@cubis/foundry 0.3.82 → 0.3.83

package/workflows/workflows/agent-environment-setup/platforms/antigravity/commands/orchestrate.toml

@@ -1,19 +1,88 @@
 description = "Coordinate multiple specialists to solve cross-cutting tasks with explicit ownership, validation gates, and repeat-until-good iteration."
 prompt = '''
-Follow the /orchestrate workflow from .agent/workflows/orchestrate.md.
+Execute the native projection of the /orchestrate workflow.
+
+Coordinate multiple specialists to solve cross-cutting tasks with explicit ownership, validation gates, and repeat-until-good iteration.
 
 Execution contract:
 1. Treat route selection as already resolved by this command; do not begin with skill discovery.
 2. Read `docs/foundation/PRODUCT.md`, `ENGINEERING_RULES.md`, `docs/foundation/ARCHITECTURE.md`, and `docs/foundation/TECH.md` in that order when they exist before non-trivial execution.
 Attached skills:
 - Load these exact skill IDs first: `system-design`, `api-design`, `database-design`, `deep-research`, `mcp-server-builder`, `tech-doc`, `prompt-engineering`, `skill-creator`.
-- Local skill file hints if installed: `.agent/skills/system-design/SKILL.md`, `.agent/skills/api-design/SKILL.md`, `.agent/skills/database-design/SKILL.md`, `.agent/skills/deep-research/SKILL.md`, `.agent/skills/mcp-server-builder/SKILL.md`, `.agent/skills/tech-doc/SKILL.md`, `.agent/skills/prompt-engineering/SKILL.md`, `.agent/skills/skill-creator/SKILL.md`.
+- Local skill file hints if installed: `.agents/skills/system-design/SKILL.md`, `.agents/skills/api-design/SKILL.md`, `.agents/skills/database-design/SKILL.md`, `.agents/skills/deep-research/SKILL.md`, `.agents/skills/mcp-server-builder/SKILL.md`, `.agents/skills/tech-doc/SKILL.md`, `.agents/skills/prompt-engineering/SKILL.md`, `.agents/skills/skill-creator/SKILL.md`.
 - Treat the skill bundle as already resolved for this workflow. Do not start with route discovery.
-3. Confirm the request fits the workflow's "When to use" section.
+3. Confirm the request fits the workflow's "When to use" section before acting.
 4. Execute according to "Workflow steps" and apply "Context notes".
 5. Complete "Verification" checks and report concrete evidence.
-6. If freshness, public comparison, or explicit research needs appear, pause implementation and load `deep-research` or hand off to `@researcher` first.
+6. If freshness, public comparison, or explicit research needs appear, pause implementation and load `deep-research` or route to research first.
 7. For outside evidence: repo first, official docs next, Reddit/community only as labeled secondary evidence.
 
+Workflow source:
+# Orchestrate Workflow
+
+## When to use
+
+Use this when a task spans multiple domains (backend + frontend, security + infrastructure, etc.) and requires coordinated specialist work with validation between steps.
+
+## Routing
+
+- Primary coordinator: `@orchestrator`
+- Specialist routing determined by task decomposition — delegates to `@backend-specialist`, `@frontend-specialist`, `@database-architect`, `@security-auditor`, `@devops-engineer`, `@test-engineer`, `@mobile-developer`, or other specialist agents as needed.
+- Validation support: `@validator`
+
+## Context notes
+
+- This workflow file, active platform rules, and selected agents or skills guide execution.
+- Attach the full task description, constraints, acceptance criteria, and relevant context when starting.
+- Read `ENGINEERING_RULES.md` and `docs/foundation/TECH.md` before decomposing non-trivial work. Check `docs/foundation/TECH.md` for build/validation commands and `docs/foundation/PRODUCT.md` for domain glossary. Then reuse any existing `docs/specs/<spec-id>/` pack as the handoff source of truth.
+
+## Skill Routing
+
+- Primary skills: `system-design`, `api-design`
+- Supporting skills (optional): `database-design`, `deep-research`, `mcp-server-builder`, `openai-docs`, `prompt-engineering`, `skill-creator`
+- Start with `system-design` for system design coordination and `api-design` for integration contracts. Add `deep-research` before implementation when the coordination challenge depends on fresh external facts or public comparison.
+
+## Workflow steps
+
+1. Decompose the task into discrete work items with acceptance criteria.
+2. Identify dependencies and determine execution order (DAG).
+3. Delegate each task to the best specialist agent with full context.
+4. Validate each deliverable against acceptance criteria via independent validation.
+5. Iterate on failed validations with specific feedback (max 3 iterations).
+6. Surface `doc_impact` when the coordinated work changes architecture, boundaries, scale, or the design system.
+7. Integrate outputs, verify cross-task consistency, and report results.
+
+## Verification
+
+- Each task validated independently against its acceptance criteria.
+- Cross-task consistency check after integration.
+- Run any applicable automated tests or checks.
+- Final validation pass on combined result.
+
+## Output Contract
+
+```yaml
+ORCHESTRATE_WORKFLOW_RESULT:
+  primary_agent: orchestrator
+  supporting_agents: [<specialist-agents-used>]
+  primary_skills: [system-design, api-design]
+  supporting_skills: [<supporting-skills-used>]
+  spec_id: <string> | null
+  spec_root: docs/specs/<spec-id> | null
+  task_count: <number>
+  completed: <number>
+  failed: <number>
+  tasks:
+    - id: <task-id>
+      agent: <agent-name>
+      status: completed | failed | skipped
+      iterations: <number>
+      validation_evidence: <string>
+  integration_status: clean | conflicts_resolved | issues_remaining
+  doc_impact: none | tech | rules | both
+  remaining_risks: [<string>] | []
+  follow_up_actions: [<string>] | []
+```
+
 If command arguments are provided, treat them as additional user context.
 '''

package/workflows/workflows/agent-environment-setup/platforms/antigravity/commands/plan.toml

@@ -1,19 +1,94 @@
 description = "Build a decision-complete implementation plan with interfaces, failure modes, and acceptance criteria."
 prompt = '''
-Follow the /plan workflow from .agent/workflows/plan.md.
+Execute the native projection of the /plan workflow.
+
+Build a decision-complete implementation plan with interfaces, failure modes, and acceptance criteria.
 
 Execution contract:
 1. Treat route selection as already resolved by this command; do not begin with skill discovery.
 2. Read `docs/foundation/PRODUCT.md`, `ENGINEERING_RULES.md`, `docs/foundation/ARCHITECTURE.md`, and `docs/foundation/TECH.md` in that order when they exist before non-trivial execution.
 Attached skills:
 - Load these exact skill IDs first: `system-design`, `api-design`, `database-design`, `deep-research`, `mcp-server-builder`, `tech-doc`, `prompt-engineering`, `skill-creator`.
-- Local skill file hints if installed: `.agent/skills/system-design/SKILL.md`, `.agent/skills/api-design/SKILL.md`, `.agent/skills/database-design/SKILL.md`, `.agent/skills/deep-research/SKILL.md`, `.agent/skills/mcp-server-builder/SKILL.md`, `.agent/skills/tech-doc/SKILL.md`, `.agent/skills/prompt-engineering/SKILL.md`, `.agent/skills/skill-creator/SKILL.md`.
+- Local skill file hints if installed: `.agents/skills/system-design/SKILL.md`, `.agents/skills/api-design/SKILL.md`, `.agents/skills/database-design/SKILL.md`, `.agents/skills/deep-research/SKILL.md`, `.agents/skills/mcp-server-builder/SKILL.md`, `.agents/skills/tech-doc/SKILL.md`, `.agents/skills/prompt-engineering/SKILL.md`, `.agents/skills/skill-creator/SKILL.md`.
 - Treat the skill bundle as already resolved for this workflow. Do not start with route discovery.
-3. Confirm the request fits the workflow's "When to use" section.
+3. Confirm the request fits the workflow's "When to use" section before acting.
 4. Execute according to "Workflow steps" and apply "Context notes".
 5. Complete "Verification" checks and report concrete evidence.
-6. If freshness, public comparison, or explicit research needs appear, pause implementation and load `deep-research` or hand off to `@researcher` first.
+6. If freshness, public comparison, or explicit research needs appear, pause implementation and load `deep-research` or route to research first.
 7. For outside evidence: repo first, official docs next, Reddit/community only as labeled secondary evidence.
 
+Workflow source:
+# Plan Workflow
+
+## When to use
+
+Use this when starting a new feature, project, or significant change that needs a structured implementation plan before coding begins.
+
+## Routing
+
+- Primary coordinator: `@project-planner`
+- Architecture support: `@orchestrator`
+- Domain validation: `@backend-specialist`, `@frontend-specialist`, `@database-architect`
+
+## Context notes
+
+- This workflow file, active platform rules, and selected agents or skills guide execution.
+- Attach the feature request, problem statement, constraints, and any existing design documents.
+- Read `ENGINEERING_RULES.md` first and `docs/foundation/TECH.md` next when they exist before finalizing a non-trivial plan. Also check `docs/foundation/PRODUCT.md` for domain glossary and `docs/foundation/ARCHITECTURE.md` for crosscutting concerns and dependency rules.
+- Reuse an existing `docs/specs/<spec-id>/` pack when the change already has one instead of creating a parallel planning track.
+
+## Skill Routing
+
+- Primary skills: `system-design`, `api-design`
+- Supporting skills (optional): `database-design`, `deep-research`, `mcp-server-builder`, `openai-docs`, `prompt-engineering`, `skill-creator`
+- Start with `system-design` for system design and `api-design` for API contracts. Add `database-design` when data modeling is central, `deep-research` when fresh external knowledge or public comparison is needed.
+
+## Workflow steps
+
+1. Clarify scope, success criteria, and constraints.
+2. Research existing patterns and dependencies, starting in-repo and escalating to `deep-research` only when outside evidence is required.
+3. Decompose into tasks with ownership and dependencies.
+4. Define interfaces, contracts, and failure modes.
+5. Produce acceptance criteria for each milestone.
+6. Record `architecture_impact`, `doc_impact`, and `traceability_status` when the work is non-trivial.
+7. Identify risks, unknowns, and mitigation strategies.
+
+## Verification
+
+- Every task has an owner, acceptance criteria, and verification approach.
+- Dependencies form a valid DAG with no cycles.
+- Risk assessment covers top 3 failure scenarios.
+- Plan reviewed against existing codebase conventions.
+
+## Output Contract
+
+```yaml
+PLAN_WORKFLOW_RESULT:
+  primary_agent: project-planner
+  supporting_agents: [orchestrator?, backend-specialist?, frontend-specialist?, database-architect?]
+  primary_skills: [system-design, api-design]
+  supporting_skills: [database-design?, deep-research?, mcp-server-builder?]
+  spec_id: <string> | null
+  spec_root: docs/specs/<spec-id> | null
+  plan:
+    scope_summary: <string>
+    tasks:
+      - id: <task-id>
+        description: <string>
+        owner: <agent-name>
+        dependencies: [<task-id>]
+        acceptance_criteria: [<string>]
+    interfaces: [<string>]
+    risks: [<string>]
+    milestones: [<string>]
+  architecture_impact:
+    summary: <string>
+    affects_structure: true | false
+    affects_design_system: true | false
+  doc_impact: none | tech | rules | both
+  traceability_status: complete | partial | blocked
+  follow_up_items: [<string>] | []
+```
+
 If command arguments are provided, treat them as additional user context.
 '''

package/workflows/workflows/agent-environment-setup/platforms/antigravity/commands/refactor.toml

@@ -1,19 +1,82 @@
 description = "Improve maintainability while preserving behavior through incremental safe refactoring."
 prompt = '''
-Follow the /refactor workflow from .agent/workflows/refactor.md.
+Execute the native projection of the /refactor workflow.
+
+Improve maintainability while preserving behavior through incremental safe refactoring.
 
 Execution contract:
 1. Treat route selection as already resolved by this command; do not begin with skill discovery.
 2. Read `docs/foundation/PRODUCT.md`, `ENGINEERING_RULES.md`, `docs/foundation/ARCHITECTURE.md`, and `docs/foundation/TECH.md` in that order when they exist before non-trivial execution.
 Attached skills:
 - Load these exact skill IDs first: `code-review`, `system-design`, `unit-testing`, `typescript-best-practices`, `javascript-best-practices`, `python-best-practices`, `golang-best-practices`.
-- Local skill file hints if installed: `.agent/skills/code-review/SKILL.md`, `.agent/skills/system-design/SKILL.md`, `.agent/skills/unit-testing/SKILL.md`, `.agent/skills/typescript-best-practices/SKILL.md`, `.agent/skills/javascript-best-practices/SKILL.md`, `.agent/skills/python-best-practices/SKILL.md`, `.agent/skills/golang-best-practices/SKILL.md`.
+- Local skill file hints if installed: `.agents/skills/code-review/SKILL.md`, `.agents/skills/system-design/SKILL.md`, `.agents/skills/unit-testing/SKILL.md`, `.agents/skills/typescript-best-practices/SKILL.md`, `.agents/skills/javascript-best-practices/SKILL.md`, `.agents/skills/python-best-practices/SKILL.md`, `.agents/skills/golang-best-practices/SKILL.md`.
 - Treat the skill bundle as already resolved for this workflow. Do not start with route discovery.
-3. Confirm the request fits the workflow's "When to use" section.
+3. Confirm the request fits the workflow's "When to use" section before acting.
 4. Execute according to "Workflow steps" and apply "Context notes".
 5. Complete "Verification" checks and report concrete evidence.
-6. If freshness, public comparison, or explicit research needs appear, pause implementation and load `deep-research` or hand off to `@researcher` first.
+6. If freshness, public comparison, or explicit research needs appear, pause implementation and load `deep-research` or route to research first.
 7. For outside evidence: repo first, official docs next, Reddit/community only as labeled secondary evidence.
 
+Workflow source:
+# Refactor Workflow
+
+## When to use
+
+Use this when improving code structure, reducing tech debt, or modularizing without changing behavior.
+
+## Routing
+
+- Primary specialist: `@code-archaeologist`
+- Domain support: `@backend-specialist`, `@frontend-specialist`
+- Verification support: `@test-engineer`, `@validator`
+
+## Context notes
+
+- This workflow file, active platform rules, and selected agents or skills guide execution.
+- Attach the target code, pain points, and any constraints on what can change.
+- Read `ENGINEERING_RULES.md` and `docs/foundation/TECH.md` first so behavior-preserving structure changes do not drift from the accepted architecture contract. Check `docs/foundation/ARCHITECTURE.md` for `## Dependency Rules` and `## Crosscutting Concerns` before restructuring.
+
+## Skill Routing
+
+- Primary skills: `static-analysis`, `legacy-modernizer`
+- Supporting skills (optional): `testing-patterns`, `system-design`, `typescript-pro`, `javascript-pro`, `python-pro`, `golang-pro`
+- Start with `static-analysis` for automated code quality assessment. Add `legacy-modernizer` for modernization patterns. Add `testing-patterns` when refactoring needs test coverage to proceed safely.
+
+## Workflow steps
+
+1. Map the current structure and identify refactoring targets.
+2. Ensure adequate test coverage before modifying (add tests if needed).
+3. Apply one refactoring at a time with behavior preservation.
+4. Verify behavior unchanged after each step.
+5. Document the improved structure and any conventions established.
+6. Set `doc_impact` when the refactor changes project structure, module boundaries, or design-system conventions.
+
+## Verification
+
+- All existing tests pass after each refactoring step.
+- No behavioral changes introduced (unless explicitly intended).
+- Code quality metrics improved (complexity, coupling, cohesion).
+- New tests added for any gaps discovered during refactoring.
+
+## Output Contract
+
+```yaml
+REFACTOR_WORKFLOW_RESULT:
+  primary_agent: code-archaeologist
+  supporting_agents: [backend-specialist?, frontend-specialist?, test-engineer?, validator?]
+  primary_skills: [static-analysis, legacy-modernizer]
+  supporting_skills: [testing-patterns?, system-design?]
+  refactoring_summary:
+    targets: [<string>]
+    changes_applied: [<string>]
+    behavior_preserved: true | false
+  quality_improvement:
+    complexity_before: <string>
+    complexity_after: <string>
+  doc_impact: none | tech | rules | both
+  tests_added: [<test-file-path>] | []
+  follow_up_items: [<string>] | []
+```
+
 If command arguments are provided, treat them as additional user context.
 '''

package/workflows/workflows/agent-environment-setup/platforms/antigravity/commands/release.toml

@@ -1,19 +1,85 @@
 description = "Prepare and execute release with rollout guardrails, verification, and rollback plan."
 prompt = '''
-Follow the /release workflow from .agent/workflows/release.md.
+Execute the native projection of the /release workflow.
+
+Prepare and execute release with rollout guardrails, verification, and rollback plan.
 
 Execution contract:
 1. Treat route selection as already resolved by this command; do not begin with skill discovery.
 2. Read `docs/foundation/PRODUCT.md`, `ENGINEERING_RULES.md`, `docs/foundation/ARCHITECTURE.md`, and `docs/foundation/TECH.md` in that order when they exist before non-trivial execution.
 Attached skills:
 - Load these exact skill IDs first: `ci-cd-pipeline`, `git-workflow`, `tech-doc`, `observability`, `kubernetes-deploy`, `typescript-best-practices`, `javascript-best-practices`.
-- Local skill file hints if installed: `.agent/skills/ci-cd-pipeline/SKILL.md`, `.agent/skills/git-workflow/SKILL.md`, `.agent/skills/tech-doc/SKILL.md`, `.agent/skills/observability/SKILL.md`, `.agent/skills/kubernetes-deploy/SKILL.md`, `.agent/skills/typescript-best-practices/SKILL.md`, `.agent/skills/javascript-best-practices/SKILL.md`.
+- Local skill file hints if installed: `.agents/skills/ci-cd-pipeline/SKILL.md`, `.agents/skills/git-workflow/SKILL.md`, `.agents/skills/tech-doc/SKILL.md`, `.agents/skills/observability/SKILL.md`, `.agents/skills/kubernetes-deploy/SKILL.md`, `.agents/skills/typescript-best-practices/SKILL.md`, `.agents/skills/javascript-best-practices/SKILL.md`.
 - Treat the skill bundle as already resolved for this workflow. Do not start with route discovery.
-3. Confirm the request fits the workflow's "When to use" section.
+3. Confirm the request fits the workflow's "When to use" section before acting.
 4. Execute according to "Workflow steps" and apply "Context notes".
 5. Complete "Verification" checks and report concrete evidence.
-6. If freshness, public comparison, or explicit research needs appear, pause implementation and load `deep-research` or hand off to `@researcher` first.
+6. If freshness, public comparison, or explicit research needs appear, pause implementation and load `deep-research` or route to research first.
 7. For outside evidence: repo first, official docs next, Reddit/community only as labeled secondary evidence.
 
+Workflow source:
+# Release Workflow
+
+## When to use
+
+Use this when preparing a release, deploying to production, or managing a rollout.
+
+## Routing
+
+- Primary coordinator: `@devops-engineer`
+- Release verification: `@test-engineer`, `@validator`
+- Documentation: `@documentation-writer`
+
+## Context notes
+
+- This workflow file, active platform rules, and selected agents or skills guide execution.
+- Attach the release scope, version number, changelog draft, and deployment target.
+- Read `ENGINEERING_RULES.md` and `docs/foundation/TECH.md` before release if the shipped changes touched architecture, scaling assumptions, or design-system rules. Check `docs/foundation/TECH.md` for `## Build And Validation` and `## CI CD Pipeline` steps to verify the release pipeline.
+
+## Skill Routing
+
+- Primary skills: `ci-cd-pipelines`, `git-workflow`
+- Supporting skills (optional): `changelog-generator`, `devops-engineer`, `sre-engineer`, `docker-kubernetes`, `observability`, `serverless-patterns`, `typescript-pro`, `javascript-pro`
+- Start with `ci-cd-pipelines` for deployment automation and `git-workflow` for release branching. Add `changelog-generator` for release notes.
+
+## Workflow steps
+
+1. Finalize scope — confirm all changes are merged and tested.
+2. Generate changelog and release notes.
+3. Prepare deployment artifacts and configuration.
+4. Execute staged rollout with health checks at each stage.
+5. Verify production health post-deployment.
+6. Document rollback procedure and post-release status.
+7. Set `doc_impact` if the release includes architecture-affecting work that should refresh the managed docs.
+
+## Verification
+
+- All tests pass on release branch/tag.
+- Changelog accurately reflects changes.
+- Deployment artifacts built and verified.
+- Production health confirmed after rollout.
+- Rollback procedure tested or documented.
+
+## Output Contract
+
+```yaml
+RELEASE_WORKFLOW_RESULT:
+  primary_agent: devops-engineer
+  supporting_agents: [test-engineer?, validator?, documentation-writer?]
+  primary_skills: [ci-cd-pipelines, git-workflow]
+  supporting_skills: [changelog-generator?, devops-engineer?, sre-engineer?]
+  release:
+    version: <string>
+    changelog: <string>
+    artifacts: [<string>]
+  deployment:
+    strategy: <staged | canary | blue-green | direct>
+    stages_completed: [<string>]
+    health_checks: [<string>]
+  rollback_plan: <string>
+  doc_impact: none | tech | rules | both
+  follow_up_items: [<string>] | []
+```
+
 If command arguments are provided, treat them as additional user context.
 '''

package/workflows/workflows/agent-environment-setup/platforms/antigravity/commands/review.toml

@@ -1,19 +1,81 @@
 description = "Run a strict review for bugs, regressions, accessibility issues, security risk, and code quality with prioritized findings."
 prompt = '''
-Follow the /review workflow from .agent/workflows/review.md.
+Execute the native projection of the /review workflow.
+
+Run a strict review for bugs, regressions, accessibility issues, security risk, and code quality with prioritized findings.
 
 Execution contract:
 1. Treat route selection as already resolved by this command; do not begin with skill discovery.
 2. Read `docs/foundation/PRODUCT.md`, `ENGINEERING_RULES.md`, `docs/foundation/ARCHITECTURE.md`, and `docs/foundation/TECH.md` in that order when they exist before non-trivial execution.
 Attached skills:
 - Load these exact skill IDs first: `code-review`, `unit-testing`, `owasp-security-review`, `performance-testing`, `react`, `nextjs`, `typescript-best-practices`, `javascript-best-practices`, `python-best-practices`, `golang-best-practices`.
-- Local skill file hints if installed: `.agent/skills/code-review/SKILL.md`, `.agent/skills/unit-testing/SKILL.md`, `.agent/skills/owasp-security-review/SKILL.md`, `.agent/skills/performance-testing/SKILL.md`, `.agent/skills/react/SKILL.md`, `.agent/skills/nextjs/SKILL.md`, `.agent/skills/typescript-best-practices/SKILL.md`, `.agent/skills/javascript-best-practices/SKILL.md`.
+- Local skill file hints if installed: `.agents/skills/code-review/SKILL.md`, `.agents/skills/unit-testing/SKILL.md`, `.agents/skills/owasp-security-review/SKILL.md`, `.agents/skills/performance-testing/SKILL.md`, `.agents/skills/react/SKILL.md`, `.agents/skills/nextjs/SKILL.md`, `.agents/skills/typescript-best-practices/SKILL.md`, `.agents/skills/javascript-best-practices/SKILL.md`.
 - Treat the skill bundle as already resolved for this workflow. Do not start with route discovery.
-3. Confirm the request fits the workflow's "When to use" section.
+3. Confirm the request fits the workflow's "When to use" section before acting.
 4. Execute according to "Workflow steps" and apply "Context notes".
 5. Complete "Verification" checks and report concrete evidence.
-6. If freshness, public comparison, or explicit research needs appear, pause implementation and load `deep-research` or hand off to `@researcher` first.
+6. If freshness, public comparison, or explicit research needs appear, pause implementation and load `deep-research` or route to research first.
 7. For outside evidence: repo first, official docs next, Reddit/community only as labeled secondary evidence.
 
+Workflow source:
+# Review Workflow
+
+## When to use
+
+Use this for code review, PR review, or quality audit of existing code changes.
+
+## Routing
+
+- Primary specialist: `@frontend-specialist` (for frontend code) or `@backend-specialist` (for backend code)
+- Security review: `@security-auditor`
+- Quality validation: `@validator`
+- Verification support: `@test-engineer`
+
+## Context notes
+
+- This workflow file, active platform rules, and selected agents or skills guide execution.
+- Attach the PR diff, changed files, or specific code paths to review.
+
+## Skill Routing
+
+- Primary skills: `frontend-code-review`, `static-analysis`, `testing-patterns`
+- Supporting skills (optional): `security-engineer`, `vulnerability-scanner`, `web-perf`, `react-expert`, `nextjs-developer`, `typescript-pro`, `javascript-pro`, `python-pro`, `golang-pro`
+- Start with `frontend-code-review` for UI code or `static-analysis` for backend code. Add `testing-patterns` when evaluating test quality. Add `security-engineer` for security-sensitive changes.
+
+## Workflow steps
+
+1. Understand the intent and scope of the changes.
+2. Review for correctness — logic bugs, edge cases, and regressions.
+3. Review for security — input validation, auth, secrets exposure.
+4. Review for accessibility — WCAG compliance, keyboard navigation, screen readers.
+5. Review for performance — unnecessary re-renders, N+1 queries, bundle impact.
+6. Prioritize findings by severity and provide actionable feedback.
+
+## Verification
+
+- Each finding has severity, location, and suggested fix.
+- Findings prioritized: critical > high > medium > low.
+- Positive observations noted alongside issues.
+- Reviewed against codebase conventions.
+
+## Output Contract
+
+```yaml
+REVIEW_WORKFLOW_RESULT:
+  primary_agent: <frontend-specialist | backend-specialist>
+  supporting_agents: [security-auditor?, validator?, test-engineer?]
+  primary_skills: [frontend-code-review?, static-analysis?, testing-patterns?]
+  supporting_skills: [security-engineer?, vulnerability-scanner?, web-perf?]
+  findings:
+    - severity: critical | high | medium | low
+      category: correctness | security | accessibility | performance | style
+      location: <file:line>
+      description: <string>
+      suggestion: <string>
+  overall_assessment: approve | request_changes | reject
+  positive_observations: [<string>] | []
+  follow_up_items: [<string>] | []
+```
+
 If command arguments are provided, treat them as additional user context.
 '''

package/workflows/workflows/agent-environment-setup/platforms/antigravity/commands/security.toml

@@ -1,19 +1,84 @@
 description = "Run security-focused analysis and remediation planning with exploitability-first triage."
 prompt = '''
-Follow the /security workflow from .agent/workflows/security.md.
+Execute the native projection of the /security workflow.
+
+Run security-focused analysis and remediation planning with exploitability-first triage.
 
 Execution contract:
 1. Treat route selection as already resolved by this command; do not begin with skill discovery.
 2. Read `docs/foundation/PRODUCT.md`, `ENGINEERING_RULES.md`, `docs/foundation/ARCHITECTURE.md`, and `docs/foundation/TECH.md` in that order when they exist before non-trivial execution.
 Attached skills:
 - Load these exact skill IDs first: `owasp-security-review`, `code-review`, `api-design`, `typescript-best-practices`, `javascript-best-practices`, `python-best-practices`, `golang-best-practices`, `rust-best-practices`.
-- Local skill file hints if installed: `.agent/skills/owasp-security-review/SKILL.md`, `.agent/skills/code-review/SKILL.md`, `.agent/skills/api-design/SKILL.md`, `.agent/skills/typescript-best-practices/SKILL.md`, `.agent/skills/javascript-best-practices/SKILL.md`, `.agent/skills/python-best-practices/SKILL.md`, `.agent/skills/golang-best-practices/SKILL.md`, `.agent/skills/rust-best-practices/SKILL.md`.
+- Local skill file hints if installed: `.agents/skills/owasp-security-review/SKILL.md`, `.agents/skills/code-review/SKILL.md`, `.agents/skills/api-design/SKILL.md`, `.agents/skills/typescript-best-practices/SKILL.md`, `.agents/skills/javascript-best-practices/SKILL.md`, `.agents/skills/python-best-practices/SKILL.md`, `.agents/skills/golang-best-practices/SKILL.md`, `.agents/skills/rust-best-practices/SKILL.md`.
 - Treat the skill bundle as already resolved for this workflow. Do not start with route discovery.
-3. Confirm the request fits the workflow's "When to use" section.
+3. Confirm the request fits the workflow's "When to use" section before acting.
 4. Execute according to "Workflow steps" and apply "Context notes".
 5. Complete "Verification" checks and report concrete evidence.
-6. If freshness, public comparison, or explicit research needs appear, pause implementation and load `deep-research` or hand off to `@researcher` first.
+6. If freshness, public comparison, or explicit research needs appear, pause implementation and load `deep-research` or route to research first.
 7. For outside evidence: repo first, official docs next, Reddit/community only as labeled secondary evidence.
 
+Workflow source:
+# Security Workflow
+
+## When to use
+
+Use this for security audits, vulnerability assessments, threat modeling, or security-focused code review.
+
+## Routing
+
+- Primary specialist: `@security-auditor`
+- Offensive assessment: `@penetration-tester`
+- Domain support: `@backend-specialist`, `@frontend-specialist`
+- Verification support: `@validator`
+
+## Context notes
+
+- This workflow file, active platform rules, and selected agents or skills guide execution.
+- Attach the security scope, threat model, compliance requirements, and relevant code paths.
+
+## Skill Routing
+
+- Primary skills: `security-engineer`, `auth-architect`
+- Supporting skills (optional): `vulnerability-scanner`, `static-analysis`, `api-design`, `graphql-architect`, `typescript-pro`, `javascript-pro`, `python-pro`, `golang-pro`, `rust-pro`
+- Start with `security-engineer` for OWASP methodology and threat modeling. Add `auth-architect` for authentication/authorization review. Add `vulnerability-scanner` for dependency scanning and CVE triage.
+
+## Workflow steps
+
+1. Define security scope and threat model.
+2. Map attack surface and identify input vectors.
+3. Assess code against OWASP Top 10 and relevant standards.
+4. Triage findings by exploitability (reachability × controllability × impact).
+5. Produce remediation plan with prioritized fixes.
+6. Verify remediations do not introduce new vulnerabilities.
+
+## Verification
+
+- All critical and high findings have remediation plans.
+- Remediation code reviewed for correctness.
+- No new vulnerabilities introduced by fixes.
+- Compliance requirements addressed if applicable.
+
+## Output Contract
+
+```yaml
+SECURITY_WORKFLOW_RESULT:
+  primary_agent: security-auditor
+  supporting_agents: [penetration-tester?, backend-specialist?, frontend-specialist?, validator?]
+  primary_skills: [security-engineer, auth-architect]
+  supporting_skills: [vulnerability-scanner?, static-analysis?, api-design?]
+  threat_model:
+    assets: [<string>]
+    threats: [<string>]
+    attack_surface: [<string>]
+  findings:
+    - severity: critical | high | medium | low
+      category: <owasp-category>
+      exploitability: <string>
+      remediation: <string>
+  compliance_notes: [<string>] | []
+  remaining_risks: [<string>] | []
+  follow_up_items: [<string>] | []
+```
+
 If command arguments are provided, treat them as additional user context.
 '''

package/workflows/workflows/agent-environment-setup/platforms/antigravity/commands/spec.toml

@@ -1,19 +1,86 @@
 description = "Create or refresh a Git-tracked spec pack for non-trivial work, including acceptance criteria, traceability, architecture impact, and next-route handoff."
 prompt = '''
-Follow the /spec workflow from .agent/workflows/spec.md.
+Execute the native projection of the /spec workflow.
+
+Create or refresh a Git-tracked spec pack for non-trivial work, including acceptance criteria, traceability, architecture impact, and next-route handoff.
 
 Execution contract:
 1. Treat route selection as already resolved by this command; do not begin with skill discovery.
 2. Read `docs/foundation/PRODUCT.md`, `ENGINEERING_RULES.md`, `docs/foundation/ARCHITECTURE.md`, and `docs/foundation/TECH.md` in that order when they exist before non-trivial execution.
 Attached skills:
 - Load these exact skill IDs first: `spec-driven-delivery`, `sadd`, `system-design`, `architecture-doc`, `deep-research`, `api-design`, `database-design`, `tech-doc`.
-- Local skill file hints if installed: `.agent/skills/spec-driven-delivery/SKILL.md`, `.agent/skills/sadd/SKILL.md`, `.agent/skills/system-design/SKILL.md`, `.agent/skills/architecture-doc/SKILL.md`, `.agent/skills/deep-research/SKILL.md`, `.agent/skills/api-design/SKILL.md`, `.agent/skills/database-design/SKILL.md`, `.agent/skills/tech-doc/SKILL.md`.
+- Local skill file hints if installed: `.agents/skills/spec-driven-delivery/SKILL.md`, `.agents/skills/sadd/SKILL.md`, `.agents/skills/system-design/SKILL.md`, `.agents/skills/architecture-doc/SKILL.md`, `.agents/skills/deep-research/SKILL.md`, `.agents/skills/api-design/SKILL.md`, `.agents/skills/database-design/SKILL.md`, `.agents/skills/tech-doc/SKILL.md`.
 - Treat the skill bundle as already resolved for this workflow. Do not start with route discovery.
-3. Confirm the request fits the workflow's "When to use" section.
+3. Confirm the request fits the workflow's "When to use" section before acting.
 4. Execute according to "Workflow steps" and apply "Context notes".
 5. Complete "Verification" checks and report concrete evidence.
-6. If freshness, public comparison, or explicit research needs appear, pause implementation and load `deep-research` or hand off to `@researcher` first.
+6. If freshness, public comparison, or explicit research needs appear, pause implementation and load `deep-research` or route to research first.
 7. For outside evidence: repo first, official docs next, Reddit/community only as labeled secondary evidence.
 
+Workflow source:
+# Spec Workflow
+
+## When to use
+
+Use this for non-trivial work that needs durable planning in Git before implementation: medium or large features, multi-step changes, cross-session work, migrations, risky refactors, or any request that needs explicit acceptance and traceability.
+
+## Routing
+
+- Primary coordinator: `@project-planner`
+- Traceability and requirements support: `@researcher`
+- Cross-domain coordination: `@orchestrator`
+- Documentation and structure support: `@documentation-writer`
+
+## Skill Routing
+
+- Primary skills: `spec-driven-delivery`, `sadd`
+- Supporting skills (optional): `system-design`, `architecture-doc`, `deep-research`, `api-design`, `database-design`, `tech-doc`
+- Start with `spec-driven-delivery` for the pack structure and handoff contract. Add `sadd` when mining requirements into testable assertions, `system-design` or `architecture-doc` when the spec changes structure, and `deep-research` only when repo-local evidence is insufficient.
+
+## Workflow steps
+
+1. Determine whether the task is non-trivial enough to justify a spec pack.
+2. Find an existing `docs/specs/<spec-id>/` pack or create a new stable `spec_id`.
+3. Write or refresh the spec pack with brief, acceptance, tasks, traceability, and handoff files.
+4. Record `architecture_impact`, `doc_impact`, and any required updates to `docs/foundation/PRODUCT.md`, `docs/foundation/ARCHITECTURE.md`, `ENGINEERING_RULES.md`, or `docs/foundation/TECH.md`. If the change adds new terms, update the `## Domain Glossary` in `docs/foundation/PRODUCT.md`. If the change introduces new crosscutting patterns or tech debt, flag updates needed in `docs/foundation/ARCHITECTURE.md`.
+5. Identify the next execution route and hand off without replanning the same work.
+
+## Context notes
+
+- Read `docs/foundation/PRODUCT.md`, `ENGINEERING_RULES.md`, `docs/foundation/ARCHITECTURE.md`, and `docs/foundation/TECH.md` in that order when they exist because they define the accepted product direction, architecture contract, and current state.
+- Prefer repo evidence first; escalate to `deep-research` only when freshness, public comparison, or explicit research requests require it.
+- Keep spec packs lean. Trivial one-step tasks should stay on the lightweight path with no new spec directory.
+
+## Verification
+
+- `spec_id` and `spec_root` are stable and explicit.
+- Acceptance criteria are testable and traceable.
+- Task dependencies form a valid execution order.
+- `architecture_impact`, `doc_impact`, and `traceability_status` are present.
+
+## Output Contract
+
+```yaml
+SPEC_WORKFLOW_RESULT:
+  primary_agent: project-planner
+  supporting_agents: [researcher?, orchestrator?, documentation-writer?]
+  primary_skills: [spec-driven-delivery, sadd]
+  supporting_skills: [system-design?, architecture-doc?, deep-research?, api-design?, database-design?, tech-doc?]
+  spec_id: <string>
+  spec_root: docs/specs/<spec-id>
+  architecture_impact:
+    summary: <string>
+    affects_structure: true | false
+    affects_design_system: true | false
+    affects_testing_strategy: true | false
+  doc_impact: none | tech | rules | both
+  traceability_status: complete | partial | blocked
+  documents:
+    created: [<path>] | []
+    updated: [<path>] | []
+  next_route: </create | /implement-track | /orchestrate | /architecture | direct>
+  gaps: [<string>] | []
+```
+
 If command arguments are provided, treat them as additional user context.
 '''