super-board

Add tasks, walk away, get merged PRs with proof.

Stop babysitting coding agents: cards you drop in Ready come back as tested, reviewed PRs.

9 skills (5 you type, 4 the board runs) · 9 commands · 6 guard hooks

🌐 Live site: erictechpro.github.io/super-board

⭐ Star this repo if it helps · Join the builders using this → weekly live calls, setup help · ▶ Watch the walkthrough

Install · Quick start · How it works · Skills · Commands · Guards

_{The skill map. Click it for the live version: zoom, pan, open any node.}

Install

Before you start:

• Claude Code, and gh with board access: gh auth refresh -s project,read:project,repo
• Dynamic workflows on in /config (backends)
• verify_commands set in your config, so the merge gate can prove the build (setup notes)

In your project folder:

curl -fsSL https://raw.githubusercontent.com/EricTechPro/super-board/main/get.sh | bash

Or as a Claude Code plugin:

/plugin marketplace add EricTechPro/super-board
/plugin install super-board@super-board

Note

The plugin ships the skills only. Run /super-board:super-board onboard and its 🔍 Checks step adds the guard hooks, scripts and workflows. Needs Claude Code, gh, jq, bash 3.2+ and Python 3.9+; the installer checks.

Security

Two security skills come with every install, and they stay separate:

Skill	Runs	Covers
pr-security-review	On every PR, inside the QA lane. Each finding fails QA and goes back to Build.	The PR's diff against its base: high-confidence, exploitable bugs only. From Anthropic's claude-code-security-review.
security-audit	Only when you ask (/security-audit). The board never runs it.	The whole repository, in depth. From Cloudflare's security-audit-skill, fetched at install with npx skills.

--no-helper-skills skips the security-audit download; /super-board onboard adds it later. Claude Code's built-in /security-review is left as it is.

Running from Codex or OpenCode? See supported hosts for tested versions, sign-in and gaps.

Optional post-run learning can delegate an already installed calibrate skill after verified selected work completes. It applies only to explicitly permitted existing canonical skill files; the package bundles no private skill. See post-run calibration.

Quick start

1. Install

curl -fsSL https://raw.githubusercontent.com/EricTechPro/super-board/main/get.sh | bash

2. Onboard

/super-board onboard

Checks · GitHub · Board · Branch · AGENTS.md · Policies · Bug sources · Review. Enter takes the recommended answer.

3. Run

/super-board run my-app

Add cards to Ready. The board drains on its own.

How it works

Which path? Clear idea, foggy idea or bugs: the routing rule says what to run, and when 1–5 tickets go to /implement-spec instead of the board.

▶ Watch on YouTube: I Built a Self-Improving Software Factory

Skills

9 skills (5 you type, 4 the board runs). Uses Matt Pocock skills, ponytail, impeccable, humanizer, Anthropic's security review and Cloudflare's security-audit.

You type — 5 skills

Skill	What it does
/super-board	Orchestrator: plans waves, runs Build → QA → Review, merges when green.
/super-collect	Finds problems, verifies them, writes a findings doc for /to-spec and /to-tickets.
/ui-refine-loop	Critique → refine loop that polishes one page or component.
/visual	One HTML page: branch recap, plan, or codebase map with diagrams.
/git-sync	Commit per logical change, merge-pull, push without force, report.

The board runs — 4 skills

Skill	What it does
/super-build	Builder lane: worktree, smallest safe change, tests, draft PR.
/super-qa	Tester lane: evidence, test-gap check, screenshots, or bounce to Build.
/super-review	Reviewer lane: own hypotheses, remembers prior findings, merge gate.
/pr-security-review	Security pass on every PR diff; super-qa runs it, findings fail QA.

Each name links to that skill's README. Adding a skill? Write its SKILL.md and README.md, add a line to skills/families.json, and this table updates itself.

Commands

/super-board onboard          # 8-step setup, resumes
/super-board lint             # vague ACs?
/super-board status           # read-only snapshot
/super-board run <slug>       # drain the board
/super-board stop             # stop workers
/super-collect [source]       # find problems → findings doc → /to-spec
/ui-refine-loop <route>       # polish one page
/visual [recap|plan|path]     # one HTML page
/git-sync                     # commit, pull, push

Flags: run --low|--high · run --codex[=<model>] · super-collect --since 30d

Guards & hooks

Run automatically once installed. Python stdlib, JSON in, JSON out.

guard-worktree-path	Blocks git worktree add outside .claude/worktrees/
guard-secrets	Blocks reading or piping dotenv files, SSH keys and credential files; key names via super-board-env-check.sh
guard-key-literals	Blocks a live-looking API key written into a file; flags one already there
guard-delete-outside	Blocks rm, find -delete and git clean aimed outside the project, ~ or /
guard-protected-push	Opt-in (onboard asks, or install.sh --protect-main): blocks direct and force pushes to main/master/base
README sync	Regenerates the skill table; pre-commit and PostToolUse hooks keep it fresh
cleanup-wt	Removes merged worktrees and branches after each merge and at session start, with a recovery file
merge gate	Merges only after the current base plus your non-empty project verify_commands pass (missing checks halt setup), pinned to the reviewed commit; applies merge_policy and runs allowed DB migrations

Models

A cheap router grades each card easy, medium or hard first; the run flag picks the model for each grade. With --codex, every lane runs on Codex GPT models instead of Claude.

Command	Router	Easy card	Medium card	Hard card
/super-board run	Haiku 4.5	Sonnet 5.5	Opus 5.5	session model
/super-board run --low	Haiku 4.5	Haiku 4.5	Sonnet 5.5	Opus 5.5
/super-board run --high	Sonnet 5.5	Opus 5.5	Opus 5.5	Opus 5.5
/super-board run --codex	gpt-6-luna	gpt-6.1-sol	gpt-6.1-sol	gpt-6-astra
/super-board run --codex --low	gpt-6-luna	gpt-6-luna	gpt-6.1-sol	gpt-6.1-sol
/super-board run --codex --high	gpt-6-luna	gpt-6-astra	gpt-6-astra	gpt-6-astra

/super-board run --codex=<model> pins one model for every card and skips the router.

Run inside Codex? plain /super-board run switches to the Codex ladder by itself. Codex has no /super-board command: it finds skills in .agents/skills/ (symlinks followed), so link .claude/skills/super-board there and type $super-board run.

Writing standard

Commits, tickets, PR bodies and comments all follow one writing standard, in the pack and in every project it is installed into.

Upgrading from 2.x

1. Re-run the install line.
2. Run /super-board onboard; step 1 upgrades for you and keeps a backup.
3. Try board-migrate --dry-run on a copy of your board first.

Full notes

Credits

MIT © Eric Tech (LICENSE). Built on obra/superpowers, mattpocock/skills, BuilderIO/skills and tt-a1i/archify. pr-security-review is ported from anthropics/claude-code-security-review (MIT © 2025 Anthropic, notice); security-audit is cloudflare/security-audit-skill (MIT © 2025-2026 Cloudflare, Inc.), installed from its own repo, not bundled.

---

Live site · Skill map · Writing standard · Setup simulator · Impeccable map · pstack map · Security audit map · Release notes · Release checks · YouTube walkthrough

_{Made by Eric Tech}

Worker skill availability

Setup and dispatch resolve real, nonempty SKILL.md files for the actual Claude or Codex host. Missing required skills halt before claims or workers; lockfiles and arbitrary plugin caches do not count. The shared registry in scripts/super-board-skills-ready.py owns lane dependencies, overrides and the two declared ponytail fallbacks. The QA lane requires the bundled pr-security-review; Cloudflare's security-audit is an optional QA entry, so a missing copy never halts a run. Setup's full helper union may be red while a selected card is runnable. Read-only checks never install; explicit onboard repair rechecks files after installation.

The CLI accepts --home <fixture-home> and --catalog <active-skills.json>. Launchers accept the same inventory through SUPER_BOARD_SKILLS_HOME and SUPER_BOARD_SKILLS_CATALOG; neither changes the actual host. Catalog shape: {"host":"codex","skills":[{"name":"vendor:skill","path":"/exact/SKILL.md", "enabled":true,"scope":"project","project_root":"/exact/project"}]}. User entries use scope:"user". Restart explicitly after repairing missing skills; readiness certifies availability, not their content or external tools.