maverick

Plugin maverick in thermiteau/maverick-claude. Commands read from the repo's manifest — yesterday.

Skills (41)

• do-adopt

  Scan a project for missing best-practice areas and implement the top recommendation for each gap (linting, unit testing) — installs tools, writes configs, verifies, and commits. Pass 'recommend' to stop after writing recommendations without implementing (replaces the old do-recommend skill).

• do-code

  Implement a focused code change. Use this skill as the wrapper for any implementation work so the Maverick workflow report captures what was done and so the agent applies the project's coding standards before editing. Intended to be invoked once per task from inside a do-issue-* or do-epic phase, no

• do-cybersecurity-review

  Audit a codebase for security risks in one of two modes. In full-audit mode it scans the entire codebase and writes a findings report to docs/security-audit.md (run as part of do-init or on demand). In update mode it hands a diff to the independent agent-security-reviewer, which reviews the diff plu

• do-docs

  Create, restructure, or update technical documentation. Handles greenfield projects, refactoring non-compliant docs, and incremental updates after code changes.

• do-epic

  Work on a multi-story GitHub epic end-to-end. Builds a DAG from the child stories, groups them into waves, runs waves in parallel via per-story worktrees, ejects PRs that fail agent-code-review for human handling, and propagates blocks to downstream stories. Requires git worktrees.

• do-init

  Initialise a project for use with Maverick — verifies the GitHub App, installs the CLI if needed, writes the project config with integration tracking, scaffolds docs, generates project skills, runs an initial cybersecurity audit, then commits the changes and opens a PR.

• do-install

  Install the maverick CLI tool system-wide at the version matching this plugin.

• do-issue-guided

  Work on a GitHub issue interactively with the user. Proceeds autonomously through routine work but pauses for confirmation at key decision points and when uncertain.

• do-issue-solo

  Work on a GitHub issue end-to-end autonomously, only pausing when blocked or when clarification is needed.

• do-maverick-alignment

  Analyze a project's codebase against Maverick standard practices and write a findings report. Checks linting, unit tests, integration tests, documentation, CI/CD, security, dependency management, observability, source control, and more. Run when onboarding an existing project or on demand.

• do-pullrequest-review

  How to process code review feedback — verify before implementing, push back when wrong, clarify before acting on partial understanding. Applied when receiving review from the agent-code-reviewer or human reviewers.

• do-tech-docs

  Technical documentation standards — document structure, writing style, file organisation, mermaid diagrams, and validation. Referenced by do-docs and tech-docs-writer.

• do-test

  Write or update tests for a code change. Operates in two modes: `unit` (module-scoped, fast, deterministic) and `integration` (crosses module / service / database boundaries). Intended to be invoked once per testable change from inside a do-issue-* or do-epic phase. Mode is required.

• do-upskill

  Generate project-specific implementation skills at docs/maverick/skills/<topic>/SKILL.md by scanning the codebase. Pass a topic name to generate one topic; omit arguments to process every topic.

• mav-block-propagation

  Idempotent, resumable propagation of a `blocked-by:#N` block from an ejected story to every transitive downstream story in the epic DAG. Triggered when agent-code-reviewer ejects a PR for human handling.

• mav-bp-accessibility

  Accessibility conventions for projects with user-facing interfaces. Covers WCAG 2.1 AA compliance, semantic HTML, keyboard navigation, colour contrast, screen reader support, and automated a11y testing. Applied when building or reviewing user-facing web or mobile applications.

• mav-bp-api-design

  API design conventions for projects with API surfaces. Covers REST and GraphQL standards, versioning, error formats, pagination, documentation as code, and backwards compatibility. Applied when designing, implementing, or reviewing APIs.

• mav-bp-application-security

  Application security conventions for all projects. Covers OWASP Top 10 awareness, input validation, secrets management, dependency scanning, SAST/DAST integration, and security headers. Applied when writing or reviewing any code.

• mav-bp-cicd

  Platform-agnostic CI/CD conventions. Covers pipeline stages, quality gates, environment promotion, secrets management, artifact handling, and deployment boundaries. Applied when configuring or reviewing CI/CD pipelines.

• mav-bp-code-review

  Code review conventions for all projects. Covers mandatory review requirements, review scope, PR sizing, reviewer and author responsibilities, and automated review integration. Applied when creating or reviewing pull requests.

• mav-bp-database-management

  Database and data management conventions for all projects using databases. Covers schema migrations, backup strategy, data lifecycle, index management, and connection pooling. Applied when designing, implementing, or reviewing database interactions.

• mav-bp-dependency-management

  Dependency management conventions for all projects. Covers lock files, version pinning, vulnerability scanning, license compliance, update strategy, and minimal dependency principle. Applied when adding, updating, or reviewing dependencies.

• mav-bp-environment-management

  Environment management conventions for all projects. Covers reproducible local development, environment parity, .env patterns, developer onboarding, and containerised development. Applied when setting up or reviewing development environments.

• mav-bp-error-handling

  Error handling conventions for all applications. Covers error propagation, retry strategies, circuit breakers, graceful degradation, error boundaries, and typed errors. Applied when writing or reviewing error handling code.

• mav-bp-infrastructure-as-code

  Infrastructure as Code conventions for all deployed projects. Covers IaC principles, environment parity, secrets management in IaC, version control, and runbook fallback for unsupported platforms. Applied when reviewing or configuring infrastructure.

• mav-bp-linting

  Linting conventions for applications. Covers linter selection, rule configuration, auto-formatting, CI integration, and project linting guidance. Applied when writing or reviewing code, or configuring developer tooling.

• mav-bp-operability

  Operability standards — logging, alerting, and observability as one discipline. Maverick''s opinionated rules: error-only log levels (no info), structured JSON logs, alert-at-the-boundary, correlation across logs/metrics/traces. Applied when writing or reviewing code that logs, alerts, or instrument

• mav-bp-remote-code-review

  Mandatory remote code review on every pull request. Defines the contract for a GitHub Actions workflow that runs the agent-code-reviewer in CI when a PR is opened, synchronized, or reopened. Used as a dependency by do-issue-solo and do-epic to enforce the review gate, and by do-maverick-alignment to

• mav-bp-testing

  Testing standards — unit and integration testing as one discipline. Maverick''s opinionated rules: behaviour over implementation, mock at boundaries only, 60% unit-coverage CI gate, critical-path integration coverage with a no-decrease ratchet. Applied when writing or reviewing tests.

• mav-claude-code-recovery

  Patterns for Claude Code workflow resilience — state persistence, crash recovery, command failure handling, subagent failure handling, and artefact durability. Not about application-level error handling.

• mav-create-solution-design

  How to produce a solution design for a GitHub issue or task. Covers codebase exploration, design structure, and validation. Used as a dependency from workflow skills.

• mav-create-tasks

  How to decompose a solution design into discrete, independently implementable tasks. Used as a dependency from workflow skills.

• mav-durability-on-gh

  Durability conventions for multi-instance Maverick workflows. Covers cold-start hydration from GitHub, marker-write protocols, push-per-task cadence, and recreating worktrees from remote branches. GitHub is the source of truth; local files are a cache.

• mav-git-workflow

  Git branching strategy, commit conventions, merge conflict handling, and branch lifecycle. Implements a simplified Gitflow with protected branches and conventional commits. Covers worktree-based multi-story workflows and cross-references stacked-PR handling.

• mav-github-issue-workflow

  Standard patterns for interacting with GitHub issues — reading, commenting, updating, state tracking, branching, and PR creation. Use as a dependency from workflow skills, not directly.

• mav-local-verification

  Pre-push code quality verification — lint, typecheck, and tests run locally before pushing. Covers discovering project verification commands, run order, scope-appropriate checks, and fixing failures. Used as a dependency from workflow skills.

• mav-multi-instance-coordination

  Claim, lease, heartbeat, and release protocols for when multiple Claude Code instances may act on the same issue or epic concurrently. GitHub labels and marker comments are the coordination surface; local state is a cache.

• mav-plan-execution

  How to execute an implementation plan step-by-step. Covers the execution loop, verification discipline, failure handling, progress tracking, crash recovery, and acceptance criteria. Adapts behaviour based on whether the caller is solo (autonomous) or guided (human checkpoints). Used as a dependency

• mav-scope-boundaries

  Defines what Claude Code must refuse to do without explicit authorisation. Covers infrastructure, auth, destructive git, and production systems. Applied automatically to all workflows.

• mav-stacked-prs

  How to stack a PR on top of an unmerged sibling branch, and how to retarget it to the repo's default branch once the sibling merges. Prevents orphan-merge incidents when a dependent story is ready before its parent.

• mav-systematic-debugging

  Use when encountering any bug, test failure, or unexpected behaviour during implementation. Requires root cause investigation before proposing fixes.

Subagents (7)

• agent-code-reviewer

  Autonomous code reviewer that performs two-stage review — spec compliance first, then code quality (correctness, test coverage, maintainability). Security is out of scope; the independent agent-security-reviewer handles that as a mandatory pre-PR gate. Dispatched after completing implementation step

• agent-github-issue-planner

  Takes a solution design and produces an ordered task list. Dispatched by do-issue-solo and do-issue-guided as a subagent so that planning does not consume the caller's context window.

• agent-implementer

  Implements one task, or one fix, of a story in its worktree: runs do-code, verifies locally, commits and pushes, then returns a short structured summary. Dispatched by do-issue-solo once per task so that source files, test output and fix iterations never enter the story agent''s context window.

• agent-issue-analyst

  Reads a GitHub issue, explores the codebase, and produces a solution design. Dispatched by do-issue-solo and do-issue-guided as a subagent so that codebase exploration does not consume the caller's context window.

• agent-security-reviewer

  Independent security reviewer for a story's diff. Runs in a fresh context (never the author's), applies the project's own security checklist from docs/maverick/skills/ on top of generic OWASP categories, runs the project's invariant checks, and returns PASS, FINDINGS or BLOCKING. Dispatched by do-is

• agent-session-reviewer

  Reviews Claude Code session activity and git diffs to identify missed opportunities, duplicated code, and quality issues.

• agent-tech-docs-writer

  Autonomous technical documentation writer. Dispatched when documentation needs to be created or updated — architecture, services, data flows, design decisions, or technology choices. Produces professional markdown with Mermaid diagrams.

Hooks (6)

• SessionStart

  python3 "${CLAUDE_PLUGIN_ROOT}/hooks/install_check.py"

• SessionStart

  python3 "${CLAUDE_PLUGIN_ROOT}/hooks/run_hook.py" subagent-report --runtime claude

• PreToolUse

  python3 "${CLAUDE_PLUGIN_ROOT}/hooks/run_hook.py" scope-guard --runtime claude

• PreToolUse

  python3 "${CLAUDE_PLUGIN_ROOT}/hooks/run_hook.py" subagent-report --runtime claude

• PostToolUse

  python3 "${CLAUDE_PLUGIN_ROOT}/hooks/run_hook.py" subagent-report --runtime claude

• SessionEnd

  python3 "${CLAUDE_PLUGIN_ROOT}/hooks/run_hook.py" session-release --runtime claude