Use when running a systematic, self-directed skill-and-NFR audit on a website/web-app project — discovering skills from Tessl and VoltAgent, identifying non-functional-requirement gaps (performance, accessibility, security, SEO, testing, privacy, i18n, ...), and planning/implementing improvements in small, verified, committed phases. Trigger on "skill audit", "NFR audit", "audit this project for skills/gaps", "what skills am I missing", or before starting a multi-phase quality-improvement effort on a site.

Hold a daily standup with the named Herdr agents and print a table the operator can find while scrolling back through a long session: ask each idle worker for four lines (DONE / PLAN / BLOCKED / REPORT), fill the busy ones from the round log, and render a banner-topped fixed-width block plus a Markdown record. Use when the user wants a standup, a daily status round, a summary of what each agent is doing, "what is everyone working on", or a status table for the team. Requires HERDR_ENV=1.

Run Herdr rounds with on-demand specialists, qualified tiers, bounded briefs, report verification, and release gates. Use for requests to dispatch the Herdr team, balance worker usage, collect reports, run or retrieve retrospectives, catch up on outstanding user attention, curate team lessons, or save and resume lead handoffs. Live rounds require HERDR_ENV; saved memory and attention work offline. Other standalone tasks skip this skill.

Bootstrap a consumer repo onto gamussa/coding-policy: install the plugin at `latest`, gitignore tessl's generated artifacts, scaffold the Codex policy-review workflow plus the Copilot lane charter, set the CODEX_AUTH_JSON secret, then commit and ship via the release skill. Use when the user wants to add, install, enable, scaffold, set up, wire up, or enroll coding-policy / an automated policy review / a PR reviewer in a repo. Also use to upgrade or refresh the reviewer files in a repo that already has them (override mode: "upgrade", "update", "refresh", "--override").

Research and write the script for a talking-head reel — sharpen a topic into one arguable claim, search the web for facts and articles that back it (every claim sourced or cut), then write both a full teleprompter script and a beat sheet in the user's own voice. Hands its sourced articles to the broll-sourcing skill so they become the on-screen screenshots. Use when the user says they want to talk about a topic, asks for a reel script, wants facts or articles found for a take, or names a subject for "today's reel". Writing and research only — no video touched here.

Scan the pull requests merged since the last changelog entry and draft the next one in the project's own style, then open a pull request with the draft. Use for a weekly or per-release changelog you no longer want to write by hand.

.NET unit testing (C# / F# / VB.NET) with xUnit.net as the primary framework - `[Fact]` single tests, `[Theory]` + `[InlineData]`/`[ClassData]`/`[MemberData]` parametrization, class and collection fixtures (`IClassFixture` / `ICollectionFixture`), parallel-execution config, `ITestOutputHelper` output, skip/traits filtering, and `dotnet test` CI with trx + coverage. Includes framework choice (xUnit for new projects; match an existing NUnit/MSTest convention detected from csproj PackageReferences; legacy .NET Framework 4.x → NUnit or MSTest) and test-authoring conventions (AAA mapping, argument-order traps, no fabricated methods, no smoke asserts). References cover NUnit (`[TestCase]`, constraint-model `Assert.That`), MSTest (`[TestClass]` / `[DataRow]` / TestContext), and the FluentAssertions `.Should()` catalog including the v8 commercial-license change. Use for any .NET unit-test task: choosing or configuring a framework, writing or parameterizing tests, fixtures, or wiring CI.

Sets up and repairs JavaScript / TypeScript unit tests - a suite that cannot resolve the project's path aliases (`@lib/...` declared in jsconfig or tsconfig), a regression that shipped because the tests asserted too little, or a module dependency that needs mocking, spying, or fake timers. Jest and Vitest as co-primary frameworks: install, config (`jest.config.js` / `vite.config.ts` test block), mocking (`jest.fn`/`jest.mock`/`jest.spyOn`, `vi.fn`/`vi.mock`/`vi.spyOn`, `__mocks__/`, fake timers), coverage (Istanbul/babel vs v8 providers, `coverageThreshold` gating), watch mode, and CI (`jest --ci`, `vitest run`, JUnit XML). Use when authoring, configuring, or repairing unit tests in a JS/TS project.

Pure-reference catalog of row-level security for tenant isolation, Postgres-first. Covers enabling RLS (ALTER TABLE ... ENABLE ROW LEVEL SECURITY, default-deny semantics), CREATE POLICY syntax (USING vs WITH CHECK clauses, FOR SELECT/INSERT/UPDATE/DELETE/ALL, permissive vs restrictive, TO role_name), bypassing RLS (superuser / BYPASSRLS / table owner / FORCE ROW LEVEL SECURITY), tenant context patterns (current_user, current_setting, JWT claims via Supabase auth.uid() / auth.jwt()), and performance discipline (wrapping auth functions in SELECT, index on policy-referenced columns). Row/tenant isolation on the non-Postgres engines - MySQL / MariaDB invoker views, CockroachDB native RLS, Vitess vindex sharding, SQL Server security policies - lives in references/other-engines.md. Use as the RLS-pattern reference for tenant isolation on any of these engines. Consumed by cross-tenant-data-leak-tests.

Consumes pre-classified visual-diff JSON and a reviewer-signed acceptance log to produce a single go/no-go CI verdict for visual regression. Blocks when intentional baseline changes lack a non-author reviewer sign-off or when regressions are present, and emits the binding gate artifacts - visual-gate.json + visual-gate.md - with fail-closed handling of a missing classifier run and author-cannot-self-approve enforcement, so the pipeline can exit non-zero on BLOCK. Use when the gate's input is pre-classified diff data and the enforcement concern is reviewer approval and a binding CI verdict.