@cubis/foundry 0.3.10 → 0.3.12

package/Ai Agent Workflow/powers/code-review-checklist/SKILL.md

@@ -1,11 +1,109 @@
 ---
 name: code-review-checklist
 description: Code review guidelines covering code quality, security, and best practices.
+allowed-tools: Read, Glob, Grep
 ---
 
-# code-review-checklist
+# Code Review Checklist
 
-This power mirrors the base skill:
-- `Ai Agent Workflow/skills/code-review-checklist/SKILL.md`
+## Quick Review Checklist
 
-When both exist, prefer the base skill as source of truth unless power-specific overrides are added here.
+### Correctness
+- [ ] Code does what it's supposed to do
+- [ ] Edge cases handled
+- [ ] Error handling in place
+- [ ] No obvious bugs
+
+### Security
+- [ ] Input validated and sanitized
+- [ ] No SQL/NoSQL injection vulnerabilities
+- [ ] No XSS or CSRF vulnerabilities
+- [ ] No hardcoded secrets or sensitive credentials
+- [ ] **AI-Specific:** Protection against Prompt Injection (if applicable)
+- [ ] **AI-Specific:** Outputs are sanitized before being used in critical sinks
+
+### Performance
+- [ ] No N+1 queries
+- [ ] No unnecessary loops
+- [ ] Appropriate caching
+- [ ] Bundle size impact considered
+
+### Code Quality
+- [ ] Clear naming
+- [ ] DRY - no duplicate code
+- [ ] SOLID principles followed
+- [ ] Appropriate abstraction level
+
+### Testing
+- [ ] Unit tests for new code
+- [ ] Edge cases tested
+- [ ] Tests readable and maintainable
+
+### Documentation
+- [ ] Complex logic commented
+- [ ] Public APIs documented
+- [ ] README updated if needed
+
+## AI & LLM Review Patterns (2025)
+
+### Logic & Hallucinations
+- [ ] **Chain of Thought:** Does the logic follow a verifiable path?
+- [ ] **Edge Cases:** Did the AI account for empty states, timeouts, and partial failures?
+- [ ] **External State:** Is the code making safe assumptions about file systems or networks?
+
+### Prompt Engineering Review
+```markdown
+// ❌ Vague prompt in code
+const response = await ai.generate(userInput);
+
+// ✅ Structured & Safe prompt
+const response = await ai.generate({
+  system: "You are a specialized parser...",
+  input: sanitize(userInput),
+  schema: ResponseSchema
+});
+```
+
+## Anti-Patterns to Flag
+
+```typescript
+// ❌ Magic numbers
+if (status === 3) { ... }
+
+// ✅ Named constants
+if (status === Status.ACTIVE) { ... }
+
+// ❌ Deep nesting
+if (a) { if (b) { if (c) { ... } } }
+
+// ✅ Early returns
+if (!a) return;
+if (!b) return;
+if (!c) return;
+// do work
+
+// ❌ Long functions (100+ lines)
+// ✅ Small, focused functions
+
+// ❌ any type
+const data: any = ...
+
+// ✅ Proper types
+const data: UserData = ...
+```
+
+## Review Comments Guide
+
+```
+// Blocking issues use 🔴
+🔴 BLOCKING: SQL injection vulnerability here
+
+// Important suggestions use 🟡
+🟡 SUGGESTION: Consider using useMemo for performance
+
+// Minor nits use 🟢
+🟢 NIT: Prefer const over let for immutable variable
+
+// Questions use ❓
+❓ QUESTION: What happens if user is null here?
+```

package/Ai Agent Workflow/powers/code-reviewer/POWER.md

@@ -1,19 +1,11 @@
+````markdown
 ---
-name: code-reviewer
-displayName: Code Reviewer
-description:
-  Use when reviewing pull requests, conducting code quality audits, or
-  identifying security vulnerabilities. Invoke for PR reviews, code quality checks,
-  refactoring suggestions.
-keywords:
-  - code review
-  - PR review
-  - pull request
-  - review code
-  - code quality
-author: OneUp
+inclusion: manual
+name: "code-reviewer"
+description: "Use when reviewing pull requests, conducting code quality audits, or identifying security vulnerabilities. Invoke for PR reviews, code quality checks, refactoring suggestions."
 ---
 
+
 # Code Reviewer
 
 ## Overview
@@ -46,15 +38,15 @@ Load detailed guidance on-demand:
 
 | Topic             | Reference                       | Load When                            |
 | ----------------- | ------------------------------- | ------------------------------------ |
-| Review Checklist  | `steering/review-checklist.md`  | Starting a review, categories        |
-| Common Issues     | `steering/common-issues.md`     | N+1 queries, magic numbers, patterns |
-| Feedback Examples | `steering/feedback-examples.md` | Writing good feedback                |
-| Report Template   | `steering/report-template.md`   | Writing final review report          |
+| Review Checklist  | `references/review-checklist.md`  | Starting a review, categories        |
+| Common Issues     | `references/common-issues.md`     | N+1 queries, magic numbers, patterns |
+| Feedback Examples | `references/feedback-examples.md` | Writing good feedback                |
+| Report Template   | `references/report-template.md`   | Writing final review report          |
 
 <!-- Rows below adapted from obra/superpowers by Jesse Vincent (@obra), MIT License -->
 
-| Spec Compliance | `steering/spec-compliance-review.md` | Reviewing implementations, PR review, spec verification |
-| Receiving Feedback | `steering/receiving-feedback.md` | Responding to review comments, handling feedback |
+| Spec Compliance | `references/spec-compliance-review.md` | Reviewing implementations, PR review, spec verification |
+| Receiving Feedback | `references/receiving-feedback.md` | Responding to review comments, handling feedback |
 
 ## Constraints
 
@@ -98,3 +90,4 @@ SOLID, DRY, KISS, YAGNI, design patterns, OWASP Top 10, language idioms, testing
 - **Security Reviewer** - Deep security analysis
 - **Test Master** - Test quality assessment
 - **Architecture Designer** - Design review
+````

package/Ai Agent Workflow/powers/code-reviewer/SKILL.md

@@ -36,15 +36,15 @@ Load detailed guidance on-demand:
 
 | Topic             | Reference                       | Load When                            |
 | ----------------- | ------------------------------- | ------------------------------------ |
-| Review Checklist  | `steering/review-checklist.md`  | Starting a review, categories        |
-| Common Issues     | `steering/common-issues.md`     | N+1 queries, magic numbers, patterns |
-| Feedback Examples | `steering/feedback-examples.md` | Writing good feedback                |
-| Report Template   | `steering/report-template.md`   | Writing final review report          |
+| Review Checklist  | `references/review-checklist.md`  | Starting a review, categories        |
+| Common Issues     | `references/common-issues.md`     | N+1 queries, magic numbers, patterns |
+| Feedback Examples | `references/feedback-examples.md` | Writing good feedback                |
+| Report Template   | `references/report-template.md`   | Writing final review report          |
 
 <!-- Rows below adapted from obra/superpowers by Jesse Vincent (@obra), MIT License -->
 
-| Spec Compliance | `steering/spec-compliance-review.md` | Reviewing implementations, PR review, spec verification |
-| Receiving Feedback | `steering/receiving-feedback.md` | Responding to review comments, handling feedback |
+| Spec Compliance | `references/spec-compliance-review.md` | Reviewing implementations, PR review, spec verification |
+| Receiving Feedback | `references/receiving-feedback.md` | Responding to review comments, handling feedback |
 
 ## Constraints
 

package/Ai Agent Workflow/powers/database-skills/POWER.md

@@ -1,8 +1,105 @@
+````markdown
 ---
+inclusion: manual
 name: database-skills
-description: Compatibility power wrapper for the database-skills package.
+description: Unified database skill hub with engine-specific packs for PostgreSQL, MySQL, Vitess, Neki, MongoDB (Mongoose), SQLite, Supabase, and Redis.
+allowed-tools: Read, Write, Edit, Glob, Grep, Bash
+metadata:
+  version: "2.0.0"
+  domain: data
+  triggers: database, sql, postgres, mysql, vitess, neki, mongodb, mongoose, sqlite, supabase, redis, schema, migration, index, query, performance, pagination, replication, pooling, sharding, cache
 ---
 
-# database-skills
+# Database Skills Hub
 
-Use this wrapper when power-oriented flows need the consolidated database package.
+Use this as the primary database hub. Keep `database-design`, `database-optimizer`, and `drift-flutter` available for specialized/legacy-compatible flows. Load the target engine's `SKILL.md` from `skills/<engine>/`, then load relevant `references/*` files.
+
+## Engine selection
+
+| Situation | Engine |
+| --- | --- |
+| Relational OLTP, self-hosted or cloud | Postgres |
+| Relational OLTP, MySQL-compatible managed service | MySQL + Vitess (PlanetScale) |
+| Multi-tenant SaaS needing horizontal Postgres scale | Neki |
+| Document model, flexible schema | MongoDB |
+| Mobile / desktop / edge local storage | SQLite |
+| BaaS with built-in auth, storage & realtime | Supabase |
+| Caching, queues, leaderboards, pub/sub | Redis |
+
+## Structure
+
+```
+skills/
+  postgres/
+    SKILL.md
+    references/
+      schema-indexing.md       ← index types, composite, partial, INCLUDE
+      performance-ops.md       ← EXPLAIN, pg_stat_statements, VACUUM, autovacuum
+      migrations.md            ← zero-downtime DDL, expand/contract, tools
+      connection-pooling.md    ← PgBouncer, pool sizing, serverless patterns
+
+  mysql/
+    SKILL.md
+    references/
+      query-indexing.md        ← EXPLAIN, composite indexes, covering, seek pagination
+      locking-ddl.md           ← INSTANT/INPLACE/COPY, MDL, gh-ost, deadlocks
+      replication.md           ← binlog formats, GTID, lag monitoring, read routing
+
+  vitess/
+    SKILL.md
+    references/
+      sharding-routing.md      ← VSchema, vindexes, sequences, scatter queries
+      operational-safety.md    ← Online DDL strategies, migration lifecycle, VReplication
+
+  neki/
+    SKILL.md
+    references/
+      architecture.md          ← sharded Postgres architecture, pre-sharding checklist
+      operations.md            ← migration planning, validation, provisional pre-GA guidance
+
+  mongodb/
+    SKILL.md
+    references/
+      modeling.md              ← embed vs reference, compound indexes, explain(), pagination
+      mongoose-nestjs.md       ← repository pattern, lean reads, transactions, NestJS setup
+      aggregation.md           ← pipeline stages, $group, $lookup, $facet, performance
+
+  sqlite/
+    SKILL.md
+    references/
+      local-first.md           ← WAL mode, migration patterns, sync/conflict strategies
+      performance.md           ← EXPLAIN QUERY PLAN, indexes, batch writes, checkpoint tuning
+
+  supabase/
+    SKILL.md
+    references/
+      rls-auth.md              ← RLS policies, auth.uid(), index predicates, service_role
+      performance-operations.md ← query optimization, connection modes, pooler selection
+
+  redis/
+    SKILL.md
+    references/
+      data-modeling.md         ← data structure selection, key naming, TTL strategy
+      cache-patterns.md        ← pipelining, SCAN, rate limiting, leaderboards, invalidation
+      operations.md            ← memory management, eviction policies, latency diagnostics
+```
+
+## Required flow
+
+1. Read `LATEST_VERSIONS.md` before proposing version-specific behavior.
+2. Use engine selection table above to pick the target engine.
+3. Load the target engine `SKILL.md` and relevant `references/*` files — read the ones that match the task (indexing, migrations, replication, etc.).
+4. Provide an optimization or implementation plan that includes:
+   - specific change with rationale,
+   - indexing or schema decisions,
+   - migration safety (online vs offline),
+   - rollback path.
+5. For production-impacting changes, include blast-radius assessment and rollout stages.
+
+## Cross-engine performance checklist
+
+- **Indexing**: add indexes only for real predicates and sort patterns. Drop unused indexes — they penalize writes.
+- **Pagination**: prefer keyset/seek for deep or high-throughput pagination. Reserve offset for shallow interactive pages only.
+- **Measurement**: compare before/after plans with engine-native explain tooling (`EXPLAIN ANALYZE`, `VEXPLAIN`, `explain()`). Validate with realistic cardinality.
+- **Safety**: no destructive data/schema operations without explicit user confirmation. Always include rollback/recovery steps.
+````

package/Ai Agent Workflow/powers/database-skills/SKILL.md

@@ -1,9 +1,102 @@
 ---
 name: database-skills
-description: Compatibility power wrapper for the database-skills package.
+description: Unified database skill hub with engine-specific packs for PostgreSQL, MySQL, Vitess, Neki, MongoDB (Mongoose), SQLite, Supabase, and Redis.
+allowed-tools: Read, Write, Edit, Glob, Grep, Bash
+metadata:
+  version: "2.0.0"
+  domain: data
+  triggers: database, sql, postgres, mysql, vitess, neki, mongodb, mongoose, sqlite, supabase, redis, schema, migration, index, query, performance, pagination, replication, pooling, sharding, cache
 ---
 
-# database-skills
+# Database Skills Hub
 
-This power mirrors:
-- `Ai Agent Workflow/skills/database-skills/SKILL.md`
+Use this as the primary database hub. Keep `database-design`, `database-optimizer`, and `drift-flutter` available for specialized/legacy-compatible flows. Load the target engine's `SKILL.md` from `skills/<engine>/`, then load relevant `references/*` files.
+
+## Engine selection
+
+| Situation | Engine |
+| --- | --- |
+| Relational OLTP, self-hosted or cloud | Postgres |
+| Relational OLTP, MySQL-compatible managed service | MySQL + Vitess (PlanetScale) |
+| Multi-tenant SaaS needing horizontal Postgres scale | Neki |
+| Document model, flexible schema | MongoDB |
+| Mobile / desktop / edge local storage | SQLite |
+| BaaS with built-in auth, storage & realtime | Supabase |
+| Caching, queues, leaderboards, pub/sub | Redis |
+
+## Structure
+
+```
+skills/
+  postgres/
+    SKILL.md
+    references/
+      schema-indexing.md       ← index types, composite, partial, INCLUDE
+      performance-ops.md       ← EXPLAIN, pg_stat_statements, VACUUM, autovacuum
+      migrations.md            ← zero-downtime DDL, expand/contract, tools
+      connection-pooling.md    ← PgBouncer, pool sizing, serverless patterns
+
+  mysql/
+    SKILL.md
+    references/
+      query-indexing.md        ← EXPLAIN, composite indexes, covering, seek pagination
+      locking-ddl.md           ← INSTANT/INPLACE/COPY, MDL, gh-ost, deadlocks
+      replication.md           ← binlog formats, GTID, lag monitoring, read routing
+
+  vitess/
+    SKILL.md
+    references/
+      sharding-routing.md      ← VSchema, vindexes, sequences, scatter queries
+      operational-safety.md    ← Online DDL strategies, migration lifecycle, VReplication
+
+  neki/
+    SKILL.md
+    references/
+      architecture.md          ← sharded Postgres architecture, pre-sharding checklist
+      operations.md            ← migration planning, validation, provisional pre-GA guidance
+
+  mongodb/
+    SKILL.md
+    references/
+      modeling.md              ← embed vs reference, compound indexes, explain(), pagination
+      mongoose-nestjs.md       ← repository pattern, lean reads, transactions, NestJS setup
+      aggregation.md           ← pipeline stages, $group, $lookup, $facet, performance
+
+  sqlite/
+    SKILL.md
+    references/
+      local-first.md           ← WAL mode, migration patterns, sync/conflict strategies
+      performance.md           ← EXPLAIN QUERY PLAN, indexes, batch writes, checkpoint tuning
+
+  supabase/
+    SKILL.md
+    references/
+      rls-auth.md              ← RLS policies, auth.uid(), index predicates, service_role
+      performance-operations.md ← query optimization, connection modes, pooler selection
+
+  redis/
+    SKILL.md
+    references/
+      data-modeling.md         ← data structure selection, key naming, TTL strategy
+      cache-patterns.md        ← pipelining, SCAN, rate limiting, leaderboards, invalidation
+      operations.md            ← memory management, eviction policies, latency diagnostics
+```
+
+## Required flow
+
+1. Read `LATEST_VERSIONS.md` before proposing version-specific behavior.
+2. Use engine selection table above to pick the target engine.
+3. Load the target engine `SKILL.md` and relevant `references/*` files — read the ones that match the task (indexing, migrations, replication, etc.).
+4. Provide an optimization or implementation plan that includes:
+   - specific change with rationale,
+   - indexing or schema decisions,
+   - migration safety (online vs offline),
+   - rollback path.
+5. For production-impacting changes, include blast-radius assessment and rollout stages.
+
+## Cross-engine performance checklist
+
+- **Indexing**: add indexes only for real predicates and sort patterns. Drop unused indexes — they penalize writes.
+- **Pagination**: prefer keyset/seek for deep or high-throughput pagination. Reserve offset for shallow interactive pages only.
+- **Measurement**: compare before/after plans with engine-native explain tooling (`EXPLAIN ANALYZE`, `VEXPLAIN`, `explain()`). Validate with realistic cardinality.
+- **Safety**: no destructive data/schema operations without explicit user confirmation. Always include rollback/recovery steps.

package/Ai Agent Workflow/powers/database-skills/engines/mongodb/POWER.md

@@ -0,0 +1,10 @@
+# mongodb
+
+Source skill:
+- `Ai Agent Workflow/skills/database-skills/skills/mongodb/SKILL.md`
+
+Focus:
+- Access-pattern-first schema design
+- Compound index strategy
+- Cursor/range pagination over deep `skip`
+- `explain("executionStats")` evidence

package/Ai Agent Workflow/powers/database-skills/engines/mysql/POWER.md

@@ -0,0 +1,10 @@
+# mysql
+
+Source skill:
+- `Ai Agent Workflow/skills/database-skills/skills/mysql/SKILL.md`
+
+Focus:
+- Composite/covering index design
+- Keyset pagination with stable ordering
+- `EXPLAIN` / `EXPLAIN ANALYZE` evidence
+- Online DDL lock and replication risk checks

package/Ai Agent Workflow/powers/database-skills/engines/neki/POWER.md

@@ -0,0 +1,10 @@
+# neki
+
+Source skill:
+- `Ai Agent Workflow/skills/database-skills/skills/neki/SKILL.md`
+
+Focus:
+- Shard key and locality planning
+- Cross-shard boundary minimization
+- Reversible migration milestones
+- Explicit assumption tracking (pre-GA)

package/Ai Agent Workflow/powers/database-skills/engines/postgres/POWER.md

@@ -0,0 +1,10 @@
+# postgres
+
+Source skill:
+- `Ai Agent Workflow/skills/database-skills/skills/postgres/SKILL.md`
+
+Focus:
+- Multicolumn/partial/INCLUDE indexes
+- Keyset pagination for deep lists
+- `EXPLAIN (ANALYZE, BUFFERS)` evidence
+- Vacuum/autovacuum and stats health

package/Ai Agent Workflow/powers/database-skills/engines/redis/POWER.md

@@ -0,0 +1,10 @@
+# redis
+
+Source skill:
+- `Ai Agent Workflow/skills/database-skills/skills/redis/SKILL.md`
+
+Focus:
+- Key schema as access index
+- Sorted set and SCAN-based pagination patterns
+- Pipeline/batching throughput optimization
+- Memory/latency diagnostics and eviction safety

package/Ai Agent Workflow/powers/database-skills/engines/sqlite/POWER.md

@@ -0,0 +1,10 @@
+# sqlite
+
+Source skill:
+- `Ai Agent Workflow/skills/database-skills/skills/sqlite/SKILL.md`
+
+Focus:
+- `EXPLAIN QUERY PLAN` verification
+- Multicolumn/covering index design
+- Keyset pagination for large local datasets
+- WAL/checkpoint tuning and transaction batching

package/Ai Agent Workflow/powers/database-skills/engines/supabase/POWER.md

@@ -0,0 +1,10 @@
+# supabase
+
+Source skill:
+- `Ai Agent Workflow/skills/database-skills/skills/supabase/SKILL.md`
+
+Focus:
+- RLS policy correctness and predicate indexing
+- Keyset pagination for heavy endpoints
+- Query optimization + advisor workflow
+- Pooler mode and managed/self-host compatibility checks

package/Ai Agent Workflow/powers/database-skills/engines/vitess/POWER.md

@@ -0,0 +1,10 @@
+# vitess
+
+Source skill:
+- `Ai Agent Workflow/skills/database-skills/skills/vitess/SKILL.md`
+
+Focus:
+- Vindex and VSchema routing quality
+- Shard-local query design
+- Shard-aware seek pagination
+- Resharding rollout + rollback safety

package/Ai Agent Workflow/powers/database-skills/steering/readme.md

@@ -1,9 +1,21 @@
 # database-skills steering
 
-Primary source:
-- `Ai Agent Workflow/skills/database-skills/`
+Use this steering map for power-mode database tasks.
 
-Suggested flow:
-1. Read hub SKILL
-2. Read engine SKILL
-3. Read engine references needed for current task
+## Routing map
+
+- Postgres: `engines/postgres/POWER.md`
+- MySQL: `engines/mysql/POWER.md`
+- Vitess: `engines/vitess/POWER.md`
+- Neki: `engines/neki/POWER.md`
+- MongoDB: `engines/mongodb/POWER.md`
+- SQLite: `engines/sqlite/POWER.md`
+- Supabase: `engines/supabase/POWER.md`
+- Redis: `engines/redis/POWER.md`
+
+## Required output for DB work
+
+- Indexing plan
+- Pagination plan
+- Query-plan evidence
+- Rollback plan