@cubis/foundry 0.3.67 → 0.3.69

package/workflows/workflows/agent-environment-setup/platforms/claude/workflows/review.md

@@ -1,53 +1,64 @@
 ---
 command: "/review"
-description: "Run a strict review for bugs, regressions, and security issues with prioritized findings."
+description: "Run a strict review for bugs, regressions, accessibility issues, security risk, and code quality with prioritized findings."
 triggers: ["review", "audit", "pr", "quality", "security review"]
 ---
-# Review Workflow
 
-# CHANGED: output contract — converted free-form bullets into structured YAML — keeps findings and remediation guidance machine-readable.
-# CHANGED: skill routing — added `skill-authoring` for skill package audits, metadata review, and sidecar repair work.
+# Review Workflow
 
 ## When to use
-Use this for pull request or branch quality review.
+
+Use this for code review, PR review, or quality audit of existing code changes.
 
 ## Routing
-- Code quality and legacy risk: `@code-archaeologist`
-- Frontend quality: `@frontend-specialist`
-- Security checks: `@security-auditor`
-- Test adequacy: `@test-engineer`
+
+- Primary specialist: `@frontend-specialist` (for frontend code) or `@backend-specialist` (for backend code)
+- Security review: `@security-auditor`
+- Quality validation: `@validator`
+- Verification support: `@test-engineer`
 
 ## Context notes
-- This workflow file, active platform rules, and selected agents/skills guide execution.
-- Attach logs, screenshots, failing output, and relevant paths when context is incomplete.
+
+- This workflow file, active platform rules, and selected agents or skills guide execution.
+- Attach the PR diff, changed files, or specific code paths to review.
 
 ## Skill Routing
-- Primary skills: `code-reviewer`, `security-reviewer`
-- Supporting skills (optional): `skill-authoring`, `semgrep`, `static-analysis`, `variant-analysis`
-- For reviews that target a skill package itself, load `skill-authoring` before general analysis extras.
+
+- Primary skills: `frontend-code-review`, `static-analysis`, `testing-patterns`
+- Supporting skills (optional): `security-engineer`, `vulnerability-scanner`, `web-perf`, `react-expert`, `nextjs-developer`, `typescript-pro`, `javascript-pro`, `python-pro`, `golang-pro`
+- Start with `frontend-code-review` for UI code or `static-analysis` for backend code. Add `testing-patterns` when evaluating test quality. Add `security-engineer` for security-sensitive changes.
 
 ## Workflow steps
-1. Inspect changed behavior and risk surface.
-2. Identify defects by severity.
-3. Validate tests and missing coverage.
-4. Produce actionable remediation guidance.
+
+1. Understand the intent and scope of the changes.
+2. Review for correctness — logic bugs, edge cases, and regressions.
+3. Review for security — input validation, auth, secrets exposure.
+4. Review for accessibility — WCAG compliance, keyboard navigation, screen readers.
+5. Review for performance — unnecessary re-renders, N+1 queries, bundle impact.
+6. Prioritize findings by severity and provide actionable feedback.
 
 ## Verification
-- Run focused checks/tests for the changed scope.
-- Confirm no regressions in adjacent behavior.
-- Note any gaps that were not validated.
+
+- Each finding has severity, location, and suggested fix.
+- Findings prioritized: critical > high > medium > low.
+- Positive observations noted alongside issues.
+- Reviewed against codebase conventions.
 
 ## Output Contract
+
 ```yaml
 REVIEW_WORKFLOW_RESULT:
-  primary_agent: code-archaeologist
-  supporting_agents: [frontend-specialist?, security-auditor?, test-engineer?]
-  primary_skills: [code-reviewer, security-reviewer]
-  supporting_skills: [semgrep?, static-analysis?, variant-analysis?]
+  primary_agent: <frontend-specialist | backend-specialist>
+  supporting_agents: [security-auditor?, validator?, test-engineer?]
+  primary_skills: [frontend-code-review?, static-analysis?, testing-patterns?]
+  supporting_skills: [security-engineer?, vulnerability-scanner?, web-perf?]
   findings:
-    - severity: <critical|high|medium|low>
-      summary: <string>
-      affected_areas: [<path-or-area>]
-      recommended_fix: <string>
-  residual_risks: [<string>] | []
+    - severity: critical | high | medium | low
+      category: correctness | security | accessibility | performance | style
+      location: <file:line>
+      description: <string>
+      suggestion: <string>
+  overall_assessment: approve | request_changes | reject
+  positive_observations: [<string>] | []
+  follow_up_items: [<string>] | []
 ```

package/workflows/workflows/agent-environment-setup/platforms/claude/workflows/security.md

@@ -3,50 +3,65 @@ command: "/security"
 description: "Run security-focused analysis and remediation planning with exploitability-first triage."
 triggers: ["security", "vulnerability", "owasp", "auth", "hardening"]
 ---
-# Security Workflow
 
-# CHANGED: output contract — converted free-form bullets into structured YAML — keeps exploitability triage and remediation evidence machine-readable.
+# Security Workflow
 
 ## When to use
-Use this when the task is primarily about security risk discovery, triage, or remediation.
+
+Use this for security audits, vulnerability assessments, threat modeling, or security-focused code review.
 
 ## Routing
+
 - Primary specialist: `@security-auditor`
-- Exploitability validation: `@penetration-tester`
-- Verification support: `@test-engineer`
+- Offensive assessment: `@penetration-tester`
+- Domain support: `@backend-specialist`, `@frontend-specialist`
+- Verification support: `@validator`
 
 ## Context notes
-- This workflow file, active platform rules, and selected agents/skills guide execution.
-- Attach logs, screenshots, failing output, and relevant paths when context is incomplete.
+
+- This workflow file, active platform rules, and selected agents or skills guide execution.
+- Attach the security scope, threat model, compliance requirements, and relevant code paths.
 
 ## Skill Routing
-- Primary skills: `security-reviewer`, `secure-code-guardian`
-- Supporting skills (optional): `semgrep`, `static-analysis`, `variant-analysis`
+
+- Primary skills: `security-engineer`, `auth-architect`
+- Supporting skills (optional): `vulnerability-scanner`, `static-analysis`, `api-designer`, `graphql-architect`, `typescript-pro`, `javascript-pro`, `python-pro`, `golang-pro`, `rust-pro`
+- Start with `security-engineer` for OWASP methodology and threat modeling. Add `auth-architect` for authentication/authorization review. Add `vulnerability-scanner` for dependency scanning and CVE triage.
 
 ## Workflow steps
-1. Map threat surface and high-risk paths.
-2. Prioritize findings by exploitability and impact.
-3. Propose concrete fixes with least regression risk.
-4. Validate remediation and residual risk.
+
+1. Define security scope and threat model.
+2. Map attack surface and identify input vectors.
+3. Assess code against OWASP Top 10 and relevant standards.
+4. Triage findings by exploitability (reachability × controllability × impact).
+5. Produce remediation plan with prioritized fixes.
+6. Verify remediations do not introduce new vulnerabilities.
 
 ## Verification
-- Run focused checks/tests for the changed scope.
-- Confirm no regressions in adjacent behavior.
-- Note any gaps that were not validated.
+
+- All critical and high findings have remediation plans.
+- Remediation code reviewed for correctness.
+- No new vulnerabilities introduced by fixes.
+- Compliance requirements addressed if applicable.
 
 ## Output Contract
+
 ```yaml
 SECURITY_WORKFLOW_RESULT:
   primary_agent: security-auditor
-  supporting_agents: [penetration-tester?, test-engineer?]
-  primary_skills: [security-reviewer, secure-code-guardian]
-  supporting_skills: [semgrep?, static-analysis?, variant-analysis?]
+  supporting_agents: [penetration-tester?, backend-specialist?, frontend-specialist?, validator?]
+  primary_skills: [security-engineer, auth-architect]
+  supporting_skills: [vulnerability-scanner?, static-analysis?, api-designer?]
+  threat_model:
+    assets: [<string>]
+    threats: [<string>]
+    attack_surface: [<string>]
   findings:
-    - severity: <critical|high|medium|low>
-      summary: <string>
-  fix_plan:
-    - owner: <agent-id>
-      action: <string>
-  verification_evidence: [<string>]
-  residual_risk_notes: [<string>] | []
+    - severity: critical | high | medium | low
+      category: <owasp-category>
+      exploitability: <string>
+      remediation: <string>
+  compliance_notes: [<string>] | []
+  remaining_risks: [<string>] | []
+  follow_up_items: [<string>] | []
 ```

package/workflows/workflows/agent-environment-setup/platforms/claude/workflows/test.md

@@ -1,54 +1,64 @@
 ---
 command: "/test"
-description: "Design and execute verification strategy aligned to risk and acceptance criteria."
+description: "Design and execute verification strategy aligned to user risk, release confidence, and regression evidence."
 triggers: ["test", "verify", "coverage", "qa", "regression"]
 ---
-# Test Workflow
 
-# CHANGED: routing — added explicit verification owners — prevents route manifest fallback to orchestrator for test-focused requests.
-# CHANGED: output contract — converted free-form bullets into structured YAML — keeps test outcomes machine-readable for release gating.
+# Test Workflow
 
 ## When to use
-Use this to drive confidence before merge or release.
+
+Use this when writing new tests, improving coverage, debugging test failures, or designing a testing strategy.
 
 ## Routing
+
 - Primary specialist: `@test-engineer`
-- Automation depth: `@qa-automation-engineer`
-- Failure triage: `@debugger`
+- Automation support: `@qa-automation-engineer`
+- Domain support: `@backend-specialist`, `@frontend-specialist`
+- Verification support: `@validator`
 
 ## Context notes
-- This workflow file, active platform rules, and selected agents/skills guide execution.
-- Attach logs, screenshots, failing output, and relevant paths when context is incomplete.
+
+- This workflow file, active platform rules, and selected agents or skills guide execution.
+- Attach the code under test, existing test files, coverage reports, and any failing test output.
 
 ## Skill Routing
-- Primary skills: `test-master`, `playwright-expert`
-- Supporting skills (optional): `webapp-testing`, `flutter-test-master`
+
+- Primary skills: `testing-patterns`, `webapp-testing`
+- Supporting skills (optional): `playwright-e2e`, `error-ux-observability`, `debugging-strategies`, `frontend-code-review`, `static-analysis`, `typescript-pro`, `javascript-pro`, `python-pro`, `golang-pro`, `java-pro`
+- Start with `testing-patterns` for test strategy and architecture. Add `webapp-testing` for implementation. Add `playwright-e2e` for E2E automation. Add `error-ux-observability` for testing error states.
 
 ## Workflow steps
-1. Map change surface to risk areas.
-2. Choose unit/integration/e2e depth per risk.
-3. Run fast checks first, then broad suite.
-4. Report failures with root-cause direction.
+
+1. Assess current test coverage and identify gaps.
+2. Design test strategy (which layers, what to test, what to skip).
+3. Implement tests with clear arrange/act/assert structure.
+4. Run tests and verify they pass.
+5. Review coverage improvement and remaining gaps.
 
 ## Verification
-- Run focused checks/tests for the changed scope.
-- Confirm no regressions in adjacent behavior.
-- Note any gaps that were not validated.
+
+- All new tests pass reliably (no flakiness).
+- Tests cover the identified risk areas.
+- Coverage metrics improved or maintained.
+- Test naming clearly describes the scenario being verified.
 
 ## Output Contract
+
 ```yaml
 TEST_WORKFLOW_RESULT:
   primary_agent: test-engineer
-  supporting_agents: [qa-automation-engineer?, debugger?]
-  primary_skills: [test-master, playwright-expert]
-  supporting_skills: [webapp-testing?, flutter-test-master?]
-  coverage_map: [<string>]
-  test_results:
-    passed: [<string>]
-    failed: [<string>] | []
-    flaky: [<string>] | []
-  residual_risk: [<string>] | []
-  recommendation: <merge|hold|release-ready|needs-follow-up>
-  next_handoff:
-    plan_handoff: <PLAN_HANDOFF|null>
+  supporting_agents: [qa-automation-engineer?, backend-specialist?, frontend-specialist?, validator?]
+  primary_skills: [testing-patterns, webapp-testing]
+  supporting_skills: [playwright-e2e?, error-ux-observability?, debugging-strategies?]
+  test_strategy:
+    unit: <number of tests>
+    integration: <number of tests>
+    e2e: <number of tests>
+  tests_written: [<test-file-path>]
+  coverage:
+    before: <percentage or description>
+    after: <percentage or description>
+  gaps_remaining: [<string>] | []
+  follow_up_items: [<string>] | []
 ```

package/workflows/workflows/agent-environment-setup/platforms/claude/workflows/vercel.md

@@ -1,51 +1,74 @@
 ---
 command: "/vercel"
 description: "Drive Vercel implementation and operations via vercel-expert with deployment, runtime, security, and observability guardrails."
-triggers: ["vercel", "deployment", "preview", "edge", "functions", "domains", "vercel cli"]
+triggers:
+  [
+    "vercel",
+    "deployment",
+    "preview",
+    "edge",
+    "functions",
+    "domains",
+    "vercel cli",
+  ]
 ---
-# Vercel Workflow
 
-# CHANGED: output contract — converted free-form bullets into structured YAML — keeps Vercel platform changes and rollout notes machine-readable.
+# Vercel Workflow
 
 ## When to use
-Use this workflow when the primary concern is Vercel platform behavior, deployment safety, or Vercel-specific automation.
+
+Use this for Vercel-specific deployment, configuration, runtime optimization, or platform operations.
 
 ## Routing
+
 - Primary specialist: `@vercel-expert`
-- Add `@devops-engineer` for CI/CD and rollout policy design.
-- Add `@security-auditor` for WAF, auth, and network-hardening decisions.
-- Add `@test-engineer` or `@qa-automation-engineer` for release quality gates.
+- Infrastructure support: `@devops-engineer`
+- Verification support: `@test-engineer`
 
 ## Context notes
-- This workflow file, active platform rules, and selected agents/skills guide execution.
-- Attach logs, screenshots, failing output, and relevant paths when context is incomplete.
+
+- This workflow file, active platform rules, and selected agents or skills guide execution.
+- Attach the Vercel project config, deployment target, and any specific Vercel feature requirements.
 
 ## Skill Routing
-- Primary skills: `vercel-platform`, `vercel-runtime`
-- Supporting skills (optional): `vercel-delivery`, `vercel-security`, `vercel-ai`, `vercel-storage`
+
+- Primary skills: `nextjs-developer`, `serverless-patterns`
+- Supporting skills (optional): `web-perf`, `react-expert`, `tailwind-patterns`, `nodejs-best-practices`, `typescript-pro`, `javascript-pro`
+- Start with `nextjs-developer` for Next.js on Vercel and `serverless-patterns` for runtime behavior. Add `web-perf` for performance optimization.
 
 ## Workflow steps
-1. Confirm environment targets, success criteria, and rollback constraints.
-2. Design the smallest Vercel-specific change that solves the issue.
-3. Implement and verify using focused checks with logs/traces evidence.
-4. Summarize risk, residual gaps, and next operational actions.
+
+1. Assess deployment requirements and runtime selection (Edge vs Serverless vs Static).
+2. Configure project settings and environment variables.
+3. Set up deployment pipeline with preview deployments.
+4. Verify deployment health and performance.
+5. Configure monitoring and alerting.
 
 ## Verification
-- Run focused checks/tests for the changed scope.
-- Confirm no regressions in adjacent behavior.
-- Note any gaps that were not validated.
+
+- Deployment successful with no build errors.
+- Runtime selection appropriate for each route.
+- Environment variables correctly configured per environment.
+- Preview deployments working for PRs.
+- Performance metrics within acceptable ranges.
 
 ## Output Contract
+
 ```yaml
 VERCEL_WORKFLOW_RESULT:
   primary_agent: vercel-expert
-  supporting_agents: [devops-engineer?, security-auditor?, test-engineer?, qa-automation-engineer?]
-  primary_skills: [vercel-platform, vercel-runtime]
-  supporting_skills: [vercel-delivery?, vercel-security?, vercel-ai?, vercel-storage?]
-  affected_components: [<string>]
-  deployment_notes: [<string>]
-  rollback_notes: [<string>]
-  security_and_observability_impact: [<string>]
-  verification_evidence: [<string>]
+  supporting_agents: [devops-engineer?, test-engineer?]
+  primary_skills: [nextjs-developer, serverless-patterns]
+  supporting_skills: [web-perf?, react-expert?]
+  deployment:
+    project: <string>
+    runtime: <edge | serverless | static>
+    environment: <development | preview | production>
+    status: success | failure
+  configuration:
+    env_vars: [<string>]
+    domains: [<string>]
+    caching: <string>
+  monitoring: <string>
   follow_up_items: [<string>] | []
 ```