@cubis/foundry 0.3.63 → 0.3.64

package/workflows/workflows/agent-environment-setup/platforms/cursor/skills/typescript-pro/SKILL.md

@@ -20,6 +20,12 @@ metadata:
 - Reducing type regressions in monorepos.
 - Preparing for upcoming TS 6/7 behavior shifts.
 
+## When not to use
+
+- Plain JavaScript-only work where runtime constraints matter more than type architecture.
+- Database-only tuning with no TypeScript code change.
+- Simple shell or config edits that do not benefit from TS guidance.
+
 ## Core workflow
 
 1. Confirm runtime and module target (Node, browser, edge).
@@ -44,6 +50,18 @@ metadata:
 - Use schema validation (zod/valibot/etc.) for external input.
 - Treat type errors as design feedback, not noise.
 
+## Debugging and observability
+
+- Reproduce type regressions with focused compiler output before widening changes.
+- Keep runtime validation and structured logging at untrusted boundaries.
+- Prefer targeted failing examples over broad `as`-based workarounds.
+
+## Performance and reliability
+
+- Keep module boundaries explicit so public types stay stable.
+- Use incremental builds/project references deliberately in large repos.
+- Measure hot runtime paths separately from type-system complexity.
+
 ## Avoid
 
 - Library-facing `any`.
@@ -53,8 +71,10 @@ metadata:
 
 ## Reference files
 
-- `references/configuration.md`
-- `references/advanced-types.md`
-- `references/type-guards.md`
-- `references/utility-types.md`
-- `references/patterns.md`
+| File | Load when |
+| --- | --- |
+| `references/configuration.md` | `tsconfig`, strictness, module targets, or project references need detail. |
+| `references/advanced-types.md` | Generics, conditional types, mapped types, or template literals are central. |
+| `references/type-guards.md` | Narrowing and runtime-safe type refinement need detail. |
+| `references/utility-types.md` | Utility-type composition or shared helper types are in scope. |
+| `references/patterns.md` | Type-safe architecture patterns or public API design needs detail. |

package/workflows/workflows/agent-environment-setup/platforms/cursor/skills/ui-ux-pro-max/SKILL.md

@@ -158,8 +158,8 @@ python3 skills/ui-ux-pro-max/scripts/search.py "<query>" --design-system --persi
 ```
 
 This creates:
-- `design-system/MASTER.md` — Global Source of Truth with all design rules
-- `design-system/pages/` — Folder for page-specific overrides
+- a `design-system` master markdown document as the global source of truth
+- a `design-system/pages/` folder for page-specific overrides
 
 **With page-specific override:**
 ```bash
@@ -167,17 +167,17 @@ python3 skills/ui-ux-pro-max/scripts/search.py "<query>" --design-system --persi
 ```
 
 This also creates:
-- `design-system/pages/dashboard.md` — Page-specific deviations from Master
+- a page-specific markdown override for the selected page
 
 **How hierarchical retrieval works:**
-1. When building a specific page (e.g., "Checkout"), first check `design-system/pages/checkout.md`
+1. When building a specific page (for example, Checkout), first check for a page-specific override file in `design-system/pages/`
 2. If the page file exists, its rules **override** the Master file
-3. If not, use `design-system/MASTER.md` exclusively
+3. If not, use the master design-system document exclusively
 
 **Context-aware retrieval prompt:**
 ```
-I am building the [Page Name] page. Please read design-system/MASTER.md.
-Also check if design-system/pages/[page-name].md exists.
+I am building the [Page Name] page. Please read the master design-system markdown document.
+Also check if a page-specific markdown override exists under `design-system/pages/`.
 If the page file exists, prioritize its rules.
 If not, use the Master rules exclusively.
 Now, generate the code...

package/workflows/workflows/agent-environment-setup/platforms/cursor/skills/ux-ui-consistency/SKILL.md

@@ -113,12 +113,15 @@ try {
 - [ ] Screen reader labels present
 - [ ] Focus order is logical
 
-## Steering Files
+## References
 
-- `one_component_rules.md` - Complete design system component usage guide
-- `ux_checklist.md` - UX review checklist for all screens
+Load detailed guidance only when needed.
+
+| File | Load when |
+| --- | --- |
+| `steering/one_component_rules.md` | Enforcing design-system component usage and avoiding raw widget drift |
+| `steering/ux_checklist.md` | Running a full UX consistency review across a screen or feature |
 
 ## Templates
 
 - `screen_states_widget` - Complete screen state handling template
-

package/workflows/workflows/agent-environment-setup/platforms/cursor/skills/variant-analysis/SKILL.md

@@ -69,7 +69,7 @@ For each match, document:
 - **Exploitability**: Reachable? Controllable inputs?
 - **Priority**: Based on impact and exploitability
 
-For deeper strategic guidance, see [METHODOLOGY.md](METHODOLOGY.md).
+For deeper strategic guidance, see [METHODOLOGY.md](references/METHODOLOGY.md).
 
 ## Tool Selection
 
@@ -139,4 +139,4 @@ Ready-to-use templates in `resources/`:
 **Semgrep** (`resources/semgrep/`):
 - `python.yaml`, `javascript.yaml`, `java.yaml`, `go.yaml`, `cpp.yaml`
 
-**Report**: `resources/variant-report-template.md`
+**Report**: `resources/variant-report-template.md`

package/workflows/workflows/agent-environment-setup/platforms/windsurf/skills/accessibility/SKILL.md

@@ -91,13 +91,15 @@ SizedBox(
 4. **Color Contrast**: Text must have 4.5:1 contrast ratio (3:1 for large text)
 5. **Screen Reader**: Test with TalkBack (Android) and VoiceOver (iOS)
 
-## Steering Files
+## References
 
-Load detailed guidance:
-- `a11y_checklist.md` - Complete accessibility checklist for reviews
+Load detailed guidance only when needed.
+
+| File | Load when |
+| --- | --- |
+| `references/a11y_checklist.md` | Running an accessibility review or validating a widget/screen against the full checklist |
 
 ## Templates
 
 - `focus_form` - Form with proper focus management
 - `semantics_icon_button` - Icon button with semantic labels
-

package/workflows/workflows/agent-environment-setup/platforms/windsurf/skills/api-designer/SKILL.md

@@ -1,11 +1,15 @@
 ---
 name: "api-designer"
-description: "Use when designing REST or GraphQL APIs, creating OpenAPI specifications, or planning API architecture. Invoke for resource modeling, versioning strategies, pagination patterns, error handling standards."
+description: "Use when defining or reviewing external API contracts, OpenAPI specifications, resource models, pagination, versioning, or error response standards. Do not use for pure database design, implementation-only handler work, or framework-specific backend setup."
 ---
 
 
 # API Designer
 
+# CHANGED: description — added a sharper trigger boundary and explicit non-goals — reduces false-positive invocation.
+# CHANGED: references section — normalized to explicit Load When guidance with platform-safe relative paths — prevents speculative sidecar loading.
+# CHANGED: related powers cleanup — removed power-era section — keeps this skill canonical and platform-safe.
+
 ## Overview
 
 Senior API architect with expertise in designing scalable, developer-friendly REST and GraphQL APIs with comprehensive OpenAPI specifications.
@@ -25,6 +29,12 @@ You are a senior API designer with 10+ years of experience creating intuitive, s
 - Planning authentication flows
 - Documenting API contracts
 
+## When Not to Use This Skill
+
+- Pure database schema, indexing, or migration work without an API contract change
+- Framework-only implementation tasks such as wiring handlers, middleware, or DI containers
+- Internal refactors that do not change request/response contracts
+
 ## Core Workflow
 
 1. **Analyze domain** - Understand business requirements, data models, client needs
@@ -33,7 +43,7 @@ You are a senior API designer with 10+ years of experience creating intuitive, s
 4. **Specify contract** - Create OpenAPI 3.1 spec with complete documentation
 5. **Plan evolution** - Design versioning, deprecation, backward compatibility
 
-## Available Steering Files
+## References
 
 Load detailed guidance on-demand:
 
@@ -84,11 +94,3 @@ When designing APIs, provide:
 ## Knowledge Reference
 
 REST architecture, OpenAPI 3.1, GraphQL, HTTP semantics, JSON:API, HATEOAS, OAuth 2.0, JWT, RFC 7807 Problem Details, API versioning patterns, pagination strategies, rate limiting, webhook design, SDK generation
-
-## Related Powers
-
-- **GraphQL Architect** - GraphQL-specific API design
-- **FastAPI Expert** - Python API implementation
-- **NestJS Expert** - TypeScript API implementation
-- **Spring Boot Engineer** - Java API implementation
-- **Security Reviewer** - API security assessment

package/workflows/workflows/agent-environment-setup/platforms/windsurf/skills/api-patterns/SKILL.md

@@ -19,16 +19,16 @@ allowed-tools: Read, Write, Edit, Glob, Grep
 
 | File | Description | When to Read |
 |------|-------------|--------------|
-| `api-style.md` | REST vs GraphQL vs tRPC decision tree | Choosing API type |
-| `rest.md` | Resource naming, HTTP methods, status codes | Designing REST API |
-| `response.md` | Envelope pattern, error format, pagination | Response structure |
-| `graphql.md` | Schema design, when to use, security | Considering GraphQL |
-| `trpc.md` | TypeScript monorepo, type safety | TS fullstack projects |
-| `versioning.md` | URI/Header/Query versioning | API evolution planning |
-| `auth.md` | JWT, OAuth, Passkey, API Keys | Auth pattern selection |
-| `rate-limiting.md` | Token bucket, sliding window | API protection |
-| `documentation.md` | OpenAPI/Swagger best practices | Documentation |
-| `security-testing.md` | OWASP API Top 10, auth/authz testing | Security audits |
+| `references/api-style.md` | REST vs GraphQL vs tRPC decision tree | Choosing API type |
+| `references/rest.md` | Resource naming, HTTP methods, status codes | Designing REST API |
+| `references/response.md` | Envelope pattern, error format, pagination | Response structure |
+| `references/graphql.md` | Schema design, when to use, security | Considering GraphQL |
+| `references/trpc.md` | TypeScript monorepo, type safety | TS fullstack projects |
+| `references/versioning.md` | URI/Header/Query versioning | API evolution planning |
+| `references/auth.md` | JWT, OAuth, Passkey, API Keys | Auth pattern selection |
+| `references/rate-limiting.md` | Token bucket, sliding window | API protection |
+| `references/documentation.md` | OpenAPI/Swagger best practices | Documentation |
+| `references/security-testing.md` | OWASP API Top 10, auth/authz testing | Security audits |
 
 ---
 
@@ -78,4 +78,3 @@ Before designing an API:
 | Script | Purpose | Command |
 |--------|---------|---------|
 | `scripts/api_validator.py` | API endpoint validation | `python scripts/api_validator.py <project_path>` |
-

package/workflows/workflows/agent-environment-setup/platforms/windsurf/skills/app-builder/SKILL.md

@@ -14,11 +14,11 @@ allowed-tools: Read, Write, Edit, Glob, Grep, Bash, Agent
 
 | File | Description | When to Read |
 |------|-------------|--------------|
-| `project-detection.md` | Keyword matrix, project type detection | Starting new project |
-| `tech-stack.md` | 2026 default stack, alternatives | Choosing technologies |
-| `agent-coordination.md` | Agent pipeline, execution order | Coordinating multi-agent work |
-| `scaffolding.md` | Directory structure, core files | Creating project structure |
-| `feature-building.md` | Feature analysis, error handling | Adding features to existing project |
+| `references/project-detection.md` | Keyword matrix, project type detection | Starting new project |
+| `references/tech-stack.md` | 2026 default stack, alternatives | Choosing technologies |
+| `references/agent-coordination.md` | Agent pipeline, execution order | Coordinating multi-agent work |
+| `references/scaffolding.md` | Directory structure, core files | Creating project structure |
+| `references/feature-building.md` | Feature analysis, error handling | Adding features to existing project |
 | `templates/SKILL.md` | **Project templates** | Scaffolding new project |
 
 ---

package/workflows/workflows/agent-environment-setup/platforms/windsurf/skills/architecture-designer/SKILL.md

@@ -75,9 +75,3 @@ When designing architecture, provide:
 ## Knowledge Reference
 
 Distributed systems, microservices, event-driven architecture, CQRS, DDD, CAP theorem, cloud platforms (AWS, GCP, Azure), containers, Kubernetes, message queues, caching, database design
-
-## Related Powers
-
-- **Fullstack Guardian** - Implementing designs
-- **DevOps Engineer** - Infrastructure implementation
-- **Secure Code Guardian** - Security architecture

package/workflows/workflows/agent-environment-setup/platforms/windsurf/skills/behavioral-modes/SKILL.md

@@ -217,7 +217,7 @@ Modern architectures optimized for agent-to-agent collaboration:
 
 ### 2. 🗺️ PLAN-EXECUTE-CRITIC (PEC)
 Cyclic mode transitions for high-complexity tasks:
-1. **Planner:** Decomposes the task into atomic steps (`task.md`).
+1. **Planner:** Decomposes the task into atomic steps (task handoff or planning artifact).
 2. **Executor:** Performs the actual coding (`IMPLEMENT`).
 3. **Critic:** Reviews the code, performs security and performance checks (`REVIEW`).
 

package/workflows/workflows/agent-environment-setup/platforms/windsurf/skills/brainstorming/SKILL.md

@@ -34,7 +34,7 @@ allowed-tools: Read, Glob, Grep
 
 ## 🧠 Dynamic Question Generation
 
-**⛔ NEVER use static templates.** Read `dynamic-questioning.md` for principles.
+**⛔ NEVER use static templates.** Read `references/dynamic-questioning.md` for principles.
 
 ### Core Principles
 
@@ -73,7 +73,7 @@ allowed-tools: Read, Glob, Grep
 **If Not Specified:** [Default + rationale]
 ```
 
-**For detailed domain-specific question banks and algorithms**, see: `dynamic-questioning.md`
+**For detailed domain-specific question banks and algorithms**, see: `references/dynamic-questioning.md`
 
 ---
 

package/workflows/workflows/agent-environment-setup/platforms/windsurf/skills/cli-developer/SKILL.md

@@ -109,8 +109,8 @@ mycli                           # Root command
 
 | File                 | Load When                                                    |
 | -------------------- | ------------------------------------------------------------ |
-| `design-patterns.md` | Command hierarchy, flags, config layers, plugin architecture |
-| `node-cli.md`        | Commander, Yargs, Inquirer, Chalk, Ora                       |
-| `python-cli.md`      | Typer, Click, argparse, Rich, questionary                    |
-| `go-cli.md`          | Cobra, Viper, Bubble Tea, progress bars                      |
-| `ux-patterns.md`     | Progress indicators, colors, help text, error messages       |
+| `references/design-patterns.md` | Command hierarchy, flags, config layers, plugin architecture |
+| `references/node-cli.md`        | Commander, Yargs, Inquirer, Chalk, Ora                       |
+| `references/python-cli.md`      | Typer, Click, argparse, Rich, questionary                    |
+| `references/go-cli.md`          | Cobra, Viper, Bubble Tea, progress bars                      |
+| `references/ux-patterns.md`     | Progress indicators, colors, help text, error messages       |

package/workflows/workflows/agent-environment-setup/platforms/windsurf/skills/code-documenter/SKILL.md

@@ -81,7 +81,3 @@ Depending on the task, provide:
 ## Knowledge Reference
 
 Google/NumPy/Sphinx docstrings, JSDoc, OpenAPI 3.0/3.1, AsyncAPI, gRPC/protobuf, FastAPI, Django, NestJS, Express, GraphQL, Docusaurus, MkDocs, VitePress, Swagger UI, Redoc, Stoplight
-
-## Related Powers
-
-**Spec Miner** - Informs from code analysis | **Fullstack Guardian** - Documents during implementation | **Code Reviewer** - Checks documentation quality

package/workflows/workflows/agent-environment-setup/platforms/windsurf/skills/code-reviewer/SKILL.md

@@ -82,9 +82,3 @@ Code review report should include:
 ## Knowledge Reference
 
 SOLID, DRY, KISS, YAGNI, design patterns, OWASP Top 10, language idioms, testing patterns
-
-## Related Powers
-
-- **Security Reviewer** - Deep security analysis
-- **Test Master** - Test quality assessment
-- **Architecture Designer** - Design review

package/workflows/workflows/agent-environment-setup/platforms/windsurf/skills/csharp-pro/SKILL.md

@@ -18,6 +18,12 @@ metadata:
 - Refactoring legacy C# into modern, testable architecture.
 - Improving async correctness and operational resilience.
 
+## When not to use
+
+- Frontend-only browser work with no .NET runtime.
+- Database-only tuning where query/schema evidence is the primary task.
+- Tiny scripting tasks better served by existing shell or project tooling.
+
 ## Core workflow
 
 1. Confirm target framework/runtime constraints.
@@ -33,6 +39,24 @@ metadata:
 - Use dependency injection with explicit lifetimes.
 - Keep API contracts versioned and backward-compatible.
 
+## Debugging and observability
+
+- Use structured logs with correlation/request IDs on service boundaries.
+- Keep exception-to-response mapping explicit and non-leaky.
+- Prefer `dotnet test`, analyzers, and targeted traces before speculative rewrites.
+
+## Performance and reliability
+
+- Measure allocation hotspots before changing data structures.
+- Propagate `CancellationToken` through request and worker paths.
+- Bound retries/timeouts explicitly for network and queue work.
+
+## References
+
+| File | Load when |
+| --- | --- |
+| `references/operational-baseline.md` | You need current async, logging, testing, and deployment guardrails for C#/.NET services. |
+
 ## Avoid
 
 - Sync-over-async (`.Result`, `.Wait()`) in request paths.

package/workflows/workflows/agent-environment-setup/platforms/windsurf/skills/csharp-pro/references/operational-baseline.md

@@ -0,0 +1,9 @@
+## Operational baseline
+
+Load when: service-level logging, async boundaries, dependency injection, or production verification need explicit guardrails.
+
+- Keep nullable reference types enabled and treat warnings as design feedback.
+- Use `CancellationToken` in public async APIs and propagate it through external I/O.
+- Prefer structured logging with request/job correlation IDs.
+- Keep transport contracts separate from domain and persistence models.
+- Validate with `dotnet test`, analyzers, and targeted profiling before shipping.

package/workflows/workflows/agent-environment-setup/platforms/windsurf/skills/database-design/SKILL.md

@@ -14,12 +14,12 @@ allowed-tools: Read, Write, Edit, Glob, Grep
 
 | File | Description | When to Read |
 |------|-------------|--------------|
-| `database-selection.md` | PostgreSQL vs Neon vs Turso vs SQLite | Choosing database |
-| `orm-selection.md` | Drizzle vs Prisma vs Kysely | Choosing ORM |
-| `schema-design.md` | Normalization, PKs, relationships | Designing schema |
-| `indexing.md` | Index types, composite indexes | Performance tuning |
-| `optimization.md` | N+1, EXPLAIN ANALYZE | Query optimization |
-| `migrations.md` | Safe migrations, serverless DBs | Schema changes |
+| `references/database-selection.md` | PostgreSQL vs Neon vs Turso vs SQLite | Choosing database |
+| `references/orm-selection.md` | Drizzle vs Prisma vs Kysely | Choosing ORM |
+| `references/schema-design.md` | Normalization, PKs, relationships | Designing schema |
+| `references/indexing.md` | Index types, composite indexes | Performance tuning |
+| `references/optimization.md` | N+1, EXPLAIN ANALYZE | Query optimization |
+| `references/migrations.md` | Safe migrations, serverless DBs | Schema changes |
 
 ---
 

package/workflows/workflows/agent-environment-setup/platforms/windsurf/skills/database-optimizer/SKILL.md

@@ -79,9 +79,3 @@ When optimizing database performance, provide:
 ## Knowledge Reference
 
 PostgreSQL (pg_stat_statements, EXPLAIN ANALYZE, indexes, VACUUM, partitioning), MySQL (slow query log, EXPLAIN, InnoDB, query cache), query optimization, index design, execution plans, configuration tuning, replication, sharding, caching strategies
-
-## Related Powers
-
-- **Backend Developer** - Query pattern optimization
-- **DevOps Engineer** - Infrastructure and resource tuning
-- **Data Engineer** - ETL and analytical query optimization

package/workflows/workflows/agent-environment-setup/platforms/windsurf/skills/database-skills/SKILL.md

@@ -84,7 +84,7 @@ skills/
 
 ## Required flow
 
-1. Read `LATEST_VERSIONS.md` before proposing version-specific behavior.
+1. Read `references/LATEST_VERSIONS.md` before proposing version-specific behavior.
 2. Use engine selection table above to pick the target engine.
 3. Load the target engine `SKILL.md` and relevant `references/*` files — read the ones that match the task (indexing, migrations, replication, etc.).
 4. Provide an optimization or implementation plan that includes:

package/workflows/workflows/agent-environment-setup/platforms/windsurf/skills/design-system-builder/SKILL.md

@@ -140,9 +140,13 @@ When creating/reviewing a component:
 5. **Tests** (widget tests + golden ideas)
 6. **Migration Notes** (how to replace old widgets)
 
-## Steering Files
+## References
 
-- `component_api_guidelines.md` - API design best practices
+Load detailed guidance only when needed.
+
+| File | Load when |
+| --- | --- |
+| `references/component_api_guidelines.md` | Designing or reviewing a component API, variants, theming hooks, or token usage contracts |
 
 ## Templates
 

package/workflows/workflows/agent-environment-setup/platforms/windsurf/skills/error-ux-observability/SKILL.md

@@ -147,12 +147,15 @@ ref.listen(controllerProvider, (prev, next) {
 4. **Log at appropriate levels** (debug/info/warning/error/fatal)
 5. **Include stack traces for errors**
 
-## Steering Files
+## References
 
-- `failure_to_ui.md` - Complete failure-to-message mapping guide
-- `logging_levels.md` - When to use each log level
+Load detailed guidance only when needed.
+
+| File | Load when |
+| --- | --- |
+| `references/failure_to_ui.md` | Mapping backend/domain failures into user-facing messages and screen states |
+| `references/logging_levels.md` | Deciding which log level and structure to use for an event or failure |
 
 ## Templates
 
 - `failure_message_mapper` - Failure to UI message mapper template
-

package/workflows/workflows/agent-environment-setup/platforms/windsurf/skills/fastify-patterns/SKILL.md

@@ -14,7 +14,7 @@ Expert guidance for building high-performance NestJS applications with Fastify a
 
 You are a backend performance specialist with deep expertise in Fastify and NestJS integration. You optimize for throughput, security, and maintainability while leveraging Fastify's plugin architecture.
 
-## When to Use This Power
+## When to Use This Skill
 
 - Setting up NestJS with Fastify adapter
 - Implementing cookie-based session authentication
@@ -150,9 +150,3 @@ await app.register(secureSession, {
 | Requests/sec  | ~17,000 | ~30,000 | ~76% faster |
 | Latency (avg) | 5.8ms   | 3.3ms   | ~43% lower  |
 | Memory        | Higher  | Lower   | ~20% less   |
-
-## Related Powers
-
-- **NestJS Expert** - Core NestJS patterns
-- **Security Reviewer** - Security auditing
-- **DevOps Engineer** - Container deployment

package/workflows/workflows/agent-environment-setup/platforms/windsurf/skills/fix-review/SKILL.md

@@ -158,7 +158,7 @@ See `references/finding-matching.md` for detailed matching strategies.
 
 Generate two outputs:
 
-**1. Report file (`FIX_REVIEW_REPORT.md`):**
+**1. Report file (`FIX_REVIEW_REPORT` markdown artifact):**
 
 ```markdown
 # Fix Review Report

package/workflows/workflows/agent-environment-setup/platforms/windsurf/skills/flutter-code-reviewer/SKILL.md

@@ -166,20 +166,22 @@ Minimum:
 - 1 unit test for failure path
 - Widget test for loading/error/data (or override repo)
 
-See: `steering/testing_expectations.md`
+See: `references/testing_expectations.md`
 
 ---
 
-## Steering Files
+## References
 
-| File                       | Load When                              |
-| -------------------------- | -------------------------------------- |
-| `review_checklist.md`      | Starting a review, categories          |
-| `testing_expectations.md`  | Checking test requirements             |
-| `common-issues.md`         | N+1 queries, magic numbers, patterns   |
-| `feedback-examples.md`     | Writing good feedback                  |
-| `strict-rules.md`          | Enforcing strict review standards      |
+Load detailed guidance only when needed.
+
+| File | Load when |
+| --- | --- |
+| `references/review_checklist.md` | Starting a review and needing the full category-by-category checklist |
+| `references/testing_expectations.md` | Checking whether controller, widget, or regression tests are sufficient |
+| `references/common-issues.md` | Looking for recurring Flutter/Riverpod review smells and anti-patterns |
+| `references/feedback-examples.md` | Writing concise, high-signal review feedback with clear fixes |
+| `references/strict-rules.md` | Applying stricter merge-blocking review standards |
 
 ## Templates
 
-- `review_response.md` - Code review response template
+- `templates/review_response.md` - Code review response template

package/workflows/workflows/agent-environment-setup/platforms/windsurf/skills/flutter-security-reviewer/SKILL.md

@@ -189,16 +189,18 @@ logger.info('User login successful: userId=${user.id}');
 
 ---
 
-## Steering Files
+## References
 
-| File                        | Load When                              |
-| --------------------------- | -------------------------------------- |
-| `secure_storage_policy.md`  | What to store where                    |
-| `network_hardening.md`      | Network security best practices        |
-| `log_redaction.md`          | How to redact sensitive data from logs |
-| `vulnerability-patterns.md` | SQL injection, XSS, IDOR patterns      |
-| `secret-scanning.md`        | Finding hardcoded secrets              |
+Load detailed guidance only when needed.
+
+| File | Load when |
+| --- | --- |
+| `references/secure_storage_policy.md` | Deciding where tokens, credentials, or sensitive user data may be stored |
+| `references/network_hardening.md` | Reviewing TLS, certificate handling, interceptor logging, or retry policy |
+| `references/log_redaction.md` | Redacting PII, tokens, and secrets from logs, analytics, and crash reports |
+| `references/vulnerability-patterns.md` | Checking for common auth, injection, IDOR, or trust-boundary weaknesses |
+| `references/secret-scanning.md` | Hunting for hardcoded secrets or unsafe configuration material |
 
 ## Templates
 
-- `security_review_response.md` - Security review report template
+- `templates/security_review_response.md` - Security review report template

package/workflows/workflows/agent-environment-setup/platforms/windsurf/skills/frontend-design/SKILL.md

@@ -17,13 +17,13 @@ allowed-tools: Read, Write, Edit, Glob, Grep, Bash
 
 | File | Status | When to Read |
 |------|--------|--------------|
-| [ux-psychology.md](ux-psychology.md) | 🔴 **REQUIRED** | Always read first! |
-| [color-system.md](color-system.md) | ⚪ Optional | Color/palette decisions |
-| [typography-system.md](typography-system.md) | ⚪ Optional | Font selection/pairing |
-| [visual-effects.md](visual-effects.md) | ⚪ Optional | Glassmorphism, shadows, gradients |
-| [animation-guide.md](animation-guide.md) | ⚪ Optional | Animation needed |
-| [motion-graphics.md](motion-graphics.md) | ⚪ Optional | Lottie, GSAP, 3D |
-| [decision-trees.md](decision-trees.md) | ⚪ Optional | Context templates |
+| [ux-psychology.md](references/ux-psychology.md) | 🔴 **REQUIRED** | Always read first! |
+| [color-system.md](references/color-system.md) | ⚪ Optional | Color/palette decisions |
+| [typography-system.md](references/typography-system.md) | ⚪ Optional | Font selection/pairing |
+| [visual-effects.md](references/visual-effects.md) | ⚪ Optional | Glassmorphism, shadows, gradients |
+| [animation-guide.md](references/animation-guide.md) | ⚪ Optional | Animation needed |
+| [motion-graphics.md](references/motion-graphics.md) | ⚪ Optional | Lottie, GSAP, 3D |
+| [decision-trees.md](references/decision-trees.md) | ⚪ Optional | Context templates |
 
 > 🔴 **ux-psychology.md = ALWAYS READ. Others = only if relevant.**
 
@@ -188,7 +188,7 @@ All spacing and sizing in multiples of 8:
 3. **Light or dark mode?** (sets foundation)
 4. **ASK USER** if not specified
 
-For detailed color theory: [color-system.md](color-system.md)
+For detailed color theory: [color-system.md](references/color-system.md)
 
 ---
 
@@ -219,7 +219,7 @@ Contrast + Harmony:
 - **Contrast**: Check WCAG requirements
 - **Size**: 16px+ for body on web
 
-For detailed typography: [typography-system.md](typography-system.md)
+For detailed typography: [typography-system.md](references/typography-system.md)
 
 ---
 
@@ -256,7 +256,7 @@ Harmonious gradients:
 └── VARY from project to project radically
 ```
 
-For complete effects guide: [visual-effects.md](visual-effects.md)
+For complete effects guide: [visual-effects.md](references/visual-effects.md)
 
 ---
 
@@ -287,7 +287,7 @@ Duration based on:
 - Respect reduced-motion preference
 - Test on low-end devices
 
-For animation patterns: [animation-guide.md](animation-guide.md), for advanced: [motion-graphics.md](motion-graphics.md)
+For animation patterns: [animation-guide.md](references/animation-guide.md), for advanced: [motion-graphics.md](references/motion-graphics.md)
 
 ---
 
@@ -383,13 +383,13 @@ For EVERY design task:
 
 For deeper guidance on specific areas:
 
-- [color-system.md](color-system.md) - Color theory and selection process
-- [typography-system.md](typography-system.md) - Font pairing and scale decisions
-- [visual-effects.md](visual-effects.md) - Effects principles and techniques
-- [animation-guide.md](animation-guide.md) - Motion design principles
-- [motion-graphics.md](motion-graphics.md) - Advanced: Lottie, GSAP, SVG, 3D, Particles
-- [decision-trees.md](decision-trees.md) - Context-specific templates
-- [ux-psychology.md](ux-psychology.md) - User psychology deep dive
+- [color-system.md](references/color-system.md) - Color theory and selection process
+- [typography-system.md](references/typography-system.md) - Font pairing and scale decisions
+- [visual-effects.md](references/visual-effects.md) - Effects principles and techniques
+- [animation-guide.md](references/animation-guide.md) - Motion design principles
+- [motion-graphics.md](references/motion-graphics.md) - Advanced: Lottie, GSAP, SVG, 3D, Particles
+- [decision-trees.md](references/decision-trees.md) - Context-specific templates
+- [ux-psychology.md](references/ux-psychology.md) - User psychology deep dive
 
 ---