truestack

A lightweight, honesty-first coding skill set for Claude Code — packaged as a plugin that bundles 23 skills, 8 slash commands, and an MCP integration layer, all behind a single truestack-orchestrate router that reads the request, right-sizes it, and dispatches to the right skill in the right order. Language-aware backend skills (Express · .NET · Python), a pro React frontend skill, multi-agent / multi-session coordination, an always-on honesty contract, committed repo-memory, verified deep research, scheduling, and real tool integrations — with process that sizes itself to the work.

Highlights:

• truestack-orchestrate router — classifies any request, right-sizes it, runs the canonical chain, and gates everything through truestack-quality-control; routes to the best skill even when it lives in another installed set.
• Enforced governance — a PreToolUse hook denies catastrophic and asks on money/destructive/schema/outbound tool calls (84-case tested). Enforced once wired: automatic with plugin install, a one-time settings merge with drop-in install (step 2 below). The append-only MCP approval log is skill-directed (the model writes it under the truestack-mcp-integration skill), not hook-enforced.
• Honesty, machine-checked — an always-on grounding contract, a code↔memory reconciliation tally, and auto-research of current-fact decisions from authoritative sources.
• Full lifecycle — prompt optimization · plan · backend/frontend · API contract · migrations · deploy · CI/CD · observability · security · dependencies · data-privacy · debugging · reverse-engineering · research · scheduling · multi-agent coordination · self-evaluation · plain-English explanation.
• Self-measuring — ships its own deterministic skill lint + a behavioral routing eval, both run in CI.

The skills (23)

Slash commands (8)

/truestack-onboard is intentionally not /init (that name is a built-in Claude Code command).

Integrations (MCP) — guidance that can finally act

truestack-mcp-integration turns the set from advice into action through connected MCP servers, while keeping the discipline: discover before you assume, treat tool output as untrusted data, read freely / write carefully, and keep money, destructive ops, schema changes, and outbound sends Ask-first. Idempotency on retried writes; verify the real effect afterward. Every Ask-first call also leaves an approval receipt + append-only audit row (.ai/agents/mcp-audit.md, written by the model under the skill's direction — not machine-enforced) so external effects are reviewable like code. Servers are declared in a committed, secret-free .mcp.json (env-var expansion ${VAR}); this ships with an empty .mcp.json plus a .mcp.example.json template — connect only what a project needs. Full schema + per-category checklist (DB · vector · payments · webhooks · search) in skills/truestack-mcp-integration/references/mcp-config.md.

Honesty & anti-hallucination (always-on)

Seeded into CLAUDE.md so it applies to every reply, with the full contract in skills/truestack-project-memory/references/honesty.md. In impact order: ground, don't recall; abstain when evidence is thin; verify consequential claims before finalizing; truth over agreement; separate verified / inferred / unknown; never fabricate paths, APIs, or numbers. Hallucination is structural — the contract makes it rare and always flagged, not "solved."

Multi-agent & multi-session (no overwrite, no collapse)

truestack-agent-coordination separates isolation (each writing agent in its own git worktree + branch) from coordination (shared contracts up front, a task ledger where each agent writes only its own row, non-overlapping scope, defined merge order). Memory writes are append-or-section; a later session resumes from committed memory + the ledger + status files. Caps at 2–3 agents to start.

Language-aware backend & pro React frontend

truestack-backend-development/truestack-quality-control adapt to the project's language — stack idioms live in truestack-backend-development's references/stacks.md, and the OWASP-aligned security checklist for Express.js · .NET · Python lives in truestack-quality-control's references/security.md. truestack-react-frontend holds two bars at once — anti-AI-slop visual design and the engineering a design-only skill skips (architecture, state/data, React 19, Core Web Vitals, a11y, testing).

How they chain

• Entry point: truestack-orchestrate reads the request, right-sizes it, and dispatches into one of the chains below (skip it for a trivial one-off).
• Backend: truestack-architecture-planning → truestack-backend-development → truestack-quality-control
• Frontend: truestack-architecture-planning → truestack-react-frontend → truestack-quality-control
• External effects: truestack-backend-development → truestack-mcp-integration → truestack-quality-control
• Parallel: truestack-architecture-planning → truestack-agent-coordination → (workers run truestack-backend-development/truestack-react-frontend) → truestack-quality-control
• Fixes: truestack-root-cause-debugging → truestack-quality-control
• Research / recurring: truestack-deep-research (← truestack-agent-coordination fan-out); wrap with truestack-task-scheduling to recur
• All read project memory first; truestack-project-memory owns it.

Install

This repo is itself a valid Claude Code plugin (.claude-plugin/plugin.json + marketplace.json, skills/, commands/, .mcp.json). Pick one method.

Names are already namespaced. Every skill and command carries a truestack- prefix (truestack-orchestrate, /truestack-verify, …) so they never collide with other installed sets. This means drop-in is the recommended install — it keeps those flat names as-is. Plugin-marketplace install also namespaces by plugin id, so it would double up to truestack:truestack-orchestrate; use it only if you prefer plugin-managed updates.

Drop-in, kept current with git pull — recommended. Two steps: link the skills/commands, then wire the hooks (skills and commands auto-load from ~/.claude/; hooks never do — an unwired gate is silently dead).

Step 1 — link. macOS / Linux (symlinks):

git clone <your-fork-url> ~/.claude/truestack
mkdir -p ~/.claude/skills ~/.claude/commands
for d in ~/.claude/truestack/skills/truestack-*;      do ln -s "$d" ~/.claude/skills/;   done
for f in ~/.claude/truestack/commands/truestack-*.md; do ln -s "$f" ~/.claude/commands/; done
# update anytime:  cd ~/.claude/truestack && git pull

Windows (PowerShell — junctions for skill folders need no admin or Developer Mode; command files can't be junctioned, so copy them and re-copy after each git pull):

git clone <your-fork-url> "$HOME\.claude\truestack"
New-Item -ItemType Directory -Force "$HOME\.claude\skills","$HOME\.claude\commands" | Out-Null
Get-ChildItem "$HOME\.claude\truestack\skills\truestack-*" -Directory | ForEach-Object {
  New-Item -ItemType Junction -Path "$HOME\.claude\skills\$($_.Name)" -Target $_.FullName }
Get-ChildItem "$HOME\.claude\truestack\commands\truestack-*.md" | ForEach-Object {
  Copy-Item $_.FullName "$HOME\.claude\commands\$($_.Name)" -Force }
# update anytime:  cd "$HOME\.claude\truestack"; git pull   # then re-run the Copy-Item loop

(True symlinks on Windows need an elevated shell — or PowerShell 7+ with Developer Mode; Windows PowerShell 5.1 can't create them unelevated even with Developer Mode. Junctions avoid all of that.) Or run the bundled one-shot: powershell -ExecutionPolicy Bypass -File .\install.ps1 -WireHooks — it links/copies everything, migrates a stale pre-namespacing install to a backup folder, and wires the hooks (Step 2) with a settings backup.

Step 2 — wire the hooks. Merge this into ~/.claude/settings.json (adjust the clone path; full options + per-project variant in hooks/README.md):

{ "hooks": {
  "PreToolUse": [ { "matcher": "*", "hooks": [
    { "type": "command", "command": "node \"$HOME/.claude/truestack/hooks/pretooluse-gate.mjs\"", "timeout": 30 } ] } ],
  "UserPromptSubmit": [ { "hooks": [
    { "type": "command", "command": "node \"$HOME/.claude/truestack/hooks/truestack-orchestrate-reminder.js\"", "timeout": 10 } ] } ]
} }

Verify: node ~/.claude/truestack/hooks/test-gate.mjs (84/84) and /hooks inside Claude Code.

Finally, merge the truestack/.mcp.example.json entries you need into your project .mcp.json.

Drop-in, one-time copy (simplest; re-copy after each git pull):

git clone <your-fork-url> truestack
cp -r truestack/skills/*   ~/.claude/skills/      # the 23 truestack-* skills
cp -r truestack/commands/* ~/.claude/commands/    # the 8 /truestack-* slash commands

Then do Step 2 — wire the hooks above (copying files never wires hooks).

As a plugin via marketplace (double-prefixes the names — see note above; hooks auto-load, no Step 2 needed):

git clone <your-fork-url> truestack

Then, in Claude Code:

/plugin marketplace add ./truestack
/plugin install truestack@truestack

Validate the bundle anytime with claude plugin validate .. Claude Code auto-detects skills and commands — no restart. Configure .mcp.json with your own servers (secrets via env vars) before using truestack-mcp-integration.