@ericrisco/rsc 0.1.55 → 0.1.57

package/skills/nestjs/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: nestjs
-description: "Use when building or structuring a NestJS backend — feature modules, providers, controllers, DI wiring, and the cross-cutting layer (guards, interceptors, pipes, exception filters) — including binding-scope and request-lifecycle decisions and Nest-specific testing. Triggers: 'create a NestJS module', 'wire a custom provider with useFactory', 'APP_GUARD vs @UseGuards on the controller', 'my request-scoped provider is undefined in a guard', 'A circular dependency has been detected at bootstrap', 'mock a repository provider with overrideProvider', 'monta un módulo de Nest', 'guard de autenticación JWT en NestJS'. NOT a bare Express/Node service with no DI (that is nodejs)."
+description: "Use when building or structuring a NestJS backend — feature modules, providers and DI wiring, provider scopes and request-lifecycle order, where to bind guards/pipes/interceptors/filters, and testing with Test.createTestingModule. NOT a bare Express/Fastify service with no DI (that is `nodejs`), NOT framework-agnostic REST design (that is `api-design`)."
 tags: [nestjs, nodejs, backend, dependency-injection, guards, pipes, testing, typescript]
 recommends: [nodejs, typescript, api-design, prisma-orm, testing-web]
 origin: risco
@@ -10,15 +10,7 @@ origin: risco
 
 Build server-side Node apps the way NestJS intends: feature modules, providers wired through the DI container, controllers, and a cross-cutting layer bound at a deliberate scope. This skill is about Nest-specific mechanics — how DI scopes resolve, what order the request lifecycle runs in, where to bind guards/pipes/interceptors/filters, and how to test it with `Test.createTestingModule`.
 
-## Use this when
-
-- Scaffolding or extending a Nest app: new module, controller, provider, resolver.
-- Wiring DI: `useClass` / `useValue` / `useFactory` / `useExisting`, injection tokens, `forwardRef`, dynamic modules (`forRoot` / `forRootAsync`).
-- Adding cross-cutting behavior and deciding global vs controller vs route binding.
-- "Why is my request-scoped provider undefined" / "circular dependency detected at bootstrap".
-- Unit tests with mock providers and e2e tests with Supertest against the real Nest app.
-
-## Not this when
+## Not this — route instead
 
 - Bare Express/Fastify/`http` service, no `@Module`/`@Injectable` → `../nodejs/SKILL.md`. Nest starts the moment the DI container appears.
 - REST resource modeling, versioning, status codes, idempotency (framework-agnostic) → `../api-design/SKILL.md`. Nest is where you *implement* those decisions.

package/skills/nodejs/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: nodejs
-description: "Use when building or structuring a plain Node.js / Express backend service — project layout, async correctness, central error handling, config validation, and graceful shutdown — the runtime and HTTP service, not a DI framework. Triggers: 'set up an Express 5 service', 'my async route error returns 200 with an empty body', 'where do controllers vs services go', 'centralize error handling middleware', 'shut down cleanly on SIGTERM without dropping requests', 'why does one unhandled promise rejection crash my server', 'monta un backend con Express y manejo de errores', 'apaga el servidor sin perder peticiones en vuelo'. NOT NestJS DI/modules/guards (that is nestjs); NOT the TS type system/tsconfig (that is typescript); NOT REST contract/versioning (that is api-design)."
+description: "Use when building or operating a plain Node.js / Express 5 backend service: project layout, async correctness, central error middleware, fail-fast config, graceful shutdown on SIGTERM. NOT DI modules/providers/guards (that is `nestjs`), NOT the type system or tsconfig (that is `typescript`), NOT REST contract design (that is `api-design`)."
 tags: [nodejs, express, backend, async, error-handling]
 recommends: [nestjs, typescript, api-design, error-handling, postgresdb]
 origin: risco
@@ -8,24 +8,15 @@ origin: risco
 
 # Node.js backend services
 
-Stand up a plain Node.js HTTP/JSON service — `node:http` or Express 5 — that a person can read, test, and operate without a DI framework. This skill is about the runtime and the request lifecycle: how to lay out the code, how to keep async correct, how errors become status codes, how config fails fast, and how the process dies cleanly. The contract shape, the type system, and the data layer live elsewhere (see the boundaries below).
+Stand up a plain Node.js HTTP/JSON service — `node:http` or Express 5 — that a person can read, test, and operate without a DI framework. This skill is about the runtime and the request lifecycle: how to lay out the code, how to keep async correct, how errors become status codes, how config fails fast, and how the process dies cleanly. The contract shape, the type system, and the data layer live elsewhere (see the boundary below).
 
-## Use this when
+## Boundary
 
-- Standing up a new HTTP/JSON service on Node with Express 5 (or bare `node:http`).
-- Structuring routes / controllers / services / repositories in a non-DI app.
-- Fixing async bugs: floating promises, swallowed errors, callbacks not awaited.
-- Centralizing error handling and the 404/500 contract in one place.
-- Graceful shutdown on SIGTERM, env validation at boot, the request lifecycle.
-- Choosing CommonJS vs ESM and pinning a runtime.
-
-## Not this when
-
-- The app is built around `@Module` / `@Injectable` / DI providers, guards, interceptors, pipes, exception filters → `../nestjs/SKILL.md`. Nest starts the moment the DI container appears; route away then, do not half-build it here.
-- Pure TypeScript type system, generics, `tsconfig` → `../typescript/SKILL.md`. This skill uses TS but does not teach types.
-- REST resource modeling, versioning, pagination, status-code semantics (framework-agnostic) → api-design. This skill *wires* the handlers; api-design decides the contract.
-- Schema, queries, connection pool, migrations → `../postgresdb/SKILL.md` / prisma-orm / drizzle-orm. *Calling* a repository stays here; designing the table does not.
-- Containerizing / shipping → docker / deployment. Choosing the logging/metrics/tracing stack → observability. This skill emits structured logs and a shutdown hook; it does not own the pipeline.
+- The app is built around `@Module` / `@Injectable` / DI providers, guards, interceptors, pipes, exception filters → [`nestjs`](../nestjs/SKILL.md). Nest starts the moment the DI container appears; route away then, do not half-build it here.
+- Pure TypeScript type system, generics, `tsconfig` → [`typescript`](../typescript/SKILL.md). This skill uses TS but does not teach types.
+- REST resource modeling, versioning, pagination, status-code semantics (framework-agnostic) → [`api-design`](../api-design/SKILL.md). This skill *wires* the handlers; api-design decides the contract. Cross-cutting error taxonomy → [`error-handling`](../error-handling/SKILL.md).
+- Schema, queries, connection pool, migrations → [`postgresdb`](../postgresdb/SKILL.md) / [`prisma-orm`](../prisma-orm/SKILL.md) / [`drizzle-orm`](../drizzle-orm/SKILL.md). *Calling* a repository stays here; designing the table does not.
+- Containerizing / shipping → [`docker`](../docker/SKILL.md) / [`deployment`](../deployment/SKILL.md). Choosing the logging/metrics/tracing stack → [`observability`](../observability/SKILL.md). This skill emits structured logs and a shutdown hook; it does not own the pipeline.
 
 ## Decide first
 
@@ -33,7 +24,7 @@ Pick the runtime shape before writing code — the wrong choice is expensive to
 
 | Situation | Choice | Why |
 | --- | --- | --- |
-| Needs DI/modules, large team, heavy cross-cutting | route to `../nestjs/SKILL.md` | Don't reinvent a DI container by hand |
+| Needs DI/modules, large team, heavy cross-cutting | route to [`nestjs`](../nestjs/SKILL.md) | Don't reinvent a DI container by hand |
 | Small/medium JSON API, want middleware + routing | Express 5 | Mature, async errors auto-forward (v5) |
 | One tiny endpoint, zero deps, a healthcheck | `node:http` | No dependency surface to maintain |
 | A library, not a server | not this skill | No request lifecycle to manage |
@@ -158,7 +149,7 @@ app.get("/users/:id", async (req, res) => {
 });
 ```
 
-The error handler placed before the route never sees the throw, so the response is whatever was half-written. Put it last. See `references/express5-migration.md` for the full v4→5 breaking-change checklist and the legacy v4 `asyncHandler` wrapper.
+The error handler placed before the route never sees the throw, so the response is whatever was half-written. Put it last. See [`references/express5-migration.md`](references/express5-migration.md) for the full v4→5 breaking-change checklist, the middleware-order diagram, and the legacy v4 `asyncHandler` wrapper.
 
 ## Config & secrets
 
@@ -185,7 +176,7 @@ On SIGTERM the orchestrator gives you a brief window to finish. Drop nothing.
 4. Close the DB pool and other resources.
 5. `process.exit(0)`, with a force-exit timer as a backstop if drain stalls.
 
-Expose `/healthz` (liveness — is the process up) separately from `/readyz` (readiness — should it receive traffic). They answer different questions; conflating them causes both false restarts and dropped requests during deploys. The full copy-pasteable `server.ts` lives in `references/graceful-shutdown.md`.
+Expose `/healthz` (liveness — is the process up) separately from `/readyz` (readiness — should it receive traffic). They answer different questions; conflating them causes both false restarts and dropped requests during deploys. The complete copy-pasteable `server.ts` — signal handlers, `AbortController`, readiness gate, force-exit backstop — lives in [`references/graceful-shutdown.md`](references/graceful-shutdown.md).
 
 ```ts
 // server.ts (sketch — full version in references/)
@@ -230,13 +221,9 @@ test("404 returns the error contract", async () => {
 | `catch (e) {}` then continue | Swallows the failure, masks the bug | Re-throw, or map to an `AppError` |
 | `process.exit()` without draining | Drops in-flight requests on deploy | SIGTERM → `server.close()` → abort → exit |
 | Global `unhandledRejection` as control flow | Hides bugs, leaves process in a bad state | Log + exit there; fix the floating promise |
-| Assuming Express 4 defaults | v5: `urlencoded` `extended:false`, `static` `dotfiles:"ignore"` | Read `references/express5-migration.md` |
+| Assuming Express 4 defaults | v5: `urlencoded` `extended:false`, `static` `dotfiles:"ignore"` | Read [`references/express5-migration.md`](references/express5-migration.md) |
 | Leaking stack/message in prod | Information disclosure | Stack only when `NODE_ENV !== "production"` |
 
-## References & siblings
-
-- `references/express5-migration.md` — full Express 4→5 breaking changes, middleware-order diagram, the legacy v4 `asyncHandler` wrapper.
-- `references/graceful-shutdown.md` — complete `server.ts`: signal handlers, `AbortController`, readiness gate, force-exit backstop.
-- DI/modules/guards → `../nestjs/SKILL.md`. Type system/tsconfig → `../typescript/SKILL.md`. Data layer → `../postgresdb/SKILL.md`. Contract design → api-design. Cross-cutting error taxonomy → error-handling.
+## Verify
 
 `scripts/verify.sh` statically lints a produced repo for these rules (4-arg error handler last, no `listen()` in `app.ts`, `engines.node` supported, floating-promise heuristic). Advisory; hard-fails only on `listen()` in `app.ts` or a missing error handler.

package/skills/power-automate/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: power-automate
-description: "Use when operating Microsoft Power Automate cloud flows programmatically — creating, enabling, updating, listing or deleting flows through the Dataverse Web API (the workflow table, category 5) with Entra ID / OAuth2 auth, or reading action-level run history via the third-party FlowStudio MCP. Triggers: 'create a Power Automate cloud flow with the Dataverse API', 'enable my flow by code / set statecode to 1', 'why can't I create or edit a My Flow programmatically', 'PATCH the workflow clientdata', 'automatizar el despliegue de un flujo de Power Automate desde código'. NOT designing the flow or authoring its definition (automation-flows), NOT choosing a platform by billing model (automation-strategy), NOT a generic typed REST client with auth/pagination/backoff (api-connector-builder), NOT the endpoint receiving an HTTP-trigger POST in your app (webhooks), NOT scripting Microsoft 365 / Graph mail & calendar directly (no first-party skill — api-connector-builder, or google-workspace)."
+description: "Use when operating Microsoft Power Automate cloud flows from code — create, enable, update, list or delete via the Dataverse Web API (`workflow` table, category 5) with Entra ID OAuth2, plus run-history debugging. NOT designing the flow definition (that is `automation-flows`), NOT picking a platform by billing model (that is `automation-strategy`)."
 tags: [power-automate, dataverse, microsoft, flows, entra, oauth, mcp, m365, automation]
 recommends: [automation-flows, automation-strategy, api-connector-builder, webhooks]
 profiles: [full]
@@ -80,7 +80,7 @@ Two load-bearing parts:
 - **`definition`** — a Logic Apps workflow definition: `triggers` (exactly one) then `actions`. This is the *design* artifact. Do not invent it from scratch here — get the trigger→actions→branch→error shape from `../automation-flows/SKILL.md`, then drop it into `definition`. Fastest reliable way to get a real one: build the flow once in the maker portal, export the solution, and copy its `clientdata`.
 - **`connectionReferences`** — the map from the definition's connectors to actual connections. **A flow whose connection references are not authorized will not turn on.** In a solution these are connection-reference records the target environment must resolve; unresolved references are the #1 reason a `PATCH statecode=1` "succeeds" but the flow never runs.
 
-**The trap:** `clientdata` must be *escaped into a string* before it goes in the request body — a nested object is rejected. In a script, `JSON.stringify(clientDataObject)` and assign the result; do not paste the object raw. Full annotated example in `references/dataverse-web-api.md`.
+**The trap:** `clientdata` must be *escaped into a string* before it goes in the request body — a nested object is rejected. In a script, `JSON.stringify(clientDataObject)` and assign the result; do not paste the object raw. Full annotated example — plus the endpoint cheat-sheet (token, list/filter, create, enable, update, delete, ExportSolution, share), OData headers and error handling — in `references/dataverse-web-api.md`.
 
 ## Dynamic lifecycle — token → create → validate → enable → manage → delete
 
@@ -128,13 +128,17 @@ curl -s -X DELETE "$PA_DATAVERSE_URL/api/data/v9.2/workflows(<workflowid>)" \
 
 **Debug a run** — Dataverse's `flowrun` table lists run records but not per-action I/O. To see *which action failed and with what payload*, use FlowStudio MCP: `list_live_flows` → `get_live_flow_runs` → `get_live_flow_run_action_outputs`. See `references/flowstudio-mcp-and-limits.md`.
 
-## Microsoft 365 ecosystem fit
+## Boundaries — when it is not a flow you operate here
 
-Power Automate is Microsoft's iPaaS across M365 and Dynamics; flows live in **Dataverse** and glue Outlook, Teams, SharePoint, Dynamics, and hundreds of connectors. That means the boundary is sharp: if the ask is *"send this email / read this calendar via Microsoft Graph from my own backend code,"* that is not a flow at all — build a typed Graph client with `../api-connector-builder/SKILL.md` (there is no first-party MS-Graph skill). If the equivalent is on Google, that is `../google-workspace/SKILL.md`. This skill is for when the automation genuinely *is* a Power Automate flow you must operate by code.
+Power Automate is Microsoft's iPaaS across M365 and Dynamics; flows live in **Dataverse** and glue Outlook, Teams, SharePoint, Dynamics, and hundreds of connectors. This skill is for when the automation genuinely *is* a Power Automate flow you must operate by code. When it isn't:
 
-## Honesty / gotchas
+- *"Send this email / read this calendar via Microsoft Graph from my own backend code"* — not a flow at all; build a typed Graph client with `../api-connector-builder/SKILL.md` (there is no first-party MS-Graph skill), or `../google-workspace/SKILL.md` for the Google equivalent. Same route for a general typed client with auth/pagination/backoff — this skill uses the Dataverse endpoints surgically, it does not build a client.
+- *"Power Automate or n8n/Make/Zapier?"* — billing model and constraints decide that: `../automation-strategy/SKILL.md`, before you commit to operating here.
+- *"Receive my flow's HTTP-trigger POST in my app"* — that inbound endpoint is `../webhooks/SKILL.md`; this skill triggers and operates flows, it does not build the receiver.
 
-| Trap | Why it bites | Do instead |
+## Anti-patterns
+
+| Anti-pattern | Why it bites | Do instead |
 |---|---|---|
 | Trying to CRUD a **My Flow** by code | Unsupported — silently impossible, not a bug you can fix | Move it into a Dataverse solution, or drive it by hand |
 | `clientdata` sent as a nested object | Request rejected; the column expects an escaped **string** | Serialize (`JSON.stringify`) the definition+connectionReferences before sending |
@@ -144,13 +148,6 @@ Power Automate is Microsoft's iPaaS across M365 and Dynamics; flows live in **Da
 | Hardcoding the Dataverse URL / secret | Env-specific, leaks in source | `.env`: `PA_DATAVERSE_URL`, `PA_TENANT_ID`, `PA_CLIENT_ID`, `PA_CLIENT_SECRET` |
 | Assuming the Dataverse path is permanent | Power Platform API is superseding surfaces piecemeal | Re-check `api.powerplatform.com` coverage at author time; the split is fast-moving |
 
-## Related skills
-
-- **`../automation-flows/SKILL.md`** — design side: what the trigger→actions→branch→error should be, the importable definition. This skill *consumes* that shape as `clientdata.definition`. Design there, operate here.
-- **`../automation-strategy/SKILL.md`** — choosing Power Automate vs n8n/Make/Zapier by billing and constraints. Decide there before you commit to operating here.
-- **`../api-connector-builder/SKILL.md`** — a generic typed REST client with auth/pagination/backoff (including a Dataverse or MS Graph client). This skill uses the Dataverse API surgically; it does not build a general client.
-- **`../webhooks/SKILL.md`** — building the inbound endpoint in *your* app that receives a flow's HTTP-trigger POST. This skill triggers/operates flows; it does not build the receiver.
-
 ## Checklist
 
 - [ ] `.env` set: `PA_DATAVERSE_URL` (no trailing slash), `PA_TENANT_ID`, `PA_CLIENT_ID`, `PA_CLIENT_SECRET`.
@@ -161,9 +158,3 @@ Power Automate is Microsoft's iPaaS across M365 and Dynamics; flows live in **Da
 - [ ] Flow enabled via `PATCH statecode=1` and verified on read-back.
 - [ ] Solution **exported** before any `DELETE`.
 - [ ] No secrets or org URLs hardcoded; FlowStudio MCP (if used) flagged as third-party.
-
-## References
-
-- `references/dataverse-web-api.md` — endpoint cheat-sheet (token, list/filter, create, enable, update, delete, ExportSolution, share), the full annotated `clientdata`, OData headers, and error handling.
-- `references/entra-auth-setup.md` — app registration, service principal vs delegated user, the Dataverse application user + security role, `.default` vs `user_impersonation`, and common 401/403 causes.
-- `references/flowstudio-mcp-and-limits.md` — FlowStudio MCP tools and auth (third-party), what it exposes that Dataverse doesn't, and the platform limits (My Flows, `api.flow.microsoft.com`, Power Platform API evolution).

package/skills/prisma-orm/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: prisma-orm
-description: "Use when modeling data or writing type-safe queries with Prisma ORM in TypeScript and hitting its classic problems: N+1 on relations, over-fetching with fat include, an unbounded findMany scanning the whole table, the v7 'requires either adapter or accelerateUrl' error, or a Prisma 6 to 7 upgrade. Owns schema.prisma, the prisma-client generator, prisma.config.ts, the Prisma Client query API, and Prisma Migrate. Triggers: 'PrismaClient requires either adapter or accelerateUrl', 'client is not in node_modules anymore', 'relationLoadStrategy join vs query', 'migrate dev vs migrate deploy in CI', 'findMany returns the whole table', 'modela el esquema de usuarios y pedidos con Prisma', 'migració de Prisma a la versió 7'. NOT the schema-as-TS SQL-builder ORM (that is drizzle-orm), NOT cross-cutting zero-downtime migration strategy (that is db-migrations), NOT Postgres server tuning and EXPLAIN (that is postgresdb)."
+description: "Use when modeling data or writing type-safe queries with Prisma ORM in TypeScript — `schema.prisma`, `prisma.config.ts`, the generated Prisma Client, and Prisma Migrate, including the v6 to v7 upgrade. NOT schema-as-TS with a SQL builder (that is `drizzle-orm`), NOT ORM-agnostic zero-downtime migration (that is `db-migrations`), NOT Postgres engine tuning (that is `postgresdb`)."
 tags:
   - prisma
   - prisma-orm
@@ -286,8 +286,8 @@ Rules with teeth:
 
 Failed-migration recovery, baselining an existing database, and the full Prisma 6 to 7
 upgrade are in `references/migrations-and-v7-upgrade.md`. For ORM-independent evolution
-strategy (expand/contract, dual-write, zero-downtime backfills) that is the `db-migrations`
-skill.
+strategy (expand/contract, dual-write, zero-downtime backfills) that is
+`../db-migrations/SKILL.md`.
 
 ## Anti-patterns
 
@@ -311,10 +311,3 @@ Run `scripts/verify.sh <path>` to statically check emitted artifacts: it confirm
 `prisma-client` generator + `output`, an adapter on the constructor, and flags
 `$queryRawUnsafe` injection, `binaryTargets`, unbounded `findMany`, and wrong-ORM
 contamination. Read-only; no database connection.
-
-## References
-
-- `references/queries-and-performance.md` — query cookbook, `relationLoadStrategy` matrix,
-  transactions, generated types, the perf checklist, and the raw-SQL safety matrix.
-- `references/migrations-and-v7-upgrade.md` — migrate workflow detail, failed-migration
-  recovery, baselining, and the full Prisma 6 to 7 upgrade.

package/skills/prisma-orm/evals/cases.yaml

@@ -21,8 +21,8 @@ should_trigger:
     why: Non-obvious v7 change — generated output path replaces the node_modules import.
   - prompt: "Necessito fer la migració de Prisma a la versió 7, què he de canviar a schema.prisma i al client?"
     why: >
-      Catalan phrasing matching the description's stated coverage — the v6 to 7 upgrade
-      (generator rename, output, adapter, prisma.config.ts) is explicitly owned here.
+      Catalan phrasing of the v6 to 7 upgrade (generator rename, output, adapter,
+      prisma.config.ts), which this skill owns.
 
 should_not_trigger:
   - prompt: "Set up the same schema using Drizzle's pgTable and drizzle-kit"

package/skills/procurement/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: procurement
-description: "Use when a small operator must decide what to buy and from whom — pick a supplier/vendor, write an RFI/RFQ/RFP that gets comparable bids back, compare quotes on total cost not sticker price, negotiate price and payment terms, judge single-source risk, or build a vendor scorecard for quarterly review. Triggers: 'help me pick a supplier for X', 'write an RFQ for 5,000 units', 'which of these quotes is actually cheapest over three years', 'should I take the 2/10 net 30 early-payment discount', 'we buy a critical part from one supplier — how risky is that', 'build a supplier scorecard', 'compara estos proveedores / negociar condiciones de pago', 'compara aquests proveïdors / negociar condicions amb el proveïdor'. NOT signing the binding purchase agreement or redlining liability/IP clauses (that is contracts), NOT the price you charge your own customers (that is pricing), NOT counting or reordering the stock once it arrives (that is inventory)."
+description: "Use when a small operator must choose what to buy and from whom: pick a supplier, write an RFI/RFQ/RFP that returns comparable bids, score quotes on total cost of ownership, negotiate price and payment terms, or judge single-source risk. NOT redlining the purchase agreement (that is `contracts`), NOT the price you charge customers (that is `pricing`), NOT stock once it lands (that is `inventory`)."
 tags: [procurement, sourcing, suppliers, rfq, negotiation, vendor-management]
 recommends: [contracts, pricing, inventory, logistics-ops, invoicing, cost-tracking]
 origin: risco
@@ -172,8 +172,3 @@ You own the decision and the deal. The moment it becomes something else, route:
 - Tracking ongoing SaaS/subscription spend after a renewal decision → `../cost-tracking/SKILL.md`.
 
 > Note on AI: generative tools can compress supplier *discovery* by up to ~90% — finding candidates fast. They do not replace the weighting, TCO model, risk segmentation, or negotiation. Use AI to widen the shortlist; keep the judgment human and on paper.
-
-## references/
-
-- `references/sourcing-requests.md` — copy-ready RFI/RFQ/RFP skeletons with the mandatory comparable-bid sections, plus invite and award/regret email templates.
-- `references/scorecard-and-tco.md` — weighted-scorecard template, worked TCO comparison layout, supplier performance scorecard, SRM-cadence-by-quadrant table, and re-source trigger thresholds.

package/skills/procurement/evals/cases.yaml

@@ -12,9 +12,9 @@ should_trigger:
   - prompt: "We buy a critical component from only one supplier — how worried should I be?"
     why: Single/sole-source concentration risk and the backup-plan requirement.
   - prompt: "Negociar mejores condiciones de pago con nuestro proveedor."
-    why: Spanish trigger — payment-terms negotiation, trading a concession for extended terms.
+    why: Asked in Spanish — payment-terms negotiation, trading a concession for extended terms.
   - prompt: "Compara aquests proveïdors i munta una scorecard ponderada per decidir."
-    why: Catalan trigger — weighted-scorecard supplier comparison.
+    why: Asked in Catalan — weighted-scorecard supplier comparison.
 
 should_not_trigger:
   - prompt: "Draft and redline the purchase agreement so we can sign it."

package/skills/react-native/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: react-native
-description: "Use when writing the JS/TS code inside a React Native or Expo app — screens, navigation, lists, animation, platform-conditional UI, data/offline state, and native-module authoring — and when killing runtime jank or render bugs. Triggers: 'scaffold an Expo Router app', 'FlashList vs FlatList', 'auth-gated route groups', 'gesture reattaches every render', 're-render storm on every keystroke', 'deep link lands on the wrong screen', 'write an Expo Module wrapping a native SDK', 'la llista pateix lag quan faig scroll', 'mi app va fluida en iOS pero a tirones en Android'. NOT eas build/submit/OTA update/prebuild/config-plugin (that is expo), NOT a Dart app (that is flutter), NOT web React/DOM (that is react or nextjs)."
+description: "Use when writing the JS/TS inside a React Native or Expo app — screens, Expo Router navigation, lists, Reanimated gestures, platform forks, offline state, native modules — or killing jank and render storms. NOT eas build/submit/OTA/config-plugin (that is `expo`), NOT a Dart app (that is `flutter`), NOT web React/DOM (that is `react` or `nextjs`)."
 tags: [react-native, expo, mobile, ios, android, navigation, performance]
 recommends: [expo, react, flutter, design, debug, performance]
 origin: risco
@@ -8,11 +8,7 @@ origin: risco
 
 # React Native (app code)
 
-You write the code that runs *inside* the app: render, navigate, animate, list, persist, and author native modules. The pipeline around it — building, signing, OTA, native config — is not yours.
-
-## What this skill owns
-
-Mobile is split across two skills by **verb**. Run the verb test before doing anything:
+You write the code that runs *inside* the app: render, navigate, animate, list, persist, and author native modules. Mobile is split across two skills by **verb** — run the verb test before doing anything:
 
 | Verb in the request | Skill |
 |---|---|
@@ -149,7 +145,7 @@ Use Reanimated 4 CSS animations for simple declarative cases (fades, simple tran
 
 - Small forks: `Platform.select({ ios: 12, android: 8 })` or `Platform.OS === 'ios'`.
 - Whole-component forks: `Button.ios.tsx` / `Button.android.tsx` — the bundler picks the right one; import `./Button` with no extension.
-- Safe area: use `react-native-safe-area-context` insets, not hardcoded notch padding. Why: insets differ per device and orientation.
+- Safe area: use `react-native-safe-area-context` insets, not hardcoded notch padding. Why: insets differ per device and orientation. Palette, type scale and layout intent are not decided here → `../design/SKILL.md`.
 - `KeyboardAvoidingView` behaves differently per platform — `padding` on iOS, often `height` or nothing on Android; test both, don't assume the iOS behavior ports.
 - Set the status bar style explicitly per screen via `expo-status-bar`.
 
@@ -196,6 +192,7 @@ Full Expo Module (Swift + Kotlin + view), the Turbo Module codegen-spec walkthro
 - Read **Hermes** stack traces from the bottom up; the JS frame that matters is usually above the native bridge frames.
 - "Works on iOS, breaks on Android" (or vice versa) → run the platform-divergence checklist in `references/performance-debugging.md` before guessing.
 - A red screen citing the interop layer is usually an old-architecture lib running under Fabric — update the lib or find a New-Arch-ready replacement; do **not** disable New Arch.
+- A fault that resists all of the above needs systematic isolation, not more guesses → `../debug/SKILL.md`.
 
 ## Anti-patterns
 
@@ -211,10 +208,3 @@ Full Expo Module (Swift + Kotlin + view), the Turbo Module codegen-spec walkthro
 | Index as list key | Breaks recycling, reorders rows on insert | Stable domain id |
 | Doing native config / `eas.json` / OTA here | Wrong skill; this is app code | `../expo/SKILL.md` |
 | Hardcoded notch/safe-area padding | Wrong on other devices/orientations | `react-native-safe-area-context` insets |
-
-## Cross-references
-
-- Building, signing, OTA, native config → `../expo/SKILL.md`
-- Dart cross-platform alternative → `../flutter/SKILL.md`
-- Layout/visual design decisions → `../design/SKILL.md`
-- Systematic runtime fault isolation → `../debug/SKILL.md`

package/skills/react-native/scripts/verify.sh

@@ -42,6 +42,7 @@ flag() { # message + matching lines
   findings=1
   printf '%s[finding]%s %s\n' "$YELLOW" "$RESET" "$1"
   [ -n "${2:-}" ] && printf '%s\n' "$2" | sed 's/^/    /'
+  return 0 # never let a message-only finding trip set -e and skip the remaining checks
 }
 
 md_files() { # SKILL.md + every references/*.md
@@ -86,11 +87,13 @@ if [ -n "$bare" ]; then
   done < "$SKILL"
 fi
 
-# 4) Description must carry the Triggers: label and a NOT-boundary.
+# 4) Description shape: a "Use when/to" lead, a NOT-boundary, and no keyword trigger list
+#    (the model matches by meaning; a phrase list is per-turn cost for every install).
 desc="$(grep -m1 -E '^description:' "$SKILL" 2>/dev/null || true)"
 if [ -n "$desc" ]; then
-  printf '%s' "$desc" | grep -q 'Triggers:' || flag "description missing 'Triggers:' label"
+  printf '%s' "$desc" | grep -qE 'Use (when|to) ' || flag "description does not open with 'Use when/to'"
   printf '%s' "$desc" | grep -qE 'NOT ' || flag "description missing a 'NOT <x> (that is <sibling>)' boundary"
+  printf '%s' "$desc" | grep -q 'Triggers:' && flag "description carries a 'Triggers:' keyword list -> delete it, the model matches by meaning" ""
 fi
 
 # 5) No cross-ref to a sibling that does not exist on disk next to this skill.

package/skills/reporting/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: reporting
-description: "Use when you need a recurring report that ships to stakeholders on a cadence — a weekly team digest, monthly exec pack, quarterly board summary, or recurring client performance report — and it must go out reliably without a human in the loop. Symptoms: a standing metrics email keeps breaking or shows stale numbers, the Monday digest is hand-assembled every week, leadership asks for 'the same report but every month', or a client expects a PDF on a schedule. Triggers: 'set up a weekly automated report emailed to the exec team', 'build a monthly PDF report for our biggest client on a schedule', 'send the board a quarterly summary every quarter', 'our Monday metrics email keeps going out with last week's numbers — make it reliable', 'automatiza un informe mensual para dirección', 'munta un informe setmanal automàtic per al comitè'. NOT a live screen people open to slice metrics (that is dashboard), NOT deciding which KPIs to track (that is kpi-framework), NOT a one-off investigation (that is analytics)."
+description: "Use when a recurring report must ship itself on a cadence — weekly digest, monthly exec pack, board pack — via a fetch→narrate→render→deliver pipeline with a schedule and a freshness gate. NOT a live view people slice (that is `dashboard`), NOT picking which KPIs to track (that is `kpi-framework`), NOT a one-off investigation (that is `analytics`)."
 tags: [reporting, automated-reports, recurring, stakeholder-reporting, scheduled-delivery, data-analytics]
 recommends: [dashboard, kpi-framework, analytics, automation-flows, email-connector, spreadsheet-ops, google-workspace, notion-connector, github-actions]
 origin: risco
@@ -10,9 +10,10 @@ origin: risco
 
 A report is a **push** artifact: a fixed snapshot that lands in someone's inbox or shared drive on a
 cadence, the same shape every period, with no human assembling it. That is the whole job. If a human
-opens a live view to slice numbers themselves, that is **pull** — a dashboard, not a report. Hold that
-line; almost every failed "reporting" project is a dashboard wearing a report's name, or a report
-nobody can trust because the numbers went stale and no one noticed.
+opens a live view to slice numbers themselves, that is **pull** — a
+[`dashboard`](../dashboard/SKILL.md), not a report. Hold that line; almost every failed "reporting"
+project is a dashboard wearing a report's name, or a report nobody can trust because the numbers went
+stale and no one noticed.
 
 Your deliverable is a **runnable pipeline**, not advice: a template, a generation script, a schedule,
 and a delivery step, with a freshness gate so it fails loud instead of shipping yesterday's numbers.
@@ -32,24 +33,23 @@ is a number no one can defend.
 | **Owner** | Who gets paged when it breaks | a named person, not "the team" |
 
 Rule: you **consume** an agreed metric set — you do not adjudicate which KPIs matter. If the ask is
-"which metrics should we even track?", that is kpi-framework, not this skill. The contract names the
-source and its owner so a wrong number has an address.
+"which metrics should we even track?", that is [`kpi-framework`](../kpi-framework/SKILL.md), not this
+skill. The contract names the source and its owner so a wrong number has an address.
 
 ## Decide: push report vs live dashboard (this branches — settle it first)
 
-Audiences want a consistent, citable snapshot for the period far more often than a live feed; that is
-why scheduled push beats a dashboard for exec summaries, weekly reviews, and finance close packs.
+Audiences want a citable snapshot for the period more often than a live feed — that is why push wins
+for exec summaries, weekly reviews, and finance close packs.
 
 | Signal in the ask | Route |
 | --- | --- |
 | "Same summary, every week/month/quarter" | **reporting** (here) |
 | "Consistent snapshot the board can cite in a meeting" | **reporting** (here) |
 | "It must arrive even if no one logs in" | **reporting** (here) |
-| "A screen people open to filter/drill live" | **dashboard** |
-| "Self-serve, slice by region/date on demand" | **dashboard** |
+| "A screen people open to filter/drill live" | [`dashboard`](../dashboard/SKILL.md) |
+| "Self-serve, slice by region/date on demand" | [`dashboard`](../dashboard/SKILL.md) |
 
-When both are wanted, build the report; let it link to the dashboard as a "go deeper" footer. Do not
-email a dashboard link and call it a report — see the anti-patterns table.
+When both are wanted, build the report and let it link to the dashboard as a "go deeper" footer.
 
 ## Pick the artifact format
 
@@ -120,7 +120,7 @@ Bad → Good, the difference that decides whether the report is useful:
 - **Bad:** a table row `Revenue | 248,300 | 201,400`. The reader must do the math and guess if it matters.
 - **Good:** "Revenue up 23.3% WoW (€248,300 from €201,400) — investigate: driven by the enterprise renewal that won't recur next week."
 
-Never ship a raw metric dump with no narrative. The numbers are the evidence; the sentence is the report.
+The numbers are the evidence; the sentence is the report.
 
 ## Schedule + reliability gate (where reports actually die)
 
@@ -145,7 +145,8 @@ does not teach scheduling in general. The actual transport (SMTP/Gmail send) bel
 
 - [ ] **Freshness gate before send** — assert the source is newer than the last period; if stale, do
       NOT send, raise instead. A report that consumes dirty data is not this skill's job to clean —
-      that is data-cleaning; this gate only refuses to ship known-stale numbers.
+      that is [`data-cleaning`](../data-cleaning/SKILL.md); this gate only refuses to ship
+      known-stale numbers.
 - [ ] **Fail loud** — on any error, alert the owner (the report not arriving is itself a silent failure).
 - [ ] **Idempotent run** — re-running for the same period produces the same artifact, no duplicate send.
 - [ ] **Dead-report cleanup** — if no one opened the last N editions, kill the schedule. Unread reports
@@ -161,18 +162,15 @@ does not teach scheduling in general. The actual transport (SMTP/Gmail send) bel
 | Raw metric dump, no narrative | Reader does the math, misses what changed, stops opening it | Exec summary + 3 takeaways + a "so what" per section |
 | Schedule with no failure alert | A broken job is invisible for weeks; the report just stops | Fail loud to the named owner on any error |
 | A template forked per recipient | Layout change must be made N times; they drift | Single template scoped by `params` |
-| Redefining KPIs inside the report | The report quietly becomes the metric authority, numbers diverge | Consume an agreed set; defer definition to kpi-framework |
+| Redefining KPIs inside the report | The report quietly becomes the metric authority, numbers diverge | Consume an agreed set; defer definition to [`kpi-framework`](../kpi-framework/SKILL.md) |
 | Unpinned WeasyPrint / render lib | A minor bump reflows the board pack with no warning | Pin (WeasyPrint 68.1) and re-check PyPI before changing |
 | Hand-assembling the digest weekly | It breaks the week the owner is on leave | Automate the pipeline end to end; a human only reads it |
 
 ## Verify
 
 Run `scripts/verify.sh` (read-only; pass a path to a generated pipeline directory, or run in it). It
-confirms a Jinja2 template exists and renders against a sample context without error, that the
-generation script produces a non-empty PDF/HTML artifact, that a schedule definition exists (a crontab
-line or a `.github/workflows/*.yml` with a `schedule:` block), and that a delivery step is wired. It
-soft-warns if no freshness/failure gate is detected. On an empty/clean target it exits 0 — nothing to
-check is not a failure.
-
-References: [`pipeline.md`](references/pipeline.md) — full template, chart embed, per-recipient loop,
-GitHub Actions `schedule:` YAML, freshness gate, and failure alert.
+confirms a Jinja2 template renders against a sample context without error, the generation script
+produces a non-empty PDF/HTML artifact, a schedule definition exists (a crontab line or a
+`.github/workflows/*.yml` with a `schedule:` block), and a delivery step is wired. It soft-warns if no
+freshness/failure gate is detected, and exits 0 on an empty/clean target — nothing to check is not a
+failure.

package/skills/roast-me/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: roast-me
-description: "Use when you want honest, comedic feedback on how you prompt — analyzing your own past sessions to score prompt quality and compute efficiency, surface your worst habits, and generate a model-selection cheat sheet. Triggers: 'roast me', 'roast my prompting', 'audit my prompting habits', 'how good are my prompts', 'am I prompting well', 'what are my bad prompt habits', 'analiza mis prompts', 'puntua els meus prompts', 'how much am I wasting on model costs'. NOT reviewing your code or output quality (use code-review for that) and NOT a general prompt-engineering tutorial (use prompt-engineering for that)."
+description: "Use when someone wants an honest, comedic audit of their own prompting — reads their past agent transcripts, scores prompt quality and compute efficiency, names their worst habits, builds a model-selection cheat sheet. NOT reviewing code an agent produced (that is `code-review`), NOT prompting technique in general (that is `prompt-engineering`)."
 tags: [prompting, self-audit, compute-efficiency, ai-hygiene, learning]
 recommends: [prompt-engineering, code-review, context-budget]
 profiles: [full]
@@ -9,7 +9,7 @@ origin: risco
 
 # roast-me — audit your prompting, score yourself, stop burning money
 
-You are the **prompt auditor**. Your target is not the user's code — it is their *prompting behaviour*. You read their recent agent transcripts, run structured analysis passes, produce dual scores (Prompt Quality + Compute Efficiency), name the worst habits with named techniques to fix them, and track the trend over time.
+You are the **prompt auditor**. Your target is not the user's code — it is their *prompting behaviour*, read from their own recent agent transcripts.
 
 Every run follows five phases. Execute them in order.
 
@@ -115,9 +115,7 @@ Score History:
   2026-06-08  73/100 (C) +5↑   35/100 (F)            The 3W Rule
 ```
 
-Output the roast report as formatted markdown. If history exists, append the trend line.
-
-Done.
+Output the roast report as formatted markdown.
 
 ## Orientación (siempre)
 

package/skills/roast-me/evals/cases.yaml

@@ -9,7 +9,7 @@ skill: roast-me
 
 should_trigger:
   - prompt: "Roast me."
-    why: "Canonical verbatim invocation — the skill's own trigger phrase. Must fire immediately and run the five-phase pipeline."
+    why: "Canonical invocation — the shortest possible ask for exactly this skill's job. Must fire immediately and run the five-phase pipeline."
 
   - prompt: "Audit my prompting habits over the last two weeks."
     why: "Situation-first phrasing with a custom time window — roast-me owns both the 'audit prompting' job and the --days N parameter."
@@ -18,10 +18,10 @@ should_trigger:
     why: "Dual concern (prompt quality + cost) phrased as a question — maps directly to the two scores roast-me produces. No mention of 'roast' keyword."
 
   - prompt: "Analiza mis prompts de la última semana y dime dónde soy malo."
-    why: "Spanish-language trigger — rsc users write Spanish; the description must fire on non-English phrasings. Tests the non-English trigger."
+    why: "Spanish-language request — rsc users write Spanish; routing must survive translation on meaning alone."
 
   - prompt: "Puntua els meus prompts i digue'm quins hàbits hauria de canviar."
-    why: "Catalan-language trigger — a non-obvious language variant. The description lists this phrasing explicitly."
+    why: "Catalan-language request — a non-obvious language variant that must route on meaning, with no keyword resembling the skill id."
 
   - prompt: "How much am I burning on model costs? Show me where I overspend."
     why: "Compute-efficiency angle only, no prompting-quality framing — roast-me's compute score and cheat sheet are the direct answer."

package/skills/ruby/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: ruby
-description: "Use when writing idiomatic Ruby outside Rails — plain scripts, CLIs, gems, libraries — or refactoring imperative loops into Enumerable chains, designing module mixins, packaging with Bundler, deciding whether metaprogramming is worth it, or setting up Minitest/RSpec. Triggers: 'write this in Ruby', 'refactor this loop with map/reduce', 'build a gem', 'gemspec / Gemfile.lock', 'method_missing or define_method?', 'Minitest vs RSpec', 'FrozenError after Ruby 3.4 upgrade', 'mixin vs inheritance', 'escribir una gema en Ruby', 'refactoritzar amb blocs'. NOT Rails/ActiveRecord/controllers (that is rails)."
+description: "Use when writing or refactoring plain Ruby outside Rails — scripts, CLIs, gems, libraries: Enumerable chains and blocks, module mixins and value objects, Bundler/gemspec packaging, whether metaprogramming earns its keep, Minitest or RSpec, Ruby 3.4/4.0 frozen-string hygiene. NOT Rails, ActiveRecord, or ActiveSupport idioms (that is `rails`)."
 tags: [ruby, gems, bundler, metaprogramming, rspec, minitest, enumerable]
 recommends: [rails, testing-web, secure-coding]
 profiles: []
@@ -14,31 +14,18 @@ leaning on `Enumerable` and `Comparable` instead of hand-rolled loops, with
 `frozen_string_literal` hygiene and a real `Gemfile`/`.gemspec` when you package.
 
 This is **Ruby the language and its non-Rails ecosystem** — blocks, modules, gems,
-metaprogramming, Minitest/RSpec. The moment code loads the Rails framework or reaches
-for ActiveRecord/ActiveSupport idioms, it is no longer this skill — that is `rails`.
+metaprogramming, Minitest/RSpec. Delegate: Rails apps, ActiveRecord models, controllers,
+migrations, views, Hotwire — anything that loads Rails or uses ActiveSupport/ActiveRecord
+idioms — to [`rails`](../rails/SKILL.md); the same task in another language to
+[`python`](../python/SKILL.md), [`go`](../go/SKILL.md), [`rust`](../rust/SKILL.md),
+[`elixir`](../elixir/SKILL.md), [`php`](../php/SKILL.md) or
+[`typescript`](../typescript/SKILL.md); the CI pipeline that runs your Ruby tests to
+[`github-actions`](../github-actions/SKILL.md) — this skill writes the tests, not the workflow.
 
 Targets **Ruby 4.0** (released 2025-12-25) on **3.4** semantics: Prism is the default
 parser, string literals warn on mutation without a magic comment, `it` is an implicit
 block param, and `Set` is now a core class.
 
-## When to use / When NOT to use
-
-**Use when:**
-
-- Authoring or refactoring any plain-Ruby `.rb` file, CLI, script, gem, or library.
-- Turning imperative loops into `Enumerable` chains (`map`/`select`/`reduce`/`each_with_object`/`group_by`).
-- Designing module mixins, `Comparable`/`Enumerable` inclusion, refinements, or value objects (`Struct`/`Data`).
-- Setting up a gem: `bundle gem`, `.gemspec`, SemVer, version constraints, publishing to RubyGems.
-- Deciding whether metaprogramming (`method_missing`, `define_method`, `instance_eval`, DSLs) earns its keep.
-- Writing tests with Minitest or RSpec, wiring RuboCop/Standard, or adding RBS/Sorbet typing.
-
-**When NOT to use (delegate):**
-
-- Rails apps, ActiveRecord models, controllers, migrations, views, Hotwire -> `rails`.
-  The hard line: anything that loads Rails or uses ActiveSupport/ActiveRecord idioms.
-- The same task in another language -> `python`, `go`, `rust`, `elixir`, `php`, `typescript`.
-- A CI pipeline that runs your Ruby tests -> `github-actions` (this skill writes the tests, not the workflow).
-
 ## Mental model
 
 Internalize these before writing a line:
@@ -291,7 +278,8 @@ examples with `let`/`subject`/`context` are in
 - **Types:** two coexisting systems — **RBS** (official signatures in separate `.rbs`
   files, checked by Steep) and **Sorbet** (inline `sig` blocks, with experimental
   inline-RBS-comment support). Add types only on a library's public surface or a hot,
-  bug-prone core — not on throwaway scripts.
+  bug-prone core — not on throwaway scripts. RuboCop vs Standard config sits in
+  [references/gems-and-testing.md](references/gems-and-testing.md).
 
 ## Anti-patterns
 
@@ -305,12 +293,3 @@ examples with `let`/`subject`/`context` are in
 | Not committing `Gemfile.lock` for an app | Non-reproducible installs across machines | Commit it for apps; omit only for library gems |
 | `eval` of user-derived input | Remote code execution | Parse explicitly; never `eval` untrusted data |
 | Over-DSLing config a Hash would serve | Hidden control flow, slow `method_missing` | A plain Hash or `Data` object |
-
-## References
-
-- [references/metaprogramming.md](references/metaprogramming.md) — `define_method`,
-  `method_missing` + `respond_to_missing?`, `instance_eval`/`class_eval`, building a DSL,
-  refinements vs monkey-patching, `prepend` wrapping.
-- [references/gems-and-testing.md](references/gems-and-testing.md) — full `bundle gem`
-  tree and `.gemspec`, SemVer + `~>`, publishing, Rakefile, full Minitest + RSpec files,
-  RuboCop vs Standard config.