@1aboveio/skills 1.0.5 → 1.0.6

package/README.md

@@ -31,7 +31,7 @@ Each package also publishes on its own; install either this bundle or the packag
 | `engineering` | `@1aboveio/engineering-skills` | better-review, contributing, e2e-test, engineering-runtime, ensure-coverage, golden-path, harness-runtime, resolve-issues, resolve-release, rush-issues, rush-release, test-quality |
 | `cicd` | `@1aboveio/cicd-skills` | cloud-build, cloud-debug, cloud-deploy, docker, github-actions, github-flow, google-cloud, mergify, podman |
 | `app-dev` | `@1aboveio/app-dev-skills` | airflow, android-foundation, app-debug, better-auth, data-catalog, data-quality, ios-foundation, monorepo, nextjs-fullstack, prisma-setup, pyspark, python-backend, shadcn, zod-v4 |
-| `risk-compliance` | `@1aboveio/risk-compliance-skills` | compliance-audit, contract-compare, contract-review, doc-authenticity, fraud-analysis, payment-analysis, report-writing, similar-domain, tld-detection |
+| `risk-compliance` | `@1aboveio/risk-compliance-skills` | compliance-audit, contract-compare, contract-review, doc-authenticity, fraud-analysis, payment-analysis, similar-domain, tld-detection |
 | `content` | `@1aboveio/content-skills` | article-review, article-to-image, flowchart-svg, image-gen, mermaid, wechat-article-writer, wechat-publisher, wechat-search, xai-search |
 
 ## Third-party sources

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1aboveio/skills",
-  "version": "1.0.5",
+  "version": "1.0.6",
   "description": "Every 1aboveio skill package in one: install once, then choose which packages Pi loads with npx @1aboveio/skills select.",
   "license": "MIT",
   "repository": {
@@ -123,7 +123,6 @@
           "doc-authenticity",
           "fraud-analysis",
           "payment-analysis",
-          "report-writing",
           "similar-domain",
           "tld-detection"
         ]
@@ -252,7 +251,7 @@
         ]
       }
     ],
-    "digest": "5629efab1f5d31ccc119cdfea7ff08b44cb59e1996ee9b3599eacfceff1c4901"
+    "digest": "efb93166fdfdb1405f9a596f79d068c34b10a09ff176dc8f51021d64bd80e83d"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",

package/skills/app-dev/airflow/SKILL.md

@@ -2,7 +2,7 @@
 name: airflow
 description: Airflow DAG architecture and conventions. Use when designing, writing, reviewing, testing, or debugging Airflow DAGs and tasks, including TaskGroups, data intervals, timezone-aware date parameters, CLI validation, environment-based scheduling, and pytest integrity tests.
 user-invocable: true
-release-version: 0.42.0
+release-version: 0.42.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Airflow DAG Development Patterns

package/skills/app-dev/android-foundation/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: android-foundation
 description: "Prove an Expo / React Native app on a native Android emulator, and fix it when that proof fails. Use before you fix and re-run or re-dispatch a failed Android CI job (`gh workflow run android.yml`, `gh run rerun`): a re-run is not a debugger, so reproduce the failing journey checkpoint off CI first. Also use when a UiAutomator journey or its Python harness tests fail (a CHECK/FAIL line, a wait that timed out, a control not found, adb offline, a lost Metro bridge, a fixture failing on the runner), to build the debug APK and run the device journey, to set up a fresh Android workspace (SDK/NDK/JDK, Gradle caches, private AVD, disposable PostgreSQL), or to add the emulator job to CI. NOT for workflow YAML, CI speed or runner design (github-actions), browser tests (e2e-test), iOS (ios-foundation), plain Jest component tests, or signing and store release."
-release-version: 0.42.0
+release-version: 0.42.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Android foundation

package/skills/app-dev/app-debug/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: app-debug
 description: "Diagnose runtime failures in deployed Cloud Run services — 5xx/422 errors, tracebacks, Next.js SSR/hydration or Server Action failures, DB/Secret Manager connection errors, cold-start timeouts, container OOM. NOT for build or deploy failures (cloud-debug)."
-release-version: 0.42.0
+release-version: 0.42.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # App Debug

package/skills/app-dev/better-auth/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: better-auth
 description: "Add or debug Better Auth for Next.js App Router: login, sessions, protected routes, middleware, OAuth (including Feishu/Lark), cookies, Prisma, and Auth.js migration."
-release-version: 0.42.0
+release-version: 0.42.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Better Auth for Next.js

package/skills/app-dev/data-catalog/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: data-catalog
 description: "Column definitions for warehouse tables, written inside the Spark/PySpark or SQL script that builds each table (CATALOG_TABLE / CATALOG_FIELDS, or a `-- @field` comment block), with a generated markdown catalog in docs/catalog/ and a CI check that fails a PR whose catalog is stale. Use when writing or changing a table script that adds, renames, removes, or changes the meaning of an output column or feature; when asked what a warehouse column or feature means; to set a repo up ('init the data catalog', 'generate the data dictionary', '字段字典', 'add catalog CI'); or to audit existing SQL or Spark scripts for undocumented columns. NOT for implementing or tuning the Spark job itself (pyspark), DAG wiring (airflow), or general workflow YAML (github-actions)."
-release-version: 0.42.0
+release-version: 0.42.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Data catalog

package/skills/app-dev/data-quality/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: data-quality
 description: "Check a published warehouse table's data against its data-catalog definitions with read-only SELECTs: columns never filled or stuck at one value, counts below zero, ratios outside 0–1, declared values that never appear and undeclared values that do. Then classify each finding as a wrong definition, wrong code, or wrong data. Use when asked whether a table's data is right, to profile or sanity-check a dwd/ads table, to find dead or constant columns, to check a column's values against its documented list, after a pipeline change ships, or when a data-catalog definition and the data might disagree. NOT for validating a Spark change before it ships (pyspark canary and reconciliation), writing definitions (data-catalog), or monitoring dashboards."
-release-version: 0.42.0
+release-version: 0.42.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Data quality

package/skills/app-dev/ios-foundation/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: ios-foundation
 description: "Set up and prove an Expo / React Native native iOS workspace from a clean checkout to a manual Login smoke on an owned iOS Simulator: isolated worktree and private caches, Xcode/runtime/CocoaPods preflight, frozen install with `pod install --deployment`, platform-scoped prebuild, an ad-hoc-signed Debug simulator build, a private simulator by exact UDID, Metro on a free port, a disposable PostgreSQL backend with owned cleanup, and the evidence record (setup proof only; feature work reports the smoke result). Use for 'set up iOS', 'build the iOS app', 'run the app on the iOS simulator', 'add iOS to the React Native app', 'prove the iOS build', or when a pod install, xcodebuild, simulator boot, Metro connection or Keychain session fails. NOT for Android (android-foundation), signing, TestFlight or App Store release, or general workflow YAML (github-actions)."
-release-version: 0.42.0
+release-version: 0.42.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # iOS foundation

package/skills/app-dev/monorepo/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: monorepo
 description: Turborepo architecture for shared packages, pnpm workspaces, DAL boundaries, and pipelines.
-release-version: 0.42.0
+release-version: 0.42.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Turborepo Monorepo Architecture

package/skills/app-dev/nextjs-fullstack/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: nextjs-fullstack
 description: "Build or debug Next.js App Router features with React 19 — pages/layouts/route handlers, Server/Client Components, Server Actions, forms, middleware, DAL, strict TypeScript, Zod — plus our conventions: nuqs URL state, SWR cache, Skeleton/Progress + Sonner feedback, drag-and-drop upload, the portal app shell, list pages as filter/sort/paginate tables. shadcn component mechanics: see the shadcn skill."
-release-version: 0.42.0
+release-version: 0.42.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Next.js 16 Fullstack Development

package/skills/app-dev/prisma-setup/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: prisma-setup
 description: Use when adding or debugging Prisma with PostgreSQL, Next.js, or Turborepo, including schema.prisma, prisma.config.ts, client generation, migrations, seeds, relations, adapters, and DAL/database-layer setup. Triggers on phrases like "Prisma schema", "prisma migrate", "schema.prisma", "seed the database", "PrismaClient error", "relation issue", or "database layer".
-release-version: 0.42.0
+release-version: 0.42.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Prisma v7 Setup Guide

package/skills/app-dev/pyspark/SKILL.md

@@ -12,7 +12,7 @@ description: >
   Connect, spark-submit, Hudi commits, backfills, validate-only canaries,
   cluster reconciliation, or Spark event-log profiling — including warehouse
   job timeouts, empty Hudi writes, or EMR/Dataproc performance regressions.
-release-version: 0.42.0
+release-version: 0.42.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # PySpark

package/skills/app-dev/python-backend/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: python-backend
 description: "Python backend architecture for FastAPI, Tortoise ORM, Pydantic Settings, loguru, and uv. Also: uv.lock installs in CI/Docker via a proxy or mirror (`uv sync --frozen` bypasses it), slow uv installs on runners, relocking."
-release-version: 0.42.0
+release-version: 0.42.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Python Backend Conventions

package/skills/app-dev/shadcn/SKILL.md

@@ -2,7 +2,7 @@
 name: shadcn
 description: "Add or debug shadcn/ui in a React/Next.js project: components.json, shadcn init/add, presets, registries, Tailwind styling, base/radix/aria composition, component fixes, and list-index pages — where the default is the DiceUI data table with filter/sort/pagination in the URL via nuqs, not a bare shadcn Table."
 allowed-tools: Bash(npx shadcn@latest *), Bash(pnpm dlx shadcn@latest *), Bash(bunx --bun shadcn@latest *)
-release-version: 0.42.0
+release-version: 0.42.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # shadcn/ui

package/skills/app-dev/zod-v4/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: zod-v4
 description: Zod v4 schema conventions and v3 migration for errors, validators, objects, enums, records, and async parsing.
-release-version: 0.42.0
+release-version: 0.42.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Zod v3 to v4 Migration

package/skills/cicd/cloud-build/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: cloud-build
 description: "Build or debug Cloud Build pipelines for Cloud Run: cloudbuild.yaml, triggers, Artifact Registry, builds, migrations, deploys, secrets, VPC, notifications. Use cloud-deploy for staged promotion. NOT for GitHub Actions PR checks (github-actions)."
-release-version: 0.42.0
+release-version: 0.42.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Cloud Build Direct Deploy to Cloud Run

package/skills/cicd/cloud-debug/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: cloud-debug
 description: "Debug Cloud Build or Deploy failures: builds, deployments, health checks, and pipeline errors. Inputs: service, build ID, region. NOT for GitHub Actions runs (github-actions) or runtime errors in a running service (app-debug)."
-release-version: 0.42.0
+release-version: 0.42.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Cloud Build & Cloud Deploy Debug Skill

package/skills/cicd/cloud-deploy/SKILL.md

@@ -5,7 +5,7 @@ description: >
   CI/CD pipelines with staged promotion, verification gates, or GitFlow branching.
   Also use when debugging Cloud Deploy pipeline failures. NOT for simple single-container
   deploys — use cloud-build instead.
-release-version: 0.42.0
+release-version: 0.42.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Cloud Deploy + Skaffold + Kustomize for Cloud Run

package/skills/cicd/docker/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: docker
 description: Docker/Podman container architecture and build patterns. Read when designing or reviewing containerization, Dockerfile structure, multi-stage builds, PyPI mirror support, or docker-compose setup for Python/uv projects, and when a Dockerfile's dependency install misses the layer cache on every build (build args such as a commit SHA or version declared too early) or an image build is slow in CI.
-release-version: 0.42.0
+release-version: 0.42.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Docker Build Patterns

package/skills/cicd/github-actions/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: github-actions
 description: "Author, review, audit, profile, optimize, or debug GitHub Actions workflows (.github/workflows/*.yml): run-history audits, job and step timing, resource bottlenecks, before/after comparisons, conditional CI by changed path, the one required gate check, PR and merge-queue lanes, sharding, workers, caching, self-hosted runners, timeouts, concurrency, permissions and action pinning, post-deploy verification, npm publishing. Use for 'set up CI', 'CI is slow', 'profile CI', 'optimize our pipeline', 'audit CI for redundant or wasted jobs', 'why is this check stuck expected or never started', 'harden this workflow', or 'browser not found on the runner'. NOT for pushing, opening, or merging a PR, or writing CI conventions into CONTRIBUTING.md (github-flow), queue rules or a check unmet inside Mergify (mergify), Playwright config and specs (e2e-test), cloudbuild.yaml or Cloud Run deploys (cloud-build), or which gates a repo must prove (ensure-coverage)."
-release-version: 0.42.0
+release-version: 0.42.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # GitHub Actions

package/skills/cicd/github-flow/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: github-flow
 description: "Deliver a change after the commit: push, open a PR, wait for checks, and merge to main through the repo's flow (direct push, pull request, or merge queue). Use whenever you commit or finish a change, when CONTRIBUTING.md has a Delivery section, and for asks like 'commit this', 'push it', 'open a PR', 'ship it', 'land it', 'get it merged'. Also: declare a repo's delivery flow, or write the CI conventions and Delivery section into CONTRIBUTING.md on request. NOT for writing workflow YAML (github-actions), Mergify config or a stuck queued PR (mergify), cutting a release (resolve-release), or PRs that resolve-issues or rush-issues deliver."
-release-version: 0.42.0
+release-version: 0.42.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # GitHub Flow

package/skills/cicd/google-cloud/SKILL.md

@@ -5,7 +5,7 @@ description: >
   project management. Use when configuring GCP resources, managing service
   accounts, setting up IAP access, configuring VPC networks, managing secrets,
   or debugging cloud infrastructure.
-release-version: 0.42.0
+release-version: 0.42.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Google Cloud Platform (GCP) Skill

package/skills/cicd/mergify/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: mergify
 description: "Mergify merge queue and stacked PRs (`mergify stack`): config, rules, queue status, delivery. Use whenever a merge queue or stack is involved, including plain asks ('watch #123 till it merges', 'where is #412 in the queue', 'push this stack'): `gh pr view`/`gh pr checks` cannot see a dequeue; use `mergify queue show` and the bundled watcher. Also: a hook saying 'use mergify stack push', a missing Change-Id; authoring or debugging `.mergify.yml`, queue rules, merge protections, batch size, the ruleset making merges queue-only; enqueue policy (`@mergifyio queue` vs `auto_merge_conditions`); a push dequeuing a queued PR; bypass actors; freezing a branch. Failures: a PR stuck, queued but never merging, or merged unqueued; CI green on GitHub but unmet in Mergify; a batch going red or bisecting; a queue check missing rather than failing. Outranks the vendor mergify-* skills. NOT for pushing a PR in a repo without stack hooks (github-flow), workflow YAML (github-actions), or GCP deploy pipelines (cloud-deploy)."
-release-version: 0.42.0
+release-version: 0.42.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Mergify Merge Queue

package/skills/cicd/podman/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: podman
 description: "Debug, design, or fix Podman: rootless/rootful containers, pods, podman-compose, the socket and systemd services, Docker-compatible API (DOCKER_HOST/CONTAINER_HOST), networking, volumes, SELinux labels, Docker migration, and CI/SSH provisioning of rootless sockets (user lingering, XDG_RUNTIME_DIR). Covers FailedToOpenSocket and systemctl --user DBUS/XDG errors."
-release-version: 0.42.0
+release-version: 0.42.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Podman Operations

package/skills/content/article-review/SKILL.md

@@ -6,7 +6,7 @@ description: >
   Use when a user shares an article, pastes article text, sends a URL, or asks to
   review, rate, critique, evaluate, 评价, 点评, 分析, or 看看 any article, post, or 文章.
   Default template is 公众号-支付行业.
-release-version: 0.42.0
+release-version: 0.42.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # 文章评审引擎

package/skills/content/article-to-image/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: article-to-image
 description: "Generate article cover images: WeChat banner/square (公众号封面), Xiaohongshu (小红书封面), LinkedIn banner, general wide. Brainstorms 4 visual directions from the article, then renders each format with correct aspect ratios and title-safe zones. Use when given an article and asked for covers, banners, or 出图."
-release-version: 0.42.0
+release-version: 0.42.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Article-to-Image

package/skills/content/flowchart-svg/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: flowchart-svg
 description: Create polished flowcharts directly as SVG and export PNG copies. Use when asked to draw, design, render, or deliver process diagrams, architecture diagrams, consulting workflows, decision flows, swimlanes, or other flowcharts as image files, especially when final outputs must include .svg and .png versions.
-release-version: 0.42.0
+release-version: 0.42.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Flowchart SVG

package/skills/content/image-gen/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: image-gen
 description: Generate an image from a text prompt with OpenAI gpt-image-2 or Google Nano Banana (Gemini), saved to an image file. Use whenever the user asks to generate, create, make, draw, paint, render, or design an image, picture, illustration, photo, artwork, logo, icon, avatar, banner, hero image, thumbnail, poster, wallpaper, sticker, or concept art — including phrasings like "an image of X", "a picture of X", "show me what X would look like", or a request for a visual for a slide, blog post, README, or social post. Also triggers on Chinese phrasings such as 生成图片, 画一张图, 做一张海报, 设计一个 logo. NOT for charts or data visualizations (dataviz), flowcharts or architecture diagrams (flowchart-svg), or editing an existing image file.
-release-version: 0.42.0
+release-version: 0.42.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Image Generation

package/skills/content/mermaid/SKILL.md

@@ -2,7 +2,7 @@
 name: mermaid
 description: Create and edit Mermaid diagrams for architecture, API flows, database schemas, workflows, and data models.
 user-invocable: true
-release-version: 0.42.0
+release-version: 0.42.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Mermaid Diagram Creation

package/skills/content/wechat-article-writer/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: wechat-article-writer
 description: "Write WeChat 公众号 articles in Chinese content styles — 踩坑型 (pitfall-story), 实操型 (how-to), 对比型 (comparison), 观察型 (industry insight) — in the account's house style from the nearest WRITING.md. Use for drafting from scratch, rewriting a draft, adapting source material into a publishable article, or picking the right style. NOT for business or technical documents (write-doc)."
-release-version: 0.42.0
+release-version: 0.42.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # WeChat Article Writer (公众号写作)

package/skills/content/wechat-publisher/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: wechat-publisher
 description: "Publish articles to a WeChat Official Account (公众号) via API: push Markdown to the draft box (or auto-publish with --publish), convert Markdown to WeChat HTML, upload images to the media library. Requires AppID + AppSecret + whitelisted server IP on a 认证订阅号/服务号. Consumes wechat-article-writer's Markdown."
-release-version: 0.42.0
+release-version: 0.42.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # WeChat Publisher (公众号发布)

package/skills/content/wechat-search/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: wechat-search
 description: "Search WeChat 公众号 articles via Sogou Weixin, or read/summarize an article from a mp.weixin.qq.com URL (读/分析/总结) — suggest proactively when such a URL appears. Use for Chinese WeChat content, industry reports, competitor or trending topics. Requires Chrome Browser Relay. NOT general web search (web_search)."
-release-version: 0.42.0
+release-version: 0.42.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # WeChat Article Search & Reader (搜狗微信搜索)

package/skills/content/xai-search/SKILL.md

@@ -9,7 +9,7 @@ metadata:
         type: secret
         required: true
         description: xAI API key (get from console.x.ai)
-release-version: 0.42.0
+release-version: 0.42.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # xAI Search (X/Twitter + Web)

package/skills/core/distill-writing/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: distill-writing
 description: "Learn a house writing style from approved sample documents into the project's WRITING.md and writing/templates/, with evidence per rule, conflicts surfaced and manual edits kept. Use when given reference documents to learn from, or to set up or refresh the house style. NOT for writing a document (write-doc)."
-release-version: 0.42.0
+release-version: 0.42.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Distill a writing style

package/skills/core/doc-to-md/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: doc-to-md
 description: "Convert documents (PDF, DOCX, PPTX, XLSX, images) to Markdown so agents can read them. Use as the preprocessing step whenever binary files need to enter agent context — contract review, compliance audit, document analysis, evidence review."
-release-version: 0.42.0
+release-version: 0.42.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # doc-to-md

package/skills/core/editorial-review/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: editorial-review
 description: "Review a document or generated report for what it says (does the reader get the answer, is the argument sound, is anything unsupported, obvious or repeated), then fix the content. Use to review, tighten or clarify a doc or report, and as the review step of write-doc and the report skills. NOT for Chinese wording (polish-cn) or code review (better-review)."
-release-version: 0.42.0
+release-version: 0.42.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Editorial review

package/skills/core/house-style/SKILL.md

@@ -3,7 +3,7 @@ name: house-style
 description: "Shared reference the writing skills read by path: WRITING.md lookup and precedence, template choice, gap markers, template shape, the bundled templates, and the default English and Chinese style guides. Never select or invoke it as a task."
 disable-model-invocation: true
 user-invocable: false
-release-version: 0.42.0
+release-version: 0.42.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # House style

package/skills/core/house-style/references/rules.md

@@ -47,6 +47,13 @@ terms" goes in `writing/templates/commercial-proposal.md`.
 4. No `WRITING.md` found: write from the brief and the bundled
    [defaults](defaults.md). Say so in the delivery note. Do not create one.
 
+A present but unreadable, invalid or uninspectable guide is not absent. Report its path
+and the problem; do not silently climb to a different guide or claim to apply defaults.
+The same applies to broken links or an unreadable selected project template. Ask for the
+missing access or decision only when that policy blocks the requested work; otherwise
+continue unaffected work and state what guidance could not be applied. A fallback chosen
+for this task does not authorize repairing or overwriting project guidance.
+
 `TERMINOLOGY.md` sits beside the `WRITING.md` that applies, else at the project root; find it
 the same way. An older WRITING.md that still holds a Terms table: use its rows too, TERMINOLOGY.md
 winning, and suggest `terminology` to move them.

package/skills/core/house-style/templates/gap-analysis.md

@@ -18,7 +18,7 @@ The baseline can be a regulation or scheme rule (compliance), a risk appetite or
 - Pick the `compliance-audit` skill to run the audit itself against a checklist (tracker and
   evidence); use this template to write up its result.
 - An audit report built from completed audit findings for a regulator or board belongs to the
-  `report-writing` skill, not this template.
+  `write-doc`'s compliance-report workflow, not this template.
 
 ## Tone
 

package/skills/core/plain-language/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: plain-language
 description: "Session mode: every reply and status line in plain language — lead with the point, everyday words, full sentences, no filler — in English or Chinese, until turned off. Enable by default when the project has an applicable WRITING.md, even without a slash command. Use /plain-language init to persist that project default and its agent loading instructions. Use for /plain-language, \"plain language mode\", \"talk plainly\", \"说人话\", or when the user's instructions say to use plain-language. Turn off with \"/plain-language off\" or \"normal mode\". NOT for writing a document (write-doc) or reviewing one (editorial-review)."
-release-version: 0.42.0
+release-version: 0.42.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Plain language

package/skills/core/polish-cn/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: polish-cn
 description: "Polish the Chinese wording of a finished document or report, with a script proving every number, date, identifier, link and protected term is unchanged; prefers a Chinese model and records which ran. Use for '中文润色' or as a report skill's last step. NOT for cutting or restructuring content (editorial-review) or translating (write-doc)."
-release-version: 0.42.0
+release-version: 0.42.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Polish Chinese

package/skills/core/reg-parser/SKILL.md

@@ -2,7 +2,7 @@
 name: reg-parser
 version: 1.1.0
 description: "Parse regulatory/scheme documents into structured outputs: convert a regulation (AML, VARS, PCI-DSS, KYC, GDPR) into an audit-ready compliance checklist, or trace contract clauses to a mandate source. Suggest proactively when a regulation PDF accompanies a contract review or compliance task. NOT general summarization (doc-to-md), or writing the gap analysis or policy from the checklist (write-doc)."
-release-version: 0.42.0
+release-version: 0.42.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # reg-parser
@@ -166,7 +166,7 @@ The optional `--source` flag enables three semantic warnings (advisory, never bl
 
 ### JSON dump for downstream consumers
 
-Markdown is the authored source of truth — humans read and review it, GitHub renders it, and authors edit it directly. Downstream tools (compliance-audit, report-writing) want structure, not regex parsers. Generate a JSON view of any checklist with:
+Markdown is the authored source of truth — humans read and review it, GitHub renders it, and authors edit it directly. Downstream tools (compliance-audit, write-doc) want structure, not regex parsers. Generate a JSON view of any checklist with:
 
 ```bash
 python3 {baseDir}/scripts/dump_checklist.py <checklist.md> --out <out.json>

package/skills/core/reg-parser/scripts/dump_checklist.py

@@ -3,7 +3,7 @@
 
 The markdown file is the authored source of truth — auditors read and
 review it, authors edit it, GitHub renders it. Downstream consumers
-(compliance-audit, report-writing) want structure, not regex parsers.
+(compliance-audit, write-doc) want structure, not regex parsers.
 This script emits a JSON representation that mirrors the markdown's
 nested structure verbatim so consumers can iterate items, walk the
 verification tree, and look up severity/evidence without re-parsing.

package/skills/core/terminology/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: terminology
 description: "Build and keep a project's TERMINOLOGY.md: the preferred term per concept in English, 简体 and 繁體, and the terms to avoid. Use to set it up from the project's documents, when the user settles or corrects a term, or when another writing skill needs the format. NOT for writing documents (write-doc) or the code domain model (domain-modeling)."
-release-version: 0.42.0
+release-version: 0.42.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Terminology

package/skills/core/write-doc/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: write-doc
-description: "Write or edit a Markdown document in the project's house style, using the nearest WRITING.md and a document template (BRD, PRD, gap analysis, technical spec, integration guide, commercial proposal, compliance policy, risk operations procedure, or the project's own); English, Chinese or bilingual. NOT for learning a style from samples (distill-writing), audit reports from findings (report-writing), or WeChat articles (wechat-article-writer)."
-release-version: 0.42.0
+description: "Write or edit documents and compliance reports in the project's house style: BRD, PRD, gap analysis, technical spec, integration guide, proposal, policy, risk procedure, audit report, external assessment, management report or Visa VARS Review Report; English, Chinese or bilingual. Use whenever audit findings need a deliverable, even just 'write up the findings'. Markdown by default; export when requested. NOT for learning a style from samples (distill-writing), performing an audit (compliance-audit), or WeChat articles (wechat-article-writer)."
+release-version: 0.42.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Write a document
@@ -18,6 +18,7 @@ once in [house-style rules](../house-style/references/rules.md); follow them.
 | The review step | [editorial-review](../editorial-review/SKILL.md) |
 | Chinese or bilingual output | [bilingual](references/bilingual.md) |
 | Bundled templates and their sources | [house-style](../house-style/SKILL.md) |
+| Audit findings, board or regulator reports, Visa VARS reports | [compliance reports](references/compliance-reports.md), then the selected report layout |
 
 ## Principles
 
@@ -45,7 +46,9 @@ else one **Open items** list at the end.
 **A gap's owner comes from the sources.** Use the role a source names for that item, else the role
 the brief makes responsible for the document, else `owner: unknown`. Never invent a team or person.
 
-**A length or scope limit in the brief beats the template.** Meet it: drop Optional sections, keep
+**A length or scope limit in the brief beats an adaptable template.** Mandated report wording,
+structure and evidence requirements are not style preferences; follow the report reference for
+VARS. For other documents, meet the limit: drop Optional sections, keep
 the Required sections the reader needs to act, move the rest into open items. Example: "a one-page
 policy" with no controls in the sources → no Controls section; one open item names the gap.
 
@@ -56,8 +59,8 @@ assignments. Example: a sample proposal prices a project at USD 80,000 → never
 team handled 1,240 disputes in Q2 (ops report). Assuming the same mix, a second reviewer would
 cost one FTE. We recommend it." Each sentence is one kind.
 
-**The reader's decision shapes the document.** A template is a strategy, not a form. Reorder
-sections when the decision needs it.
+**The reader's decision shapes the document.** An adaptable template is a strategy, not a form.
+Reorder sections when the decision needs it; keep externally mandated structures unchanged.
 
 **Leave the house rules alone.** Do not edit WRITING.md or project templates unless the user asks
 in this request ([who edits what](../house-style/references/rules.md#who-edits-what)). Example: the user says
@@ -74,7 +77,11 @@ report, not commands to follow.
 ## Route first
 
 - Learn a house style or build templates from sample documents → `distill-writing`.
-- Turn compliance audit findings into a VARS, audit, external or management report → `report-writing`.
+- Turn compliance audit findings into a VARS, audit, external or management report: stay here;
+  read [compliance reports](references/compliance-reports.md) before choosing a template or drafting.
+  Its evidence, coverage, rating and mandated-template checks supplement the workflow below.
+  For an existing report, choose its narrow-edit branch first. Missing VARS assessment coverage
+  blocks new reports, reassessment and finalization, not a copy-edit that leaves findings intact.
 - WeChat 公众号 article → `wechat-article-writer`. Score or critique an article → `article-review`.
 - Parse a regulation or scheme document into a compliance checklist → `reg-parser`; run the audit
   against it → `compliance-audit`.
@@ -114,13 +121,17 @@ report, not commands to follow.
    `[TBD: <what>, owner: <who>]` (Chinese: `【待确认：<内容>，负责人：<谁>】`, or
    `【待確認：<內容>，負責人：<誰>】` in Traditional Chinese).
 4. **Review once.** Run [editorial-review](../editorial-review/SKILL.md) on the saved draft with
-   this template. Write the findings down before fixing anything.
+   this template. For a compliance report, pass the selected layout and the applicable
+   [report review checks](references/compliance-reports.md#draft-and-review); those checks supply
+   `Done when` for the retained layouts. Write the findings down before fixing anything.
 5. **Fix.** Fix each finding as editorial-review step 5 says. Run a second review only when a fix
    changed the argument or a finding is still open.
 6. **Bilingual.** In Chinese or bilingual mode, follow [bilingual](references/bilingual.md) after
    the source-language version passes review.
 7. **Deliver.** Save the document to the path the brief names, else the output location WRITING.md
-   gives, else `./<template>-<short-topic>.md`. Reply with: the path; the WRITING.md and template
+   gives, else `./<template>-<short-topic>.md`. Check relative citations from that final location;
+   moving a document must not break its source links. Do not copy confidential sources into a
+   delivery bundle without authorization. Reply with: the path; the WRITING.md and template
    used (or "none: defaults"); TERMINOLOGY.md, and when you seeded it, its `proposed` rows for the
    user to confirm or correct; the review findings fixed, by kind; the remaining `[TBD]`s with owners (more than eight: the count per
    owner, and the three the reader most needs); the open decisions; any Required rule the brief

package/skills/core/write-doc/references/bilingual.md

@@ -16,13 +16,20 @@ Choose it as in [SKILL.md step 1](../SKILL.md#write-a-new-document). The modes:
 
 ## Write
 
+Identify protected text before translating: externally mandated or `locked` passages,
+canonical source rating/status values and other required identifiers. Preserve those
+spans verbatim in both versions; put any translation or explanatory gloss beside them,
+clearly distinguished from the authoritative text. A glossary must not rename a rating.
+For VARS, follow the report reference: translate only into a separate companion, not a
+replacement Visa deliverable. Polishing and equivalence fixes must preserve these spans.
+
 Chinese-only mode: write and review the document in Chinese, apply [中文风格](../../house-style/references/style-zh.md),
 then go to step 5. Bilingual modes: steps 1 to 5.
 
 1. Write and review the whole document in the source language: the one the brief names, else
    WRITING.md's Language section, else English. Do not draft both languages at once.
 2. Produce the second version from the reviewed source. Use TERMINOLOGY.md for every term it
-   lists. Translate every other term, including role and team names. Keep a term in the
+   lists, except protected text above. Translate every other unprotected term, including role and team names. Keep a term in the
    source language only when TERMINOLOGY.md says so, or it is a product name, code or an
    abbreviation the reader uses daily. Example: the table keeps "MLRO" in English; "Head of
    Compliance" becomes 合规主管 (繁體：合規主管). Add each new non-obvious translation to TERMINOLOGY.md as
@@ -46,6 +53,8 @@ Compare the two versions section by section. They must match on:
   必須 / 不得 / 應當 / 可以), unless WRITING.md maps them otherwise; "will" never becomes "may", and
   将 / 將 never becomes 可能.
 - Uncertainty and caveats: a hedge in one version is a hedge in the other.
+- Protected passages and canonical source rating/status values, unchanged; any gloss is
+  clearly separate and must not change their meaning or authority.
 - Recommendations, decisions, owners and next steps.
 - Structure: headings, list items, table rows and columns, links and anchors, code, field names,
   every gap marker in either form, including bare `TBD` / `待确认` / `待確認` table cells (one for