@cubis/foundry 0.3.81 → 0.3.83

package/workflows/workflows/agent-environment-setup/platforms/codex/workflows/migrate.md

@@ -1,78 +0,0 @@
----
-command: "/migrate"
-description: "Plan and execute technology migrations, framework upgrades, and dependency updates with rollback safety, incremental verification, and zero-downtime transition."
-triggers:
-  [
-    "migrate",
-    "upgrade",
-    "update dependency",
-    "framework upgrade",
-    "version bump",
-    "major update",
-  ]
----
-
-# Migrate Workflow
-
-## When to use
-
-Use this for technology migrations, framework upgrades, dependency updates, or major version transitions.
-
-## Routing
-
-- Primary specialist: `the code-archaeologist posture`
-- Implementation support: `the backend-specialist posture`, `the frontend-specialist posture`
-- Verification support: `the test-engineer posture`, `the validator posture`
-
-## Context notes
-
-- This workflow file, active platform rules, and selected agents or skills guide execution.
-- Attach the migration target, current versions, breaking change lists, and impact assessment.
-- Read `ENGINEERING_RULES.md` and `TECH.md` first because migrations often change accepted patterns and current-state architecture at the same time.
-
-## Skill Routing
-
-- Primary skills: `system-design`, `system-design`
-- Supporting skills (optional): `code-review`, `unit-testing`, `typescript-best-practices`, `javascript-best-practices`, `python-best-practices`, `golang-best-practices`
-- Start with `system-design` for migration methodology and `system-design` for system impact. Add `code-review` for automated codemod or compatibility analysis.
-
-## Workflow steps
-
-1. Assess current state and migration target.
-2. Map breaking changes and affected code paths.
-3. Plan incremental migration steps with rollback points.
-4. Execute migration one step at a time with verification.
-5. Update tests and documentation for new patterns.
-6. Set `doc_impact` when the migration changes architecture, deployment shape, boundaries, or design-system rules.
-7. Verify full system behavior after migration complete.
-
-## Verification
-
-- All breaking changes addressed.
-- Tests pass on migrated code.
-- Rollback tested at each migration step.
-- No degradation in performance or functionality.
-- Documentation updated for new patterns.
-
-## Output Contract
-
-```yaml
-MIGRATE_WORKFLOW_RESULT:
-  primary_agent: code-archaeologist
-  supporting_agents: [backend-specialist?, frontend-specialist?, test-engineer?, validator?]
-  primary_skills: [system-design, system-design]
-  supporting_skills: [code-review?, unit-testing?]
-  migration:
-    from: <string>
-    to: <string>
-    breaking_changes: [<string>]
-    steps_completed: [<string>]
-    rollback_points: [<string>]
-  verification:
-    tests_passed: true | false
-    performance_impact: <string>
-  doc_impact: none | tech | rules | both
-  follow_up_items: [<string>] | []
-```
-
-> **Codex note:** Prefer native Codex delegation when the host exposes it. Otherwise follow AGENTS.md specialist postures inline while keeping the same routing and verification contract.

package/workflows/workflows/agent-environment-setup/platforms/codex/workflows/mobile.md

@@ -1,71 +0,0 @@
----
-command: "/mobile"
-description: "Drive mobile implementation decisions for Flutter/cross-platform behavior and reliability."
-triggers: ["mobile", "flutter", "ios", "android", "navigation"]
----
-
-# Mobile Workflow
-
-## When to use
-
-Use this for mobile app development, Flutter architecture, Stitch-driven mobile screen handoff, native integrations, or platform-specific behavior.
-
-## Routing
-
-- Primary specialist: `the mobile-developer posture`
-- Design support: `the frontend-specialist posture`
-- Verification support: `the test-engineer posture`
-
-## Context notes
-
-- This workflow file, active platform rules, and selected agents or skills guide execution.
-- Attach platform targets (iOS, Android, both), Flutter version, and relevant screen/feature context.
-- Read `ENGINEERING_RULES.md` and `TECH.md` before implementing non-trivial mobile work so screens and features follow the declared architecture and design-system rules.
-
-## Skill Routing
-
-- Primary skills: `expo-app`, `react-native`
-- Supporting skills (optional): `stitch`, `frontend-design`, `expo-app`, `expo-app`, `expo-app`, `expo-app`, `expo-app`, `expo-app`, `expo-app`, `expo-app`, `expo-app`, `swift-best-practices`, `kotlin-best-practices`
-- Start with `expo-app` for feature implementation and `react-native` for UX patterns. Add framework-specific Flutter skill when applicable. Add `frontend-design` for multi-language support.
-- When the request starts from Stitch artifacts or a design sync, load `stitch` first and then pair it with `react-native` plus the narrowest mobile implementation skill for the target stack.
-
-## Workflow steps
-
-1. Clarify platform targets and feature requirements.
-2. Design architecture with platform-appropriate patterns.
-3. Implement with consideration for iOS/Android differences.
-4. Write widget and integration tests.
-5. Review for platform-specific edge cases and UX conventions.
-6. Set `doc_impact` if the feature changes navigation, shared UI rules, or mobile architecture conventions.
-
-## Verification
-
-- Runs correctly on both target platforms.
-- Platform-specific conventions respected (iOS/Android).
-- Touch targets and gesture feedback appropriate.
-- Widget tests cover core behavior.
-- Offline behavior tested if applicable.
-
-## Output Contract
-
-```yaml
-MOBILE_WORKFLOW_RESULT:
-  primary_agent: mobile-developer
-  supporting_agents: [frontend-specialist?, test-engineer?]
-  primary_skills: [expo-app, react-native]
-  supporting_skills: [stitch?, frontend-design?, expo-app?, expo-app?, <flutter-specific>?]
-  implementation:
-    platforms: [ios, android]
-    architecture_decisions: [<string>]
-    changed_artifacts: [<path>]
-  testing:
-    widget_tests: [<path>]
-    integration_tests: [<path>] | []
-  platform_notes:
-    ios: [<string>] | []
-    android: [<string>] | []
-  doc_impact: none | tech | rules | both
-  follow_up_items: [<string>] | []
-```
-
-> **Codex note:** Prefer native Codex delegation when the host exposes it. Otherwise follow AGENTS.md specialist postures inline while keeping the same routing and verification contract.

package/workflows/workflows/agent-environment-setup/platforms/codex/workflows/onboard.md

@@ -1,72 +0,0 @@
----
-command: "/onboard"
-description: "Survey an unfamiliar codebase, map its architecture, identify patterns and conventions, and produce a structured orientation report for new contributors."
-triggers:
-  [
-    "onboard",
-    "explore codebase",
-    "understand project",
-    "new to this repo",
-    "codebase survey",
-  ]
----
-
-# Onboard Workflow
-
-## When to use
-
-Use this when joining a new project, exploring an unfamiliar codebase, or preparing orientation material.
-
-## Routing
-
-- Primary specialist: `the researcher posture`
-- Architecture mapping: `the code-archaeologist posture`
-- Domain specialists as needed: `the backend-specialist posture`, `the frontend-specialist posture`
-
-## Context notes
-
-- This workflow file, active platform rules, and selected agents or skills guide execution.
-- Provide the repo URL, focus areas, and any specific questions to answer during onboarding.
-- Read `ENGINEERING_RULES.md` first and `TECH.md` next when present so onboarding distinguishes the intended contract from current implementation reality.
-
-## Skill Routing
-
-- Primary skills: `deep-research`, `system-design`
-- Supporting skills (optional): `system-design`, `database-design`, `typescript-best-practices`, `javascript-best-practices`, `python-best-practices`
-- Start with `deep-research` for systematic exploration and `system-design` for architecture mapping. Add `system-design` for undocumented systems. Prefer repo evidence first; use external sources only when setup or dependency behavior cannot be confirmed locally.
-
-## Workflow steps
-
-1. Survey the project structure — directories, entry points, and configuration.
-2. Map the architecture — components, data flow, and integration points.
-3. Identify patterns — naming conventions, design patterns, and coding standards.
-4. Document dependencies — external services, databases, and APIs.
-5. Produce orientation report with development setup instructions.
-
-## Verification
-
-- All major components identified and documented.
-- Development setup instructions verified (can be followed by a newcomer).
-- Architecture diagram or description covers main data flows.
-- Key patterns and conventions explicitly documented.
-
-## Output Contract
-
-```yaml
-ONBOARD_WORKFLOW_RESULT:
-  primary_agent: researcher
-  supporting_agents: [code-archaeologist?, backend-specialist?, frontend-specialist?]
-  primary_skills: [deep-research, system-design]
-  supporting_skills: [system-design?, database-design?]
-  project_overview:
-    purpose: <string>
-    tech_stack: [<string>]
-    architecture: <string>
-  key_components: [<string>]
-  patterns_and_conventions: [<string>]
-  development_setup: [<step>]
-  dependencies: [<string>]
-  knowledge_gaps: [<string>] | []
-```
-
-> **Codex note:** Prefer native Codex delegation when the host exposes it. Otherwise follow AGENTS.md specialist postures inline while keeping the same routing and verification contract.

package/workflows/workflows/agent-environment-setup/platforms/codex/workflows/orchestrate.md

@@ -1,73 +0,0 @@
----
-command: "/orchestrate"
-description: "Coordinate multiple specialists to solve cross-cutting tasks with explicit ownership, validation gates, and repeat-until-good iteration."
-triggers: ["orchestrate", "coordinate", "multi-area", "cross-team", "handoff"]
----
-
-# Orchestrate Workflow
-
-## When to use
-
-Use this when a task spans multiple domains (backend + frontend, security + infrastructure, etc.) and requires coordinated specialist work with validation between steps.
-
-## Routing
-
-- Primary coordinator: `the orchestrator posture`
-- Specialist routing determined by task decomposition — delegates to `the backend-specialist posture`, `the frontend-specialist posture`, `the database-architect posture`, `the security-auditor posture`, `the ci-cd-pipeline posture`, `the test-engineer posture`, `the mobile-developer posture`, or other specialist agents as needed.
-- Validation support: `the validator posture`
-
-## Context notes
-
-- This workflow file, active platform rules, and selected agents or skills guide execution.
-- Attach the full task description, constraints, acceptance criteria, and relevant context when starting.
-- Read `ENGINEERING_RULES.md` and `TECH.md` before decomposing non-trivial work, then reuse any existing `docs/specs/<spec-id>/` pack as the handoff source of truth.
-
-## Skill Routing
-
-- Primary skills: `system-design`, `api-design`
-- Supporting skills (optional): `database-design`, `deep-research`, `mcp-server-builder`, `tech-doc`, `prompt-engineering`, `skill-creator`
-- Start with `system-design` for system design coordination and `api-design` for integration contracts. Add `deep-research` before implementation when the coordination challenge depends on fresh external facts or public comparison.
-
-## Workflow steps
-
-1. Decompose the task into discrete work items with acceptance criteria.
-2. Identify dependencies and determine execution order (DAG).
-3. Delegate each task to the best specialist agent with full context.
-4. Validate each deliverable against acceptance criteria via independent validation.
-5. Iterate on failed validations with specific feedback (max 3 iterations).
-6. Surface `doc_impact` when the coordinated work changes architecture, boundaries, scale, or the design system.
-7. Integrate outputs, verify cross-task consistency, and report results.
-
-## Verification
-
-- Each task validated independently against its acceptance criteria.
-- Cross-task consistency check after integration.
-- Run any applicable automated tests or checks.
-- Final validation pass on combined result.
-
-## Output Contract
-
-```yaml
-ORCHESTRATE_WORKFLOW_RESULT:
-  primary_agent: orchestrator
-  supporting_agents: [<specialist-agents-used>]
-  primary_skills: [system-design, api-design]
-  supporting_skills: [<supporting-skills-used>]
-  spec_id: <string> | null
-  spec_root: docs/specs/<spec-id> | null
-  task_count: <number>
-  completed: <number>
-  failed: <number>
-  tasks:
-    - id: <task-id>
-      agent: <agent-name>
-      status: completed | failed | skipped
-      iterations: <number>
-      validation_evidence: <string>
-  integration_status: clean | conflicts_resolved | issues_remaining
-  doc_impact: none | tech | rules | both
-  remaining_risks: [<string>] | []
-  follow_up_actions: [<string>] | []
-```
-
-> **Codex note:** Prefer native Codex delegation when the host exposes it. Otherwise follow AGENTS.md specialist postures inline while keeping the same routing and verification contract.

package/workflows/workflows/agent-environment-setup/platforms/codex/workflows/plan.md

@@ -1,90 +0,0 @@
----
-command: "/plan"
-description: "Build a decision-complete implementation plan with interfaces, failure modes, and acceptance criteria."
-triggers:
-  [
-    "plan",
-    "design",
-    "roadmap",
-    "acceptance",
-    "brainstorm",
-    "idea",
-    "options",
-    "tradeoff",
-    "approach",
-  ]
----
-
-# Plan Workflow
-
-## When to use
-
-Use this when starting a new feature, project, or significant change that needs a structured implementation plan before coding begins.
-
-## Routing
-
-- Primary coordinator: `the project-planner posture`
-- Architecture support: `the orchestrator posture`
-- Domain validation: `the backend-specialist posture`, `the frontend-specialist posture`, `the database-architect posture`
-
-## Context notes
-
-- This workflow file, active platform rules, and selected agents or skills guide execution.
-- Attach the feature request, problem statement, constraints, and any existing design documents.
-- Read `ENGINEERING_RULES.md` first and `TECH.md` next when they exist before finalizing a non-trivial plan.
-- Reuse an existing `docs/specs/<spec-id>/` pack when the change already has one instead of creating a parallel planning track.
-
-## Skill Routing
-
-- Primary skills: `system-design`, `api-design`
-- Supporting skills (optional): `database-design`, `deep-research`, `mcp-server-builder`, `tech-doc`, `prompt-engineering`, `skill-creator`
-- Start with `system-design` for system design and `api-design` for API contracts. Add `database-design` when data modeling is central, `deep-research` when fresh external knowledge or public comparison is needed.
-
-## Workflow steps
-
-1. Clarify scope, success criteria, and constraints.
-2. Research existing patterns and dependencies, starting in-repo and escalating to `deep-research` only when outside evidence is required.
-3. Decompose into tasks with ownership and dependencies.
-4. Define interfaces, contracts, and failure modes.
-5. Produce acceptance criteria for each milestone.
-6. Record `architecture_impact`, `doc_impact`, and `traceability_status` when the work is non-trivial.
-7. Identify risks, unknowns, and mitigation strategies.
-
-## Verification
-
-- Every task has an owner, acceptance criteria, and verification approach.
-- Dependencies form a valid DAG with no cycles.
-- Risk assessment covers top 3 failure scenarios.
-- Plan reviewed against existing codebase conventions.
-
-## Output Contract
-
-```yaml
-PLAN_WORKFLOW_RESULT:
-  primary_agent: project-planner
-  supporting_agents: [orchestrator?, backend-specialist?, frontend-specialist?, database-architect?]
-  primary_skills: [system-design, api-design]
-  supporting_skills: [database-design?, deep-research?, mcp-server-builder?]
-  spec_id: <string> | null
-  spec_root: docs/specs/<spec-id> | null
-  plan:
-    scope_summary: <string>
-    tasks:
-      - id: <task-id>
-        description: <string>
-        owner: <agent-name>
-        dependencies: [<task-id>]
-        acceptance_criteria: [<string>]
-    interfaces: [<string>]
-    risks: [<string>]
-    milestones: [<string>]
-  architecture_impact:
-    summary: <string>
-    affects_structure: true | false
-    affects_design_system: true | false
-  doc_impact: none | tech | rules | both
-  traceability_status: complete | partial | blocked
-  follow_up_items: [<string>] | []
-```
-
-> **Codex note:** Prefer native Codex delegation when the host exposes it. Otherwise follow AGENTS.md specialist postures inline while keeping the same routing and verification contract.

package/workflows/workflows/agent-environment-setup/platforms/codex/workflows/refactor.md

@@ -1,67 +0,0 @@
----
-command: "/refactor"
-description: "Improve maintainability while preserving behavior through incremental safe refactoring."
-triggers: ["refactor", "cleanup", "maintainability", "debt", "modularize"]
----
-
-# Refactor Workflow
-
-## When to use
-
-Use this when improving code structure, reducing tech debt, or modularizing without changing behavior.
-
-## Routing
-
-- Primary specialist: `the code-archaeologist posture`
-- Domain support: `the backend-specialist posture`, `the frontend-specialist posture`
-- Verification support: `the test-engineer posture`, `the validator posture`
-
-## Context notes
-
-- This workflow file, active platform rules, and selected agents or skills guide execution.
-- Attach the target code, pain points, and any constraints on what can change.
-- Read `ENGINEERING_RULES.md` and `TECH.md` first so behavior-preserving structure changes do not drift from the accepted architecture contract.
-
-## Skill Routing
-
-- Primary skills: `code-review`, `system-design`
-- Supporting skills (optional): `unit-testing`, `system-design`, `typescript-best-practices`, `javascript-best-practices`, `python-best-practices`, `golang-best-practices`
-- Start with `code-review` for automated code quality assessment. Add `system-design` for modernization patterns. Add `unit-testing` when refactoring needs test coverage to proceed safely.
-
-## Workflow steps
-
-1. Map the current structure and identify refactoring targets.
-2. Ensure adequate test coverage before modifying (add tests if needed).
-3. Apply one refactoring at a time with behavior preservation.
-4. Verify behavior unchanged after each step.
-5. Document the improved structure and any conventions established.
-6. Set `doc_impact` when the refactor changes project structure, module boundaries, or design-system conventions.
-
-## Verification
-
-- All existing tests pass after each refactoring step.
-- No behavioral changes introduced (unless explicitly intended).
-- Code quality metrics improved (complexity, coupling, cohesion).
-- New tests added for any gaps discovered during refactoring.
-
-## Output Contract
-
-```yaml
-REFACTOR_WORKFLOW_RESULT:
-  primary_agent: code-archaeologist
-  supporting_agents: [backend-specialist?, frontend-specialist?, test-engineer?, validator?]
-  primary_skills: [code-review, system-design]
-  supporting_skills: [unit-testing?, system-design?]
-  refactoring_summary:
-    targets: [<string>]
-    changes_applied: [<string>]
-    behavior_preserved: true | false
-  quality_improvement:
-    complexity_before: <string>
-    complexity_after: <string>
-  doc_impact: none | tech | rules | both
-  tests_added: [<test-file-path>] | []
-  follow_up_items: [<string>] | []
-```
-
-> **Codex note:** Prefer native Codex delegation when the host exposes it. Otherwise follow AGENTS.md specialist postures inline while keeping the same routing and verification contract.

package/workflows/workflows/agent-environment-setup/platforms/codex/workflows/release.md

@@ -1,70 +0,0 @@
----
-command: "/release"
-description: "Prepare and execute release with rollout guardrails, verification, and rollback plan."
-triggers: ["release", "deploy", "rollout", "ship", "go-live"]
----
-
-# Release Workflow
-
-## When to use
-
-Use this when preparing a release, deploying to production, or managing a rollout.
-
-## Routing
-
-- Primary coordinator: `the ci-cd-pipeline posture`
-- Release verification: `the test-engineer posture`, `the validator posture`
-- Documentation: `the documentation-writer posture`
-
-## Context notes
-
-- This workflow file, active platform rules, and selected agents or skills guide execution.
-- Attach the release scope, version number, changelog draft, and deployment target.
-- Read `ENGINEERING_RULES.md` and `TECH.md` before release if the shipped changes touched architecture, scaling assumptions, or design-system rules.
-
-## Skill Routing
-
-- Primary skills: `ci-cd-pipeline`, `git-workflow`
-- Supporting skills (optional): `tech-doc`, `ci-cd-pipeline`, `observability`, `kubernetes-deploy`, `observability`, `ci-cd-pipeline`, `typescript-best-practices`, `javascript-best-practices`
-- Start with `ci-cd-pipeline` for deployment automation and `git-workflow` for release branching. Add `tech-doc` for release notes.
-
-## Workflow steps
-
-1. Finalize scope — confirm all changes are merged and tested.
-2. Generate changelog and release notes.
-3. Prepare deployment artifacts and configuration.
-4. Execute staged rollout with health checks at each stage.
-5. Verify production health post-deployment.
-6. Document rollback procedure and post-release status.
-7. Set `doc_impact` if the release includes architecture-affecting work that should refresh the managed docs.
-
-## Verification
-
-- All tests pass on release branch/tag.
-- Changelog accurately reflects changes.
-- Deployment artifacts built and verified.
-- Production health confirmed after rollout.
-- Rollback procedure tested or documented.
-
-## Output Contract
-
-```yaml
-RELEASE_WORKFLOW_RESULT:
-  primary_agent: ci-cd-pipeline
-  supporting_agents: [test-engineer?, validator?, documentation-writer?]
-  primary_skills: [ci-cd-pipeline, git-workflow]
-  supporting_skills: [tech-doc?, ci-cd-pipeline?, observability?]
-  release:
-    version: <string>
-    changelog: <string>
-    artifacts: [<string>]
-  deployment:
-    strategy: <staged | canary | blue-green | direct>
-    stages_completed: [<string>]
-    health_checks: [<string>]
-  rollback_plan: <string>
-  doc_impact: none | tech | rules | both
-  follow_up_items: [<string>] | []
-```
-
-> **Codex note:** Prefer native Codex delegation when the host exposes it. Otherwise follow AGENTS.md specialist postures inline while keeping the same routing and verification contract.

package/workflows/workflows/agent-environment-setup/platforms/codex/workflows/review.md

@@ -1,66 +0,0 @@
----
-command: "/review"
-description: "Run a strict review for bugs, regressions, accessibility issues, security risk, and code quality with prioritized findings."
-triggers: ["review", "audit", "pr", "quality", "security review"]
----
-
-# Review Workflow
-
-## When to use
-
-Use this for code review, PR review, or quality audit of existing code changes.
-
-## Routing
-
-- Primary specialist: `the frontend-specialist posture` (for frontend code) or `the backend-specialist posture` (for backend code)
-- Security review: `the security-auditor posture`
-- Quality validation: `the validator posture`
-- Verification support: `the test-engineer posture`
-
-## Context notes
-
-- This workflow file, active platform rules, and selected agents or skills guide execution.
-- Attach the PR diff, changed files, or specific code paths to review.
-
-## Skill Routing
-
-- Primary skills: `code-review`, `code-review`, `unit-testing`
-- Supporting skills (optional): `owasp-security-review`, `owasp-security-review`, `performance-testing`, `react`, `nextjs`, `typescript-best-practices`, `javascript-best-practices`, `python-best-practices`, `golang-best-practices`
-- Start with `code-review` for UI code or `code-review` for backend code. Add `unit-testing` when evaluating test quality. Add `owasp-security-review` for security-sensitive changes.
-
-## Workflow steps
-
-1. Understand the intent and scope of the changes.
-2. Review for correctness — logic bugs, edge cases, and regressions.
-3. Review for security — input validation, auth, secrets exposure.
-4. Review for accessibility — WCAG compliance, keyboard navigation, screen readers.
-5. Review for performance — unnecessary re-renders, N+1 queries, bundle impact.
-6. Prioritize findings by severity and provide actionable feedback.
-
-## Verification
-
-- Each finding has severity, location, and suggested fix.
-- Findings prioritized: critical > high > medium > low.
-- Positive observations noted alongside issues.
-- Reviewed against codebase conventions.
-
-## Output Contract
-
-```yaml
-REVIEW_WORKFLOW_RESULT:
-  primary_agent: <frontend-specialist | backend-specialist>
-  supporting_agents: [security-auditor?, validator?, test-engineer?]
-  primary_skills: [code-review?, code-review?, unit-testing?]
-  supporting_skills: [owasp-security-review?, owasp-security-review?, performance-testing?]
-  findings:
-    - severity: critical | high | medium | low
-      category: correctness | security | accessibility | performance | style
-      location: <file:line>
-      description: <string>
-      suggestion: <string>
-  overall_assessment: approve | request_changes | reject
-  positive_observations: [<string>] | []
-  follow_up_items: [<string>] | []
-```
-
-> **Codex note:** Prefer native Codex delegation when the host exposes it. Otherwise follow AGENTS.md specialist postures inline while keeping the same routing and verification contract.

package/workflows/workflows/agent-environment-setup/platforms/codex/workflows/security.md

@@ -1,69 +0,0 @@
----
-command: "/security"
-description: "Run security-focused analysis and remediation planning with exploitability-first triage."
-triggers: ["security", "vulnerability", "owasp", "auth", "hardening"]
----
-
-# Security Workflow
-
-## When to use
-
-Use this for security audits, vulnerability assessments, threat modeling, or security-focused code review.
-
-## Routing
-
-- Primary specialist: `the security-auditor posture`
-- Offensive assessment: `the penetration-tester posture`
-- Domain support: `the backend-specialist posture`, `the frontend-specialist posture`
-- Verification support: `the validator posture`
-
-## Context notes
-
-- This workflow file, active platform rules, and selected agents or skills guide execution.
-- Attach the security scope, threat model, compliance requirements, and relevant code paths.
-
-## Skill Routing
-
-- Primary skills: `owasp-security-review`, `owasp-security-review`
-- Supporting skills (optional): `owasp-security-review`, `code-review`, `api-design`, `api-design`, `typescript-best-practices`, `javascript-best-practices`, `python-best-practices`, `golang-best-practices`, `rust-best-practices`
-- Start with `owasp-security-review` for OWASP methodology and threat modeling. Add `owasp-security-review` for authentication/authorization review. Add `owasp-security-review` for dependency scanning and CVE triage.
-
-## Workflow steps
-
-1. Define security scope and threat model.
-2. Map attack surface and identify input vectors.
-3. Assess code against OWASP Top 10 and relevant standards.
-4. Triage findings by exploitability (reachability × controllability × impact).
-5. Produce remediation plan with prioritized fixes.
-6. Verify remediations do not introduce new vulnerabilities.
-
-## Verification
-
-- All critical and high findings have remediation plans.
-- Remediation code reviewed for correctness.
-- No new vulnerabilities introduced by fixes.
-- Compliance requirements addressed if applicable.
-
-## Output Contract
-
-```yaml
-SECURITY_WORKFLOW_RESULT:
-  primary_agent: security-auditor
-  supporting_agents: [penetration-tester?, backend-specialist?, frontend-specialist?, validator?]
-  primary_skills: [owasp-security-review, owasp-security-review]
-  supporting_skills: [owasp-security-review?, code-review?, api-design?]
-  threat_model:
-    assets: [<string>]
-    threats: [<string>]
-    attack_surface: [<string>]
-  findings:
-    - severity: critical | high | medium | low
-      category: <owasp-category>
-      exploitability: <string>
-      remediation: <string>
-  compliance_notes: [<string>] | []
-  remaining_risks: [<string>] | []
-  follow_up_items: [<string>] | []
-```
-
-> **Codex note:** Prefer native Codex delegation when the host exposes it. Otherwise follow AGENTS.md specialist postures inline while keeping the same routing and verification contract.