jctots

end-session

Wrap up a session — decide whether a reboot is actually pending and delegate to the handover skill if so, save anything memory-worthy that hasn't been captured yet, and report usage stats. Use whenever the user says they're done, wrapping up, or closing the session — this is the one command to reach for at session end, not `/handover` directly; it decides which mechanism applies instead of making the user track that.

handover

Write or read .claude/handover.md, a session-continuity snapshot used instead of `claude -c` around a reboot-triggering action. Use in write mode proactively before anything likely to end the session (systemctl reboot, rpm-ostree rebase, anything requiring a restart); use in read mode whenever the session's first turn is the literal message "I'm back" — sent automatically by scripts/session-autostart.sh on every launch, not typed by the human — or when the user says they're back after a reboot by hand.

DevOps & Infrastructure Listed

incident

Scaffold a new incidents/I{nnn}-{slug}.md from the template and insert its row in incidents/index.md. Use right after a fix lands on this machine — a broken thing that this session's work fixed. Not for decisions (alternatives weighed, no breakage) or host facts (firmware, device IDs) — those go elsewhere per incidents/index.md's own header.

update-check

Check for OS image updates (rpm-ostree), drift/updates across both flatpak manifests (this repo's scripts/install-flatpaks.sh and the private extras repo's flatpaks.sh, if EXTRAS_DIR is set), the full flatpak install including runtimes/extensions, npm global packages, and firmware (fwupd/LVFS). Use when the user asks to check for updates, upgrade the system, or update installed apps.

reset-triage

Detects whether the previous boot ended cleanly, and if not, surfaces a standard evidence bundle unprompted. Use on every "I'm back" session start, chained after handover's read-mode — regardless of whether a handover.md was present, since an unclean shutdown can happen outside any planned-reboot flow.

security-privacy-check

Run a security + privacy posture sweep — Lynis system audit (hardening index, warnings, suggestions) plus GNOME privacy settings, location services, and Flatpak per-app permission overrides. Use when the user asks for a security check, privacy check, hardening review, or "what can see my camera/mic/location."

etc-drift

Check whether etckeeper actually committed the last change to /etc — an uncommitted /etc change is irreversible in practice per CLAUDE.md, since etckeeper's git history is what makes docs/recovery.md Card 2 possible. Use after any system-touching session, or when the user asks to check /etc drift or etckeeper status.

host-check

Run every report-only script in the base layer and host profile (scripts/install-flatpaks.sh, install-gnome-extensions.sh, layer-packages.sh, tpm2-luks-unlock.sh, hosts/<slug>/quirks.sh) and summarize ok/missing across all of them. Use when the user asks for a general status sweep of the machine, "what's missing", or a health check that isn't specifically about updates.