@event4u/agent-config 16.0.0 → 16.2.0

package/dist/agent-src/skills/api-design/data/manifest.json

@@ -28,7 +28,7 @@
   "refresh_cadence": "quarterly",
   "upstream": {
     "repo": "derived: RFC 9110/9457/7396/8288 + httpapi WG drafts",
-    "sha": "RFC set as of 2026-06",
-    "last_checked": "2026-06-07"
+    "sha": "RFC 9110 (STD 97) / 9457 / 7396 / 8288 \u2014 verified 2026-09-18: 9110 neither obsoleted nor updated; 9457 current and obsoletes 7807",
+    "last_checked": "2026-09-18"
   }
-}
+}

package/dist/agent-src/skills/database/data/manifest.json

@@ -28,8 +28,8 @@
   "owner": "package-maintainer",
   "refresh_cadence": "quarterly",
   "upstream": {
-    "repo": "derived: PostgreSQL 16 + MySQL 8 reference docs",
-    "sha": "PostgreSQL 16.x / MySQL 8.4 docs",
-    "last_checked": "2026-06-07"
+    "repo": "derived: PostgreSQL 18 + MySQL 9.7 reference docs (previously PostgreSQL 16 + MySQL 8)",
+    "sha": "re-derived 2026-09-27 against PostgreSQL 18.x / MySQL 9.7: all 12 rows of query-tuning.csv still apply as written on both engines. Three rows gained a version-scoped annotation for a genuinely new capability rather than a rewrite \u2014 row 1 (Slow WHERE on large table) notes PG18's B-tree skip scan, which relaxes the equality-first composite-index rule on PG18+ only; row 5 (JOIN explosion) notes MySQL 9.7's Hypergraph Optimizer, now GA in Community Edition, improving join-order choices automatically; row 12 (JSON column filtering) notes that PG18 flips the GENERATED-column default from STORED to VIRTUAL, and VIRTUAL columns are not indexable, so STORED must now be explicit. PostgreSQL 16.x and MySQL 8.4 remain supported and the patterns apply there unchanged",
+    "last_checked": "2026-09-18"
   }
-}
+}

package/dist/agent-src/skills/database/data/query-tuning.csv

@@ -1,13 +1,13 @@
 Symptom,Keywords,Root Cause,Strategy,Code Good,Anti-Pattern,Verification,Severity
-Slow WHERE on large table,slow query where filter full scan seq scan,Sequential scan despite selective predicate,B-tree index on the filtered column(s); composite index ordered by equality-first then range,"CREATE INDEX idx_orders_status_created ON orders (status, created_at)",Indexing low-cardinality boolean alone; composite ordered range-first,EXPLAIN (ANALYZE) shows Index Scan; rows estimate ≈ actual,HIGH
+Slow WHERE on large table,slow query where filter full scan seq scan,Sequential scan despite selective predicate,B-tree index on the filtered column(s); composite index ordered by equality-first then range (PostgreSQL 18+: skip scan lets the planner use later columns without a leading-column equality predicate — MySQL and pre-18 Postgres still need equality-first ordering),"CREATE INDEX idx_orders_status_created ON orders (status, created_at)",Indexing low-cardinality boolean alone; composite ordered range-first,EXPLAIN (ANALYZE) shows Index Scan (PG 18+: or Index Searches for a skip scan); rows estimate ≈ actual,HIGH
 ORDER BY ... LIMIT slow,order by limit sort top n latest,Sort node over the whole table for a top-N query,Index matching the ORDER BY direction (including DESC/NULLS) so LIMIT walks the index,CREATE INDEX idx_events_created_desc ON events (created_at DESC),OFFSET pagination for infinite feeds (use keyset),Plan shows Index Scan Backward / no Sort node,HIGH
 N+1 query loop,n+1 loop per row lazy load orm repeated query,Hundreds of identical queries differing only by id,Eager-load relations / batch with IN(...) or JOIN; dataloader pattern at the API layer,SELECT * FROM comments WHERE post_id IN (...),Fixing with a cache instead of the access pattern,Query count per request flat vs item count,HIGH
 LIKE '%term%' search,like contains search wildcard fulltext,Leading-wildcard LIKE can't use B-tree,Trigram index (pg_trgm GIN) or full-text search (tsvector + GIN); dedicated engine beyond ~10M rows,CREATE INDEX idx_users_name_trgm ON users USING gin (name gin_trgm_ops),Forcing LOWER() without an expression index,Plan shows Bitmap Index Scan on the GIN index,MEDIUM
-JOIN explosion,join many tables slow hash join nested loop,Mis-estimated join order / missing join keys index,Index every FK used in joins; verify row estimates; break monster joins into CTE/temp stages when estimates collapse,ANALYZE tables; index fk columns,Disabling nested loops globally; hint-chasing before stats are fresh,Estimates within ~10x of actuals at every join node,HIGH
+JOIN explosion,join many tables slow hash join nested loop,Mis-estimated join order / missing join keys index,Index every FK used in joins; verify row estimates; break monster joins into CTE/temp stages when estimates collapse (MySQL 9.7: the Hypergraph Optimizer is now GA in Community Edition and can materially improve join-order choices on its own — verify estimates before assuming a manual rewrite is still needed),ANALYZE tables; index fk columns,Disabling nested loops globally; hint-chasing before stats are fresh,Estimates within ~10x of actuals at every join node,HIGH
 Aggregation over millions of rows,group by count sum report aggregate slow,Repeated full-table aggregation for dashboards,Pre-aggregate: materialized view / rollup table refreshed on schedule or trigger; partial indexes for hot subsets,CREATE MATERIALIZED VIEW daily_rev AS ... REFRESH CONCURRENTLY,Caching in app memory only (cold-start storms),"Dashboard reads hit the rollup, not base tables",MEDIUM
 Pagination deep offset,offset page 10000 slow deep pagination,OFFSET N scans+discards N rows,Keyset/cursor pagination on a unique ordered key,"WHERE (created_at,id) < (:c,:i) ORDER BY created_at DESC,id DESC LIMIT 20",Hiding offset behind a 'page' param and capping at 1000 as a fix,p99 latency flat across page depth,HIGH
 Write contention / lock waits,deadlock lock wait contention update hot row,"Hot-row updates serialize (counters, balances)",Row-level design: ledger inserts over UPDATE-in-place; batch with SKIP LOCKED queues; keep transactions short,SELECT ... FOR UPDATE SKIP LOCKED for workers,Retrying deadlocks blindly without ordering writes,Lock wait time ~0 under load test; deadlock rate 0,HIGH
 Missing/stale statistics,wrong plan estimate stale statistics analyze,Optimizer estimates wildly off → bad plans,Auto-analyze tuned for big tables; manual ANALYZE after bulk loads; extended statistics for correlated columns,"CREATE STATISTICS s_dist (dependencies) ON city,country FROM addr",Hinting every query instead of fixing stats,Plan estimates ≈ actuals after ANALYZE,MEDIUM
 Over-indexing writes,insert slow many indexes write amplification,Each extra index taxes every INSERT/UPDATE,Audit with index-usage stats; drop unused; covering index to replace several near-duplicates,pg_stat_user_indexes idx_scan = 0 candidates,Adding an index per slow query without retiring old ones,Write p95 recovers; no unused-index rows,MEDIUM
 SELECT * over wide rows,select star wide row toast network payload,Fetching unused columns (TOAST/LOB) dominates IO,Project needed columns; covering index enables index-only scans,"SELECT id,status,total FROM orders ...",Compressing payloads instead of trimming the select list,Plan shows Index Only Scan where applicable,LOW
-JSON column filtering,json jsonb attribute filter schemaless,Filtering inside JSON without index = full scan,"GIN index on jsonb path ops, or generated column + B-tree for hot keys",ALTER TABLE t ADD COLUMN status text GENERATED ALWAYS AS (doc->>'status') STORED; CREATE INDEX ...,Stuffing relational data into one JSON blob,Plan uses the GIN/generated-column index,MEDIUM
+JSON column filtering,json jsonb attribute filter schemaless,Filtering inside JSON without index = full scan,"GIN index on jsonb path ops, or generated column + B-tree for hot keys",ALTER TABLE t ADD COLUMN status text GENERATED ALWAYS AS (doc->>'status') STORED; CREATE INDEX ...; -- PG18+: STORED must be explicit (default flipped to VIRTUAL — not indexable),Stuffing relational data into one JSON blob; relying on the pre-PG18 STORED default,Plan uses the GIN/generated-column index,MEDIUM

package/dist/agent-src/skills/design-review/SKILL.md

@@ -44,7 +44,7 @@ A **live preview URL** is required for testing.
 
 ## Procedure: Design review
 
-1. **Inspect the PR and preview** — Read the PR description, diff, and identify changed components/pages; capture a baseline screenshot of the preview URL.
+1. **Inspect the PR and preview** — Read the PR description, diff, and identify changed components/pages; read the probe artifact and run the appearance floor over the preview URL (Phase 0).
 2. **Walk the interactions** — Run Phase 1; cover hover/focus/active/disabled, keyboard, loading, and form error states.
 3. **Cover responsiveness, polish, a11y, robustness** — Run Phases 2–5 in order; record findings per phase.
 4. **Audit code-health and content** — Run Phases 6–7; check tokens, dead styles, copy, console warnings.
@@ -55,7 +55,11 @@ A **live preview URL** is required for testing.
 - Read PR description and git diff.
 - Identify changed components and affected pages.
 - Navigate to preview URL.
-- Take baseline screenshot.
+- **Read the probe artifact** `agents/runtime/state/ui-conformance.json`
+  (`ui_conformance_probe --target <file> --reference <file>`) — its per-dimension counters are the
+  behavioral evidence Phases 1–2 report against. Absent is absent, never clean; a dimension the host
+  could not exercise carries a not-applicable row with its reason rather than a zero.
+- **Run the appearance floor** (§ Appearance verification) — mandatory on every review.
 
 ### Phase 1: Interaction
 
@@ -102,7 +106,9 @@ asserted floor outside the measured set is an assertion nobody checks; 375px
 passing says nothing about 320px, which is where a two-column grid or a fixed
 `min-width` actually breaks.
 
-- Take screenshots at each viewport.
+- **Read the probe artifact's `viewport_matrix` rows** — one per declared width, recording whether the
+  layout property that should change at that breakpoint did. A not-applicable row is missing evidence, not a pass.
+- **Run the appearance floor** (§ Appearance verification) at every one of the four widths.
 - **Scroll-driven surface** — read the `scroll_evidence` artefact
   ([`references/verification-automation.md`](references/verification-automation.md)
   § Scroll evidence) and report every sample whose asserted `state` and
@@ -156,6 +162,26 @@ passing says nothing about 320px, which is where a two-column grid or a fixed
 - No placeholder text left in production.
 - Check browser console for JavaScript errors or warnings.
 
+## Appearance verification — mandatory, and explicitly appearance-only
+
+```
+APPEARANCE VERIFICATION IS MANDATORY WHEREVER APPEARANCE CAN BE AFFECTED.
+THE PROBE DEMOTES THE IMAGE FROM PRIMARY EVIDENCE — IT DOES NOT MOVE THE FLOOR.
+AN IMAGE IS NEVER EVIDENCE FOR HOVER, FOCUS, KEYBOARD, BREAKPOINT OR JS BEHAVIOR.
+AN UNRUN APPEARANCE CHECK IS REPORTED AS UNRUN, NEVER AS PASSED.
+```
+
+**Trigger — identical to the two capture steps it replaces**, not merely as broad: Phase 0
+unconditionally, Phase 2 once per width. Only what the image is evidence *for* narrowed.
+**Two jobs, and the older one comes first:** (1) presence and sanity — *"presence + sanity
+check that nothing renders broken. Not pixel-perfect regression"* — no blank frame, no
+collapsed or overlapping layout, no missing region, no unstyled flash; **no probe dimension
+covers it**, because a computed style can be correct on a node nobody can see; (2) pixel
+comparison against a baseline where one exists, element-scoped, dynamic content masked. No
+render capability → scope the verdict and say so per the gate at the top of this skill;
+degrading is reported, never a pass. What a clean render does *not* answer:
+[`references/verification-automation.md`](references/verification-automation.md) § Appearance verification.
+
 ## Reviewer posture
 
 **Approval is earned, not assumed. Default to flagging.**
@@ -187,7 +213,7 @@ excessive copy, and redundant UI chrome.
 Load the reference file whose sections the review needs — never all of them by default:
 
 - [`references/review-communication.md`](references/review-communication.md) — Before / After / Why output format · Communication principles · Report structure · Design Review Summary
-- [`references/verification-automation.md`](references/verification-automation.md) — Visual QA with browser automation · Async-verifier pattern (keep the main context clean)
+- [`references/verification-automation.md`](references/verification-automation.md) — Visual QA with browser automation · Async-verifier pattern (keep the main context clean) · Appearance verification (what a clean render does not answer)
 
 ## Output format
 
@@ -234,6 +260,56 @@ THE Q1-Q6 FLOOR SET IS IDENTICAL IN ALL FOUR MODES.
 Do not re-derive any of these fields here. This skill is a declared consumer of
 that object, and the contract's consumer table names it.
 
+## Fidelity proof — the chapter matrix
+
+```
+A 1:1 CLAIM IS PROVEN BY A COMMITTED MATRIX, NEVER BY A GREEN SUITE.
+ONE ROW PER HANDOVER CHAPTER. ONE EVIDENCE KIND PER ROW. NO EMPTY CELL.
+A BEHAVIOR TEST ANSWERS "DOES IT WORK", NOT "DOES IT MATCH".
+```
+
+This discharges [`design-fidelity`](../../rules/design-fidelity.md)'s proof
+clause. It fires when a numbered handover is the spec — chapters like
+`10-datenmodell-api.md` … `46-roadmap-achse-randtage.md`, each an abgegrenzter
+contract. Such a handover is already a checklist; the failure it prevents is
+reading it and never working it as one.
+
+**Build the matrix from the handover's own numbering**, one row per chapter:
+
+| Chapter | Claim it makes | Evidence | Status |
+
+**Evidence is exactly one of four kinds**, and the row names which:
+
+1. **Element-scoped screenshot baseline** — `toHaveScreenshot` on the component,
+   not the page. Built into Playwright via pixelmatch, so no new dependency
+   ([`playwright-testing`](../playwright-testing/SKILL.md)). Mask dynamic
+   content (timestamps, running numbers, ids) or the baseline flakes on data
+   rather than on design.
+2. **`toHaveCSS` assertion on the value the chapter names** — the right kind
+   when the chapter states a token, a spacing step or a color rather than a
+   shape.
+3. **Behavior spec with a sensitivity probe** — legitimate where the chapter
+   describes an interaction. The probe is not optional: neutralise the
+   mechanism, watch the spec go red, restore it. A spec never seen red has
+   unknown sensitivity and is not evidence.
+4. **Explicitly not implemented, with the reason** — a real row, not a gap. An
+   honest `not implemented` is what makes the other three trustworthy.
+
+**The matrix is committed**, not written into a reply. A matrix that lives in a
+chat message dies with the session, which is the difference between a method and
+an artifact — and the whole reason this section exists rather than a paragraph
+telling a reviewer to be thorough.
+
+**The staleness trap.** A new handover version ships and the baselines stay
+pinned to the old one, so every screenshot row passes against a reference nobody
+uses any more. Check the baseline timestamps against the handover's own
+CHANGELOG before reading a green matrix as a pass.
+
+**What the matrix does not do.** It records what was compared, never that the
+comparison was honest — nothing in this tree reads a handover, so a row naming
+evidence nobody took looks exactly like one naming evidence that was. The
+control is that a reviewer can open it.
+
 ## Review independence — two passes, isolated, in this order
 
 ```

package/dist/agent-src/skills/design-review/references/verification-automation.md

@@ -122,3 +122,35 @@ the async verifier above, which captures the fan-out's main win without spinning
 up four separate views. Reconsider only when `design-review` runs as a standalone
 heavy batch over many *independent* surfaces, where per-surface
 `do-in-parallel` genuinely pays.
+
+## Appearance verification — what a clean render does not answer
+
+The skill body carries the floor: appearance verification is mandatory wherever
+appearance can be affected, its trigger is identical to the two capture steps it
+replaces, and presence-and-sanity comes before pixel comparison. This section is
+the part a reviewer looks up rather than obeys — the division of labour between a
+render and the probe's four dimensions.
+
+A render is a resting frame. It can only show what the surface looks like with
+nothing driving it, which is why a clean one says nothing about:
+
+| The question | Why the render cannot answer it | What does |
+|---|---|---|
+| Does hover / focus / active feedback exist? | the state is never entered | `interaction` |
+| Does the keyboard reach it, and does the handler fire? | no input is delivered | `interaction` |
+| Did the breakpoint change the layout, or did the media query silently not fire? | the same picture comes back either way | `viewport_matrix` |
+| Is the resolved value the token intended, after cascade and fallback? | a wrong value can look plausible | `computed_style` |
+| Is `prefers-reduced-motion` honoured, and with *what* instead? | the preference is never emulated | `media_emulation` |
+
+Reading a clean render as though it covered a row of this table is the
+substitution the appearance-only marking exists to prevent, and it is the reason
+the floor lists its two jobs separately rather than as one "visual check": the
+first job is the one no probe dimension replaces, and the second is the one the
+probe supersedes for behavior.
+
+**The converse holds and is the less obvious half.** No probe dimension covers
+presence and sanity. A `computed_style` row can be green on a node that is
+off-screen, transparent, zero-height or painted under an overlay — correct
+resolved values on something nobody can see. That asymmetry is why demoting the
+image from *primary evidence* is not the same as removing it, and why an unrun
+appearance check is reported as unrun rather than folded into a probe verdict.

package/dist/agent-src/skills/existing-ui-audit/SKILL.md

@@ -97,6 +97,14 @@ nobody can test is how the previous mismatch happened.
 It reads zero in a JavaScript tree by construction, which is not the same as
 unused.
 
+### 1b. Detect the component-granularity taxonomy the project already chose
+
+```bash
+npx tsx scripts/work_engine/taxonomy/detect.ts   # or import detect_component_taxonomy(root)
+```
+
+Returns the project's **own** tier names joined with `/` — `atoms/molecules/organisms`, `primitives/patterns/features`, whatever it actually uses — or `none`. Record it as `state.ui_audit.component_taxonomy`, with `state.ui_audit.component_root` for where the components live. `none` is a real answer, and leaves every downstream step behaving exactly as it did before this detection existed. Never write a taxonomy the project does not evidence, and never "tidy" a layout into one — this step *finds* the project's structure, it never supplies one. Detection rules, the declared-beats-inferred precedence and the two collision floors: [`references/component-taxonomy-detection.md`](references/component-taxonomy-detection.md).
+
 ### 2. Identify the design system
 
 Detect markers, in order. **Stop at the first match** — projects rarely run more than one design system.
@@ -163,10 +171,20 @@ Read `components.json` for the registered style + base color, then read the `pac
 ### 4b. Prefer a live Storybook read over the hand-read inventory — when one is running
 
 When the project carries `@storybook/addon-mcp` **and** a Storybook is running, query it
-instead of reading files: `list-all-documentation` for the inventory, then `get-documentation`
-for the components that matter. **The live read wins; the hand-read inventory of step 4 is the
-fallback and is never removed** — an agent that cannot reach a running Storybook must still be
-able to inventory the library. The channel disappearing is normal, not an error.
+instead of reading files: `docs-list` for the inventory, then `docs-show` for the components
+that matter. **The live read wins; the hand-read inventory of step 4 is the fallback and is
+never removed** — an agent that cannot reach a running Storybook must still be able to
+inventory the library. The channel disappearing is normal, not an error.
+
+**The names are version-bound, and these are the current ones.** Own derivation, from a
+throwaway `npm install` on 2026-09-13, not from any document: at `@storybook/addon-mcp@10.6.0`
+the docs tools are registered by `storybook`'s own `createDocsToolset` under the method ids
+`docs.list` / `docs.show` / `docs.showStory`, and `toMcpToolName` renders those as `docs-list`,
+`docs-show` and `docs-show-story`. The older `list-all-documentation` / `get-documentation` were
+the literal names at `@storybook/addon-mcp@0.7.0` (via `@storybook/mcp@0.8.0`); at 10.6.0 they
+survive only as the tools' human-readable **titles**. There is no 10.5.x of the addon — it goes
+0.7.0 → 10.6.0 — so a project on the current scaffold gets the `docs-*` names. If a live
+`tools/list` disagrees, the live read wins over this paragraph.
 
 **React-only while the toolset is in preview.** Storybook's own MCP FAQ (docs **10.5**,
 `docs/ai/mcp/overview` § FAQ) states the documentation toolset supports React only during
@@ -261,6 +279,9 @@ then set `state.ui_audit.greenfield = true` and emit a halt:
 >    before building (recommended for projects with >1 planned screen)
 > 2. Proceed bare with Tailwind defaults (recommended for one-off prototypes)
 > 3. Point me at an external design-system reference (URL or file)
+> 4. Scaffold + a granularity convention — as 1, and new components go into
+>    named granularity folders you pick the names for; rename or drop it later
+>    and nothing here objects
 
 **Recommendation: 1 — Scaffold tokens + primitives** — even one extra screen
 benefits from a shared base; the scaffold cost is ~10 min and saves
@@ -268,7 +289,9 @@ re-doing every primitive on screen 2. Caveat: flip to 2 if this is a
 demo or single-page prototype that will not grow.
 ```
 
-Record the user's pick in `state.ui_audit.greenfield_decision` (`scaffold` | `bare` | `external_reference`). Re-running the skill on the same state-file with `greenfield_decision` set is a no-op for the halt (audit findings stay).
+Option 4 is an **offer**, and the only one made anywhere: a project that already exists is never asked (§ 1b reads what it chose), and a greenfield project picking any other number has declined terminally, because the halt is a no-op once any decision is recorded. It stays one more number in the same block rather than a second question — a single number still answers it, which is what the reply-shape rule requires.
+
+Record the user's pick in `state.ui_audit.greenfield_decision` (`scaffold` | `bare` | `external_reference` | `granularity_convention`). Re-running the skill on the same state-file with `greenfield_decision` set is a no-op for the halt (audit findings stay). `granularity_convention` takes the same scaffold path as `scaffold` — it adds the convention, it does not replace the scaffolding.
 
 ### 8. (Optional) Capture an a11y baseline
 
@@ -322,6 +345,7 @@ violations will surface as new findings on every run.
 Load on demand once the audit needs the pitfall catalog:
 
 - [`references/anti-slop-cross-reference.md`](references/anti-slop-cross-reference.md) — Anti-slop cross-reference
+- [`references/component-taxonomy-detection.md`](references/component-taxonomy-detection.md) — Component-taxonomy detection rules
 
 - [`references/output-and-pitfalls.md`](references/output-and-pitfalls.md) — Output format · Gotcha · Anti-slop cross-reference
 
@@ -334,6 +358,7 @@ Load on demand once the audit needs the pitfall catalog:
 5. **`state.ui_audit.patterns`** — object with forms, tables, modals, empty_states, navigation, data_display arrays
 6. **`state.ui_audit.candidates`** — top-5 similarity matches for the current input (may be empty)
 7. **`state.ui_audit.greenfield`** — boolean; when true, `greenfield_decision` MUST also be set before the dispatcher advances
+7b. **`state.ui_audit.component_taxonomy`** / **`component_root`** — the project's own granularity tiers joined with `/` (or `none`), and where the components live relative to the project root. Never a canonical tier list — a project with three tiers records three; `none` is the value that leaves every downstream step unchanged.
 8. **`state.ui_audit.a11y_baseline`** *(optional)* — array of `{rule, selector, severity?}` entries documenting pre-existing a11y violations the review gate should treat as informational. Omit the key entirely when no baseline applies; do not write `[]` for "I checked and there are none" — that disables the gate's filter for every future run.
 
 **Design-system export (current-repo source):** when the goal is to seed

package/dist/agent-src/skills/existing-ui-audit/references/component-taxonomy-detection.md

@@ -0,0 +1,56 @@
+# existing-ui-audit — component-taxonomy detection
+
+> Section-level entry point of the `existing-ui-audit` skill (progressive
+> disclosure). Load this file when § 1b of SKILL.md routes here — it carries
+> the detection rules and the boundary the step must not cross.
+
+## What the detector answers
+
+The question is *"has this project already chosen a way to organize its
+components by granularity, and if so what does it call the tiers?"* — never
+*"which taxonomy should this project use?"*. The recorded value is the
+project's **own** tier directory names, in the project's own order, joined
+with `/`, or `none`. Nothing canonical is ever written: a project with three
+tiers records three, and a project whose tiers are called
+`primitives / patterns / features` records exactly that.
+
+## Three properties, each pinned by a test
+
+- **Declared outranks inferred.** A `## Component taxonomy` section in the
+  consumer project's own `DESIGN.md`, at its root or under `docs/`, listing
+  backticked directory names as list items wins, provided at least two of
+  those directories exist
+  under the component root. The name may be bolded — `- **\`atoms\`** — ...`
+  is read exactly like `` - `atoms` — ... ``. Grounding the declaration against
+  the tree keeps a stale doc from declaring a taxonomy the tree does not have,
+  and a backticked name in prose rather than in a list item is a mention, not a
+  declaration. This is how a project whose tiers appear in no vocabulary the
+  detector knows still gets conformance. The first doc that *qualifies* wins:
+  one with no section, or one naming fewer than two tiers that exist on disk,
+  falls through to the next.
+
+- **A folder that merely sounds like a tier is a collision, not a convention.**
+  `components/{checkout,billing,molecules}` records `none`, and so does the
+  ordinary kind split `components/{layout,pages,forms}` — `layout`, `page`,
+  `block`, `element`, `part` and `cell` are all everyday folder names as well
+  as granularity words. Inference needs at least two tier-shaped buckets **and**
+  more than two thirds of the weighed ones; support folders (`hooks`, `utils`,
+  `types`, `lib`, `styles`, …) are left out of the denominator, so three
+  ordinary siblings cannot hide a taxonomy that is really there. Each floor has
+  its own fixture, because at one hit in three buckets either floor alone would
+  still refuse and neither would be tested.
+
+- **`none` is a real answer, not a failure.** A flat tree, an unreadable tree,
+  a missing component folder, a permission error: all record `none`, and every
+  downstream step then behaves exactly as it did before this detection
+  existed. Detection never throws — degrading to `none` is the safe direction,
+  because `none` is precisely the value that leaves the project's own
+  structures untouched.
+
+## The boundary
+
+Never write a taxonomy the project does not evidence, and never "tidy" an
+existing layout into one. Holding to the project's own structures is the
+standing rule; this step exists to *find* that structure, not to supply one.
+The single place a taxonomy is ever *offered* is the greenfield halt in § 7,
+and a decline there is terminal.

package/dist/agent-src/skills/experiment-loop/SKILL.md

@@ -91,7 +91,37 @@ twice, leaving the branch one iteration ahead of its own record.
 1. **The register path**, and the iteration count actually run against the bound.
 2. **A metric line**: baseline → final, and the number of keeps versus reverts.
 3. **The exit condition that fired**, named — bound reached, or exit signal.
-4. **Every reverted iteration listed** with its reason. A revert is a result the
+4. **A `run_terminal` value** — the exit in the vocabulary every other loop in
+   this tree reports in, so a reader can count this run's stop alongside the
+   continuation hook's and the self-fix lanes' without a per-surface
+   translation table.
+
+   | exit condition | `run_terminal` |
+   |---|---|
+   | `score >= target` — the run had a destination and reached it | `success` |
+   | `iterations_run >= max_iterations` — the declared bound | `exhausted` |
+   | `consecutive_reverts >= N` — the exit signal fired | `stagnated` |
+   | the evaluator was red on the unchanged tree, so no iteration ran | `clean-no-op` |
+   | the run stopped on a missing precondition (metric unreadable, verifier absent) | `blocked` |
+
+   The value set is `RunTerminalState` — `success`, `clean-no-op`, `blocked`,
+   `approval-required`, `exhausted`, `stagnated`, `premise-invalidated` —
+   declared once at `src/scripts/_lib/outcome_vocabularies.ts`
+   (`RUN_TERMINAL_STATES`) and described in
+   [`terminal-states`](../../agent-src/contexts/execution/terminal-states.md).
+   A new exit condition maps onto an existing member or it is not a terminal
+   state; never invent a value here.
+
+   `exhausted` and `stagnated` stay distinct on purpose. This skill's own pivot
+   ladder already treats them differently — a spent bound may deserve a larger
+   one, while consecutive reverts mean the hypothesis class is done and route to
+   the ladder instead. Reporting both as "stopped" throws away the part that
+   decides what happens next.
+
+   Reaching the bound is a normal exit, not a failure, and `exhausted` does not
+   say otherwise — it says where the run stopped, never whether it was worth
+   running. A published null is still a result.
+5. **Every reverted iteration listed** with its reason. A revert is a result the
    next run needs, not noise to summarise away.
 
 ## Gotcha

package/dist/agent-src/skills/markitdown/SKILL.md

@@ -1,6 +1,10 @@
 ---
 model_tier: medium
 name: markitdown
+inputs:
+  - name: source
+    type: string
+    description: "URI of the document to convert — file:, https: or data: (http: is refused). Absent means the skill is being read for its scheme discipline rather than invoked."
 description: "Convert PDF, DOCX, XLSX, PPTX, EPUB, images, or audio to Markdown via the markitdown-mcp server — 'extract this PDF', 'OCR this image', 'transcribe this audio'."
 status: active
 tier: senior

package/dist/agent-src/skills/playwright-testing/SKILL.md

@@ -144,22 +144,46 @@ test('homepage visual regression', async ({ page }) => {
 
 ## Viewport testing
 
+A viewport loop whose only assertion is an image proves that the page rendered,
+not that the breakpoint did anything: the same picture comes back whether the
+media query fired or silently did not. Assert the layout property the breakpoint
+is supposed to change, then keep the capture and name it for the one thing it
+proves.
+
 ```ts
 test.describe('Responsive design', () => {
   for (const viewport of [
-    { width: 1440, height: 900, name: 'desktop' },
-    { width: 768, height: 1024, name: 'tablet' },
-    { width: 375, height: 812, name: 'mobile' },
+    { width: 1440, height: 900, name: 'desktop', columns: '1fr 1fr 1fr' },
+    { width: 768, height: 1024, name: 'tablet', columns: '1fr 1fr' },
+    { width: 375, height: 812, name: 'mobile', columns: '1fr' },
   ]) {
-    test(`renders correctly on ${viewport.name}`, async ({ page }) => {
-      await page.setViewportSize(viewport)
+    test(`lays out correctly on ${viewport.name}`, async ({ page }) => {
+      await page.setViewportSize({ width: viewport.width, height: viewport.height })
       await page.goto('/')
-      await expect(page).toHaveScreenshot(`home-${viewport.name}.png`)
+      // Behaviour: the declared breakpoint actually changed the layout.
+      await expect(page.locator('#grid')).toHaveCSS('grid-template-columns', viewport.columns)
+      // Appearance only: presence + sanity that nothing renders broken.
+      await expect(page).toHaveScreenshot(`appearance-${viewport.name}.png`)
     })
   }
 })
 ```
 
+**Read the probe artifact rather than re-deriving the matrix by hand.**
+`agents/runtime/state/ui-conformance.json` — produced by
+`ui_conformance_probe --target <file> --reference <file>` — carries a
+`viewport_matrix` row per declared width, plus a not-applicable row with its
+reason wherever the host could not cross the breakpoint. A width with no row is
+missing evidence, not a pass, and no dimension reads zero findings because it did
+not run.
+
+**The capture above is appearance-only, and it stays mandatory.** It proves
+presence and sanity — the surface rendered and nothing renders obviously broken —
+and proves nothing about hover, focus, keyboard or a media-preference branch.
+Demoting it from behavioral evidence does not narrow when it runs: it still runs
+at every width in the matrix. Floor and division of labour:
+[`design-review`](../design-review/SKILL.md) § Appearance verification.
+
 ## Debugging
 
 ```bash

package/dist/agent-src/skills/roadmap-writing/SKILL.md

@@ -191,7 +191,7 @@ the owner can decide in one sitting: one option named and why, what the delay
 costs, a command or path per option rather than prose, and an offer to walk
 them through it. Ratcheted by `lint_roadmap_blockers`. Full shape:
 [`templates/roadmaps.md` rule 20](../../agent-src/templates/roadmaps.md).
-Omit it entirely when there is no such gate; run the § 4c gate-test first.
+Omit it entirely when there is no such gate; run the § 4c gate-test first. A **hold** is the publication-side twin — a blocker stops execution, a hold stops publication; ask once whether an intermediate tree state must stay unpublished (default **no**; roadmap incompleteness never is one), walk `re-sequence → guard → hold`, and record the avoided outcome as well as the taken one, per [`templates/roadmaps.md` rule 28](../../agent-src/templates/roadmaps.md) and the § 5c self-check in [`/roadmap:create`](../../domains/product-basic/roadmap/create/command.md).
 
 ### 5c. Risk review (Gate R1) — after draft, before save
 

package/dist/agent-src/skills/storybook-workshop/SKILL.md

@@ -52,6 +52,43 @@ single prop's effect because every value is co-present. Split it, one axis per s
 Stories render under the **same semantic tokens** as the app and the `.dark` class; a
 hardcoded preview theme makes the workshop lie about what the component looks like in place.
 
+### The five behavioral stories — assert a value, never an image
+
+`Hover`, `Focus`, `Active`, `Keyboard` and `ReducedMotion` join the set above, and they
+carry one extra rule: **each asserts a resolved computed style or a handler effect, never a
+screenshot.** A component that owes a state checklist and proves it with a pixel diff has
+not proved it — a screenshot is a resting frame, and none of these five is a resting frame.
+
+| Story | Drive | Assert |
+|---|---|---|
+| `Hover` | `userEvent.hover(el)` | the resolved property the hover rule is supposed to change actually changed |
+| `Focus` | focus the element | the `:focus` styles resolve as intended |
+| `Keyboard` | `userEvent.tab()` until the element is active | a visible `:focus-visible` indicator resolves — programmatic focus does **not** set it in Chromium, so a `.focus()` call reports a real focus ring as absent |
+| `Active` | press and hold | what pressing adds **on top of hover** — a pointer cannot press without hovering, so asserting against the resting style makes one removed hover rule fail two stories |
+| `ReducedMotion` | emulate `prefers-reduced-motion: reduce` | what the surface presents *instead of* the motion, per [`accessibility-auditor`](../accessibility-auditor/SKILL.md) § 2 — not that the media block exists |
+
+The `Active` and `Keyboard` rows are not style advice. Both are measured failure modes from
+building the probe that backs this set, recorded here so the next author does not rediscover
+them: the first produced a duplicate finding for a single defect, the second reports a focus
+ring that is present as missing.
+
+### Responsive rows — one row per declared breakpoint
+
+Beside the state stories, each responsive component owes a row per declared breakpoint
+(1440 / 768 / 375 / 320) asserting **the layout property that is supposed to change there** —
+`flex-direction`, `grid-template-columns`, `display`. One row per breakpoint, not one per
+property: a single media rule usually moves several properties at once, and one finding each
+counts one defect several times.
+
+**Where a workshop is absent, this set is still assertable.** These stories are a contract
+about what is asserted, not about a particular runner — the `ui_conformance_probe` script
+exercises the same five states and the same breakpoint rows against a file URL. It and its
+sensitivity fixture live in the package repository and are **not** shipped to consumers,
+which is why both are named rather than linked: a path to either resolves nowhere in an
+install. The fixture is the evidence for the two sensitivity claims above — removing one
+hover rule turns exactly the hover assertion red and nothing else, and removing one media
+rule turns exactly the matching breakpoint row red.
+
 ## JSDoc `@summary` is required, and the reason is mechanical
 
 The manifest an agent reads **truncates descriptions**. A component whose summary is a
@@ -81,7 +118,7 @@ files otherwise — and only then decide whether anything needs writing.
 1. **Inspect the existing story set before authoring anything.** Read what the library
    already has — via the MCP channel below when it is available, otherwise by reading the
    story files — and check the component against it by name and by shape.
-   - **Source of truth:** the story files, or `list-all-documentation` over a running Storybook.
+   - **Source of truth:** the story files, or `docs-list` over a running Storybook.
    - **Verify:** the component you are about to write does not already exist under another name.
 2. **One story per concept**, named from the state set above.
    - **Verify:** no story name joins two axes with `And`.
@@ -142,10 +179,12 @@ up yet"*, so its presence is not evidence the channel works.
 
 When the project has `@storybook/addon-mcp` **and** a running Storybook,
 [`existing-ui-audit`](../existing-ui-audit/SKILL.md) prefers the live tools —
-`list-all-documentation`, then `get-documentation` for the components that matter — over the
+`docs-list`, then `docs-show` for the components that matter — over the
 hand-read inventory. **The live read wins; the file read is the fallback**, and the fallback
 is never removed: an agent that cannot reach a running Storybook must still be able to
-inventory the library.
+inventory the library. The tool names are version-bound and were re-derived from a throwaway
+installation on 2026-09-13 — [`existing-ui-audit`](../existing-ui-audit/SKILL.md) § 4b carries
+the derivation and the version boundary; do not restate it here.
 
 **React-only while in preview.** Storybook's own MCP FAQ (docs 10.5) states the documentation
 toolset supports React only during preview, so Vue, Angular, and Web Components take the

package/dist/agent-src/skills/threat-modeling/SKILL.md

@@ -25,8 +25,8 @@ triggers:
 > "<surface description>"` returns the surface class, ATT&CK/CWE-cited
 > threats, required controls, and negative tests, with confidence +
 > evidence-gap. Propose grounded findings; the human confirms. Corpus:
-> [`data/threats.csv`](data/threats.csv) (MITRE ATT&CK v16 / OWASP
-> ASVS-derived, owner + cadence in the manifest).
+> [`data/threats.csv`](data/threats.csv) (MITRE ATT&CK v19.x / OWASP
+> ASVS 5.0.0-derived, owner + cadence in the manifest).
 
 > You are a reviewer specialized in **pre-implementation threat analysis**.
 > Your only job is to produce a compact threat model for a planned change —
@@ -215,8 +215,13 @@ run tests**.
   *Threat Modeling: Designing for Security* (2014). Framing basis for the
   Actors / Assets / Entry Points / Trust Boundaries / Abuse Cases rubric.
   [learn.microsoft.com/en-us/security/engineering/threat-modeling-tool-threats](https://learn.microsoft.com/en-us/security/engineering/threat-modeling-tool-threats)
-- **OWASP ASVS v4.0.3** — Authorization (V4), Validation & Encoding (V5),
-  Session Management (V3) — default baseline for "Missing control" entries.
+- **OWASP ASVS v5.0.0** — Authorization (V8), Encoding and Sanitization (V1)
+  + Validation and Business Logic (V2), Session Management (V7) — default
+  baseline for "Missing control" entries. Renumbered from 4.0.3's V4/V5/V3
+  per the standard's own 4.0→5.0 migration guide (`5.0/en/0x05-For-Users-Of-4.0.md`
+  in the ASVS repo) — 5.0.0 splits the old V5 Validation/Sanitization/Encoding
+  chapter into separate Encoding-and-Sanitization and Validation-and-Business-Logic
+  chapters, and drops direct CWE/NIST cross-mappings from the requirements.
   [owasp.org/www-project-application-security-verification-standard/](https://owasp.org/www-project-application-security-verification-standard/)
 - **OWASP Top 10 2021** — A01 Broken Access Control, A04 Insecure Design,
   A05 Security Misconfiguration — cross-reference when naming abuse cases.

package/dist/agent-src/skills/threat-modeling/data/manifest.json

@@ -76,8 +76,8 @@
   "owner": "package-maintainer",
   "refresh_cadence": "quarterly",
   "upstream": {
-    "repo": "derived: MITRE ATT&CK + CWE + OWASP API Top 10 / ASVS 4.0",
-    "sha": "ATT&CK v16 / ASVS 4.0.3",
-    "last_checked": "2026-06-07"
+    "repo": "derived: MITRE ATT&CK + CWE + OWASP API Top 10 / ASVS 5.0",
+    "sha": "re-derived 2026-09-27 against ATT&CK v19.x and ASVS 5.0.0: every ATT&CK id cited in threats.csv's Source Refs column (T1110, T1563, T1105, T1090, T1499, T1552, T1552.001, T1190, T1078.004) resolves in the current Enterprise matrix and none is deprecated or revoked \u2014 threats.csv itself carries no ASVS identifiers, so there is nothing to remap there. SKILL.md's References section cited ASVS 4.0.3's V3/V4/V5 by the old numbering; updated to 5.0.0's V7 Session Management, V8 Authorization, and V1 Encoding and Sanitization + V2 Validation and Business Logic, per the standard's own 4.0\u21925.0 migration guide",
+    "last_checked": "2026-09-18"
   }
-}
+}

package/dist/agent-src/skills/ui-component-architect/SKILL.md

@@ -69,6 +69,29 @@ still exists in the tree. Absent or empty → fall through to
 Then review existing components in the codebase for the same
 responsibility — extend rather than rebuild when a match is found.
 
+**Read `state.ui_audit.component_taxonomy` before you decide where the
+component goes.** The audit (§ 1b of
+[`existing-ui-audit`](../existing-ui-audit/SKILL.md)) records the project's
+**own** granularity tiers, joined with `/`, or `none`:
+
+- **It names tiers** → record the chosen tier on the component's
+  `state.ui_design.components[]` entry as `tier` (the apply step reads that
+  field and nothing else writes it), then place the component inside it and say
+  which:
+  *"conforming to the project's `primitives/patterns/features` taxonomy —
+  `Checkout` goes under `src/components/features/`"*. Match the tier by name;
+  there is no rule here that computes a tier, and there must not be one.
+- **A component fits no tier** → report it as a named conformance gap with the
+  reason, and leave it unplaced. Do not put it somewhere else quietly, and do
+  not invent a tier for it — picking one would need exactly the per-tier rule
+  the measurement below shows is not derivable.
+- **`none`** → behave exactly as you would without this paragraph. A project
+  that organizes its components some other way must not be able to tell that
+  this step exists. Never propose a taxonomy to a project that has one you did
+  not recognise, and never propose one mid-task to a project that has none —
+  the single offer is made once, at the greenfield halt, and a decline there is
+  terminal.
+
 **A new component's workshop is part of its design where the project has one —
 size-conditional, never a generic mandate.** The boundary is
 [`component-oriented-and-oop-development`](../../guidelines/component-oriented-and-oop-development.md)