@cubis/foundry 0.3.82 → 0.3.83

package/workflows/workflows/agent-environment-setup/manifest.json

@@ -4,52 +4,8 @@
   "description": "Workflow-first AI agent environment setup for Antigravity, Codex, Copilot, Claude Code, and Gemini CLI.",
   "platforms": {
     "antigravity": {
-      "workflows": [
-        "accessibility.md",
-        "architecture.md",
-        "backend.md",
-        "create.md",
-        "database.md",
-        "debug.md",
-        "devops.md",
-        "implement-track.md",
-        "migrate.md",
-        "mobile.md",
-        "onboard.md",
-        "orchestrate.md",
-        "plan.md",
-        "refactor.md",
-        "release.md",
-        "review.md",
-        "security.md",
-        "spec.md",
-        "test.md",
-        "vercel.md"
-      ],
-      "agents": [
-        "backend-specialist.md",
-        "code-archaeologist.md",
-        "database-architect.md",
-        "debugger.md",
-        "devops-engineer.md",
-        "documentation-writer.md",
-        "frontend-specialist.md",
-        "game-developer.md",
-        "mobile-developer.md",
-        "orchestrator.md",
-        "penetration-tester.md",
-        "performance-optimizer.md",
-        "product-manager.md",
-        "project-planner.md",
-        "qa-automation-engineer.md",
-        "researcher.md",
-        "security-auditor.md",
-        "seo-specialist.md",
-        "sre-engineer.md",
-        "test-engineer.md",
-        "validator.md",
-        "vercel-expert.md"
-      ],
+      "workflows": [],
+      "agents": [],
       "skills": [
         "api-design",
         "architecture-doc",
@@ -122,6 +78,7 @@
         "vibesec",
         "vuejs"
       ],
+      "generatedSkills": [],
       "rulesTemplate": "platforms/antigravity/rules/GEMINI.md",
       "hooks": [
         {
@@ -150,55 +107,56 @@
         "security.toml",
         "spec.toml",
         "test.toml",
-        "vercel.toml"
+        "vercel.toml",
+        "agent-backend-specialist.toml",
+        "agent-code-archaeologist.toml",
+        "agent-database-architect.toml",
+        "agent-debugger.toml",
+        "agent-devops-engineer.toml",
+        "agent-documentation-writer.toml",
+        "agent-frontend-specialist.toml",
+        "agent-game-developer.toml",
+        "agent-mobile-developer.toml",
+        "agent-orchestrator.toml",
+        "agent-penetration-tester.toml",
+        "agent-performance-optimizer.toml",
+        "agent-product-manager.toml",
+        "agent-project-planner.toml",
+        "agent-qa-automation-engineer.toml",
+        "agent-researcher.toml",
+        "agent-security-auditor.toml",
+        "agent-seo-specialist.toml",
+        "agent-sre-engineer.toml",
+        "agent-test-engineer.toml",
+        "agent-validator.toml",
+        "agent-vercel-expert.toml"
       ]
     },
     "codex": {
-      "workflows": [
-        "accessibility.md",
-        "architecture.md",
-        "backend.md",
-        "create.md",
-        "database.md",
-        "debug.md",
-        "devops.md",
-        "implement-track.md",
-        "migrate.md",
-        "mobile.md",
-        "onboard.md",
-        "orchestrate.md",
-        "plan.md",
-        "refactor.md",
-        "release.md",
-        "review.md",
-        "security.md",
-        "spec.md",
-        "test.md",
-        "vercel.md"
-      ],
+      "workflows": [],
       "agents": [
-        "backend-specialist.md",
-        "code-archaeologist.md",
-        "database-architect.md",
-        "debugger.md",
-        "devops-engineer.md",
-        "documentation-writer.md",
-        "frontend-specialist.md",
-        "game-developer.md",
-        "mobile-developer.md",
-        "orchestrator.md",
-        "penetration-tester.md",
-        "performance-optimizer.md",
-        "product-manager.md",
-        "project-planner.md",
-        "qa-automation-engineer.md",
-        "researcher.md",
-        "security-auditor.md",
-        "seo-specialist.md",
-        "sre-engineer.md",
-        "test-engineer.md",
-        "validator.md",
-        "vercel-expert.md"
+        "backend-specialist.toml",
+        "code-archaeologist.toml",
+        "database-architect.toml",
+        "debugger.toml",
+        "devops-engineer.toml",
+        "documentation-writer.toml",
+        "frontend-specialist.toml",
+        "game-developer.toml",
+        "mobile-developer.toml",
+        "orchestrator.toml",
+        "penetration-tester.toml",
+        "performance-optimizer.toml",
+        "product-manager.toml",
+        "project-planner.toml",
+        "qa-automation-engineer.toml",
+        "researcher.toml",
+        "security-auditor.toml",
+        "seo-specialist.toml",
+        "sre-engineer.toml",
+        "test-engineer.toml",
+        "validator.toml",
+        "vercel-expert.toml"
       ],
       "skills": [
         "api-design",
@@ -272,6 +230,28 @@
         "vibesec",
         "vuejs"
       ],
+      "generatedSkills": [
+        "accessibility",
+        "architecture",
+        "backend",
+        "create",
+        "database",
+        "debug",
+        "devops",
+        "implement-track",
+        "migrate",
+        "mobile",
+        "onboard",
+        "orchestrate",
+        "plan",
+        "refactor",
+        "release",
+        "review",
+        "security",
+        "spec",
+        "test",
+        "vercel"
+      ],
       "rulesTemplate": "platforms/codex/rules/AGENTS.md",
       "hooks": [
         {
@@ -282,28 +262,7 @@
       ]
     },
     "copilot": {
-      "workflows": [
-        "accessibility.md",
-        "architecture.md",
-        "backend.md",
-        "create.md",
-        "database.md",
-        "debug.md",
-        "devops.md",
-        "implement-track.md",
-        "migrate.md",
-        "mobile.md",
-        "onboard.md",
-        "orchestrate.md",
-        "plan.md",
-        "refactor.md",
-        "release.md",
-        "review.md",
-        "security.md",
-        "spec.md",
-        "test.md",
-        "vercel.md"
-      ],
+      "workflows": [],
       "agents": [
         "backend-specialist.md",
         "code-archaeologist.md",
@@ -400,6 +359,7 @@
         "vibesec",
         "vuejs"
       ],
+      "generatedSkills": [],
       "rulesTemplate": "platforms/copilot/rules/copilot-instructions.md",
       "hooks": [
         {
@@ -409,51 +369,30 @@
         }
       ],
       "prompts": [
-        "workflow-accessibility.prompt.md",
-        "workflow-architecture.prompt.md",
-        "workflow-backend.prompt.md",
-        "workflow-create.prompt.md",
-        "workflow-database.prompt.md",
-        "workflow-debug.prompt.md",
-        "workflow-devops.prompt.md",
-        "workflow-implement-track.prompt.md",
-        "workflow-migrate.prompt.md",
-        "workflow-mobile.prompt.md",
-        "workflow-onboard.prompt.md",
-        "workflow-orchestrate.prompt.md",
-        "workflow-plan.prompt.md",
-        "workflow-refactor.prompt.md",
-        "workflow-release.prompt.md",
-        "workflow-review.prompt.md",
-        "workflow-security.prompt.md",
-        "workflow-spec.prompt.md",
-        "workflow-test.prompt.md",
-        "workflow-vercel.prompt.md"
+        "accessibility.prompt.md",
+        "architecture.prompt.md",
+        "backend.prompt.md",
+        "create.prompt.md",
+        "database.prompt.md",
+        "debug.prompt.md",
+        "devops.prompt.md",
+        "implement-track.prompt.md",
+        "migrate.prompt.md",
+        "mobile.prompt.md",
+        "onboard.prompt.md",
+        "orchestrate.prompt.md",
+        "plan.prompt.md",
+        "refactor.prompt.md",
+        "release.prompt.md",
+        "review.prompt.md",
+        "security.prompt.md",
+        "spec.prompt.md",
+        "test.prompt.md",
+        "vercel.prompt.md"
       ]
     },
     "claude": {
-      "workflows": [
-        "accessibility.md",
-        "architecture.md",
-        "backend.md",
-        "create.md",
-        "database.md",
-        "debug.md",
-        "devops.md",
-        "implement-track.md",
-        "migrate.md",
-        "mobile.md",
-        "onboard.md",
-        "orchestrate.md",
-        "plan.md",
-        "refactor.md",
-        "release.md",
-        "review.md",
-        "security.md",
-        "spec.md",
-        "test.md",
-        "vercel.md"
-      ],
+      "workflows": [],
       "agents": [
         "backend-specialist.md",
         "code-archaeologist.md",
@@ -550,6 +489,28 @@
         "vibesec",
         "vuejs"
       ],
+      "generatedSkills": [
+        "accessibility",
+        "architecture",
+        "backend",
+        "create",
+        "database",
+        "debug",
+        "devops",
+        "implement-track",
+        "migrate",
+        "mobile",
+        "onboard",
+        "orchestrate",
+        "plan",
+        "refactor",
+        "release",
+        "review",
+        "security",
+        "spec",
+        "test",
+        "vercel"
+      ],
       "rulesTemplate": "platforms/claude/rules/CLAUDE.md",
       "hooks": [
         {
@@ -581,101 +542,10 @@
       ]
     },
     "gemini": {
-      "workflows": [
-        "accessibility.md",
-        "architecture.md",
-        "backend.md",
-        "create.md",
-        "database.md",
-        "debug.md",
-        "devops.md",
-        "implement-track.md",
-        "migrate.md",
-        "mobile.md",
-        "onboard.md",
-        "orchestrate.md",
-        "plan.md",
-        "refactor.md",
-        "release.md",
-        "review.md",
-        "security.md",
-        "spec.md",
-        "test.md",
-        "vercel.md"
-      ],
+      "workflows": [],
       "agents": [],
-      "skills": [
-        "api-design",
-        "architecture-doc",
-        "ci-cd-pipeline",
-        "code-review",
-        "csharp-best-practices",
-        "database-design",
-        "deep-research",
-        "django-drf",
-        "docker-compose-dev",
-        "drizzle-orm",
-        "electron-qa",
-        "expo-app",
-        "express-nodejs",
-        "fastapi",
-        "frontend-design",
-        "gin-golang",
-        "git-workflow",
-        "go-fiber",
-        "golang-best-practices",
-        "google-workspace",
-        "huggingface-ml",
-        "integration-testing",
-        "java-best-practices",
-        "javascript-best-practices",
-        "kaizen-iteration",
-        "kotlin-best-practices",
-        "kubernetes-deploy",
-        "laravel",
-        "llm-eval",
-        "mcp-server-builder",
-        "microservices-design",
-        "nestjs",
-        "nextjs",
-        "observability",
-        "owasp-security-review",
-        "pentest-skill",
-        "performance-testing",
-        "php-best-practices",
-        "playwright-interactive",
-        "playwright-persistent-browser",
-        "prisma",
-        "prompt-engineering",
-        "python-best-practices",
-        "rag-patterns",
-        "react",
-        "react-native",
-        "react-native-callstack",
-        "receiving-code-review",
-        "remix",
-        "requesting-code-review",
-        "rust-best-practices",
-        "sadd",
-        "sanitize-pii",
-        "secret-management",
-        "skill-creator",
-        "spec-driven-delivery",
-        "spring-boot",
-        "sqlalchemy",
-        "stitch",
-        "stripe-integration",
-        "svelte-sveltekit",
-        "swift-best-practices",
-        "system-design",
-        "systematic-debugging",
-        "t3-stack",
-        "tech-doc",
-        "typescript-best-practices",
-        "unit-testing",
-        "vibesec",
-        "vuejs"
-      ],
+      "skills": [],
+      "generatedSkills": [],
       "rulesTemplate": "platforms/gemini/rules/GEMINI.md",
       "hooks": [
         {
@@ -704,7 +574,29 @@
         "security.toml",
         "spec.toml",
         "test.toml",
-        "vercel.toml"
+        "vercel.toml",
+        "agent-backend-specialist.toml",
+        "agent-code-archaeologist.toml",
+        "agent-database-architect.toml",
+        "agent-debugger.toml",
+        "agent-devops-engineer.toml",
+        "agent-documentation-writer.toml",
+        "agent-frontend-specialist.toml",
+        "agent-game-developer.toml",
+        "agent-mobile-developer.toml",
+        "agent-orchestrator.toml",
+        "agent-penetration-tester.toml",
+        "agent-performance-optimizer.toml",
+        "agent-product-manager.toml",
+        "agent-project-planner.toml",
+        "agent-qa-automation-engineer.toml",
+        "agent-researcher.toml",
+        "agent-security-auditor.toml",
+        "agent-seo-specialist.toml",
+        "agent-sre-engineer.toml",
+        "agent-test-engineer.toml",
+        "agent-validator.toml",
+        "agent-vercel-expert.toml"
       ]
     }
   }

package/workflows/workflows/agent-environment-setup/platforms/antigravity/commands/accessibility.toml

@@ -1,19 +1,84 @@
 description = "Run a structured accessibility audit on web UI code with WCAG 2.2 AA compliance checks, ARIA validation, keyboard navigation testing, and screen reader verification."
 prompt = '''
-Follow the /accessibility workflow from .agent/workflows/accessibility.md.
+Execute the native projection of the /accessibility workflow.
+
+Run a structured accessibility audit on web UI code with WCAG 2.2 AA compliance checks, ARIA validation, keyboard navigation testing, and screen reader verification.
 
 Execution contract:
 1. Treat route selection as already resolved by this command; do not begin with skill discovery.
 2. Read `docs/foundation/PRODUCT.md`, `ENGINEERING_RULES.md`, `docs/foundation/ARCHITECTURE.md`, and `docs/foundation/TECH.md` in that order when they exist before non-trivial execution.
 Attached skills:
 - Load these exact skill IDs first: `code-review`, `frontend-design`, `performance-testing`, `react`, `nextjs`, `playwright-interactive`, `typescript-best-practices`, `javascript-best-practices`.
-- Local skill file hints if installed: `.agent/skills/code-review/SKILL.md`, `.agent/skills/frontend-design/SKILL.md`, `.agent/skills/performance-testing/SKILL.md`, `.agent/skills/react/SKILL.md`, `.agent/skills/nextjs/SKILL.md`, `.agent/skills/playwright-interactive/SKILL.md`, `.agent/skills/typescript-best-practices/SKILL.md`, `.agent/skills/javascript-best-practices/SKILL.md`.
+- Local skill file hints if installed: `.agents/skills/code-review/SKILL.md`, `.agents/skills/frontend-design/SKILL.md`, `.agents/skills/performance-testing/SKILL.md`, `.agents/skills/react/SKILL.md`, `.agents/skills/nextjs/SKILL.md`, `.agents/skills/playwright-interactive/SKILL.md`, `.agents/skills/typescript-best-practices/SKILL.md`, `.agents/skills/javascript-best-practices/SKILL.md`.
 - Treat the skill bundle as already resolved for this workflow. Do not start with route discovery.
-3. Confirm the request fits the workflow's "When to use" section.
+3. Confirm the request fits the workflow's "When to use" section before acting.
 4. Execute according to "Workflow steps" and apply "Context notes".
 5. Complete "Verification" checks and report concrete evidence.
-6. If freshness, public comparison, or explicit research needs appear, pause implementation and load `deep-research` or hand off to `@researcher` first.
+6. If freshness, public comparison, or explicit research needs appear, pause implementation and load `deep-research` or route to research first.
 7. For outside evidence: repo first, official docs next, Reddit/community only as labeled secondary evidence.
 
+Workflow source:
+# Accessibility Workflow
+
+## When to use
+
+Use this for accessibility audits, WCAG compliance review, or improving accessible user experience.
+
+## Routing
+
+- Primary specialist: `@frontend-specialist`
+- Verification support: `@test-engineer`
+- Review support: `@validator`
+
+## Context notes
+
+- This workflow file, active platform rules, and selected agents or skills guide execution.
+- Attach the target components, pages, or routes to audit. Include any existing axe or Lighthouse results.
+
+## Skill Routing
+
+- Primary skills: `frontend-code-review`, `frontend-design`
+- Supporting skills (optional): `i18n-localization`, `web-perf`, `react-expert`, `nextjs-developer`, `tailwind-patterns`, `playwright-e2e`, `typescript-pro`, `javascript-pro`
+- Start with `frontend-code-review` for WCAG compliance checks. Add `frontend-design` for accessible design patterns. Add `i18n-localization` for RTL and locale-specific accessibility.
+
+## Workflow steps
+
+1. Inventory components and user flows to audit.
+2. Run automated accessibility checks (axe, Lighthouse).
+3. Manual keyboard navigation and focus management review.
+4. ARIA validation — correct roles, states, and properties.
+5. Screen reader compatibility assessment.
+6. Prioritize findings and provide remediation guidance.
+
+## Verification
+
+- All critical WCAG 2.2 AA violations identified.
+- Keyboard navigation works for all interactive elements.
+- ARIA attributes are semantically correct.
+- Color contrast meets minimum ratios.
+- Focus management is logical and visible.
+
+## Output Contract
+
+```yaml
+ACCESSIBILITY_WORKFLOW_RESULT:
+  primary_agent: frontend-specialist
+  supporting_agents: [test-engineer?, validator?]
+  primary_skills: [frontend-code-review, frontend-design]
+  supporting_skills: [i18n-localization?, web-perf?, playwright-e2e?]
+  audit_scope: [<component-or-route>]
+  findings:
+    - severity: critical | high | medium | low
+      wcag_criterion: <string>
+      element: <string>
+      description: <string>
+      remediation: <string>
+  automated_results:
+    tool: <axe | lighthouse | other>
+    violations: <number>
+    passes: <number>
+  follow_up_items: [<string>] | []
+```
+
 If command arguments are provided, treat them as additional user context.
 '''

package/workflows/workflows/agent-environment-setup/platforms/antigravity/commands/agent-backend-specialist.toml

@@ -0,0 +1,86 @@
+description = "Backend specialist for API contracts, service logic, schema-aware backend changes, auth-sensitive implementation, payment integrations, and serverless architecture. Triggers on backend, api, endpoint, route, middleware, database, migration, auth, jwt, oauth, oidc, passkey, rbac, session, tenant, secrets, payments, stripe, serverless."
+prompt = '''
+Execute the native projection of the @backend-specialist specialist route.
+
+Backend specialist for API contracts, service logic, schema-aware backend changes, auth-sensitive implementation, payment integrations, and serverless architecture. Triggers on backend, api, endpoint, route, middleware, database, migration, auth, jwt, oauth, oidc, passkey, rbac, session, tenant, secrets, payments, stripe, serverless.
+
+Execution contract:
+1. Treat route selection as already resolved by this command; do not begin with skill discovery.
+2. Read `docs/foundation/MEMORY.md` first when it exists, then load deeper foundation docs only when needed.
+Attached skills:
+- Load these exact skill IDs first: `api-design`, `system-design`, `owasp-security-review`, `database-design`, `drizzle-orm`, `microservices-design`, `javascript-best-practices`, `nestjs`, `fastapi`, `stripe-integration`, `ci-cd-pipeline`, `frontend-design`, `typescript-best-practices`, `python-best-practices`, `golang-best-practices`, `java-best-practices`, `csharp-best-practices`, `kotlin-best-practices`, `rust-best-practices`, `php-best-practices`.
+- Local skill file hints if installed: `.agents/skills/api-design/SKILL.md`, `.agents/skills/system-design/SKILL.md`, `.agents/skills/owasp-security-review/SKILL.md`, `.agents/skills/database-design/SKILL.md`, `.agents/skills/drizzle-orm/SKILL.md`, `.agents/skills/microservices-design/SKILL.md`, `.agents/skills/javascript-best-practices/SKILL.md`, `.agents/skills/nestjs/SKILL.md`.
+- Treat the skill bundle as already resolved for this workflow. Do not start with route discovery.
+3. Stay within the specialist scope and escalate to a broader workflow when the task crosses domains.
+4. Run focused verification for the changes or analysis you perform.
+5. For outside evidence: repo first, official docs next, Reddit/community only as labeled secondary evidence.
+
+Specialist source:
+# Backend Specialist
+
+Build backend systems that stay correct under production pressure.
+
+## Skill Loading Contract
+
+- Do not call `skill_search` for any skill in the pre-declared list when the task clearly falls into that domain.
+- Load one primary skill first based on the dominant concern:
+  - `api-design` for API contract shape, versioning, or endpoint design
+  - `api-patterns` for REST/RPC conventions and HTTP semantics
+  - `auth-architect` for authentication, authorization, session, RBAC, or SSO flows
+  - `database-design` for schema design, query optimization, or migration planning
+  - `nestjs-expert` for NestJS-specific module, provider, or decorator patterns
+  - `fastapi-expert` for FastAPI route, dependency injection, or Pydantic model patterns
+  - `graphql-architect` for GraphQL schema, resolver, or subscription design
+  - `microservices-architect` for service boundaries, event-driven patterns, or distributed systems
+  - `stripe-best-practices` for payment processing, subscription management, or webhook handling
+  - `serverless-patterns` for Lambda, Edge Functions, cold starts, or serverless architecture
+  - `i18n-localization` for internationalization of backend responses, locale-aware data
+- Add one supporting skill only when the task genuinely crosses concerns.
+- Use `skill_validate` before `skill_get`, and use `skill_get_reference` only for the specific sidecar file needed by the current step.
+
+## Skill References
+
+Load on demand. Do not preload all references.
+
+| File                      | Load when                                                                    |
+| ------------------------- | ---------------------------------------------------------------------------- |
+| `api-design`            | Designing new API contracts, versioning, or endpoint shape.                  |
+| `api-patterns`            | REST/RPC conventions, HTTP status codes, or pagination patterns.             |
+| `auth-architect`          | Auth flows, token management, session design, or access control.             |
+| `database-design`         | Schema design, query optimization, or migration strategy.                    |
+| `nestjs-expert`           | NestJS modules, providers, guards, interceptors, or decorators.              |
+| `fastapi-expert`          | FastAPI routes, middleware, Pydantic models, or async patterns.              |
+| `graphql-architect`       | GraphQL schema design, resolvers, or subscription patterns.                  |
+| `microservices-architect` | Service boundaries, event-driven architecture, or distributed transactions.  |
+| `stripe-best-practices`   | Payment processing, subscriptions, webhooks, or Stripe SDK usage.            |
+| `serverless-patterns`     | Lambda architecture, cold starts, Edge Functions, or serverless constraints. |
+| `i18n-localization`       | Locale-aware responses, pluralization, or internationalization patterns.     |
+
+## Operating Stance
+
+- Prefer explicit contracts over implicit coupling.
+- Treat auth as a first-class concern, not an afterthought.
+- Design for observability: structured logging, correlation IDs, and clear error responses.
+- Keep database access behind a data-access layer; never scatter raw queries across handlers.
+- Validate at boundaries, trust within boundaries.
+- Prefer idempotent operations for anything that touches external state.
+
+## Decision Frameworks
+
+| When choosing... | Prefer                        | Because                                    |
+| ---------------- | ----------------------------- | ------------------------------------------ |
+| API style        | REST for CRUD, GraphQL for UI | Match consumption pattern to client needs  |
+| Auth approach    | JWT + refresh for SPAs        | Stateless scaling with secure rotation     |
+| Database access  | ORM with raw escape hatch     | Safety by default, performance when needed |
+| Error responses  | Structured error envelope     | Machine-parseable, debuggable, consistent  |
+| Background work  | Queue-based with dead-letter  | Fault tolerance and retry isolation        |
+
+## Output Expectations
+
+- Explain the main architecture decision in concrete terms.
+- Call out any security, performance, or data-integrity risk left behind.
+- Run focused checks when code changes land.
+- Note any API contract or schema changes that affect consumers.
+
+If command arguments are provided, treat them as additional user context.
+'''