Integrations and analysis

GitHub sync, strategic initiatives, UI evaluation, security auditing and codebase mapping.

Command	Arguments	What it does
`/aoforge:gh-sync`	`[migrate [--dry-run]\|status\|flush\|pull\|setup [--apply]\|release <tag>\|<objective>\|--all]`	Operate the GitHub store, where GitHub is the system of record once `github.store` is on: migrate a project onto it (dry run first, then explicit approval), show store status, flush the outbox, pull the cache, set the repository up, generate release notes. With the store off, mirror objectives to GitHub issues.
`/aoforge:initiatives`	`[sync [--initiative <slug>] [--project-id <id>] [--force]] \| [list [--home <path>]] \| [show <slug>]`	Manage strategic initiative context — sync GitHub Epics to disk, list cached initiatives, or show a single initiative body. Planner reads these at plan time.
`/aoforge:security-audit`	`[optional: path scope like 'src/api' or focus filter like 'secrets-only', 'auth-only', 'deps-only']`	Scan the codebase for security vulnerabilities — checks for secrets, auth flaws, dependency risks, and OWASP Top 10 issues.
`/aoforge:map-codebase`	`[optional: specific area to map, e.g., 'api' or 'auth'] [--non-interactive]`	Analyze an existing codebase to understand its stack, architecture, conventions, and concerns before starting new work.

/aoforge:gh-sync

Pushes planning state to GitHub. One-way: planning files stay authoritative, GitHub is derivative.

/aoforge:gh-sync status              # is the integration reachable?
/aoforge:gh-sync objectives          # create/update one issue per objective
/aoforge:gh-sync release v2.5.0      # generate release notes from SUMMARY files
/aoforge:gh-sync 4                   # push one objective's full state

Opt in via .aoforge/config.json:

{
  "github": {
    "enabled": true,
    "repo": "owner/name",
    "milestone_prefix": "v",
    "labels": {
      "objective": "aoforge:objective",
      "in_progress": "aoforge:in-progress",
      "gaps": "aoforge:gaps"
    }
  }
}

Requires the gh CLI, authenticated. Every operation is a no-op when the integration is disabled, gh is missing, or auth expired — failures never block your workflow. Full detail in the GitHub integration guide.

/aoforge:initiatives

Syncs GitHub Epics into local strategic context that the planner reads at plan time.

/aoforge:initiatives sync
/aoforge:initiatives sync --initiative payments-v2 --force
/aoforge:initiatives list
/aoforge:initiatives show payments-v2

The point is grounding: an objective planned with the parent initiative in context makes different trade-offs than one planned in isolation.

/aoforge-stack-flutter:ui-eval

Machine-judges the visual correctness of UI states.

/aoforge-stack-flutter:ui-eval 6
/aoforge-stack-flutter:ui-eval path/to/manifest.json

The ui-evaluator agent captures every declared UI surface, scores each through the offline visual-eval engine, and writes evidence the verifier consumes. It is not “take a screenshot and hope” — the scores are machine-produced and the verifier gates on them.

See the UI evaluation guide.

/aoforge:security-audit

/aoforge:security-audit
/aoforge:security-audit src/api
/aoforge:security-audit secrets-only
/aoforge:security-audit auth-only
/aoforge:security-audit deps-only

Standalone — works without .aoforge/. Fans out security-auditor agents across three domains (secrets, auth flows, dependency risk) plus code-level OWASP Top 10 checks.

Every finding carries Confidence: VERIFIED | SUSPECTED. Only VERIFIED findings are acted on downstream, because an agent that speculates confidently produces remediation work for imaginary problems.

/aoforge:map-codebase

/aoforge:map-codebase
/aoforge:map-codebase api

Parallel codebase-mapper agents analyse stack, architecture, quality and concerns, writing findings to .aoforge/codebase/. Run this before /aoforge:new-project on an existing codebase so the roadmap is grounded in what exists. Same VERIFIED / SUSPECTED confidence tagging as the security audit.