@cubis/foundry 0.3.31 → 0.3.33

package/workflows/workflows/agent-environment-setup/platforms/copilot/workflows/qa.md

@@ -5,6 +5,7 @@ triggers: ["qa", "test", "regression", "automation", "e2e"]
 ---
 # QA Workflow
 
+## When to use
 Use this when verification quality and regression prevention are primary concerns.
 
 ## Routing
@@ -12,12 +13,25 @@ Use this when verification quality and regression prevention are primary concern
 - Test strategy support: `@test-engineer`
 - Bug investigation support: `@debugger`
 
-## Steps
+## Context notes
+- This workflow file, active platform rules, and selected agents/skills guide execution.
+- Attach logs, screenshots, failing output, and relevant paths when context is incomplete.
+
+## Skill Routing
+- Primary skills: `test-master`, `playwright-expert`
+- Supporting skills (optional): `webapp-testing`, `lint-and-validate`
+
+## Workflow steps
 1. Identify risk-heavy user journeys.
 2. Define automation + manual checks where needed.
 3. Execute validation and triage failures.
 4. Report confidence level and remaining gaps.
 
+## Verification
+- Run focused checks/tests for the changed scope.
+- Confirm no regressions in adjacent behavior.
+- Note any gaps that were not validated.
+
 ## Output Contract
 - Test strategy and scope
 - Automation coverage updates

package/workflows/workflows/agent-environment-setup/platforms/copilot/workflows/refactor.md

@@ -5,14 +5,28 @@ triggers: ["refactor", "cleanup", "maintainability", "debt", "modularize"]
 ---
 # Refactor Workflow
 
+## When to use
 Use this for design improvement without intentional behavior changes.
 
-## Steps
+## Context notes
+- This workflow file, active platform rules, and selected agents/skills guide execution.
+- Attach logs, screenshots, failing output, and relevant paths when context is incomplete.
+
+## Skill Routing
+- Primary skills: `refactor`, `legacy-modernizer`
+- Supporting skills (optional): `architecture-designer`, `code-reviewer`
+
+## Workflow steps
 1. Define behavior invariants and guardrails.
 2. Isolate refactor slices with low coupling.
 3. Apply changes incrementally with tests.
 4. Confirm behavior parity and performance baseline.
 
+## Verification
+- Run focused checks/tests for the changed scope.
+- Confirm no regressions in adjacent behavior.
+- Note any gaps that were not validated.
+
 ## Output Contract
 - Refactor scope and invariants
 - Structural changes

package/workflows/workflows/agent-environment-setup/platforms/copilot/workflows/release.md

@@ -5,6 +5,7 @@ triggers: ["release", "deploy", "rollout", "ship", "go-live"]
 ---
 # Release Workflow
 
+## When to use
 Use this before deployment to production-like environments.
 
 ## Routing
@@ -12,13 +13,26 @@ Use this before deployment to production-like environments.
 - Risk checks: `@security-auditor` + `@test-engineer`
 - Scope/fallback alignment: `@product-owner`
 
-## Steps
+## Context notes
+- This workflow file, active platform rules, and selected agents/skills guide execution.
+- Attach logs, screenshots, failing output, and relevant paths when context is incomplete.
+
+## Skill Routing
+- Primary skills: `devops-engineer`, `sre-engineer`
+- Supporting skills (optional): `monitoring-expert`, `test-master`
+
+## Workflow steps
 1. Confirm release scope and dependencies.
 2. Validate test evidence and readiness gates.
 3. Define rollout strategy and rollback triggers.
 4. Execute release and monitor signals.
 5. Publish release summary and next actions.
 
+## Verification
+- Run focused checks/tests for the changed scope.
+- Confirm no regressions in adjacent behavior.
+- Note any gaps that were not validated.
+
 ## Output Contract
 - Release checklist status
 - Rollout strategy

package/workflows/workflows/agent-environment-setup/platforms/copilot/workflows/review.md

@@ -5,6 +5,7 @@ triggers: ["review", "audit", "pr", "quality", "security review"]
 ---
 # Review Workflow
 
+## When to use
 Use this for pull request or branch quality review.
 
 ## Routing
@@ -13,12 +14,25 @@ Use this for pull request or branch quality review.
 - Security checks: `@security-auditor`
 - Test adequacy: `@test-engineer`
 
-## Steps
+## Context notes
+- This workflow file, active platform rules, and selected agents/skills guide execution.
+- Attach logs, screenshots, failing output, and relevant paths when context is incomplete.
+
+## Skill Routing
+- Primary skills: `code-reviewer`, `security-reviewer`
+- Supporting skills (optional): `semgrep`, `static-analysis`, `variant-analysis`
+
+## Workflow steps
 1. Inspect changed behavior and risk surface.
 2. Identify defects by severity.
 3. Validate tests and missing coverage.
 4. Produce actionable remediation guidance.
 
+## Verification
+- Run focused checks/tests for the changed scope.
+- Confirm no regressions in adjacent behavior.
+- Note any gaps that were not validated.
+
 ## Output Contract
 - Findings ordered by severity
 - Affected files/areas

package/workflows/workflows/agent-environment-setup/platforms/copilot/workflows/security.md

@@ -5,6 +5,7 @@ triggers: ["security", "vulnerability", "owasp", "auth", "hardening"]
 ---
 # Security Workflow
 
+## When to use
 Use this when the task is primarily about security risk discovery, triage, or remediation.
 
 ## Routing
@@ -12,12 +13,25 @@ Use this when the task is primarily about security risk discovery, triage, or re
 - Exploitability validation: `@penetration-tester`
 - Verification support: `@test-engineer`
 
-## Steps
+## Context notes
+- This workflow file, active platform rules, and selected agents/skills guide execution.
+- Attach logs, screenshots, failing output, and relevant paths when context is incomplete.
+
+## Skill Routing
+- Primary skills: `security-reviewer`, `secure-code-guardian`
+- Supporting skills (optional): `semgrep`, `static-analysis`, `variant-analysis`
+
+## Workflow steps
 1. Map threat surface and high-risk paths.
 2. Prioritize findings by exploitability and impact.
 3. Propose concrete fixes with least regression risk.
 4. Validate remediation and residual risk.
 
+## Verification
+- Run focused checks/tests for the changed scope.
+- Confirm no regressions in adjacent behavior.
+- Note any gaps that were not validated.
+
 ## Output Contract
 - Findings by severity
 - Fix plan with owners

package/workflows/workflows/agent-environment-setup/platforms/copilot/workflows/test.md

@@ -5,14 +5,28 @@ triggers: ["test", "verify", "coverage", "qa", "regression"]
 ---
 # Test Workflow
 
+## When to use
 Use this to drive confidence before merge or release.
 
-## Steps
+## Context notes
+- This workflow file, active platform rules, and selected agents/skills guide execution.
+- Attach logs, screenshots, failing output, and relevant paths when context is incomplete.
+
+## Skill Routing
+- Primary skills: `test-master`, `playwright-expert`
+- Supporting skills (optional): `webapp-testing`, `flutter-test-master`
+
+## Workflow steps
 1. Map change surface to risk areas.
 2. Choose unit/integration/e2e depth per risk.
 3. Run fast checks first, then broad suite.
 4. Report failures with root-cause direction.
 
+## Verification
+- Run focused checks/tests for the changed scope.
+- Confirm no regressions in adjacent behavior.
+- Note any gaps that were not validated.
+
 ## Output Contract
 - Coverage map (what was tested)
 - Test results summary

package/workflows/workflows/agent-environment-setup/platforms/copilot/workflows/vercel.md

@@ -5,6 +5,7 @@ triggers: ["vercel", "deployment", "preview", "edge", "functions", "domains", "v
 ---
 # Vercel Workflow
 
+## When to use
 Use this workflow when the primary concern is Vercel platform behavior, deployment safety, or Vercel-specific automation.
 
 ## Routing
@@ -13,12 +14,25 @@ Use this workflow when the primary concern is Vercel platform behavior, deployme
 - Add `@security-auditor` for WAF, auth, and network-hardening decisions.
 - Add `@test-engineer` or `@qa-automation-engineer` for release quality gates.
 
-## Steps
+## Context notes
+- This workflow file, active platform rules, and selected agents/skills guide execution.
+- Attach logs, screenshots, failing output, and relevant paths when context is incomplete.
+
+## Skill Routing
+- Primary skills: `vercel-platform`, `vercel-runtime`
+- Supporting skills (optional): `vercel-delivery`, `vercel-security`, `vercel-ai`, `vercel-storage`
+
+## Workflow steps
 1. Confirm environment targets, success criteria, and rollback constraints.
 2. Design the smallest Vercel-specific change that solves the issue.
 3. Implement and verify using focused checks with logs/traces evidence.
 4. Summarize risk, residual gaps, and next operational actions.
 
+## Verification
+- Run focused checks/tests for the changed scope.
+- Confirm no regressions in adjacent behavior.
+- Note any gaps that were not validated.
+
 ## Output Contract
 - Config/code changes and affected Vercel components
 - Deployment and rollback notes

package/workflows/workflows/agent-environment-setup/platforms/cursor/skills/architecture/SKILL.md

@@ -1,55 +1,21 @@
 ---
 name: architecture
-description: Architectural decision-making framework. Requirements analysis, trade-off evaluation, ADR documentation. Use when making architecture decisions or analyzing system design.
-allowed-tools: Read, Glob, Grep
+description: "Compatibility alias skill. Deprecated: use architecture-designer."
+metadata:
+  deprecated: true
+  replaced_by: architecture-designer
+  removal_target: v0.6.0
 ---
 
-# Architecture Decision Framework
+# Architecture
 
-> "Requirements drive architecture. Trade-offs inform decisions. ADRs capture rationale."
+## Compatibility Alias
 
-## 🎯 Selective Reading Rule
+This skill is deprecated and kept for backward compatibility.
 
-**Read ONLY files relevant to the request!** Check the content map, find what you need.
+Use `architecture-designer` as the canonical skill.
 
-| File | Description | When to Read |
-|------|-------------|--------------|
-| `context-discovery.md` | Questions to ask, project classification | Starting architecture design |
-| `trade-off-analysis.md` | ADR templates, trade-off framework | Documenting decisions |
-| `pattern-selection.md` | Decision trees, anti-patterns | Choosing patterns |
-| `examples.md` | MVP, SaaS, Enterprise examples | Reference implementations |
-| `patterns-reference.md` | Quick lookup for patterns | Pattern comparison |
+## Migration
 
----
-
-## 🔗 Related Skills
-
-| Skill | Use For |
-|-------|---------|
-| `@[skills/database-design]` | Database schema design |
-| `@[skills/api-patterns]` | API design patterns |
-| `@[skills/deployment-procedures]` | Deployment architecture |
-
----
-
-## Core Principle
-
-**"Simplicity is the ultimate sophistication."**
-
-- Start simple
-- Add complexity ONLY when proven necessary
-- You can always add patterns later
-- Removing complexity is MUCH harder than adding it
-
----
-
-## Validation Checklist
-
-Before finalizing architecture:
-
-- [ ] Requirements clearly understood
-- [ ] Constraints identified
-- [ ] Each decision has trade-off analysis
-- [ ] Simpler alternatives considered
-- [ ] ADRs written for significant decisions
-- [ ] Team expertise matches chosen patterns
+1. Replace direct references to `architecture` with `architecture-designer`.
+2. Apply the full workflow from `architecture-designer` for new work.

package/workflows/workflows/agent-environment-setup/platforms/cursor/skills/ask-questions-if-underspecified/SKILL.md

@@ -0,0 +1,85 @@
+---
+name: ask-questions-if-underspecified
+description: Clarify requirements before implementing. Use when serious doubts arise.
+---
+
+# Ask Questions If Underspecified
+
+## When to Use
+
+Use this skill when a request has multiple plausible interpretations or key details (objective, scope, constraints, environment, or safety) are unclear.
+
+## When NOT to Use
+
+Do not use this skill when the request is already clear, or when a quick, low-risk discovery read can answer the missing details.
+
+## Goal
+
+Ask the minimum set of clarifying questions needed to avoid wrong work; do not start implementing until the must-have questions are answered (or the user explicitly approves proceeding with stated assumptions).
+
+## Workflow
+
+### 1) Decide whether the request is underspecified
+
+Treat a request as underspecified if after exploring how to perform the work, some or all of the following are not clear:
+- Define the objective (what should change vs stay the same)
+- Define "done" (acceptance criteria, examples, edge cases)
+- Define scope (which files/components/users are in/out)
+- Define constraints (compatibility, performance, style, deps, time)
+- Identify environment (language/runtime versions, OS, build/test runner)
+- Clarify safety/reversibility (data migration, rollout/rollback, risk)
+
+If multiple plausible interpretations exist, assume it is underspecified.
+
+### 2) Ask must-have questions first (keep it small)
+
+Ask 1-5 questions in the first pass. Prefer questions that eliminate whole branches of work.
+
+Make questions easy to answer:
+- Optimize for scannability (short, numbered questions; avoid paragraphs)
+- Offer multiple-choice options when possible
+- Suggest reasonable defaults when appropriate (mark them clearly as the default/recommended choice; bold the recommended choice in the list, or if you present options in a code block, put a bold "Recommended" line immediately above the block and also tag defaults inside the block)
+- Include a fast-path response (e.g., reply `defaults` to accept all recommended/default choices)
+- Include a low-friction "not sure" option when helpful (e.g., "Not sure - use default")
+- Separate "Need to know" from "Nice to know" if that reduces friction
+- Structure options so the user can respond with compact decisions (e.g., `1b 2a 3c`); restate the chosen options in plain language to confirm
+
+### 3) Pause before acting
+
+Until must-have answers arrive:
+- Do not run commands, edit files, or produce a detailed plan that depends on unknowns
+- Do perform a clearly labeled, low-risk discovery step only if it does not commit you to a direction (e.g., inspect repo structure, read relevant config files)
+
+If the user explicitly asks you to proceed without answers:
+- State your assumptions as a short numbered list
+- Ask for confirmation; proceed only after they confirm or correct them
+
+### 4) Confirm interpretation, then proceed
+
+Once you have answers, restate the requirements in 1-3 sentences (including key constraints and what success looks like), then start work.
+
+## Question templates
+
+- "Before I start, I need: (1) ..., (2) ..., (3) .... If you don't care about (2), I will assume ...."
+- "Which of these should it be? A) ... B) ... C) ... (pick one)"
+- "What would you consider 'done'? For example: ..."
+- "Any constraints I must follow (versions, performance, style, deps)? If none, I will target the existing project defaults."
+- Use numbered questions with lettered options and a clear reply format
+
+```text
+1) Scope?
+a) Minimal change (default)
+b) Refactor while touching the area
+c) Not sure - use default
+2) Compatibility target?
+a) Current project defaults (default)
+b) Also support older versions: <specify>
+c) Not sure - use default
+
+Reply with: defaults (or 1a 2a)
+```
+
+## Anti-patterns
+
+- Don't ask questions you can answer with a quick, low-risk discovery read (e.g., configs, existing patterns, docs).
+- Don't ask open-ended questions if a tight multiple-choice or yes/no would eliminate ambiguity faster.

package/workflows/workflows/agent-environment-setup/platforms/cursor/skills/atlassian-mcp/SKILL.md

@@ -0,0 +1,88 @@
+---
+name: atlassian-mcp
+description: Use when querying Jira issues, searching Confluence pages, creating tickets, updating documentation, or integrating Atlassian tools via MCP protocol.
+license: MIT
+metadata:
+  author: https://github.com/Jeffallan
+  version: "1.0.0"
+  domain: platform
+  triggers: Jira, Confluence, Atlassian, MCP, tickets, issues, wiki, JQL, CQL, sprint, backlog, project management
+  role: expert
+  scope: implementation
+  output-format: code
+  related-skills: mcp-developer, api-designer, security-reviewer
+---
+
+# Atlassian MCP Expert
+
+Senior integration specialist with deep expertise in connecting Jira, Confluence, and other Atlassian tools to AI systems via Model Context Protocol (MCP).
+
+## Role Definition
+
+You are an expert in Atlassian MCP integration with mastery of both official and open-source MCP servers, JQL/CQL query languages, OAuth 2.0 authentication, and production deployment patterns. You build robust workflows that automate issue triage, documentation sync, sprint planning, and cross-tool integration while respecting permissions and maintaining security.
+
+## When to Use This Skill
+
+- Querying Jira issues with JQL filters
+- Searching or creating Confluence pages
+- Automating sprint workflows and backlog management
+- Setting up MCP server authentication (OAuth/API tokens)
+- Syncing meeting notes to Jira tickets
+- Generating documentation from issue data
+- Debugging Atlassian API integration issues
+- Choosing between official vs open-source MCP servers
+
+## Core Workflow
+
+1. **Select server** - Choose official cloud, open-source, or self-hosted MCP server
+2. **Authenticate** - Configure OAuth 2.1, API tokens, or PAT credentials
+3. **Design queries** - Write JQL for Jira, CQL for Confluence, test filters
+4. **Implement workflow** - Build tool calls, handle pagination, error recovery
+5. **Deploy** - Configure IDE integration, test permissions, monitor rate limits
+
+## Reference Guide
+
+Load detailed guidance based on context:
+
+| Topic | Reference | Load When |
+|-------|-----------|-----------|
+| Server Setup | `references/mcp-server-setup.md` | Installation, choosing servers, configuration |
+| Jira Operations | `references/jira-queries.md` | JQL syntax, issue CRUD, sprints, boards |
+| Confluence Ops | `references/confluence-operations.md` | CQL search, page creation, spaces, comments |
+| Authentication | `references/authentication-patterns.md` | OAuth 2.0, API tokens, permission scopes |
+| Common Workflows | `references/common-workflows.md` | Issue triage, doc sync, sprint automation |
+
+## Constraints
+
+### MUST DO
+- Respect user permissions and workspace access controls
+- Validate JQL/CQL queries before execution
+- Handle rate limits with exponential backoff
+- Use pagination for large result sets (50-100 items per page)
+- Implement error recovery for network failures
+- Log API calls for debugging and audit trails
+- Test with read-only operations first
+- Document required permission scopes
+
+### MUST NOT DO
+- Hardcode API tokens or OAuth secrets in code
+- Ignore rate limit headers from Atlassian APIs
+- Create issues without validating required fields
+- Skip input sanitization on user-provided query strings
+- Deploy without testing permission boundaries
+- Update production data without confirmation prompts
+- Mix different authentication methods in same session
+- Expose sensitive issue data in logs or error messages
+
+## Output Templates
+
+When implementing Atlassian MCP features, provide:
+1. MCP server configuration (JSON/environment vars)
+2. Query examples (JQL/CQL with explanations)
+3. Tool call implementation with error handling
+4. Authentication setup instructions
+5. Brief explanation of permission requirements
+
+## Knowledge Reference
+
+Atlassian MCP Server (official), mcp-atlassian (sooperset), atlassian-mcp (xuanxt), JQL (Jira Query Language), CQL (Confluence Query Language), OAuth 2.1, API tokens, Personal Access Tokens (PAT), Model Context Protocol, JSON-RPC 2.0, rate limiting, pagination, permission scopes, Jira REST API, Confluence REST API