@cubis/foundry 0.3.63 → 0.3.65

package/workflows/workflows/agent-environment-setup/platforms/antigravity/workflows/create.md

@@ -5,16 +5,28 @@ triggers: ["create", "build", "implement", "feature", "develop"]
 ---
 # Create Workflow
 
+# CHANGED: routing — added explicit implementation owners by domain — prevents fallback routing and clarifies which specialist leads execution.
+# CHANGED: output contract — converted free-form bullets into structured YAML — makes create results consumable by downstream workflows.
+# CHANGED: skill routing — added `skill-authoring` as the canonical support skill for skill package work — lets skill creation and repair route cleanly without blind startup search.
+
 ## When to use
 Use this for net-new implementation after design is stable.
 
+## Routing
+- Primary coordinator: `@orchestrator`
+- Backend implementation: `@backend-specialist`
+- Frontend implementation: `@frontend-specialist`
+- Mobile implementation: `@mobile-developer`
+- Verification support: `@test-engineer`
+
 ## Context notes
 - This workflow file, active platform rules, and selected agents/skills guide execution.
 - Attach logs, screenshots, failing output, and relevant paths when context is incomplete.
 
 ## Skill Routing
 - Primary skills: `feature-forge`, `architecture-designer`
-- Supporting skills (optional): `lint-and-validate`, `test-master`
+- Supporting skills (optional): `skill-authoring`, `lint-and-validate`, `test-master`
+- If the task is creating or repairing a skill package, load `skill-authoring` directly before generic supporting skills.
 
 ## Workflow steps
 1. Confirm target files and contracts.
@@ -28,7 +40,21 @@ Use this for net-new implementation after design is stable.
 - Note any gaps that were not validated.
 
 ## Output Contract
-- Changed components/files
-- Behavioral impact
-- Test evidence
-- Follow-up items
+```yaml
+CREATE_WORKFLOW_RESULT:
+  primary_agent_id: "orchestrator"
+  supporting_agent_ids: ["backend-specialist", "frontend-specialist", "mobile-developer", "test-engineer"]
+  primary_skill_ids: ["feature-forge", "architecture-designer"]
+  supporting_skill_ids: ["lint-and-validate", "test-master"]
+  implemented_scope:
+    summary: "Describe the implemented increment"
+    changed_artifacts: ["<path-or-artifact>"]
+  behavioral_impact: ["Describe user-visible or system-level changes"]
+  verification:
+    checks_run: ["<command-or-test>"]
+    evidence: ["Describe the strongest verification evidence"]
+    gaps: []
+  follow_up_items: []
+  next_handoff:
+    plan_handoff: null
+```

package/workflows/workflows/agent-environment-setup/platforms/antigravity/workflows/database.md

@@ -5,6 +5,8 @@ triggers: ["database", "sql", "schema", "migration", "index"]
 ---
 # Database Workflow
 
+# CHANGED: output contract — converted free-form bullets into structured YAML — keeps schema and migration handoffs machine-readable across platforms.
+
 ## When to use
 Use this when data modeling, query quality, migration safety, or database performance is core to the task.
 
@@ -15,7 +17,7 @@ Use this when data modeling, query quality, migration safety, or database perfor
 - Core skill hub: `database-skills`
 - Companion skills: `database-design` (schema/migrations), `database-optimizer` (tuning/triage)
 - Mobile/local persistence companion: `drift-flutter`
-- Power bridge: `workflows/powers/database-skills`
+- Engine references are loaded on-demand through `database-skills` using `skill_validate` and targeted `skill_get_reference`.
 
 ## Context notes
 - This workflow file, active platform rules, and selected agents/skills guide execution.
@@ -24,7 +26,7 @@ Use this when data modeling, query quality, migration safety, or database perfor
 ## Skill Routing
 - Primary skills: `database-skills`, `database-design`
 - Supporting skills (optional): `database-optimizer`
-- Engine packs (sub-skills): `database-skills/postgres`, `database-skills/mysql`, `database-skills/vitess`, `database-skills/neki`, `database-skills/mongodb`, `database-skills/sqlite`, `database-skills/supabase`, `database-skills/redis`
+- Engine references: `postgres`, `mysql`, `vitess`, `neki`, `mongodb`, `sqlite`, `supabase`, `redis`
 
 ## Workflow steps
 1. Confirm data shape, access patterns, and workload size.
@@ -40,9 +42,20 @@ Use this when data modeling, query quality, migration safety, or database perfor
 - Note any gaps that were not validated.
 
 ## Output Contract
-- Schema/query changes
-- Indexing plan
-- Pagination plan
-- Migration + rollback plan
-- Query-plan evidence (`EXPLAIN` or equivalent)
-- Validation evidence
+```yaml
+DATABASE_WORKFLOW_RESULT:
+  primary_agent_id: "database-architect"
+  supporting_agent_ids: ["backend-specialist", "test-engineer"]
+  primary_skill_ids: ["database-skills", "database-design"]
+  supporting_skill_ids: ["database-optimizer"]
+  schema_changes: ["Describe schema changes"]
+  indexing_plan: ["Describe indexes and rationale"]
+  pagination_plan: null
+  migration:
+    required: false
+    plan: ["Describe migration steps"]
+    rollback: ["Describe rollback steps"]
+  evidence:
+    query_plans: ["Summarize explain or engine-native plan evidence"]
+    validation_checks: ["<command-or-test>"]
+```

package/workflows/workflows/agent-environment-setup/platforms/antigravity/workflows/debug.md

@@ -5,9 +5,17 @@ triggers: ["debug", "bug", "error", "incident", "stack trace"]
 ---
 # Debug Workflow
 
+# CHANGED: routing — added explicit debug ownership and supporting specialists — prevents route manifest fallback to orchestrator during bug work.
+# CHANGED: output contract — converted free-form bullets into structured YAML — makes root-cause handoff deterministic.
+
 ## When to use
 Use this when behavior is failing or inconsistent.
 
+## Routing
+- Primary specialist: `@debugger`
+- Domain implementation support: `@backend-specialist`
+- Verification support: `@test-engineer`
+
 ## Context notes
 - This workflow file, active platform rules, and selected agents/skills guide execution.
 - Attach logs, screenshots, failing output, and relevant paths when context is incomplete.
@@ -28,7 +36,19 @@ Use this when behavior is failing or inconsistent.
 - Note any gaps that were not validated.
 
 ## Output Contract
-- Reproduction notes
-- Root cause summary
-- Fix summary
-- Regression checks performed
+```yaml
+DEBUG_WORKFLOW_RESULT:
+  primary_agent: debugger
+  supporting_agents: [backend-specialist?, test-engineer?]
+  primary_skills: [systematic-debugging, find-bugs]
+  supporting_skills: [monitoring-expert?, error-ux-observability?]
+  reproduction:
+    steps: [<string>]
+    expected_vs_actual: <string>
+  root_cause: <string>
+  remediation:
+    summary: <string>
+    changed_artifacts: [<path-or-artifact>]
+  regression_checks: [<command or test>]
+  follow_up_items: [<string>] | []
+```

package/workflows/workflows/agent-environment-setup/platforms/antigravity/workflows/devops.md

@@ -5,6 +5,8 @@ triggers: ["devops", "deploy", "ci", "cd", "rollback", "infra"]
 ---
 # DevOps Workflow
 
+# CHANGED: output contract — converted free-form bullets into structured YAML — keeps rollout and rollback planning machine-readable.
+
 ## When to use
 Use this when deployment pipeline, infrastructure, or release execution is the main scope.
 
@@ -33,7 +35,15 @@ Use this when deployment pipeline, infrastructure, or release execution is the m
 - Note any gaps that were not validated.
 
 ## Output Contract
-- Deployment plan
-- Rollback conditions
-- Validation and observability checks
-- Outstanding operational risks
+```yaml
+DEVOPS_WORKFLOW_RESULT:
+  primary_agent: devops-engineer
+  supporting_agents: [security-auditor?, test-engineer?]
+  primary_skills: [devops-engineer, sre-engineer]
+  supporting_skills: [monitoring-expert?, terraform-engineer?, wrangler?]
+  deployment_plan: [<string>]
+  rollback_conditions: [<string>]
+  validation_checks: [<command or test>]
+  observability_checks: [<string>]
+  outstanding_operational_risks: [<string>] | []
+```

package/workflows/workflows/agent-environment-setup/platforms/antigravity/workflows/implement-track.md

@@ -5,9 +5,17 @@ triggers: ["track", "milestone", "delivery", "progress", "execution"]
 ---
 # Implement Track Workflow
 
+# CHANGED: routing — added explicit milestone coordination owners — prevents generic fallback and clarifies who runs long execution tracks.
+# CHANGED: output contract — converted free-form bullets into structured YAML — keeps milestone state machine-readable for resumability.
+
 ## When to use
 Use this for medium/large efforts where progress visibility is required.
 
+## Routing
+- Primary coordinator: `@orchestrator`
+- Milestone planning: `@project-planner`
+- Verification gates: `@test-engineer`
+
 ## Context notes
 - This workflow file, active platform rules, and selected agents/skills guide execution.
 - Attach logs, screenshots, failing output, and relevant paths when context is incomplete.
@@ -29,7 +37,20 @@ Use this for medium/large efforts where progress visibility is required.
 - Note any gaps that were not validated.
 
 ## Output Contract
-- Milestone board (done/in-progress/next)
-- Gate status
-- Blockers and dependencies
-- ETA confidence
+```yaml
+IMPLEMENT_TRACK_WORKFLOW_RESULT:
+  primary_agent: orchestrator
+  supporting_agents: [project-planner?, test-engineer?]
+  primary_skills: [plan-writing, feature-forge]
+  supporting_skills: [lint-and-validate?, test-master?]
+  milestones:
+    done: [<string>]
+    in_progress: [<string>]
+    next: [<string>]
+  gate_status: [<string>]
+  blockers: [<string>] | []
+  dependencies: [<string>] | []
+  eta_confidence: <low|medium|high>
+  next_handoff:
+    plan_handoff: <PLAN_HANDOFF|null>
+```

package/workflows/workflows/agent-environment-setup/platforms/antigravity/workflows/incident.md

@@ -5,6 +5,8 @@ triggers: ["incident", "outage", "sev", "degraded", "hotfix"]
 ---
 # Incident Workflow
 
+# CHANGED: output contract — converted free-form bullets into structured YAML — keeps incident mitigation and follow-up data structured for resumability.
+
 ## When to use
 Use this for active or recent production incidents.
 
@@ -36,7 +38,15 @@ Use this for active or recent production incidents.
 - Note any gaps that were not validated.
 
 ## Output Contract
-- Incident timeline
-- Mitigation actions
-- Root cause statement
-- Follow-up prevention tasks
+```yaml
+INCIDENT_WORKFLOW_RESULT:
+  primary_agent_id: "backend-specialist"
+  escalation_agent_ids: ["debugger", "database-architect", "security-auditor", "test-engineer", "devops-engineer"]
+  primary_skill_ids: ["systematic-debugging", "sre-engineer"]
+  supporting_skill_ids: ["monitoring-expert", "security-reviewer"]
+  incident_timeline: ["Summarize sequence of impact, detection, mitigation, and recovery"]
+  mitigation_actions: ["Describe mitigation steps taken"]
+  root_cause: "Describe confirmed or best-supported root cause"
+  durable_fix: null
+  follow_up_prevention_tasks: ["Describe prevention and hardening actions"]
+```

package/workflows/workflows/agent-environment-setup/platforms/antigravity/workflows/mobile.md

@@ -5,6 +5,8 @@ triggers: ["mobile", "flutter", "ios", "android", "navigation"]
 ---
 # Mobile Workflow
 
+# CHANGED: output contract — converted free-form bullets into structured YAML — keeps mobile flow changes and readiness notes machine-readable.
+
 ## When to use
 Use this when mobile app architecture, UX behavior, or platform constraints are the focus.
 
@@ -33,7 +35,14 @@ Use this when mobile app architecture, UX behavior, or platform constraints are
 - Note any gaps that were not validated.
 
 ## Output Contract
-- Mobile flow changes
-- Platform constraints handled
-- Test coverage summary
-- Release-readiness notes
+```yaml
+MOBILE_WORKFLOW_RESULT:
+  primary_agent: mobile-developer
+  supporting_agents: [frontend-specialist?, test-engineer?]
+  primary_skills: [mobile-design, flutter-expert]
+  supporting_skills: [riverpod-3?, drift-flutter?, flutter-test-master?]
+  flow_changes: [<string>]
+  platform_constraints_handled: [<string>]
+  test_coverage_summary: [<string>]
+  release_readiness_notes: [<string>] | []
+```

package/workflows/workflows/agent-environment-setup/platforms/antigravity/workflows/orchestrate.md

@@ -5,6 +5,9 @@ triggers: ["orchestrate", "coordinate", "multi-area", "cross-team", "handoff"]
 ---
 # Orchestrate Workflow
 
+# CHANGED: output contract — converted free-form bullets into structured YAML — keeps multi-workstream coordination deterministic across regenerated platforms.
+# CHANGED: skill routing — added `skill-authoring` when orchestration spans canonical skill edits, generator updates, and platform parity work.
+
 ## When to use
 Use this when a task spans backend, frontend, data, testing, and release concerns.
 
@@ -30,7 +33,8 @@ Use this when a task spans backend, frontend, data, testing, and release concern
 
 ## Skill Routing
 - Primary skills: `parallel-agents`, `architecture-designer`
-- Supporting skills (optional): `plan-writing`, `feature-forge`
+- Supporting skills (optional): `plan-writing`, `feature-forge`, `skill-authoring`
+- When the workstream includes skill package changes across multiple platforms, load `skill-authoring` as the first supporting skill.
 
 ## Verification
 - Run focused checks/tests for the changed scope.
@@ -38,8 +42,19 @@ Use this when a task spans backend, frontend, data, testing, and release concern
 - Note any gaps that were not validated.
 
 ## Output Contract
-- Scope and assumptions
-- Workstreams with owner + deliverable
-- Consolidated execution order
-- Test and rollout gates
-- Open risks and mitigations
+```yaml
+ORCHESTRATE_WORKFLOW_RESULT:
+  primary_agent: orchestrator
+  supporting_agents: [backend-specialist?, database-architect?, frontend-specialist?, security-auditor?, test-engineer?, devops-engineer?]
+  primary_skills: [parallel-agents, architecture-designer]
+  supporting_skills: [plan-writing?, feature-forge?]
+  scope_and_assumptions: [<string>]
+  workstreams:
+    - owner: <agent-id>
+      deliverable: <string>
+  execution_order: [<string>]
+  gates:
+    test: [<string>]
+    rollout: [<string>]
+  open_risks: [<string>] | []
+```

package/workflows/workflows/agent-environment-setup/platforms/antigravity/workflows/plan.md

@@ -5,16 +5,26 @@ triggers: ["plan", "spec", "design", "roadmap", "acceptance"]
 ---
 # Plan Workflow
 
+# CHANGED: output contract — upgraded to canonical PLAN_HANDOFF schema — lets implementation agents continue task 1→N without re-routing or user restatement.
+# CHANGED: skill routing — added `skill-authoring` as a planning support skill for skill package design and maintenance work.
+
 ## When to use
 Use this when execution needs a stable specification.
 
+## Routing
+- Primary specialist: `@project-planner`
+- Scope clarification: `@product-manager`
+- Architecture review: `@backend-specialist`
+- Verification planning: `@test-engineer`
+
 ## Context notes
 - This workflow file, active platform rules, and selected agents/skills guide execution.
 - Attach logs, screenshots, failing output, and relevant paths when context is incomplete.
 
 ## Skill Routing
 - Primary skills: `plan-writing`, `architecture-designer`
-- Supporting skills (optional): `feature-forge`, `api-designer`
+- Supporting skills (optional): `feature-forge`, `api-designer`, `skill-authoring`
+- When the plan itself is for a skill package, prefer `skill-authoring` as the first supporting skill.
 
 ## Workflow steps
 1. Lock scope and non-goals.
@@ -29,7 +39,25 @@ Use this when execution needs a stable specification.
 - Note any gaps that were not validated.
 
 ## Output Contract
-- Implementation phases
-- API/data/interface details
-- Edge cases and risk matrix
-- Verification and rollout checklist
+```yaml
+PLAN_HANDOFF:
+  tasks:
+    - id: 1
+      title: "Describe the first implementation task"
+      domain: "backend"
+      skill_hint: "api-designer"
+      depends_on: []
+      output_artifact: "path-or-artifact"
+      stop_if_failed: true
+  shared_context:
+    stack: "Describe the target stack"
+    constraints: "List hard requirements and guardrails"
+    active_files: ["path-or-artifact"]
+  execution_mode: "sequential"
+  loaded_skills: ["api-designer"]
+  stop_conditions:
+    - "output_artifact missing AND stop_if_failed: true"
+    - "destructive or irreversible action not in plan"
+    - "required skill missing after 1 skill_search attempt"
+    - "explicit user pause or redirect"
+```

package/workflows/workflows/agent-environment-setup/platforms/antigravity/workflows/postman.md

@@ -5,6 +5,8 @@ triggers: ["postman", "collection", "workspace", "environment", "runcollection",
 ---
 # Postman Workflow
 
+# CHANGED: output contract — converted free-form bullets into structured YAML — keeps workspace/action identifiers machine-readable for follow-on automation.
+
 ## When to use
 Use this when tasks are primarily about Postman workspaces, collections, environments, monitors, mocks, or collection runs.
 
@@ -16,25 +18,57 @@ Use this when tasks are primarily about Postman workspaces, collections, environ
 ## Context notes
 - This workflow file, active platform rules, and selected agents/skills guide execution.
 - Resolve and pass workspace IDs explicitly when tools require them.
-- Prefer MCP tools (`postman.*` or `postman_*`) over manual JSON/CLI fallback unless fallback is explicitly requested by the user.
+- Use direct Postman MCP server tools for real Postman actions (`postman.<tool>` or client-wrapped equivalent such as `mcp__postman__<tool>`).
+- Reserve Foundry `postman_*` tools for status/mode/config only.
+- Prefer direct Postman MCP tools over manual JSON/CLI fallback unless fallback is explicitly requested by the user.
+- Support monitor tasks only when the user explicitly asks for monitor-based cloud execution or monitor validation.
+- Never auto-fallback from `postman.runCollection` failure into `postman.runMonitor`.
+- Recommend Postman CLI as the default secondary path after direct MCP execution fails.
 
 ## Skill Routing
 - Primary skills: `postman`
 - Supporting skills (optional): `api-designer`, `test-master`
 
 ## Workflow steps
-1. Load Postman skill and check integration status (`postman_get_status`).
+1. Load Postman skill and check integration status (`postman_get_status` for config/status only).
 2. Resolve workspace ID (user-provided, configured default, or explicit selection).
-3. Execute required MCP operations (list/create/update/run) with explicit IDs.
-4. Summarize outcomes, failures, and next actions with exact object identifiers.
+3. Execute required direct Postman MCP operations (list/create/update/run) with explicit IDs.
+4. If execution fails, classify the error before suggesting any fallback.
+5. Summarize outcomes, failures, and next actions with exact object identifiers.
 
 ## Verification
 - Confirm requested Postman action completed successfully.
 - Validate response status and key result fields (IDs, counts, failures).
 - Note any skipped steps and required follow-up.
 
+## Failure classification
+
+- `limitBreachedError` or "breached monitoring usage limit":
+  - classify as monitor quota exhaustion
+  - do not retry monitor execution
+  - recommend Postman CLI
+  - direct the user to Postman monitoring usage dashboard
+- `429` or rate-limited API response:
+  - classify as Postman API rate limiting
+  - recommend backoff and lower request burst
+- collection-run timeout without quota/rate-limit signal:
+  - classify as direct MCP/runtime timeout
+  - do not auto-convert to monitor execution
+  - recommend Postman CLI or smaller-scope rerun
+
 ## Output Contract
-- Workspace/context used
-- Actions executed and resulting IDs
-- Pass/fail summary for runs
-- Follow-up or remediation steps
+```yaml
+POSTMAN_WORKFLOW_RESULT:
+  primary_agent: backend-specialist
+  supporting_agents: [security-auditor?, test-engineer?]
+  primary_skills: [postman]
+  supporting_skills: [api-designer?, test-master?]
+  workspace_context: <string>
+  actions_executed:
+    - action: <string>
+      result_id: <string|null>
+  run_summary:
+    passed: <bool|null>
+    failures: [<string>] | []
+  follow_up_steps: [<string>] | []
+```

package/workflows/workflows/agent-environment-setup/platforms/antigravity/workflows/qa.md

@@ -5,6 +5,8 @@ triggers: ["qa", "test", "regression", "automation", "e2e"]
 ---
 # QA Workflow
 
+# CHANGED: output contract — converted free-form bullets into structured YAML — keeps quality strategy and defect findings machine-readable.
+
 ## When to use
 Use this when verification quality and regression prevention are primary concerns.
 
@@ -33,7 +35,17 @@ Use this when verification quality and regression prevention are primary concern
 - Note any gaps that were not validated.
 
 ## Output Contract
-- Test strategy and scope
-- Automation coverage updates
-- Defect findings and severity
-- Confidence and residual risk
+```yaml
+QA_WORKFLOW_RESULT:
+  primary_agent: qa-automation-engineer
+  supporting_agents: [test-engineer?, debugger?]
+  primary_skills: [test-master, playwright-expert]
+  supporting_skills: [webapp-testing?, lint-and-validate?]
+  strategy_and_scope: [<string>]
+  automation_coverage_updates: [<string>]
+  defect_findings:
+    - severity: <critical|high|medium|low>
+      summary: <string>
+  confidence: <low|medium|high>
+  residual_risk: [<string>] | []
+```

package/workflows/workflows/agent-environment-setup/platforms/antigravity/workflows/refactor.md

@@ -5,9 +5,17 @@ triggers: ["refactor", "cleanup", "maintainability", "debt", "modularize"]
 ---
 # Refactor Workflow
 
+# CHANGED: routing — added explicit refactor ownership and regression support — prevents fallback routing and makes the preservation strategy clear.
+# CHANGED: output contract — converted free-form bullets into structured YAML — makes invariant and parity reporting machine-readable.
+
 ## When to use
 Use this for design improvement without intentional behavior changes.
 
+## Routing
+- Primary specialist: `@code-archaeologist`
+- Domain implementation support: `@backend-specialist`
+- Regression verification: `@test-engineer`
+
 ## Context notes
 - This workflow file, active platform rules, and selected agents/skills guide execution.
 - Attach logs, screenshots, failing output, and relevant paths when context is incomplete.
@@ -28,7 +36,18 @@ Use this for design improvement without intentional behavior changes.
 - Note any gaps that were not validated.
 
 ## Output Contract
-- Refactor scope and invariants
-- Structural changes
-- Behavior parity evidence
-- Deferred technical debt items
+```yaml
+REFACTOR_WORKFLOW_RESULT:
+  primary_agent: code-archaeologist
+  supporting_agents: [backend-specialist?, test-engineer?]
+  primary_skills: [refactor, legacy-modernizer]
+  supporting_skills: [architecture-designer?, code-reviewer?]
+  scope:
+    summary: <string>
+    invariants: [<string>]
+  structural_changes: [<string>]
+  behavior_parity_evidence: [<command or test>]
+  deferred_technical_debt: [<string>] | []
+  next_handoff:
+    plan_handoff: <PLAN_HANDOFF|null>
+```

package/workflows/workflows/agent-environment-setup/platforms/antigravity/workflows/release.md

@@ -5,6 +5,8 @@ triggers: ["release", "deploy", "rollout", "ship", "go-live"]
 ---
 # Release Workflow
 
+# CHANGED: output contract — converted free-form bullets into structured YAML — keeps release gates and monitoring plans machine-readable.
+
 ## When to use
 Use this before deployment to production-like environments.
 
@@ -34,7 +36,14 @@ Use this before deployment to production-like environments.
 - Note any gaps that were not validated.
 
 ## Output Contract
-- Release checklist status
-- Rollout strategy
-- Rollback conditions
-- Post-release monitoring plan
+```yaml
+RELEASE_WORKFLOW_RESULT:
+  primary_agent: devops-engineer
+  supporting_agents: [security-auditor?, test-engineer?, product-owner?]
+  primary_skills: [devops-engineer, sre-engineer]
+  supporting_skills: [monitoring-expert?, test-master?]
+  release_checklist_status: [<string>]
+  rollout_strategy: [<string>]
+  rollback_conditions: [<string>]
+  post_release_monitoring_plan: [<string>]
+```

package/workflows/workflows/agent-environment-setup/platforms/antigravity/workflows/review.md

@@ -5,6 +5,9 @@ triggers: ["review", "audit", "pr", "quality", "security review"]
 ---
 # Review Workflow
 
+# CHANGED: output contract — converted free-form bullets into structured YAML — keeps findings and remediation guidance machine-readable.
+# CHANGED: skill routing — added `skill-authoring` for skill package audits, metadata review, and sidecar repair work.
+
 ## When to use
 Use this for pull request or branch quality review.
 
@@ -20,7 +23,8 @@ Use this for pull request or branch quality review.
 
 ## Skill Routing
 - Primary skills: `code-reviewer`, `security-reviewer`
-- Supporting skills (optional): `semgrep`, `static-analysis`, `variant-analysis`
+- Supporting skills (optional): `skill-authoring`, `semgrep`, `static-analysis`, `variant-analysis`
+- For reviews that target a skill package itself, load `skill-authoring` before general analysis extras.
 
 ## Workflow steps
 1. Inspect changed behavior and risk surface.
@@ -34,7 +38,16 @@ Use this for pull request or branch quality review.
 - Note any gaps that were not validated.
 
 ## Output Contract
-- Findings ordered by severity
-- Affected files/areas
-- Recommended fixes
-- Residual risks after fixes
+```yaml
+REVIEW_WORKFLOW_RESULT:
+  primary_agent: code-archaeologist
+  supporting_agents: [frontend-specialist?, security-auditor?, test-engineer?]
+  primary_skills: [code-reviewer, security-reviewer]
+  supporting_skills: [semgrep?, static-analysis?, variant-analysis?]
+  findings:
+    - severity: <critical|high|medium|low>
+      summary: <string>
+      affected_areas: [<path-or-area>]
+      recommended_fix: <string>
+  residual_risks: [<string>] | []
+```

package/workflows/workflows/agent-environment-setup/platforms/antigravity/workflows/security.md

@@ -5,6 +5,8 @@ triggers: ["security", "vulnerability", "owasp", "auth", "hardening"]
 ---
 # Security Workflow
 
+# CHANGED: output contract — converted free-form bullets into structured YAML — keeps exploitability triage and remediation evidence machine-readable.
+
 ## When to use
 Use this when the task is primarily about security risk discovery, triage, or remediation.
 
@@ -33,7 +35,18 @@ Use this when the task is primarily about security risk discovery, triage, or re
 - Note any gaps that were not validated.
 
 ## Output Contract
-- Findings by severity
-- Fix plan with owners
-- Verification evidence
-- Residual risk notes
+```yaml
+SECURITY_WORKFLOW_RESULT:
+  primary_agent: security-auditor
+  supporting_agents: [penetration-tester?, test-engineer?]
+  primary_skills: [security-reviewer, secure-code-guardian]
+  supporting_skills: [semgrep?, static-analysis?, variant-analysis?]
+  findings:
+    - severity: <critical|high|medium|low>
+      summary: <string>
+  fix_plan:
+    - owner: <agent-id>
+      action: <string>
+  verification_evidence: [<string>]
+  residual_risk_notes: [<string>] | []
+```