@cubis/foundry 0.3.83 → 0.3.84

package/workflows/workflows/agent-environment-setup/platforms/claude/generated-skills/review/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: review
-description: "Run a strict review for bugs, regressions, accessibility issues, security risk, and code quality with prioritized findings."
+description: "Comprehensive code review combining quality review and security audit."
 license: MIT
 metadata:
   author: cubis-foundry
@@ -10,62 +10,52 @@ metadata:
   command: "/review"
 compatibility: Claude Code
 ---
-# review Workflow
 # Review Workflow
-
 ## When to use
 
-Use this for code review, PR review, or quality audit of existing code changes.
+Use for code review, pull request review, quality audits, or pre-merge verification.
 
-## Routing
+## Agent Chain
 
-- Primary specialist: `@frontend-specialist` (for frontend code) or `@backend-specialist` (for backend code)
-- Security review: `@security-auditor`
-- Quality validation: `@validator`
-- Verification support: `@test-engineer`
+`reviewer` -> `implementer` (if fixes needed)
 
-## Context notes
+## Routing
 
-- This workflow file, active platform rules, and selected agents or skills guide execution.
-- Attach the PR diff, changed files, or specific code paths to review.
+1. **Review**: `@reviewer` performs quality, pattern, maintainability, and security review.
+2. **Fix (if needed)**: `@implementer` addresses any critical or high-severity findings.
 
 ## Skill Routing
 
-- Primary skills: `frontend-code-review`, `static-analysis`, `testing-patterns`
-- Supporting skills (optional): `security-engineer`, `vulnerability-scanner`, `web-perf`, `react-expert`, `nextjs-developer`, `typescript-pro`, `javascript-pro`, `python-pro`, `golang-pro`
-- Start with `frontend-code-review` for UI code or `static-analysis` for backend code. Add `testing-patterns` when evaluating test quality. Add `security-engineer` for security-sensitive changes.
+- Primary skills: `code-review`, `owasp-security-review`
+- Supporting skills (optional): `secret-management`, `pentest-skill`, `api-design`, `typescript-best-practices`
+
+## Context notes
+
+- Provide the files or diff to review, and any specific concerns or focus areas.
+- Quality review and security review are combined in one pass.
 
 ## Workflow steps
 
-1. Understand the intent and scope of the changes.
-2. Review for correctness — logic bugs, edge cases, and regressions.
-3. Review for security — input validation, auth, secrets exposure.
-4. Review for accessibility — WCAG compliance, keyboard navigation, screen readers.
-5. Review for performance — unnecessary re-renders, N+1 queries, bundle impact.
-6. Prioritize findings by severity and provide actionable feedback.
+1. Reviewer analyzes the code and records quality and security findings together.
+2. If no critical/high issues: APPROVE.
+3. If fixes are needed: implementer addresses the findings.
+4. After fixes: re-review to verify resolutions.
 
 ## Verification
 
-- Each finding has severity, location, and suggested fix.
-- Findings prioritized: critical > high > medium > low.
-- Positive observations noted alongside issues.
-- Reviewed against codebase conventions.
+- All critical and high-severity findings addressed.
+- Security audit complete with no unresolved vulnerabilities.
+- Final review status is APPROVE.
 
 ## Output Contract
 
 ```yaml
-REVIEW_WORKFLOW_RESULT:
-  primary_agent: <frontend-specialist | backend-specialist>
-  supporting_agents: [security-auditor?, validator?, test-engineer?]
-  primary_skills: [frontend-code-review?, static-analysis?, testing-patterns?]
-  supporting_skills: [security-engineer?, vulnerability-scanner?, web-perf?]
-  findings:
-    - severity: critical | high | medium | low
-      category: correctness | security | accessibility | performance | style
-      location: <file:line>
-      description: <string>
-      suggestion: <string>
-  overall_assessment: approve | request_changes | reject
-  positive_observations: [<string>] | []
+WORKFLOW_RESULT:
+  primary_agent: reviewer
+  supporting_agents: [implementer]
+  review_status: <approve|request_changes>
+  critical_findings: <number>
+  high_findings: <number>
+  security_findings: <number>
   follow_up_items: [<string>] | []
 ```

package/workflows/workflows/agent-environment-setup/platforms/claude/generated-skills/test/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: test
-description: "Design and execute verification strategy aligned to user risk, release confidence, and regression evidence."
+description: "Test authoring and coverage improvement: explore the code, write tests, and review test quality."
 license: MIT
 metadata:
   author: cubis-foundry
@@ -10,62 +10,54 @@ metadata:
   command: "/test"
 compatibility: Claude Code
 ---
-# test Workflow
 # Test Workflow
-
 ## When to use
 
-Use this when writing new tests, improving coverage, debugging test failures, or designing a testing strategy.
+Use when adding tests, fixing test failures, or improving test coverage for existing code.
 
-## Routing
+## Agent Chain
 
-- Primary specialist: `@test-engineer`
-- Automation support: `@qa-automation-engineer`
-- Domain support: `@backend-specialist`, `@frontend-specialist`
-- Verification support: `@validator`
+`explorer` -> `tester` -> `reviewer`
 
-## Context notes
+## Routing
 
-- This workflow file, active platform rules, and selected agents or skills guide execution.
-- Attach the code under test, existing test files, coverage reports, and any failing test output.
+1. **Explore**: `@explorer` reads the code under test - maps functions, inputs, outputs, edge cases, and existing test patterns.
+2. **Test**: `@tester` writes tests following the project's conventions, runs the suite, and analyzes results.
+3. **Review**: `@reviewer` evaluates test quality, coverage, and correctness.
 
 ## Skill Routing
 
-- Primary skills: `testing-patterns`, `webapp-testing`
-- Supporting skills (optional): `playwright-e2e`, `error-ux-observability`, `debugging-strategies`, `frontend-code-review`, `static-analysis`, `typescript-pro`, `javascript-pro`, `python-pro`, `golang-pro`, `java-pro`
-- Start with `testing-patterns` for test strategy and architecture. Add `webapp-testing` for implementation. Add `playwright-e2e` for E2E automation. Add `error-ux-observability` for testing error states.
+- Primary skills: `unit-testing`, `integration-testing`
+- Supporting skills (optional): `deep-research`, `playwright-interactive`, `playwright-web-qa`, `flutter-mobile-qa`, `code-review`
+
+## Context notes
+
+- Specify the code area to test, desired coverage level, and any specific scenarios to verify.
+- Tester uses the project's existing test framework and patterns.
 
 ## Workflow steps
 
-1. Assess current test coverage and identify gaps.
-2. Design test strategy (which layers, what to test, what to skip).
-3. Implement tests with clear arrange/act/assert structure.
-4. Run tests and verify they pass.
-5. Review coverage improvement and remaining gaps.
+1. Explorer maps the code to be tested: public API, edge cases, error paths.
+2. Tester writes tests following existing project patterns (framework, naming, structure).
+3. Tester runs the full test suite and reports results.
+4. Reviewer evaluates test coverage and quality - checks for missing edge cases.
+5. If gaps are found, tester adds additional tests and re-runs.
 
 ## Verification
 
-- All new tests pass reliably (no flakiness).
-- Tests cover the identified risk areas.
-- Coverage metrics improved or maintained.
-- Test naming clearly describes the scenario being verified.
+- All new tests pass.
+- Test coverage meets the specified target.
+- No existing tests broken by changes.
 
 ## Output Contract
 
 ```yaml
-TEST_WORKFLOW_RESULT:
-  primary_agent: test-engineer
-  supporting_agents: [qa-automation-engineer?, backend-specialist?, frontend-specialist?, validator?]
-  primary_skills: [testing-patterns, webapp-testing]
-  supporting_skills: [playwright-e2e?, error-ux-observability?, debugging-strategies?]
-  test_strategy:
-    unit: <number of tests>
-    integration: <number of tests>
-    e2e: <number of tests>
-  tests_written: [<test-file-path>]
-  coverage:
-    before: <percentage or description>
-    after: <percentage or description>
-  gaps_remaining: [<string>] | []
+WORKFLOW_RESULT:
+  primary_agent: tester
+  supporting_agents: [explorer, reviewer]
+  tests_added: [<path>]
+  tests_passed: <number>
+  tests_failed: <number>
+  coverage_delta: <string>
   follow_up_items: [<string>] | []
 ```

package/workflows/workflows/agent-environment-setup/platforms/claude/generated-skills/web-qa/SKILL.md

@@ -0,0 +1,68 @@
+---
+name: web-qa
+description: "Run charter-driven web QA through Playwright MCP with deterministic browser evidence and report-ready artifacts."
+license: MIT
+metadata:
+  author: cubis-foundry
+  route-kind: "workflow"
+  route-id: "web-qa"
+  platform: "Claude Code"
+  command: "/web-qa"
+compatibility: Claude Code
+---
+# Web QA Workflow
+## When to use
+
+Use when validating a real browser flow with Playwright MCP and the main outcome is execution evidence, not authoring a reusable suite.
+
+## Agent Chain
+
+`explorer` -> `tester` -> `reviewer`
+
+## Routing
+
+1. **Explore**: `@explorer` confirms the base URL, charter inputs, environment access, and Playwright MCP readiness.
+2. **Test**: `@tester` runs the web QA charter, captures browser evidence, and records the exact blocked step when execution fails.
+3. **Review**: `@reviewer` checks whether the artifacts support the final verdict and whether accessibility/network/console evidence is sufficient.
+
+## Skill Routing
+
+- Primary skills: `playwright-web-qa`
+- Supporting skills (optional): `playwright-interactive`, `integration-testing`, `code-review`
+
+## Context notes
+
+- Provide the charter path, base URL, and any required starting route or environment assumption.
+- This route is for live QA execution and evidence capture, not generalized suite authoring.
+## Runtime contract
+
+- Prefer Playwright MCP as the execution path.
+- Save artifacts under `artifacts/web-qa/`.
+- Capture deterministic screenshots, DOM snapshots, console logs, network evidence, and accessibility evidence when requested.
+- Stop after one controlled retry and report evidence.
+
+## Workflow steps
+
+1. Confirm the charter, base URL, and starting route.
+2. Start from the explicit page state and capture baseline evidence.
+3. Execute each charter step through Playwright MCP.
+4. Persist screenshots, DOM, console, network, and accessibility artifacts as the charter requires.
+5. Review the evidence and summarize pass/fail/blocked findings.
+
+## Verification
+
+- The charter ran against the intended URL.
+- Evidence exists for baseline state and any failure.
+- The final report states the Playwright MCP execution result and artifact paths.
+
+## Output Contract
+
+```yaml
+WORKFLOW_RESULT:
+  primary_agent: tester
+  supporting_agents: [explorer, reviewer]
+  provider_used: <playwright-mcp>
+  artifacts: [<path>]
+  blocked_reasons: [<string>] | []
+  follow_up_items: [<string>] | []
+```

package/workflows/workflows/agent-environment-setup/platforms/claude/hooks/route-research-guard.mjs

@@ -20,7 +20,7 @@ if (/(^|\s)(\/[-a-z0-9]+|@[a-z0-9_-]+)/i.test(prompt)) {
   );
 }
 
-if (/(^|[^a-z0-9-])(deep-research|stitch|skill-creator|frontend-design|api-design|database-design)([^a-z0-9-]|$)/i.test(normalized)) {
+if (/(^|[^a-z0-9-])(deep-research|stitch|stitch-design-orchestrator|stitch-prompt-enhancement|stitch-design-system|stitch-implementation-handoff|skill-creator|frontend-design|api-design|database-design)([^a-z0-9-]|$)/i.test(normalized)) {
   reminders.push(
     "Named skill detected. Run skill_validate on the exact skill ID first and skip route_resolve when it validates."
   );