Patina Mode

Patina mode

Platform Adaptation

These skills share one tree across Claude Code and Codex. Read references/provider-dispatch.md whenever a configured role launches. It defines the provider-qualified model descriptors, native/external route table, launcher, isolation, receipts, and dropout policy. Children never choose routes. When a skill names a Claude tool or built-in skill (run, verify, plugin-dev:skill-development), read references/codex-tools.md for the Codex equivalent.

On Codex, patina-mode requires the multi_agent feature. Before selecting a playbook or changing anything, confirm that spawn_agent is available. If it is unavailable, stop and tell the user to set multi_agent = true under [features] in ~/.codex/config.toml, then restart Codex. Do not continue with a sequential substitute.

Non-negotiables

Start every multi-step task with a todolist whose first item is to read the Principles section below in full. The principles ground every trigger here. Keep principle choices, routing decisions, skip reasons, and throughput notes in the private task record. Explain them to the user only when asked or when the reasoning affects a decision the user must make. A citation with no decision behind it means you skipped its leaf skill; it must trace to a real choice the leaf's rule drove.

While patina-mode is active, this skill owns workflow routing. Use only the skills and playbooks named here. Do not substitute another development, repair, review, or pull request controller because it is installed.

Every skill named in this document and its playbooks is the Engineering plugin's. On Claude Code, invoke it as engineering:<name> rather than the bare name. Another installed plugin may ship a skill of the same name and an identical description, so a bare name can silently reach the wrong one. The exceptions are the references already carrying their own namespace, such as plugin-dev:skill-development, and the Claude Code built-in driver skills run and verify. On Codex, see references/codex-tools.md.

Every scripts/... and playbooks/... path in this document, its playbooks, and its references is relative to this skill's base directory, the absolute path your runtime states when it loads patina-mode. Join the two, then run or read the result. The bundled watch-pr watcher, orch store CLI, and worktree-audit.sh live under scripts/ there. Two other anchors look plausible and both fail. CLAUDE_PLUGIN_ROOT is set only for hooks, so it is unset in any shell you run. The repository you are working in ships none of these files, so a repo-relative path resolves to nothing.

Choose the smallest workflow that can establish the required result. Gather a routine fact directly. Route to another skill only when its workflow adds needed evidence or resolves a decision.

Remaining triggers:

• Issue-linked work begins or resumes → follow references/issue-handoff.md. Its executable direct-work and Session-pickup entries call the same gate. Each entry requires a successful working-on-issues result before another playbook changes a branch, edits a file, creates a commit, changes a pull request, or starts an operational run. Its completed-issue, blocker, branch-ownership, and worktree gates override the general autonomy rules below.
• An issue branch belongs to another worktree → let working-on-issues stop at its handoff gate. Run the bundled move-branch-here skill only when the operator approves the move.
• A Claude session ID, codex://threads/<id>, or T3 Code thread handoff → run the bundled move-session-here skill, then route its recovered resume point through the Session pickup playbook. Session pickup enters the same issue handoff gate.
• Unresolved facts that require subsystem investigation, or nontrivial uncertainty about how the current system works → the how skill. Do not repeat How when a valid grounding record already answers the same questions.
• About to AskUserQuestion on a "which approach", "how should I", or "what should this do" fork → classify it before you ask. If the answer is a fact you could observe by running something (behavior, timing, layout, output, perf, even whether an eval separates), it is not the human's to answer. Sketch it via the Prototype playbook (playbooks/prototype.md) and let the result decide. If the task is a read-only Investigation whose deliverable is a cited answer, stay in it and answer from the evidence rather than building a sketch. Reserve the question for a genuine product or preference call no experiment can settle. The ask is the slow path. A throwaway probe usually answers faster, and it hands the human a result to react to instead of a decision to make.
• Any code → name the data shape first, and choose its organizing structure per principle-model-the-domain.
• A consequential choice about ownership or interfaces, or competing viable designs → the architect skill before implementing. A function boundary alone does not trigger Architect. When requirements and the implementation pattern are established, follow the matched playbook. Escalate if later evidence reveals unresolved risk, material uncertainty, or competing approaches.
• Parallel fan-out → the swarm skill for coverage matrices, races, gauntlets, and exploration partitions. Use arena for design or code bakeoffs with base selection and grafting.
• Contested design → the interrogate skill (multi-model adversarial) before shipping.
• Nontrivial multi-step → write the throughput checkpoint (Feature step 3) in the private task record.
• Any prose surface → the unslop skill. Your reply is a prose surface; write it per Writing the reply. Agent-facing prose also follows the plugin-dev:skill-development skill (Claude Code's authoring guidance for SKILL.md files).
• Docs, RFCs, readmes, PR descriptions, or commit messages → the technical-writing skill (/technical-writing).
• Before commit → the deslop skill (/deslop).
• Before review → the no-comments skill (/no-comments).
• Shipping UI / IDE / CLI → the driver skill (run for CLIs/TUIs, verify for UIs). Both ship as Claude Code built-ins. For bug fixes, reproduce first on the same surface yourself; hand to the user only under the narrow Bug fix step 1 exception.
• A human-authored change request or QA finding needs resolution → run the gather-evidence skill before editing or preparing a response. Route a confirmed case to the matching playbook, then run gather-evidence again on the changed target. Leave replies, thread resolution, and review state to the operator. Automated review uses the existing bot triage instead.
• Work uses an Android emulator or iOS simulator → run the running-mobile-simulators skill before the first device state change. The agent that controls the device owns one exact device lease through app execution, automation, evidence capture, recovery, and cleanup.
• Any PR-status request → the Babysit playbook (playbooks/babysit.md), not the bundled babysit skill, whose description matches the same words. That includes "babysit this", "get it green", "address the review-bot comments", and the commonest phrasing, "check on PR X" / "anything outstanding on X". Never triggered by merely opening a PR. Declare its mode before polling; the playbook's step 1 owns the request-to-mode mapping. Reaching for drive inside a phase agent stops that agent finishing its turn.
• Asked to land or ship a green stack → the Shipping playbook (playbooks/shipping.md). Green is not safe. Nothing gets armed before an independent per-PR verdict, and only the contiguous verified run from the root lands.
• An automated PR-review bot or the agentic security review commented → skeptical posture. They catch real bugs and also file non-issues and nitpicks, so assess each on its merits and dismiss noise with a concrete reason instead of churning code. Triage fix / dismiss / ask per references/bugbot-triage.md.
• Broken skill mid-task → fix it in its own PR. Don't block. Don't silently work around it.
• Long, autonomous, or multi-phase work, or any task the user steps away from to review later ("going to bed", "trust it when i'm back", "/loop until X") → a decision trail via the show-me-your-work skill. Commit it when stakes need an auditable record; keep it local otherwise.

Carry grounding through the route

Keep one compact grounding record through the task. Record established findings, evidence pointers, the scope and input identities they depend on, and unresolved questions. Before reusing investigation or verification, confirm that the relevant scope, inputs, and evidence remain current. Reuse the valid portion. Refresh only the findings or checks affected by a change. Record which requirement the reused evidence satisfies.

Before launching any How or Architect Ground investigation, including a mandatory step in a routed child playbook, apply this check:

1. Match the step's questions to the current grounding record. When valid findings answer them, mark that investigation requirement satisfied by the cited evidence and continue without launching another investigation lane. This satisfies the child's How or Ground requirement, including How in Investigation, Feature, and Refactoring, and Architect's request for How during Ground.
2. Before repeating an investigation, name each missing or changed question and explain why the existing evidence no longer answers it. Investigate only those gaps. A child instruction to invoke How or produce a handoff is not itself a missing question. Gather routine facts directly. Run Why when consequential rationale remains unresolved.
3. In each executor brief, name the child requirement satisfied, cite the findings and their current scope and inputs, and list any remaining questions. Explicitly instruct the executor to continue from the satisfied requirement without another lane for the same questions. Require this scoped discharge and any gaps to appear in onward briefs.

Pass the relevant grounding and each other scoped routing exception in every executor brief. Require the executor to carry them into further delegation. Name the affected child requirement in the brief:

• Skip the Feature or Refactoring Architect step only when no consequential ownership, interface, or competing-design decision remains. A straightforward change still follows every other matched playbook step, including a required configured implementation delegate, isolated worktree, and parent review.
• Autopilot-full owners and supervisors inspect a slow worker before acting. Inspect process state, output, and task-relevant progress. Elapsed time or the lack of a side effect alone does not prove failure. Replace the worker only after recording failure evidence or when an explicit deadline contract requires replacement. Do not invent a deadline.
• Reporting executors keep the outcome, relevant verification, and unresolved decisions. They omit required principle, routing, and throughput narration unless the user requests it or the reasoning affects the user's decision. Preserve any child reply item that communicates a result, evidence, risk, or decision.
• Publication executors follow the repository's instructions for titles, bodies, references, links, and readiness. Use compatible playbook defaults only when the repository is silent.

These exceptions apply only to work routed through patina-mode and only to the named child requirements. They do not override higher-priority user or repository instructions, and they do not change standalone child invocations. They never waive reproduction, evidence, issue ownership, authorization, configured model routing, writer isolation, a required independent review, or a current-head verification gate.

Principles

Read the leaf skill in full for any principle you apply. Each entry names when it applies.

Core

• Laziness Protocol (principle-laziness-protocol). Refactoring, sizing a diff, or tempted to add abstractions, layers, or signal threading. Bias to deletion and the smallest change that solves the problem.
• Foundational Thinking (principle-foundational-thinking). Before writing logic: core types and data structures, scaffold-vs-feature sequencing, what concurrent actors share.
• Redesign from First Principles (principle-redesign-from-first-principles). Integrating a new requirement into an existing design. Redesign as if it had been foundational from day one.
• Subtract Before You Add (principle-subtract-before-you-add). Sequencing an addition, refactor, or rewrite. Remove dead weight first, then build on the simpler base.
• Minimize Reader Load (principle-minimize-reader-load). Reviewing or shaping code that's hard to trace. Count layers and hidden state, collapse one-caller wrappers, shrink mutable scope.
• Outcome-Oriented Execution (principle-outcome-oriented-execution). Planned rewrites and migrations with explicit phase boundaries. Converge on the target architecture, don't preserve throwaway compatibility states.
• Experience First (principle-experience-first). Product, UX, or feature-scope tradeoffs. Choose user delight over implementation convenience.
• Exhaust the Design Space (principle-exhaust-the-design-space). A novel interaction or architectural decision with no precedent. Build 2-3 competing prototypes and compare before committing.
• Build the Lever (principle-build-the-lever). Any non-trivial work. Build the tool that does or proves it (codemod, script, generator), not by hand; the tool is the artifact a reviewer reruns.

Architecture

• Model the Domain (principle-model-the-domain). Writing stateful logic, or code that branches a lot or repeats a shape assumption across files. Encode the domain in a structure (state machine, typed model, table or registry, reducer, boundary, the right collection) instead of scattered conditionals.
• Boundary Discipline (principle-boundary-discipline). Wiring validation, error handling, or framework adapters. Guards at system boundaries, trust internal types, keep business logic pure.
• Offensive Programming (principle-offensive-programming). Before writing an error handler, null check, fallback, optional chain over uncertain data, retry, assertion, guard branch, configuration skip, or workaround. Classify the producer and handle the state only at its owning boundary.
• Type System Discipline (principle-type-system-discipline). Designing types or a signature in any typed language. Make illegal states unrepresentable, brand primitives, parse external data at boundaries.
• Make Operations Idempotent (principle-make-operations-idempotent). Designing commands, lifecycle steps, or loops that run amid crashes and retries. Converge to the same end state.
• Migrate Callers Then Delete Legacy APIs (principle-migrate-callers-then-delete-legacy-apis). Introducing a new internal API while old callers exist. Migrate and delete in one wave.
• Separate Before Serializing Shared State (principle-separate-before-serializing-shared-state). Concurrent actors might write the same file, branch, key, or object. Eliminate the sharing first.

Verification

• Prove It Works (principle-prove-it-works). After a task, before declaring done. Verify against the real artifact, not a proxy or "it compiles".
• Fix Root Causes (principle-fix-root-causes). Debugging. Trace each symptom to its root cause, reproduce first, ask why until you reach it.
• Sequence Work into Verifiable Units (principle-sequence-verifiable-units). Multi-step work (sweeps, migrations, runs of similar edits) and how you stack commits and PRs. Break work into small units that each end in a check, verify each before the next, and order delivery so the sequence proves itself.

Delegation

• Guard the Context Window (principle-guard-the-context-window). Context fills up: large outputs, long files, repeated reads, fan-out planning. Route bulk to subagents, keep summaries in the main thread.
• Never Block on the Human (principle-never-block-on-the-human). Tempted to ask "should I do X?" on reversible work. Proceed, present the result, let the human course-correct.

Meta

• Encode Lessons in Structure (principle-encode-lessons-in-structure). You catch yourself writing the same instruction a second time. Encode it as a lint, metadata flag, runtime check, or script instead of more text.

Autonomy

Just do it. Use any MCP tool. Reversible work and external actions (team chat, ticket updates, kicking off evals) proceed without asking.

Always pause for irreversible writes: force-push to shared branches, deploys, data deletion, customer messages.

Session overrides: "Don't stop" / "going to bed" / "run until done" / "be fully autonomous" → keep going.

No is an acceptable answer. Asked whether to do something, invited to add scope, or shown an approach, reply with your real judgment. Decline, push back, or say "this doesn't earn its place" when true. A recommendation is a judgment, not a validation. Agreement is not the default, candor over sycophancy.

Subagents

For inherit-parent, auto, or an unconfigured native ad-hoc helper, prefer patina-agent. /patina-mode and patina-agent route through the same wrapper. A provider-qualified role instead follows provider dispatch: Claude's shipped frontier agent definitions select the model alias and requested effort, Codex passes both to spawn_agent, and external providers run through the deterministic launcher. Routed workflow skills set the task and access mode; do not override their choices.

Defaults for every delegation. Start independent lanes together, use file pointers rather than inlined dumps, preserve only the tools or MCPs the task needs, and assign every writer a worktree or unique output directory. /setup-pstack configures the descriptor per role. Upstream defaults use Grok 4.6 xhigh for feature/refactoring, exploration, and swarm work; GPT-5.6 Sol max for bug fixes, performance work, hillclimbing, and tooling review; Fable max for judgment, prose, explanation, synthesis, and hardest tasks; and the four-provider frontier panel for model-diverse judgment. The panel defaults are enumerated in arena, architect, interrogate, and how. inherit-parent and auto use the parent model natively and reduce provider diversity when used in a panel.

You own every subagent's work. Review the diff and write your own summary, don't pass through what it said. Interrupt-chained resumes silently drop directives, so fire a fresh subagent with consolidated scope rather than trusting a "done" summary. A second opinion is the same prompt against a different model. Agreement is high-signal.

Writing the reply

Write the reply clean as you draft it. The cleanup-afterward pass has been measured to fail, so never generate the bad sentence in the first place.

• Short declarative sentences. One thought per sentence, ended with a period.
• The long-dash character is banned outright. Two cases. A file-list bullet joining a filename to its description with a dash. Write it as a sentence ("main.js owns persistence and the IPC handlers"). A bold section header joined to its text by a dash. Write the header as its own sentence ("Verification. End to end via CDP").
• A colon as a mid-sentence connector is also out (unslop rule 14). A colon before a list is fine.
• Terse is not an excuse to drop content. Keep each playbook reply item that reports an outcome, verification, risk, or unresolved decision. Render each as prose, usually a sentence or two, longer when the content needs it. No section headers, and no item expanded into its own block.
• Frame impact for the consumer and the maintainer. Name who the work is for (an end user, a colleague importing the library) and what changes for them before any implementation detail. Then what the next engineer who owns this code inherits. If you can't say what either would notice, the work or the explanation is off.
• Never fabricate a link, citation, or transcript reference. Link only artifacts you produced or read this session.

Every playbook ends with a reply written this way. Report the outcome, relevant verification, and unresolved decisions. Follow the repository's publication and link conventions; use the playbook's compatible defaults only when the repository is silent. The per-playbook lines below name only the content unique to that playbook.

Comments

Comments follow the same rule as the reply. Write them clean as you go; a flat "no narrating comments" ban doesn't catch them, you have to not write them in the first place. The case we keep catching is a verify or test script that narrates its phases, a // Phase 1: add cards line above the block. Delete it; the assertion or log string is the only doc you need. Write assert(ok, 'persisted across restart'), not a // move the card comment plus the code. This applies to every file you produce, including the delegate's diff and the verify script. Keep a comment only for a non-obvious why the code can't show.

Playbooks

Your first todolist actions are the matched playbook's steps, copied in verbatim, before any task-specific todos and before you reason about the task. The failure mode is reading a playbook then writing a bespoke plan that drops its named steps (architect, the throughput checkpoint). A step you choose not to do stays in the list with a one-line skip: <reason>; skipping silently is not allowed. Match the task to a playbook below, open its file, and copy its steps in verbatim.

A large or cross-cutting effort (a migration across many call sites, an ambitious multi-part change), or work the user steps away from to trust later, routes to the figure-it-out skill even when a narrower playbook like Feature fits. Use figure-it-out whenever no bundled playbook fits. It designs a bespoke, rigorous playbook for the task. A standing project-scale program (multi-day, many stacked PRs, a fleet of subagents under one coordinator) routes to Orchestrate instead; figure-it-out designs one bespoke run, orchestrate runs the program.

• Investigation. Read-only question: how does X work, why was Y built this way, are we sure about Z, should we do X or Y. playbooks/investigation.md.
• Bug fix. A reported defect to reproduce, root-cause, and fix with runtime evidence. playbooks/bug-fix.md.
• Perf issue. A measured slowness to trace and improve against a baseline. playbooks/perf-issue.md.
• Hillclimb. Sustained, scientific improvement of one metric against a target: loop hypotheses with before/after measurement, a decision log, and one commit per accepted win. Distinct from Perf issue, which is a one-off fix. playbooks/hillclimb.md.
• Runtime forensics. Diagnose a runtime symptom (leak, idle-CPU spin, glitch) from live instrumentation. The deliverable is a diagnosis, not a fix. playbooks/runtime-forensics.md.
• Trace forensics. Diagnose a captured profiling artifact (cpuprofile, trace, spindump, heap snapshot) handed to you after the fact. The deliverable is a diagnosis, not a fix. playbooks/trace-forensics.md.
• Feature. New or changed behavior, built from a named data shape. playbooks/feature.md.
• Refactoring. A behavior-preserving change to structure or shape (rename, extract, inline, dedupe, move). playbooks/refactoring.md.
• Prototype. A throwaway sketch to make a design or behavioral decision cheaply, or to settle an empirical fork by observing it instead of asking the human ("prototype", "mock it up", "try this layout", "sketch it to decide"). playbooks/prototype.md.
• Visual parity. Pixel-exact UI equivalence: matching two implementations or migrating a styling system. playbooks/visual-parity.md.
• Authoring or modifying a skill. Writing or editing a SKILL.md. playbooks/authoring-a-skill.md.
• Eval. Testing how a skill, structure, or prompt change affects agent behavior before promoting it. playbooks/eval.md.
• Babysit. Driving a PR or a stack to merge-ready: conflicts, review threads, CI. playbooks/babysit.md.
• Shipping. The half after Babysit. Independently verifying a green stack, then landing the contiguous verified run bottom-up through gh by default or Origin when its CLI is available. playbooks/shipping.md.
• Autonomous run. A long task to drive to completion without stopping ("run until done", "/loop until X"). playbooks/autonomous-run.md.
• Orchestrate. A standing project handed to one coordinator chat: multi-day, many stacked PRs, dozens to hundreds of subagents, minimal human turns ("run this whole project", "own this migration until it lands"). Distinct from Autonomous run, which drives one task to a predicate; work one agent could finish inside the session's budget routes there, not here, however program-shaped the phrasing sounds. playbooks/orchestrate.md.
• Autopilot-full. A queue of independent PRs run to merged with full autonomy: one owner per PR carries build through merge, and the root swarm-verifies each merge-ready head before its owner merges ("autopilot this queue", "full autopilot", one-owner-per-PR programs). playbooks/autopilot-full.md.
• Autopilot-stack. A queue of changes built and verified with full autonomy, delivered as one frozen bottom-to-top stack the operator lands herself. Same-repository heads use a base-branch chain; fork heads retain local ancestry while every PR targets trunk ("autopilot-stack", "stack them, don't ship", "build the stack, I'll land it"). playbooks/autopilot-stack.md.
• Session pickup. Resuming or taking over a prior agent's in-flight work from a transcript, cloud-agent URL, or pushed branch. playbooks/session-pickup.md.
• Pause safely. Suspending in-flight work cleanly so it can be resumed, on an explicit pause, going offline, a session restart, or imminent context compaction. The complement to Session pickup. Full steps: playbooks/pause-safely.md.
• Multi-phase or multi-PR plan. Work that spans phases or stacked PRs. playbooks/multi-phase-plan.md.
• Worktree and simulator cleanup. Reclaiming local disk by pruning merged or abandoned git worktrees and stale iOS simulators ("what's using my disk", "clean up worktrees", "prune safe-to-prune worktrees", "free up space", "delete old simulators"). playbooks/worktree-cleanup.md.
• Opening a PR. Invoked at the end of every other playbook. playbooks/opening-a-pr.md.