Every step runs behind a gate that refuses by name

Agent skills for two loops: a legacy .NET application to verified production, and a GitHub issue to a merged pull request, hands-off. When a step is not allowed, the gate says who locked it and what clears it.

Refusal, as written by the gatehooks/roseline-gate.sh

Locked by: roseline-gate.sh
On: Read of Program.cs
Reason: Program.cs is C#, and this kit routes all C# analysis through RoselineMCP.
Use instead: mcp__roseline__search_symbols for the file's shape, mcp__roseline__get_symbol_info to read one member's body.

Read the methodology Why the gate exists Source on GitHub

Install on your agent

Pick the host you are in. The command is the whole install.

Claude Code Codex GitHub Copilot CLI Gemini CLI Antigravity CLI pi Other hosts

claude plugin marketplace add phmatray/tagout
claude plugin install tagout@tagout-marketplace
claude plugin install tagout-migrate@tagout-marketplace

Inside a session the same two commands work as /plugin marketplace add and /plugin install.

codex plugin marketplace add phmatray/tagout

Open /plugins, install Tagout, then review and trust its hooks in /hooks.

copilot plugin marketplace add phmatray/tagout
copilot plugin install tagout@tagout-marketplace

Skills are namespaced by the plugin — /tagout:create-issue, and so on.

gemini extensions install https://github.com/phmatray/tagout

AGENTS.md loads as always-on context, and /migrate and its siblings arrive as commands.

agy plugin install https://github.com/phmatray/tagout

It reuses the Gemini extension; type a command such as /migrate-assess as a message.

pi install git:github.com/phmatray/tagout

The skills load as a pi package; the issue → pull request skills work as they are.

git clone https://github.com/phmatray/tagout ~/.tagout
mkdir -p .cursor/rules && cp ~/.tagout/.cursor/rules/tagout.mdc .cursor/rules/

That second line is Cursor's; the other 5 rule-file hosts have theirs on the Install page.

Written for Claude Code; a plugin on 6 hosts, a rule file on 6 more families. Every host, and how to remove it: Install. What each one gets: Platforms. The migration pipeline also needs RoselineMCP, started by dnx from the .NET 10 SDK.

Chords: 18 min
Les Fleurs du Mal: ~30 min
Pokédex G: ~1 h

Seven locks, one hasp

assess read-only audit

baseline tests and diagnostics recorded

retarget target framework moved

remediate errors and warnings cleared

modernize safe idioms applied

verify build and tests green

deliver report and release

Lock-out record: four dead platforms, cleared

Four apps from 2013–2016, built for platforms nothing runs any more, were audited, migrated to Blazor WebAssembly and verified live: characterization tests first, legacy data and art byte for byte, measured WCAG AA, offline proven with the network cut. The minutes come from the gate commits, not a stopwatch.

App, live	Locked on	Cleared in
Chords	Windows Phone	18 minpipeline, measured
Les Fleurs du Mal	WinRT 8.1	~30 minpipeline, measured
Pokédex G	UWP, SQLite 49 MB	~1 hpipeline, measured
Sokoban	WinRT 8.1	First wavenot timed

The audit, the per-app reports and what each wave taught the kit: the case study.

What the gates refuse

Five ways an agent-driven upgrade goes wrong without anyone noticing, and the lock that stops each one.

Upgrading means bumping the target framework and hoping.
Seven phases, each ending at a build, test and diagnostics gate. A red gate stops the pipeline.
The agent reads whole C# files instead of asking Roslyn.
The roseline gate denies a Read of a .cs file and names the RoselineMCP tool that replaces it.
Four agents share one checkout, and a commit lands in another agent's pull request.
Guarded git writes check the branch before and after, and the write-gate denies the raw command.
The fix ships before the cause is known.
debug-issue finds the root cause before any patch.
The backlog only ever fills.
One filing bar for every inlet, and triage-backlog to re-decide what is already open.

Which command?

Once installed, say what you have. Each row is a skill or a command, and each one ends with a recap and the next command to type.

Situation	Reach for
An idea to track	`create-issue`
An issue with a plan	`implement-issue #N`
A PR to land	`merge-pr #N`
One idea or issue to a merged PR, hands-off	`deliver-issue <idea>` or `#N`
A queue that never shrinks	`triage-backlog`
Many issues, hands-off	`auto-dev`
What went wrong in my last sessions	`review-sessions`
A legacy .NET app	`/migrate-assess`, then `/migrate`
A migrated app to re-verify	`/migrate-verify`
A portfolio to cost	`/migrate-audit`
Open follow-ups across migrated repos	`/migrate-followups`
A new repo for these skills	`profile-repo`, then `setup-repo`
Something is already broken	`debug-issue` fires on its own

The rest of the site

The method in full, the decisions behind it, and one article per release.

The methodologyThe two loops in full, one page per skill, the machinery, and how the kit compares to GSD, SpecKit and BMAD.
DecisionsControl-flow decisions have one program and one home.
Architectural Decision RecordsThe decisions that are hard to reverse, and the ones declined.
The roseline gateWhy every C# read and write goes through RoselineMCP.
The bundle gateThe opt-in drift gate for committed bundles.
Demo walkthroughA real pipeline run on the bundled legacy fixture.
JournalOne article per release: why it happened, what got cut, what bit us.
PlatformsWhat each host gets: skills, commands, MCP servers, gates, sub-agents.