@cubis/foundry 0.3.11 → 0.3.13

package/Ai Agent Workflow/powers/ui-ux-pro-max/POWER.md

@@ -0,0 +1,389 @@
+````markdown
+---
+inclusion: manual
+name: ui-ux-pro-max
+description: "UI/UX design intelligence. 50 styles, 21 palettes, 50 font pairings, 20 charts, 9 stacks (React, Next.js, Vue, Svelte, SwiftUI, React Native, Flutter, Tailwind, shadcn/ui). Actions: plan, build, create, design, implement, review, fix, improve, optimize, enhance, refactor, check UI/UX code. Projects: website, landing page, dashboard, admin panel, e-commerce, SaaS, portfolio, blog, mobile app, .html, .tsx, .vue, .svelte. Elements: button, modal, navbar, sidebar, card, table, form, chart. Styles: glassmorphism, claymorphism, minimalism, brutalism, neumorphism, bento grid, dark mode, responsive, skeuomorphism, flat design. Topics: color palette, accessibility, animation, layout, typography, font pairing, spacing, hover, shadow, gradient. Integrations: shadcn/ui MCP for component search and examples."
+---
+
+# UI/UX Pro Max - Design Intelligence
+
+Comprehensive design guide for web and mobile applications. Contains 50+ styles, 97 color palettes, 57 font pairings, 99 UX guidelines, and 25 chart types across 9 technology stacks. Searchable database with priority-based recommendations.
+
+## When to Apply
+
+Reference these guidelines when:
+- Designing new UI components or pages
+- Choosing color palettes and typography
+- Reviewing code for UX issues
+- Building landing pages or dashboards
+- Implementing accessibility requirements
+
+## Rule Categories by Priority
+
+| Priority | Category | Impact | Domain |
+|----------|----------|--------|--------|
+| 1 | Accessibility | CRITICAL | `ux` |
+| 2 | Touch & Interaction | CRITICAL | `ux` |
+| 3 | Performance | HIGH | `ux` |
+| 4 | Layout & Responsive | HIGH | `ux` |
+| 5 | Typography & Color | MEDIUM | `typography`, `color` |
+| 6 | Animation | MEDIUM | `ux` |
+| 7 | Style Selection | MEDIUM | `style`, `product` |
+| 8 | Charts & Data | LOW | `chart` |
+
+## Quick Reference
+
+### 1. Accessibility (CRITICAL)
+
+- `color-contrast` - Minimum 4.5:1 ratio for normal text
+- `focus-states` - Visible focus rings on interactive elements
+- `alt-text` - Descriptive alt text for meaningful images
+- `aria-labels` - aria-label for icon-only buttons
+- `keyboard-nav` - Tab order matches visual order
+- `form-labels` - Use label with for attribute
+
+### 2. Touch & Interaction (CRITICAL)
+
+- `touch-target-size` - Minimum 44x44px touch targets
+- `hover-vs-tap` - Use click/tap for primary interactions
+- `loading-buttons` - Disable button during async operations
+- `error-feedback` - Clear error messages near problem
+- `cursor-pointer` - Add cursor-pointer to clickable elements
+
+### 3. Performance (HIGH)
+
+- `image-optimization` - Use WebP, srcset, lazy loading
+- `reduced-motion` - Check prefers-reduced-motion
+- `content-jumping` - Reserve space for async content
+
+### 4. Layout & Responsive (HIGH)
+
+- `viewport-meta` - width=device-width initial-scale=1
+- `readable-font-size` - Minimum 16px body text on mobile
+- `horizontal-scroll` - Ensure content fits viewport width
+- `z-index-management` - Define z-index scale (10, 20, 30, 50)
+
+### 5. Typography & Color (MEDIUM)
+
+- `line-height` - Use 1.5-1.75 for body text
+- `line-length` - Limit to 65-75 characters per line
+- `font-pairing` - Match heading/body font personalities
+
+### 6. Animation (MEDIUM)
+
+- `duration-timing` - Use 150-300ms for micro-interactions
+- `transform-performance` - Use transform/opacity, not width/height
+- `loading-states` - Skeleton screens or spinners
+
+### 7. Style Selection (MEDIUM)
+
+- `style-match` - Match style to product type
+- `consistency` - Use same style across all pages
+- `no-emoji-icons` - Use SVG icons, not emojis
+
+### 8. Charts & Data (LOW)
+
+- `chart-type` - Match chart type to data type
+- `color-guidance` - Use accessible color palettes
+- `data-table` - Provide table alternative for accessibility
+
+## How to Use
+
+Search specific domains using the CLI tool below.
+
+---
+
+## Prerequisites
+
+Check if Python is installed:
+
+```bash
+python3 --version || python --version
+```
+
+If Python is not installed, install it based on user's OS:
+
+**macOS:**
+```bash
+brew install python3
+```
+
+**Ubuntu/Debian:**
+```bash
+sudo apt update && sudo apt install python3
+```
+
+**Windows:**
+```powershell
+winget install Python.Python.3.12
+```
+
+---
+
+## How to Use This Skill
+
+When user requests UI/UX work (design, build, create, implement, review, fix, improve), follow this workflow:
+
+### Step 1: Analyze User Requirements
+
+Extract key information from user request:
+- **Product type**: SaaS, e-commerce, portfolio, dashboard, landing page, etc.
+- **Style keywords**: minimal, playful, professional, elegant, dark mode, etc.
+- **Industry**: healthcare, fintech, gaming, education, etc.
+- **Stack**: React, Vue, Next.js, or default to `html-tailwind`
+
+### Step 2: Generate Design System (REQUIRED)
+
+**Always start with `--design-system`** to get comprehensive recommendations with reasoning:
+
+```bash
+python3 skills/ui-ux-pro-max/scripts/search.py "<product_type> <industry> <keywords>" --design-system [-p "Project Name"]
+```
+
+This command:
+1. Searches 5 domains in parallel (product, style, color, landing, typography)
+2. Applies reasoning rules from `ui-reasoning.csv` to select best matches
+3. Returns complete design system: pattern, style, colors, typography, effects
+4. Includes anti-patterns to avoid
+
+**Example:**
+```bash
+python3 skills/ui-ux-pro-max/scripts/search.py "beauty spa wellness service" --design-system -p "Serenity Spa"
+```
+
+### Step 2b: Persist Design System (Master + Overrides Pattern)
+
+To save the design system for **hierarchical retrieval across sessions**, add `--persist`:
+
+```bash
+python3 skills/ui-ux-pro-max/scripts/search.py "<query>" --design-system --persist -p "Project Name"
+```
+
+This creates:
+- `design-system/MASTER.md` — Global Source of Truth with all design rules
+- `design-system/pages/` — Folder for page-specific overrides
+
+**With page-specific override:**
+```bash
+python3 skills/ui-ux-pro-max/scripts/search.py "<query>" --design-system --persist -p "Project Name" --page "dashboard"
+```
+
+This also creates:
+- `design-system/pages/dashboard.md` — Page-specific deviations from Master
+
+**How hierarchical retrieval works:**
+1. When building a specific page (e.g., "Checkout"), first check `design-system/pages/checkout.md`
+2. If the page file exists, its rules **override** the Master file
+3. If not, use `design-system/MASTER.md` exclusively
+
+**Context-aware retrieval prompt:**
+```
+I am building the [Page Name] page. Please read design-system/MASTER.md.
+Also check if design-system/pages/[page-name].md exists.
+If the page file exists, prioritize its rules.
+If not, use the Master rules exclusively.
+Now, generate the code...
+```
+
+### Step 3: Supplement with Detailed Searches (as needed)
+
+After getting the design system, use domain searches to get additional details:
+
+```bash
+python3 skills/ui-ux-pro-max/scripts/search.py "<keyword>" --domain <domain> [-n <max_results>]
+```
+
+**When to use detailed searches:**
+
+| Need | Domain | Example |
+|------|--------|---------|
+| More style options | `style` | `--domain style "glassmorphism dark"` |
+| Chart recommendations | `chart` | `--domain chart "real-time dashboard"` |
+| UX best practices | `ux` | `--domain ux "animation accessibility"` |
+| Alternative fonts | `typography` | `--domain typography "elegant luxury"` |
+| Landing structure | `landing` | `--domain landing "hero social-proof"` |
+
+### Step 4: Stack Guidelines (Default: html-tailwind)
+
+Get implementation-specific best practices. If user doesn't specify a stack, **default to `html-tailwind`**.
+
+```bash
+python3 skills/ui-ux-pro-max/scripts/search.py "<keyword>" --stack html-tailwind
+```
+
+Available stacks: `html-tailwind`, `react`, `nextjs`, `vue`, `svelte`, `swiftui`, `react-native`, `flutter`, `shadcn`, `jetpack-compose`
+
+---
+
+## Search Reference
+
+### Available Domains
+
+| Domain | Use For | Example Keywords |
+|--------|---------|------------------|
+| `product` | Product type recommendations | SaaS, e-commerce, portfolio, healthcare, beauty, service |
+| `style` | UI styles, colors, effects | glassmorphism, minimalism, dark mode, brutalism |
+| `typography` | Font pairings, Google Fonts | elegant, playful, professional, modern |
+| `color` | Color palettes by product type | saas, ecommerce, healthcare, beauty, fintech, service |
+| `landing` | Page structure, CTA strategies | hero, hero-centric, testimonial, pricing, social-proof |
+| `chart` | Chart types, library recommendations | trend, comparison, timeline, funnel, pie |
+| `ux` | Best practices, anti-patterns | animation, accessibility, z-index, loading |
+| `react` | React/Next.js performance | waterfall, bundle, suspense, memo, rerender, cache |
+| `web` | Web interface guidelines | aria, focus, keyboard, semantic, virtualize |
+| `prompt` | AI prompts, CSS keywords | (style name) |
+
+### Available Stacks
+
+| Stack | Focus |
+|-------|-------|
+| `html-tailwind` | Tailwind utilities, responsive, a11y (DEFAULT) |
+| `react` | State, hooks, performance, patterns |
+| `nextjs` | SSR, routing, images, API routes |
+| `vue` | Composition API, Pinia, Vue Router |
+| `svelte` | Runes, stores, SvelteKit |
+| `swiftui` | Views, State, Navigation, Animation |
+| `react-native` | Components, Navigation, Lists |
+| `flutter` | Widgets, State, Layout, Theming |
+| `shadcn` | shadcn/ui components, theming, forms, patterns |
+| `jetpack-compose` | Composables, Modifiers, State Hoisting, Recomposition |
+
+---
+
+## Example Workflow
+
+**User request:** "Làm landing page cho dịch vụ chăm sóc da chuyên nghiệp"
+
+### Step 1: Analyze Requirements
+- Product type: Beauty/Spa service
+- Style keywords: elegant, professional, soft
+- Industry: Beauty/Wellness
+- Stack: html-tailwind (default)
+
+### Step 2: Generate Design System (REQUIRED)
+
+```bash
+python3 skills/ui-ux-pro-max/scripts/search.py "beauty spa wellness service elegant" --design-system -p "Serenity Spa"
+```
+
+**Output:** Complete design system with pattern, style, colors, typography, effects, and anti-patterns.
+
+### Step 3: Supplement with Detailed Searches (as needed)
+
+```bash
+# Get UX guidelines for animation and accessibility
+python3 skills/ui-ux-pro-max/scripts/search.py "animation accessibility" --domain ux
+
+# Get alternative typography options if needed
+python3 skills/ui-ux-pro-max/scripts/search.py "elegant luxury serif" --domain typography
+```
+
+### Step 4: Stack Guidelines
+
+```bash
+python3 skills/ui-ux-pro-max/scripts/search.py "layout responsive form" --stack html-tailwind
+```
+
+**Then:** Synthesize design system + detailed searches and implement the design.
+
+---
+
+## Output Formats
+
+The `--design-system` flag supports two output formats:
+
+```bash
+# ASCII box (default) - best for terminal display
+python3 skills/ui-ux-pro-max/scripts/search.py "fintech crypto" --design-system
+
+# Markdown - best for documentation
+python3 skills/ui-ux-pro-max/scripts/search.py "fintech crypto" --design-system -f markdown
+```
+
+---
+
+## Tips for Better Results
+
+1. **Be specific with keywords** - "healthcare SaaS dashboard" > "app"
+2. **Search multiple times** - Different keywords reveal different insights
+3. **Combine domains** - Style + Typography + Color = Complete design system
+4. **Always check UX** - Search "animation", "z-index", "accessibility" for common issues
+5. **Use stack flag** - Get implementation-specific best practices
+6. **Iterate** - If first search doesn't match, try different keywords
+
+---
+
+## Common Rules for Professional UI
+
+These are frequently overlooked issues that make UI look unprofessional:
+
+### Icons & Visual Elements
+
+| Rule | Do | Don't |
+|------|----|----- |
+| **No emoji icons** | Use SVG icons (Heroicons, Lucide, Simple Icons) | Use emojis like 🎨 🚀 ⚙️ as UI icons |
+| **Stable hover states** | Use color/opacity transitions on hover | Use scale transforms that shift layout |
+| **Correct brand logos** | Research official SVG from Simple Icons | Guess or use incorrect logo paths |
+| **Consistent icon sizing** | Use fixed viewBox (24x24) with w-6 h-6 | Mix different icon sizes randomly |
+
+### Interaction & Cursor
+
+| Rule | Do | Don't |
+|------|----|----- |
+| **Cursor pointer** | Add `cursor-pointer` to all clickable/hoverable cards | Leave default cursor on interactive elements |
+| **Hover feedback** | Provide visual feedback (color, shadow, border) | No indication element is interactive |
+| **Smooth transitions** | Use `transition-colors duration-200` | Instant state changes or too slow (>500ms) |
+
+### Light/Dark Mode Contrast
+
+| Rule | Do | Don't |
+|------|----|----- |
+| **Glass card light mode** | Use `bg-white/80` or higher opacity | Use `bg-white/10` (too transparent) |
+| **Text contrast light** | Use `#0F172A` (slate-900) for text | Use `#94A3B8` (slate-400) for body text |
+| **Muted text light** | Use `#475569` (slate-600) minimum | Use gray-400 or lighter |
+| **Border visibility** | Use `border-gray-200` in light mode | Use `border-white/10` (invisible) |
+
+### Layout & Spacing
+
+| Rule | Do | Don't |
+|------|----|----- |
+| **Floating navbar** | Add `top-4 left-4 right-4` spacing | Stick navbar to `top-0 left-0 right-0` |
+| **Content padding** | Account for fixed navbar height | Let content hide behind fixed elements |
+| **Consistent max-width** | Use same `max-w-6xl` or `max-w-7xl` | Mix different container widths |
+
+---
+
+## Pre-Delivery Checklist
+
+Before delivering UI code, verify these items:
+
+### Visual Quality
+- [ ] No emojis used as icons (use SVG instead)
+- [ ] All icons from consistent icon set (Heroicons/Lucide)
+- [ ] Brand logos are correct (verified from Simple Icons)
+- [ ] Hover states don't cause layout shift
+- [ ] Use theme colors directly (bg-primary) not var() wrapper
+
+### Interaction
+- [ ] All clickable elements have `cursor-pointer`
+- [ ] Hover states provide clear visual feedback
+- [ ] Transitions are smooth (150-300ms)
+- [ ] Focus states visible for keyboard navigation
+
+### Light/Dark Mode
+- [ ] Light mode text has sufficient contrast (4.5:1 minimum)
+- [ ] Glass/transparent elements visible in light mode
+- [ ] Borders visible in both modes
+- [ ] Test both modes before delivery
+
+### Layout
+- [ ] Floating elements have proper spacing from edges
+- [ ] No content hidden behind fixed navbars
+- [ ] Responsive at 375px, 768px, 1024px, 1440px
+- [ ] No horizontal scroll on mobile
+
+### Accessibility
+- [ ] All images have alt text
+- [ ] Form inputs have labels
+- [ ] Color is not the only indicator
+- [ ] `prefers-reduced-motion` respected
+````

package/Ai Agent Workflow/powers/ux-ui-consistency/POWER.md

@@ -1,4 +1,6 @@
+````markdown
 ---
+inclusion: manual
 name: "ux-ui-consistency"
 displayName: "UX/UI Consistency"
 description: "Ensure consistent UX patterns: design system component usage, screen states, error handling, and loading patterns"
@@ -121,4 +123,4 @@ try {
 ## Templates
 
 - `screen_states_widget` - Complete screen state handling template
-
+````

package/Ai Agent Workflow/powers/variant-analysis/POWER.md

@@ -0,0 +1,145 @@
+````markdown
+---
+inclusion: manual
+name: variant-analysis
+description: Find similar vulnerabilities and bugs across codebases using pattern-based analysis. Use when hunting bug variants, building CodeQL/Semgrep queries, analyzing security vulnerabilities, or performing systematic code audits after finding an initial issue.
+---
+
+# Variant Analysis
+
+You are a variant analysis expert. Your role is to help find similar vulnerabilities and bugs across a codebase after identifying an initial pattern.
+
+## When to Use
+
+Use this skill when:
+- A vulnerability has been found and you need to search for similar instances
+- Building or refining CodeQL/Semgrep queries for security patterns
+- Performing systematic code audits after an initial issue discovery
+- Hunting for bug variants across a codebase
+- Analyzing how a single root cause manifests in different code paths
+
+## When NOT to Use
+
+Do NOT use this skill for:
+- Initial vulnerability discovery (use audit-context-building or domain-specific audits instead)
+- General code review without a known pattern to search for
+- Writing fix recommendations (use issue-writer instead)
+- Understanding unfamiliar code (use audit-context-building for deep comprehension first)
+
+## The Five-Step Process
+
+### Step 1: Understand the Original Issue
+
+Before searching, deeply understand the known bug:
+- **What is the root cause?** Not the symptom, but WHY it's vulnerable
+- **What conditions are required?** Control flow, data flow, state
+- **What makes it exploitable?** User control, missing validation, etc.
+
+### Step 2: Create an Exact Match
+
+Start with a pattern that matches ONLY the known instance:
+```bash
+rg -n "exact_vulnerable_code_here"
+```
+Verify: Does it match exactly ONE location (the original)?
+
+### Step 3: Identify Abstraction Points
+
+| Element | Keep Specific | Can Abstract |
+|---------|---------------|--------------|
+| Function name | If unique to bug | If pattern applies to family |
+| Variable names | Never | Always use metavariables |
+| Literal values | If value matters | If any value triggers bug |
+| Arguments | If position matters | Use `...` wildcards |
+
+### Step 4: Iteratively Generalize
+
+**Change ONE element at a time:**
+1. Run the pattern
+2. Review ALL new matches
+3. Classify: true positive or false positive?
+4. If FP rate acceptable, generalize next element
+5. If FP rate too high, revert and try different abstraction
+
+**Stop when false positive rate exceeds ~50%**
+
+### Step 5: Analyze and Triage Results
+
+For each match, document:
+- **Location**: File, line, function
+- **Confidence**: High/Medium/Low
+- **Exploitability**: Reachable? Controllable inputs?
+- **Priority**: Based on impact and exploitability
+
+For deeper strategic guidance, see [METHODOLOGY.md](METHODOLOGY.md).
+
+## Tool Selection
+
+| Scenario | Tool | Why |
+|----------|------|-----|
+| Quick surface search | ripgrep | Fast, zero setup |
+| Simple pattern matching | Semgrep | Easy syntax, no build needed |
+| Data flow tracking | Semgrep taint / CodeQL | Follows values across functions |
+| Cross-function analysis | CodeQL | Best interprocedural analysis |
+| Non-building code | Semgrep | Works on incomplete code |
+
+## Key Principles
+
+1. **Root cause first**: Understand WHY before searching for WHERE
+2. **Start specific**: First pattern should match exactly the known bug
+3. **One change at a time**: Generalize incrementally, verify after each change
+4. **Know when to stop**: 50%+ FP rate means you've gone too generic
+5. **Search everywhere**: Always search the ENTIRE codebase, not just the module where the bug was found
+6. **Expand vulnerability classes**: One root cause often has multiple manifestations
+
+## Critical Pitfalls to Avoid
+
+These common mistakes cause analysts to miss real vulnerabilities:
+
+### 1. Narrow Search Scope
+
+Searching only the module where the original bug was found misses variants in other locations.
+
+**Example:** Bug found in `api/handlers/` → only searching that directory → missing variant in `utils/auth.py`
+
+**Mitigation:** Always run searches against the entire codebase root directory.
+
+### 2. Pattern Too Specific
+
+Using only the exact attribute/function from the original bug misses variants using related constructs.
+
+**Example:** Bug uses `isAuthenticated` check → only searching for that exact term → missing bugs using related properties like `isActive`, `isAdmin`, `isVerified`
+
+**Mitigation:** Enumerate ALL semantically related attributes/functions for the bug class.
+
+### 3. Single Vulnerability Class
+
+Focusing on only one manifestation of the root cause misses other ways the same logic error appears.
+
+**Example:** Original bug is "return allow when condition is false" → only searching that pattern → missing:
+- Null equality bypasses (`null == null` evaluates to true)
+- Documentation/code mismatches (function does opposite of what docs claim)
+- Inverted conditional logic (wrong branch taken)
+
+**Mitigation:** List all possible manifestations of the root cause before searching.
+
+### 4. Missing Edge Cases
+
+Testing patterns only with "normal" scenarios misses vulnerabilities triggered by edge cases.
+
+**Example:** Testing auth checks only with valid users → missing bypass when `userId = null` matches `resourceOwnerId = null`
+
+**Mitigation:** Test with: unauthenticated users, null/undefined values, empty collections, and boundary conditions.
+
+## Resources
+
+Ready-to-use templates in `resources/`:
+
+**CodeQL** (`resources/codeql/`):
+- `python.ql`, `javascript.ql`, `java.ql`, `go.ql`, `cpp.ql`
+
+**Semgrep** (`resources/semgrep/`):
+- `python.yaml`, `javascript.yaml`, `java.yaml`, `go.yaml`, `cpp.yaml`
+
+**Report**: `resources/variant-report-template.md`
+````

package/Ai Agent Workflow/powers/vercel-ai-gateway/POWER.md

@@ -0,0 +1,82 @@
+````markdown
+---
+inclusion: manual
+name: vercel-ai-gateway
+description: "Complete Vercel AI Gateway integration: LLM traffic routing, authentication/BYOK, fallback chains, model-provider routing policies, usage observability, and OpenAI-compatible endpoints."
+license: MIT
+metadata:
+  author: cubis-foundry
+  version: "1.0.0"
+  domain: vercel
+  triggers: vercel, ai, gateway, llm, byok, fallback, model routing, openai compatible, token usage, ai observability
+  role: specialist
+  scope: implementation
+  output-format: checklist
+  related-skills: prompt-engineer, monitoring-expert, secure-code-guardian, vercel-observability
+  consolidates: vercel-ai-gateway-core, vercel-ai-gateway-auth-byok, vercel-ai-gateway-fallbacks, vercel-ai-gateway-model-routing, vercel-ai-gateway-observability, vercel-ai-gateway-openai-compatible
+---
+
+# Vercel AI Gateway
+
+## Purpose
+
+Route LLM traffic through Vercel AI Gateway with unified controls covering authentication, model-provider routing, resilient fallback chains, usage observability, and OpenAI-compatible endpoint compatibility.
+
+## When To Use
+
+- Routing AI/LLM requests through Vercel's managed gateway.
+- Configuring bring-your-own-key (BYOK) authentication for AI providers.
+- Implementing retries and fallback chains for resilient AI responses.
+- Designing model and provider routing policies for latency, quality, and cost.
+- Monitoring AI Gateway usage, latency, and spend.
+- Using OpenAI-compatible endpoints without provider lock-in.
+
+## Domain Areas
+
+### Core Routing
+
+- Define unified gateway endpoint and routing config.
+- Set per-model quality, latency, and cost objectives.
+
+### Authentication & BYOK
+
+- Configure provider API key management and BYOK controls.
+- Scope key access per project/environment.
+
+### Fallbacks & Resilience
+
+- Implement retry policies and fallback provider chains.
+- Define circuit-breaker thresholds.
+
+### Model Routing Policies
+
+- Route by latency, cost, capability, or custom weights.
+- Support multi-provider and multi-region strategies.
+
+### Observability
+
+- Instrument token usage, latency, and error rates per model.
+- Set spend thresholds and alerting.
+
+### OpenAI Compatibility
+
+- Use OpenAI-compatible request/response format.
+- Migrate between providers without application changes.
+
+## Operating Checklist
+
+1. Define model quality, latency, and cost objectives for each endpoint.
+2. Configure authentication and BYOK key scoping per environment.
+3. Implement routing, fallback, and retry policies explicitly.
+4. Instrument token usage, latency, and error classes for all calls.
+5. Validate OpenAI-compatible endpoint compatibility if needed.
+6. Run safety and regression checks before broad rollout.
+
+## Output Contract
+
+- Proposed routing and authentication architecture with tradeoffs
+- Required config, code, and environment changes
+- Fallback chain definition and circuit-breaker settings
+- Validation evidence (spend limits, latency targets, error budgets)
+- Residual risks and follow-up actions
+````