# Cli Forge Chef

> >

- **Type:** Skill
- **Install:** `agentstack add skill-destynova2-cli-code-skills-cli-forge-chef`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [Destynova2](https://agentstack.voostack.com/s/destynova2)
- **Installs:** 0
- **Category:** [Cloud & Infrastructure](https://agentstack.voostack.com/c/cloud-infrastructure)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [Destynova2](https://github.com/Destynova2)
- **Source:** https://github.com/Destynova2/cli-code-skills/tree/main/cli-forge-chef

## Install

```sh
agentstack add skill-destynova2-cli-code-skills-cli-forge-chef
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

> **Optimization:** Heavy content lives in `references/`. Load on demand.

> **Language rule:** Skill instructions are written in English. When generating user-facing files (prompts, shared-state, tmuxinator comments, reports), detect the project's primary language (from README, comments, docs, commit messages) and produce those files in that language. If the project is bilingual, ask the user which language to use before proceeding. The Brigade vocabulary (Menu, Commis, Sous-Chef, Chef, Plat, Mise en place, etc.) stays in French regardless — it's the pattern's canonical terminology, not prose.

> **Gotchas:** Read `../gotchas.md` AND `references/gotchas-chef.md` before producing output.

# CLI Forge Boss — Brigade de Cuisine

> *"On ne cuisine pas seul. On cuisine en brigade."* — Auguste Escoffier
> (*"You don't cook alone. You cook in a brigade."*)

## The Brigade

```
┌─────────────────────────────────────────────────────┐
│                      CLIENT                          │
│  (user, ticket, roadmap)                             │
│                                                      │
│  Orders plats via the MENU (PERT)                    │
│  "I want: decision tokens + E2E + sokolsky"          │
└──────────────────────┬──────────────────────────────┘
                       │ order
┌──────────────────────▼──────────────────────────────┐
│                  CHEF DE CUISINE                     │
│  (plans, decides, orchestrates)                      │
│                                                      │
│  - Reads the menu (PERT / roadmap)                   │
│  - Assigns plats to the commis                       │
│  - Decides the order in which to send them out       │
│  - Asks the Sous-Chef to taste before sending        │
│  - Calls "Envoyez !" when it's ready                 │
│  - NEVER COOKS                                       │
└──────────────────────┬──────────────────────────────┘
                       │ SendMessage
┌──────────────────────▼──────────────────────────────┐
│              3 VOTING SOUS-CHEFS                     │
│  (taste, judge — quorum 2/3)                         │
│                                                      │
│  sous-chef-scope   : is the plat in your station?    │
│  sous-chef-secu    : any broken glass in the plat?   │
│  sous-chef-qualite : does it taste right?            │
│                                                      │
│  2/3 APPROVE → passes                                │
│  1 DENY → sent back to the kitchen                   │
│  1 ESCALATE → call the patron (human, ~5% of cases)  │
├──────────────────────────────────────────────────────┤
│              SOUS-CHEF MERGE                         │
│  (plates up, sends to the pass)                      │
│                                                      │
│  - Quality gates (/cli-audit-*)                      │
│  - Merge + CI (tmux send-keys gate)                  │
│  - Updates the carnet (shared-state.md)              │
│  - Runs in bypassPermissions                         │
│  - CWD = {project}-wt-gate                           │
│    (push + PR allowed, apply DENIED)                 │
├──────────────────────────────────────────────────────┤
│              APPLY PANE (only if infra present)      │
│  (executes tofu/helm/kubectl after 3/3 quorum)       │
│                                                      │
│  - Receives APPLY_REQUEST from any agent             │
│  - Runs the plan (tofu plan, helm diff, kubectl diff)│
│  - Submits plan to 3 voting sous-chefs — 3/3 needed  │
│  - Executes only after unanimous APPROVE             │
│  - Prod target → extra PATRON ACK                    │
│  - CWD = {project}-wt-apply                          │
│    (tofu/helm/kubectl allowed, git push DENIED)      │
│  - See references/apply-quorum.md                    │
└──────────────────────┬──────────────────────────────┘
                       │ SendMessage
┌──────────────────────▼──────────────────────────────┐
│              COMMIS (x N)                            │
│  (cook, prep, plate)                                 │
│                                                      │
│  - Each has their own station (worktree / project)   │
│  - Prepare their plat (code, test, commit)           │
│  - Announce "Pret !" to the sous-chef                │
│  - DO NOT DECIDE when to send out                    │
└──────────────────────┬──────────────────────────────┘
                       │ "Plat au passe"
┌──────────────────────▼──────────────────────────────┐
│              MAITRE D'HOTEL                          │
│  (pass → client, landing watchdog)                   │
│                                                      │
│  - Receives PRs once auto-merge is enabled           │
│  - Polls until MERGED (not just "auto-merge on")     │
│  - Rattrapage: rebase BEHIND branches when main moves│
│  - Relance: rerun transient CI failures (max 2x)     │
│  - Renvoi: real failures go back to the Sous-Chef    │
│  - Encaissement: tag verified + shared-state updated │
│  - Reports "Client content" only when all 6 done     │
│                                                      │
│  Read references/maitre-dhotel.md for the full role  │
└──────────────────────┬──────────────────────────────┘
                       │ "Client content + tag"
┌──────────────────────▼──────────────────────────────┐
│                   CLIENT (happy)                     │
│  Release tag cut, prod deploy green, sprint done     │
└─────────────────────────────────────────────────────┘
```

### When the patron (human) steps in

**~5% of cases.** The human is called only when a Sous-Chef votes ESCALATE:

| Case | Who escalates | Why |
|---|---|---|
| Edit on `.github/workflows/` | sous-chef-scope | CI = global impact |
| New dep in Cargo.toml | sous-chef-secu | Supply chain risk |
| Test removal | sous-chef-secu | Never auto-approve |
| Diff > 200 lines | sous-chef-qualite | Too big to judge quickly |
| File from another worker | sous-chef-scope | Potential conflict |

Everything else passes without human intervention.

### Brigade vocabulary

| Brigade term | Meaning | Example |
|---|---|---|
| **Carte du jour** | Review of sensitive zones (sprint start) | "ci.yml moves to 3/3, log_backend stays 2/3" |
| **Marche** | Project inventory (git log, PRs, incidents) | "3 DENYs on ci.yml during sprint S3" |
| **Produit frais** | Normal zone (2/3) with no incidents | "src/features/ : 0 DENY in 3 sprints" |
| **Produit sensible** | 3/3 unanimity required | "Cargo.toml: rustls-pemfile advisory" |
| **Produit retire** | Past hallucination → now a test case | "Blind auto-approve → G16" |
| **Nouvelle recette** | New module to classify | "log_backend → normal, self_tuning → sensitive" |
| Menu | PERT (dependency DAG of plats with durations) | "Sprint S3: 4 plats, critical path A→C→D" |
| Commande | Ticket / task | "feat/hit-decision-tokens" |
| Plat | Feature merged + CI green | PR #88 merged |
| Mise en place | shared-state.md "In progress" | Worker writes its target files |
| Cuisson | Coding + tests | Worker codes in its worktree |
| Dressage | Commit + cleanup | cargo fmt, clippy clean |
| Gouter | Quorum vote by the Sous-Chefs | "2/3 APPROVE (normal) or 3/3 (sensitive)" |
| Pass | CI pipeline | gh run watch |
| Envoi | Merge + green light | "Envoyez! feat/x merged." |
| Plat au passe | Sous-Chef hands a PR to the Maître d'hôtel with auto-merge on | "Plat au passe: #201, auto-merge squash" |
| Rattrapage | Maître d'hôtel rebases a BEHIND branch | "Rattrapage #201: main moved after #200 landed" |
| Relance | Maître d'hôtel reruns a transient CI failure (max 2x per cause) | "Relance #202: CodeQL rate-limit" |
| Encaissement | Maître d'hôtel confirms MERGED + tag cut + shared-state updated | "Encaissement #201 → v0.36.17" |
| Client content | Maître d'hôtel signals full landing to the Chef | "Client content: 3 plats, 2 tags, 0 orphans" |
| Renvoi | Gate failed or quorum DENY, or real failure from Maître d'hôtel | "Renvoie! Sous-Chef Secu proposes: ..." |
| Appel au patron | ESCALATE ( Ready
    Ready --> MiseEnPlace: dispatched to commis
    MiseEnPlace --> Cuisson: write-set locked in shared-state
    Cuisson --> Dressage: code + tests pass locally
    Dressage --> Gouter: commit + lint clean, sent to Sous-Chef
    Gouter --> Envoi: 2/3 APPROVE (normal) or 3/3 (sensitive)
    Gouter --> Renvoi: DENY or CONCERN with solution
    Renvoi --> Cuisson: commis applies the proposed fix
    Envoi --> PlatAuPasse: Sous-Chef creates PR with auto-merge + F8 conflict scan
    PlatAuPasse --> EnSalle: Maitre d'hotel receives the plat
    EnSalle --> Surveillance: polling loop every 45s
    Surveillance --> Surveillance: CLEAN / HAS_HOOKS / UNSTABLE (wait)
    Surveillance --> Rattrapage: BEHIND (main moved)
    Rattrapage --> Surveillance: rebase + force-push-with-lease + re-enable auto-merge
    Rattrapage --> Renvoi: rebase conflict
    Surveillance --> Relance: BLOCKED + transient CI
    Relance --> Surveillance: gh run rerun --failed
    Relance --> Escalade: 3rd transient in a row
    Surveillance --> Renvoi: BLOCKED + real failure OR DIRTY merge conflict
    Surveillance --> Encaissement: MERGED
    Encaissement --> ClientContent: tag verified + shared-state Valid merges updated + cascade Rattrapage on other in-flight
    ClientContent --> [*]: Chef notified, plat fully served
    Escalade --> [*]: > 2h timeout, Chef takes over
    Cuisson --> Apoptosis: same diff rejected 2x / idle 30min / regression
    Dressage --> Apoptosis: same diff rejected 2x / regression
    Apoptosis --> Ready: revert + locks released, plat re-enters the pool
    Gouter --> AppelAuPatron: 3 rounds without consensus
    AppelAuPatron --> Cuisson: human decision applied
    AppelAuPatron --> [*]: human aborts the plat
```

This is the authoritative plat lifecycle — if prose anywhere else disagrees, fix the prose.

### Communication flow

```
Commis edits a file
  → Chef sends the diff to the 3 voting Sous-Chefs (parallel)
  → 2/3 APPROVE → passes automatically (zero human)
  → 1 DENY → sent back to the commis with a reason
  → 1 ESCALATE → Chef notifies the patron (human)

Commis finishes cooking
  → "Pret !" to the Sous-Chef (SendMessage)
  → Sous-Chef tastes (quality gates)
  → IF good:
      → Sous-Chef plates up and sends (merge + CI)
      → Sous-Chef to Chef: "Plat sent, table served"
      → Chef to dependent commis: "Envoyez the next one!"
  → IF not good:
      → Sous-Chef to Commis: "Renvoi! Too much salt in fn X"
      → Sous-Chef to Chef: "Renvoi on plat Y, commis is fixing it"
```

## Input

`$ARGUMENTS` is the target project path or name.

- If a path: analyze the project, generate config for it
- If a name: create a new project directory and generate config
- If empty: use the current working directory

## Phase 0 — Mise en place

**First, check whether a sprint is currently running or paused:**

Read `references/sprint-persistence.md`. Check `.claude/sprint-history/current/`:
- If a sprint is **PAUSED** → offer: Resume / Rewind / Fresh / Abandon
- If a sprint is **DONE** → read the gotchas-learned and sensitive zones for the new sprint
- If no history → fresh sprint

Before generating anything, understand the project:

### 0.1 — Detect project type

| Signal | Type | Build tools | Test command | Lint command |
|--------|------|-------------|--------------|--------------|
| `Cargo.toml` | Rust | `cargo` | `cargo test` | `cargo fmt && cargo clippy` |
| `go.mod` | Go | `go` | `go test ./...` | `golangci-lint run` |
| `package.json` | JS/TS | `npm`, `npx` | `npm test` | `npm run lint` |
| `pyproject.toml` / `setup.py` | Python | `python3`, `pip`, `uv` | `pytest` | `ruff check` |
| `*.tf` / `terragrunt.hcl` | Terraform | `terraform`, `tofu` | `terraform plan` | `terraform validate` |
| `Chart.yaml` / `helmfile.yaml` | Helm | `helm` | `helm template` | `helm lint` |
| `docker-compose*.yml` | Docker | `docker`, `podman` | N/A | `docker compose config` |
| `flake.nix` | Nix | `nix` | `nix flake check` | `nix flake check` |
| Multiple of above | Monorepo | union | per-workspace | per-workspace |

If no manifest found → ask the user: "What type of project is this? (Rust, Go, JS/TS, Python, Infra, Other)"

Use the detected type to:
- Filter build tool permissions in `settings.local.json` (only include relevant tools)
- Set correct build/test/lint commands in commis prompts
- Choose appropriate quality gates

### 0.2 — Read the project

1. **Read the project** — README, CONTRIBUTING.md, docs/explanation/architecture.md, manifest file, src/ structure
2. **Read git state** — branches, worktrees, CI config
3. **Identify the menu** — what needs to be done? Check issues, roadmap, design docs

### 0.3 — Check prerequisites

#### Tools

| Tool | Check | Install (Fedora/RHEL) | Install (macOS) | Install (Debian/Ubuntu) | Fallback |
|------|-------|-----------------------|-----------------|-------------------------|----------|
| tmux | `which tmux` | `sudo dnf install tmux` | `brew install tmux` | `sudo apt install tmux` | None — required |
| tmuxinator | `which tmuxinator` | `brew install tmuxinator` (preferred) or `gem install tmuxinator` | `brew install tmuxinator` | `gem install tmuxinator` | **Raw tmux script** — see `references/raw-tmux-fallback.md` |
| claude | `which claude` | `npm i -g @anthropic-ai/claude-code` | `npm i -g @anthropic-ai/claude-code` | `npm i -g @anthropic-ai/claude-code` | None — required |
| gh | `which gh` | `sudo dnf install gh` | `brew install gh` | `sudo apt install gh` | Manual CI checks |

```bash
# Check all prerequisites
for tool in tmux tmuxinator claude gh; do
  which "$tool" >/dev/null 2>&1 || echo "MISSING: $tool"
done
grep -q "CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS" ~/.claude/settings.json 2>/dev/null || echo "AGENT_TEAMS_NOT_ENABLED"
```

If a tool is missing → **show the install command for the detected OS** and stop.

#### VCS — git or jj

The project MUST be a version-controlled repository. Check:

```bash
# Detect VCS type
if [ -d .jj ]; then
  VCS="jj"
elif git rev-parse --git-dir >/dev/null 2>&1; then
  VCS="git"
else
  echo "FATAL: not a git or jj repository. Initialize with 'git init' or 'jj git init' first."
  exit 1
fi
```

If not a repo → **stop and ask the user to init**. The Chef never creates a repo — that's a user decision.

#### Branching model detection

Auto-detect the project's branching model. **Never assume Git Flow.**

```bash
# Detect GitHub repo
REPO=$(gh repo view --json nameWithOwner,defaultBranchRef -q '.nameWithOwner' 2>/dev/null)
DEFAULT_BRANCH=$(gh repo view --json defaultBranchRef -q '.defaultBranchRef.name' 2>/dev/null)

# Detect branching model by examining existing branches
HAS_DEVELOP=$(git branch -r 2>/dev/null | grep -c 'origin/develop')
HAS_RELEASE_BRANCHES=$(git branch -r 2>/dev/null | grep -c 'origin/release/')
HAS_RELEASE_PLZ=$(test -f release-plz.toml && echo 1 || echo 0)

if [ "$HAS_DEVELOP" -gt 0 ] && [ "$HAS_RELEASE_BRANCHES" -gt 0 ]; then
  BRANCH_MODEL="gitflow"
  BASE_BRANCH="develop"
  RELEASE_BRANCH="main"
elif [ "$HAS_DEVELOP" -gt 0 ]; then
  BRANCH_MODEL="github-flow-develop"
  BASE_BRANCH="develop"
  RELEASE_BRANCH="main"
elif [ "$DEFAULT_BRANCH" = "main" ] || [ "$DEFAULT_BRANCH" = "master" ]; then
  BRANCH_MODEL="github-flow"
  BASE_BRANCH="${DEFAULT_BRANCH}"
  RELEASE_BRANCH="${DEFAULT_BRANCH}"
else
  BRANCH_MODEL="trunk"
  BASE_BRANCH="${DEFAULT_BRANCH:-main}"
  RELEASE_BRANCH="${BASE_BRANCH}"
fi
```

| Detected model | Base branch | Release branch | Commis branch from | PR target | Sync-main needed? |
|---|---|---|---|---|---|
| **github-flow** | main | main | main | main | No |
| **github-flow-develop** | develop | main | develop | develop | Yes |
| **gitflow** | develop | main | develop | develop | Yes (via release branches) |
| **trunk** | main/master | same | main | main | No |

**Impact on the brigade:**
- **github-flow / trunk**: commis branch from main, PRs t

…

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Destynova2](https://github.com/Destynova2)
- **Source:** [Destynova2/cli-code-skills](https://github.com/Destynova2/cli-code-skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-destynova2-cli-code-skills-cli-forge-chef
- Seller: https://agentstack.voostack.com/s/destynova2
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.