@ericrisco/rsc 0.1.54 → 0.1.56

package/manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.54",
+  "version": "0.1.56",
   "counts": {
     "skills": 258
   },
@@ -2020,7 +2020,7 @@
     },
     {
       "id": "gdpr-privacy",
-      "description": "Use when getting a product or website into practical GDPR shape: a privacy policy that matches what the product actually does, a cookie/consent banner, a defensible lawful basis per processing activity, a Record of Processing Activities, an Article 28 data-processing agreement with a vendor, an international-transfer mechanism (SCCs), or a working data-subject-rights flow. Triggers: 'write a GDPR privacy policy', 'is our cookie banner compliant', 'consent or legitimate interest for product emails', 'write the LIA', 'review this vendor DPA', 'we send data to a US sub-processor what mechanism', 'build our ROPA', 'how do we handle a DSAR / right to erasure', 'do we need a DPIA', 'redacta nuestra política de privacidad RGPD', 'revisa el banner de cookies perquè el rebuig sigui tan fàcil com acceptar'. NOT internal data retention/classification rules (that is data-policy) and NOT the consumer Terms of Service contract (that is terms-conditions).",
+      "description": "Use when producing the GDPR artifacts a product publishes or hands over: a privacy policy true to what it processes, a cookie/consent banner, a lawful basis per purpose, an Art. 28 DPA, an SCC transfer mechanism, or a DSAR flow. Drafts for counsel review. NOT internal retention rules (that is `data-policy`), NOT consumer ToS (that is `terms-conditions`).",
       "tags": [
         "gdpr",
         "privacy",
@@ -2379,7 +2379,7 @@
     },
     {
       "id": "invoicing",
-      "description": "Use when someone needs to cut a legally-valid bill or quote, move it through its get-paid lifecycle, or chase money that hasn't arrived — billing completed work, drafting a quote before a job, an invoice weeks overdue, what must legally be on the page, or readiness for a structured e-invoicing mandate. Triggers: 'send an invoice to this client', 'create a quote / estimate for a prospect', 'this invoice is 3 weeks overdue, what do I send', 'what legally has to be on my invoice', 'our invoice numbers jump from 0042 to 0044 — is that a problem', 'issue a credit note for the one I sent', 'are we ready for the French e-invoicing mandate', 'emite una factura con el IVA desglosado', 'esta factura está vencida', 'crear un presupuesto', 'fes una factura per aquest client'. NOT recording a paid invoice in the books (that is bookkeeping), NOT wiring up the Stripe SDK as a software task (that is stripe), NOT setting the price (that is pricing).",
+      "description": "Use when issuing an invoice, quote, or credit note and moving it draft-to-paid — the legally required VAT fields, gap-free numbering, per-country e-invoicing mandates, dunning overdue ones. NOT recording a paid invoice in the books (that is `bookkeeping`), NOT Stripe SDK plumbing (that is `stripe`), NOT setting the price (that is `pricing`).",
       "tags": [
         "invoicing",
         "billing",
@@ -2654,7 +2654,7 @@
     },
     {
       "id": "linkedin-outreach",
-      "description": "Use when running LinkedIn-native social selling as a repeatable motion: building Sales Navigator saved searches and trigger alerts, fixing a low connection-acceptance rate, designing a daily social-selling routine, turning profile views / post engagers / accepted connections into warm conversations, and logging every touch so the loop is measurable. Triggers: 'set up a Sales Nav saved search and alert me on job changes', 'how many connection requests per week without getting flagged', 'my acceptance rate is in the toilet', 'someone viewed my profile, what is the play', 'turn the people who liked my post into conversations', 'munta'm una rutina de social selling a LinkedIn', '¿cuántas invitaciones puedo enviar por semana'. This owns the loop and its ledger, NOT writing the cold connection note or DM copy (that is cold-outreach).",
+      "description": "Use when running LinkedIn social selling as a repeatable motion — Sales Navigator saved searches and trigger alerts, weekly request budgets, fixing a low acceptance rate, turning profile views and post engagers into warm threads, logging every touch. NOT the note or DM copy (that is `cold-outreach`), NOT the deal after a reply (that is `sales-pipeline`).",
       "tags": [
         "linkedin",
         "social-selling",
@@ -2888,7 +2888,7 @@
     },
     {
       "id": "meeting-notes",
-      "description": "Use when a meeting, standup, or call just ended and you have a transcript or rough notes to turn into a durable record — extract the decisions with their why, assign action items with an owner and a real due date, flag open questions, and ship a one-screen recap within 24–48h. Also when an AI-notetaker transcript hallucinated tasks or mixed up speakers and you must clean it before sending. Triggers: 'pull the action items out of this transcript and tell me who owns what by when', 'the Otter transcript mixed up who said what, clean it up so I can send it', 'resume la reunión de hoy y saca los próximos pasos con responsable y fecha límite', 'fes una acta de la reunió'. NOT the durable decision record with full alternatives and review cadence (that is decision-records).",
+      "description": "Use when a meeting just ended and a transcript or rough notes must become a record the absent can act on — decisions with their why, actions with an owner and a real date, open questions, a recap inside 24–48h — or to clean an AI-notetaker draft that invented tasks or swapped speakers. NOT the durable ADR with alternatives weighed (that is decision-records).",
       "tags": [
         "meeting-notes",
         "action-items",
@@ -3135,7 +3135,7 @@
     },
     {
       "id": "no-code-app",
-      "description": "Use when building an app on a no-code/low-code platform (Bubble, Softr, Glide, with Airtable/Xano backends) — picking the tool, modeling the data, taming usage/cost metering, or planning the exit before lock-in. Triggers: 'build a CRM without code', 'Bubble or Glide for my MVP', 'monta una app sin codi per reserves', 'my Bubble bill suddenly exploded' (workload-unit metering), 'Glide updates overage', 'how do I avoid getting locked into a no-code tool', 'when should I stop and write real code'. NOT a coded web app (that is nextjs).",
+      "description": "Use when building an app on a no-code/low-code platform (Bubble, Softr, Glide over Airtable or Xano) — picking the platform, modeling the data, keeping usage-metered cost predictable, and planning the exit before lock-in. NOT a hand-written coded app (that is `nextjs`), NOT wiring SaaS tools together with no app UI (that is `automation-flows`).",
       "tags": [
         "no-code",
         "low-code",
@@ -3307,7 +3307,7 @@
     },
     {
       "id": "performance",
-      "description": "Use when one page or route is slow for a single user and the fix has to start with a measurement — failing Core Web Vitals (LCP, INP, CLS), a bloated JS bundle, too many re-renders, slow hydration, or a profiler showing where the time actually goes. Triggers: 'my LCP is 4 seconds', 'the page feels janky, typing lags', 'First Load JS is huge', 'INP is failing in Search Console', the non-obvious 'we import the whole library for one function' and 'a use client boundary is shipping the server tree to the browser', and Catalan/Spanish 'la pàgina carrega lenta i no passa els Core Web Vitals' / 'el bundle pesa demasiado, hay que analizarlo antes de tocar nada'. NOT surviving a concurrent traffic spike with caches, replicas and load tests (that is scaling), NOT fixing the slow SQL query or N+1 itself (that is postgresdb).",
+      "description": "Use when a page or interaction is slow for one user and the fix starts from a measurement — a failing Core Web Vital (LCP, INP, CLS), a heavy JS bundle, wasted re-renders, an over-broad client boundary: profile, attribute the cost to one phase, fix it, re-measure. NOT surviving concurrent load (that is `scaling`), NOT the slow query (that is `postgresdb`).",
       "tags": [
         "performance",
         "core-web-vitals",
@@ -3459,7 +3459,7 @@
     },
     {
       "id": "power-automate",
-      "description": "Use when operating Microsoft Power Automate cloud flows programmatically — creating, enabling, updating, listing or deleting flows through the Dataverse Web API (the workflow table, category 5) with Entra ID / OAuth2 auth, or reading action-level run history via the third-party FlowStudio MCP. Triggers: 'create a Power Automate cloud flow with the Dataverse API', 'enable my flow by code / set statecode to 1', 'why can't I create or edit a My Flow programmatically', 'PATCH the workflow clientdata', 'automatizar el despliegue de un flujo de Power Automate desde código'. NOT designing the flow or authoring its definition (automation-flows), NOT choosing a platform by billing model (automation-strategy), NOT a generic typed REST client with auth/pagination/backoff (api-connector-builder), NOT the endpoint receiving an HTTP-trigger POST in your app (webhooks), NOT scripting Microsoft 365 / Graph mail & calendar directly (no first-party skill — api-connector-builder, or google-workspace).",
+      "description": "Use when operating Microsoft Power Automate cloud flows from code — create, enable, update, list or delete via the Dataverse Web API (`workflow` table, category 5) with Entra ID OAuth2, plus run-history debugging. NOT designing the flow definition (that is `automation-flows`), NOT picking a platform by billing model (that is `automation-strategy`).",
       "tags": [
         "power-automate",
         "dataverse",
@@ -3750,7 +3750,7 @@
     },
     {
       "id": "react-native",
-      "description": "Use when writing the JS/TS code inside a React Native or Expo app — screens, navigation, lists, animation, platform-conditional UI, data/offline state, and native-module authoring — and when killing runtime jank or render bugs. Triggers: 'scaffold an Expo Router app', 'FlashList vs FlatList', 'auth-gated route groups', 'gesture reattaches every render', 're-render storm on every keystroke', 'deep link lands on the wrong screen', 'write an Expo Module wrapping a native SDK', 'la llista pateix lag quan faig scroll', 'mi app va fluida en iOS pero a tirones en Android'. NOT eas build/submit/OTA update/prebuild/config-plugin (that is expo), NOT a Dart app (that is flutter), NOT web React/DOM (that is react or nextjs).",
+      "description": "Use when writing the JS/TS inside a React Native or Expo app — screens, Expo Router navigation, lists, Reanimated gestures, platform forks, offline state, native modules — or killing jank and render storms. NOT eas build/submit/OTA/config-plugin (that is `expo`), NOT a Dart app (that is `flutter`), NOT web React/DOM (that is `react` or `nextjs`).",
       "tags": [
         "react-native",
         "expo",
@@ -3994,7 +3994,7 @@
     },
     {
       "id": "roast-me",
-      "description": "Use when you want honest, comedic feedback on how you prompt — analyzing your own past sessions to score prompt quality and compute efficiency, surface your worst habits, and generate a model-selection cheat sheet. Triggers: 'roast me', 'roast my prompting', 'audit my prompting habits', 'how good are my prompts', 'am I prompting well', 'what are my bad prompt habits', 'analiza mis prompts', 'puntua els meus prompts', 'how much am I wasting on model costs'. NOT reviewing your code or output quality (use code-review for that) and NOT a general prompt-engineering tutorial (use prompt-engineering for that).",
+      "description": "Use when someone wants an honest, comedic audit of their own prompting — reads their past agent transcripts, scores prompt quality and compute efficiency, names their worst habits, builds a model-selection cheat sheet. NOT reviewing code an agent produced (that is `code-review`), NOT prompting technique in general (that is `prompt-engineering`).",
       "tags": [
         "prompting",
         "self-audit",
@@ -4322,7 +4322,7 @@
     },
     {
       "id": "shortform-strategy",
-      "description": "Use when running the durable strategy layer of a TikTok and/or Instagram Reels account — positioning, posting cadence, format mix, which trends and sounds to ride, recurring series, and the what-worked learning loop — not making one video. Use for standing up a new account before posting; diagnosing a flat or declining account (positioning, cadence, or format?); deciding whether to ride a trend or sound now; designing a recurring series; the monthly strategy review; or choosing the Reels-vs-carousel mix. Triggers: 'starting a new TikTok account, what and how often should we post', 'we post every single day and our reach is going down' (cadence-dilution symptom, no strategy word), 'should we jump on this sound or is it dead', 'we want a weekly recurring series on Reels', 'muntar l''estratègia del compte de Reels: posicionament i cadència', '¿nos subimos a esta tendencia o ya pasó?'. NOT writing the single short script or hook variants (that is video-shorts).",
+      "description": "Use when the unit of work is a TikTok/Reels account, not one clip: positioning, sustainable cadence and format mix, ride-or-skip on a trend or sound, recurring series, diagnosing a flat account, and the dated learning loop. NOT the single script or hook variants (that is `video-shorts`), NOT the idea backlog (that is `shortform-ideation`).",
       "tags": [
         "short-form-video",
         "tiktok",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ericrisco/rsc",
-  "version": "0.1.54",
+  "version": "0.1.56",
   "description": "Eric Risco's agent-skills catalog as a granular, self-recommending CLI installer.",
   "type": "module",
   "bin": {

package/skills/gdpr-privacy/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: gdpr-privacy
-description: "Use when getting a product or website into practical GDPR shape: a privacy policy that matches what the product actually does, a cookie/consent banner, a defensible lawful basis per processing activity, a Record of Processing Activities, an Article 28 data-processing agreement with a vendor, an international-transfer mechanism (SCCs), or a working data-subject-rights flow. Triggers: 'write a GDPR privacy policy', 'is our cookie banner compliant', 'consent or legitimate interest for product emails', 'write the LIA', 'review this vendor DPA', 'we send data to a US sub-processor what mechanism', 'build our ROPA', 'how do we handle a DSAR / right to erasure', 'do we need a DPIA', 'redacta nuestra política de privacidad RGPD', 'revisa el banner de cookies perquè el rebuig sigui tan fàcil com acceptar'. NOT internal data retention/classification rules (that is data-policy) and NOT the consumer Terms of Service contract (that is terms-conditions)."
+description: "Use when producing the GDPR artifacts a product publishes or hands over: a privacy policy true to what it processes, a cookie/consent banner, a lawful basis per purpose, an Art. 28 DPA, an SCC transfer mechanism, or a DSAR flow. Drafts for counsel review. NOT internal retention rules (that is `data-policy`), NOT consumer ToS (that is `terms-conditions`)."
 tags: [gdpr, privacy, data-protection, cookies, consent, lawful-basis, dpa, scc, dsar, ropa, dpia, rgpd]
 recommends: [data-policy, terms-conditions, contracts, compliance, secure-coding, email-deliverability]
 origin: risco
@@ -128,9 +128,7 @@ Per-right runbook: `references/dsar-and-consent.md`.
 - **DPIA (Art. 35):** mandatory *before* any processing "likely to result in a high risk." Trigger checklist — do a DPIA if any apply: large-scale processing of special categories (Art. 9 data), systematic monitoring of a public area, or novel/high-risk technology (e.g. new biometric or AI-driven profiling). When in doubt, do it.
 - **Breach (Art. 33/34):** notify the supervisory authority **within 72 hours** of becoming aware, unless the breach is unlikely to result in risk; notify affected individuals when the risk to them is high. Have the contact and the template ready *before* a breach, not during.
 
-## The legal boundary (non-negotiable)
-
-This skill drafts artifacts and flags issues. It is **not legal advice**. Emit the counsel/DPO-review line before anything is published or relied on — every time, no exceptions.
+## Stakes, and what isn't yours
 
 The fines make the stakes concrete: up to **€20M or 4% of global annual turnover** (whichever is higher) for the most serious infringements, €10M / 2% for the lesser tier; cumulative GDPR fines already exceed €7.1B. This is not a Big-Tech-only risk.
 
@@ -158,10 +156,4 @@ Hand off what isn't yours:
 | "Industry-standard security" with no Art. 32 reference | Cite Article 32 and describe the actual measures |
 | Says it's giving legal advice / the policy is safe to publish unreviewed | Flag for qualified privacy counsel / DPO every time |
 
-## References
-
-- `references/privacy-policy-blueprint.md` — Art. 13/14 mandatory-disclosure sections as `[BRACKET]` fill-ins, each with a "why required" line.
-- `references/dpa-and-transfers.md` — Art. 28 demand/offer clause table, 2021 SCC module picker, TIA skeleton, DPF note, sub-processor change-notice clause.
-- `references/dsar-and-consent.md` — data-subject-rights runbook, the LIA three-part template, a compliant cookie-banner config shape, and the `verify.sh` banlist rationale.
-
-Run `scripts/verify.sh <artifact-file>` over any policy/banner/DPA you emit to catch missing Art. 13/14 tokens, placeholder leftovers, boilerplate-lies, and a banner missing its reject control.
+Run `scripts/verify.sh <artifact-file>` over any policy/banner/DPA you emit to catch missing Art. 13/14 tokens, placeholder leftovers, boilerplate-lies, and a banner missing its reject control (banlist rationale in `references/dsar-and-consent.md`).

package/skills/gdpr-privacy/evals/cases.yaml

@@ -14,9 +14,9 @@ should_trigger:
   - prompt: "Someone emailed asking us to delete all their data — what's our deadline and process?"
     why: DSAR/erasure flow and the one-month statutory clock with exceptions.
   - prompt: "Redacta nuestra política de privacidad conforme al RGPD."
-    why: Spanish trigger — drafting the privacy policy under GDPR.
+    why: Drafting the privacy policy under GDPR, asked in Spanish — matched by meaning, not keyword.
   - prompt: "Revisa el banner de cookies del web perquè el rebuig sigui tan fàcil com acceptar."
-    why: Catalan trigger — cookie-banner review with the reject-parity rule.
+    why: Cookie-banner review against the reject-parity rule, asked in Catalan.
 
 should_not_trigger:
   - prompt: "Define our internal data retention schedule and data-classification tiers."

package/skills/invoicing/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: invoicing
-description: "Use when someone needs to cut a legally-valid bill or quote, move it through its get-paid lifecycle, or chase money that hasn't arrived — billing completed work, drafting a quote before a job, an invoice weeks overdue, what must legally be on the page, or readiness for a structured e-invoicing mandate. Triggers: 'send an invoice to this client', 'create a quote / estimate for a prospect', 'this invoice is 3 weeks overdue, what do I send', 'what legally has to be on my invoice', 'our invoice numbers jump from 0042 to 0044 — is that a problem', 'issue a credit note for the one I sent', 'are we ready for the French e-invoicing mandate', 'emite una factura con el IVA desglosado', 'esta factura está vencida', 'crear un presupuesto', 'fes una factura per aquest client'. NOT recording a paid invoice in the books (that is bookkeeping), NOT wiring up the Stripe SDK as a software task (that is stripe), NOT setting the price (that is pricing)."
+description: "Use when issuing an invoice, quote, or credit note and moving it draft-to-paid — the legally required VAT fields, gap-free numbering, per-country e-invoicing mandates, dunning overdue ones. NOT recording a paid invoice in the books (that is `bookkeeping`), NOT Stripe SDK plumbing (that is `stripe`), NOT setting the price (that is `pricing`)."
 tags: [invoicing, billing, vat-invoice, dunning, accounts-receivable, e-invoicing, quotes, credit-note]
 recommends: [bookkeeping, stripe, pricing, contracts, proposals, e-signature, webhooks, finance-ops]
 origin: risco
@@ -8,7 +8,7 @@ origin: risco
 
 # Invoicing — cut the document, run the lifecycle, get paid
 
-You are the person in the business who **cuts the invoice, sends it, and gets it paid**. You own the billing document and its collection lifecycle: what must be on the page for a tax authority to accept it, how it moves from draft to paid, and how to chase money politely-then-firmly without breaking the law. You are not the accountant who later files it, and not the engineer who wires up the payment processor.
+You own the billing document and its collection lifecycle: what must be on the page for a tax authority to accept it, how it moves from draft to paid, and how to chase money politely-then-firmly without breaking the law.
 
 The whole job is three moves: **cut a valid document → run its lifecycle → get it paid.** Skip the validity step and the customer can't deduct the VAT. Skip the lifecycle and you lose track of who owes what. Skip the chase and you work for free.
 
@@ -39,7 +39,7 @@ Before anything, decide which document you are issuing — they use different nu
 | Proforma | A "please-pay-this" preview that is not yet a tax document | Not the invoice series | No — not a fiscal invoice |
 | Credit note / corrective (factura rectificativa) | To cancel or reduce an invoice already sent | Its own corrective series, **referencing the original number** | Reduces an existing obligation |
 
-Why it matters: you **never** delete or renumber a finalized invoice to fix it. You issue a corrective that points back at the original. A missing number in the invoice series is an audit flag.
+Never delete or renumber a finalized invoice to fix it — issue a corrective that points back at the original (see the lifecycle rule below).
 
 ## The legally-valid invoice checklist
 
@@ -143,12 +143,3 @@ Quotes follow `draft → finalize (assigns number) → accept`, which auto-gener
 | Chasing payment with no statutory basis | Weak, easily ignored | From D+15 cite ECB+8pp interest + EUR 40 fixed cost |
 | Omitting the per-rate VAT breakdown | Customer can't deduct VAT; invalid invoice | Net + rate + VAT amount per rate, plus total |
 | Recording the payment in the books yourself | Wrong skill, double-entry not your job | Hand the paid invoice to `../bookkeeping/SKILL.md` |
-
-## Hand-off
-
-- Invoice paid → record + reconcile it: `../bookkeeping/SKILL.md`.
-- Need the SDK / webhook plumbing: `../stripe/SKILL.md`, `../webhooks/SKILL.md`.
-- Deciding the amount before you bill: `../pricing/SKILL.md`.
-- The terms the invoice bills against: `../contracts/SKILL.md`.
-- The pre-sale pitch, not the bill: `../proposals/SKILL.md`.
-- Getting it signed: `../e-signature/SKILL.md`.

package/skills/linkedin-outreach/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: linkedin-outreach
-description: "Use when running LinkedIn-native social selling as a repeatable motion: building Sales Navigator saved searches and trigger alerts, fixing a low connection-acceptance rate, designing a daily social-selling routine, turning profile views / post engagers / accepted connections into warm conversations, and logging every touch so the loop is measurable. Triggers: 'set up a Sales Nav saved search and alert me on job changes', 'how many connection requests per week without getting flagged', 'my acceptance rate is in the toilet', 'someone viewed my profile, what is the play', 'turn the people who liked my post into conversations', 'munta'm una rutina de social selling a LinkedIn', '¿cuántas invitaciones puedo enviar por semana'. This owns the loop and its ledger, NOT writing the cold connection note or DM copy (that is cold-outreach)."
+description: "Use when running LinkedIn social selling as a repeatable motion — Sales Navigator saved searches and trigger alerts, weekly request budgets, fixing a low acceptance rate, turning profile views and post engagers into warm threads, logging every touch. NOT the note or DM copy (that is `cold-outreach`), NOT the deal after a reply (that is `sales-pipeline`)."
 tags: [linkedin, social-selling, sales-navigator, outreach, pipeline]
 recommends: [cold-outreach, lead-gen, sales-pipeline, linkedin-strategy, linkedin-content]
 origin: risco
@@ -8,46 +8,28 @@ origin: risco
 
 # Linkedin Outreach — The Loop and Its Ledger
 
-*You run the LinkedIn social-selling motion and keep its score. You decide **who** to touch, **when**, through **what** warm-up, and **how** the whole loop is run and logged. You do not write the cold message (`cold-outreach`), source the raw list (`lead-gen`), or run the deal after the reply (`sales-pipeline`). The thesis is warm-first: engagement before connection, signal before send, ledger before "I'll remember it."*
+*You run the LinkedIn social-selling motion and keep its score: **who** to touch, **when**, through **what** warm-up, and **how** the loop is run and logged. The thesis is warm-first — engagement before connection, signal before send, ledger before "I'll remember it." The output is a running system plus a touch ledger under `02-DOCS/`, never a finished line of copy: when prose is needed you write the brief and hand it off, then stay in the loop.*
 
-This skill is a *motion*, not a message. Its output is a running system plus a touch ledger under `02-DOCS/`, not a finished line of copy. When prose is genuinely needed, you write the brief and hand it off — you stay in the loop.
+## Boundary
 
-## When to use
+The sharpest line is against `../cold-outreach/SKILL.md`, and it splits on message-vs-system:
 
-- "Set up a Sales Navigator saved search / lead list for [ICP] and the trigger alerts."
-- "How many connection requests can I send this week without getting my account flagged?"
-- "Build me a 30-min-a-day social-selling routine that turns LinkedIn into pipeline."
-- "My acceptance rate is ~15% — how do I run requests so people actually accept?"
-- "Turn everyone who engaged with my last post into a conversation."
-- "Someone viewed my profile / liked my post — what's the play?"
-- "Log my LinkedIn touches and show me what's converting."
-- "munta'm una rutina de social selling a LinkedIn", "¿cuántas invitaciones puedo enviar por semana?"
+- **A single message** — the connection note (≤300 chars), the DM bump, its wording and per-inbox send cadence → cold-outreach. If the ask is "write this" or "fix this template," it is not yours.
+- **The system** — who to touch, when, the warm-up, the budget, the ledger → here. When both are in play, this skill drives and delegates the copy.
 
-## When NOT — the boundary that gets fought over
-
-The sharpest line is against **cold-outreach**. Hold it:
-
-- **A single message** — the connection note (≤300 chars), the DM bump, its wording and per-inbox send cadence → `../cold-outreach/SKILL.md`. If the ask is "write this" or "fix this template," it is not yours.
-- **The system** — who to touch, when, the warm-up, the budget, the ledger → here. When both are in play, **this skill drives and delegates the copy.**
-
-Other routes:
-
-- Sourcing / scoring the raw prospect list, ICP definition, dedupe → `../lead-gen/SKILL.md`.
-- Running the deal after a reply (stages, forecast, CRM tasks) → `../sales-pipeline/SKILL.md`.
-- Writing/scheduling LinkedIn *posts* → `../linkedin-content/SKILL.md`.
-- Brand growth/positioning strategy → `../linkedin-strategy/SKILL.md`.
+Also not yours: sourcing / scoring the raw prospect list and ICP definition → `../lead-gen/SKILL.md`; the deal after a reply, i.e. stages, forecast, CRM tasks → `../sales-pipeline/SKILL.md`; writing or scheduling LinkedIn *posts* → `../linkedin-content/SKILL.md`; brand growth and positioning → `../linkedin-strategy/SKILL.md`.
 
 ## The loop
 
 Five phases, in order. Each has a *why* and yields one artifact; the artifact gates the next phase. Skipping a phase is how acceptance collapses.
 
 1. **Target** — *why:* outreach timed to a reason beats outreach timed to a calendar. → Yields a Sales Nav saved search + trigger alerts (job change, funding, recent post).
-2. **Warm** — *why:* a cold context-free request accepts ~20–30%; engaging first lifts it past ~60%. → Yields a logged pre-touch (profile view + one genuine comment/like 1–2 days prior).
+2. **Warm** — *why:* a cold, context-free request is the worst-accepting move you can make; engaging first is what fixes it. → Yields a logged pre-touch (profile view + one genuine comment/like 1–2 days prior).
 3. **Connect** — *why:* the request is the smallest, most rate-limited move; spend it deliberately. → Yields a sent request inside the weekly budget, note-or-no-note chosen by goal.
 4. **Convert** — *why:* an accept is not a conversation; the choreography turns a signal into a warm 1:1. → Yields a thread with a real reply, copy delegated to cold-outreach when needed.
 5. **Log** — *why:* a motion you can't measure you can't repeat or fix. → Yields a row in the `02-DOCS/` ledger with the outcome.
 
-Each phase has its own section below. Run them as a daily checklist (last section).
+Each phase gets a section below; the last one compresses all five into a day.
 
 ## Target with Sales Navigator
 
@@ -88,7 +70,7 @@ When you do send a note, you do **not** write it here — hand the brief (the ho
 | Free | ~100/wk | ~20/weekday, stay under ~80/wk | Pause and warm more if acceptance drops below ~30%. |
 | Premium / Sales Nav | up to ~200/wk | up to ~40/day | Only with strong SSI and acceptance >40%; otherwise treat as free. |
 
-Health rules: requests over the cap get throttled or flagged; acceptance below ~30% means you are spraying — go back to phase 2, don't push volume. Withdraw stale pending requests before they pile up.
+Over the cap, requests get throttled or the account flagged. Below ~30% acceptance you are spraying — go back to phase 2 instead of pushing volume, and withdraw stale pending requests before they pile up.
 
 ## Engagement → conversation
 
@@ -123,9 +105,7 @@ Buying-signal tells in a thread: they ask about price/timeline, mention an activ
 
 1. Book the call or send the warm intro.
 2. Log the outcome (`call_booked`) in the ledger.
-3. Hand the thread + context to `../sales-pipeline/SKILL.md`.
-
-**Explicit stop:** this skill never sets deal stages, forecasts, or runs follow-up CRM tasks. The moment a deal exists, it is sales-pipeline's.
+3. Hand the thread + context to `../sales-pipeline/SKILL.md` — the moment a deal exists it is theirs, and you set no stages or forecasts.
 
 ## The ledger (02-DOCS)
 

package/skills/meeting-notes/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: meeting-notes
-description: "Use when a meeting, standup, or call just ended and you have a transcript or rough notes to turn into a durable record — extract the decisions with their why, assign action items with an owner and a real due date, flag open questions, and ship a one-screen recap within 24–48h. Also when an AI-notetaker transcript hallucinated tasks or mixed up speakers and you must clean it before sending. Triggers: 'pull the action items out of this transcript and tell me who owns what by when', 'the Otter transcript mixed up who said what, clean it up so I can send it', 'resume la reunión de hoy y saca los próximos pasos con responsable y fecha límite', 'fes una acta de la reunió'. NOT the durable decision record with full alternatives and review cadence (that is decision-records)."
+description: "Use when a meeting just ended and a transcript or rough notes must become a record the absent can act on — decisions with their why, actions with an owner and a real date, open questions, a recap inside 24–48h — or to clean an AI-notetaker draft that invented tasks or swapped speakers. NOT the durable ADR with alternatives weighed (that is decision-records)."
 tags: [meeting-notes, action-items, decisions, recap, transcript-cleanup, minutes, standup, business-ops]
 recommends: [decision-records, sop-builder, project-ops, calendar-scheduling, notion-connector, automation-flows, document-processing]
 origin: risco
@@ -12,16 +12,16 @@ origin: risco
 
 You own the **point-in-time meeting record**: take a transcript or raw notes, separate signal from noise, and emit a curated artifact — decisions (with rationale), action items (owner + due date), open questions, and a one-screen TL;DR. The output is human-readable judgment, not a code file.
 
-## What this owns vs. what it does not
+## Not this skill
 
-- The **durable decision record** — full rationale, alternatives weighed, reversibility framing, review cadence → [`decision-records`](../decision-records/SKILL.md). This skill *captures* a decision in its meeting context and hands the heavy ADR off; it does not maintain the long-lived artifact.
-- A **reusable step-by-step procedure / runbook** → [`sop-builder`](../sop-builder/SKILL.md). A SOP is a repeatable how-to; meeting notes are a point-in-time record.
-- **Tracking the emitted tasks across a board / sprint** → [`project-ops`](../project-ops/SKILL.md). This skill *emits* action items; managing their lifecycle is project-ops.
-- **Scheduling the meeting, finding a slot, sending the invite** → [`calendar-scheduling`](../calendar-scheduling/SKILL.md).
-- **Building the integration that pushes notes into Notion/Slack/a tracker** → [`notion-connector`](../notion-connector/SKILL.md) / [`automation-flows`](../automation-flows/SKILL.md).
-- **Summarizing an arbitrary document that is not a meeting** → [`document-processing`](../document-processing/SKILL.md).
-
-Boundary in one line: the durable decision record with alternatives and review lives in `decision-records`; `meeting-notes` captures the decision in context and ships the actionable recap.
+| If the ask is… | Route to |
+|---|---|
+| The **durable decision record** — full rationale, alternatives weighed, reversibility argued, review cadence | [`decision-records`](../decision-records/SKILL.md). This skill *captures* a decision in its meeting context and hands the heavy ADR off; it does not maintain the long-lived artifact |
+| A **reusable step-by-step procedure / runbook** | [`sop-builder`](../sop-builder/SKILL.md). A SOP is a repeatable how-to; meeting notes are a point-in-time record |
+| **Tracking the emitted tasks across a board / sprint** | [`project-ops`](../project-ops/SKILL.md). This skill *emits* action items; their lifecycle is not its job |
+| **Scheduling the meeting, finding a slot, sending the invite** | [`calendar-scheduling`](../calendar-scheduling/SKILL.md) |
+| **Building the integration that pushes notes into Notion/Slack/a tracker** | [`notion-connector`](../notion-connector/SKILL.md) / [`automation-flows`](../automation-flows/SKILL.md) |
+| **Summarizing an arbitrary document that is not a meeting** | [`document-processing`](../document-processing/SKILL.md) |
 
 ## The capture loop
 
@@ -69,15 +69,11 @@ go/no-go by Jun 12, payments integration is still open.
 - Revisit pricing tiers next sync (not in scope today)
 ```
 
-Rule: every major decision gets **one sentence of context**. A decision with no why rots — six weeks later nobody remembers what trade-off it solved. (Umbrex / Fellow.app, accessed 2026-06-02.)
+Four filled versions of this skeleton — decision meeting, standup/sync, retro, 1:1 — plus copy-paste action-item and decision rows are in [`references/templates.md`](references/templates.md).
 
 ## Action items done right
 
-A complete action item is **`verb, owner, by <real date>`** — never a vague "soon". Explicit dates and named owners raise completion and ownership. (Umbrex, accessed 2026-06-02.)
-
-- **Verb-first** — the task starts with what to do: "Draft…", "Spike…", "Send…", "Confirm…".
-- **One named owner** — a person, not "the team" or "we". Shared ownership means nobody owns it.
-- **A real date** — "by Tue Jun 9", not "next week", not "soon", not "ASAP".
+A complete action item is **`verb, owner, by <real date>`**: verb-first ("Draft…", "Spike…", "Send…", "Confirm…"), **one named person** — not "the team", not "we", since shared ownership means nobody owns it — and **a real date** ("by Tue Jun 9", never "next week", "soon", or "ASAP"). Explicit dates and named owners raise completion and ownership. (Umbrex, accessed 2026-06-02.)
 
 Bad → Good:
 
@@ -98,7 +94,7 @@ Add **RACI only when ownership is genuinely contested** — a cross-team decisio
 For each real decision capture three things:
 
 1. **The decision** — what was decided, stated as a fact.
-2. **One sentence of why** — the trade-off or context. (Umbrex / Fellow.app, accessed 2026-06-02.)
+2. **One sentence of why** — the trade-off or context. Every major decision gets one; a decision with no why rots, and six weeks later nobody remembers what trade-off it solved. (Umbrex / Fellow.app, accessed 2026-06-02.)
 3. **Dissent or unresolved issue** — if someone disagreed or it's conditional, note it. A record that hides dissent will be re-litigated.
 
 Tag each decision by **reversibility** — `reversible` / `partially-reversible` / `irreversible` — as a single field. Reversible calls can be made fast on imperfect info; irreversible ones warrant slowing down and recording more context, and the tag helps later review. (fs.blog / Reflect OS, accessed 2026-06-02.)
@@ -109,7 +105,7 @@ Bad → Good:
 |---|---|
 | "Decided to use Postgres." | "Adopt Postgres over DynamoDB for the events store. *Why:* relational queries we need; team already knows it. *Reversibility:* partially-reversible. Dissent: none." |
 
-When a decision needs the full ADR — alternatives weighed, reversibility argued, a review date — that is `decision-records`' job. Capture it here in context, then hand it off. Don't grow an ADR inside the meeting notes.
+When a decision needs the full ADR — alternatives weighed, reversibility argued, a review date — that is [`decision-records`](../decision-records/SKILL.md)' job. Capture it here in context, then hand it off. Don't grow an ADR inside the meeting notes.
 
 ## Working with AI transcripts
 
@@ -129,14 +125,7 @@ Recording a conversation carries real legal and confidentiality exposure. (Justi
 
 - **Announce + get consent before recording.** Roughly a dozen US states require all-party (two-party) consent — per Justia's 50-state survey, CA, CT, DE, FL, IL, MD, MA, MT, NV, NH, PA, WA — but the canonical list is contested (some sources classify MI, OR, or NV differently). Verify the current rule for your jurisdiction; don't assert a fixed count. Under GDPR, recording is data processing — you need a basis and to inform attendees.
 - **A cloud AI notetaker grants a third party access** to the conversation, which can waive privilege. Don't auto-record sensitive or privileged meetings (legal, HR, M&A, incident reviews).
-- **Redact** names, secrets, and confidential details before distribution if the audience is wider than the room.
-
-Decision checklist before you record or distribute:
-
-- [ ] Is this being recorded? → announce it and get consent first.
-- [ ] Any all-party-consent jurisdiction or EU attendee? → explicit consent, on record.
-- [ ] Sensitive / privileged (legal, HR, M&A)? → don't auto-record; notes by hand, tighter distribution.
-- [ ] Distributing beyond the room? → redact names/secrets first.
+- **Redact** names, secrets, and confidential details before distribution if the audience is wider than the room — and tighten distribution on anything sensitive.
 
 ## Distribution
 
@@ -162,7 +151,3 @@ Then route, don't fork. Action items → a tracker via [`project-ops`](../projec
 | Fork the notes into three places | Versions diverge; people act on the stale one | One canonical home, link don't copy |
 | Invent a missing owner or date | A fabricated commitment is worse than a flagged gap | Flag it as "needs confirmation" — never guess |
 | Bolt RACI onto a standup | Overhead nobody reads; slows a simple sync | RACI only when ownership is genuinely contested |
-
-## References
-
-- [`references/templates.md`](references/templates.md) — four ready meeting-record templates (decision meeting, standup/sync, retro, 1:1), the full AI-transcript verification checklist, and copy-paste action-item and decision-row formats.

package/skills/no-code-app/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: no-code-app
-description: "Use when building an app on a no-code/low-code platform (Bubble, Softr, Glide, with Airtable/Xano backends) — picking the tool, modeling the data, taming usage/cost metering, or planning the exit before lock-in. Triggers: 'build a CRM without code', 'Bubble or Glide for my MVP', 'monta una app sin codi per reserves', 'my Bubble bill suddenly exploded' (workload-unit metering), 'Glide updates overage', 'how do I avoid getting locked into a no-code tool', 'when should I stop and write real code'. NOT a coded web app (that is nextjs)."
+description: "Use when building an app on a no-code/low-code platform (Bubble, Softr, Glide over Airtable or Xano) — picking the platform, modeling the data, keeping usage-metered cost predictable, and planning the exit before lock-in. NOT a hand-written coded app (that is `nextjs`), NOT wiring SaaS tools together with no app UI (that is `automation-flows`)."
 tags: [no-code, low-code, bubble, glide, softr, app-builder, mvp]
 recommends: [nextjs, shopify, wordpress, automation-flows, spreadsheet-ops, notion-connector, stripe]
 origin: risco
@@ -10,13 +10,9 @@ origin: risco
 
 You are deciding whether to build an app on a visual platform, which platform, how to model it, and where the wall is. No-code is not "the easy way" — it is a trade: you buy speed-to-first-user and pay it back in logic ceilings and metered cost. Your job is to make that trade with eyes open.
 
-## The one rule
+**Decide the exit before you build the entrance.** If you cannot describe how you would leave, you are not building an MVP — you are building a hostage.
 
-Decide the exit before you build the entrance.
-
-- No-code wins on **speed-to-first-user** — a working app in days, no deploy pipeline. That is the only thing it reliably wins.
-- It dies on **deep conditional logic** and on **scale economics** — many-branch workflows get unmaintainable, and metering turns a $29 bill into a $400 one without warning.
-- ~25-30% of no-code projects get rewritten when they outgrow the tool, at $50K-$250K. ~68% of platforms offer no code export. If you cannot describe how you would leave, you are not building an MVP — you are building a hostage.
+No-code wins on **speed-to-first-user** — a working app in days, no deploy pipeline. That is the only thing it reliably wins. It dies on **deep conditional logic** and on **scale economics**: many-branch workflows get unmaintainable, and metering turns a $29 bill into a $400 one without warning.
 
 ## Step 0: is no-code even the right tool?
 
@@ -24,9 +20,9 @@ Run this gate before touching any builder. If any line is a clear yes, route out
 
 | If the user really wants... | Stop and go to |
 | --- | --- |
-| A hand-written app, full control over code | [../nextjs/SKILL.md](../nextjs/SKILL.md) (or react) |
-| A commerce storefront, products + checkout | `shopify` |
-| A content site / blog / CMS | `wordpress` |
+| A hand-written app, full control over code | [../nextjs/SKILL.md](../nextjs/SKILL.md) (or [../react/SKILL.md](../react/SKILL.md)) |
+| A commerce storefront, products + checkout | [../shopify/SKILL.md](../shopify/SKILL.md) |
+| A content site / blog / CMS | [../wordpress/SKILL.md](../wordpress/SKILL.md) |
 | To wire SaaS tools together, no app UI | [../automation-flows/SKILL.md](../automation-flows/SKILL.md) |
 | A spreadsheet as the deliverable itself | [../spreadsheet-ops/SKILL.md](../spreadsheet-ops/SKILL.md) |
 | A Notion workspace, not a published app | [../notion-connector/SKILL.md](../notion-connector/SKILL.md) |
@@ -89,6 +85,8 @@ bookings:  { id, customer: ->customers, class: ->classes, status: [pending|paid|
 payments:  { id, booking: ->bookings, amount, provider_ref }   # via stripe
 ```
 
+Payments in any of these flows: see [../stripe/SKILL.md](../stripe/SKILL.md).
+
 ## Build logic without footguns
 
 The metering model punishes the obvious-but-wrong way of doing things. Build defensively.
@@ -127,7 +125,7 @@ This is the section everyone skips and everyone regrets. Do it on day 1.
    - Logic outgrows the canvas — many-branch conditionals, custom algorithms.
    - Performance — it crawls at real row counts (the 10K-row test).
    - Cost — the metered bill crosses what a real backend + hosting would cost.
-4. **Price the rewrite honestly.** Outgrowing the tool means a $50K-$250K rebuild. Knowing that number is what lets you decide *now* whether to start in code via [../nextjs/SKILL.md](../nextjs/SKILL.md) instead.
+4. **Price the rewrite honestly.** ~25-30% of no-code projects get rewritten when they outgrow the tool, at $50K-$250K. Knowing that number is what lets you decide *now* whether to start in code via [../nextjs/SKILL.md](../nextjs/SKILL.md) instead.
 
 When two of those triggers fire, stop adding features and start the migration plan — do not keep pouring work into a runtime you are about to leave.
 
@@ -145,9 +143,3 @@ When two of those triggers fire, stop adding features and start the migration pl
 | Testing only at demo scale (100 rows) | Load-test at 10x expected rows early | Snappy at 100 can crawl at 10,000 |
 | No export plan, hope you never leave | Export day 1, keep model portable | 68% offer no code export; rewrite is $50K-$250K |
 | Picking Bubble for a simple internal portal | Softr (flat-rate) for portals over data | Predictable cost, no per-write surprise |
-
-## References
-
-- [references/platform-limits.md](references/platform-limits.md) — 2026 pricing/metering/record-cap cheatsheet (Bubble WU tiers, Glide updates, Softr flat tiers), backend comparison (native/Airtable/Xano), cost-estimation worked examples, and the migrate-off trigger list, with sources and access dates.
-
-Payments in any of these flows: see [../stripe/SKILL.md](../stripe/SKILL.md).

package/skills/performance/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: performance
-description: "Use when one page or route is slow for a single user and the fix has to start with a measurement — failing Core Web Vitals (LCP, INP, CLS), a bloated JS bundle, too many re-renders, slow hydration, or a profiler showing where the time actually goes. Triggers: 'my LCP is 4 seconds', 'the page feels janky, typing lags', 'First Load JS is huge', 'INP is failing in Search Console', the non-obvious 'we import the whole library for one function' and 'a use client boundary is shipping the server tree to the browser', and Catalan/Spanish 'la pàgina carrega lenta i no passa els Core Web Vitals' / 'el bundle pesa demasiado, hay que analizarlo antes de tocar nada'. NOT surviving a concurrent traffic spike with caches, replicas and load tests (that is scaling), NOT fixing the slow SQL query or N+1 itself (that is postgresdb)."
+description: "Use when a page or interaction is slow for one user and the fix starts from a measurement — a failing Core Web Vital (LCP, INP, CLS), a heavy JS bundle, wasted re-renders, an over-broad client boundary: profile, attribute the cost to one phase, fix it, re-measure. NOT surviving concurrent load (that is `scaling`), NOT the slow query (that is `postgresdb`)."
 tags: [performance, core-web-vitals, lcp, inp, cls, bundle-size, profiling, react, web-vitals]
 recommends: [scaling, postgresdb, redis, nextjs, react, observability, monitoring]
 profiles: []
@@ -15,12 +15,7 @@ The whole job in one line: **measure with a profiler → attribute the cost to o
 
 **Prime directive: no fix without a profile first.** A waterfall, a flame chart, a bundle treemap, or a field CWV number comes before you touch code. The fix you guess is almost never the fix the measurement points at, and a "fast" change that moves a phase nobody was waiting on is wasted work that you then have to maintain.
 
-Where the deep fix lives elsewhere — cross-reference, don't duplicate:
-
-- TTFB is the bottleneck because of a slow query or an N+1 → name it here, fix it in `../postgresdb/SKILL.md`.
-- You decided *what* to cache to cut a phase, now make the cache race-free → `../redis/SKILL.md`.
-- The problem only appears under concurrent load → `../scaling/SKILL.md`.
-- You need the canonical App-Router / component data pattern, not the perf loop → `../nextjs/SKILL.md`, `../react/SKILL.md`.
+Cross-reference, don't duplicate: the last column of the table below names where each deep fix lives. The one case it has no row for — you decided *what* to cache to cut a phase and now need that cache race-free — is `../redis/SKILL.md`.
 
 ## Decision table — symptom to first move
 

package/skills/power-automate/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: power-automate
-description: "Use when operating Microsoft Power Automate cloud flows programmatically — creating, enabling, updating, listing or deleting flows through the Dataverse Web API (the workflow table, category 5) with Entra ID / OAuth2 auth, or reading action-level run history via the third-party FlowStudio MCP. Triggers: 'create a Power Automate cloud flow with the Dataverse API', 'enable my flow by code / set statecode to 1', 'why can't I create or edit a My Flow programmatically', 'PATCH the workflow clientdata', 'automatizar el despliegue de un flujo de Power Automate desde código'. NOT designing the flow or authoring its definition (automation-flows), NOT choosing a platform by billing model (automation-strategy), NOT a generic typed REST client with auth/pagination/backoff (api-connector-builder), NOT the endpoint receiving an HTTP-trigger POST in your app (webhooks), NOT scripting Microsoft 365 / Graph mail & calendar directly (no first-party skill — api-connector-builder, or google-workspace)."
+description: "Use when operating Microsoft Power Automate cloud flows from code — create, enable, update, list or delete via the Dataverse Web API (`workflow` table, category 5) with Entra ID OAuth2, plus run-history debugging. NOT designing the flow definition (that is `automation-flows`), NOT picking a platform by billing model (that is `automation-strategy`)."
 tags: [power-automate, dataverse, microsoft, flows, entra, oauth, mcp, m365, automation]
 recommends: [automation-flows, automation-strategy, api-connector-builder, webhooks]
 profiles: [full]
@@ -80,7 +80,7 @@ Two load-bearing parts:
 - **`definition`** — a Logic Apps workflow definition: `triggers` (exactly one) then `actions`. This is the *design* artifact. Do not invent it from scratch here — get the trigger→actions→branch→error shape from `../automation-flows/SKILL.md`, then drop it into `definition`. Fastest reliable way to get a real one: build the flow once in the maker portal, export the solution, and copy its `clientdata`.
 - **`connectionReferences`** — the map from the definition's connectors to actual connections. **A flow whose connection references are not authorized will not turn on.** In a solution these are connection-reference records the target environment must resolve; unresolved references are the #1 reason a `PATCH statecode=1` "succeeds" but the flow never runs.
 
-**The trap:** `clientdata` must be *escaped into a string* before it goes in the request body — a nested object is rejected. In a script, `JSON.stringify(clientDataObject)` and assign the result; do not paste the object raw. Full annotated example in `references/dataverse-web-api.md`.
+**The trap:** `clientdata` must be *escaped into a string* before it goes in the request body — a nested object is rejected. In a script, `JSON.stringify(clientDataObject)` and assign the result; do not paste the object raw. Full annotated example — plus the endpoint cheat-sheet (token, list/filter, create, enable, update, delete, ExportSolution, share), OData headers and error handling — in `references/dataverse-web-api.md`.
 
 ## Dynamic lifecycle — token → create → validate → enable → manage → delete
 
@@ -128,13 +128,17 @@ curl -s -X DELETE "$PA_DATAVERSE_URL/api/data/v9.2/workflows(<workflowid>)" \
 
 **Debug a run** — Dataverse's `flowrun` table lists run records but not per-action I/O. To see *which action failed and with what payload*, use FlowStudio MCP: `list_live_flows` → `get_live_flow_runs` → `get_live_flow_run_action_outputs`. See `references/flowstudio-mcp-and-limits.md`.
 
-## Microsoft 365 ecosystem fit
+## Boundaries — when it is not a flow you operate here
 
-Power Automate is Microsoft's iPaaS across M365 and Dynamics; flows live in **Dataverse** and glue Outlook, Teams, SharePoint, Dynamics, and hundreds of connectors. That means the boundary is sharp: if the ask is *"send this email / read this calendar via Microsoft Graph from my own backend code,"* that is not a flow at all — build a typed Graph client with `../api-connector-builder/SKILL.md` (there is no first-party MS-Graph skill). If the equivalent is on Google, that is `../google-workspace/SKILL.md`. This skill is for when the automation genuinely *is* a Power Automate flow you must operate by code.
+Power Automate is Microsoft's iPaaS across M365 and Dynamics; flows live in **Dataverse** and glue Outlook, Teams, SharePoint, Dynamics, and hundreds of connectors. This skill is for when the automation genuinely *is* a Power Automate flow you must operate by code. When it isn't:
 
-## Honesty / gotchas
+- *"Send this email / read this calendar via Microsoft Graph from my own backend code"* — not a flow at all; build a typed Graph client with `../api-connector-builder/SKILL.md` (there is no first-party MS-Graph skill), or `../google-workspace/SKILL.md` for the Google equivalent. Same route for a general typed client with auth/pagination/backoff — this skill uses the Dataverse endpoints surgically, it does not build a client.
+- *"Power Automate or n8n/Make/Zapier?"* — billing model and constraints decide that: `../automation-strategy/SKILL.md`, before you commit to operating here.
+- *"Receive my flow's HTTP-trigger POST in my app"* — that inbound endpoint is `../webhooks/SKILL.md`; this skill triggers and operates flows, it does not build the receiver.
 
-| Trap | Why it bites | Do instead |
+## Anti-patterns
+
+| Anti-pattern | Why it bites | Do instead |
 |---|---|---|
 | Trying to CRUD a **My Flow** by code | Unsupported — silently impossible, not a bug you can fix | Move it into a Dataverse solution, or drive it by hand |
 | `clientdata` sent as a nested object | Request rejected; the column expects an escaped **string** | Serialize (`JSON.stringify`) the definition+connectionReferences before sending |
@@ -144,13 +148,6 @@ Power Automate is Microsoft's iPaaS across M365 and Dynamics; flows live in **Da
 | Hardcoding the Dataverse URL / secret | Env-specific, leaks in source | `.env`: `PA_DATAVERSE_URL`, `PA_TENANT_ID`, `PA_CLIENT_ID`, `PA_CLIENT_SECRET` |
 | Assuming the Dataverse path is permanent | Power Platform API is superseding surfaces piecemeal | Re-check `api.powerplatform.com` coverage at author time; the split is fast-moving |
 
-## Related skills
-
-- **`../automation-flows/SKILL.md`** — design side: what the trigger→actions→branch→error should be, the importable definition. This skill *consumes* that shape as `clientdata.definition`. Design there, operate here.
-- **`../automation-strategy/SKILL.md`** — choosing Power Automate vs n8n/Make/Zapier by billing and constraints. Decide there before you commit to operating here.
-- **`../api-connector-builder/SKILL.md`** — a generic typed REST client with auth/pagination/backoff (including a Dataverse or MS Graph client). This skill uses the Dataverse API surgically; it does not build a general client.
-- **`../webhooks/SKILL.md`** — building the inbound endpoint in *your* app that receives a flow's HTTP-trigger POST. This skill triggers/operates flows; it does not build the receiver.
-
 ## Checklist
 
 - [ ] `.env` set: `PA_DATAVERSE_URL` (no trailing slash), `PA_TENANT_ID`, `PA_CLIENT_ID`, `PA_CLIENT_SECRET`.
@@ -161,9 +158,3 @@ Power Automate is Microsoft's iPaaS across M365 and Dynamics; flows live in **Da
 - [ ] Flow enabled via `PATCH statecode=1` and verified on read-back.
 - [ ] Solution **exported** before any `DELETE`.
 - [ ] No secrets or org URLs hardcoded; FlowStudio MCP (if used) flagged as third-party.
-
-## References
-
-- `references/dataverse-web-api.md` — endpoint cheat-sheet (token, list/filter, create, enable, update, delete, ExportSolution, share), the full annotated `clientdata`, OData headers, and error handling.
-- `references/entra-auth-setup.md` — app registration, service principal vs delegated user, the Dataverse application user + security role, `.default` vs `user_impersonation`, and common 401/403 causes.
-- `references/flowstudio-mcp-and-limits.md` — FlowStudio MCP tools and auth (third-party), what it exposes that Dataverse doesn't, and the platform limits (My Flows, `api.flow.microsoft.com`, Power Platform API evolution).

package/skills/react-native/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: react-native
-description: "Use when writing the JS/TS code inside a React Native or Expo app — screens, navigation, lists, animation, platform-conditional UI, data/offline state, and native-module authoring — and when killing runtime jank or render bugs. Triggers: 'scaffold an Expo Router app', 'FlashList vs FlatList', 'auth-gated route groups', 'gesture reattaches every render', 're-render storm on every keystroke', 'deep link lands on the wrong screen', 'write an Expo Module wrapping a native SDK', 'la llista pateix lag quan faig scroll', 'mi app va fluida en iOS pero a tirones en Android'. NOT eas build/submit/OTA update/prebuild/config-plugin (that is expo), NOT a Dart app (that is flutter), NOT web React/DOM (that is react or nextjs)."
+description: "Use when writing the JS/TS inside a React Native or Expo app — screens, Expo Router navigation, lists, Reanimated gestures, platform forks, offline state, native modules — or killing jank and render storms. NOT eas build/submit/OTA/config-plugin (that is `expo`), NOT a Dart app (that is `flutter`), NOT web React/DOM (that is `react` or `nextjs`)."
 tags: [react-native, expo, mobile, ios, android, navigation, performance]
 recommends: [expo, react, flutter, design, debug, performance]
 origin: risco
@@ -8,11 +8,7 @@ origin: risco
 
 # React Native (app code)
 
-You write the code that runs *inside* the app: render, navigate, animate, list, persist, and author native modules. The pipeline around it — building, signing, OTA, native config — is not yours.
-
-## What this skill owns
-
-Mobile is split across two skills by **verb**. Run the verb test before doing anything:
+You write the code that runs *inside* the app: render, navigate, animate, list, persist, and author native modules. Mobile is split across two skills by **verb** — run the verb test before doing anything:
 
 | Verb in the request | Skill |
 |---|---|
@@ -149,7 +145,7 @@ Use Reanimated 4 CSS animations for simple declarative cases (fades, simple tran
 
 - Small forks: `Platform.select({ ios: 12, android: 8 })` or `Platform.OS === 'ios'`.
 - Whole-component forks: `Button.ios.tsx` / `Button.android.tsx` — the bundler picks the right one; import `./Button` with no extension.
-- Safe area: use `react-native-safe-area-context` insets, not hardcoded notch padding. Why: insets differ per device and orientation.
+- Safe area: use `react-native-safe-area-context` insets, not hardcoded notch padding. Why: insets differ per device and orientation. Palette, type scale and layout intent are not decided here → `../design/SKILL.md`.
 - `KeyboardAvoidingView` behaves differently per platform — `padding` on iOS, often `height` or nothing on Android; test both, don't assume the iOS behavior ports.
 - Set the status bar style explicitly per screen via `expo-status-bar`.
 
@@ -196,6 +192,7 @@ Full Expo Module (Swift + Kotlin + view), the Turbo Module codegen-spec walkthro
 - Read **Hermes** stack traces from the bottom up; the JS frame that matters is usually above the native bridge frames.
 - "Works on iOS, breaks on Android" (or vice versa) → run the platform-divergence checklist in `references/performance-debugging.md` before guessing.
 - A red screen citing the interop layer is usually an old-architecture lib running under Fabric — update the lib or find a New-Arch-ready replacement; do **not** disable New Arch.
+- A fault that resists all of the above needs systematic isolation, not more guesses → `../debug/SKILL.md`.
 
 ## Anti-patterns
 
@@ -211,10 +208,3 @@ Full Expo Module (Swift + Kotlin + view), the Turbo Module codegen-spec walkthro
 | Index as list key | Breaks recycling, reorders rows on insert | Stable domain id |
 | Doing native config / `eas.json` / OTA here | Wrong skill; this is app code | `../expo/SKILL.md` |
 | Hardcoded notch/safe-area padding | Wrong on other devices/orientations | `react-native-safe-area-context` insets |
-
-## Cross-references
-
-- Building, signing, OTA, native config → `../expo/SKILL.md`
-- Dart cross-platform alternative → `../flutter/SKILL.md`
-- Layout/visual design decisions → `../design/SKILL.md`
-- Systematic runtime fault isolation → `../debug/SKILL.md`

package/skills/react-native/scripts/verify.sh

@@ -42,6 +42,7 @@ flag() { # message + matching lines
   findings=1
   printf '%s[finding]%s %s\n' "$YELLOW" "$RESET" "$1"
   [ -n "${2:-}" ] && printf '%s\n' "$2" | sed 's/^/    /'
+  return 0 # never let a message-only finding trip set -e and skip the remaining checks
 }
 
 md_files() { # SKILL.md + every references/*.md
@@ -86,11 +87,13 @@ if [ -n "$bare" ]; then
   done < "$SKILL"
 fi
 
-# 4) Description must carry the Triggers: label and a NOT-boundary.
+# 4) Description shape: a "Use when/to" lead, a NOT-boundary, and no keyword trigger list
+#    (the model matches by meaning; a phrase list is per-turn cost for every install).
 desc="$(grep -m1 -E '^description:' "$SKILL" 2>/dev/null || true)"
 if [ -n "$desc" ]; then
-  printf '%s' "$desc" | grep -q 'Triggers:' || flag "description missing 'Triggers:' label"
+  printf '%s' "$desc" | grep -qE 'Use (when|to) ' || flag "description does not open with 'Use when/to'"
   printf '%s' "$desc" | grep -qE 'NOT ' || flag "description missing a 'NOT <x> (that is <sibling>)' boundary"
+  printf '%s' "$desc" | grep -q 'Triggers:' && flag "description carries a 'Triggers:' keyword list -> delete it, the model matches by meaning" ""
 fi
 
 # 5) No cross-ref to a sibling that does not exist on disk next to this skill.

package/skills/roast-me/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: roast-me
-description: "Use when you want honest, comedic feedback on how you prompt — analyzing your own past sessions to score prompt quality and compute efficiency, surface your worst habits, and generate a model-selection cheat sheet. Triggers: 'roast me', 'roast my prompting', 'audit my prompting habits', 'how good are my prompts', 'am I prompting well', 'what are my bad prompt habits', 'analiza mis prompts', 'puntua els meus prompts', 'how much am I wasting on model costs'. NOT reviewing your code or output quality (use code-review for that) and NOT a general prompt-engineering tutorial (use prompt-engineering for that)."
+description: "Use when someone wants an honest, comedic audit of their own prompting — reads their past agent transcripts, scores prompt quality and compute efficiency, names their worst habits, builds a model-selection cheat sheet. NOT reviewing code an agent produced (that is `code-review`), NOT prompting technique in general (that is `prompt-engineering`)."
 tags: [prompting, self-audit, compute-efficiency, ai-hygiene, learning]
 recommends: [prompt-engineering, code-review, context-budget]
 profiles: [full]
@@ -9,7 +9,7 @@ origin: risco
 
 # roast-me — audit your prompting, score yourself, stop burning money
 
-You are the **prompt auditor**. Your target is not the user's code — it is their *prompting behaviour*. You read their recent agent transcripts, run structured analysis passes, produce dual scores (Prompt Quality + Compute Efficiency), name the worst habits with named techniques to fix them, and track the trend over time.
+You are the **prompt auditor**. Your target is not the user's code — it is their *prompting behaviour*, read from their own recent agent transcripts.
 
 Every run follows five phases. Execute them in order.
 
@@ -115,9 +115,7 @@ Score History:
   2026-06-08  73/100 (C) +5↑   35/100 (F)            The 3W Rule
 ```
 
-Output the roast report as formatted markdown. If history exists, append the trend line.
-
-Done.
+Output the roast report as formatted markdown.
 
 ## Orientación (siempre)
 

package/skills/roast-me/evals/cases.yaml

@@ -9,7 +9,7 @@ skill: roast-me
 
 should_trigger:
   - prompt: "Roast me."
-    why: "Canonical verbatim invocation — the skill's own trigger phrase. Must fire immediately and run the five-phase pipeline."
+    why: "Canonical invocation — the shortest possible ask for exactly this skill's job. Must fire immediately and run the five-phase pipeline."
 
   - prompt: "Audit my prompting habits over the last two weeks."
     why: "Situation-first phrasing with a custom time window — roast-me owns both the 'audit prompting' job and the --days N parameter."
@@ -18,10 +18,10 @@ should_trigger:
     why: "Dual concern (prompt quality + cost) phrased as a question — maps directly to the two scores roast-me produces. No mention of 'roast' keyword."
 
   - prompt: "Analiza mis prompts de la última semana y dime dónde soy malo."
-    why: "Spanish-language trigger — rsc users write Spanish; the description must fire on non-English phrasings. Tests the non-English trigger."
+    why: "Spanish-language request — rsc users write Spanish; routing must survive translation on meaning alone."
 
   - prompt: "Puntua els meus prompts i digue'm quins hàbits hauria de canviar."
-    why: "Catalan-language trigger — a non-obvious language variant. The description lists this phrasing explicitly."
+    why: "Catalan-language request — a non-obvious language variant that must route on meaning, with no keyword resembling the skill id."
 
   - prompt: "How much am I burning on model costs? Show me where I overspend."
     why: "Compute-efficiency angle only, no prompting-quality framing — roast-me's compute score and cheat sheet are the direct answer."

package/skills/shortform-strategy/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: shortform-strategy
-description: "Use when running the durable strategy layer of a TikTok and/or Instagram Reels account — positioning, posting cadence, format mix, which trends and sounds to ride, recurring series, and the what-worked learning loop — not making one video. Use for standing up a new account before posting; diagnosing a flat or declining account (positioning, cadence, or format?); deciding whether to ride a trend or sound now; designing a recurring series; the monthly strategy review; or choosing the Reels-vs-carousel mix. Triggers: 'starting a new TikTok account, what and how often should we post', 'we post every single day and our reach is going down' (cadence-dilution symptom, no strategy word), 'should we jump on this sound or is it dead', 'we want a weekly recurring series on Reels', 'muntar l''estratègia del compte de Reels: posicionament i cadència', '¿nos subimos a esta tendencia o ya pasó?'. NOT writing the single short script or hook variants (that is video-shorts)."
+description: "Use when the unit of work is a TikTok/Reels account, not one clip: positioning, sustainable cadence and format mix, ride-or-skip on a trend or sound, recurring series, diagnosing a flat account, and the dated learning loop. NOT the single script or hook variants (that is `video-shorts`), NOT the idea backlog (that is `shortform-ideation`)."
 tags: [short-form-video, tiktok, instagram-reels, account-growth, positioning, posting-cadence, trends, series, algorithm-2026]
 recommends: [video-shorts, shortform-ideation, shortform-packaging, shortform-editing, social-publisher, content-engine, brand-voice, analytics]
 origin: risco
@@ -12,9 +12,9 @@ origin: risco
 
 Hand off downstream the moment the deliverable becomes *one video*:
 - The 15–60s script and hook variants → `../video-shorts/SKILL.md`.
-- The topic/angle backlog feeding the account → **shortform-ideation**.
-- The cover frame / on-screen title / first-frame packaging → **shortform-packaging**.
-- The cut, caption burn-in, sound sync → **shortform-editing**.
+- The topic/angle backlog feeding the account → `../shortform-ideation/SKILL.md`.
+- The cover frame / on-screen title / first-frame packaging → `../shortform-packaging/SKILL.md`.
+- The cut, caption burn-in, sound sync → `../shortform-editing/SKILL.md`.
 - Cross-platform calendar/scheduler across X/LinkedIn/Threads → `../social-publisher/SKILL.md`.
 - The top-down editorial system across all content types → `../content-engine/SKILL.md`.
 - The durable tone the account speaks in → `../brand-voice/SKILL.md`.
@@ -101,7 +101,7 @@ Design it as a *contract with the viewer*:
 - **Fix a cadence** — same slot, same rhythm (e.g. every Tuesday). A series with no schedule is just a hashtag.
 - **Pilot before committing.** Use **Trial Reels** (public IG accounts, 1,000+ followers, available since July 2025) to publish the pilot to non-followers first and read the signal before showing your existing audience — a built-in A/B surface for a format bet (later.com; socialpilot.co — accessed 2026-06-02).
 
-The hand-off: you define the series *concept, cadence, and numbering*. The episodes get ideated (shortform-ideation), scripted (`../video-shorts/SKILL.md`), and packaged (shortform-packaging) elsewhere.
+The hand-off: you define the series *concept, cadence, and numbering*. The episodes get ideated (`../shortform-ideation/SKILL.md`), scripted (`../video-shorts/SKILL.md`), and packaged (`../shortform-packaging/SKILL.md`) elsewhere.
 
 ## The learning loop — log, review, write back
 
@@ -152,21 +152,9 @@ timestamp: 2026-06-02T10:00:00Z
 
 ## Persist it
 
-Write the account's brain back so it compounds (mirrors the harness Karpathy-wiki convention). The `shortform/` wiki tree is an **OKF v0.1 bundle** shared with the `tiktok-api` and `shortform-packaging` siblings: every `.md` written here carries YAML frontmatter with a non-empty `type`, cross-references are standard markdown links (never `[[wikilinks]]`), and `decisions.md` follows the OKF newest-first append-log rule.
-
-- `02-DOCS/wiki/shortform/strategy.md` — positioning, cadence/mix, KPI, length bands, current series. Lead with frontmatter; the body keeps the H1 + sections the linter checks:
-
-  ```markdown
-  ---
-  type: shortform-strategy
-  title: Shortform account strategy
-  tags: [shortform, strategy, positioning, cadence]
-  timestamp: 2026-06-02T10:00:00Z
-  ---
-  # Shortform account strategy
-  ...
-  ```
+Write the account's brain back so it compounds (mirrors the harness Karpathy-wiki convention). The `shortform/` wiki tree is an **OKF v0.1 bundle** shared with the `../tiktok-api/SKILL.md` and `../shortform-packaging/SKILL.md` siblings: every `.md` written here carries YAML frontmatter with a non-empty `type`, cross-references are standard markdown links (never `[[wikilinks]]`), and `decisions.md` follows the OKF newest-first append-log rule.
 
+- `02-DOCS/wiki/shortform/strategy.md` — positioning, cadence/mix, KPI, length bands, current series. Same frontmatter shape as above with `type: shortform-strategy`, then the H1 (`# Shortform account strategy`) and the sections the linter checks.
 - `02-DOCS/wiki/shortform/decisions.md` — the dated decision log, OKF append-log (`type: shortform-decision-log`, newest block on top; format above).
 - `02-DOCS/raw/shortform/metrics.csv` — the per-post ledger (schema in `references/learning-loop-template.md`). This is `raw/`, not `wiki/` — a CSV, no frontmatter.