@event4u/agent-config 2.25.0 → 3.0.0

package/.agent-src/skills/aws-infrastructure/SKILL.md

@@ -3,6 +3,18 @@ name: aws-infrastructure
 description: "Use when working with AWS resources — ECS Fargate, ECR, EFS, Secrets Manager, gomplate templates, multi-env deployments — even when the user says 'deploy to staging' without naming AWS."
 source: package
 domain: devops
+workspaces:
+  - engineering
+packs:
+  - engineering-base
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # aws-infrastructure

package/.agent-src/skills/blade-ui/SKILL.md

@@ -3,6 +3,18 @@ name: blade-ui
 description: "Use when the project's frontend stack is Blade — dispatched by `directives/ui/{apply,review,polish}.py`. Covers views, components, partials, layouts, and view logic."
 source: package
 domain: engineering
+workspaces:
+  - engineering
+packs:
+  - laravel
+lifecycle: active
+trust:
+  level: professional
+  confidence: high
+  human_review_required: false
+install:
+  default: false
+  removable: true
 ---
 
 # blade-ui

package/.agent-src/skills/blast-radius-analyzer/SKILL.md

@@ -5,6 +5,18 @@ personas:
   - backend-architect
 source: package
 domain: discovery
+workspaces:
+  - engineering
+packs:
+  - engineering-base
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # blast-radius-analyzer

package/.agent-src/skills/bug-analyzer/SKILL.md

@@ -4,6 +4,18 @@ description: "Use when the user shares a Sentry error, Jira bug ticket, or error
 source: package
 domain: discovery
 council_depth: deep
+workspaces:
+  - engineering
+packs:
+  - engineering-base
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # bug-analyzer
@@ -84,7 +96,7 @@ Gather all available evidence before forming any hypothesis:
 - **Stacktrace** → start from top frame (crash site), trace down to entry point.
 - Use `codebase-retrieval` to find the relevant code.
 - Read each file in the call chain to understand the data flow.
-- Check existing context docs (`agents/contexts/`) for the affected area.
+- Check existing context docs (`agents/settings/contexts/`) for the affected area.
 - **Consult engineering memory.** Via
   [`memory-access`](../../../docs/guidelines/agent-infra/memory-access.md) call
   `retrieve(types=["historical-patterns", "incident-learnings"],
@@ -201,7 +213,7 @@ For each bug found: **Bug** → **Location** → **Severity** → **Root Cause**
 
 Read `AGENTS.md` and `./agents/` for project-specific architecture, business rules, and domain docs.
 Detect the project from the repo name (see `rules/architecture.md`).
-Check for existing contexts in `agents/contexts/` or module `agents/contexts/`.
+Check for existing contexts in `agents/settings/contexts/` or module `agents/settings/contexts/`.
 
 
 ## Adversarial review

package/.agent-src/skills/build-buy-partner/SKILL.md

@@ -6,6 +6,18 @@ tier: senior
 source: package
 domain: process
 context_spine: [org-stage, product, customer-segment]
+workspaces:
+  - founder
+packs:
+  - founder-strategy
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: true
 ---
 
 # build-buy-partner

package/.agent-src/skills/canvas-design/SKILL.md

@@ -3,6 +3,18 @@ name: canvas-design
 description: "Use when creating static visual art — posters, marketing visuals, brand assets, PDF/PNG design pieces — even if the user just says 'design a poster' or 'mach uns ein Visual'."
 source: package
 domain: product
+workspaces:
+  - small-business
+packs:
+  - ai-video
+lifecycle: experimental
+trust:
+  level: experimental
+  confidence: high
+  human_review_required: false
+install:
+  default: false
+  removable: true
 ---
 
 # canvas-design

package/.agent-src/skills/character-consistency/SKILL.md

@@ -5,12 +5,24 @@ personas:
   - hollywood-director
 source: package
 domain: product
+workspaces:
+  - small-business
+packs:
+  - ai-video
+lifecycle: experimental
+trust:
+  level: experimental
+  confidence: high
+  human_review_required: false
+install:
+  default: false
+  removable: true
 ---
 
 # character-consistency
 
 > Lock a character's visual identity into
-> `agents/ai-video/<project>/characters/<id>.json` so every scene
+> `agents/reference/ai-video/<project>/characters/<id>.json` so every scene
 > reuses the **exact same tokens** verbatim. Downstream skills
 > ([`video-director`](../video-director/SKILL.md),
 > [`pixar-storyteller`](../pixar-storyteller/SKILL.md),
@@ -37,7 +49,7 @@ Do NOT use when:
 
 ### Step 0: Inspect
 
-1. Check `agents/ai-video/<project>/characters/` — if a lock already
+1. Check `agents/reference/ai-video/<project>/characters/` — if a lock already
    exists for this id, **read it, do not redraft**. Edits require an
    explicit revision note (Phase 6 visual regression must rerun).
 2. Confirm the character will appear in ≥ 2 scenes; one-shot → skip.
@@ -45,7 +57,7 @@ Do NOT use when:
 ### Step 1: Draft identity tokens
 
 Emit a JSON file at
-`agents/ai-video/<project>/characters/<character-id>.json` with the
+`agents/reference/ai-video/<project>/characters/<character-id>.json` with the
 following fields. Every field is mandatory; missing field → fail
 the lock.
 
@@ -70,7 +82,7 @@ the lock.
 
 1. After the first scene renders, copy the highest-quality frame
    showing the character full-face and full-body to
-   `agents/ai-video/<project>/characters/<id>.ref.png`.
+   `agents/reference/ai-video/<project>/characters/<id>.ref.png`.
 2. Update `reference_frame` in the JSON to point at it.
 3. Phase 6 visual regression compares every subsequent scene's
    character frame against this reference (ImageMagick `compare`
@@ -86,11 +98,11 @@ the lock.
 
 ## Output format
 
-1. **`agents/ai-video/<project>/characters/<id>.json`** — locked
+1. **`agents/reference/ai-video/<project>/characters/<id>.json`** — locked
    identity tokens, schema above.
-2. **`agents/ai-video/<project>/characters/<id>.ref.png`** —
+2. **`agents/reference/ai-video/<project>/characters/<id>.ref.png`** —
    reference frame (added after first render).
-3. **`agents/ai-video/<project>/characters/CHANGELOG.md`** — one
+3. **`agents/reference/ai-video/<project>/characters/CHANGELOG.md`** — one
    line per revision: `v<n> · YYYY-MM-DD · reason · scenes-to-rerun`.
 
 ## Gotcha
@@ -122,10 +134,10 @@ the lock.
 
 When a character lock would identify or render a real person, consult before emitting the JSON:
 
-- [`agents/policies/media/likeness.md`](../../../agents/policies/media/likeness.md) — real-person identity tokens require a cited likeness release.
-- [`agents/policies/media/public-figures.md`](../../../agents/policies/media/public-figures.md) — recognised public figures carry the harder gate (publicity rights + transformative-intent).
-- [`agents/policies/media/voice-cloning.md`](../../../agents/policies/media/voice-cloning.md) — when `voice_note` references a real person's voice.
-- [`agents/policies/media/disclosure.md`](../../../agents/policies/media/disclosure.md) — outputs carrying a real-person lock require the non-removable AI-generation disclosure downstream.
+- [`agents/settings/policies/media/likeness.md`](../../../agents/settings/policies/media/likeness.md) — real-person identity tokens require a cited likeness release.
+- [`agents/settings/policies/media/public-figures.md`](../../../agents/settings/policies/media/public-figures.md) — recognised public figures carry the harder gate (publicity rights + transformative-intent).
+- [`agents/settings/policies/media/voice-cloning.md`](../../../agents/settings/policies/media/voice-cloning.md) — when `voice_note` references a real person's voice.
+- [`agents/settings/policies/media/disclosure.md`](../../../agents/settings/policies/media/disclosure.md) — outputs carrying a real-person lock require the non-removable AI-generation disclosure downstream.
 
 Refuse-and-surface the file path; do not silently sanitise the prompt.
 

package/.agent-src/skills/check-refs/SKILL.md

@@ -11,6 +11,18 @@ execution:
   command:
     - python3
     - scripts/check_references.py
+workspaces:
+  - agent-config-maintainer
+packs:
+  - meta
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # check-refs

package/.agent-src/skills/churn-prevention/SKILL.md

@@ -6,6 +6,18 @@ tier: senior
 source: package
 domain: product
 context_spine: [product, customer-segment]
+workspaces:
+  - product
+packs:
+  - product-basic
+lifecycle: active
+trust:
+  level: professional
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: true
 ---
 
 # churn-prevention

package/.agent-src/skills/code-refactoring/SKILL.md

@@ -1,8 +1,20 @@
 ---
 name: code-refactoring
-description: "Use when the user says "refactor this", "rename class", or "move method". Safely refactors PHP code — finds all callers, updates downstream dependencies, and verifies with quality tools."
+description: "Use when the user says 'refactor this', 'rename class', or 'move method'. Safely refactors code in any language — finds all callers, updates downstream dependencies, verifies via quality tools."
 source: package
 domain: engineering
+workspaces:
+  - engineering
+packs:
+  - engineering-base
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # refactorer
@@ -19,8 +31,8 @@ Do NOT use when:
 
 ## Before refactoring
 
-1. **Read the agent docs** — check `agents/docs/` and `agents/contexts/` for the area you're refactoring.
-   For modules, also read `app/Modules/{Module}/agents/`. See the `project-docs` skill for the mapping.
+1. **Read the agent docs** — check `agents/reference/docs/` and `agents/settings/contexts/` for the area you're refactoring.
+   For modules, also read the project's module-docs directory (path varies by stack — Laravel: `app/Modules/{Module}/agents/`; Nx: `apps/{app}/docs/`; mono-repo: per-package `docs/`). See the `project-docs` skill for the mapping.
 2. **Understand the scope** — what exactly needs to change and why?
 3. **Find ALL references** — use `codebase-retrieval` and `view` with `search_query_regex` to find every
    caller, implementation, test, and configuration that references the code being changed.
@@ -34,34 +46,35 @@ Do NOT use when:
 - Rename, extract, move, or restructure the target code.
 - Keep the change minimal and focused.
 
-### Step 2: Update all downstream deps
+### Step 2: Update all downstream dependencies
 
 For each affected file (from the impact analysis):
 
 - **Callers**: Update method calls, constructor arguments, imports.
 - **Interfaces / abstract methods**: Update all implementations to match new signatures.
 - **Subclasses**: Update overridden methods.
-- **Type hints / PHPDoc**: Update type references.
+- **Type hints / annotations**: Update type references (PHPDoc, TypeScript types, Python type hints, Go generics, Rust generics).
 - **Config / bindings**: Update service container bindings, route references, etc.
-- **Imports**: Add or update `use` statements.
+- **Imports**: Add or update import statements (`use` for PHP, `import` for JS/TS/Python, `import` blocks for Go, `use` for Rust).
 
-### Step 3: Update API layer (if controllers/endpoints are affected)
+### Step 3: Update API layer (if request handlers / endpoints are affected)
 
-When refactoring touches controllers, requests, resources, or routes:
+When refactoring touches handlers, route registrations, request validators, or response shapers, walk the stack-appropriate boundary. Use the carve-out skill for the project's framework if one exists; otherwise consult the table below for what to check on each stack.
 
-| Component | What to check and update |
+| Layer | What to check and update |
 |---|---|
-| **Controller** | `__invoke()` signature, injected services, return type |
-| **FormRequest** | `authorize()`, `rules()`, validated field names |
-| **Resource** | `toArray()` field mapping, conditional fields, nested resources |
-| **OpenAPI Schema Attributes** | Request schemas (`ShowResourceRequestSchema`, `CreateResourceRequestSchema`, etc.) |
-| **OpenAPI Response Attributes** | Response schemas (`ShowResourceResponseSchema`, `CreateResourceResponseSchema`, etc.) |
-| **OpenAPI Error Attributes** | `ResourceNotFoundResponse`, `ValidationErrorResponse` |
-| **Custom Request Schemas** | Extended schema classes in `app/OpenApi/Schema/Request/v{N}/` |
-| **Route definition** | Route file in `routes/api/v{N}/`, route name, URL path, HTTP method |
-| **Route model binding** | Parameter name in route must match variable name in controller |
-| **Version inheritance** | If v1 extends v2 (or vice versa), check both versions |
-| **Module routes** | Module routes in `app/Modules/*/Routes/api.php` with version prefix |
+| **Route registration** | Route file / decorator / file-based-router entry — name, URL, HTTP method, parameter binding |
+| **Handler / Controller** | Entry signature, injected dependencies, return type |
+| **Request validator** | Validation rule definitions, allowlisted fields (FormRequest, Zod schema, class-validator DTO, Pydantic model, struct tags) |
+| **Response shaper** | Field mapping in the transformer (API Resource, serializer, DTO mapper, response model) |
+| **API contract** | OpenAPI annotations, generated spec, typed client (regenerate if generated) |
+| **Authorization rule** | Policy / voter / guard / middleware / route dependency that protects the route |
+| **Module routes** | Module-local routing surface (Laravel `app/Modules/*/Routes/`, Nx `apps/*/src/routes`, mono-repo per-package routes) |
+
+Carve-out routing:
+- Laravel: [`laravel-api-endpoint`](../laravel-api-endpoint/SKILL.md)
+- Next.js: [`nextjs-patterns`](../nextjs-patterns/SKILL.md)
+- Symfony: [`symfony-workflow`](../symfony-workflow/SKILL.md)
 
 ### Step 4: Update tests — with user approval
 
@@ -89,19 +102,24 @@ When refactoring touches controllers, requests, resources, or routes:
 - Do NOT delete tests — adapt them to the new code structure.
 - Do NOT reduce test coverage — if you split a class, split the test too.
 
-### Step 5: Verify with quality tools
+### Step 5: Verify with the project's quality tools
 
-Run quality tools after each significant step — do NOT batch everything to the end:
+Run the project's type-checker and linter after each significant step — do NOT batch everything to the end. The exact command set depends on the stack; resolve via `quality-tools` skill or the project's `Taskfile.yml` / `package.json scripts` / `composer.json scripts` / `Makefile`.
 
-- Run PHPStan: `vendor/bin/phpstan analyse` (see `quality-tools` skill for detection).
-- If PHPStan finds new errors from the refactoring → fix immediately before continuing.
-- Run Rector + ECS: `vendor/bin/rector process && vendor/bin/ecs check --fix`.
-- Run PHPStan again after Rector (Rector can introduce issues).
+| Stack | Typical pipeline |
+|---|---|
+| Laravel / PHP | `vendor/bin/phpstan analyse` → `vendor/bin/rector process` → `vendor/bin/ecs check --fix` → re-run PHPStan |
+| TypeScript | `tsc --noEmit` → `eslint --fix` → `prettier --write` |
+| Python | `mypy` (or `pyright`) → `ruff check --fix` → `ruff format` |
+| Go | `go vet ./...` → `golangci-lint run --fix` → `gofmt -w` |
+| Rust | `cargo check` → `cargo clippy --fix` → `cargo fmt` |
+
+If auto-fixers can rewrite types (Rector for PHP, `eslint --fix` for TS), re-run the type-checker after them — auto-fixers can introduce new errors.
 
 ### Step 6: Run tests
 
-- Run tests related to the changed code first (`php artisan test --filter=...`).
-- Then run the full test suite (`php artisan test`).
+- Run tests related to the changed code first (`php artisan test --filter=...`, `pnpm test -- <pattern>`, `pytest -k <pattern>`, `go test ./{path}/...`, `cargo test {pattern}`).
+- Then run the full test suite (`php artisan test`, `pnpm test`, `pytest`, `go test ./...`, `cargo test`).
 - All tests must pass before the refactoring is considered complete.
 
 ### Step 7: Update documentation
@@ -110,8 +128,8 @@ After the code changes are verified, update all affected documentation:
 
 | Documentation layer | When to update | Location |
 |---|---|---|
-| **Project docs** | When conventions, patterns, or key files change | `agents/docs/*.md` |
-| **Project contexts** | When architecture or high-level flow changes | `agents/contexts/*.md` |
+| **Project docs** | When conventions, patterns, or key files change | `agents/reference/docs/*.md` |
+| **Project contexts** | When architecture or high-level flow changes | `agents/settings/contexts/*.md` |
 | **Module agent docs** | When module-specific behavior changes | `app/Modules/*/agents/` |
 | **Module Docs/** | When module internals change | `app/Modules/*/Docs/` |
 | **AGENTS.md** | When project-wide conventions change | `AGENTS.md` |
@@ -140,11 +158,11 @@ After the code changes are verified, update all affected documentation:
 
 ### Change API endpoint
 1. Update controller + request + resource + OpenAPI schemas + route → present test changes →
-   update docs (`agents/docs/controller.md`, `agents/docs/api-resources.md`) → run PHPStan → run tests.
+   update docs (`agents/reference/docs/controller.md`, `agents/reference/docs/api-resources.md`) → run PHPStan → run tests.
 
-### Replace impl (e.g. switch service)
-1. Create new impl → update binding → find all direct references → update → present test
-   changes → update docs → run PHPStan → run tests → remove old impl.
+### Replace implementation (e.g. switch service)
+1. Create new implementation → update binding → find all direct references → update → present test
+   changes → update docs → run PHPStan → run tests → remove old implementation.
 
 ### Move/restructure module
 1. Move files → update namespaces → update `ModuleServiceProvider` if needed → update module routes →

package/.agent-src/skills/code-review/SKILL.md

@@ -3,6 +3,18 @@ name: code-review
 description: "Use when the user says "review this", "check my code", or wants feedback on changes. Reviews for correctness, quality, security, and coding standards."
 source: package
 domain: quality
+workspaces:
+  - engineering
+packs:
+  - engineering-base
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # code-review
@@ -37,68 +49,73 @@ Use this skill when:
 
 ## Review checklist
 
+The checks below are stack-agnostic. For framework-specific conventions (PSR-12 + `declare(strict_types=1)`, FormRequest, single-action `__invoke`, API Resources, Pest, Blade escaping, Eloquent N+1) defer to the carve-outs:
+- PHP / Laravel → [`laravel`](../laravel/SKILL.md), [`laravel-validation`](../laravel-validation/SKILL.md), [`eloquent`](../eloquent/SKILL.md), [`pest-testing`](../pest-testing/SKILL.md), [`blade-ui`](../blade-ui/SKILL.md), [`php-coder`](../php-coder/SKILL.md)
+- Symfony → [`symfony-workflow`](../symfony-workflow/SKILL.md)
+- Next.js / TS → [`nextjs-patterns`](../nextjs-patterns/SKILL.md), [`react-shadcn-ui`](../react-shadcn-ui/SKILL.md)
+
 ### Code quality
 
 | Check | What to look for |
 |---|---|
-| **Strict types** | `declare(strict_types=1)` in new files, typed properties/params/returns |
-| **PSR-12** | Coding style, line length ≤120, trailing commas, Yoda comparisons |
-| **Naming** | Clear, descriptive names. `camelCase` vars, `snake_case` array keys, `UPPER_SNAKE` constants |
+| **Type discipline** | New code is fully typed in the project's idiom (PHP typed properties + `declare(strict_types=1)`, TS strict, Python type hints, Go / Rust by construction). |
+| **Style conformance** | Matches the project's formatter / linter output — no reformatting battles, no out-of-band style. |
+| **Naming** | Clear, descriptive names; matches the dominant casing in the surrounding code (camelCase / snake_case / PascalCase per the language's idiom). |
 | **Early returns** | No deep nesting. Guard clauses at the top. |
-| **Single responsibility** | Each class/method does one thing. Controllers are thin. |
-| **No magic** | No magic properties on models (use getters/setters). No `$request->input()` without FormRequest. |
-| **PHPDoc** | Only where type hints are insufficient (generics, complex arrays). No redundant docblocks. |
+| **Single responsibility** | Each class / module / function does one thing. HTTP handlers stay thin. |
+| **No magic** | No reach-through to globals (`app()`, `$_GET`, ambient context). No untyped data shapes leaking out of the I/O boundary. |
+| **Doc comments** | Only where the type system is insufficient (generics, complex shapes). No redundant docblocks. |
 
 ### Architecture
 
 | Check | What to look for |
 |---|---|
-| **Layer separation** | Business logic in services, not controllers. Models have no business logic. |
-| **Single-action controllers** | New controllers use `__invoke()`. No multi-action controllers. |
-| **FormRequest** | Every controller has a dedicated FormRequest. No inline `$request->validate()`. |
-| **API Resources** | Controllers return Resources, never raw models or `response()->json()`. |
-| **DTOs** | Structured data transfer between layers, not raw arrays. |
-| **Dependency injection** | Constructor injection, no `new Service()` or `app()` calls in business logic. |
+| **Layer separation** | Business logic in services / use-cases, not in HTTP handlers. Domain models stay I/O-free. |
+| **Handler shape** | New handlers follow the framework's recommended shape (Laravel single-action `__invoke`, Next.js route handler, Express handler-per-route). See the stack carve-out. |
+| **Input validation** | Validated at the request boundary via the framework's primitive (Laravel `FormRequest`, Zod / class-validator, Pydantic, struct-tag validators). No ad-hoc inline `if` checks. |
+| **Response shaping** | Returns through a transformer / serializer / DTO. Never returns raw ORM entities. |
+| **DTOs / value objects** | Structured data between layers, not raw associative arrays / `any` / `dict[str, Any]`. |
+| **Dependency injection** | Constructor injection (or framework-idiomatic equivalent). No service-locator calls in business logic. |
 
 ### Database & Performance
 
 | Check | What to look for |
 |---|---|
-| **N+1 queries** | Relationship access in loops without eager loading |
-| **Missing indexes** | New columns used in WHERE/JOIN without index |
-| **Unbounded queries** | `Model::all()` or queries without pagination/limit |
-| **Raw SQL** | Parameterized queries only. No string concatenation with user input. |
-| **Migrations** | Reversible (has `down()`). Correct connection. Correct table prefix. |
-| **Money** | Uses `decimal` or `Math` helper, never `float` |
+| **N+1 queries** | Relationship / association access in loops without eager / batch loading. |
+| **Missing indexes** | New columns used in `WHERE` / `JOIN` without a supporting index. |
+| **Unbounded queries** | Full-table reads (`Model::all()`, `SELECT *` without `LIMIT`, unpaged list endpoints). |
+| **Raw SQL** | Parameterised queries only. No string concatenation with user input. |
+| **Migrations** | Reversible. Targets the right connection / schema. Idempotent where the platform supports it. |
+| **Money / precision** | Uses an exact-precision type (PHP `decimal` / `Math` helper, TS bigint / decimal lib, Python `Decimal`), never `float`. |
 
 ### Security
 
 | Check | What to look for |
 |---|---|
-| **Authorization** | Policy check in FormRequest or middleware. No unprotected endpoints. |
-| **Input validation** | All user input validated via FormRequest rules. |
-| **Mass assignment** | No `$model->fill($request->all())` without `$fillable`/`$guarded`. |
-| **SQL injection** | No raw queries with unescaped user input. |
-| **XSS** | Blade output escaped (`{{ }}` not `{!! !!}`) unless intentional. |
-| **Sensitive data** | No secrets, tokens, or passwords in code or logs. |
+| **Authorization** | Authz check at every state-changing endpoint (Laravel Policy, Symfony voter, NestJS guard, framework middleware). No unprotected mutating routes. |
+| **Input validation** | All user input validated at the boundary via the framework's primitive. |
+| **Mass assignment** | No bulk-binding raw request payloads to ORM entities without an explicit allow-list (`$fillable` / `$guarded` in Laravel, DTO mapping in TS / Python). |
+| **Injection** | No raw queries / command lines / template strings with unescaped user input. |
+| **Output encoding** | Template output is escaped by default; raw / unescaped output is intentional and reviewed (Blade `{{ }}` vs `{!! !!}`, React `dangerouslySetInnerHTML`, Jinja `\|safe`). |
+| **Sensitive data** | No secrets, tokens, or passwords in code, logs, or error responses. |
 
 ### Tests
 
 | Check | What to look for |
 |---|---|
-| **Coverage** | New code paths have tests. Bug fixes have regression tests. |
-| **Test quality** | Tests verify behavior, not implementation details. |
-| **Pest syntax** | Correct Pest conventions. No `readonly`/`final` on test classes. |
-| **Seeders** | Test data via seeders (or factories where allowed). |
+| **Coverage** | New code paths have tests. Bug fixes have regression tests (RED → GREEN). |
+| **Test quality** | Tests verify behaviour, not implementation details. |
+| **Framework idiom** | Correct conventions for the project's test framework (Pest / PHPUnit, Jest / Vitest, pytest, `go test`, `cargo test`) — see the stack carve-out for specifics. |
+| **Test data** | Provisioned via the project's idiom (seeders, factories, fixtures, builders). |
 | **Assertions** | Meaningful assertions. Not just "no exception thrown". |
-| **Flaky risks** | Time-dependent tests use `travel()`. No reliance on execution speed. |
+| **Flaky risks** | Time-dependent tests freeze the clock (`travel()`, `jest.useFakeTimers()`, `freezegun`). No reliance on execution speed. |
 
 ## Before creating a PR
 
-1. Run quality pipeline: PHPStan → Rector → ECS → PHPStan (see `quality-tools` skill for commands)
-2. Run tests: `make test` (or project equivalent)
+1. Run the project's quality pipeline (see the stack carve-out for the exact commands — PHP: `quality-tools`).
+2. Run tests via the project's runner (`make test`, `npm test`, `pytest`, `go test ./...`, or the project's wrapper script).
 3. Ensure CI passes on the branch.
-4. Self-review the diff: `git diff origin/main..HEAD`
+4. Self-review the diff: `git diff origin/main..HEAD`.
 
 ## Receiving feedback
 
@@ -114,7 +131,7 @@ When receiving code review feedback, follow this sequence:
 6. **IMPLEMENT** — One item at a time, test each.
 
 If **any item is unclear**, STOP — do not implement anything yet. Items may be related;
-partial understanding → wrong impl.
+partial understanding leads to wrong implementation.
 
 ### No performative agreement
 
@@ -132,7 +149,7 @@ partial understanding → wrong impl.
 **External / Copilot / bot feedback** (less context):
 - Check: Technically correct for THIS codebase?
 - Check: Does it break existing functionality?
-- Check: Is there a reason for the current impl?
+- Check: Is there a reason for the current implementation?
 - Check: Does the reviewer understand the full context?
 - **YAGNI check:** If the reviewer suggests "implementing properly", grep the codebase
   for actual usage. If unused → suggest removing (YAGNI).
@@ -181,7 +198,7 @@ Description and suggested improvement.
 Description.
 ```
 
-Group related findings. Don't repeat what linters/PHPStan already catch — focus on
+Group related findings. Don't repeat what the project's linter / type-checker already catches — focus on
 logic, architecture, and things tools can't detect.
 
 ## Adversarial review
@@ -211,5 +228,5 @@ Focus on the "Code changes / Refactoring" attack questions.
 - Do NOT approve without actually reading the code.
 - Do NOT agree with review comments without verifying them against the codebase.
 - Do NOT use performative language when responding to feedback ("Great point!", "Excellent catch!").
-- Do NOT nitpick style issues that ECS/Rector handle automatically.
+- Do NOT nitpick style issues the project's formatter / auto-refactor (ECS, Prettier, Ruff, gofmt) handles automatically.
 - Do NOT merge without CI passing and quality checks green.

package/.agent-src/skills/command-routing/SKILL.md

@@ -7,6 +7,18 @@ execution:
   type: assisted
   handler: internal
   allowed_tools: []
+workspaces:
+  - agent-config-maintainer
+packs:
+  - meta
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # commands

package/.agent-src/skills/command-writing/SKILL.md

@@ -3,6 +3,18 @@ name: command-writing
 description: "Use when creating or editing a slash command in .agent-src.uncompressed/commands/ — frontmatter, numbered steps, safety gates — even when the user just says 'add a /command for X'."
 source: package
 domain: process
+workspaces:
+  - agent-config-maintainer
+packs:
+  - meta
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 <!-- cloud_safe: degrade -->
@@ -118,7 +130,7 @@ Suggestion-block rules (linter-enforced):
   override the global settings per command.
 
 Eligibility decisions are tracked in
-[`agents/contexts/command-suggestion-eligibility.md`](../../../agents/contexts/command-suggestion-eligibility.md).
+[`agents/settings/contexts/command-suggestion-eligibility.md`](../../../agents/settings/contexts/command-suggestion-eligibility.md).
 Add or revise entries there before changing a command's `suggestion` block.
 
 When iterating on the description, delegate to the
@@ -197,7 +209,7 @@ the pre-existing violations on `main` in a Markdown table:
 Forward-only: the new check applies to **the file under review** and to
 **future** edits. The baseline table is informational so reviewers can
 spot intent (fix-now vs. backlog) without diffing the full lint output.
-See `agents/analysis/lint-warning-triage.md` for the 3-bucket reference.
+See `agents/evidence/analysis/lint-warning-triage.md` for the 3-bucket reference.
 
 ## Output format
 

package/.agent-src/skills/comp-banding/SKILL.md

@@ -6,6 +6,18 @@ tier: senior
 source: package
 domain: process
 context_spine: [org-stage, customer-segment, regulatory-regime]
+workspaces:
+  - ops
+packs:
+  - ops-people
+lifecycle: active
+trust:
+  level: professional
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: true
 ---
 
 # comp-banding