claude-jacked — Best-in-Class Upgrade Research

Already covers the core ergonomics surface well: consistent resource naming, HTTP-method semantics, structured errors with machine code + human message, consistent pagination, uniform filter/sort, partial responses/field selection, explicit versioning, 401-vs-403 distinction, rate-limit headers, and self-describing schemas. The anti-pattern list is strong and field-tested (200-with-error-body, deep nesting >2 levels, multi-call data that belongs together, breaking changes without version bump, GET with side effects, exposing internal IDs). 'Pick one and be consistent' framing for naming/pagination/filtering matches industry consensus. Scope and trigger list are sound.

Tight, technique-dense, and well-structured in the repo's lens format (What to check / Common anti-patterns / When to apply). Already covers the durable AA fundamentals correctly: contrast ratios (4.5:1 / 3:1), keyboard access + focus indicators, label association (not placeholder-as-label), alt text incl. empty alt for decorative, 'don't sprinkle ARIA', error announcement, no color-alone, focus management after dynamic changes, skip link, lang attribute, unique page titles, logical heading hierarchy. Anti-patterns list is genuinely good: div-as-button, outline:none without replacement, tabindex>0, hover-only essential info, modals that don't trap focus, non-keyboard custom selects, toasts that vanish before announcement. This already matches or exceeds most generic single-file a11y rule sets.

Solid, well-scoped coverage of the fundamentals: specific exception types over bare catch-all; preserving error context on re-raise (raise ... from e); helpful user messages that don't leak internals; retry with exponential backoff AND jitter; resource cleanup via finally/context managers; error boundaries at system boundaries (API handlers, consumers, job runners); collecting validation errors together; distinguishing expected (user/network) from unexpected (bug) errors; async timeout/cancellation; and correlation ID + timestamp + error code in responses. The anti-pattern list is genuinely strong and matches field consensus: silent swallow, log-but-return-success, exceptions-for-flow-control, retrying non-idempotent operations, hiding catch-all, string-matching on error messages, and missing timeouts on external calls. These map cleanly onto the GitHub Copilot review guide and the basics every source agrees on.

Ours is genuinely differentiated and best-in-class on several axes the field's checklists do NOT match: (1) Measure-driven truth — measure.js computes type-scale sprawl, gap dupes, top-level-sibling edge misalignment, tabular-num currency, contrast ratios, ragged wraps, page-scroll/overflow/clipped-table detection in-browser, so a screen passes only when the measure is clean AND the shot passes — far more rigorous than the eyeball-plus-checklist competitors. (2) Exhaustive crawl discipline — every route from router config (not just nav), EVERY persona with the explicit 'never audit as admin alone / RBAC-gated UI' rule, every state/expandable/modal/dark+light, list->detail link-following. Most competitors visit '5-8 pages from homepage'. (3) A best-in-class false-positive section that competitors largely lack: resize_page clamps to physical display (read innerWidth after every resize), fullPage clips right edge, modal z-index overlaps are false positives, in-container overflow-x scroll is fine vs page-scroll/clipped-parent is a defect, white-on-dark is correct, padding-inset children aren't misaligned, grep-a-class is noisy so verify computed style on the rendered element. (4) Fix-at-source doctrine (one token/theme-class/component change cascades; outline not box-shadow for focus rings so overflow-hidden doesn't clip). (5) Crisp differentiation vs /qa and /ux. These are real, hard-won, and must not regress.

Ours is already well-scoped and matches the field on its core job. It covers the four checks most articles lead with: Duplicates (semantic, not just exact match), Contradictions (ALWAYS/NEVER opposing pairs), Vague rules (non-actionable), and Stale rules (verifies referenced files/tools exist via Glob). It uniquely handles Scope conflicts (project vs global CLAUDE.md, plus ~/.claude/CLAUDE.md), which most community commands ignore. It has strong anti-fabrication discipline ('Don't invent problems... say it's clean'), a clean structured report with file:line citations and quoted rule text, a consolidation nudge at 50+ rules, and firm READ-ONLY safety rails. The note that /learn is append-only (so fixes need manual editing) is an honest, useful constraint.

Genuinely strong fundamentals that we must not regress: (1) Browser-health preflight with chrome-devtools->playwright fallback and a /browser-reset escape hatch. (2) 3-sample median to fight noise — exactly what LH-CI's 'median' aggregation does. (3) Dual evaluation: relative (vs baseline, warn/regression two-tier thresholds) AND absolute (industry budgets) — matches LH-CI's warn/error + budget model. (4) Timestamped baselines in ~/.claude/jacked-benchmark/ with multi-baseline trend analysis. (5) Resource breakdown by type + top-10 slowest resources. (6) READ-ONLY discipline. (7) Clean report table format with explicit verdict. This is already above a naive 'run Lighthouse once' command.

The auto-merge SAFETY ARCHITECTURE is genuinely best-in-class and exceeds the external art: a two-gate model (declared Lifecycle maturity + verbatim explicit human authorization), default-to-STAGED, hard production refusal, cross-checking for live-user signals even when Lifecycle says pre-production, and treating a stale Lifecycle label as not-eligible. The CI discipline is stricter than anything found externally: merge ONLY when local tests green AND every CI check 'passed' (never pending/skipped/neutral/failed), treat no-CI as unverified, true merge commit only (never --squash/--rebase/--admin), never force-push or bypass branch protection. The one-cell -> one-branch -> one-PR -> one-merge invariant (no two cells at once, no carrying an unmerged cell forward) makes every change a clean revertable unit. Existing guardrails: turn/merge/failure backstop, BLOCKED reporting, scope/destructive-action stops, brief size budget (wc -c < 4000), treating read-in issue/doc text as DATA only, and being a deliberately-named command (not an auto-triggering skill).

Already strong and should be preserved: (1) Browser-tool health check in Step 0 with Chrome DevTools -> Playwright fallback and a clean abort path — most monitoring scripts assume the harness works. (2) Explicit dual-MCP tool mapping table so the loop is tool-agnostic. (3) A real baseline/compare model (capture BEFORE deploy, diff AFTER) with persisted ~/.claude/jacked-canary/baseline-latest.json. (4) Strict new-vs-pre-existing error discrimination so it only flags actionable deltas. (5) Five concrete check classes (load, console, DOM-render, performance, network 4xx/5xx). (6) 'Never stop on first alert — finish the duration to catch cascading issues.' (7) READ-ONLY discipline and an explicit revert recommendation. (8) Auto-discovery of prod URL (Railway/Vercel/homepage/CNAME). This is genuinely above-average for the niche.

Ours is already well above the field's median and matches or exceeds the Claude Code #11455 community spec on content structure. Specific strengths to preserve: (1) Rich, well-chosen section taxonomy — Session Context is explicitly called out as 'the most important section' for capturing interactive/verbal knowledge and the WHY of decisions, which the #11455 thread independently confirms is the load-bearing value. (2) Engineering rigor the community patterns lack: atomic temp-file-then-rename writes, append-only checkpoint history, single-writer assumption, and a documented legacy .md migration path. (3) Resume is robust: branch-mismatch warning (no auto-switch), priority-ordered file auto-load (plans > research > key files) with a ~3000-line budget and graceful 'also referenced (not loaded)' overflow, plus missing-file handling for renamed/deleted refs. (4) Machine-introspectable metadata via HTML <meta> tags (status/branch/timestamp/plans/research/lenses) enabling list/resume/complete without a DB. (5) active_lenses tracking and separated HTML research files — both go beyond the flat single-file approach Cline/Amp/#11455 use.

Our skill is structurally more rigorous than almost everything published. Keep/protect: (1) The two-axis Quality(50)+Efficiency(50) scoring rubric with letter grades — no external source has a comparable audit instrument. (2) The KEEP/EXTRACT/DEDUPE/DELETE per-section classification framework with explicit lists of what belongs in each bucket. (3) Report-BEFORE-changes discipline (Phase 5 output gate) — prevents destructive trimming. (4) Strong-pointer language patterns WITH explicit weak-pointer anti-patterns ('See X for details' gets ignored) — this is genuinely ahead of the field. (5) The doc-chain hierarchy concept (always / when-area / task-specific) with a verify phase that runs executable checks for missing references and weak pointers. (6) The 'restructure, don't trim' principle (size-tiered line budgets) and the named restructure patterns (Everything-In-One-File, Weak-Pointers, Duplicated-Tables, Stale-Reference, No-Doc-Chain). None of this should regress.

Ours is already a well-shaped, mature simplicity reviewer. Clear core principles (simplicity-first, human readability as prose, future-ready without over-engineering). A real review process: focus on recent changes, named simplification levers (combine parameterized fns, prefer stdlib/built-ins, guard clauses + early returns + lookup tables, remove intermediate transforms, async over callback chains), and SOLID/duplication/control-flow checks. Good trade-off discipline (acknowledges when complexity is justified, never sacrifices correctness/type-safety/error-handling for brevity). Strong communication norms (constructive, before/after snippets, lead with what's good, explicit 'if it's already good, say so'). A concrete output template with prioritized sections. This already covers the substance of hamy.xyz's Agent 9 and exceeds it on before/after-snippet rigor and trade-off nuance.

The dual-axis capability-vs-experience model is a genuine differentiator — nothing in the surveyed Claude Code PM ecosystem or the classic frameworks (RICE, OST, JTBD) collects 'experienced workflow' evidence the way our required Experience Walkthrough stream does (click-cost of the core loop, lifecycle visibility, metric honesty / counters-with-zero-writers, lying success states, repeated-context cost). The hard rule that feature-inventory evidence caps a cell at 7 and 8+ requires walkthrough evidence is a strong, original anti-over-scoring guardrail. The Roles × Domains INTERSECTION framing (vs a flat feature list) correctly captures combinatorial gaps that a 1-D backlog misses. Cross-cutting levers ranked by cells-lifted-per-effort is exactly the right ROI lens. Mandatory source-URL tracking + competitor profiles with clickable links + inline superscript citations is more rigorous than the ecosystem norm. The self-contained dark-theme HTML heatmap + PDF export is a polished, presentable deliverable. The Red Flags and Rationalizations tables are excellent self-correction scaffolding. Do not regress any of these.

cso is already strong and largely matches the field. It has: an explicit 8/10+ confidence gate; a mandatory concrete exploit scenario per finding ('an attacker could...'); a thorough 17-category false-positive exclusion list (broader than Anthropic's ~5 hard exclusions); full OWASP Top 10 walk-through (A01-A10) with stack-specific grep patterns; a STRIDE threat model focused on the 3-5 most critical data flows; multi-mode scoping (--diff/--code/--infra/--supply-chain/--owasp/--skills); tech-stack detection, attack-surface census, git-history secret scan, and dependency audit phases; a clean structured Security Posture Report format; and hard READ-ONLY guarantees with node_modules/vendor/dist exclusions. The --skills mode (auditing Claude Code skills/commands for prompt injection) is ahead of the official tool, which has no equivalent. The phased pipeline (detect stack -> map surface -> scan history -> deps -> OWASP -> STRIDE -> report) is more structured than Anthropic's diff-only command.

Solid, well-scoped checklist that already covers most of the durable fundamentals: NOT NULL discipline, FK ON DELETE behavior, indexes for WHERE/JOIN/ORDER BY, composite-index selectivity order, DECIMAL/integer-cents for money, timestamptz over timestamp, string enums over magic ints, unique constraints, created_at/updated_at, and key anti-patterns (NOT NULL-without-default on a populated table, missing FK indexes, unindexed LIKE '%x%', N+1 lazy loading, JSON blobs vs normalized columns, runaway cascade deletes, non-idempotent migrations). It also already names backward-compatible/rollback-safe migrations and batched updates to avoid locking — so the conceptual frame is right; what it lacks is the specific Postgres operational mechanics the field now treats as table stakes.

Ours already exceeds the field on several axes worth protecting from regression: (1) PHASE AUTO-DETECTION (planning / implementation / post-impl / grill) with an explicit AMBIGUOUS->ask-don't-guess fallback — HAMY and others review a static diff only; (2) the PRE-MORTEM ANALYST agent that ASSUMES FAILURE HAS HAPPENED and works backward, with a rotating bank of operational/design/integration scenarios — no comparable command has this, and it is a genuine differentiator that catches a different bug class than structural review; (3) interactive GRILL MODE (one Socratic question at a time, push on weak answers) — unique; (4) the findings -> writing-plans -> review-the-fix-plan -> wait-for-approval pipeline for impl phase (does NOT blindly auto-fix code); (5) the recursive STOP CONDITION where ANY fix resets the pass tracker and forces a full fresh re-review (not just verify-the-fix); (6) deep PRE-REVIEW CONTEXT DISCOVERY across CLAUDE.md/AGENTS.md/.cursorrules/ADRs/design docs in both .md and .html; (7) an 11-lens taxonomy that already includes Observability and Data-Integrity/Schema-Safety lenses HAMY lacks as first-class items.

Ours already exceeds every external source on the hardest parts and must not regress: (1) RECURSIVE review-until-clean loop with fix-then-re-verify waves — neither Anthropic's nor hamy's command re-checks that a fix actually worked or introduced regressions; ours mandates a fresh full re-review of each failed lens plus verification of prior fixes, and a hard 'do NOT stop early / do NOT ask should-I-continue' rule. (2) Structural randomness for genuine coverage diversity: shuffled personas, wild cards, and a one-shot Pre-Mortem Analyst that assumes-failure-and-works-backward (a reframing none of the external commands have). (3) Lens-PAIRING (2 lenses per reviewer, depth over breadth) plus relevance-based lens SELECTION with announced reasoning, vs the field's fixed agent roster. (4) Phase detection (PLANNING/IMPLEMENTATION/POST-IMPLEMENTATION) and full plan-mode support where the parent edits the plan file. (5) Pluggable specialist lenses from ~/.claude/lenses with trigger matching and project-override. (6) Read-only reviewers + single sequential holistic fix phase by the parent — cleaner than parallel editors and lets the parent see cross-cutting concerns. (7) Conditional frontend-design reviewer and UX discoverability sub-checklist. (8) Repo-config acceleration via /jacked-setup. Already carries severity tiers (CRITICAL/MEDIUM/LOW) with LOW non-blocking, and already scans CLAUDE.md/AGENTS.md/.cursorrules/.windsurfrules for context — matching the field's context-discovery step.

Genuinely strong on single-process Python defensive coding and already matches or exceeds the field on those axes: None/NoneType guards, getattr-with-default, dict.get vs KeyError, guarding iteration over None/empty, fail-fast input validation at boundaries, a clean custom exception hierarchy (base AppError + specific subclasses), no-bare-except-without-reraise, retries with exponential backoff + jitter, mandatory timeouts (no infinite waits), idempotency mentioned, context managers for resources, the mutable-default-argument trap, structured logging, no leaking sensitive data, and a concrete review process with critical/high/medium/low priority ranking and per-finding fix examples. The four-pass review structure and explicit prioritized output format are better than most community 'error handling' subagents, which are vague prompt blobs.

Best-in-class on the hard, non-obvious traps that actually eat hours: NIXPACKS can't provision bleeding-edge Node (set NIXPACKS_NODE_VERSION); npm 11 vs npm 10 lockfile optional-dep skew on `npm ci`; RLS bypass via the superuser ${{ Postgres.DATABASE_URL }} (the single best security insight here — most guides get this wrong); app-role password rotation in the migrator pre-deploy step; 'Unauthorized that actually succeeded' CLI behavior with re-verify-via-service-list; MCP-unauthenticated-while-CLI-authed; GitHub App authorization being a separate manual step from `add --repo`; `railway up` deploys the local dir not GitHub; and a strong verify-don't-trust loop (poll deployment status to terminal, then curl /health). Also strong: explicit service-topology decision table (monolith vs split FE/BE), reference-variable model, the bucket/S3 cred-sharing recipe, and a clean user hand-off output spec. Structure (model -> topology -> sequence -> env recipe -> storage -> auth -> gotchas -> output) is excellent and should be preserved.

Our docs-sync is already ahead of the field on rigor and should not be regressed: (1) The 3-pass verification protocol — Pass 1 update, Pass 2 cross-check 'lying detector' (verify EVERY remaining claim: file paths via ls/Read, symbols via grep, env vars, CLI flags, code examples, cross-refs), Pass 3 'fresh reader' misdirection audit — is materially more rigorous than every external tool found, all of which are single-pass. (2) The 'misdirection is worse than absence — silence is honest, wrong instructions are not' principle is a genuinely sharp idea nobody else articulates. (3) Unverifiable claims get an explicit `<!-- docs-sync: unable to verify -->` marker surfaced to the human rather than silently dropped. (4) Staleness uses git's last-commit timestamp (not filesystem mtime, which changes on checkout) with a stat fallback for untracked files — exactly the correct, non-obvious choice the field's git-age signal also lands on. (5) Parallel one-agent-per-doc dispatch with branch-driven / fresh-audit / both modes is a clean architecture. (6) Per-doc-type agent templates (README, Wiki, CLAUDE.md, generic) with type-specific scope/style constraints. (7) Strong 'What NOT to Update' carve-out (internal refactors, auto-generated docs, scratch scripts, WIP, test-only) — which the DeepDocs auto-generated-vs-narrative distinction independently validates. (8) Repo-config overlay + repo-scoped override resolution for speed. (9) Suggest-don't-auto-create for new doc gaps, and stage-don't-commit handoff.

Ours is already ahead of the public field on structure and depth. Dual-mode operation (Design Review = Principal Architect with independent research + first-principles + risk; Code Review = combined CTO+CSO) is more sophisticated than any community reference found. The multi-tenant / cross-org data-leak section is called out as CRITICAL with data-flow tracing — the VoltAgent canonical reviewer has no tenant concept at all. Domain-specific lens groups (Web/API, CLI, Data Pipelines, Libraries, Infra/DevOps) give breadth the flat community checklists lack. The /dcr lens-assignment protocol (depth-over-breadth, per-lens report structure, strict READ-ONLY discipline, footnote-only out-of-scope) is genuinely best-in-class and absent from every external source. Severity bucketing (Critical/Warning/Win, APPROVE/NEEDS CHANGES/BLOCK) and the project-context discovery fallback are solid. It also fits a strong surrounding ecosystem: /dc and /dcr dispatchers and a separate /cso skill that already owns deep OWASP Top 10 + STRIDE, so the agent correctly does not try to re-implement a full threat-model engine.

Resolves symlinks via Path.resolve() before the boundary test, so a symlink inside the frozen dir pointing outside is correctly caught (matches the official 'deny applies to target' posture). Forward-slash normalizes for Windows (matches the doc's POSIX normalization). Deterministic <1ms boundary check that runs UNCONDITIONALLY — before the gatekeeper's enabled/LLM gates — so it works even when the LLM gatekeeper is off (default). Reads/Grep/Glob/Bash-inspection stay unrestricted, which is the right scope for 'focused work'. Clean one-command UX (/freeze, /unfreeze) is lower-friction than hand-editing settings.json deny rules. The confirmation message already enumerates what's blocked vs. not — good instinct, just incomplete (see gaps).

Already covers the core lane well: change analysis/categorization via git status+diff, the <200-300 line reviewability threshold, branch-prefix conventions, one-logical-change-per-PR, a stacked-PR section with base-branch retargeting and post-merge rebase, a structured PR template, Conventional Commits type/scope/subject format, a red-flags checklist (mixing features+fixes, 'various fixes' messages, >10 files), and proactive-intervention framing. Its stacked-PR retargeting flow (open PR2 with base=feature-1, then gh pr edit --base main after PR1 merges) matches field practice. Scope is cleanly distinct from sibling agents pr-workflow-checker (post-coding state/stash/worktree triage) and issue-pr-coordinator (issue grouping/linking), so it owns authoring + splitting strategy.

Already best-in-class on the fundamentals the field converged on: (1) evidence-not-asserted DONE — 'Success is shown as evidence, never asserted' (line 47), which is precisely the verification-gap Nate's piece names. (2) Converge-in-one-run framing with the LLM-judge-reads-transcript mechanic spelled out (line 61), matching the Ralph-loop consensus. (3) Bounded backstop with a 'BLOCKED:' halt distinct from DONE, and a three-condition stop in MERGE mode (line 74) — directly the 'objective stop condition, not vibes' the overnight threads demand. (4) Per-milestone commits for resumable state; ordered independently-verifiable milestones; green-CI-gated merge with true merge commits and no protection bypass. (5) Hard 4,000-char measure-don't-eyeball gate with a file-backed pointer-goal fallback. (6) Prompt-injection hygiene (read-in content treated as DATA). (7) UI/UX polish + TDD quality bars. This already exceeds most published guidance.

Ours is genuinely strong on the dimension most of the field ignores: strategic MULTI-issue grouping into coherent PRs by component affinity, root-cause similarity, feature complementarity, and sequential dependency, with scope caps (5-7 issues/PR). Copilot and Dosu are essentially single-issue agents; ours plans a portfolio. It also has a clean structured status report format, issue->PR linking with 'Fixes #' auto-close, testing strategy differentiated by issue type (BUG reproduce-then-regression-test, FEATURE/REFACTOR/ENHANCEMENT), an explicit prioritization decision framework (critical bugs > security > blocked deps > high-value features > tech debt), a pre-merge QA checklist, and reads existing Claude plans via the has-claude-plan label. These match or exceed field practice for the planning/coordination half of the job.

jack-it-up is already a strong orchestrator and matches the field's architecture. It nails: (1) the canonical Explore->Plan->Implement->Verify->Ship loop the Anthropic docs prescribe, with a real iterate-until-clean cycle (phases 4-5 repeat until /dc passes with no CRITICAL/MEDIUM); (2) adversarial, fresh-context review delegated to /dc, which already does multi-lens review + a pre-mortem analyst + the findings-to-reviewed-fix-plan pipeline (this is best-in-class and exceeds most peer commands); (3) subagent-driven execution giving fresh context per task with two-stage (spec then quality) review and per-task TDD+commit — exactly the 'fresh context for review' / 'reviewer isn't the author' pattern Anthropic recommends; (4) explicit anti-'good enough' framing (Red Flags table, the 10/10 mindset, 'thoroughness vs scope creep' distinction) that most peer workflows lack; (5) a clear 'When NOT to use this' section matching Anthropic's 'if you could describe the diff in one sentence, skip the plan'; (6) reviewed-plan-before-execution gate (phase 3) — the planning gate the spec-driven crowd considers essential. Do not regress any of these.

Ours is the most architecturally advanced tool in the field and must not regress these: (1) TRUE SEMANTIC/vector search via Qdrant — every competitor is keyword/FTS5 only and even lists 'vector embeddings for semantic similarity' as a future wishlist item; ours already has it. (2) CROSS-MACHINE + TEAM sharing — Qdrant Cloud index surfaces teammates' sessions as @username with a YOU/@teammate distinction; no competitor does multi-user. (3) CONTENT-TYPE-AWARE indexing — separately indexes plan files (📋), subagent summaries (🤖), summary labels, and user messages, not just raw text. (4) SMART-MODE retrieval with explicit token budgeting (~5-10K vs 50-200K) to prevent context explosion — a genuine differentiator vs dumping transcripts. (5) AGE-BANDED STALENESS WARNINGS (7-30/30-90/90+ days) telling Claude how much to trust recalled code. (6) LOCAL-vs-REMOTE handling: prefers native `claude --resume` for local sessions (full memory state) and only injects context for remote ones. (7) Honest prerequisite gate that STOPs and degrades gracefully when the search extra/Qdrant isn't configured instead of silently failing.

jacked-setup is already well ahead of the public field on scope and safety. The field's prior art is almost entirely single-CLAUDE.md generators (ClaudeForge, /init); jacked-setup instead profiles the repo and emits per-command standalone files with pre-filled config, which nothing in the ecosystem does. It already nails several things the field only talks about: (1) gatekeeper-safe, bounded discovery (every find/grep uses -maxdepth/--exclude-dir); (2) credential safety (variable names only, never values, with infra-cred exclusions); (3) a floor check that refuses to generate useless config on empty repos; (4) explicit consent before overwriting existing files, with OLD_FORMAT vs STANDALONE detection; (5) a .gitignore check so teammates actually receive the files; (6) reads the engine via the Read tool at generation time rather than from memory (avoids hallucinated engine bodies); (7) a stable ## Repo Config header contract for re-runs. It also already stamps each file with generation date + engine version and documents the upgrade/re-run path. This is a mature command.

Ours already covers the core pipeline well and is competitive with the best public equivalent: identify-PR auto-detection with PR-number/skip-canary/revert arg modes; pre-merge readiness reporting (CI + reviews + mergeable); squash-by-default with clear merge-failure causes; broad platform detection (Railway/Vercel/Fly/Heroku/GH Pages/Netlify); per-platform deploy-wait with polling intervals; always-on HTTP smoke test plus a condensed single-pass canary that hands off to a dedicated /canary command for the full monitoring loop; git-revert (history-safe) revert mode; a structured deploy report; and explicit Hard Rules (never force-merge, always wait for deploy). The dedicated canary.md is notably deeper than the competitor's inline health check (baseline capture, console/DOM/perf/network deltas, new-vs-pre-existing distinction).

/learn is already well-aligned with field best practice and in several places exceeds it. It already has: (1) a graduation/promotion lifecycle (lessons.md -> permanent CLAUDE.md) that mirrors the self-improving-agent skill's promotion model; (2) explicit anti-fabrication ('do NOT invent a lesson just to have output'); (3) conflict detection with in-place merge rather than duplication; (4) generalize-the-principle extraction; (5) lead-with-ALWAYS/NEVER + lead-with-WHY + concrete-not-vague drafting rules with good/bad examples that match the mindstudio guidance; (6) machine-specific-path safety (portable references only) which most field examples omit; (7) append-only writes, 1-3 line cap, and a 50+-rule consolidation trigger (/audit-rules). This is a solid, opinionated implementation; the gaps below are additive, not corrective.

Ours is already substantially more rigorous than the closest direct competitor (latiotech's Claude Code plugin) and meets or exceeds every domain best-practice surfaced. Specifically load-bearing strengths to NOT regress: (1) per-package transitive hash verification in uv.lock (even one unhashed transitive dep = CRITICAL) — competitor only checks 'lockfile present'; (2) the corrected SHA-pinning positive-assertion regex with the documented @beta false-negative note; (3) frozen-install CI enforcement with a counter-check for non-frozen installs; (4) multi-scanner CVE coverage (pip-audit + osv-scanner + npm audit signatures) plus npm provenance verification; (5) Phase 11 release-tarball-vs-git diff (the xz-utils lesson) — competitor has no equivalent; (6) zizmor + Harden-Runner + persist-credentials + permissions block; (7) OpenSSF Scorecard integration; (8) coverage-gated 0–100 scoring that refuses 'Hardened' band when scanner coverage <90% (defeats false-sense-of-security from missing tools); (9) prompt-injection defense treating audited content as data; (10) a hard read-only safety model that NEVER mutates manifests/lockfiles so locking down repo A can't break repo B, plus the validated, opt-in --workspace blast-radius scan; (11) HIPAA mapping + paranoid tier. This is genuinely best-in-class for a deps/CI-focused audit.

Ours is a thin command (one line) that delegates to a deep `pr-workflow-checker` agent, and that agent is already ahead of the field in several ways. Phase-0 pre-flight verification (stashes, worktrees, untracked files, [gone] branches, MEMORY.md freshness) with verify-before-clean and never-auto-delete is something none of the external sources offer. It has a lint gate (ruff/eslint/clippy/go vet with auto-fix), integrates /dc and /docs-sync (auto-running docs-sync when the diff touches code/CLI/config), checks JACKED_GUARDRAILS/DESIGN_GUARDRAILS compliance, and has clean decision logic for the four branch states (uncommitted / no-commits / commits-no-PR / commits-with-PR). It reads ALL commits not just the latest, links issues aggressively with `Fixes #`, and the sibling `git-pr-workflow-manager` adds stacked-PR detection and retargeting. Its generated description (Summary / Changes / Fixed Issues / Test Plan) already matches Graphite's Purpose/Changes/Impact/Testing recommendation.

Genuinely strong and ahead of most community examples in several areas: (1) PHASE 0 pre-flight verification — stash/worktree/untracked/[gone]-branch triage with explicit SAFE-vs-NEEDS-ATTENTION verdicts and a never-auto-delete safety posture is more rigorous than anything found in the field. (2) Parallel state gathering in PHASE 1. (3) Clear A/B/C/D decision matrix (uncommitted / no-commits / no-PR / existing-PR). (4) PHASE 1.5 lint gating with project-type detection and auto-fix, plus /dc and /docs-sync nudges and guardrails-file compliance — this already covers the 'use linting tools' best practice. (5) Reads ALL commits, not just the latest. (6) Aggressive issue-linking with Fixes #XX auto-close. (7) Memory-file freshness reconciliation against gh pr list. The agent's structure (explicit phases + exact bash) matches the field's key lesson that explicit command sequences beat natural language.

Our qa is already ahead of most of the field and must not regress on these: (1) Multi-tool detection with a graceful fallback chain (Chrome DevTools MCP -> Playwright MCP -> Claude-in-Chrome -> agent-browser) plus exact remediation copy when a tool is down -- more robust than every external example, which assumes one tool. (2) Accessibility-tree-first detection (snapshot preferred over screenshot) -- matches the token-efficiency consensus Kinney documents. (3) git-diff-driven scoping that targets only changed UI areas, with an explicit cross-page-impact spot-check for shared infra (global CSS, router, store, layouts) -- nobody external does this; most just test a URL blindly. (4) Credential auto-discovery from .env with infra-credential exclusion and a security check. (5) Repo Config override + jacked-setup pre-configuration for fast repeat runs. (6) Accessibility lens integration (contrast, keyboard nav, semantic HTML, labels, focus management). (7) Disciplined read-only detect-then-plan posture (issues -> writing-plans -> /dcr) with severity-ranked structured report. (8) Screenshot lifecycle management (setup + cleanup). (9) A clear /qa vs /ux split by blast radius.

Ours is already ahead of the public field and should not regress these: (1) Step 0 deterministic path selection (Path P Playwright native video+chapters vs Path F frame-stitch) probed UP FRONT, naming 'no way to produce a video discovered mid-session' as the #1 failure mode; (2) the load-bearing 'inject 0.8-1.5s wait beats between actions or the video is an unreadable blur' trick — MCP actions are near-instant; (3) never-fake-login (record up to the auth wall, narrate the rest is blocked) and announce-env-var-names-not-values; (4) Step 6 artifact verification via ffprobe/identify (duration>0, frame count>1, non-trivial size) before claiming success — no other source does this; (5) explicit avoidance of macOS screencapture -v due to the un-clickable TCC prompt; (6) a video-synced narrated doc that already pairs each leg with expected-vs-observed AND console/network state at that moment; (7) shareability awareness (mp4/gif drag-drop into GitHub/Slack, webm->mp4 convert). The generic Claude Code QA posts in the wild do none of 1-6.

Ours is already strong and well-matched to the field for its narrow job. Don't regress: (1) cwd resolution never trusts the lossy projects-dir slug — it verifies by reading the recorded `cwd` field inside transcripts and enumerates dirs as fallback; (2) crash-truncated final JSONL line is tolerated (skipped) and flagged as `truncated`; (3) incomplete-last-turn is detected structurally via an unanswered final tool_use id (open_ids), not heuristics; (4) digest captures TodoWrite state, files touched (including file-history-snapshot backups), plan excerpt, and sub-agent summaries; (5) the renderer is char-budgeted and NAMES every section it clips/drops rather than silently truncating; (6) verbatim `/goal` and `/loop` kickoffs are surfaced as an un-trimmable 'Manual restart required' block because native `--resume` cannot restart them — a genuinely subtle, correct insight; (7) confirm-before-inject UX, live-session exclusion via $CLAUDE_CODE_SESSION_ID, /recover self-leak guard, and explicit outdated-CLI ('No such command recover') remediation. Qdrant-free by design so it works on a bare install the moment after a crash.

OURS already implements and substantially exceeds the canonical community technique ('The Elegant Redo' one-liner). Genuinely strong: (1) Non-negotiable work preservation via git stash with explicit failure-stop if the stash command errors — most community advice just says 'scrap it'. (2) Branch isolation so the old approach stays accessible and comparable (git diff main..HEAD). (3) A mandatory, well-structured 4-question reflection (original goal / what went wrong / what we know now / what the new approach must account for) that directly captures hindsight — this maps cleanly onto Spolsky's 'developers underestimate the cost of reproducing behavior'. (4) Replan-before-code (plan mode) gating implementation on an approved design. (5) Explicit anti-over-engineering mindset ('simplest thing that works'). (6) Hard safety rails and a refusal to skip reflection even when the user says 'just redo it'. (7) A prerequisite gate that refuses to redo when there's nothing implemented yet. This is already best-in-class relative to anything in the Claude Code ecosystem.

Ours is already aligned with field best-practice on the hard parts. (1) PyPI Trusted Publishers via OIDC — no long-lived tokens — which the PyPA guide and Simon Willison's TIL both treat as the gold standard. (2) Correct version source of truth: ours edits jacked/__init__.py, which IS the hatch version path (`[tool.hatch.version] path = "jacked/__init__.py"`), with pyproject `dynamic = ["version"]` — so the bump is internally consistent. (3) Strong gating: refuses to release on a dirty tree, refuses to release with failing CI, refuses duplicate versions (PyPI rejects them), never force-pushes without approval, and monitors the publish workflow to completion before declaring done. (4) Clear pre-flight (branch check, gh auth check) and explicit failure handling with `--log-failed`. (5) Branch assumption ('master') and the publish.yml trigger (`on: release: published`) match this repo's actual config. The supply-chain hardening (pinned actions, harden-runner, SBOM, OIDC) already exceeds most community release commands.

Ours is already solid and arguably ahead of generic git-stats tools on a few axes: (1) explicit compare-mode that computes period-over-period deltas for velocity/LOC/test-ratio/fix-ratio; (2) coding-session detection via <2h commit-gap clustering with avg/longest session and peak-hours-of-day — git-quick-stats only does raw hour histograms; (3) per-contributor narrative with both a specific praise and a specific growth opportunity (humane, not a leaderboard); (4) test-health signal (test-file ratio, high-churn-no-test-change flag) and fix-ratio as a quality proxy; (5) strictly read-only with cross-platform date handling and a gh-CLI-optional PR section. Structure (gather → sessions → compare → report) is clean and the report template is concrete.

Already matches the field's central principle: verify what actually landed before resuming, and never redo work that already succeeded (the buildmvpfast 'crash-only / skip already-executed' and the Medium 'know which steps committed' patterns). Correctly frames the error as not-your-fault to stop the model from second-guessing a sound plan. Covers the three real resume scenarios cleanly: (1) work finished, just waiting → confirm, don't redo; (2) inline edit/command/tool interrupted → verify what applied, resume from the precise fall-off point; (3) dead subagents/workflow → resume a workflow via resumeFromRunId and re-dispatch ONLY the agents that failed (this resume-don't-restart granularity is exactly best practice). Explicitly forbids changing the goal/plan or starting new work — a meaningful guardrail. Tight, low-token, single-purpose.

Ours is already strong and structurally ahead of most community swarm/brainstorm commands. Specifically, do not regress: (1) Complexity calibration table that auto-scales agent count 2-5 by signal — matches Anthropic's 'scale effort to query complexity' principle. (2) Three-axis differentiation (persona x constraint x method) with uniqueness enforcement — this is the diversity driver the debate literature says matters most, and it's more principled than the 'N clones with different temperatures' approach common in the field. (3) Explicit two-phase design: divergent research → synthesis (convergence/divergence/unique-insight analysis) → verify + devil's-advocate → bounded iterate loop. The dedicated Devil's Advocate with a 'find NEW risks, don't restate' rule and a 'if you can't break it, that's a strong signal' framing is genuinely best-in-class. (4) Pre-spawn CODEBASE_CONTEXT discovery condensed (not raw files) into agent prompts — avoids prompt bloat. (5) Hard rules: all-parallel spawning, READ-ONLY agents, no auto-transition to implementation, 3-round safety cap, 'no convergence → stop and ask user.' (6) Persists output as an HTML artifact (with Mermaid for convergence maps) — matches the cross-tool consensus that plans should be visible, inspectable artifacts. (7) Synthesis decision logic (clear winner / combination / no convergence) is explicit and refuses to force a false winner.

Already best-in-class on the fundamentals and ahead of every community equivalent found: (1) Real-linters-first (ruff/eslint) with explicit 'if not configured, skip — don't install', which the davila7 agent lacks. (2) Hard file:line discipline on every finding. (3) Three-bucket categorization (Bugs/Risk, Maintenance, Cleanup). (4) Specialist-lens anti-pattern integration — a differentiator no external source has. (5) Output cap (~20 findings) with 'actionable over exhaustive' and a suggested-next deeper scan. (6) Explicit epistemic humility: 'Don't pretend to be a static analyzer', 'say possible not definite'. This honesty already beats tools that over-claim.

Genuinely strong and Python-deep. Already covers, at or above field level: the full test pyramid (unit>integration>e2e) plus property-based (Hypothesis) and performance (pytest-benchmark); determinism done concretely (freezegun, seeded RNG, no flaky tests); isolation (no shared state, fixture cleanup); a speed budget (<10s unit suite); parametrization and fixture/mock-with-spec patterns with real code; a coverage workflow (pytest-cov, branch/edge identification, HTML reports, sensible exclusions); and an explicit anti-pattern catalog (testing implementation not behavior, over-mocking, order-dependent/brittle tests, hitting production resources, missing error coverage) plus a test-maintenance and quality-gate section. The behavior-over-implementation stance and 'mocks properly spec'd' line already pre-empt two of the field's named AI-test failure modes.

Ours is a clean, idempotent state-file removal that already matches or beats the field. It guards the empty/missing case ('No freeze is currently active' and stop), records the previous path for the confirmation, removes ~/.claude/jacked-freeze-dir.txt, and confirms with the previously-frozen path. The companion /freeze and the security_gatekeeper.py PreToolUse hook (lines 1772-1810) fail-open if the freeze file is corrupted and only restrict Edit/Write/NotebookEdit (Read/Grep/Glob stay free), so simply deleting the file is the correct and complete reversal — no hook teardown needed. This is functionally equivalent to gstack's unfreeze (116k stars), the strongest comparable in the ecosystem, and the external 'domain technique' art is genuinely thin (mostly clones of this same pattern).

Ours is materially more advanced than the popular external art on orchestration and scoping, and we must not regress these: (1) True parallel fan-out across an (aspect × page) matrix with 2-4 isolated agents — OneRedOak's celebrated workflow is single-agent and sequential; (2) git-diff-driven auto-scoping of which pages/aspects to test, including staged+untracked new-file detection — no external source auto-scopes from the diff (Bowser requires hand-authored YAML stories); (3) cross-page impact tiering (Tier 1/2/3 with path+filename signals and explicit exclusions like index.*/*.module.css) to expand coverage on shared-infra changes; (4) new-feature Discoverability detection with entry-point inference, navigation-depth counting, first-use/empty-state and return-navigation checks — absent from all external sources; (5) persona inference from project signals + mobile-context weighted-signal detection; (6) credential auto-discovery from .env with infra-var exclusion; (7) robust multi-browser-tool detection/fallback (Chrome DevTools MCP → Playwright → Claude-in-Chrome → agent-browser) with per-tool tool lists and tab isolation; (8) severity triage, dedup, read-only contract that hands findings to /dcr + writing-plans. This is a complete, dev-loop-native execution stack.

Ours is materially more sophisticated than anything found in the field. Specifically worth preserving: (1) Commits to ONE high-leverage initiative instead of returning a menu — the explicit anti-pattern that the only real competitor (claude-toolkit /next, which returns 5 items) falls into. (2) The coverage-matrix strategic lens (personas x contexts, capability vs walked-experience, hunt for cross-cutting levers that lift many cells) — no competitor has any strategic read; they all just scrape signals. (3) Confidence calibration with an explicit honesty bar (inline read is capability-only, never claims near-10/10 on experience, downgrades confidence on a 7-vs-9 call, offers /coverage-matrix before betting weeks) — directly counters the field's #1 failure mode of treating a thin read as truth. (4) The /goal brief forging with the HARD 4000-char size gate measured mechanically via wc -c, convergence-sizing/phasing for XL work, file-backed self-bootstrapping pointer-goals, and a turn backstop — far beyond any competitor and structurally matches Cursor's validated bounded-loop pattern. (5) Thorough DATA-only prompt-injection hardening carried into the brief (cite by identifier + neutral paraphrase, [text omitted] for directive-like titles). (6) Graceful degradation (not-enough-context stop, GH-not-auth handling, lifecycle inference table). (7) Resume-first checkpoint awareness and repo-scoped config override.