/goal ./scripts/verify.sh exits 0, .ai/spec-tdd/state.json phase is done, frozen tests and acceptance gates are unchanged, no tests are skipped/weakened, and no TODO/stub/hardcoded test-only implementation remains; or stop after 20 turns with a clear blocked report
Scan the dependencies of [authorized project or current repository] for known CVEs using current advisory sources. If you cannot access the dependency graph, repository, or current advisories, report the blocker and stop. For each high or critical finding, identify the affected direct or transitive dependency, determine whether the vulnerable code is reachable, and check whether the exploit conditions exist in this project. Rank findings by severity, reachability, exposure, and available remediation. Patch or upgrade the highest-risk reachable dependency using the smallest credible change. Run the build, tests, and security scan again. Keep the change only if verification passes and no unacceptable regression appears. Repeat until no exploitable high or critical CVE remains, or every remaining finding has an evidence-backed reachability assessment and an approved risk decision. Ask before major or breaking upgrades, production changes, or accepting risk. Finish with the CVE inventory, reachability evidence, fixes, verification results, and remaining risks.
Reduce the data [web app] downloads before its first screen appears. First record passing tests, mobile and desktop screenshots, and compressed transferred bytes—the data actually downloaded. Use the build report only to suggest candidates. Defer, compress, or remove one item, then rebuild and rerun every check. Keep it only if tests pass, screenshots are pixel-identical, and bytes decrease; otherwise revert. Stop when no safe candidate remains, progress stalls, or approval is needed. Return measurements, changes, and untested states.
Move the project to the current Node LTS across .nvmrc, CI config, Dockerfiles, and engines, fixing deprecations until everything is green on the new runtime.
/goal the project runs on the current Node LTS — update .nvmrc, the engines field, CI workflow files, and any Dockerfile base images to the LTS version, then run install, build, lint, and the full test suite on it, fixing deprecation warnings and breakages one at a time; stop when all are green or after 15 turns
Work a triaged bug list one fix per fresh-context iteration: reproduce first, fix minimally, prove it with a regression test, and log root-cause patterns to guardrails.
/loop fresh context each iteration: read bugs.json and .ralph/guardrails.md, take the top open bug, write a failing test that reproduces it before touching any code, then apply the smallest fix that makes the test pass with the rest of the suite green, and mark the bug fixed; if you cannot reproduce it, mark it needs-info with your findings instead; append recurring root-cause patterns to .ralph/guardrails.md; stop when bugs.json is clear or after 25 turns
Break a large refactor into a JSON backlog of modules and let fresh-context iterations convert one module per pass, with guardrails capturing every pattern decision so the result stays consistent.
/loop fresh context each iteration: read refactor-plan.json and .ralph/guardrails.md, take the next module not marked converted, migrate it to the target pattern described in PROMPT.md, run tests and typecheck, and mark it converted only when green; record every convention decision you make (naming, file layout, error handling) in .ralph/guardrails.md so later modules match earlier ones; stop when all modules are converted or after 30 turns
Iterate over a prioritized list of untested modules with fresh context each pass, writing real behavioral tests for one module at a time and banking lessons in a guardrails file.
/loop each iteration with fresh context: read .ralph/test-backlog.json and .ralph/guardrails.md, pick the top unfinished module, write behavioral tests for its public API (no snapshot-only tests), run the suite, and mark the module done only when its tests pass and coverage for it exceeds 80%; append any discovered testing gotcha (fixtures, mocking rules, async traps) to .ralph/guardrails.md; stop when the backlog is empty or after 25 turns
/goal every path in openapi.yaml has a contract test asserting its status codes and response schema — add tests for one untested endpoint per turn, run the suite, and fix either the spec or the handler when they disagree (tell me which you chose); stop when all paths are covered or after 15 turns
Shrink the production JavaScript bundle under a hard budget by attacking the largest modules with code-splitting, lighter imports, and dead-weight removal.
/goal the main production bundle is under 250 KB gzipped — run the build with the bundle analyzer, address the single largest contributor each turn (code-split it, replace it with a lighter import, or drop it), and confirm the build and tests stay green; stop at the budget or after 10 turns
Instrument the test suite with query logging, find endpoints issuing N+1 queries, and fix them with eager loading or batching until the hot paths are clean.
/goal no endpoint in the integration test suite issues more than 10 SQL queries per request — enable query logging in the test environment, find the worst N+1 offender, fix it with eager loading or a batched query, verify the count dropped and tests still pass, then move to the next; stop after 12 turns
Email is the missing tool in your harness. ConnectMyEmail gives Claude Code and Codex a clean MCP into Gmail, iCloud and IMAP — triage, drafts, follow-ups, on a loop.
/goal `npm outdated` lists no minor or patch updates — upgrade exactly one package per turn, run tests, lint, and build after each, commit if green, and pin the previous version with a note in UPGRADE-BLOCKERS.md if it fails; stop after 20 turns
A Ralph-style loop that writes its own rules: when a check fails the same way twice, the failure pattern gets appended to a guardrails file that every later iteration reads first.
/loop read .ralph/guardrails.md before doing anything, then run the full check suite and fix the first failure; if a check fails twice with the same error, append the failure pattern and a one-line rule for avoiding it to .ralph/guardrails.md before retrying; stop when all checks pass or after 15 turns
/goal the recent diff is clean and convention-aligned — review it for debug code, dead branches, and bad names, fix with minimal edits until `npm run lint && npm test` passes; stop after 4 turns
/goal a PR is open for this change and every CI check passes — implement it, test locally, push, open the PR with `gh pr create`, then keep fixing failures (re-check with `gh pr checks`) until green; stop after 10 turns