@cubis/foundry 0.3.11 → 0.3.13

package/Ai Agent Workflow/skills/vercel-ai-gateway/SKILL.md

@@ -0,0 +1,79 @@
+---
+name: vercel-ai-gateway
+description: "Complete Vercel AI Gateway integration: LLM traffic routing, authentication/BYOK, fallback chains, model-provider routing policies, usage observability, and OpenAI-compatible endpoints."
+license: MIT
+metadata:
+  author: cubis-foundry
+  version: "1.0.0"
+  domain: vercel
+  triggers: vercel, ai, gateway, llm, byok, fallback, model routing, openai compatible, token usage, ai observability
+  role: specialist
+  scope: implementation
+  output-format: checklist
+  related-skills: prompt-engineer, monitoring-expert, secure-code-guardian, vercel-observability
+  consolidates: vercel-ai-gateway-core, vercel-ai-gateway-auth-byok, vercel-ai-gateway-fallbacks, vercel-ai-gateway-model-routing, vercel-ai-gateway-observability, vercel-ai-gateway-openai-compatible
+---
+
+# Vercel AI Gateway
+
+## Purpose
+
+Route LLM traffic through Vercel AI Gateway with unified controls covering authentication, model-provider routing, resilient fallback chains, usage observability, and OpenAI-compatible endpoint compatibility.
+
+## When To Use
+
+- Routing AI/LLM requests through Vercel's managed gateway.
+- Configuring bring-your-own-key (BYOK) authentication for AI providers.
+- Implementing retries and fallback chains for resilient AI responses.
+- Designing model and provider routing policies for latency, quality, and cost.
+- Monitoring AI Gateway usage, latency, and spend.
+- Using OpenAI-compatible endpoints without provider lock-in.
+
+## Domain Areas
+
+### Core Routing
+
+- Define unified gateway endpoint and routing config.
+- Set per-model quality, latency, and cost objectives.
+
+### Authentication & BYOK
+
+- Configure provider API key management and BYOK controls.
+- Scope key access per project/environment.
+
+### Fallbacks & Resilience
+
+- Implement retry policies and fallback provider chains.
+- Define circuit-breaker thresholds.
+
+### Model Routing Policies
+
+- Route by latency, cost, capability, or custom weights.
+- Support multi-provider and multi-region strategies.
+
+### Observability
+
+- Instrument token usage, latency, and error rates per model.
+- Set spend thresholds and alerting.
+
+### OpenAI Compatibility
+
+- Use OpenAI-compatible request/response format.
+- Migrate between providers without application changes.
+
+## Operating Checklist
+
+1. Define model quality, latency, and cost objectives for each endpoint.
+2. Configure authentication and BYOK key scoping per environment.
+3. Implement routing, fallback, and retry policies explicitly.
+4. Instrument token usage, latency, and error classes for all calls.
+5. Validate OpenAI-compatible endpoint compatibility if needed.
+6. Run safety and regression checks before broad rollout.
+
+## Output Contract
+
+- Proposed routing and authentication architecture with tradeoffs
+- Required config, code, and environment changes
+- Fallback chain definition and circuit-breaker settings
+- Validation evidence (spend limits, latency targets, error budgets)
+- Residual risks and follow-up actions

package/Ai Agent Workflow/skills/vercel-ai-sdk/SKILL.md

@@ -0,0 +1,59 @@
+---
+name: vercel-ai-sdk
+description: "Vercel AI SDK for building AI-powered applications: core providers/streaming patterns and React/Svelte UI hooks for chat, completion, and generative UX."
+license: MIT
+metadata:
+  author: cubis-foundry
+  version: "1.0.0"
+  domain: vercel
+  triggers: vercel, ai sdk, useChat, useCompletion, streamText, generateText, ai ui, streaming, generative ui
+  role: specialist
+  scope: implementation
+  output-format: checklist
+  related-skills: react-expert, nextjs-developer, prompt-engineer, vercel-ai-gateway
+  consolidates: vercel-ai-sdk-core, vercel-ai-sdk-ui
+---
+
+# Vercel AI SDK
+
+## Purpose
+
+Build AI-powered applications with Vercel AI SDK covering core provider integration, streaming primitives, and framework UI hooks for chat, completion, and generative interfaces.
+
+## When To Use
+
+- Integrating LLM providers (OpenAI, Anthropic, Google, etc.) via unified SDK.
+- Streaming text, objects, or tool calls from the server to the client.
+- Building chat or completion UIs with `useChat` / `useCompletion` hooks.
+- Implementing generative UI and multi-step agent flows.
+
+## Domain Areas
+
+### Core (Provider & Streaming)
+
+- Configure providers with `createOpenAI`, `createAnthropic`, etc.
+- Use `streamText`, `generateText`, `streamObject`, `generateObject`.
+- Handle tool calls, multi-step flows, and error recovery.
+
+### UI Hooks (React / Svelte / Vue)
+
+- `useChat`: managed chat history, streaming, form submission.
+- `useCompletion`: single-prompt streaming completions.
+- `useAssistant`: OpenAI Assistants API integration.
+- Attach metadata, handle events, and control abort signals.
+
+## Operating Checklist
+
+1. Select and configure the appropriate provider.
+2. Choose streaming vs. non-streaming based on UX requirements.
+3. Implement error handling and loading states in UI hooks.
+4. Validate type safety of generated objects with schema validation.
+5. Test streaming under latency and partial-response conditions.
+
+## Output Contract
+
+- Provider configuration and env var requirements
+- Stream handler and UI hook implementation
+- Tool call schemas and multi-step flow definitions
+- Error and abort handling patterns
+- Validation evidence and rollback notes

package/Ai Agent Workflow/skills/vercel-caching/SKILL.md

@@ -0,0 +1,83 @@
+---
+name: vercel-caching
+description: "Vercel caching strategies: CDN cache, cache-control headers, runtime cache, ISR, Next.js Data Cache, request collapsing, remote caching (Turborepo), and CDN purging."
+license: MIT
+metadata:
+  author: cubis-foundry
+  version: "1.0.0"
+  domain: vercel
+  triggers: vercel, cdn cache, caching, isr, incremental static regeneration, data cache, request collapsing, remote caching, turborepo cache, cache purge, stale-while-revalidate, cache-control
+  role: specialist
+  scope: implementation
+  output-format: checklist
+  related-skills: nextjs-developer, vercel-functions, vercel-routing, web-perf
+  consolidates: vercel-cdn-cache, vercel-cdn-purging, vercel-cache-control-headers, vercel-runtime-cache, vercel-isr, vercel-data-cache-nextjs, vercel-request-collapsing, vercel-remote-caching
+---
+
+# Vercel Caching
+
+## Purpose
+
+Implement and tune Vercel's full caching stack to maximize performance and reduce origin load, including CDN edge caching, ISR, Next.js Data Cache, request collapsing, and Turborepo remote caching.
+
+## When To Use
+
+- Setting cache-control headers and CDN TTL for static/dynamic assets.
+- Configuring ISR revalidation periods and on-demand revalidation.
+- Using Next.js Data Cache (`fetch` caching, `unstable_cache`).
+- Purging CDN cache after deploys or content updates.
+- Enabling request collapsing to prevent cache stampedes.
+- Setting up Turborepo remote caching for faster CI.
+
+## Domain Areas
+
+### CDN Cache & Cache-Control
+
+- Set `Cache-Control: s-maxage`, `stale-while-revalidate` headers.
+- Configure edge cache TTL per route in `vercel.json`.
+- Understand Vercel's cache key construction.
+
+### CDN Purging
+
+- On-demand cache invalidation via Vercel dashboard or REST API.
+- Tag-based purge strategies for content updates.
+
+### ISR (Incremental Static Regeneration)
+
+- Configure `revalidate` in Next.js page/route handlers.
+- On-demand revalidation with `revalidatePath` / `revalidateTag`.
+- ISR fallback behavior and error handling.
+
+### Next.js Data Cache
+
+- `fetch` cache with `cache`, `next.revalidate`, `next.tags` options.
+- `unstable_cache` for non-fetch data sources.
+- Cache invalidation with `revalidateTag`.
+
+### Request Collapsing
+
+- Enable to coalesce concurrent cache-miss requests.
+- Validate behavior under load with simulated stampedes.
+
+### Remote Caching (Turborepo)
+
+- Configure Vercel Remote Cache for Turborepo.
+- Authenticate with `TURBO_TOKEN` and `TURBO_TEAM`.
+- Monitor cache hit rates and artifact sizes.
+
+## Operating Checklist
+
+1. Audit current cache-control headers and TTL values.
+2. Define caching strategy per route type (static, dynamic, API).
+3. Implement ISR or Data Cache with explicit revalidation tags.
+4. Set up cache purge automation for content updates.
+5. Enable and validate request collapsing in staging under load.
+6. Configure Turborepo remote caching and verify hit rates in CI.
+
+## Output Contract
+
+- Cache-control header strategy per route type
+- ISR/Data Cache configuration with revalidation tags
+- CDN purge automation plan and trigger events
+- Turborepo remote cache setup instructions
+- Performance validation (cache hit ratios, TTFB targets)

package/Ai Agent Workflow/skills/vercel-cli/SKILL.md

@@ -0,0 +1,85 @@
+---
+name: vercel-cli
+description: "Vercel CLI mastery: core commands, flags, MCP integration, microfrontend management, and project/domain/environment variable operations from the command line."
+license: MIT
+metadata:
+  author: cubis-foundry
+  version: "1.0.0"
+  domain: vercel
+  triggers: vercel cli, vercel command, npx vercel, vercel dev, vercel deploy, vercel env, vercel domains cli, vercel pull, vercel link, vercel mcp, vercel microfrontends cli
+  role: specialist
+  scope: implementation
+  output-format: checklist
+  related-skills: devops-engineer, wrangler, vercel-deployments, vercel-domains
+  consolidates: vercel-cli-core, vercel-cli-flags, vercel-cli-mcp, vercel-cli-microfrontends, vercel-cli-project-domain-env
+---
+
+# Vercel CLI
+
+## Purpose
+
+Use the Vercel CLI for local development, deployments, environment management, domain operations, microfrontend orchestration, and MCP-based automation workflows.
+
+## When To Use
+
+- Running `vercel dev` for local development with edge function support.
+- Deploying with `vercel --prod` or `vercel deploy` from CI/CD.
+- Managing environment variables with `vercel env add/pull/rm`.
+- Managing domains and DNS with `vercel domains`.
+- Linking, inspecting, and managing project config with `vercel link`.
+- Using the Vercel MCP for agent-based CLI automation.
+- Managing microfrontend apps from the CLI.
+
+## Domain Areas
+
+### Core Commands
+
+| Command                    | Purpose                                    |
+| -------------------------- | ------------------------------------------ |
+| `vercel` / `vercel deploy` | Deploy current directory                   |
+| `vercel --prod`            | Deploy to production                       |
+| `vercel dev`               | Local dev server with edge emulation       |
+| `vercel build`             | Build locally (mirrors Vercel cloud build) |
+| `vercel inspect <url>`     | Inspect deployment details                 |
+| `vercel rollback`          | Instant rollback to previous deployment    |
+| `vercel link`              | Link local directory to Vercel project     |
+| `vercel pull`              | Pull project settings and env vars locally |
+
+### Flags
+
+- `--env`, `--build-env`, `--token`, `--scope`, `--yes`, `--no-wait`.
+- `--regions` for targeted regional deployment.
+- `--archive=tgz` for artifact-based deployments.
+
+### Project / Domain / Env
+
+- `vercel env add/pull/rm` — manage environment variables.
+- `vercel domains add/rm/inspect` — domain management.
+- `vercel alias set <url> <alias>` — assign deployment aliases.
+
+### MCP Integration
+
+- Use Vercel MCP server for agent-driven CLI automation.
+- Query deployment state, logs, and project config programmatically.
+
+### Microfrontends
+
+- `vercel microfrontends` commands for app group management.
+- Register and route microfrontend applications from CLI.
+
+## Operating Checklist
+
+1. Authenticate with `vercel login` and verify scope with `vercel whoami`.
+2. Link project with `vercel link` before running local commands.
+3. Pull env vars with `vercel env pull .env.local` for local dev.
+4. Use `vercel build` to validate build output before deploying.
+5. Automate deployments in CI with `--token` and `--yes` flags.
+6. Use `vercel rollback` as the immediate incident response action.
+
+## Output Contract
+
+- CLI authentication and project linking steps
+- Environment variable management workflow
+- CI/CD pipeline CLI integration commands
+- Relevant flags and flags rationale
+- Rollback procedure and verification steps

package/Ai Agent Workflow/skills/vercel-deployments/SKILL.md

@@ -0,0 +1,101 @@
+---
+name: vercel-deployments
+description: "Vercel deployment lifecycle: git-triggered deployments, build pipeline, build output API, deployment promotion, environment management, preview/production protection, and generated URL patterns."
+license: MIT
+metadata:
+  author: cubis-foundry
+  version: "1.0.0"
+  domain: vercel
+  triggers: vercel, deployment, git deploy, build pipeline, build output api, deployment promotion, environments, preview, production, protection, generated urls, build image
+  role: specialist
+  scope: implementation
+  output-format: checklist
+  related-skills: devops-engineer, vercel-cli, vercel-caching, vercel-domains
+  consolidates: vercel-git-deployments, vercel-deployment-promotion, vercel-deployment-protection, vercel-protection-bypass-automation, vercel-environments, vercel-build-pipeline, vercel-build-output-api, vercel-build-image-upgrades, vercel-generated-urls
+---
+
+# Vercel Deployments
+
+## Purpose
+
+Manage the full Vercel deployment lifecycle from git-triggered builds to production promotion, including environment management, deployment protection, build pipeline customization, and URL strategies.
+
+## When To Use
+
+- Setting up git-based automatic deployments (push-to-deploy).
+- Configuring build pipeline steps and custom build commands.
+- Using Build Output API for framework-agnostic output generation.
+- Promoting preview deployments to production.
+- Configuring deployment protection (password, SSO, Vercel Auth).
+- Automating protection bypass for CI/CD testing.
+- Managing multiple environments (production, preview, development).
+- Understanding and controlling generated deployment URL patterns.
+- Upgrading build image versions.
+
+## Domain Areas
+
+### Git Deployments
+
+- Branch → environment mapping (main → production, etc.).
+- Ignored build step configuration.
+- Monorepo detection and build filtering.
+
+### Build Pipeline
+
+- Custom `buildCommand`, `outputDirectory`, `installCommand`.
+- Build caching and artifact reuse.
+- Build environment variable injection.
+
+### Build Output API
+
+- Framework-agnostic output format: static files, functions, middleware.
+- `config.json`, `routes`, and prerender configs.
+
+### Build Image Upgrades
+
+- Choose and lock Node.js / system dependency versions.
+- Upgrade strategy and regression testing plan.
+
+### Deployment Promotion
+
+- Promote preview to production via CLI or dashboard.
+- Instant rollback to previous production deployment.
+
+### Deployment Protection
+
+- Configure Vercel Authentication, password protection, or IP allowlists for previews.
+- Set per-environment protection levels.
+
+### Protection Bypass Automation
+
+- Use `VERCEL_AUTOMATION_BYPASS_SECRET` for CI access to protected deployments.
+- Rotate secrets and audit bypass usage.
+
+### Environments
+
+- Manage production, preview, and development environment variables.
+- Scope secrets per target environment.
+- Use environment variable groups for shared config.
+
+### Generated URLs
+
+- Understand deployment URL anatomy (`project-hash-team.vercel.app`).
+- Configure custom domains alongside generated URLs.
+- Use deployment URLs in CI testing pipelines.
+
+## Operating Checklist
+
+1. Validate git branch → environment mapping before first deploy.
+2. Test build pipeline locally with `vercel build` before pushing.
+3. Set deployment protection for preview environments.
+4. Configure protection bypass secret for CI/CD pipelines.
+5. Stage → promote workflow: test on preview, promote to production.
+6. Verify instant rollback readiness before any risky deploy.
+
+## Output Contract
+
+- Build pipeline configuration (`vercel.json` / framework config)
+- Environment variable structure per environment tier
+- Deployment protection settings and bypass secret rotation plan
+- Promotion runbook with rollback steps
+- Residual risks and follow-up actions

package/Ai Agent Workflow/skills/vercel-domains/SKILL.md

@@ -1,36 +1,80 @@
 ---
 name: vercel-domains
-description: "Manage custom domain lifecycle: add, assign, verify, and remove."
+description: "Vercel domain management: custom domains, DNS records, nameservers, SSL certificates, domain ownership verification, and static IP configuration."
 license: MIT
 metadata:
   author: cubis-foundry
   version: "1.0.0"
   domain: vercel
-  triggers: vercel, domains
+  triggers: vercel, domain, dns, nameservers, ssl, certificate, custom domain, cname, static ip, domain ownership
   role: specialist
   scope: implementation
   output-format: checklist
-  related-skills: devops-engineer, server-management, security-reviewer
+  related-skills: devops-engineer, vercel-deployments, vercel-platform
+  consolidates: vercel-dns-records, vercel-nameservers, vercel-ssl-certificates, vercel-domain-ownership-claims, vercel-static-ips
 ---
 
 # Vercel Domains
 
 ## Purpose
-Manage custom domain lifecycle: add, assign, verify, and remove.
+
+Manage custom domains on Vercel including DNS configuration, nameserver delegation, SSL certificate provisioning, domain ownership verification, and static IP assignment.
 
 ## When To Use
-- Vercel platform changes in the `network` domain.
-- Tasks requiring production-safe rollout and verification evidence.
-- Work that needs explicit Vercel-specific constraints and guardrails.
+
+- Adding a custom domain to a Vercel project.
+- Configuring DNS records (A, CNAME, TXT, MX) for a domain.
+- Delegating nameservers to Vercel for full DNS management.
+- Troubleshooting SSL certificate provisioning failures.
+- Claiming domain ownership for enterprise configurations.
+- Assigning dedicated static IPs for allowlist-based firewall rules.
+
+## Domain Areas
+
+### Custom Domains
+
+- Add domains in Vercel project settings.
+- Configure redirect from www ↔ apex and production ↔ preview.
+
+### DNS Records
+
+- Manage A, AAAA, CNAME, TXT, MX, SRV records via Vercel DNS.
+- Priority ordering for MX and SRV records.
+
+### Nameservers
+
+- Delegate domain to Vercel nameservers for managed DNS.
+- Validate propagation with `dig`/`nslookup`.
+
+### SSL Certificates
+
+- Automatic cert provisioning via Let's Encrypt.
+- Troubleshoot DNS validation challenges.
+- Wildcard cert requirements for multi-tenant setups.
+
+### Domain Ownership Claims
+
+- Verify domain ownership using TXT record DNS challenges.
+- Required for enterprise team domain assignment.
+
+### Static IPs
+
+- Enable dedicated static egress IPs for firewall allowlisting.
+- Document IPs for downstream system configuration.
 
 ## Operating Checklist
+
 1. Confirm ownership and DNS authority for each managed domain.
 2. Apply changes with TTL and propagation windows accounted for.
-3. Validate certificate state and endpoint reachability after updates.
-4. Prepare rollback records for every production DNS change.
+3. Validate SSL cert provisioning and auto-renewal is active.
+4. Complete domain ownership claim if required by enterprise team.
+5. Document static IPs and communicate to downstream firewall owners.
+6. Prepare rollback records for every production DNS change.
 
 ## Output Contract
-- Proposed implementation choices and tradeoffs
-- Required config, code, and environment changes
-- Validation evidence and rollback notes
-- Residual risks and follow-up actions
+
+- DNS record configuration plan with TTL values
+- SSL certificate provisioning status and validation method
+- Nameserver delegation steps and verification commands
+- Static IP assignments and downstream firewall change requests
+- Residual risks (propagation delays, cert failures)

package/Ai Agent Workflow/skills/vercel-firewall/SKILL.md

@@ -0,0 +1,72 @@
+---
+name: vercel-firewall
+description: "Vercel security controls: WAF core, custom firewall rules, rate limiting, bot management, and BotID fingerprinting for DDoS protection, abuse prevention, and traffic filtering."
+license: MIT
+metadata:
+  author: cubis-foundry
+  version: "1.0.0"
+  domain: vercel
+  triggers: vercel, firewall, waf, rate limiting, bot protection, botid, ddos, abuse, traffic filtering, custom rules
+  role: specialist
+  scope: implementation
+  output-format: checklist
+  related-skills: secure-code-guardian, security-reviewer, vercel-observability, vercel-domains
+  consolidates: vercel-firewall-core, vercel-waf-custom-rules, vercel-waf-rate-limiting, vercel-bot-management, vercel-botid
+---
+
+# Vercel Firewall
+
+## Purpose
+
+Protect Vercel deployments from abuse, DDoS, bots, and malicious traffic using WAF custom rules, rate limiting, bot management, and BotID fingerprinting.
+
+## When To Use
+
+- Setting up WAF rules to block or challenge malicious requests.
+- Implementing rate limiting to prevent API abuse.
+- Detecting and blocking bad bots while allowing good bots.
+- Using BotID for persistent bot fingerprinting.
+- Configuring IP allowlists/blocklists and geo-based rules.
+
+## Domain Areas
+
+### WAF Core & Custom Rules
+
+- Create IP-based, header-based, path-based, and geo-based rules.
+- Actions: `deny`, `challenge`, `log`, `redirect`.
+- Set rule priority and conflict resolution order.
+
+### Rate Limiting
+
+- Configure request rate limits per IP, route, or user segment.
+- Define burst allowances and penalty durations.
+- Use sliding window vs fixed window strategies.
+
+### Bot Management
+
+- Distinguish good bots (crawlers, monitors) from bad bots.
+- Apply challenge pages or blocks for detected bots.
+- Maintain an up-to-date allowed bot list.
+
+### BotID
+
+- Enable persistent bot fingerprinting via BotID header.
+- Use BotID signals in downstream application logic.
+- Monitor and tune BotID confidence thresholds.
+
+## Operating Checklist
+
+1. Audit current attack patterns and abuse vectors before rule creation.
+2. Define rule priorities and test in log-only mode first.
+3. Set rate limits with appropriate burst allowances to avoid false positives.
+4. Enable and tune bot management; validate good-bot pass-through.
+5. Monitor firewall metrics post-deploy for false positive spikes.
+6. Document all rules with justification for future maintenance.
+
+## Output Contract
+
+- WAF rule set definition with priorities and actions
+- Rate limiting configuration per route/IP
+- Bot management policy and BotID integration plan
+- Monitoring thresholds and alert definitions
+- False positive mitigation strategy

package/Ai Agent Workflow/skills/vercel-flags/SKILL.md

@@ -0,0 +1,73 @@
+---
+name: vercel-flags
+description: "Vercel Feature Flags: SDK integration, platform setup, CLI workflows, dashboard management, explorer UI, and OpenFeature compatibility for safe, targeted rollouts."
+license: MIT
+metadata:
+  author: cubis-foundry
+  version: "1.0.0"
+  domain: vercel
+  triggers: vercel, feature flags, flags sdk, flags platform, openfeature, flags dashboard, flags explorer, feature toggle, rollout, a/b test
+  role: specialist
+  scope: implementation
+  output-format: checklist
+  related-skills: nextjs-developer, vercel-deployments, vercel-cli
+  consolidates: vercel-flags-platform, vercel-flags-sdk, vercel-flags-cli-workflows, vercel-flags-dashboard, vercel-flags-explorer, vercel-flags-openfeature
+---
+
+# Vercel Flags
+
+## Purpose
+
+Implement Vercel Feature Flags end-to-end: platform configuration, SDK integration in application code, CLI management workflows, dashboard visibility, explorer UX for teams, and OpenFeature provider compatibility.
+
+## When To Use
+
+- Setting up feature flags on Vercel platform.
+- Integrating `@vercel/flags` SDK into Next.js or other frameworks.
+- Managing flags via CLI for automated rollout pipelines.
+- Using the Flags Dashboard or Explorer for team visibility.
+- Implementing OpenFeature-compatible providers for portability.
+
+## Domain Areas
+
+### Platform Setup
+
+- Configure flag definitions and environments in Vercel dashboard.
+- Assign targeting rules, rollout percentages, and user segments.
+
+### SDK Integration
+
+- Install `@vercel/flags` and configure provider.
+- Use `unstable_flag`, `flag()`, and edge-compatible evaluation.
+- Integrate with Next.js middleware and React Server Components.
+
+### CLI Workflows
+
+- `vercel flags ls`, `vercel flags pull`, `vercel flags push`.
+- Automate flag state changes in CI/CD pipelines.
+
+### Dashboard & Explorer
+
+- Monitor flag state, overrides, and exposure metrics.
+- Use the Toolbar and Explorer for local override during development.
+
+### OpenFeature Compatibility
+
+- Register Vercel as an OpenFeature provider.
+- Maintain provider-agnostic flag evaluation logic.
+
+## Operating Checklist
+
+1. Define flag schema and targeting rules before implementation.
+2. Integrate SDK with appropriate edge/server evaluation context.
+3. Implement safe defaults for all flags (fail-closed).
+4. Validate flag exposure in dashboard before broad rollout.
+5. Automate flag lifecycle (create, rollout, cleanup) in CI.
+
+## Output Contract
+
+- Flag schema definitions and targeting rule design
+- SDK integration code and Next.js adapter config
+- CLI workflow scripts for CI/CD pipelines
+- Dashboard monitoring setup and exposure validation
+- Residual risks and cleanup checklist