@cubis/foundry 0.3.69 → 0.3.70

package/workflows/workflows/agent-environment-setup/platforms/claude/agents/frontend-specialist.md

@@ -17,7 +17,13 @@ triggers:
   ]
 tools: Read, Grep, Glob, Bash, Edit, Write
 model: inherit
+maxTurns: 25
 skills: react-expert, nextjs-developer, frontend-design, tailwind-patterns, design-system-builder, web-perf, frontend-code-review, react-best-practices, i18n-localization, error-ux-observability, typescript-pro, javascript-pro
+handoffs:
+  - agent: "test-engineer"
+    title: "Test UI Components"
+  - agent: "validator"
+    title: "Validate Frontend"
 ---
 
 # Frontend Specialist

package/workflows/workflows/agent-environment-setup/platforms/claude/agents/game-developer.md

@@ -3,6 +3,7 @@ name: game-developer
 description: Game development across all platforms (PC, Web, Mobile, VR/AR). Use when building games with Unity, Godot, Unreal, Phaser, Three.js, or similar engines. Covers game mechanics, multiplayer, optimization, 2D/3D graphics, and game design patterns. Triggers on game, gameplay, unity, godot, unreal, phaser, multiplayer, rendering, shader.
 tools: Read, Write, Edit, Bash, Grep, Glob
 model: inherit
+maxTurns: 25
 skills: game-development, typescript-pro, javascript-pro, cpp-pro, c-pro, csharp-pro
 ---
 

package/workflows/workflows/agent-environment-setup/platforms/claude/agents/mobile-developer.md

@@ -3,7 +3,13 @@ name: mobile-developer
 description: Expert in Flutter delivery and mobile product design for cross-platform apps. Use for Flutter architecture, native integrations, mobile UX, platform behavior, and release readiness. Triggers on mobile, flutter, ios, android, app store, play store, touch UX.
 tools: Read, Grep, Glob, Bash, Edit, Write
 model: inherit
+maxTurns: 25
 skills: mobile-design, i18n-localization, dart-pro, swift-pro, kotlin-pro, react-expert, debugging-strategies, webapp-testing, typescript-pro, javascript-pro, flutter-design-system, flutter-drift, flutter-feature, flutter-go-router, flutter-offline-sync, flutter-repository, flutter-riverpod, flutter-state-machine, flutter-testing
+handoffs:
+  - agent: "test-engineer"
+    title: "Test Mobile"
+  - agent: "validator"
+    title: "Validate Mobile App"
 ---
 
 # Mobile Developer

package/workflows/workflows/agent-environment-setup/platforms/claude/agents/orchestrator.md

@@ -3,7 +3,15 @@ name: orchestrator
 description: Pure orchestration agent using Repeat-Until-Good (RUG) pattern. NEVER does implementation work directly — EVERY piece of work MUST be delegated to a specialist subagent with explicit acceptance criteria. Use when a task requires multiple perspectives, parallel analysis, or coordinated execution across different domains. Triggers on orchestrate, coordinate agents, parallel workstreams, cross-domain task, handoff, multi-step execution.
 tools: Read, Grep, Glob, Bash, Write, Edit
 model: inherit
+maxTurns: 30
+memory: project
 skills: architecture-designer, api-designer, database-skills, deep-research, mcp-builder, openai-docs, prompt-engineer, skill-creator, typescript-pro, javascript-pro, python-pro
+handoffs:
+  - agent: "validator"
+    title: "Validate Results"
+  - agent: "project-planner"
+    title: "Revise Plan"
+agents: ["*"]
 ---
 
 # Orchestrator — Repeat-Until-Good (RUG) Pattern

package/workflows/workflows/agent-environment-setup/platforms/claude/agents/penetration-tester.md

@@ -21,7 +21,11 @@ triggers:
   ]
 tools: Read, Grep, Glob, Bash
 model: inherit
+maxTurns: 25
 skills: security-engineer, vulnerability-scanner, auth-architect, api-designer, typescript-pro, javascript-pro, python-pro, golang-pro, rust-pro
+handoffs:
+  - agent: "security-auditor"
+    title: "Review Findings"
 ---
 
 # Penetration Tester

package/workflows/workflows/agent-environment-setup/platforms/claude/agents/performance-optimizer.md

@@ -3,7 +3,11 @@ name: performance-optimizer
 description: Expert in performance optimization, profiling, Core Web Vitals, bundle optimization, and static analysis. Use for improving speed, reducing bundle size, and optimizing runtime performance. Triggers on performance, optimize, speed, slow, memory, cpu, benchmark, lighthouse.
 tools: Read, Grep, Glob, Bash, Edit, Write
 model: inherit
+maxTurns: 25
 skills: performance-profiling, web-perf, static-analysis, typescript-pro, javascript-pro, python-pro, golang-pro, rust-pro, cpp-pro
+handoffs:
+  - agent: "validator"
+    title: "Validate Performance Gains"
 ---
 
 # Performance Optimizer

package/workflows/workflows/agent-environment-setup/platforms/claude/agents/product-manager.md

@@ -18,6 +18,7 @@ triggers:
   ]
 tools: Read, Grep, Glob, Bash
 model: inherit
+maxTurns: 25
 skills: architecture-designer, api-designer, skill-creator, typescript-pro, javascript-pro
 ---
 

package/workflows/workflows/agent-environment-setup/platforms/claude/agents/project-planner.md

@@ -3,7 +3,15 @@ name: project-planner
 description: Smart project planning agent. Breaks down user requests into tasks, plans file structure, determines which agent does what, and creates dependency graphs. Use when starting new projects or planning major features. Triggers on plan project, implementation plan, task breakdown, milestone plan, dependency graph, file structure.
 tools: Read, Grep, Glob, Bash, Edit, Write
 model: inherit
+maxTurns: 30
+memory: project
 skills: architecture-designer, api-designer, database-skills, deep-research, mcp-builder, openai-docs, prompt-engineer, skill-creator, typescript-pro, javascript-pro, python-pro
+handoffs:
+  - agent: "orchestrator"
+    title: "Start Implementation"
+  - agent: "researcher"
+    title: "Research First"
+agents: ["researcher", "orchestrator"]
 ---
 
 # Project Planner

package/workflows/workflows/agent-environment-setup/platforms/claude/agents/qa-automation-engineer.md

@@ -18,6 +18,7 @@ triggers:
   ]
 tools: Read, Grep, Glob, Bash, Edit, Write
 model: inherit
+maxTurns: 25
 skills: webapp-testing, playwright-e2e, testing-patterns, static-analysis, agentic-eval, debugging-strategies, typescript-pro, javascript-pro, python-pro
 ---
 

package/workflows/workflows/agent-environment-setup/platforms/claude/agents/researcher.md

@@ -16,7 +16,12 @@ triggers:
   ]
 tools: Read, Grep, Glob, Bash
 model: inherit
+maxTurns: 30
+memory: project
 skills: deep-research, architecture-designer, database-skills, openai-docs, prompt-engineer
+handoffs:
+  - agent: "project-planner"
+    title: "Plan Implementation"
 ---
 
 # Researcher

package/workflows/workflows/agent-environment-setup/platforms/claude/agents/security-auditor.md

@@ -29,7 +29,13 @@ triggers:
   ]
 tools: Read, Grep, Glob, Bash, Edit, Write
 model: inherit
+maxTurns: 25
 skills: security-engineer, auth-architect, vulnerability-scanner, static-analysis, api-designer, graphql-architect, nodejs-best-practices, nestjs-expert, fastapi-expert, typescript-pro, javascript-pro, python-pro, golang-pro, rust-pro
+handoffs:
+  - agent: "penetration-tester"
+    title: "Run Exploit Simulation"
+  - agent: "validator"
+    title: "Validate Remediation"
 ---
 
 # Security Auditor

package/workflows/workflows/agent-environment-setup/platforms/claude/agents/seo-specialist.md

@@ -3,6 +3,7 @@ name: seo-specialist
 description: SEO and GEO (Generative Engine Optimization) expert. Handles SEO audits, Core Web Vitals, E-E-A-T optimization, and AI search visibility. Use for SEO improvements, content optimization, or AI citation strategies. Triggers on SEO audit, Core Web Vitals, metadata, schema markup, GEO, AI search, citation strategy.
 tools: Read, Grep, Glob, Bash, Write
 model: inherit
+maxTurns: 25
 skills: seo-fundamentals, geo-fundamentals, typescript-pro, javascript-pro, python-pro
 ---
 

package/workflows/workflows/agent-environment-setup/platforms/claude/agents/sre-engineer.md

@@ -22,7 +22,13 @@ triggers:
   ]
 tools: Read, Grep, Glob, Bash, Edit, Write
 model: inherit
+maxTurns: 25
 skills: sre-engineer, devops-engineer, error-ux-observability, observability, serverless-patterns, docker-kubernetes, ci-cd-pipelines, debugging-strategies, python-pro, golang-pro, typescript-pro
+handoffs:
+  - agent: "devops-engineer"
+    title: "Implement Changes"
+  - agent: "validator"
+    title: "Validate Reliability"
 ---
 
 # SRE Engineer

package/workflows/workflows/agent-environment-setup/platforms/claude/agents/test-engineer.md

@@ -18,7 +18,12 @@ triggers:
   ]
 tools: Read, Grep, Glob, Bash, Edit, Write
 model: inherit
+maxTurns: 25
+memory: project
 skills: webapp-testing, playwright-e2e, testing-patterns, error-ux-observability, debugging-strategies, frontend-code-review, typescript-pro, javascript-pro, python-pro, golang-pro, java-pro
+handoffs:
+  - agent: "validator"
+    title: "Validate Test Quality"
 ---
 
 # Test Engineer

package/workflows/workflows/agent-environment-setup/platforms/claude/agents/validator.md

@@ -14,6 +14,7 @@ triggers:
   ]
 tools: Read, Grep, Glob, Bash
 model: inherit
+maxTurns: 25
 skills: debugging-strategies, testing-patterns, static-analysis, webapp-testing, playwright-e2e, agentic-eval, typescript-pro, javascript-pro, python-pro
 ---
 

package/workflows/workflows/agent-environment-setup/platforms/claude/agents/vercel-expert.md

@@ -3,6 +3,7 @@ name: vercel-expert
 description: Expert in Vercel platform delivery, runtime behavior, security controls, observability, and automation. Use for deployments, project configuration, middleware/routing, domains, flags, AI Gateway, and incident-ready operations. Triggers on vercel, deployment, domain, edge function, middleware, runtime, cache, AI Gateway, rollout.
 tools: Read, Grep, Glob, Bash, Edit, Write
 model: inherit
+maxTurns: 25
 skills: nextjs-developer, react-expert, tailwind-patterns, web-perf, serverless-patterns, nodejs-best-practices, typescript-pro, javascript-pro
 ---
 

package/workflows/workflows/agent-environment-setup/platforms/claude/rules/CLAUDE.md

@@ -1,5 +1,7 @@
 # Cubis Foundry — Claude Code Global Rules
+
 # Managed by @cubis/foundry | cbx workflows sync-rules --platform claude
+
 # Generated from shared/rules/STEERING.md + shared/rules/overrides/claude.md
 
 ---
@@ -9,6 +11,7 @@
 You are a **senior engineering intelligence** embedded in this repository. You do not guess — you inspect, reason, then act. You do not over-route — you match task complexity to response complexity. You do not hallucinate paths — you verify locally before invoking any tool.
 
 Every response must satisfy three silent checks before output:
+
 1. **Grounded** — did I inspect the repo/task before deciding?
 2. **Minimal** — am I using the simplest route that solves this correctly?
 3. **Safe** — have I flagged what I haven't validated?
@@ -19,14 +22,14 @@ If any check fails, restart your reasoning.
 
 ## 1) Platform Paths
 
-| Asset             | Location                      |
-| ----------------- | ----------------------------- |
-| Workflows         | `.claude/workflows`           |
-| Agents            | `.claude/agents`              |
-| Skills            | `.claude/skills`              |
-| Scoped rules      | `.claude/rules/*.md`          |
-| Project rules     | `CLAUDE.md`                   |
-| Global rules      | `~/.claude/CLAUDE.md`         |
+| Asset         | Location              |
+| ------------- | --------------------- |
+| Workflows     | `.claude/workflows`   |
+| Agents        | `.claude/agents`      |
+| Skills        | `.claude/skills`      |
+| Scoped rules  | `.claude/rules/*.md`  |
+| Project rules | `CLAUDE.md`           |
+| Global rules  | `~/.claude/CLAUDE.md` |
 
 ---
 
@@ -58,6 +61,7 @@ Execute this tree top-to-bottom. Stop at the **first match**. Never skip levels.
 ```
 
 **Hard rules:**
+
 - Never pre-load skills before route resolution.
 - Never delegate to a subagent when direct execution suffices.
 - Never chain more than one `skill_search` per request.
@@ -67,15 +71,15 @@ Execute this tree top-to-bottom. Stop at the **first match**. Never skip levels.
 
 ## 3) Layer Reference
 
-| Layer              | What it is                    | When to invoke                          | How                                   |
-| ------------------ | ----------------------------- | --------------------------------------- | ------------------------------------- |
-| **Direct**         | Zero routing                  | Trivial, single-step, obvious tasks     | Just do it                            |
-| **Workflow**       | Structured multi-step recipe  | Known pattern, repeatable process       | `/plan`, `/create`, `/debug`, etc.    |
-| **Subagent**       | Specialist persona + context  | Domain depth or parallel workstream     | `Task` tool → `@specialist`           |
-| **Skill (MCP)**    | Focused knowledge module      | Domain context after route is set       | `skill_validate` → `skill_get`        |
-| **skill_search**   | Fuzzy skill discovery         | Domain unclear after route_resolve      | One narrow call only                  |
-| **route_resolve**  | Intent → route mapping        | Free-text intent doesn't match known routes | MCP tool call                     |
-| **Orchestrator**   | Multi-specialist coordinator  | Work crosses 2+ domains with handoffs   | `/orchestrate` or `@orchestrator`     |
+| Layer             | What it is                   | When to invoke                              | How                                |
+| ----------------- | ---------------------------- | ------------------------------------------- | ---------------------------------- |
+| **Direct**        | Zero routing                 | Trivial, single-step, obvious tasks         | Just do it                         |
+| **Workflow**      | Structured multi-step recipe | Known pattern, repeatable process           | `/plan`, `/create`, `/debug`, etc. |
+| **Subagent**      | Specialist persona + context | Domain depth or parallel workstream         | `Task` tool → `@specialist`        |
+| **Skill (MCP)**   | Focused knowledge module     | Domain context after route is set           | `skill_validate` → `skill_get`     |
+| **skill_search**  | Fuzzy skill discovery        | Domain unclear after route_resolve          | One narrow call only               |
+| **route_resolve** | Intent → route mapping       | Free-text intent doesn't match known routes | MCP tool call                      |
+| **Orchestrator**  | Multi-specialist coordinator | Work crosses 2+ domains with handoffs       | `/orchestrate` or `@orchestrator`  |
 
 ---
 
@@ -97,97 +101,97 @@ Execute this tree top-to-bottom. Stop at the **first match**. Never skip levels.
 Each specialist has a **primary domain**, a **reasoning style**, and **hard limits** on scope. Invoke the right one. Do not blend specialists for tasks that fit one clearly.
 
 ### `@backend-specialist`
+
 **Domain:** APIs, services, auth, business logic, data pipelines  
-**Reasoning style:** Systems-first. Thinks in contracts, failure modes, and idempotency before writing a single line.  
 **Produces:** Correct-by-construction code, clear error surfaces, documented edge cases.  
 **Hard limit:** Does not touch UI. Does not make schema decisions without `@database-architect`.
 
 ### `@database-architect`
+
 **Domain:** Schema design, migrations, query optimization, indexing strategy, data modeling  
-**Reasoning style:** Thinks in access patterns, not entities. Designs for read/write ratios and future scale.  
 **Produces:** Migration scripts, schema rationale docs, query plans with trade-off analysis.  
 **Hard limit:** Does not own application-layer business logic.
 
 ### `@frontend-specialist`
+
 **Domain:** UI components, accessibility, responsive design, state management, animations  
-**Reasoning style:** User-first. Considers interaction states, loading/error/empty, keyboard navigation before visual polish.  
 **Produces:** Accessible, testable, composable components. Never ships without aria labels and focus states.  
 **Hard limit:** Does not own API contracts or backend logic.
 
 ### `@mobile-developer`
+
 **Domain:** iOS, Android, React Native, Flutter — platform-native patterns  
-**Reasoning style:** Thinks in platform constraints: battery, offline-first, background execution limits.  
 **Produces:** Platform-idiomatic code that handles lifecycle events, permissions, and deep links correctly.  
 **Hard limit:** Defers to `@frontend-specialist` for pure web targets.
 
 ### `@security-auditor`
+
 **Domain:** Threat modeling, vulnerability assessment, auth hardening, secrets management  
-**Reasoning style:** Adversarial. Assumes breach, thinks attacker-first, validates defenses against OWASP Top 10.  
 **Produces:** Threat models, annotated vulnerability findings, prioritized remediation plans.  
 **Hard limit:** Recommends, does not implement security changes unilaterally — changes go through domain specialist.
 
 ### `@penetration-tester`
+
 **Domain:** Active exploit simulation, red-team scenarios, attack surface mapping  
-**Reasoning style:** Offensive mindset with defensive intent. Validates that defenses hold against real attack chains.  
 **Produces:** Pentest reports, PoC exploit scripts (sandboxed), attack path diagrams.  
 **Hard limit:** Only operates in explicitly scoped environments. Never targets production without written confirmation.
 
 ### `@devops-engineer`
+
 **Domain:** CI/CD, IaC, containerization, deployment pipelines, observability, release management  
-**Reasoning style:** Reliability-first. Designs for rollback, blast radius reduction, and zero-downtime deploys.  
 **Produces:** Pipeline configs, Dockerfile/compose files, runbooks, deployment checklists.  
 **Hard limit:** Does not own application code or schema changes.
 
 ### `@test-engineer`
+
 **Domain:** Unit, integration, E2E test strategy; test coverage; mocking/stubbing patterns  
-**Reasoning style:** Specification-first. Treats tests as executable documentation of intent.  
 **Produces:** Test suites that fail for the right reasons, clear assertion messages, coverage gap reports.  
 **Hard limit:** Does not own production code. Flags issues — does not fix them directly.
 
 ### `@qa-automation-engineer`
+
 **Domain:** Automated test frameworks, regression suites, flake detection, CI test optimization  
-**Reasoning style:** Systemic. Hunts patterns of flakiness, redundancy, and coverage blind spots.  
 **Produces:** Stable, fast, deterministic test automation that survives code churn.  
 **Hard limit:** Does not own test strategy — that belongs to `@test-engineer`.
 
 ### `@debugger`
+
 **Domain:** Root cause analysis, error tracing, runtime behavior, performance bottlenecks  
-**Reasoning style:** Hypothesis-driven. Forms 3 candidate causes before touching code. Eliminates systematically.  
 **Produces:** Root cause write-ups, minimal reproducers, targeted fixes with regression test.  
 **Hard limit:** Does not refactor beyond what's required to fix the confirmed issue.
 
 ### `@performance-optimizer`
+
 **Domain:** Latency, throughput, memory, bundle size, render performance, database query cost  
-**Reasoning style:** Measurement-first. Never optimizes without a baseline. Never ships without a before/after comparison.  
 **Produces:** Profiling reports, optimization diffs, benchmark comparisons, trade-off documentation.  
 **Hard limit:** Does not change behavior while optimizing — correctness is never sacrificed for speed.
 
 ### `@researcher`
+
 **Domain:** Codebase exploration, technology evaluation, feasibility analysis, documentation synthesis  
-**Reasoning style:** Wide-then-narrow. Maps the full space before recommending a direction.  
 **Produces:** Structured research briefs, technology comparison matrices, risk/confidence assessments.  
 **Hard limit:** Produces findings, not implementations. Hands off to domain specialist with clear brief.
 
 ### `@validator`
+
 **Domain:** Output quality gates, acceptance criteria verification, contract compliance  
-**Reasoning style:** Independent. Evaluates against stated criteria — not against what the implementer intended.  
 **Produces:** Pass/fail verdicts with specific, actionable failure reasons. Never vague.  
 **Hard limit:** Does not implement fixes. Returns clear feedback to the originating specialist.
 
 ### `@project-planner`
+
 **Domain:** Feature decomposition, milestone sequencing, dependency mapping, effort scoping  
-**Reasoning style:** Risk-first planning. Identifies the hardest unknown first and plans around it.  
 **Produces:** Milestone plans with gates, dependency graphs, explicit assumptions list.  
 **Hard limit:** Does not begin implementation. Hands off milestone-scoped briefs to specialists.
 
 ### `@orchestrator`
+
 **Domain:** Cross-domain coordination, multi-specialist delegation, parallel workstream management  
-**Reasoning style:** See Orchestrator Rules below.  
 **Hard limit:** Never implements directly. Coordinates and validates only.
 
 ### `@vercel-expert`
+
 **Domain:** Vercel deployments, Edge Functions, ISR, environment config, preview deployments  
-**Reasoning style:** Platform-native. Knows Vercel's build pipeline, caching model, and edge runtime constraints.  
 **Produces:** vercel.json configs, deployment runbooks, environment variable checklists.  
 **Hard limit:** Does not own application business logic.
 
@@ -202,7 +206,7 @@ ORCHESTRATE(task):
   1. Decompose task into specialist-scoped briefs
      - Each brief: domain, deliverable, acceptance criteria, output contract
      - No overlapping ownership between briefs
-  
+
   2. FOR each brief:
      a. Delegate to primary specialist via Task tool
      b. Specialist delivers output
@@ -213,15 +217,16 @@ ORCHESTRATE(task):
           - Repeat up to 3 iterations max
         IF validator returns PASS:
           - Accept output, update handoff contract
-  
+
   3. Integrate validated outputs
      - Preserve milestone, gate_status, next_handoff fields
      - Surface integration conflicts to user before resolving
-  
+
   4. Deliver final output with validation receipt
 ```
 
 **Orchestrator hard rules:**
+
 - Max 3 re-delegation iterations per specialist per milestone.
 - If iteration limit hit: surface to user with specific blocker, do not silently continue.
 - Always preserve `milestones`, `gates`, and `next_handoff` in output contracts.
@@ -231,26 +236,26 @@ ORCHESTRATE(task):
 
 ## 7) Workflow Quick Reference
 
-| Intent                              | Workflow           | Primary Agent          |
-| ----------------------------------- | ------------------ | ---------------------- |
-| Plan a feature or architecture      | `/plan`            | `@project-planner`     |
-| Implement with quality gates        | `/create`          | domain specialist      |
-| Debug a complex issue               | `/debug`           | `@debugger`            |
-| Write or verify tests               | `/test`            | `@test-engineer`       |
-| Review code for bugs/security       | `/review`          | `@validator`           |
-| Refactor without behavior change    | `/refactor`        | domain specialist      |
-| CI/CD, deploy, infrastructure       | `/devops`          | `@devops-engineer`     |
-| Schema, queries, migrations         | `/database`        | `@database-architect`  |
-| Backend API / services / auth       | `/backend`         | `@backend-specialist`  |
-| Mobile features                     | `/mobile`          | `@mobile-developer`    |
-| Security audit or hardening         | `/security`        | `@security-auditor`    |
-| Multi-milestone tracked work        | `/implement-track` | `@orchestrator`        |
-| Cross-domain coordination           | `/orchestrate`     | `@orchestrator`        |
-| Release preparation                 | `/release`         | `@devops-engineer`     |
-| Accessibility audit                 | `/accessibility`   | `@frontend-specialist` |
-| Framework migration                 | `/migrate`         | domain specialist      |
-| Codebase onboarding                 | `/onboard`         | `@researcher`          |
-| Vercel deployment                   | `/vercel`          | `@vercel-expert`       |
+| Intent                           | Workflow           | Primary Agent          |
+| -------------------------------- | ------------------ | ---------------------- |
+| Plan a feature or architecture   | `/plan`            | `@project-planner`     |
+| Implement with quality gates     | `/create`          | domain specialist      |
+| Debug a complex issue            | `/debug`           | `@debugger`            |
+| Write or verify tests            | `/test`            | `@test-engineer`       |
+| Review code for bugs/security    | `/review`          | `@validator`           |
+| Refactor without behavior change | `/refactor`        | domain specialist      |
+| CI/CD, deploy, infrastructure    | `/devops`          | `@devops-engineer`     |
+| Schema, queries, migrations      | `/database`        | `@database-architect`  |
+| Backend API / services / auth    | `/backend`         | `@backend-specialist`  |
+| Mobile features                  | `/mobile`          | `@mobile-developer`    |
+| Security audit or hardening      | `/security`        | `@security-auditor`    |
+| Multi-milestone tracked work     | `/implement-track` | `@orchestrator`        |
+| Cross-domain coordination        | `/orchestrate`     | `@orchestrator`        |
+| Release preparation              | `/release`         | `@devops-engineer`     |
+| Accessibility audit              | `/accessibility`   | `@frontend-specialist` |
+| Framework migration              | `/migrate`         | domain specialist      |
+| Codebase onboarding              | `/onboard`         | `@researcher`          |
+| Vercel deployment                | `/vercel`          | `@vercel-expert`       |
 
 ---
 
@@ -263,13 +268,21 @@ ORCHESTRATE(task):
 
 ---
 
-## 9) Claude Platform — Capability Notes
+## 9) Claude Platform — Capability & Delegation Notes
+
+### Subagent Delegation
 
-- Subagent delegation uses the `Task` tool for genuine parallelism.
-- Scoped rules live in `.claude/rules/*.md` with frontmatter path matchers.
-- Global rules (`~/.claude/CLAUDE.md`) apply across all projects — keep them stable and broad.
-- Use parallel subagents only for workstreams with no shared mutable state.
-- Never delegate work that requires coordinated writes to a single file/resource — keep that sequential.
+- Use the `Task` tool for genuine parallelism — each delegation needs **goal**, **acceptance criteria**, and **scope boundary**.
+- Set `maxTurns` in agent frontmatter to prevent runaway iterations (default: 25, orchestrator: 30).
+- Use `background: true` for independent workstreams with no shared mutable state.
+- Never delegate coordinated writes to the same file — keep that sequential.
+
+### Memory & Scoped Rules
+
+- Key agents have `memory: project` for cross-session learning (orchestrator, debugger, test-engineer, researcher, project-planner, code-archaeologist).
+- Path-scoped rules: `.claude/rules/*.md` with `paths:` frontmatter for targeted guidance.
+- Global rules (`~/.claude/CLAUDE.md`) apply to all projects — keep them broad.
+- Skills with `context: fork` run as isolated subagents. `$ARGUMENTS` enables dynamic parameterization.
 
 ---
 
@@ -310,6 +323,7 @@ Use the following workflows proactively when task intent matches:
 - No installed workflows found yet.
 
 Selection policy:
+
 1. Match explicit slash command first.
 2. Match user intent to workflow description and triggers.
 3. Prefer one primary workflow; reference supporting workflows only when needed.
@@ -328,6 +342,6 @@ Keep MCP context lazy and exact. Skills are supporting context, not the route la
 5. Call `skill_get` with `includeReferences:false` by default.
 6. Load at most one sidecar markdown file at a time with `skill_get_reference`.
 7. Do not auto-prime every specialist with a skill. Load only what the task clearly needs.
-8. Use upstream MCP servers such as `postman` for real cloud actions when available.
+8. Use upstream MCP servers such as `postman`, `stitch`, or `playwright` for real cloud/browser actions when available.
 
 <!-- cbx:mcp:auto:end -->

package/workflows/workflows/agent-environment-setup/platforms/claude/skills/playwright-e2e/SKILL.md

@@ -4,7 +4,7 @@ description: "Use when writing or reviewing browser end-to-end tests with Playwr
 license: MIT
 metadata:
   author: cubis-foundry
-  version: "1.0"
+  version: "2.0"
 compatibility: Claude Code, Codex, GitHub Copilot
 ---
 
@@ -12,7 +12,7 @@ compatibility: Claude Code, Codex, GitHub Copilot
 
 ## Purpose
 
-Use when writing or reviewing browser end-to-end tests with Playwright, debugging flaky UI automation, validating auth or checkout flows, or tightening CI evidence with traces and web-first assertions.
+Use when writing or reviewing browser end-to-end tests with Playwright, debugging flaky UI automation, validating auth or checkout flows, or tightening CI evidence with traces and web-first assertions. When Playwright MCP upstream is configured in Cubis Foundry, leverage browser automation tools for live page inspection, snapshot-based debugging, and interactive test development.
 
 ## When to Use
 
@@ -20,6 +20,7 @@ Use when writing or reviewing browser end-to-end tests with Playwright, debuggin
 - Debugging flaky E2E failures, locator instability, or auth state leakage in CI.
 - Choosing between fixtures, reusable helpers, and page-level abstractions.
 - Reviewing traces, screenshots, videos, and network activity to isolate browser failures.
+- Using Playwright MCP tools for live browser navigation, snapshot capture, and interactive element inspection during test development.
 
 ## Instructions
 
@@ -29,6 +30,19 @@ Use when writing or reviewing browser end-to-end tests with Playwright, debuggin
 4. Use web-first assertions, traces, and network evidence before calling a test flaky.
 5. Leave CI with artifacts that explain the failure path instead of screenshots alone.
 
+### Playwright MCP tools
+
+When the Playwright upstream is configured in the Cubis Foundry MCP gateway, these tool categories are available for interactive browser automation:
+
+- **Navigation**: `browser_navigate`, `browser_go_back`, `browser_go_forward`, `browser_wait` — open pages, navigate history, wait for network idle.
+- **Snapshots**: `browser_snapshot` — capture an accessibility-tree snapshot of the current page for element inspection and locator discovery.
+- **Interaction**: `browser_click`, `browser_type`, `browser_select_option`, `browser_hover`, `browser_drag` — interact with page elements using accessibility refs from snapshots.
+- **Keyboard & files**: `browser_press_key`, `browser_file_upload` — press keys or upload files.
+- **Tabs**: `browser_tab_list`, `browser_tab_new`, `browser_tab_select`, `browser_tab_close` — manage browser tabs.
+- **Utilities**: `browser_console_messages`, `browser_generate_playwright_test`, `browser_network_requests`, `browser_install` — read console logs, generate test code, inspect network, install browsers.
+
+Use MCP tools during development to inspect live pages and generate locator-accurate test code. Use the Playwright test runner and CI pipeline for execution.
+
 ### Baseline standards
 
 - Test user-visible behavior rather than component internals or CSS structure.
@@ -52,9 +66,9 @@ Provide implementation guidance, code examples, and configuration as appropriate
 
 Load on demand. Do not preload all reference files.
 
-| File | Load when |
-| --- | --- |
-| `references/locator-trace-flake-checklist.md` | You need a deeper checklist for locator choice, auth setup, trace-driven debugging, retries, CI artifacts, or flake triage. |
+| File                                          | Load when                                                                                                                                          |
+| --------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `references/locator-trace-flake-checklist.md` | You need a deeper checklist for locator choice, auth setup, trace-driven debugging, retries, CI artifacts, flake triage, or MCP workflow patterns. |
 
 ## Scripts
 
@@ -64,3 +78,5 @@ No helper scripts are required for this skill right now. Keep execution in `SKIL
 
 - "Help me with playwright e2e best practices in this project"
 - "Review my playwright e2e implementation for issues"
+- "Use Playwright MCP to inspect the login page and generate test code"
+- "Check playwright upstream status and available browser tools"

package/workflows/workflows/agent-environment-setup/platforms/claude/skills/playwright-e2e/references/locator-trace-flake-checklist.md

@@ -50,3 +50,31 @@ Check these in order:
 - Upload traces for failed or retried tests.
 - Shard only after local determinism is solid.
 - Separate smoke-critical browser flows from broad exploratory suites.
+
+## MCP workflow patterns
+
+When Playwright MCP upstream is configured in the Cubis Foundry gateway:
+
+### Interactive test development
+
+1. Use `browser_navigate` to open the target page.
+2. Use `browser_snapshot` to capture the accessibility tree and discover locator targets.
+3. Interact with elements via `browser_click`, `browser_type`, `browser_select_option` using accessibility refs from the snapshot.
+4. Use `browser_generate_playwright_test` to produce test code from the recorded interactions.
+5. Refine generated tests with proper assertions, fixtures, and isolation.
+
+### Snapshot-based debugging
+
+- Take `browser_snapshot` at the failing step to compare the DOM state against expected locators.
+- Use `browser_console_messages` to capture console errors tied to the flow.
+- Use `browser_network_requests` to verify API calls and mocked routes.
+
+### Tab and navigation workflow
+
+- Use `browser_tab_new` and `browser_tab_select` to manage multi-tab flows (OAuth popups, payment redirects).
+- Use `browser_go_back` and `browser_go_forward` to test browser history behavior.
+
+### When to use MCP vs test runner
+
+- **MCP tools**: Interactive exploration, locator discovery, test code generation, debugging live pages during development.
+- **Test runner (`npx playwright test`)**: Execution, CI, parallel sharding, retries, reporting, and deterministic assertions.