@cubis/foundry 0.3.11 → 0.3.13

package/Ai Agent Workflow/powers/react-expert/POWER.md

@@ -0,0 +1,87 @@
+````markdown
+---
+inclusion: manual
+name: react-expert
+description: "Use for framework-agnostic React component architecture, hooks/state patterns, and React 19 APIs. For Next.js routing/App Router specifics, use nextjs-developer."
+license: MIT
+metadata:
+  author: https://github.com/Jeffallan
+  version: "1.0.0"
+  domain: frontend
+  triggers: React, JSX, hooks, useState, useEffect, useContext, Server Components, React 19, Suspense, TanStack Query, Redux, Zustand, component, frontend
+  role: specialist
+  scope: implementation
+  output-format: code
+  related-skills: fullstack-guardian, playwright-expert, test-master
+---
+
+# React Expert
+
+Senior React specialist with deep expertise in React 19, Server Components, and production-grade application architecture.
+
+## Role Definition
+
+You are a senior React engineer with 10+ years of frontend experience. You specialize in React 19 patterns including Server Components, the `use()` hook, and form actions. You build accessible, performant applications with TypeScript and modern state management.
+
+## When to Use This Skill
+
+- Building new React components or features
+- Implementing state management (local, Context, Redux, Zustand)
+- Optimizing React performance
+- Setting up React project architecture
+- Working with React 19 Server Components
+- Implementing forms with React 19 actions
+- Data fetching patterns with TanStack Query or `use()`
+
+## Core Workflow
+
+1. **Analyze requirements** - Identify component hierarchy, state needs, data flow
+2. **Choose patterns** - Select appropriate state management, data fetching approach
+3. **Implement** - Write TypeScript components with proper types
+4. **Optimize** - Apply memoization where needed, ensure accessibility
+5. **Test** - Write tests with React Testing Library
+
+## Reference Guide
+
+Load detailed guidance based on context:
+
+| Topic | Reference | Load When |
+|-------|-----------|-----------|
+| Server Components | `references/server-components.md` | RSC patterns, Next.js App Router |
+| React 19 | `references/react-19-features.md` | use() hook, useActionState, forms |
+| State Management | `references/state-management.md` | Context, Zustand, Redux, TanStack |
+| Hooks | `references/hooks-patterns.md` | Custom hooks, useEffect, useCallback |
+| Performance | `references/performance.md` | memo, lazy, virtualization |
+| Testing | `references/testing-react.md` | Testing Library, mocking |
+| Class Migration | `references/migration-class-to-modern.md` | Converting class components to hooks/RSC |
+
+## Constraints
+
+### MUST DO
+- Use TypeScript with strict mode
+- Implement error boundaries for graceful failures
+- Use `key` props correctly (stable, unique identifiers)
+- Clean up effects (return cleanup function)
+- Use semantic HTML and ARIA for accessibility
+- Memoize when passing callbacks/objects to memoized children
+- Use Suspense boundaries for async operations
+
+### MUST NOT DO
+- Mutate state directly
+- Use array index as key for dynamic lists
+- Create functions inside JSX (causes re-renders)
+- Forget useEffect cleanup (memory leaks)
+- Ignore React strict mode warnings
+- Skip error boundaries in production
+
+## Output Templates
+
+When implementing React features, provide:
+1. Component file with TypeScript types
+2. Test file if non-trivial logic
+3. Brief explanation of key decisions
+
+## Knowledge Reference
+
+React 19, Server Components, use() hook, Suspense, TypeScript, TanStack Query, Zustand, Redux Toolkit, React Router, React Testing Library, Vitest/Jest, Next.js App Router, accessibility (WCAG)
+````

package/Ai Agent Workflow/powers/react-expert/SKILL.md

@@ -45,13 +45,13 @@ Load detailed guidance based on context:
 
 | Topic | Reference | Load When |
 |-------|-----------|-----------|
-| Server Components | `steering/server-components.md` | RSC patterns, Next.js App Router |
-| React 19 | `steering/react-19-features.md` | use() hook, useActionState, forms |
-| State Management | `steering/state-management.md` | Context, Zustand, Redux, TanStack |
-| Hooks | `steering/hooks-patterns.md` | Custom hooks, useEffect, useCallback |
-| Performance | `steering/performance.md` | memo, lazy, virtualization |
-| Testing | `steering/testing-react.md` | Testing Library, mocking |
-| Class Migration | `steering/migration-class-to-modern.md` | Converting class components to hooks/RSC |
+| Server Components | `references/server-components.md` | RSC patterns, Next.js App Router |
+| React 19 | `references/react-19-features.md` | use() hook, useActionState, forms |
+| State Management | `references/state-management.md` | Context, Zustand, Redux, TanStack |
+| Hooks | `references/hooks-patterns.md` | Custom hooks, useEffect, useCallback |
+| Performance | `references/performance.md` | memo, lazy, virtualization |
+| Testing | `references/testing-react.md` | Testing Library, mocking |
+| Class Migration | `references/migration-class-to-modern.md` | Converting class components to hooks/RSC |
 
 ## Constraints
 

package/Ai Agent Workflow/powers/red-team-tactics/POWER.md

@@ -1,13 +1,202 @@
+````markdown
 ---
+inclusion: manual
 name: red-team-tactics
 description: Red team tactics principles based on MITRE ATT&CK. Attack phases, detection evasion, reporting.
+allowed-tools: Read, Glob, Grep
 ---
 
-# red-team-tactics
+# Red Team Tactics
 
-This is a compatibility power wrapper for the `red-team-tactics` skill.
+> Adversary simulation principles based on MITRE ATT&CK framework.
 
-Primary source:
-- `Ai Agent Workflow/skills/red-team-tactics/SKILL.md`
+---
+
+## 1. MITRE ATT&CK Phases
+
+### Attack Lifecycle
+
+```
+RECONNAISSANCE → INITIAL ACCESS → EXECUTION → PERSISTENCE
+       ↓              ↓              ↓            ↓
+   PRIVILEGE ESC → DEFENSE EVASION → CRED ACCESS → DISCOVERY
+       ↓              ↓              ↓            ↓
+LATERAL MOVEMENT → COLLECTION → C2 → EXFILTRATION → IMPACT
+```
+
+### Phase Objectives
+
+| Phase | Objective |
+|-------|-----------|
+| **Recon** | Map attack surface |
+| **Initial Access** | Get first foothold |
+| **Execution** | Run code on target |
+| **Persistence** | Survive reboots |
+| **Privilege Escalation** | Get admin/root |
+| **Defense Evasion** | Avoid detection |
+| **Credential Access** | Harvest credentials |
+| **Discovery** | Map internal network |
+| **Lateral Movement** | Spread to other systems |
+| **Collection** | Gather target data |
+| **C2** | Maintain command channel |
+| **Exfiltration** | Extract data |
+
+---
+
+## 2. Reconnaissance Principles
+
+### Passive vs Active
+
+| Type | Trade-off |
+|------|-----------|
+| **Passive** | No target contact, limited info |
+| **Active** | Direct contact, more detection risk |
+
+### Information Targets
+
+| Category | Value |
+|----------|-------|
+| Technology stack | Attack vector selection |
+| Employee info | Social engineering |
+| Network ranges | Scanning scope |
+| Third parties | Supply chain attack |
+
+---
+
+## 3. Initial Access Vectors
+
+### Selection Criteria
+
+| Vector | When to Use |
+|--------|-------------|
+| **Phishing** | Human target, email access |
+| **Public exploits** | Vulnerable services exposed |
+| **Valid credentials** | Leaked or cracked |
+| **Supply chain** | Third-party access |
+
+---
+
+## 4. Privilege Escalation Principles
+
+### Windows Targets
+
+| Check | Opportunity |
+|-------|-------------|
+| Unquoted service paths | Write to path |
+| Weak service permissions | Modify service |
+| Token privileges | Abuse SeDebug, etc. |
+| Stored credentials | Harvest |
+
+### Linux Targets
+
+| Check | Opportunity |
+|-------|-------------|
+| SUID binaries | Execute as owner |
+| Sudo misconfiguration | Command execution |
+| Kernel vulnerabilities | Kernel exploits |
+| Cron jobs | Writable scripts |
+
+---
+
+## 5. Defense Evasion Principles
+
+### Key Techniques
+
+| Technique | Purpose |
+|-----------|---------|
+| LOLBins | Use legitimate tools |
+| Obfuscation | Hide malicious code |
+| Timestomping | Hide file modifications |
+| Log clearing | Remove evidence |
+
+### Operational Security
+
+- Work during business hours
+- Mimic legitimate traffic patterns
+- Use encrypted channels
+- Blend with normal behavior
+
+---
+
+## 6. Lateral Movement Principles
+
+### Credential Types
+
+| Type | Use |
+|------|-----|
+| Password | Standard auth |
+| Hash | Pass-the-hash |
+| Ticket | Pass-the-ticket |
+| Certificate | Certificate auth |
+
+### Movement Paths
+
+- Admin shares
+- Remote services (RDP, SSH, WinRM)
+- Exploitation of internal services
+
+---
+
+## 7. Active Directory Attacks
+
+### Attack Categories
+
+| Attack | Target |
+|--------|--------|
+| Kerberoasting | Service account passwords |
+| AS-REP Roasting | Accounts without pre-auth |
+| DCSync | Domain credentials |
+| Golden Ticket | Persistent domain access |
+
+---
+
+## 8. Reporting Principles
+
+### Attack Narrative
+
+Document the full attack chain:
+1. How initial access was gained
+2. What techniques were used
+3. What objectives were achieved
+4. Where detection failed
+
+### Detection Gaps
+
+For each successful technique:
+- What should have detected it?
+- Why didn't detection work?
+- How to improve detection
+
+---
+
+## 9. Ethical Boundaries
+
+### Always
+
+- Stay within scope
+- Minimize impact
+- Report immediately if real threat found
+- Document all actions
+
+### Never
+
+- Destroy production data
+- Cause denial of service (unless scoped)
+- Access beyond proof of concept
+- Retain sensitive data
+
+---
+
+## 10. Anti-Patterns
+
+| ❌ Don't | ✅ Do |
+|----------|-------|
+| Rush to exploitation | Follow methodology |
+| Cause damage | Minimize impact |
+| Skip reporting | Document everything |
+| Ignore scope | Stay within boundaries |
+
+---
 
-Use this folder for power-specific extensions when needed.
+> **Remember:** Red team simulates attackers to improve defenses, not to cause harm.
+````

package/Ai Agent Workflow/powers/red-team-tactics/SKILL.md

@@ -1,11 +1,199 @@
 ---
 name: red-team-tactics
 description: Red team tactics principles based on MITRE ATT&CK. Attack phases, detection evasion, reporting.
+allowed-tools: Read, Glob, Grep
 ---
 
-# red-team-tactics
+# Red Team Tactics
 
-This power mirrors the base skill:
-- `Ai Agent Workflow/skills/red-team-tactics/SKILL.md`
+> Adversary simulation principles based on MITRE ATT&CK framework.
 
-When both exist, prefer the base skill as source of truth unless power-specific overrides are added here.
+---
+
+## 1. MITRE ATT&CK Phases
+
+### Attack Lifecycle
+
+```
+RECONNAISSANCE → INITIAL ACCESS → EXECUTION → PERSISTENCE
+       ↓              ↓              ↓            ↓
+   PRIVILEGE ESC → DEFENSE EVASION → CRED ACCESS → DISCOVERY
+       ↓              ↓              ↓            ↓
+LATERAL MOVEMENT → COLLECTION → C2 → EXFILTRATION → IMPACT
+```
+
+### Phase Objectives
+
+| Phase | Objective |
+|-------|-----------|
+| **Recon** | Map attack surface |
+| **Initial Access** | Get first foothold |
+| **Execution** | Run code on target |
+| **Persistence** | Survive reboots |
+| **Privilege Escalation** | Get admin/root |
+| **Defense Evasion** | Avoid detection |
+| **Credential Access** | Harvest credentials |
+| **Discovery** | Map internal network |
+| **Lateral Movement** | Spread to other systems |
+| **Collection** | Gather target data |
+| **C2** | Maintain command channel |
+| **Exfiltration** | Extract data |
+
+---
+
+## 2. Reconnaissance Principles
+
+### Passive vs Active
+
+| Type | Trade-off |
+|------|-----------|
+| **Passive** | No target contact, limited info |
+| **Active** | Direct contact, more detection risk |
+
+### Information Targets
+
+| Category | Value |
+|----------|-------|
+| Technology stack | Attack vector selection |
+| Employee info | Social engineering |
+| Network ranges | Scanning scope |
+| Third parties | Supply chain attack |
+
+---
+
+## 3. Initial Access Vectors
+
+### Selection Criteria
+
+| Vector | When to Use |
+|--------|-------------|
+| **Phishing** | Human target, email access |
+| **Public exploits** | Vulnerable services exposed |
+| **Valid credentials** | Leaked or cracked |
+| **Supply chain** | Third-party access |
+
+---
+
+## 4. Privilege Escalation Principles
+
+### Windows Targets
+
+| Check | Opportunity |
+|-------|-------------|
+| Unquoted service paths | Write to path |
+| Weak service permissions | Modify service |
+| Token privileges | Abuse SeDebug, etc. |
+| Stored credentials | Harvest |
+
+### Linux Targets
+
+| Check | Opportunity |
+|-------|-------------|
+| SUID binaries | Execute as owner |
+| Sudo misconfiguration | Command execution |
+| Kernel vulnerabilities | Kernel exploits |
+| Cron jobs | Writable scripts |
+
+---
+
+## 5. Defense Evasion Principles
+
+### Key Techniques
+
+| Technique | Purpose |
+|-----------|---------|
+| LOLBins | Use legitimate tools |
+| Obfuscation | Hide malicious code |
+| Timestomping | Hide file modifications |
+| Log clearing | Remove evidence |
+
+### Operational Security
+
+- Work during business hours
+- Mimic legitimate traffic patterns
+- Use encrypted channels
+- Blend with normal behavior
+
+---
+
+## 6. Lateral Movement Principles
+
+### Credential Types
+
+| Type | Use |
+|------|-----|
+| Password | Standard auth |
+| Hash | Pass-the-hash |
+| Ticket | Pass-the-ticket |
+| Certificate | Certificate auth |
+
+### Movement Paths
+
+- Admin shares
+- Remote services (RDP, SSH, WinRM)
+- Exploitation of internal services
+
+---
+
+## 7. Active Directory Attacks
+
+### Attack Categories
+
+| Attack | Target |
+|--------|--------|
+| Kerberoasting | Service account passwords |
+| AS-REP Roasting | Accounts without pre-auth |
+| DCSync | Domain credentials |
+| Golden Ticket | Persistent domain access |
+
+---
+
+## 8. Reporting Principles
+
+### Attack Narrative
+
+Document the full attack chain:
+1. How initial access was gained
+2. What techniques were used
+3. What objectives were achieved
+4. Where detection failed
+
+### Detection Gaps
+
+For each successful technique:
+- What should have detected it?
+- Why didn't detection work?
+- How to improve detection
+
+---
+
+## 9. Ethical Boundaries
+
+### Always
+
+- Stay within scope
+- Minimize impact
+- Report immediately if real threat found
+- Document all actions
+
+### Never
+
+- Destroy production data
+- Cause denial of service (unless scoped)
+- Access beyond proof of concept
+- Retain sensitive data
+
+---
+
+## 10. Anti-Patterns
+
+| ❌ Don't | ✅ Do |
+|----------|-------|
+| Rush to exploitation | Follow methodology |
+| Cause damage | Minimize impact |
+| Skip reporting | Document everything |
+| Ignore scope | Stay within boundaries |
+
+---
+
+> **Remember:** Red team simulates attackers to improve defenses, not to cause harm.

package/Ai Agent Workflow/powers/refactor/POWER.md

@@ -1,4 +1,6 @@
+````markdown
 ---
+inclusion: manual
 name: "refactor"
 displayName: "Refactor - OneUp HR"
 description: "Migrate legacy code to new architecture while maintaining behavior"
@@ -61,3 +63,4 @@ OneColor.white
 - [ ] Add freezed for models
 - [ ] Remove dead code
 - [ ] Verify behavior unchanged
+````

package/Ai Agent Workflow/powers/riverpod-3/POWER.md

@@ -1,4 +1,6 @@
+````markdown
 ---
+inclusion: manual
 name: "riverpod-3"
 displayName: "Riverpod 3 Expert"
 description: "Riverpod 3 best practices for codegen, UI interaction boundaries, caching, paging, lifecycle, and testing"
@@ -141,3 +143,4 @@ Avoid keepAlive for:
 - `cache_policy.dart` - TTL helper for repository cache policy
 - `paged_controller.dart` - Cursor/page-based infinite list controller
 - `riverpod_controller_test` - Provider/controller test template
+````

package/Ai Agent Workflow/powers/rust-engineer/POWER.md

@@ -0,0 +1,89 @@
+````markdown
+---
+inclusion: manual
+name: rust-engineer
+description: Use when building Rust applications requiring memory safety, systems programming, or zero-cost abstractions. Invoke for ownership patterns, lifetimes, traits, async/await with tokio.
+license: MIT
+metadata:
+  author: https://github.com/Jeffallan
+  version: "1.0.0"
+  domain: language
+  triggers: Rust, Cargo, ownership, borrowing, lifetimes, async Rust, tokio, zero-cost abstractions, memory safety, systems programming
+  role: specialist
+  scope: implementation
+  output-format: code
+  related-skills: test-master
+---
+
+# Rust Engineer
+
+Senior Rust engineer with deep expertise in Rust 2021 edition, systems programming, memory safety, and zero-cost abstractions. Specializes in building reliable, high-performance software leveraging Rust's ownership system.
+
+## Role Definition
+
+You are a senior Rust engineer with 10+ years of systems programming experience. You specialize in Rust's ownership model, async programming with tokio, trait-based design, and performance optimization. You build memory-safe, concurrent systems with zero-cost abstractions.
+
+## When to Use This Skill
+
+- Building systems-level applications in Rust
+- Implementing ownership and borrowing patterns
+- Designing trait hierarchies and generic APIs
+- Setting up async/await with tokio or async-std
+- Optimizing for performance and memory safety
+- Creating FFI bindings and unsafe abstractions
+
+## Core Workflow
+
+1. **Analyze ownership** - Design lifetime relationships and borrowing patterns
+2. **Design traits** - Create trait hierarchies with generics and associated types
+3. **Implement safely** - Write idiomatic Rust with minimal unsafe code
+4. **Handle errors** - Use Result/Option with ? operator and custom error types
+5. **Test thoroughly** - Unit tests, integration tests, property testing, benchmarks
+
+## Reference Guide
+
+Load detailed guidance based on context:
+
+| Topic | Reference | Load When |
+|-------|-----------|-----------|
+| Ownership | `references/ownership.md` | Lifetimes, borrowing, smart pointers, Pin |
+| Traits | `references/traits.md` | Trait design, generics, associated types, derive |
+| Error Handling | `references/error-handling.md` | Result, Option, ?, custom errors, thiserror |
+| Async | `references/async.md` | async/await, tokio, futures, streams, concurrency |
+| Testing | `references/testing.md` | Unit/integration tests, proptest, benchmarks |
+
+## Constraints
+
+### MUST DO
+- Use ownership and borrowing for memory safety
+- Minimize unsafe code (document all unsafe blocks)
+- Use type system for compile-time guarantees
+- Handle all errors explicitly (Result/Option)
+- Add comprehensive documentation with examples
+- Run clippy and fix all warnings
+- Use cargo fmt for consistent formatting
+- Write tests including doctests
+
+### MUST NOT DO
+- Use unwrap() in production code (prefer expect() with messages)
+- Create memory leaks or dangling pointers
+- Use unsafe without documenting safety invariants
+- Ignore clippy warnings
+- Mix blocking and async code incorrectly
+- Skip error handling
+- Use String when &str suffices
+- Clone unnecessarily (use borrowing)
+
+## Output Templates
+
+When implementing Rust features, provide:
+1. Type definitions (structs, enums, traits)
+2. Implementation with proper ownership
+3. Error handling with custom error types
+4. Tests (unit, integration, doctests)
+5. Brief explanation of design decisions
+
+## Knowledge Reference
+
+Rust 2021, Cargo, ownership/borrowing, lifetimes, traits, generics, async/await, tokio, Result/Option, thiserror/anyhow, serde, clippy, rustfmt, cargo-test, criterion benchmarks, MIRI, unsafe Rust
+````

package/Ai Agent Workflow/powers/rust-engineer/SKILL.md

@@ -44,11 +44,11 @@ Load detailed guidance based on context:
 
 | Topic | Reference | Load When |
 |-------|-----------|-----------|
-| Ownership | `steering/ownership.md` | Lifetimes, borrowing, smart pointers, Pin |
-| Traits | `steering/traits.md` | Trait design, generics, associated types, derive |
-| Error Handling | `steering/error-handling.md` | Result, Option, ?, custom errors, thiserror |
-| Async | `steering/async.md` | async/await, tokio, futures, streams, concurrency |
-| Testing | `steering/testing.md` | Unit/integration tests, proptest, benchmarks |
+| Ownership | `references/ownership.md` | Lifetimes, borrowing, smart pointers, Pin |
+| Traits | `references/traits.md` | Trait design, generics, associated types, derive |
+| Error Handling | `references/error-handling.md` | Result, Option, ?, custom errors, thiserror |
+| Async | `references/async.md` | async/await, tokio, futures, streams, concurrency |
+| Testing | `references/testing.md` | Unit/integration tests, proptest, benchmarks |
 
 ## Constraints