@event4u/agent-config 14.10.0 → 14.12.0

package/dist/agent-src/skills/fe-design/SKILL.md

@@ -22,6 +22,16 @@ dispatching this?**
 |---|---|---|
 | A ticketed run — the UI directive set is dispatching | `directives/ui/*` | a reference it cites |
 | Anything else — "build me the page", "improve this form", "implement the approved design" | **you, in this turn** | the executor |
+| A renderer axis is in play — WebGL / Three.js / canvas / scroll-scrubbed video | **still you** — the renderer is a grounding question, not a second executor | the executor, grounded via `search_stack` |
+
+The third row is an **axis**, not an owner. Renderer selection resolves through
+machinery that already exists: `search_stack` in
+[`corpus-grounding`](../corpus-grounding/SKILL.md)
+(`scripts/decision_engine.ts`), whose stack corpus carries `threejs.csv` among
+its stacks, read beside the register in
+[`design-intelligence`](../design-intelligence/references/context-and-registers.md)
+§ Register. No second frontend executor is declared, and none is needed: a
+renderer changes what you ground against, never who writes the UI.
 
 Outside the engine, nothing else owns the design quality of a UI write. Reading
 this skill and then writing the UI from priors is the failure it exists to
@@ -65,42 +75,36 @@ else runs the loop.
    artifact's own markup/CSS/JS is stack-compatible, adapt **that code**;
    re-deriving it from scratch is a deviation needing confirmation
    (`design-fidelity-mechanics` § Adopt the code).
-5. **Review** — run [`design-review`](../design-review/SKILL.md) before calling
-   it done, and scope the verdict honestly: render-scoped when you can render
-   it, otherwise explicitly static-scoped, naming which checks actually ran.
-   "Looks good" with neither scope named is a verdict without evidence.
-
-### The heuristics — here, not one hop away
-
-The load-bearing subset, inline so that "loaded" means the content is in
-context. Depth stays in [`references/design-patterns.md`](references/design-patterns.md).
-
-1. **Audit outranks heuristic.** A token, primitive or convention the audit
-   found wins over anything on this list; say `[audit override]` when it does.
-2. **Reuse tokens, never raw values.** A hex, font or px literal where the
-   audit found a token is off-brand by construction.
-3. **All five states are designed.** `empty` is a helpful message, not a blank
-   region; `loading` prefers a skeleton over a spinner (it shows structure, so
-   it reads as faster); `error` says what to do next.
-4. **Labels are always visible.** No placeholder-only inputs.
-5. **Validate on blur and on submit**, never on every keystroke; the message
-   goes below the field and is specific.
-6. **Mobile-first, and 320 px actually works.** Default styles are the small
-   viewport; complexity is added at larger breakpoints, never removed at
-   smaller ones.
-7. **A11y minimums are non-negotiable:** 4.5:1 contrast for text (3:1 large),
-   every interactive element reachable by Tab, a visible focus ring, semantic
-   elements over `div`, and an `aria-label` wherever there is no visible text.
-8. **Every action gets feedback.** Users read silence as failure.
-9. **Prefer undo over a confirmation dialog** — confirmations get clicked
-   through; an undo affordance actually protects the user.
-10. **Tables:** numbers right-aligned, text left-aligned, a designed empty
-    state, and a sticky header on anything long enough to scroll.
-11. **No placeholder microcopy ships.** Lorem ipsum, `TODO`, and
-    `[Your text here]` are unfinished output, not drafts.
-
-Before proposing a direction, run the anti-slop scan named under
-[Anti-slop discipline](#anti-slop-discipline) below.
+5. **Review, then re-enter** — run [`design-review`](../design-review/SKILL.md)
+   before calling it done, and scope the verdict honestly: render-scoped when
+   you can render it, otherwise explicitly static-scoped, naming which checks
+   actually ran. "Looks good" with neither scope named is a verdict without
+   evidence. Findings → fix them and **re-enter step 5**, at most **2 rounds**,
+   and **stop early on a null**: a round that produces **no new finding** ends
+   the loop, and a round that produces only findings the provided artifact
+   already covers produces no new finding. At the 2-round ceiling with findings
+   still open, stop and hand the remaining list back — ship-as-is or abort is
+   the user's call, never another silent pass. Judgement alone never buys a
+   third round.
+
+   The ceiling is **2**, the same number the engine enforces
+   (`directives/ui/polish.ts`, `POLISH_CEILING`), so the ad-hoc path and the
+   ticketed path bound the loop identically rather than by two conventions that
+   can drift. Fixtures: `daf-adhoc-converges` (round 2 is a null, loop ends) and
+   `daf-adhoc-ceiling` (findings remain at the ceiling, loop hands back).
+
+### The floors — pulled immediately before the write
+
+```
+PULL references/craft-floor.md IMMEDIATELY BEFORE THE WRITE, NOT AT SKILL LOAD.
+```
+
+Twelve universal floors that do not vary by mode, register, intent or stack.
+They were inline here until the delivery point moved: a floor read at skill-load
+time can be a compaction away from the write it governs (`ADR-227`).
+
+One precedence rule stays here because it is authority, not craft: **the audit
+outranks every heuristic.** Say `[audit override]` when it does.
 
 ## Positioning — reference inside the engine, executor outside it
 
@@ -212,13 +216,42 @@ When this skill's content is folded into a design brief or review:
 - Heuristics in this reference apply across stacks; do not promote them to project rules without checking the audit.
 - Mobile-first is not optional — every layout must work on 320px width.
 
+## Read the authority object — never re-infer it
+
+Read the resolved `ui_authority`
+([contract](../../../docs/contracts/ui-authority.md)) before the loop:
+`surface_mode`, `register`, `change_intent`, `reference_maturity`,
+`constraints`. This skill is a **declared consumer** — a second decision table
+beside the object is a drift surface, so do not re-derive any field.
+
+`surface_mode` sets density, hierarchy and expressiveness only, per
+[`design-modes`](../../../docs/guidelines/design-modes.md) § The second axis.
+
+```
+QUALITY FLOORS DO NOT VARY BY SURFACE MODE.
+A FLOOR THAT MOVES WITH THE MODE IS A PREFERENCE WEARING A FLOOR'S NAME.
+```
+
+### The source-led path
+
+`reference_maturity: runnable-artifact` → the artifact's own markup, CSS and JS
+is the data basis; adapting it is the **default** and a from-scratch
+re-derivation is a deviation. Sort every mechanic into `honoured` / `translated`
+/ `flagged`; one present, absent and unflagged is a **silent drop**, target zero.
+Procedure and the vanishing-mechanic classes:
+[`references/source-led-port.md`](references/source-led-port.md).
+
+Maturity is not decided here — it arrives on the authority object, and per-value
+provenance belongs to `road-to-frontend-fidelity-calibration` Phases 0 and 2.
+
 ## Anti-slop discipline
 
-Before proposing any UI layout, component, or aesthetic direction, pull
-[`docs/guidelines/design-antipatterns.md`](../../../docs/guidelines/design-antipatterns.md)
-and scan the Visual (V1–V7), Layout (L1–L8), and Quality-floors (Q1–Q12) sections.
-If the first-impulse design matches a listed pattern, either choose a different
-approach or explicitly invoke the override condition in the design brief.
+Before proposing a direction, scan the Visual (V1–V7) and Layout (L1–L8)
+sections of [`design-antipatterns`](../../../docs/guidelines/design-antipatterns.md).
+On a match, choose differently or invoke the entry's own override condition in
+the brief — every entry has one, and they are register-scoped. The Q* floors are
+in [`references/craft-floor.md`](references/craft-floor.md) instead of here, so
+they arrive at the write rather than at skill load.
 
 ## Do NOT
 

package/dist/agent-src/skills/fe-design/references/craft-floor.md

@@ -0,0 +1,52 @@
+# Craft floor — load this immediately before the write
+
+Universal floors. They do not vary by surface mode, register, change intent or
+stack. Taste and direction stay mode-scoped in
+[`fe-design`](../SKILL.md); nothing on this page is a preference.
+
+**Why this is a separate page rather than inline.** The skill body used to carry
+these inline, on the argument that "loaded" should mean the content is in
+context. That argument is kept and the delivery point moved: a floor read at
+*skill-load* time can be many turns and a compaction away from the write it
+governs, and `ADR-227` records that a path-scoped carrier is not re-injected
+after `/compact`. This page is pulled **immediately before the write**, which is
+the moment the floor has to be present. Same content, later delivery.
+
+## The floors
+
+1. **Reuse tokens, never raw values.** A hex, font or px literal where the audit
+   found a token is off-brand by construction.
+2. **All five states are designed.** `empty` is a helpful message, not a blank
+   region. `loading` prefers a skeleton over a spinner — it shows structure, so
+   it reads as faster. `error` says what to do next.
+3. **Labels are always visible.** No placeholder-only inputs.
+4. **Validate on blur and on submit**, never on every keystroke. The message
+   goes below the field and is specific.
+5. **Mobile-first, and 320 px actually works.** Default styles are the small
+   viewport; complexity is added at larger breakpoints, never removed at smaller
+   ones. `agent-config ui:render` captures 320 px so this is measurable rather
+   than asserted.
+6. **Accessibility minimums are non-negotiable.** 4.5:1 contrast for text (3:1
+   large), every interactive element reachable by Tab, a visible focus ring,
+   semantic elements over `div`, and an `aria-label` wherever there is no
+   visible text.
+7. **Every action gets feedback.** Users read silence as failure.
+8. **Prefer undo over a confirmation dialog.** Confirmations get clicked
+   through; an undo affordance actually protects the user.
+9. **Tables:** numbers right-aligned, text left-aligned, a designed empty state,
+   and a sticky header on anything long enough to scroll.
+10. **No placeholder microcopy ships.** Lorem ipsum, `TODO` and
+    `[Your text here]` are unfinished output, not drafts.
+11. **A default font pick is declared or changed.** Inter, Roboto, DM Sans,
+    Geist, Space Grotesk and Instrument Serif are the AI defaults. In the
+    product register "one reliable family" is a complete reason — but state it.
+    An undeclared pick is an undeclared choice (T7).
+12. **Zero silent drops.** A mechanic present in a supplied source and absent
+    from the output, with no `flagged` entry, is a silent drop.
+
+## What is NOT on this page
+
+Density, hierarchy, expressiveness, palette character, type personality,
+motion register. Those are surface-mode and register decisions and they live in
+`fe-design`. Putting them here would make a preference look like a floor, which
+is the failure this split exists to prevent.

package/dist/agent-src/skills/fe-design/references/source-led-port.md

@@ -0,0 +1,36 @@
+# Source-led port — adopt the mechanics, do not re-derive them
+
+Pulled when `ui_authority.reference_maturity` is `runnable-artifact`. Contract:
+[`ui-authority`](../../../../../docs/contracts/ui-authority.md).
+
+When `reference_maturity` is `runnable-artifact`, the artifact's own markup, CSS
+and JS is the data basis and adapting it is the DEFAULT. A from-scratch
+re-derivation is a deviation and needs the same confirmation as a swapped
+control (per [`design-fidelity`](../../rules/design-fidelity.md)).
+
+Account for every mechanic the source carries, in the engine's own vocabulary
+(`COVERAGE_BUCKETS`, shared rather than copied — `agent-config ui:audit`
+re-exports it):
+
+- **`honoured`** — carried across intact.
+- **`translated`** — expressed differently in the target stack, same observable
+  behaviour. Name the substitution.
+- **`flagged`** — cannot be carried; say so explicitly.
+
+```
+A MECHANIC THAT IS PRESENT IN THE SOURCE AND ABSENT FROM THE OUTPUT WITH NO
+`flagged` ENTRY IS A SILENT DROP. TARGET: ZERO.
+```
+
+`container-type` / `@container`, `clamp()` type scales, `:has()` state
+selectors, `IntersectionObserver` reveals and view transitions are the classes
+that vanish most often, because each one *looks* like decoration and is
+actually behaviour. `tests/eval/frontend-corpus/near-miss/artifact-source-not-rederived`
+is the pinned case: three mechanics, and an output that silently becomes a plain
+media-query grid fails it.
+
+**Maturity itself is not decided here.** `reference_maturity` arrives on the
+authority object, and per-value provenance for a comp belongs to
+`road-to-frontend-fidelity-calibration` Phases 0 and 2. This skill adds no
+second maturity discriminator.
+

package/dist/agent-src/skills/file-editor/SKILL.md

@@ -3,6 +3,11 @@ model_tier: lite
 name: file-editor
 description: "Use when opening edited files in the user's IDE. Reads settings from .agent-settings.yml to determine IDE and whether auto-open is enabled."
 domain: process
+scope:
+  write:
+    - pattern: "**"
+      access: "write"
+  verification_reason: "the write target IS the caller's argument — this skill edits whatever path it is pointed at, so its scope is the tree by construction. A narrower glob would be false, not tighter."
 execution:
   type: assisted
   handler: shell

package/dist/agent-src/skills/finishing-a-development-branch/SKILL.md

@@ -61,7 +61,7 @@ or [`fix-pr-comments`](../../commands/fix-pr-comments.md) instead.
 ### 2. Verify readiness
 
 Run the end-of-work gate before presenting any options — see
-[`verify-before-complete`](../verify-before-complete/SKILL.md).
+[`verify-completion-evidence`](../verify-completion-evidence/SKILL.md).
 Steps 1–3 run only when `quality.local_auto_run: true`; under the
 default (`false` / missing) skip them without asking — the user runs
 quality tools manually, remote CI on the PR is the authoritative gate,
@@ -226,7 +226,7 @@ After the chosen option completes, report:
 
 ## When to hand over to another skill / command
 
-* Final pre-merge verification → [`verify-before-complete`](../verify-before-complete/SKILL.md)
+* Final pre-merge verification → [`verify-completion-evidence`](../verify-completion-evidence/SKILL.md)
 * Rebasing the stack before PR → [`prepare-for-review`](../../commands/prepare-for-review.md)
 * Writing the commit for any last-minute tweaks →
   [`commit`](../../commands/commit.md),

package/dist/agent-src/skills/git-workflow/SKILL.md

@@ -3,6 +3,9 @@ model_tier: medium
 name: git-workflow
 description: "Use when working with Git — branch naming, commit messages, PR creation, rebasing, or the code review process — even when the user says 'push this' or 'merge the branch' without naming Git."
 domain: process
+scope:
+  write: []
+  verification_reason: "execution.handler is internal, so this skill spawns no subprocess — writes happen through the agent's declared allowed_tools. No command can prove a scope the skill never executes."
 execution:
   type: assisted
   handler: internal

package/dist/agent-src/skills/html-deck/SKILL.md

@@ -12,6 +12,9 @@ trust:
   level: professional
 install:
   removable: true
+scope:
+  write: []
+  verification_reason: "execution declares no handler, so this skill runs nothing of its own — every write is the calling agent's, under the rules that govern it. No command can prove a scope the skill never executes."
 execution:
   type: manual
 ---

package/dist/agent-src/skills/iconography/SKILL.md

@@ -12,6 +12,9 @@ trust:
   level: professional
 install:
   removable: true
+scope:
+  write: []
+  verification_reason: "execution declares no handler, so this skill runs nothing of its own — every write is the calling agent's, under the rules that govern it. No command can prove a scope the skill never executes."
 execution:
   type: manual
 ---

package/dist/agent-src/skills/image-editing/SKILL.md

@@ -12,6 +12,9 @@ trust:
   level: experimental
 install:
   removable: true
+scope:
+  write: []
+  verification_reason: "execution declares no handler, so this skill runs nothing of its own — every write is the calling agent's, under the rules that govern it. No command can prove a scope the skill never executes."
 execution:
   type: manual
 ---

package/dist/agent-src/skills/image-generation/SKILL.md

@@ -12,6 +12,9 @@ trust:
   level: experimental
 install:
   removable: true
+scope:
+  write: []
+  verification_reason: "execution declares no handler, so this skill runs nothing of its own — every write is the calling agent's, under the rules that govern it. No command can prove a scope the skill never executes."
 execution:
   type: manual
 ---

package/dist/agent-src/skills/image-provider-routing/SKILL.md

@@ -12,6 +12,9 @@ trust:
   level: experimental
 install:
   removable: true
+scope:
+  write: []
+  verification_reason: "execution declares no handler, so this skill runs nothing of its own — every write is the calling agent's, under the rules that govern it. No command can prove a scope the skill never executes."
 execution:
   type: manual
 ---

package/dist/agent-src/skills/incident-commander/SKILL.md

@@ -143,3 +143,13 @@ Post-mortem owner: <role>
 - Do NOT close an incident without a post-mortem owner assigned.
 - Do NOT edit the timeline after the fact; corrections are new
   entries.
+
+## See also
+
+- [`alerting-doctrine`](../alerting-doctrine/SKILL.md) — what earned the page
+  that opened this incident, and the runbook contract the first responder reads.
+  A page arrives with an owner, a runbook and a first diagnostic step; if it did
+  not, that is a configuration defect to record in the post-mortem.
+- [`logging-monitoring`](../logging-monitoring/SKILL.md) — the signal posture the
+  incident is being diagnosed through, and why a `proposed` threshold is not a
+  breach.

package/dist/agent-src/skills/js-library-packaging/SKILL.md

@@ -0,0 +1,173 @@
+---
+model_tier: medium
+name: js-library-packaging
+description: "Use when a JavaScript/TypeScript package is consumed by another package — exports map, peer vs. direct dependencies, files allow-list, and whether it should be built at all."
+domain: engineering
+workspaces:
+  - engineering
+packs:
+  - engineering-base
+---
+
+# js-library-packaging
+
+> **Pack placement.** `engineering-base`. The step asked for it to be *suggested by* the
+> `react` and `typescript` packs, and the skill schema carries no `suggested_by` key — so the
+> intent is recorded here rather than expressed in frontmatter that would fail validation.
+> A React or TypeScript consumer receives this skill through `engineering-base`, which both
+> of those packs require.
+
+The JavaScript twin of [`composer-packages`](../composer-packages/SKILL.md). A component is
+a file; a **library** is a package with a public surface, and that surface is declared in
+`package.json` rather than inferred. Most of the failures below are silent at author time
+and loud at the consumer's — which is why the surface is read, not assumed.
+
+## The Iron Law
+
+```
+`react` AND `react-dom` ARE peerDependencies. NEVER dependencies.
+`types` IS THE FIRST KEY OF EVERY CONDITIONS OBJECT.
+DECIDE buildable-VS-source-consumed BEFORE WRITING THE EXPORTS MAP.
+NEVER HAND-BUMP A VERSION.
+```
+
+## When to use
+
+A package in the repository is imported by another package, or is about to be published:
+an `exports` map is being written or changed, a hook fails at runtime with *"invalid hook
+call"*, an install fails on a `workspace:` range, a release needs cutting, or the
+buildable-vs-source question has not been answered yet.
+
+## Procedure
+
+1. **Answer buildable-vs-source-consumed FIRST.** It determines the exports map, the `files`
+   list, and whether a build step exists at all — deciding it after writing the map means
+   rewriting the map.
+   - **Source of truth:** is the package published to a registry, or only consumed inside
+     this workspace?
+   - **Verify:** the exports targets all point into one of the two worlds (`src/` or the
+     build directory), never a mix.
+2. **Read the surface rather than asserting it.** Run the check below over the package root.
+   - **Source of truth:** `package.json` — `exports`, `dependencies`, `peerDependencies`,
+     `files`, `private`, `publishConfig`.
+   - **Verify:** zero `error`-severity findings.
+3. **Fix peer placement before anything else.** A library carrying `react` in
+   `dependencies` gives the consumer a second copy of React.
+   - **Verify:** `react` and `react-dom` appear under `peerDependencies` only.
+4. **Order the conditions.** `types` first, then `import` / `require`.
+   - **Verify:** the check reports no `types-not-first`.
+5. **Cut the release through the repository's own mechanism** — never by editing a version
+   field. See § Release.
+   - **Verify:** the version change is produced by the tool the repository already carries.
+
+## Read the surface
+
+```
+check_package_surface <library-root> [<library-root> …]
+```
+
+`scripts/check_package_surface.ts` beside this skill. Deterministic, JSON on stdout, no
+network and no subprocess. It reports:
+
+| Code | Severity | Why |
+|---|---|---|
+| `peer-as-dependency` | error | two copies of React in one tree break hooks at runtime, with a message that names neither package |
+| `export-target-missing` | error | the manifest promises a file the package does not ship |
+| `no-exports-map` | warn | `main`/`module` without `exports` — the entry point resolves by bundler convention, not by declaration |
+| `types-not-first` | warn | conditions match in declaration order, so a later `types` is never seen and the package silently ships untyped |
+| `workspace-range-publishable` | warn | a `workspace:` range does not resolve outside the workspace; published, the consumer's install fails |
+
+**It classifies from the declared export targets, never from a directory name.** A package
+directory called `ui-lib-vite` is not evidence about Vite, and one called `buildable` is not
+evidence that anything builds. A **mixed** declaration is reported as `undeclared` rather
+than resolved to a guess — declaring both is the ambiguity worth surfacing.
+
+**What it does not do:** it never compiles and never runs a bundler, so it cannot tell you
+the declared layout is producible. A checker that grew a parser would report compile errors
+as packaging errors, and the two have different fixes.
+
+## Buildable vs. source-consumed
+
+| | source-consumed | buildable |
+|---|---|---|
+| exports point at | `src/` | the build directory |
+| build step | none | one, and it must run before publish |
+| `files` | not needed (nothing published) | the build directory, as an allow-list |
+| `private` | `true` on a workspace-only package | absent; `publishConfig.access` set instead |
+| cost | consumer compiles it | a build to maintain, and output that can go stale |
+
+**Default to source-consumed inside a workspace.** A build step exists to serve publication;
+adding one for a package nobody publishes is a maintenance cost with no consumer.
+
+## Release
+
+Read the repository, then take exactly one branch — **Class A**, per
+[`standards-from-config`](../standards-from-config/SKILL.md): the config *is* the answer.
+
+1. **`.changeset/` present → changesets.** Add a changeset describing the change and let the
+   release job bump and publish. Never edit `version` by hand.
+2. **A task runner with a release command (e.g. `nx release`) → that command.** It owns
+   version, tag, and changelog together; splitting them by hand desynchronises them.
+3. **Neither present → none configured.** **Propose** a mechanism and stop. Do not hand-bump:
+   a manually edited version has no changelog entry and no tag, so the next release cannot
+   tell what shipped.
+
+A breaking change carries the `!` marker and the footer — see
+[`conventional-commits-writing`](../conventional-commits-writing/SKILL.md). The marker is
+what a release tool reads to decide the major bump, so omitting it publishes a breaking
+change as a patch.
+
+## Output format
+
+1. State the classification (source-consumed / built surface / undeclared) and where it was
+   read from.
+2. List every `error` finding with its fix, then the warnings.
+3. Name the release branch taken and the evidence in the repository for it.
+4. Say explicitly what was not checked — buildability, types, runtime behaviour.
+
+## Gotchas
+
+- **"Invalid hook call" names neither package.** The developer sees a React error and looks
+  at their component; the cause is a library shipping its own React. This is why peer
+  placement is an error and not a warning.
+- **Condition order is silent.** `{ "import": …, "types": … }` type-checks fine at author
+  time and ships untyped to the consumer.
+- **A stale build directory passes every metadata check.** The manifest points at files that
+  exist; nothing says they match `src/`. Only a real build proves that.
+- **`files` is an allow-list, not a deny-list.** Adding a directory to the package means
+  adding it here, and forgetting is invisible until a consumer imports a missing path.
+- **A `workspace:` range is not a version.** It resolves in the workspace and nowhere else.
+
+## Do NOT
+
+- Do NOT put `react` or `react-dom` in `dependencies`.
+- Do NOT write an exports map before answering buildable-vs-source-consumed.
+- Do NOT place `types` after `import` or `require`.
+- Do NOT edit a `version` field by hand, in any of the three release branches.
+- Do NOT claim the package builds because the check passed — it never ran a build.
+
+## Security constraints
+
+`scripts/check_package_surface.ts` is **read-only and offline by construction**, and the
+constraint is worth stating because a packaging tool is a tempting place to lose it:
+
+- **No network.** It never resolves a version, queries a registry, or checks whether a name
+  is taken. Every verdict comes from the manifest in front of it.
+- **No subprocess.** No package manager, no bundler, no compiler. It cannot install, build,
+  or publish, so running it on an untrusted repository executes none of that repository's code
+  — which a package manager's lifecycle scripts would.
+- **No writes.** It reads `package.json` and tests path existence. It never edits a manifest,
+  so it can never "fix" a version field, which is the one thing § Release forbids.
+- **Paths come from the caller, targets from the manifest.** Export targets are resolved
+  relative to the given root and used only for an existence test; nothing is read from them.
+
+Widening any of these turns a metadata reader into something that runs a third party's code.
+If a future check needs a build, it belongs in a separate integration test with its own
+declared cost — never here.
+
+## See also
+
+- [`composer-packages`](../composer-packages/SKILL.md) — the PHP twin; same surface discipline, different manifest.
+- [`standards-from-config`](../standards-from-config/SKILL.md) — the Class-A rule the § Release branch follows.
+- [`conventional-commits-writing`](../conventional-commits-writing/SKILL.md) — the `!` marker a release tool reads.
+- [`ui-component-architect`](../ui-component-architect/SKILL.md) — the component inside the library; this skill is the package around it.