Operations: publishing, infra & tooling
Operations: publishing, infra & tooling/backupOperations 🔒
What it is. One command that backs up the entire workspace to GitHub, committing and pushing every changed file off-machine.
What it does. On the two-part topology it runs scripts/push-all.py, which commits working-tree changes and pushes BOTH the engine clone and the data overlay to their private origin/main, with a pre-push secret scan and an ahead/behind [0 0] verification (a bare push can silently leave a ref behind). It reads GH_TOKEN from the engine .env, refuses to push any tracked secret-like file (.env, .session, cookies.json), and never pushes the rebuildable .memory-index/. On an exec workspace it is exec-aware and pushes only the writable data overlay, skipping the read-only engine clone.
How to use it. Use to save the whole workspace to GitHub. To publish content to executives use /publish-corporate; for a full versioned fleet push with CRM aggregate use /push-updates.
/backup
python scripts/push-all.py --dry-run # show what would happen, change nothingCustomize. Set GH_TOKEN in the engine .env; message via -m "msg"; --no-commit pushes existing commits only. disable-model-invocation: true keeps it slash-command-only. Never pass --no-verify.
/sync [pull|backup]Operations 🔒
What it is. Manually syncs the workspace with plain git: pulls the latest code and data, then backs it up. This replaced the retired copy-and-orphan-delete sync engine.
What it does. Pull runs git pull --ff-only on the engine clone and the data overlay (fast-forward only, so a divergent history surfaces as a plain error), and on exec workspaces refreshes the gitignored .corporate-repo/ via scripts/sync-corporate.py (a no-op on the CEO workspace). Backup runs scripts/push-all.py with its secret scan and [0 0] ahead/behind verification. There is no orphan-deletion step.
How to use it. Use to pull updates or back up between sessions. To publish corporate changes out to all execs use /push-updates; for a backup alone use /backup.
/sync
/sync pull # git pull --ff-only only
/sync backup # push-all.py onlyCustomize. Data root resolves from the .heading-os-data sibling or the HEADING_OS_DATA env var; auth from GH_TOKEN in the engine .env. Explicit-invocation-only. Never force-push or pass --no-verify to work around a failed gate.
/push-updates [summary]Operations 🔒
What it is. The single CEO command that ships all workspace changes to every executive through the corporate repo, with build versioning.
What it does. It verifies the admin role, runs a routing-regression soft gate, then commits ceo-main; publishes corporate-classified files via scripts/publish-corporate.py --copy (classification from config/routing-map.yaml, content-only, never engine code); bumps BUILD.json and updates VERSION/CHANGELOG.md; pushes the corporate repo and ceo-main to origin/main; rides CRM changes on the data overlay via push-all.py; and refreshes CRM Central via aggregate-crm.py. The hand-typed file list is forbidden (a broken build shipped that way); the script is the single source of truth. Execs receive updates on their next plain git pull.
How to use it. Use to propagate shared updates to the whole fleet. For a personal GitHub backup of ceo-main only use /backup; to publish corporate files without the full CRM and versioning tail use /publish-corporate.
/push-updates "New competitor-intel skill, updated Q2 strategy"Customize. File classification lives in config/routing-map.yaml (add a rule rather than working around the script). CEO-only via the admin role in .workspace-identity.json; disable-model-invocation: true. Version bump (PATCH vs MINOR) is confirmed interactively.
/publish-corporate [description]Operations 🔒
What it is. CEO-only targeted publisher: copies corporate-classified content from the data overlay to the corporate repo and pushes, so execs pull it with plain git pull.
What it does. It verifies the admin role, identifies the files to publish (routing destination corporate per config/routing-map.yaml: datastore, knowledge/shared/, context carve-outs, CRM config, corporate daemon config), runs a critical-leak scan via scripts/sanitize-check.py, previews the set for confirmation, then copies preserving directory structure, commits, pushes, and bumps the corporate VERSION/CHANGELOG.md PATCH. A hard safety check blocks personal content (personal-info, people, crm/contacts/*, outputs/*, threads/, .env) even if misclassified.
How to use it. Use for selective targeted publishing. For a full versioned push including BUILD.json and CRM aggregate use /push-updates; for a personal workspace backup use /backup.
/publish-corporate "Updated a competing vendor competitive document"Customize. Classification input is config/routing-map.yaml; run scripts/publish-corporate.py --preview|--copy|--verify. CEO-only via admin role in .workspace-identity.json; disable-model-invocation: true.
/promote-corporate [--force] [--dry-run]Operations 🔒
What it is. CEO-only staged-rollout gate: fast-forward merges the corporate staging branch to main after canary validation, so all execs receive a soaked build.
What it does. It runs scripts/promote-corporate.py --dry-run to print the gate report (canary slug, staging tip, soak hours), then enforces the soak (at least 4 hours since the latest staging commit), canary-freshness, and smoke gates plus an advisory eval status. On CEO go-ahead it does git checkout main && git merge origin/staging --ff-only && git push origin main. The fast-forward preserves staging's BUILD.json verbatim: promote never bumps the build. Blocking gates require the CEO to type the failing flag name to force.
How to use it. Use to promote a soaked staging build to all execs. For a routine publish use /push-updates; to undo a bad build use /rollback-corporate.
/promote-corporate --dry-run # gate report, no merge
/promote-corporateCustomize. A canary exec must be flagged canary: true in config/exec-registry.json. CEO-only via admin role in .workspace-identity.json; disable-model-invocation: true. Never rebase/squash-merge (breaks rollback's HEAD-revert semantics).
/rollback-corporate [--dry-run]Operations 🔒
What it is. CEO-only safety net: rolls the corporate main branch back to the previous BUILD when a published build broke something the canary missed.
What it does. It previews via scripts/rollback-corporate.py --dry-run (current build and the HEAD~1 target), then does git revert --no-edit HEAD && git push origin main: a forward revert, not a hard reset, so no history is rewritten and branch protection on main holds. It fails closed and refuses when HEAD~1 does not carry the previous build (a multi-commit publish would not restore correctly). The bad commit stays on staging for investigation, never re-propagated. Execs pull the reverted state on their next sync.
How to use it. Use only when a published corporate build broke something the canary missed. For a routine publish use /push-updates; for the promote-to-main gate use /promote-corporate.
/rollback-corporate --dry-run
/rollback-corporateCustomize. Assumes the prior promote was --ff-only. CEO-only via admin role in .workspace-identity.json; disable-model-invocation: true. Never hard-reset and force-push main.
/playwright [url] [action]Operations
What it is. Real headless browser automation: screenshots, scraping JS-rendered pages, form filling, PDF generation, website monitoring, plus YouTube content extraction (title, description, chapters, full transcript).
What it does. It shells to .claude/skills/playwright/scripts/pw.py with subcommands (screenshot, extract, fill, click, pdf, youtube, monitor, batch-screenshots, execute), backed by Playwright/Chromium plus yt-dlp and youtube-transcript-api for the YouTube path. Outputs auto-place under the data overlay's browser/ tree via get_outputs_dir(). It auto-loads authenticated sessions from outputs/browser/cookies.json. The youtube subcommand requires the VPN pre-flight, since datacenter IPs are blocked for transcripts.
How to use it. Use when a task needs a real browser or YouTube understanding. For simple URL fetching use WebFetch; to import auth cookies first use /setup-browser-cookies.
/playwright screenshot "https://example.com"
"what's in this YouTube video: https://youtu.be/VIDEO_ID"Customize. Common flags: --headed, --device, --full-page, --wait-for, -o. YouTube cookie source via --browser brave:ClaudeCode or --cookies file.txt. Never submit a form on the CEO's behalf without explicit approval, and never store scraped cookies or tokens in a tracked file.
/ast-grep [search-query-or-pattern]Operations
What it is. Structural code search: translates a plain-language query into ast-grep AST patterns or YAML rules and runs them, finding code by structure (node kind, has/inside relations) rather than text.
What it does. It writes a small example snippet, drafts an ast-grep rule (using kind, relational has/inside with stopBy: end, and composite all/any/not), verifies the rule against the snippet with ast-grep scan --stdin, then searches the codebase via ast-grep run --pattern or ast-grep scan --rule. It never reports matches from an unverified rule. Search-only by default: structural rewrites (--update-all) require explicit approval.
How to use it. Use for structural code search across a codebase. For plain text or filename matching use Grep; for a semantic "what does this do" question just answer it.
/ast-grep find all async functions with no try-catch
ast-grep run --pattern 'console.log($ARG)' --lang javascript .Customize. No config knobs. Rule syntax and CLI recipes live in the skill's references/rule_reference.md and references/cli-cookbook.md. Requires the ast-grep (sg) binary on PATH.
/context7 [library] [query]Operations
What it is. Fetches live, version-specific library documentation from the Context7 API, formatted for accurate API reference and code validation instead of relying on training data.
What it does. It parses the input (first word is the library, the rest is the query) and calls scripts/context7.py, which hits the Context7 REST API and returns authoritative docs. Flags: --list (matching libraries without fetching), --version (pin a version), --json, --limit (cap token count). The API works without a key at lower rate limits.
How to use it. Use when writing or validating code against an external library and you need current docs. For general web research use /osint; for workspace notes use /zk. A namespaced plugin context7:context7 also exists; the bare /context7 resolves to this local skill.
/context7 nextjs app router middleware
/context7 react hooks --version v18Customize. Set CONTEXT7_API_KEY (format ctx7sk-...) in the workspace .env; a free key comes from the Context7 dashboard.
/setup-browser-cookies [domain]Operations
What it is. Imports logged-in cookies from a real Chromium-family browser (Brave, Chrome, Chromium, Edge) into the workspace cookie store, so Playwright and headless sessions reuse the authenticated session.
What it does. It drives scripts/utils/chromium_cookies.py, which decrypts a domain's cookies directly from the browser profile DB (DPAPI on Windows, libsecret on Linux, Keychain on macOS) per profile, then converts the {name: value} map into Playwright cookie objects and merges them into outputs/browser/cookies.json (preserving other domains). It reports only domain names and counts, never cookie values, and never commits or transmits the store.
How to use it. Use before QA-testing or scraping pages that require an authenticated session. For the browser automation itself use /playwright, which auto-loads the resulting cookie store.
/setup-browser-cookies github.com
"import cookies for dashboard.example.com from brave"Customize. Browser via --browser brave|chrome|chromium|edge (default brave); profile via --profile ClaudeCode (default). The cookie store is gitignored and on the secret-scan allow-list. Chrome M127+ app-bound (v20) encryption falls back to yt-dlp --cookies-from-browser.
/skill-creator [create|improve|eval|optimize]Operations 🔒
What it is. Authors new skills and iteratively improves, evaluates, and optimizes existing ones: draft the SKILL.md, run test prompts, evaluate results, rewrite, repeat.
What it does. It captures intent, drafts the SKILL.md against the Anthropic spec (including the namespaced x-heading-orchestration workspace extension), saves realistic test prompts to evals/evals.json, runs with-skill and baseline runs, drafts assertions, grades and aggregates, and renders results via eval-viewer/generate_review.py. It also optimizes the description frontmatter (the primary triggering mechanism) through a train/test loop, and can package the skill into a .skill file where the tooling is available.
How to use it. Use to author or refine a skill directly (CEO). Executives who want a new skill instead use /request-skill to email the request to the CEO.
/skill-creator create
/skill-creator improveCustomize. Eval schemas and grading contracts live in the skill's references/ and agents/ files; grading.json expectations must use the exact text/passed/evidence fields the viewer depends on. disable-model-invocation: true.
/request-skill [description]Operations 🔒
What it is. Lets an executive request a new skill from the CEO: captures what it should do, a use case, and expected output, then emails the request to the admin.
What it does. If the description is vague it asks three focused questions, reads .workspace-identity.json and the requester's personal context for name and title, composes an HTML request email, shows it for confirmation, then sends it via scripts/send-email.py to the hardcoded CEO address. If an existing skill already covers the request, it points the user to that skill instead of sending.
How to use it. Use when you need a capability the workspace does not have yet. Building or editing skills directly is the CEO-only /skill-creator.
/request-skill "draft weekly one-page status memos from my CRM activity"Customize. Recipient is hardcoded to the CEO address (not user-editable). disable-model-invocation: true. Outbound send stays human-gated (confirmation before sending).
/setup-wizardOperations 🔒
What it is. Interactive per-question setup that personalizes a fresh workspace: about 22 questions for a public HEADING OS clone, or 9 for a 31C exec, enriching short answers into full voice, personal, and business docs.
What it does. It calls scripts/apply-wizard-answers.py --status to detect the audience and completion state (aborting on the CEO master), then walks each pending question, delivering prompt/example/help text from the status rows. For rich questions it drafts a full 200-400 word doc for approval; for secret questions it captures API keys into .env with optional live-ping validation via wizard-verify-key.py. All writes go through the apply script, never direct edits. Re-runs render a completion-percent dashboard for editing individual answers.
How to use it. Use on a newly provisioned exec workspace or a public HEADING OS clone to personalize it, or re-run anytime to edit answers. Not for the CEO master workspace, which it refuses.
/setup-wizard
"finish my setup"Customize. Question bank content comes from the status rows (never read the YAML directly). disable-model-invocation: true; the CEO-master abort is not overridable by end users. API keys captured land in .env.
/event-debrief [event name]Operations
What it is. Turns raw event notes and business cards into a structured post-event recap after a conference, summit, or VIP engagement: leads, meetings, competitive intel, market signals, lessons, and action items.
What it does. It reads the pipeline, people, and strategy context, then produces a 10-section debrief (executive summary, leads table, meetings held, competitive intelligence, market signals, what worked, what to improve, action items with owners and deadlines, plus pipeline and people update recommendations). Afterward it offers to log a CRM interaction for each contact met and to create CRM files for hot or warm leads via /crm add. Marked parallel_safe: partial: the research phase parallelizes, CRM writes stay sequential and post-approval.
How to use it. Use after an event to capture outcomes before they decay. To then send follow-ups to everyone met, use /follow-up or the Post-Event compound pattern.
/event-debrief MWC 2026
"debrief the partner summit"Customize. Feeds the orchestrator's Post-Event Follow-ups pattern when mass follow-ups are needed. No config flags.
/interview-prep [position] [level]Operations
What it is. Builds a complete interview kit for a role: a 20-question bank, a 1-5 scoring rubric, and a post-interview scorecard aligned to the 31C Five Core Principles.
What it does. It reads the business, hiring-playbook, operational-state, and voice references, then generates a role-specific question bank (warm-up, technical, Five Core Principles behavioral, culture, candidate questions), a category-by-category 1-5 rubric with a minimum-3 threshold and automatic no-hire on any 1, and a scorecard template with an overall recommendation line. Output is returned inline, ready for any interviewer on the Tribe.
How to use it. Use when preparing to interview a candidate or building a hiring evaluation framework. For general research on a person use /osint.
/interview-prep "Senior DPI Engineer" senior
"build me a hiring framework for a mid-level SDR"Customize. Level accepts junior, mid, senior, or leadership. No config flags; the standard follows the 31C hiring bar baked into the skill.
/zk [add|enrich|find|connect|distill|garden|stats|brief] [target]Operations
What it is. A Zettelkasten second-brain manager over the knowledge/ tree (shared with Zettlr): add atomic notes, enrich, find, connect, distill skill outputs into durable notes, garden for orphans and stale seeds, stats, and topic briefs.
What it does. It dispatches by subcommand: add creates a timestamped atomic note by type into the brain subtree; enrich researches a note and upgrades its seed to growing to evergreen status; connect adds bidirectional wiki-links; distill extracts 3-7 durable insights from an output file; garden and stats run scripts/odin-brain-health.py to surface stale seeds, orphans, and broken links and regenerate INDEX.md; brief synthesizes a topic into a what-we-know / think / watch narrative. Every generated note is validated with scripts/sanitize-text.py for hidden characters.
How to use it. This is the primary capture tool for the executive fleet. On the CEO workspace /zk is dormant: durable CEO capture flows to /odin log, /thread, and auto-memory instead.
/zk add signal
/zk distill outputs/intel/osint/example/brief.md
"what do we know about sovereign DPI"Customize. Paths resolve by workspace type (flat knowledge/ on CEO, tiered personal/knowledge/ plus corporate/knowledge/shared/ on execs). Corporate-classified notes get a rule in config/routing-map.yaml. Frontmatter follows Zettlr conventions (keywords, [[ID|Label]] links).
/mullvad [connect <1|2|3>]Operations
What it is. Benchmarks Mullvad WireGuard relays by real ICMP latency from this host, presents the three fastest as a numbered menu, and connects to whichever one you select, verifying the tunnel is up.
What it does. It preflights the Mullvad CLI and daemon, detects the current connection (warning that pinging through an active tunnel biases results and offering to disconnect first), runs scripts/mullvad-fastest.py --owned-only to measure Europe and Middle East relays, and reads the saved JSON for the sorted top three (with a [DAITA] marker where applicable). On selection it runs mullvad relay set location <hostname> then mullvad connect, polls status up to 15 times, and reports the live visible location and IPv4.
How to use it. Use to find and switch to the fastest Mullvad relay. For general VPN questions or Mullvad help pages use WebFetch; for the YouTube/Google residential-exit need use Proton, not Mullvad.
/mullvad
connect 2Customize. Owned-only (provider 31173/Blix) is the default; region defaults to EU plus Middle East. Never silently pick a relay: every connect requires explicit selection. Never write account numbers, session tokens, or exit IPs to shared files.
/modem-tune [status | revert]Operations 🔒
What it is. Changes the reported IMEI on the configured GL.iNet GL-XE300 travel router over SSH for work testing, generating a fresh never-reused value, staging it, then resetting and verifying it live.
What it does. All mechanics live in scripts/modem-tune.py; the skill is the conversational wrapper that owns the reset confirmation gate. It runs status (live IMEI, SIM, network, signal), generate (a valid unique device-class IMEI), apply (records the outgoing IMEI to the ledger with a timestamp before sending AT+EGMR), a hard confirmation gate before reset (full router reboot, roughly 2-3 minutes of downtime), and verify. It is dormant on any instance without its own private config/modem.json. SSH credentials load from .env.
How to use it. Use to rotate or check the router IMEI for work testing. There is no alternative skill: it is the sole owner of the IMEI ledger. Run /modem-tune status for a read-only check.
/modem-tune status
/modem-tuneCustomize. Device identity in config/modem.json; SSH via MODEM_HOST, MODEM_USER, MODEM_SSH_PASSWORD in .env. disable-model-invocation: true. Never reboot without the confirmation gate, never reuse an IMEI, and never document this tool or its credentials in corporate or exec-facing files.