nanostack

Category: Tools & Productivity | Uploader: garagon | Downloads: 0 | Version: v1.0（Latest）

Use when the user asks about available workflow skills, wants an overview of the engineering workflow, or references "nanostack". Also triggers on /nanostack.

Changelog: Source: GitHub https://github.com/garagon/nanostack

Directory Structure

Current level: tree/main/

📁 .claude-plugin/
- 📄 plugin.json 518 B
📁 .cursor-plugin/
- 📄 plugin.json 273 B
📁 .github/
- 📁 ISSUE_TEMPLATE/
  - 📄 bug_report.yml 1.3 KB
  - 📄 config.yml 230 B
  - 📄 feature_request.yml 1.2 KB
- 📄 CODEOWNERS 42 B
- 📄 pull_request_template.md 332 B
📁 bin/
- 📁 lib/
  - 📄 store-path.sh 589 B
- 📄 analytics.sh 5.3 KB
- 📄 capture-learning.sh 1.0 KB
- 📄 discard-sprint.sh 2.2 KB
- 📄 find-artifact.sh 759 B
- 📄 init-config.sh 2.0 KB
- 📄 init-project.sh 2.7 KB
- 📄 save-artifact.sh 2.1 KB
- 📄 scope-drift.sh 2.0 KB
- 📄 sprint-journal.sh 5.5 KB
- 📄 upgrade.sh 1.6 KB
📁 conductor/
- 📁 agents/
  - 📄 openai.yaml 334 B
- 📁 bin/
  - 📄 sprint.sh 9.2 KB
- 📄 SKILL.md 6.5 KB
📁 guard/
- 📁 agents/
  - 📄 openai.yaml 319 B
- 📁 bin/
  - 📄 check-dangerous.sh 4.5 KB
- 📄 rules.json 9.5 KB
- 📄 SKILL.md 4.5 KB
📁 plan/
- 📁 agents/
  - 📄 openai.yaml 319 B
- 📁 references/
  - 📄 stack-defaults.md 6.0 KB
- 📁 templates/
  - 📄 plan-template.md 821 B
  - 📄 product-spec.md 941 B
  - 📄 technical-spec.md 1.2 KB
- 📄 SKILL.md 10.4 KB
📁 qa/
- 📁 agents/
  - 📄 openai.yaml 284 B
- 📁 bin/
  - 📄 screenshot.sh 1.0 KB
- 📄 SKILL.md 8.5 KB
📁 reference/
- 📄 artifact-schema.md 2.9 KB
- 📄 conflict-precedents.md 4.0 KB
📁 review/
- 📁 agents/
  - 📄 openai.yaml 302 B
- 📁 bin/
  - 📄 suggest-security.sh 720 B
- 📄 checklist.md 2.0 KB
- 📄 SKILL.md 8.5 KB
📁 security/
- 📁 agents/
  - 📄 openai.yaml 330 B
- 📁 references/
  - 📄 owasp-checklist.md 5.0 KB
- 📁 templates/
  - 📄 security-report.md 1.8 KB
- 📄 SKILL.md 12.6 KB
📁 ship/
- 📁 agents/
  - 📄 openai.yaml 289 B
- 📁 bin/
  - 📄 pre-ship-check.sh 964 B
  - 📄 quality-check.sh 2.9 KB
- 📁 templates/
  - 📄 pr-template.md 379 B
- 📄 SKILL.md 8.0 KB
📁 skills/
- 📄 conductor 12 B
- 📄 guard 8 B
- 📄 plan 7 B
- 📄 qa 5 B
- 📄 review 9 B
- 📄 security 11 B
- 📄 ship 7 B
- 📄 think 8 B
📁 think/
- 📁 agents/
  - 📄 openai.yaml 311 B
- 📁 references/
  - 📄 cognitive-patterns.md 5.9 KB
  - 📄 forcing-questions.md 5.5 KB
  - 📄 search-before-building.md 1.1 KB
- 📄 SKILL.md 11.3 KB
📄 .gitignore 292 B
📄 AGENTS.md 1.9 KB
📄 CODE_OF_CONDUCT.md 2.4 KB
📄 CONTRIBUTING.md 2.9 KB
📄 EXTENDING.md 5.3 KB
📄 gemini-extension.json 172 B
📄 GEMINI.md 22 B
📄 LICENSE 10.5 KB
📄 llms.txt 3.5 KB
📄 README.md 20.5 KB
📄 SECURITY.md 1.3 KB
📄 setup 14.5 KB
📄 SKILL.md 7.0 KB
📄 ZEN.md 680 B

SKILL.md

---
name: nanostack
description: Use when the user asks about available workflow skills, wants an overview of the engineering workflow, or references "nanostack". Also triggers on /nanostack.
---

# Nanostack — Engineering Workflow Skills

You have access to a set of composable engineering workflow skills. Each skill is a folder with supporting files — read them as needed for context.

## Available Skills

| Skill | When to use | Modes | Key files |
|-------|-------------|-------|-----------|
| `/think` | Before planning — strategic product thinking, premise validation, scope decisions. | — | `think/references/forcing-questions.md`, `think/references/cognitive-patterns.md` |
| `/nano` | Before starting any non-trivial work. Produces a scoped, actionable plan. | — | `plan/templates/plan-template.md` |
| `/review` | After code is written. Two-pass review + scope drift detection + conflict resolution. | `--quick` `--standard` `--thorough` | `review/checklist.md`, `reference/conflict-precedents.md` |
| `/qa` | To verify code works. Browser-based testing with Playwright, plus root-cause debugging. | `--quick` `--standard` `--thorough` | `qa/bin/screenshot.sh` |
| `/security` | Before shipping. OWASP Top 10 + STRIDE + variant analysis + conflict detection. | `--quick` `--standard` `--thorough` | `security/references/owasp-checklist.md`, `security/templates/security-report.md` |
| `/ship` | To create PRs, merge, deploy, and verify. Generates sprint journal on success. | — | `ship/templates/pr-template.md` |
| `/guard` | When working near production, destructive operations, or sensitive systems. | — | `guard/bin/check-dangerous.sh` |
| `/conductor` | Orchestrate parallel agent sessions through a sprint. Coordinate task claiming and artifact handoff. | `start` `claim` `complete` `status` | `conductor/bin/sprint.sh` |

## Workflow Order

The default workflow is: `/think` → `/nano` → build → `/review` → `/qa` → `/security` → `/ship`

With `/conductor`, review + qa + security run **in parallel** — they all depend on build, not on each other:

```
think → plan → build ─┬─ review  ─┐
                      ├─ qa       ├─ ship
                      └─ security ─┘
```

Activate `/guard` at any point when operating near production or sensitive systems.

## Zen

Read `ZEN.md` for the full set of principles. When in doubt about a decision during any skill, consult it. The short version:

- Question the requirement before writing the code.
- Delete what shouldn't exist. Don't optimize what's left until you do.
- Narrow the scope, not the ambition.
- Fix it or ask. Never ignore it.
- Security is not a tradeoff. It is a constraint.
- The output should look better than what was asked for.

## Intensity Modes

Skills `/review`, `/security`, and `/qa` support intensity modes:

| Mode | Flag | When | Confidence |
|------|------|------|-----------|
| **Quick** | `--quick` | Trivial changes (typos, config, docs) | 9/10 — only the obvious |
| **Standard** | (default) | Normal changes | 7/10 — anything reasonable |
| **Thorough** | `--thorough` | Critical changes (auth, payments, infra) | 3/10 — flag everything suspicious |

Skills auto-suggest a mode based on the diff, but the user always decides.

## Artifact Persistence

Skills automatically save their output to `.nanostack/` after every run:

```bash
.nanostack/<phase>/<timestamp>.json
```

This enables:
- **Scope drift detection** — `/review` compares planned vs actual files
- **Conflict detection** — `/review` and `/security` cross-reference each other's findings
- **Sprint journals** — `/ship` generates a journal entry from all phase artifacts
- **Trend tracking** — Are security findings decreasing over time?

Auto-saving is on by default. The user can disable it by setting `auto_save: false` in `.nanostack/config.json`.

Artifacts are validated before saving: `save-artifact.sh` rejects invalid JSON, missing required fields (`phase`, `summary`), and phase mismatches.

To discard artifacts from a bad session: `bin/discard-sprint.sh` (removes artifacts and journal entry for the current project and date).

## Conflict Resolution

When skills produce contradictory guidance (e.g., `/review` says "more error detail" but `/security` says "minimize error exposure"), the conflict resolution framework applies:

1. **Security has default precedence** — unless the risk is theoretical or internal-only
2. **Context determines final precedence** — public-facing app vs internal tool vs startup vs compliance
3. **Conflicts are documented, not silenced** — every resolution is recorded in the skill artifact

Read `reference/conflict-precedents.md` for known conflict patterns and pre-defined resolutions.

## Project Config

On first use in a project, run `bin/init-config.sh --interactive` to create `.nanostack/config.json`. This stores:

- **Installed agents** — auto-detected (claude, codex, cursor, opencode, gemini)
- **Detected stack** — node, go, python, docker
- **Preferences** — default intensity mode, auto-save, conflict precedence

If config exists, read it at the start of any skill to adapt behavior:
```bash
bin/init-config.sh  # outputs current config or {} if none
```

Skills use config for:
- `/review`, `/qa`, `/security`: read `preferences.default_intensity` instead of always defaulting to standard
- `/security`: read `preferences.conflict_precedence` to determine who wins in cross-skill conflicts
- `/security`: read `detected` to skip irrelevant checks (don't scan for Python vulns in a Go project)

Per-skill configs (`security/config.json`, `guard/config.json`) store skill-specific settings and are read by that skill only.

## Universal Rules

- **Read before acting.** Every skill must read the relevant code/diff/config before producing output. Never analyze blind.
- **Boil the lake, not the ocean.** When completeness costs minutes more than shortcuts, do the complete thing. When it costs days, don't.

## Proactive Triggers

Suggest skills when context matches — don't wait for the user to remember:

| Trigger | Suggest |
|---------|---------|
| User says "what should I build" / unclear on direction | `/think` |
| Task touches 3+ files or user says "how should I approach this" | `/nano` |
| User says "done", "finished", "ready for review" | `/review` |
| User says "does this work", "test this", bug report | `/qa` |
| Pre-ship, user says "ready to deploy", or diff touches auth/env/infra | `/security` |
| User says "create PR", "merge", "ship it" | `/ship` |
| Destructive commands, production access, or sensitive operations detected | `/guard` |

## Usage Rules

- Start with `/think` for new products or when the "what" is unclear
- Run `/nano` before building anything that touches more than 3 files
- Run `/review` on your own code — the adversarial pass catches what you missed
- `/security` is not optional before shipping to production
- `/guard` is on-demand — activate it, don't leave it always on
- Skills compose: `/qa` can invoke `/security` checks, `/ship` can invoke `/review`

Comments 0

Latest | Hot

Please login before commenting.

No comments yet. Be the first one!

nanostack

Directory Structure

SKILL.md

Report

Notice