apache
- 213 skills
- 0 followers
- 13 hours ago last updated
- ▌ Beam Concepts · apacheExplains core Apache Beam programming model concepts including PCollections, PTransforms, Pipelines, and Runners. Use when learning Beam fundamentals or explaining pipeline concepts.
- ▌ Io Connectors · apacheGuides development and usage of I/O connectors in Apache Beam. Use when working with I/O connectors, creating new connectors, or debugging data source/sink issues.
- ▌ Java Development · apacheGuides Java SDK development in Apache Beam, including building, testing, running examples, and understanding the project structure. Use when working with Java code in sdks/java/, runners/, or examples/java/.
- ▌ YAML Development · apacheGuides YAML SDK development in Apache Beam, including environment setup, testing, and key concepts. Use when working with Beam YAML code in sdks/python/apache_beam/yaml/.
- ▌ License Compliance · apacheEnsures all new files include proper Apache 2.0 license headers. Use when creating any new file in the Apache Beam repository.
- ▌ Python Development · apacheGuides Python SDK development in Apache Beam, including environment setup, testing, building, and running pipelines. Use when working with Python code in sdks/python/.
- ▌ Adding New Metadata · apacheGuide on how to add and propagate new metadata fields in Apache Beam's WindowedValue, extending protos, windmill persistence, and runner interfaces to avoid metadata loss.
- ▌
- ▌ Developing New Io Connectors · apacheEnd-to-end guide on developing new Apache Beam I/O connectors correctly, including core IO transforms, SchemaTransforms, URN proto definitions, Managed API integration, cross-language expansion service, and testing.
- ▌
- ▌ Precommit · apacheValidate and fix Pinot pre-commit checks on affected modules before a commit or PR.
- ▌ Quickstart · apacheStart and verify a local Pinot quickstart using the modes supported by the current checkout.
- ▌ Bench Compare · apacheCompare baseline and current Pinot JMH benchmark results using an isolated baseline worktree.
- ▌ Flaky Analyze · apacheInvestigate intermittent Pinot test failures in GitHub Actions and report evidence and likely causes.
- ▌ Review Testing · apacheReview Apache Pinot regression coverage and test quality when behavior or tests change.
- ▌ Review Naming API · apacheReview Apache Pinot naming and API conventions when public names, signatures, or documentation change.
- ▌ Review Performance · apacheReview Apache Pinot performance when hot paths change or a PR makes benchmark or efficiency claims.
- ▌ Review Architecture · apacheReview Apache Pinot architecture when module dependencies, SPI boundaries, abstractions, or class placement change.
- ▌ Review Process Scope · apacheReview Apache Pinot change scope and process when assessing PR descriptions, reverts, retries, or compatibility notes.
- ▌ Review Concurrency State · apacheReview Apache Pinot concurrency and state safety when locks, shared callbacks, lifecycle, or distributed metadata change.
- ▌ Review Config Backcompat · apacheReview Apache Pinot compatibility when configs, public APIs, SPI contracts, or serialized formats change.
- ▌ Review Correctness Nulls · apacheReview Apache Pinot correctness when null handling, numeric types, dispatch, or resource lifecycles change.
- ▌ Doris Debug · apache bundleApache Doris production diagnostics router. Use when Apache Doris queries are slow, imports are failing or timing out, compaction is raising -235 errors, nodes are OOM or crashing, materialized views are not rewriting, or tablet/replica health is degraded. Routes to the appropriate doris-debug-* skill. Covers shared-nothing and cloud (storage-compute separation) deployments.
- ▌ Doris Debug Node · apache bundleUse for Doris FE/BE OOM, crash, or false Alive. BE: MemTrackerLimiter lines in be.WARNING; FE: JVM heap / jstack. Distinguish heartbeat Alive from query/brpc serving health.
- ▌ Doris Debug Cloud · apache bundleUse for Doris storage-compute separation (cloud mode) issues: meta-service latency, cache miss storms, object store throughput, and shared-nothing config conflicts in compute groups.
- ▌ Doris Debug Query · apache bundleUse for Apache Doris slow/hanging/timeout queries. Covers FE planner (Nereids timeout), BE Profile bottlenecks, and Exchange WaitForData / brpc E1008 on port 8060. Session vars: enable_profile, query_timeout, nereids_timeout_second.
- ▌ Doris Repo Review · apache bundleReview an Apache Doris PR from a local clone with the same multi-agent, shared-ledger convergence workflow as the CI Code Review Runner. Use when the user supplies a PR to `/doris-repo-review`, asks to review a Doris PR locally, or asks for the CI-style review flow. Safely align only the current worktree to the exact PR head, refuse to disturb tracked local changes, write equivalent English and Chinese review documents with verified path-line anchors, and never build, test, or edit source. Treat a review as pipeline-equivalent only when an explicitly selected qualified reviewer uses a supported effort (xhigh or max, plus ultra for Codex), preferring GPT-6 Astra on Codex and Fable 5.1 on Claude Code. After a converged APPROVE result, automatically post one machine-readable PASS comment bound to the reviewed commit.
- ▌ Doris Debug Import · apache bundleUse for Doris Stream/Broker/Routine Load issues and Group Commit async_mode WAL pile-up. Tunables: table group_commit_interval_ms / group_commit_data_bytes; BE group_commit_insert_threads, group_commit_wal_path, group_commit_wal_max_disk_limit.
- ▌ Doris Debug Tablet · apacheUse for Doris tablet/replica health, version skew, clone backlog, disk balance, and tablet repair. Commands: SHOW PROC tablet_health, SHOW TABLET, ADMIN REPAIR.
- ▌ Doris Best Practices · apache bundleApache Doris table design and cluster sizing best practices. MUST USE when writing, reviewing, or optimizing Doris CREATE TABLE statements, partition/bucket strategies, data models, or cluster configurations. ALSO MUST USE whenever the doris-architecture-advisor skill produces DDL — apply the Pre-Flight Checklist to every CREATE TABLE before output. Also triggers on any workload design involving: IoT, analytics, dashboard, CDC, time-series, log analysis, real-time warehouse, point query, data platform, or any scenario where table design decisions are being made. Also triggers on replacing or migrating from legacy analytics/search/serving stacks such as Impala, Kudu, Elasticsearch/ES, Greenplum, Presto, HBase, Hive, Hadoop, Redis, or Lambda-style multi-engine data platforms, even when Apache Doris is not named explicitly. Also use when user provides an Apache Doris connection string or asks to get started. Also triggers on slow query investigation, query profiling, runtime performance diagnosis, tablet skew an
- ▌ Doris Profile Reader · apache bundleInterpret Apache Doris query runtime profiles, especially profile bottleneck triage, misleading wait counters, per-operator metric priority, scan, join-order/runtime-filter analysis, and evidence-bounded performance explanations. Use when given a Doris profile, query id, profile URL/text, or a request to explain Doris query performance.
- ▌ Doris Debug Data Lake · apache bundleUse for Doris external catalog issues: Hive/Iceberg/Paimon/Hudi query failures, metadata refresh, filesystem S3/HDFS connectivity, external MV rewrite misses.
- ▌ Doris Debug Compaction · apache bundleUse for Doris -235 / too many versions and compaction lag. Error raised in RowsetBuilder::check_tablet_version_count when version_count > max_tablet_version_num (default 2000) or meta serialize size limit.
- ▌ Doris Debug Deployment · apacheUse for Doris FE/BE startup failures, port conflicts, priority_networks misrouting, meta_dir corruption, and ADD/DROP BACKEND issues.
- ▌ Doris Architecture Advisor · apache bundleWorkload-aware architecture design for Apache Doris. MUST USE when designing data architectures, choosing between data models, planning ingestion strategies, sizing clusters, or translating business requirements into Apache Doris system designs. Complements doris-best-practices with decision frameworks and sizing-first workflow. Use when user describes a workload involving: IoT, sensor data, telemetry, real-time analytics, dashboard, log analysis, log search, CDC sync, time-series, device monitoring, point query service, ad-hoc analytics, lakehouse federation, ETL/ELT pipeline, report analytics, clickstream, user behavior, observability, metrics, fleet tracking, or any OLAP workload requiring table design from scratch. Also triggers on prompts like: "design a table for...", "how should I store...", "build an architecture for...", "we have X devices sending data every Y seconds", "recommend a cluster size for...", "what data model should I use for...", "we need to ingest X GB/day", "migrate from MySQL/PostgreS
- ▌ Doris Debug Materialized View · apache bundleUse for Doris sync MV (rollup) miss or async MTMV refresh/rewrite issues. Commands: SHOW ALTER TABLE MATERIALIZED VIEW, mv_infos(), EXPLAIN, REFRESH MATERIALIZED VIEW.
- ▌ Doris Debug Resource Isolation · apache bundleUse for Doris Workload Group / resource tag queue starvation, CPU/memory isolation leaks, and workload policy debugging. Commands: SHOW WORKLOAD GROUPS, EXPLAIN resource.
- ▌ Magpie Setup · apache bundleAdopt and maintain the apache-magpie framework in a project repo via the snapshot-based installation mechanism. The only framework skill committed in an adopter's repo; every other skill is a symlink the install sub-action wires up. Sub-actions: `/magpie-setup` - first-time install (default; main-checkout only). `adopt` is an alias. `/magpie-setup upgrade` - refresh the gitignored snapshot per the committed lock (main-checkout only) `/magpie-setup worktree-init` - symlink a worktree's snapshot to the main's `/magpie-setup verify` - health check + drift detection `/magpie-setup skill-sources` - fetch/pin/symlink skills from trusted external sources listed in the adopter trust list (main-checkout only) `/magpie-setup override <skill>` - open or scaffold an agentic override in `.apache-magpie-overrides/` `/magpie-setup uninstall` - reverse the install (snapshot, locks, symlinks, hook, doc sections); preserves `.apache-magpie-overrides/` by default (main-checkout only). `unadopt` is an alias.
- ▌ Magpie List Skills · apache bundlePrint a human-readable index of every skill installed for this repository, grouped by the family each one declares, with the name to invoke it by and the first sentence of its `description`. Discovery is installation-aware: it covers a pinned snapshot install, the framework checkout, and marketplace plugin installs, so the index matches what the agent can actually run. Generated on every run from live `SKILL.md` frontmatter, so it never goes stale when skills are added, removed, or rewritten.
- ▌ Magpie Write Skill · apache bundleAuthor a new skill for the Apache Magpie framework, or update an existing one. Walks the user through the framework's skill shape (frontmatter, resources, placeholder convention, prompt-injection defences, Privacy-LLM gate-check) and validates via the framework's existing [`tools/skill-and-tool-validator`](../../tools/skill-and-tool-validator/). Scaffolds new skills via `init_skill.py`.
- ▌ Magpie Issue Triage · apacheFor each open `<issue-tracker>` issue in the configured candidate pool, read the issue body and comments and classify the candidate disposition. On user confirmation, posts a triage-proposal comment that invites the project team to react. Read-only on tracker state — no workflow transitions, closures, or label changes. Six classes in the body.
- ▌ Magpie Setup Status · apache bundleShow how the apache-magpie framework is adopted in the current repo, then adjust that setup in place. Renders a Markdown adoption dashboard: install method and pin, drift, the wired agent targets, the installed skill families, and symlink health. From the same view the user can add or drop agent targets and skill families; the actual change runs through the setup skill.
- ▌ Magpie Issue Reassess · apache bundleSweep a configured pool of resolved or end-of-life `<issue-tracker>` issues and re-assess each against the current `<default-branch>`. Per-issue: invoke `issue-reproducer` to extract and run the reporter's code, classify the runtime outcome, attach a nature analysis, compose a `verdict.json`. Hand-back-on-completion contract: no comments posted, no transitions, no closures.
- ▌ Magpie Optimize Skill · apache bundleOptimize an existing framework skill (or sweep a set of them) by applying the restructuring patterns proven on the security-skill suite: split an oversized `SKILL.md` into linked sibling docs, lift concrete/project-specific values out of the body into `<project-config>` placeholders, replace in-agent-context body reads with out-of-context tool calls, batch per-item fetches into a single upfront pass, and add a deterministic pre-flight no-op classifier ahead of LLM passes. Every change is a behavior- preserving proposal the maintainer signs off on; the skill validator must stay green before and after. The refactoring sibling of `write-skill` (which authors net-new skills).
- ▌ Magpie Pr Stale Sweep · apacheSweep open pull requests on the configured `<upstream>` repo for inactivity past a configurable threshold and propose either a conversion to draft (when the PR is open but has gone quiet) or a closure (when the PR has been abandoned long enough to presume the author has moved on). Waits for maintainer confirmation before converting or closing anything.
- ▌ Magpie Release Rc Cut · apacheEmit the paste-ready command sequence to tag an RC, build artefacts, sign each artefact, generate checksums, and stage them to the adopter's distribution backend. Covers Steps 4–5 of the release-management lifecycle. Never runs any command locally — all sequences are emitted for the Release Manager to execute on their own machine with their own key and ASF credentials.
- ▌ Magpie CI Runner Audit · apache bundleRead-only audit of GitHub Actions workflow runner compatibility for one repository, an explicit repository set, one Apache project with multiple repositories, or the full Apache GitHub org. Finds obsolete GitHub-hosted runner labels and macOS runner/tool architecture mismatches. Produces TSV evidence files; never edits workflows, opens PRs, or posts comments.
- ▌ Magpie Release Prepare · apacheDraft release preparation artefacts for `<upstream>`: the planning issue, the version-bump and changelog prep PR, or the post-release development-version bump PR. Reads release metadata from `<project-config>/release-trains.md` and `<project-config>/release-management-config.md`. Every output is a draft confirmed by the Release Manager before filing; the agent never marks a PR ready, never merges, and never closes any artefact.
- ▌ Magpie Release Promote · apacheEmit the backend-shaped promotion command set for a release that has passed its vote. Reads the planning issue (must carry `vote-passed`), constructs the staging → release move for the configured distribution backend, checks PMC membership of the Release Manager, and proposes the `promoted` label. Never runs the promotion command itself and never publishes the release.
- ▌ Magpie Dependency Audit · apacheRead-only dependency vulnerability audit for one repository or a local checkout. Detects the project's dependency manager(s), runs the appropriate audit tool, surfaces patchable findings grouped by severity, and proposes upgrades for maintainer review. Never modifies manifests or lock files and never opens update PRs.
- ▌ Magpie Issue Reproducer · apache bundleFor a single `<issue-tracker>` issue identifying a code-level bug, extract the reporter's example code from the issue body, adapt it to run on the current `<default-branch>`, execute via `<runtime>`, and compose a `verdict.json` describing the observed behaviour vs the expected failure. Read-only on the tracker — produces evidence, never posts. Invoked by `issue-triage` and `issue-reassess`; can also be run standalone.
- ▌ Magpie Reviewer Routing · apacheGiven an open issue or PR, scores the project's configured reviewer roster across three signals — touched-area eligibility, git-history familiarity with the changed paths, and current open-review load — and proposes a primary reviewer (plus an optional backup). Read-only and propose-then-confirm: nothing is assigned, labelled, or requested without the maintainer's explicit confirmation. An unresolved roster produces an explicit NO ELIGIBLE REVIEWER signal, never a fabricated handle.
- ▌ Magpie Skill Reconciler · apache bundleCompare two near-duplicate skills — typically an ASF variant and a non-ASF or multi-project variant — and classify every difference as ALLOWED, DRIFT, or SAFETY-BASELINE. Produces a structured diff and a reconciliation proposal. Read-only: it never rewrites either skill; convergence is a separate confirmed authoring step. A safety-baseline divergence is always a must-fix, never silently merged into allowed-divergence noise.
- ▌ Magpie Audit Finding Fix · apacheFor a batch of findings from a non-security audit tool (`<audit-tool>` — ruff / flake8 / mypy / pylint / CodeQL / Apache Verum / Apache Caer / equivalent; full list in the body) against `<upstream>`, draft the smallest fix for each finding. Re-runs the tool after each batch to confirm the findings are cleared. Produces a commit and a hand-back artefact; never opens a PR on autopilot or merges.
- ▌ Magpie Flaky Test Triage · apacheRead-only flaky-test detection from GitHub Actions CI run history for one repository. Parses workflow run outcomes over a configurable window, computes per-job failure rates, and distinguishes intermittent failures (flaky) from consistent failures (deterministically broken). Produces a prioritised triage list without modifying any test code, workflow file, or tracker state.
- ▌ Magpie Issue Deduplicate · apacheMerge two open `<issue-tracker>` issues that describe the same root cause, preserving both reporters' context. Proposes a closing comment on the duplicate and a cross-reference comment on the kept issue. Waits for maintainer confirmation before posting anything or closing anything.
- ▌ Magpie Issue Stale Sweep · apacheSweep open `<issue-tracker>` issues for inactivity past a configurable threshold and propose either a closure (when the issue has been unresponsive long enough to presume abandonment) or an update request (nudge the reporter to confirm the issue is still relevant). Waits for maintainer confirmation before posting any comment or closing anything.
- ▌ Magpie Mentoring Welcome · apache bundleDraft a first-contact orientation comment for a first-time contributor on a newly opened issue or PR on the configured `<upstream>` repo. Detects first-time authorship via the GitHub `author_association` field and drafts a welcome with contributing-guide link, community-norm pointers, and expected next steps. Waits for explicit maintainer confirmation before posting. Does not post for repeat contributors.
- ▌ Magpie Release Keys Sync · apacheDraft the diff that adds the Release Manager's public key to the project's KEYS file (`<keys-file-url>`), emit a paste-ready `svn` (or backend-equivalent) command sequence, remind the RM to upload to the configured keyserver, and validate the key meets the ASF strength floor. Never commits, never holds or reads the private key. Runs during release preparation, before RC signing begins.
- ▌ Magpie Release Verify Rc · apacheRead-only pre-flight verification of a staged release candidate (RC) for `<upstream>`. Checks artefact integrity (GPG signatures and checksums), Apache RAT licence headers, NOTICE/LICENSE completeness, prohibited-binary absence (including `.pyc` / `__pycache__`), source-tree integrity (no dangling symlinks or broken internal references), and version-string consistency. Emits a structured PASS / PASS-WITH-WARNINGS / FAIL report. Makes no state change; a `--post-to <planning-issue>` flag proposes a comment for explicit RM confirmation before any posting.
- ▌ Magpie Issue Fix Workflow · apacheFor a single triaged `<issue-tracker>` issue confirmed as a bug or feature, draft a fix against `<upstream>` on `<default-branch>`. Produces the failing test, the smallest production change, the targeted+module test runs, and the commit. The PR is NOT opened on autopilot; the human committer reviews, signs, and pushes. Hand-back artefact summarises branch, commits, test results, and scope.
- ▌ Magpie Pre First Pr Check · apacheRun a newcomer-focused pre-flight checklist on a local branch before opening a pull request. Checks CONTRIBUTING conventions, SPDX headers on new files, commit-message shape (including the Generated-by: trailer for AI-assisted work), and the placeholder convention — then returns a structured checklist report. Read-only; no state changes, no PR, no external writes.
- ▌ Magpie Release Vote Draft · apacheDraft the `[VOTE]` email body and planning-issue comment for an RC of `<upstream>`. Reads RC metadata from the planning issue and `<project-config>/release-management-config.md`; produces a ready-to-copy `[VOTE]` subject + body and a proposed planning-issue comment. Never sends mail and never posts without explicit RM confirmation.
- ▌ Magpie Release Vote Tally · apacheAfter the approval window closes, fetch the approval signal for an RC of `<upstream>`, classify each reply as +1 / 0 / -1 and binding or non-binding against the configured roster, produce the tally summary, and draft the `[RESULT] [VOTE]` email. Never sends mail and never applies a label without explicit RM confirmation.
- ▌ Magpie Security Issue Fix · apache bundleAttempt to fix a security issue tracked in `<tracker>` by implementing the change in a public `<upstream>` PR. Runs `security-issue-sync` first to reconcile the issue's state, proposes an implementation plan, and on explicit user confirmation writes the change, opens a PR from the user's fork, and updates the `<tracker>` tracking issue. Public PR content is scrubbed so it does **not** reveal the CVE, the security nature of the change, or any link back to `<tracker>`.
- ▌ Magpie Setup Upstream Fix · apacheTurn a framework bug or quirk the agent hit while running a Magpie skill or tool into a fix PR against `apache/magpie` — one PR per issue. First confirms the problem is a framework defect (not a local misconfiguration or a stale snapshot), then searches `apache/magpie` for an existing issue or PR that already covers it, and only proposes a new fix PR when none exists — otherwise it points the user at the pending one.
- ▌ Magpie Issue Backlog Stats · apacheRead-only maintainer dashboard for the open general-issue backlog of <issue-tracker>. Surfaces a health rating, prioritised recommendations, age and staleness breakdowns, area pressure ranking, and a triage-funnel summary. Output is HTML by default; markdown fallback available.
- ▌ Magpie Pairing Self Review · apacheRun a structured pre-flight self-review on local changes before opening a PR. Reads the diff against a configurable base (default: the merge base of HEAD and the upstream default branch), checks correctness, security, and project conventions, and returns a structured report to the developer. No state changes, no PR, no external writes — the report is the output.
- ▌ Magpie Pr Management Stats · apache bundleRead-only maintainer dashboard for the open-PR backlog of <upstream>. Surfaces a health rating, prioritised action recommendations, weekly closure velocity trends, area pressure ranking, and a triage-funnel breakdown — with the underlying area-grouped tables as a collapsible details section.
- ▌ Magpie Security Issue Sync · apache bundleSynchronize a security issue in <tracker> with the state of its GitHub discussion, the <security-list> mailing thread, and any <upstream> PRs that fix it. The skill gathers all relevant signals and proposes label / milestone / assignee / field / draft-email updates — applying only what the user has explicitly confirmed. Suggests the next step in the handling process and prints the CVE allocation link when a CVE is needed.
- ▌ Magpie Committer Onboarding · apache bundlePost-vote committer and PMC onboarding for Apache projects. Walks the nominator through every step from ICLA check to welcome announcement for both incubating podlings and graduated top-level projects.
- ▌ Magpie Issue Reassess Stats · apache bundleRead-only dashboard over a directory of `verdict.json` files produced by `issue-reassess` campaigns. Surfaces a health rating, classification distribution, partial-fix surfaces, oldest-unresolved buckets, and per-component breakdowns. Output is HTML by default; markdown fallback available. Read-only on tracker state; consumes campaign artefacts.
- ▌ Magpie Onboarding Concierge · apacheAnswer a newcomer's "how do I contribute here" question by grounding the response in `CONTRIBUTING.md` and the project's own docs. Classifies the question (setup / workflow / first-issue / out-of-scope), retrieves the relevant guide excerpt, and drafts a concise answer in the Agentic Mentoring teaching register. Routes out-of-scope questions (design, security, deprecation, architectural taste) to a human maintainer. Read-only; produces a draft answer text — no files are written and no comments are posted without the maintainer's explicit action.
- ▌ Magpie Pr Management Mentor · apache bundleDraft a teaching-register comment on a single GitHub issue or PR thread on the configured `<upstream>` repo, aimed at a contributor who is missing repo context the maintainer would otherwise have to spell out. The skill reads the thread, decides whether a mentoring intervention is warranted, drafts one comment per the project's tone guide and convention pointers, and waits for explicit maintainer confirmation before posting via `gh`. Escalates to the configured maintainer team on the four hand-off triggers.
- ▌ Magpie Pr Management Triage · apache bundleSweep open pull requests on the configured `<upstream>` repo, classify each one against the project's quality criteria, propose a disposition, and — on the maintainer's confirmation — carry out the action via `gh`. Disposition options per PR: draft / comment / close / rebase / CI-rerun / workflow-approve / ping-stale-reviewer / request author confirmation of readiness / mark `ready for maintainer review` / promote bot-authored draft. Does **not** perform code review — that lives in `pr-management-code-review`.
- ▌ Magpie Release Audit Report · apache bundleAssemble a per-release audit record from lifecycle artefacts (planning issue, vote thread, artefact list, promote revision, and announcement URL) and propose a PR appending it to the project's audit log. Read-only on every release surface; the only write is a PR the RM reviews and a committer merges.
- ▌ Magpie Contributor Sentiment · apacheMeasures contributor-sentiment signals on <upstream> over a configurable window: thread tone (first-response classification), time-to-first-reply (median hours), first-PR retention (second-PR rate), and reviewer load (Gini coefficient). Compares each signal against a pre-adoption baseline and produces a structured gate report used to decide whether a skill family is ready to advance from experimental to stable.
- ▌ Magpie Release Archive Sweep · apacheScan the release distribution area (`dist/release/<project>/` when `release_dist_backend = svnpubsub`, or the configured distribution location), identify releases past the project's retention rule, and propose the backend-shaped command set to move them to the archive area. Read-only on the distribution surface; the RM executes every archival command as themselves.
- ▌ Magpie Security Cve Allocate · apacheWalk a security team member through allocating a CVE for an `<tracker>` tracking issue (governance-gated per `governance.cve_allocation_gate`). Prints the configured `<cve-tool>` allocation URL, waits for the allocated CVE ID, then updates the tracker in place. Tracker updates: CVE tool link field, cve allocated label, status-change comment, CVE JSON. Chains into `security-issue-sync` afterwards to reconcile the rest of the tracker.
- ▌ Magpie Security Issue Triage · apacheFor each open `<tracker>` issue carrying the `needs triage` label, read body + comments and classify the candidate disposition into one of six classes: VALID / DEFENSE-IN-DEPTH / INFO-ONLY / INVALID / PROBABLE-DUP / FIX-ALREADY-PUBLIC. On user confirmation, posts a triage-proposal comment that invites the security team to react. Read-only on tracker state — no label flips, closes, or CVE allocations. Supports `--retriage` for re-litigating passed-triage decisions when substantive new activity lands.
- ▌ Magpie Security Model Update · apacheRefresh an existing security model from what has actually happened since it was written. Mines the decision history — `<tracker>` dispositions with their stated reasons, reporter correspondence on `<security-list>`, published advisories and the project's canned responses — then maps each outcome onto the model's own disposition set and proposes a diff. Two products: **new known-non-finding entries** (§1.15) for patterns rejected repeatedly for the same documented reason, and a **model-gap list** naming decisions the model cannot derive. Regression-checks the proposal against past valid reports so a widened disclaimer cannot silently start closing real vulnerabilities. Read-only on the tracker; every output scrubbed for public release.
- ▌ Magpie Security Model Verify · apache bundlePre-flight check on a project's published security model, run per repository in scope. Verifies two things — (1) **discoverability**: an agent can mechanically reach the model by following `AGENTS.md` → `SECURITY.md` → model at a named commit, and (2) **completeness**: the model covers the minimum-bar sections an automated triager depends on. Produces one concrete remediation per failing check: a repo PR when the gap is mechanical (a missing link line, a missing pointer file), a private mail to `<governance-body>` when the gap is substantive and needs maintainer input. Read-only by default; every external write is gated on explicit approval.
- ▌ Magpie Contributor Nomination · apache bundleRead-only nomination brief for a named GitHub contributor on <upstream>. Aggregates GitHub activity across all contribution tracks plus maintainer-supplied off-GitHub signal, and flags vendor-neutrality context — the evidence a PMC needs to open a committer or PMC nomination thread.
- ▌ Magpie Good First Issue Sweep · apacheSweep the open `<issue-tracker>` backlog for existing issues that could be labelled as good first issues. Classifies each candidate as READY (propose the GFI label), NEAR-MISS (surface edits to make it GFI-ready), or SKIP using the G1–G7 suitability rubric. Applies labels only after explicit maintainer confirmation; never edits issue bodies without the maintainer's direction.
- ▌ Magpie Release Announce Draft · apacheDraft the `[ANNOUNCE]` email body and open (not merge) the site-bump PR for a promoted release of `<upstream>`. Reads release metadata from the planning issue and `<project-config>/release-management-config.md`; produces a ready-to-copy `[ANNOUNCE]` subject + body and proposes the site-bump PR. Never sends mail and never merges the PR without explicit RM confirmation.
- ▌ Magpie Report Framework Issue · apacheHelp an adopter or framework developer file a clean, redacted GitHub issue against the Apache Magpie framework repo when a skill, tool, or doc misbehaves. It gathers the problem from the user — never from the raw session transcript — then runs a mandatory public-disclosure scrub before rendering the report into the framework's `bug_report` / `change_proposal` issue template, checking for duplicates, and filing via `gh issue create --web` only on explicit confirmation. The scrub is the point: the destination is a public repo, so the skill strips any private tracker, embargoed-CVE, private-list, or cross-project content the report would otherwise leak.
- ▌ Magpie Security Model Prepare · apacheFront door for a project that has no published security model yet. Opens the conversation with `<governance-body>` on the private list, drives production of a first draft — delegating the model-writing itself to the Alpha-Omega threat-model skill set — in **draft-first** mode so maintainers react to concrete prose instead of composing from a blank page, then lands the model and its `AGENTS.md` → `SECURITY.md` discoverability chain as one reviewable PR per repository. Every claim carries a provenance tag; every inferred claim carries a matching open question. Drafts and proposes; the maintainers decide.
- ▌ Magpie Good First Issue Author · apache bundleDraft a single net-new *good first issue* on the configured `<upstream>` repo from one supplied candidate such as a known gap or a small maintainer-named task. The skill first runs a suitability gate to confirm the candidate is small and newcomer-safe. If it passes the skill drafts one issue. The draft carries scope, code pointers, contributing-doc links, acceptance criteria, and an effort estimate. A readiness checklist gates the draft before it is shown. Nothing is filed via `gh` until the maintainer explicitly confirms. The skill never curates or relabels the existing backlog.
- ▌ Magpie Setup Override Upstream · apacheWalk an adopter through promoting a local `.apache-magpie-overrides/<skill>.md` file into a PR against `apache/magpie`. After the PR merges and the adopter runs `/magpie-setup upgrade`, the override file is no longer needed and the skill prompts for its removal.
- ▌ Magpie Workflow Security Audit · apacheRead-only GitHub Actions workflow security audit for one repository, an explicit repository set, or a whole GitHub org. Runs `zizmor` to surface injection vulnerabilities, excessive permissions, unpinned external actions, and self-hosted-runner fork-secret leaks. Produces a grouped, prioritised finding report; never edits workflow files, opens PRs, or posts comments.
- ▌ Magpie Contributor To Committer · apacheRead-only readiness tracker that maps a contributor's GitHub activity against the adopter's PMC-declared committer or PMC thresholds and surfaces a traffic-light brief (Not yet / Approaching / Ready to nominate) plus the specific evidence gaps that remain.
- ▌ Magpie Dependency License Audit · apacheRead-only license audit of a project's direct and transitive dependency tree. Detects the dependency manager(s), resolves each dependency's declared license from ecosystem metadata, classifies each against a configured policy (ASF three-category A/B/X model or a custom allowlist), and surfaces incompatible, forbidden, and unknown-license dependencies for maintainer review. Never modifies manifests or lock files.
- ▌ Magpie License Compliance Audit · apacheRead-only license compliance audit for one repository or a local checkout. Checks that a LICENSE file exists, that a NOTICE file is present and complete when required by the declared license, and that source files carry SPDX-License-Identifier headers consistent with the project's declared license. Produces a grouped compliance report and proposes remedies for maintainer review. Never modifies any file.
- ▌ Magpie Newcomer Issue Explainer · apacheGiven an open good-first-issue on the configured `<upstream>` repo, explain it in beginner terms and sketch a concrete approach: which files to read first, what "done" looks like, and where to ask follow-up questions — without writing any code or fix. First runs an issue assessment to confirm the issue is open, non-security, and scope-clear. Then drafts the explanation for maintainer review. Read-only; nothing is posted without explicit maintainer confirmation.
- ▌ Magpie Setup Shared Config Sync · apacheCommit + push the user's shared Claude config to the `~/.claude-config` private dotfile-style sync repo. Inspects for uncommitted local edits and unpushed commits, drafts a commit message, and after explicit approval commits and pushes. Runs `git pull --rebase` first if the local checkout is behind, so a push never overwrites concurrent work from another machine. Bootstraps the repo when it is missing: clones the default private remote if it exists, or creates a new private remote + scaffolds the minimal layout if it does not. Never force-pushes; never rewrites already-pushed history; never creates a public remote; never modifies files outside `~/.claude-config/` (except the confirmed fresh-host symlink wiring into `~/.claude/`).
- ▌ Magpie Pr Management Code Review · apache bundleWalk a maintainer through deep, sequential code review of open pull requests on the configured `<upstream>` repo. Defaults to the **"my reviews"** queue (the union of five maintainer signals — see the Inputs table); selectors can narrow to a single PR, an area label, or a collaborator subset. Drafts an `approve` / `request-changes` / `comment` review per PR and posts on the maintainer's confirmation.
- ▌ Magpie Pr Management Quick Merge · apache bundleIdentify trivial, low-risk pull requests in the `ready for maintainer review` queue of <upstream> that pass every quality gate and touch only supplementary areas (docs, changelog, translations, tests) — the "express lane" a maintainer can review and merge in seconds. Surfaces and ranks candidates with per-PR diff summaries, an all-gates-green attestation, and the exact merge command. On the maintainer's explicit per-PR confirmation it can submit an APPROVE review (the maintainer's own review of the trivial diff — useful when the PR has no approvals yet and branch protection needs one), exactly as pr-management-code-review does. It never merges itself — automated merge is the framework's deliberately-deferred Agentic Autonomous mode; the maintainer runs the printed merge command in their own session.
- ▌ Magpie Security Issue Invalidate · apacheClose an `<tracker>` tracking issue as invalid: apply the `invalid` label, remove the scope label, post a short closing comment, archive the item from the project board, and — for trackers imported from `<security-list>` — draft a polite-but-firm reply to the reporter on the original Gmail thread explaining the team's reasoning (extracted from the tracker's discussion). For trackers opened via `security-issue-import-from-pr`, the email-draft step is skipped per the *no outreach to the PR author* rule of that skill.
- ▌ Magpie Contributor Activity Sweep · apacheRead-only GitHub activity card for a named contributor on <upstream>. Fetches PR authorship, code-review activity, issues, and PR/issue comments over a configurable window. Limited to GitHub-visible activity — the body documents the off-GitHub tracks the nominator must supply separately. No readiness verdict is produced; use contributor-nomination for a full nomination brief.
- ▌ Magpie Pairing Multi Agent Review · apacheFan a local diff through three independent, axis-focused review passes (correctness, security, conventions), then merge the findings into a single structured report. Each pass is isolated so findings from one axis cannot suppress or bias the others. The merged report uses the same format as pairing-self-review so the developer gets a consistent signal regardless of which Agentic Pairing skill they invoke.