@cubis/foundry 0.3.31 → 0.3.33

package/workflows/workflows/agent-environment-setup/shared/workflows/orchestrate.md

@@ -0,0 +1,45 @@
+---
+command: "/orchestrate"
+description: "Coordinate multiple specialists to solve cross-cutting tasks with explicit ownership and handoff."
+triggers: ["orchestrate", "coordinate", "multi-area", "cross-team", "handoff"]
+---
+# Orchestrate Workflow
+
+## When to use
+Use this when a task spans backend, frontend, data, testing, and release concerns.
+
+## Routing
+- Primary coordinator: `@orchestrator`
+- Architecture decisions: `@backend-specialist`
+- Data model/query risk: `@database-architect`
+- UX/client behavior: `@frontend-specialist`
+- Security review: `@security-auditor`
+- Verification strategy: `@test-engineer`
+- Rollout plan: `@devops-engineer`
+
+## Workflow steps
+1. Break the request into workstreams with owners.
+2. Request one primary specialist output per workstream.
+3. Merge outputs into a single implementation plan.
+4. Resolve conflicts before implementation.
+5. End with a release-risk summary.
+
+## Context notes
+- This workflow file, active platform rules, and selected agents/skills guide execution.
+- Attach logs, screenshots, failing output, and relevant paths when context is incomplete.
+
+## Skill Routing
+- Primary skills: `parallel-agents`, `architecture-designer`
+- Supporting skills (optional): `plan-writing`, `feature-forge`
+
+## Verification
+- Run focused checks/tests for the changed scope.
+- Confirm no regressions in adjacent behavior.
+- Note any gaps that were not validated.
+
+## Output Contract
+- Scope and assumptions
+- Workstreams with owner + deliverable
+- Consolidated execution order
+- Test and rollout gates
+- Open risks and mitigations

package/workflows/workflows/agent-environment-setup/shared/workflows/plan.md

@@ -0,0 +1,35 @@
+---
+command: "/plan"
+description: "Build a decision-complete implementation plan with interfaces, failure modes, and acceptance criteria."
+triggers: ["plan", "spec", "design", "roadmap", "acceptance"]
+---
+# Plan Workflow
+
+## When to use
+Use this when execution needs a stable specification.
+
+## Context notes
+- This workflow file, active platform rules, and selected agents/skills guide execution.
+- Attach logs, screenshots, failing output, and relevant paths when context is incomplete.
+
+## Skill Routing
+- Primary skills: `plan-writing`, `architecture-designer`
+- Supporting skills (optional): `feature-forge`, `api-designer`
+
+## Workflow steps
+1. Lock scope and non-goals.
+2. Define architecture, boundaries, and data flow.
+3. Specify interfaces and validation rules.
+4. Document failure modes and mitigations.
+5. Define tests and release acceptance criteria.
+
+## Verification
+- Run focused checks/tests for the changed scope.
+- Confirm no regressions in adjacent behavior.
+- Note any gaps that were not validated.
+
+## Output Contract
+- Implementation phases
+- API/data/interface details
+- Edge cases and risk matrix
+- Verification and rollout checklist

package/workflows/workflows/agent-environment-setup/shared/workflows/qa.md

@@ -0,0 +1,39 @@
+---
+command: "/qa"
+description: "Create and execute quality strategy with automation and regression-focused coverage."
+triggers: ["qa", "test", "regression", "automation", "e2e"]
+---
+# QA Workflow
+
+## When to use
+Use this when verification quality and regression prevention are primary concerns.
+
+## Routing
+- Primary specialist: `@qa-automation-engineer`
+- Test strategy support: `@test-engineer`
+- Bug investigation support: `@debugger`
+
+## Context notes
+- This workflow file, active platform rules, and selected agents/skills guide execution.
+- Attach logs, screenshots, failing output, and relevant paths when context is incomplete.
+
+## Skill Routing
+- Primary skills: `test-master`, `playwright-expert`
+- Supporting skills (optional): `webapp-testing`, `lint-and-validate`
+
+## Workflow steps
+1. Identify risk-heavy user journeys.
+2. Define automation + manual checks where needed.
+3. Execute validation and triage failures.
+4. Report confidence level and remaining gaps.
+
+## Verification
+- Run focused checks/tests for the changed scope.
+- Confirm no regressions in adjacent behavior.
+- Note any gaps that were not validated.
+
+## Output Contract
+- Test strategy and scope
+- Automation coverage updates
+- Defect findings and severity
+- Confidence and residual risk

package/workflows/workflows/agent-environment-setup/shared/workflows/refactor.md

@@ -0,0 +1,34 @@
+---
+command: "/refactor"
+description: "Improve maintainability while preserving behavior through incremental safe refactoring."
+triggers: ["refactor", "cleanup", "maintainability", "debt", "modularize"]
+---
+# Refactor Workflow
+
+## When to use
+Use this for design improvement without intentional behavior changes.
+
+## Context notes
+- This workflow file, active platform rules, and selected agents/skills guide execution.
+- Attach logs, screenshots, failing output, and relevant paths when context is incomplete.
+
+## Skill Routing
+- Primary skills: `refactor`, `legacy-modernizer`
+- Supporting skills (optional): `architecture-designer`, `code-reviewer`
+
+## Workflow steps
+1. Define behavior invariants and guardrails.
+2. Isolate refactor slices with low coupling.
+3. Apply changes incrementally with tests.
+4. Confirm behavior parity and performance baseline.
+
+## Verification
+- Run focused checks/tests for the changed scope.
+- Confirm no regressions in adjacent behavior.
+- Note any gaps that were not validated.
+
+## Output Contract
+- Refactor scope and invariants
+- Structural changes
+- Behavior parity evidence
+- Deferred technical debt items

package/workflows/workflows/agent-environment-setup/shared/workflows/release.md

@@ -0,0 +1,40 @@
+---
+command: "/release"
+description: "Prepare and execute release with rollout guardrails, verification, and rollback plan."
+triggers: ["release", "deploy", "rollout", "ship", "go-live"]
+---
+# Release Workflow
+
+## When to use
+Use this before deployment to production-like environments.
+
+## Routing
+- Release orchestration: `@devops-engineer`
+- Risk checks: `@security-auditor` + `@test-engineer`
+- Scope/fallback alignment: `@product-owner`
+
+## Context notes
+- This workflow file, active platform rules, and selected agents/skills guide execution.
+- Attach logs, screenshots, failing output, and relevant paths when context is incomplete.
+
+## Skill Routing
+- Primary skills: `devops-engineer`, `sre-engineer`
+- Supporting skills (optional): `monitoring-expert`, `test-master`
+
+## Workflow steps
+1. Confirm release scope and dependencies.
+2. Validate test evidence and readiness gates.
+3. Define rollout strategy and rollback triggers.
+4. Execute release and monitor signals.
+5. Publish release summary and next actions.
+
+## Verification
+- Run focused checks/tests for the changed scope.
+- Confirm no regressions in adjacent behavior.
+- Note any gaps that were not validated.
+
+## Output Contract
+- Release checklist status
+- Rollout strategy
+- Rollback conditions
+- Post-release monitoring plan

package/workflows/workflows/agent-environment-setup/shared/workflows/review.md

@@ -0,0 +1,40 @@
+---
+command: "/review"
+description: "Run a strict review for bugs, regressions, and security issues with prioritized findings."
+triggers: ["review", "audit", "pr", "quality", "security review"]
+---
+# Review Workflow
+
+## When to use
+Use this for pull request or branch quality review.
+
+## Routing
+- Code quality and legacy risk: `@code-archaeologist`
+- Frontend quality: `@frontend-specialist`
+- Security checks: `@security-auditor`
+- Test adequacy: `@test-engineer`
+
+## Context notes
+- This workflow file, active platform rules, and selected agents/skills guide execution.
+- Attach logs, screenshots, failing output, and relevant paths when context is incomplete.
+
+## Skill Routing
+- Primary skills: `code-reviewer`, `security-reviewer`
+- Supporting skills (optional): `semgrep`, `static-analysis`, `variant-analysis`
+
+## Workflow steps
+1. Inspect changed behavior and risk surface.
+2. Identify defects by severity.
+3. Validate tests and missing coverage.
+4. Produce actionable remediation guidance.
+
+## Verification
+- Run focused checks/tests for the changed scope.
+- Confirm no regressions in adjacent behavior.
+- Note any gaps that were not validated.
+
+## Output Contract
+- Findings ordered by severity
+- Affected files/areas
+- Recommended fixes
+- Residual risks after fixes

package/workflows/workflows/agent-environment-setup/shared/workflows/security.md

@@ -0,0 +1,39 @@
+---
+command: "/security"
+description: "Run security-focused analysis and remediation planning with exploitability-first triage."
+triggers: ["security", "vulnerability", "owasp", "auth", "hardening"]
+---
+# Security Workflow
+
+## When to use
+Use this when the task is primarily about security risk discovery, triage, or remediation.
+
+## Routing
+- Primary specialist: `@security-auditor`
+- Exploitability validation: `@penetration-tester`
+- Verification support: `@test-engineer`
+
+## Context notes
+- This workflow file, active platform rules, and selected agents/skills guide execution.
+- Attach logs, screenshots, failing output, and relevant paths when context is incomplete.
+
+## Skill Routing
+- Primary skills: `security-reviewer`, `secure-code-guardian`
+- Supporting skills (optional): `semgrep`, `static-analysis`, `variant-analysis`
+
+## Workflow steps
+1. Map threat surface and high-risk paths.
+2. Prioritize findings by exploitability and impact.
+3. Propose concrete fixes with least regression risk.
+4. Validate remediation and residual risk.
+
+## Verification
+- Run focused checks/tests for the changed scope.
+- Confirm no regressions in adjacent behavior.
+- Note any gaps that were not validated.
+
+## Output Contract
+- Findings by severity
+- Fix plan with owners
+- Verification evidence
+- Residual risk notes

package/workflows/workflows/agent-environment-setup/shared/workflows/test.md

@@ -0,0 +1,34 @@
+---
+command: "/test"
+description: "Design and execute verification strategy aligned to risk and acceptance criteria."
+triggers: ["test", "verify", "coverage", "qa", "regression"]
+---
+# Test Workflow
+
+## When to use
+Use this to drive confidence before merge or release.
+
+## Context notes
+- This workflow file, active platform rules, and selected agents/skills guide execution.
+- Attach logs, screenshots, failing output, and relevant paths when context is incomplete.
+
+## Skill Routing
+- Primary skills: `test-master`, `playwright-expert`
+- Supporting skills (optional): `webapp-testing`, `flutter-test-master`
+
+## Workflow steps
+1. Map change surface to risk areas.
+2. Choose unit/integration/e2e depth per risk.
+3. Run fast checks first, then broad suite.
+4. Report failures with root-cause direction.
+
+## Verification
+- Run focused checks/tests for the changed scope.
+- Confirm no regressions in adjacent behavior.
+- Note any gaps that were not validated.
+
+## Output Contract
+- Coverage map (what was tested)
+- Test results summary
+- Remaining risk and gaps
+- Merge/release recommendation

package/workflows/workflows/agent-environment-setup/shared/workflows/vercel.md

@@ -0,0 +1,40 @@
+---
+command: "/vercel"
+description: "Drive Vercel implementation and operations via vercel-expert with deployment, runtime, security, and observability guardrails."
+triggers: ["vercel", "deployment", "preview", "edge", "functions", "domains", "vercel cli"]
+---
+# Vercel Workflow
+
+## When to use
+Use this workflow when the primary concern is Vercel platform behavior, deployment safety, or Vercel-specific automation.
+
+## Routing
+- Primary specialist: `@vercel-expert`
+- Add `@devops-engineer` for CI/CD and rollout policy design.
+- Add `@security-auditor` for WAF, auth, and network-hardening decisions.
+- Add `@test-engineer` or `@qa-automation-engineer` for release quality gates.
+
+## Context notes
+- This workflow file, active platform rules, and selected agents/skills guide execution.
+- Attach logs, screenshots, failing output, and relevant paths when context is incomplete.
+
+## Skill Routing
+- Primary skills: `vercel-platform`, `vercel-runtime`
+- Supporting skills (optional): `vercel-delivery`, `vercel-security`, `vercel-ai`, `vercel-storage`
+
+## Workflow steps
+1. Confirm environment targets, success criteria, and rollback constraints.
+2. Design the smallest Vercel-specific change that solves the issue.
+3. Implement and verify using focused checks with logs/traces evidence.
+4. Summarize risk, residual gaps, and next operational actions.
+
+## Verification
+- Run focused checks/tests for the changed scope.
+- Confirm no regressions in adjacent behavior.
+- Note any gaps that were not validated.
+
+## Output Contract
+- Config/code changes and affected Vercel components
+- Deployment and rollback notes
+- Security and observability impact
+- Verification evidence and follow-up items