@cubis/foundry 0.3.64 → 0.3.65

package/workflows/workflows/agent-environment-setup/platforms/claude/workflows/postman.md

@@ -0,0 +1,74 @@
+---
+command: "/postman"
+description: "Execute Postman MCP operations for workspaces, collections, environments, and runs."
+triggers: ["postman", "collection", "workspace", "environment", "runcollection", "monitor", "mock", "api test"]
+---
+# Postman Workflow
+
+# CHANGED: output contract — converted free-form bullets into structured YAML — keeps workspace/action identifiers machine-readable for follow-on automation.
+
+## When to use
+Use this when tasks are primarily about Postman workspaces, collections, environments, monitors, mocks, or collection runs.
+
+## Routing
+- Postman operations and execution: `@backend-specialist`
+- Security/compliance checks on test data: `@security-auditor`
+- Validation quality and assertions: `@test-engineer`
+
+## Context notes
+- This workflow file, active platform rules, and selected agents/skills guide execution.
+- Resolve and pass workspace IDs explicitly when tools require them.
+- Use direct Postman MCP server tools for real Postman actions (`postman.<tool>` or client-wrapped equivalent such as `mcp__postman__<tool>`).
+- Reserve Foundry `postman_*` tools for status/mode/config only.
+- Prefer direct Postman MCP tools over manual JSON/CLI fallback unless fallback is explicitly requested by the user.
+- Support monitor tasks only when the user explicitly asks for monitor-based cloud execution or monitor validation.
+- Never auto-fallback from `postman.runCollection` failure into `postman.runMonitor`.
+- Recommend Postman CLI as the default secondary path after direct MCP execution fails.
+
+## Skill Routing
+- Primary skills: `postman`
+- Supporting skills (optional): `api-designer`, `test-master`
+
+## Workflow steps
+1. Load Postman skill and check integration status (`postman_get_status` for config/status only).
+2. Resolve workspace ID (user-provided, configured default, or explicit selection).
+3. Execute required direct Postman MCP operations (list/create/update/run) with explicit IDs.
+4. If execution fails, classify the error before suggesting any fallback.
+5. Summarize outcomes, failures, and next actions with exact object identifiers.
+
+## Verification
+- Confirm requested Postman action completed successfully.
+- Validate response status and key result fields (IDs, counts, failures).
+- Note any skipped steps and required follow-up.
+
+## Failure classification
+
+- `limitBreachedError` or "breached monitoring usage limit":
+  - classify as monitor quota exhaustion
+  - do not retry monitor execution
+  - recommend Postman CLI
+  - direct the user to Postman monitoring usage dashboard
+- `429` or rate-limited API response:
+  - classify as Postman API rate limiting
+  - recommend backoff and lower request burst
+- collection-run timeout without quota/rate-limit signal:
+  - classify as direct MCP/runtime timeout
+  - do not auto-convert to monitor execution
+  - recommend Postman CLI or smaller-scope rerun
+
+## Output Contract
+```yaml
+POSTMAN_WORKFLOW_RESULT:
+  primary_agent: backend-specialist
+  supporting_agents: [security-auditor?, test-engineer?]
+  primary_skills: [postman]
+  supporting_skills: [api-designer?, test-master?]
+  workspace_context: <string>
+  actions_executed:
+    - action: <string>
+      result_id: <string|null>
+  run_summary:
+    passed: <bool|null>
+    failures: [<string>] | []
+  follow_up_steps: [<string>] | []
+```

package/workflows/workflows/agent-environment-setup/platforms/claude/workflows/qa.md

@@ -0,0 +1,51 @@
+---
+command: "/qa"
+description: "Create and execute quality strategy with automation and regression-focused coverage."
+triggers: ["qa", "test", "regression", "automation", "e2e"]
+---
+# QA Workflow
+
+# CHANGED: output contract — converted free-form bullets into structured YAML — keeps quality strategy and defect findings machine-readable.
+
+## When to use
+Use this when verification quality and regression prevention are primary concerns.
+
+## Routing
+- Primary specialist: `@qa-automation-engineer`
+- Test strategy support: `@test-engineer`
+- Bug investigation support: `@debugger`
+
+## Context notes
+- This workflow file, active platform rules, and selected agents/skills guide execution.
+- Attach logs, screenshots, failing output, and relevant paths when context is incomplete.
+
+## Skill Routing
+- Primary skills: `test-master`, `playwright-expert`
+- Supporting skills (optional): `webapp-testing`, `lint-and-validate`
+
+## Workflow steps
+1. Identify risk-heavy user journeys.
+2. Define automation + manual checks where needed.
+3. Execute validation and triage failures.
+4. Report confidence level and remaining gaps.
+
+## Verification
+- Run focused checks/tests for the changed scope.
+- Confirm no regressions in adjacent behavior.
+- Note any gaps that were not validated.
+
+## Output Contract
+```yaml
+QA_WORKFLOW_RESULT:
+  primary_agent: qa-automation-engineer
+  supporting_agents: [test-engineer?, debugger?]
+  primary_skills: [test-master, playwright-expert]
+  supporting_skills: [webapp-testing?, lint-and-validate?]
+  strategy_and_scope: [<string>]
+  automation_coverage_updates: [<string>]
+  defect_findings:
+    - severity: <critical|high|medium|low>
+      summary: <string>
+  confidence: <low|medium|high>
+  residual_risk: [<string>] | []
+```

package/workflows/workflows/agent-environment-setup/platforms/claude/workflows/refactor.md

@@ -0,0 +1,53 @@
+---
+command: "/refactor"
+description: "Improve maintainability while preserving behavior through incremental safe refactoring."
+triggers: ["refactor", "cleanup", "maintainability", "debt", "modularize"]
+---
+# Refactor Workflow
+
+# CHANGED: routing — added explicit refactor ownership and regression support — prevents fallback routing and makes the preservation strategy clear.
+# CHANGED: output contract — converted free-form bullets into structured YAML — makes invariant and parity reporting machine-readable.
+
+## When to use
+Use this for design improvement without intentional behavior changes.
+
+## Routing
+- Primary specialist: `@code-archaeologist`
+- Domain implementation support: `@backend-specialist`
+- Regression verification: `@test-engineer`
+
+## Context notes
+- This workflow file, active platform rules, and selected agents/skills guide execution.
+- Attach logs, screenshots, failing output, and relevant paths when context is incomplete.
+
+## Skill Routing
+- Primary skills: `refactor`, `legacy-modernizer`
+- Supporting skills (optional): `architecture-designer`, `code-reviewer`
+
+## Workflow steps
+1. Define behavior invariants and guardrails.
+2. Isolate refactor slices with low coupling.
+3. Apply changes incrementally with tests.
+4. Confirm behavior parity and performance baseline.
+
+## Verification
+- Run focused checks/tests for the changed scope.
+- Confirm no regressions in adjacent behavior.
+- Note any gaps that were not validated.
+
+## Output Contract
+```yaml
+REFACTOR_WORKFLOW_RESULT:
+  primary_agent: code-archaeologist
+  supporting_agents: [backend-specialist?, test-engineer?]
+  primary_skills: [refactor, legacy-modernizer]
+  supporting_skills: [architecture-designer?, code-reviewer?]
+  scope:
+    summary: <string>
+    invariants: [<string>]
+  structural_changes: [<string>]
+  behavior_parity_evidence: [<command or test>]
+  deferred_technical_debt: [<string>] | []
+  next_handoff:
+    plan_handoff: <PLAN_HANDOFF|null>
+```

package/workflows/workflows/agent-environment-setup/platforms/claude/workflows/release.md

@@ -0,0 +1,49 @@
+---
+command: "/release"
+description: "Prepare and execute release with rollout guardrails, verification, and rollback plan."
+triggers: ["release", "deploy", "rollout", "ship", "go-live"]
+---
+# Release Workflow
+
+# CHANGED: output contract — converted free-form bullets into structured YAML — keeps release gates and monitoring plans machine-readable.
+
+## When to use
+Use this before deployment to production-like environments.
+
+## Routing
+- Release orchestration: `@devops-engineer`
+- Risk checks: `@security-auditor` + `@test-engineer`
+- Scope/fallback alignment: `@product-owner`
+
+## Context notes
+- This workflow file, active platform rules, and selected agents/skills guide execution.
+- Attach logs, screenshots, failing output, and relevant paths when context is incomplete.
+
+## Skill Routing
+- Primary skills: `devops-engineer`, `sre-engineer`
+- Supporting skills (optional): `monitoring-expert`, `test-master`
+
+## Workflow steps
+1. Confirm release scope and dependencies.
+2. Validate test evidence and readiness gates.
+3. Define rollout strategy and rollback triggers.
+4. Execute release and monitor signals.
+5. Publish release summary and next actions.
+
+## Verification
+- Run focused checks/tests for the changed scope.
+- Confirm no regressions in adjacent behavior.
+- Note any gaps that were not validated.
+
+## Output Contract
+```yaml
+RELEASE_WORKFLOW_RESULT:
+  primary_agent: devops-engineer
+  supporting_agents: [security-auditor?, test-engineer?, product-owner?]
+  primary_skills: [devops-engineer, sre-engineer]
+  supporting_skills: [monitoring-expert?, test-master?]
+  release_checklist_status: [<string>]
+  rollout_strategy: [<string>]
+  rollback_conditions: [<string>]
+  post_release_monitoring_plan: [<string>]
+```

package/workflows/workflows/agent-environment-setup/platforms/claude/workflows/review.md

@@ -0,0 +1,53 @@
+---
+command: "/review"
+description: "Run a strict review for bugs, regressions, and security issues with prioritized findings."
+triggers: ["review", "audit", "pr", "quality", "security review"]
+---
+# Review Workflow
+
+# CHANGED: output contract — converted free-form bullets into structured YAML — keeps findings and remediation guidance machine-readable.
+# CHANGED: skill routing — added `skill-authoring` for skill package audits, metadata review, and sidecar repair work.
+
+## When to use
+Use this for pull request or branch quality review.
+
+## Routing
+- Code quality and legacy risk: `@code-archaeologist`
+- Frontend quality: `@frontend-specialist`
+- Security checks: `@security-auditor`
+- Test adequacy: `@test-engineer`
+
+## Context notes
+- This workflow file, active platform rules, and selected agents/skills guide execution.
+- Attach logs, screenshots, failing output, and relevant paths when context is incomplete.
+
+## Skill Routing
+- Primary skills: `code-reviewer`, `security-reviewer`
+- Supporting skills (optional): `skill-authoring`, `semgrep`, `static-analysis`, `variant-analysis`
+- For reviews that target a skill package itself, load `skill-authoring` before general analysis extras.
+
+## Workflow steps
+1. Inspect changed behavior and risk surface.
+2. Identify defects by severity.
+3. Validate tests and missing coverage.
+4. Produce actionable remediation guidance.
+
+## Verification
+- Run focused checks/tests for the changed scope.
+- Confirm no regressions in adjacent behavior.
+- Note any gaps that were not validated.
+
+## Output Contract
+```yaml
+REVIEW_WORKFLOW_RESULT:
+  primary_agent: code-archaeologist
+  supporting_agents: [frontend-specialist?, security-auditor?, test-engineer?]
+  primary_skills: [code-reviewer, security-reviewer]
+  supporting_skills: [semgrep?, static-analysis?, variant-analysis?]
+  findings:
+    - severity: <critical|high|medium|low>
+      summary: <string>
+      affected_areas: [<path-or-area>]
+      recommended_fix: <string>
+  residual_risks: [<string>] | []
+```

package/workflows/workflows/agent-environment-setup/platforms/claude/workflows/security.md

@@ -0,0 +1,52 @@
+---
+command: "/security"
+description: "Run security-focused analysis and remediation planning with exploitability-first triage."
+triggers: ["security", "vulnerability", "owasp", "auth", "hardening"]
+---
+# Security Workflow
+
+# CHANGED: output contract — converted free-form bullets into structured YAML — keeps exploitability triage and remediation evidence machine-readable.
+
+## When to use
+Use this when the task is primarily about security risk discovery, triage, or remediation.
+
+## Routing
+- Primary specialist: `@security-auditor`
+- Exploitability validation: `@penetration-tester`
+- Verification support: `@test-engineer`
+
+## Context notes
+- This workflow file, active platform rules, and selected agents/skills guide execution.
+- Attach logs, screenshots, failing output, and relevant paths when context is incomplete.
+
+## Skill Routing
+- Primary skills: `security-reviewer`, `secure-code-guardian`
+- Supporting skills (optional): `semgrep`, `static-analysis`, `variant-analysis`
+
+## Workflow steps
+1. Map threat surface and high-risk paths.
+2. Prioritize findings by exploitability and impact.
+3. Propose concrete fixes with least regression risk.
+4. Validate remediation and residual risk.
+
+## Verification
+- Run focused checks/tests for the changed scope.
+- Confirm no regressions in adjacent behavior.
+- Note any gaps that were not validated.
+
+## Output Contract
+```yaml
+SECURITY_WORKFLOW_RESULT:
+  primary_agent: security-auditor
+  supporting_agents: [penetration-tester?, test-engineer?]
+  primary_skills: [security-reviewer, secure-code-guardian]
+  supporting_skills: [semgrep?, static-analysis?, variant-analysis?]
+  findings:
+    - severity: <critical|high|medium|low>
+      summary: <string>
+  fix_plan:
+    - owner: <agent-id>
+      action: <string>
+  verification_evidence: [<string>]
+  residual_risk_notes: [<string>] | []
+```

package/workflows/workflows/agent-environment-setup/platforms/claude/workflows/test.md

@@ -0,0 +1,54 @@
+---
+command: "/test"
+description: "Design and execute verification strategy aligned to risk and acceptance criteria."
+triggers: ["test", "verify", "coverage", "qa", "regression"]
+---
+# Test Workflow
+
+# CHANGED: routing — added explicit verification owners — prevents route manifest fallback to orchestrator for test-focused requests.
+# CHANGED: output contract — converted free-form bullets into structured YAML — keeps test outcomes machine-readable for release gating.
+
+## When to use
+Use this to drive confidence before merge or release.
+
+## Routing
+- Primary specialist: `@test-engineer`
+- Automation depth: `@qa-automation-engineer`
+- Failure triage: `@debugger`
+
+## Context notes
+- This workflow file, active platform rules, and selected agents/skills guide execution.
+- Attach logs, screenshots, failing output, and relevant paths when context is incomplete.
+
+## Skill Routing
+- Primary skills: `test-master`, `playwright-expert`
+- Supporting skills (optional): `webapp-testing`, `flutter-test-master`
+
+## Workflow steps
+1. Map change surface to risk areas.
+2. Choose unit/integration/e2e depth per risk.
+3. Run fast checks first, then broad suite.
+4. Report failures with root-cause direction.
+
+## Verification
+- Run focused checks/tests for the changed scope.
+- Confirm no regressions in adjacent behavior.
+- Note any gaps that were not validated.
+
+## Output Contract
+```yaml
+TEST_WORKFLOW_RESULT:
+  primary_agent: test-engineer
+  supporting_agents: [qa-automation-engineer?, debugger?]
+  primary_skills: [test-master, playwright-expert]
+  supporting_skills: [webapp-testing?, flutter-test-master?]
+  coverage_map: [<string>]
+  test_results:
+    passed: [<string>]
+    failed: [<string>] | []
+    flaky: [<string>] | []
+  residual_risk: [<string>] | []
+  recommendation: <merge|hold|release-ready|needs-follow-up>
+  next_handoff:
+    plan_handoff: <PLAN_HANDOFF|null>
+```

package/workflows/workflows/agent-environment-setup/platforms/claude/workflows/vercel.md

@@ -0,0 +1,51 @@
+---
+command: "/vercel"
+description: "Drive Vercel implementation and operations via vercel-expert with deployment, runtime, security, and observability guardrails."
+triggers: ["vercel", "deployment", "preview", "edge", "functions", "domains", "vercel cli"]
+---
+# Vercel Workflow
+
+# CHANGED: output contract — converted free-form bullets into structured YAML — keeps Vercel platform changes and rollout notes machine-readable.
+
+## When to use
+Use this workflow when the primary concern is Vercel platform behavior, deployment safety, or Vercel-specific automation.
+
+## Routing
+- Primary specialist: `@vercel-expert`
+- Add `@devops-engineer` for CI/CD and rollout policy design.
+- Add `@security-auditor` for WAF, auth, and network-hardening decisions.
+- Add `@test-engineer` or `@qa-automation-engineer` for release quality gates.
+
+## Context notes
+- This workflow file, active platform rules, and selected agents/skills guide execution.
+- Attach logs, screenshots, failing output, and relevant paths when context is incomplete.
+
+## Skill Routing
+- Primary skills: `vercel-platform`, `vercel-runtime`
+- Supporting skills (optional): `vercel-delivery`, `vercel-security`, `vercel-ai`, `vercel-storage`
+
+## Workflow steps
+1. Confirm environment targets, success criteria, and rollback constraints.
+2. Design the smallest Vercel-specific change that solves the issue.
+3. Implement and verify using focused checks with logs/traces evidence.
+4. Summarize risk, residual gaps, and next operational actions.
+
+## Verification
+- Run focused checks/tests for the changed scope.
+- Confirm no regressions in adjacent behavior.
+- Note any gaps that were not validated.
+
+## Output Contract
+```yaml
+VERCEL_WORKFLOW_RESULT:
+  primary_agent: vercel-expert
+  supporting_agents: [devops-engineer?, security-auditor?, test-engineer?, qa-automation-engineer?]
+  primary_skills: [vercel-platform, vercel-runtime]
+  supporting_skills: [vercel-delivery?, vercel-security?, vercel-ai?, vercel-storage?]
+  affected_components: [<string>]
+  deployment_notes: [<string>]
+  rollback_notes: [<string>]
+  security_and_observability_impact: [<string>]
+  verification_evidence: [<string>]
+  follow_up_items: [<string>] | []
+```