magdil-rosh — do more than the ask

1the pain every engineer knows

"Sure, done." — and then the back-and-forth begins.

You ask for one thing. You get the demo version. Then you spend the next twenty minutes listing everything it forgot — the same list, every single time.

~/your-project — the usual

you ▸create a welcome email

ai ▸✓ done — welcome-email.html

you ▸…and the mobile version?

you ▸…dark mode?

you ▸…a plaintext fallback?

you ▸…what about a missing first name?

you ▸…did you make the send idempotent?

you ▸…unsubscribe header? fr-CA?

you ▸…(still typing the list)

The model already knows all of this. It just didn't apply it — because a short request reads like a request for the minimal version. magdil-rosh is the forcing function that makes "complete" the default.

2same prompt · two outcomes

Before & after

One prompt — "create a welcome email". Left: what you usually get. Right: what the skill delivers, then reports back as a receipt.

✗ without the skillhappy path

$ create a welcome email

✓Desktop HTML template
✕Mobile layout
✕Dark mode
✕Plaintext fallback
✕Missing-name fallback
✕Idempotent send (no dup spam)
✕List-Unsubscribe header
✕en-US / en-CA / fr-CA

shipped 1 of 8 — the rest becomes your next 6 messages

✓ with magdil-roshcomplete

$ create a welcome email

✅Desktop + mobile (table layout, inline CSS)
✅Dark-mode colors + logo
✅Multipart: HTML + plaintext
✅Missing-name → "Hi there" fallback
✅Idempotent send + retry/backoff
✅List-Unsubscribe + CASL/CAN-SPAM
⏭️Litmus cross-client run — deferred (needs account)
❓Which locales ship in v1 — en only, or +fr-CA?

covered 6 · deferred 1 · asked 1 — zero silent gaps

3how it works

Four moves, every time

No config. The skill triggers itself when you ask to build something shippable, and stays out of the way for trivial stuff.

Match

Maps your request to a domain — auth, email, forms, CRUD, payments, migration…

Load checklist

Pulls that domain's list of commonly-forgotten rows — on demand, low token cost.

Ask ≤3

Only the forks that change the build — delete semantics, auth model, legal scope. Recommended option first.

Cover + receipt

Every row covered or deferred out loud, then a terse report: ✅ / ⏭️ / ❓.

416 checklists, extensible

It already knows your domain

Two cross-cutting checklists (every feature) plus per-domain files. No match? It builds thoroughly, then writes you a new one.

universalstates · a11y · mobile · security

uxfeel · polish · latency

authOAuth · sessions · errors

emailmobile · dark · deliverability

formsvalidation · states · a11y

crudempty · pagination · authz

file-uploadtype · size · scan · resume

search-filterdebounce · race · no-results

paymentsidempotency · webhooks · SCA

api-endpointauthz · status · rate-limit

realtimereconnect · resync · order

modal-dialogfocus trap · esc · mobile

specacceptance · out-of-scope

outreach-emailsequence · CASL · deliverability

data-migrationdry-run · rollback · resume

+ yoursadding-domains.md

510 things every engineer ships incomplete

Sound familiar?

Ten one-line requests you've made a hundred times. Tap any to see what usually gets silently skipped — the rows magdil-rosh covers by default.

▸$ add Google loginskips ~9

happy path works; the failure paths don't exist:

✅User denies consent on Google's screen → clean return, not a crash
✅Same email already registered with password → account-linking policy (takeover risk)
✅Match on stable sub, not email; email_verified enforced
✅Session expiry mid-use → silent re-auth, preserve location
✅state/nonce CSRF + replay protection; popup-blocked fallback

▸$ create a welcome emailskips ~7

you got desktop HTML. you needed:

✅Mobile layout + dark mode + table/inline-CSS for Outlook
✅Plaintext multipart alternative
✅Missing-name fallback ("Hi there"), HTML-escaped tokens
✅Idempotent send (re-trigger ≠ duplicate spam)
✅List-Unsubscribe header + compliance

▸$ build a contact / signup formskips ~8

it submits. but:

✅Loading / error / success states; preserve input on error
✅Double-submit guard + idempotency
✅Server-side validation, not just client; field-mapped errors
✅Unsaved-changes guard on navigate away
✅a11y: labels, focus first invalid field, aria-live errors
✅Spam protection on public forms (honeypot/Turnstile)

▸$ add a list with create / edit / deleteskips ~8

CRUD's happy path hides:

✅Empty state (with CTA) vs no-search-results — different copy
✅Delete confirmation naming the item; optimistic rollback
✅Already-deleted (404) → treat as success
✅Server authz on every row (not just hide the button)
✅Stable ordering + URL-persisted filters/page

▸$ add avatar / file uploadskips ~7

picks a file, sure. then:

✅Type + size validation client AND server (magic-bytes, not extension)
✅Progress bar, cancel, preview, remove/replace
✅Corrupt / 0-byte / huge file handling; resumable on drop
✅Strip EXIF GPS; signed URLs for private files

▸$ add search / filteringskips ~6

it queries. but did it:

✅Debounce input; cancel stale requests (out-of-order races)
✅No-results state with the query echoed
✅Escape special / injection chars; diacritic folding
✅Scope results to what the user may see (no leak via search)

▸$ add checkout / paymentskips ~9

the most expensive corners to cut:

✅Idempotency key — double-click must NOT double-charge
✅Confirm via webhook, not the return redirect
✅Never trust client-sent amount; price server-side
✅Declined / insufficient / SCA-3DS / pending states
✅Integer cents (no float money); receipt + audit log

▸$ add a modal / confirm dialogskips ~6

div with a backdrop ≠ a dialog:

✅Focus trap; focus moves in on open, returns to trigger on close
✅Esc closes; backdrop click (unless dirty); scroll lock
✅role=dialog + aria; background inert
✅Full-screen / bottom-sheet on mobile, not a clipped box

▸$ write a data migration / backfillskips ~8

"just update the rows" is how prod breaks:

✅Dry-run mode; backup verified before mutating
✅Idempotent / re-runnable; resumable from a checkpoint
✅Validate counts before AND after; reconcile
✅Batch large sets; rollback plan written first

▸$ write the spec / PRDskips ~6

a happy-path spec is a wish:

✅Testable acceptance criteria per requirement
✅Explicit non-goals / out-of-scope (stops scope creep)
✅Edge cases + error states, not just the main flow
✅Rollout, success metrics, open questions named

6open source · MIT

Install in 10 seconds

Add it as a Claude Code plugin — one command, versioned, updatable. It loads automatically; no setup, no API key.

claude code

# in Claude Code:
/plugin marketplace add tickets-forge-dev/magdil-rosh
/plugin install magdil-rosh

# restart the session — then ask Claude to build something
# and watch the receipt

Prefer manual? git clone, then cp -r magdil-rosh/skills/magdil-rosh ~/.claude/skills/

Star on GitHub ★ Read the source