@event4u/agent-config 2.25.0 → 3.0.0

package/.agent-src/skills/dependency-upgrade/SKILL.md

@@ -1,18 +1,30 @@
 ---
 name: dependency-upgrade
-description: "Use when upgrading dependencies — "update Laravel", "bump PHP version", or "upgrade packages". Covers changelog review, breaking change detection, and verification."
+description: "Use when upgrading dependencies — 'update framework X', 'bump runtime version', or 'upgrade packages'. Covers changelog review, breaking-change detection, and verification. Stack-agnostic."
 source: package
 domain: engineering
+workspaces:
+  - engineering
+packs:
+  - engineering-base
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # dependency-upgrade
 
 ## When to use
 
-Use this skill when upgrading Composer packages, npm packages, or any project dependency.
+Use this skill when upgrading project dependencies on any stack — Composer (PHP), npm / pnpm / yarn (JS/TS), pip / poetry / uv (Python), go.mod (Go), Cargo (Rust), or any other language-level package manager.
 
 Do NOT use when:
-- Installing new deps for the first time
+- Installing new dependencies for the first time
 - Routine code changes unrelated to package versions
 
 ## Procedure: Upgrade a dependency
@@ -25,7 +37,7 @@ Before upgrading:
 - **Identify breaking changes** — look for "BREAKING", "BC break", major version bumps.
 - **Check deprecation notices** — code using deprecated APIs needs updating.
 - **Review upgrade guides** — many packages provide migration docs.
-- **Check PHP/Node version requirements** — does the new version need a newer runtime?
+- **Check runtime version requirements** — does the new version need a newer PHP / Node / Python / Go / Rust toolchain?
 
 ### 2. Plan
 
@@ -73,23 +85,69 @@ npm install package-name@latest
 npm audit
 ```
 
-### 4. Verify
+#### pip / poetry / uv (Python)
+
+```bash
+# Check outdated packages
+pip list --outdated         # pip
+poetry show --outdated       # poetry
+uv pip list --outdated       # uv
+
+# Upgrade a specific package
+pip install --upgrade package-name
+poetry update package-name
+uv pip install --upgrade package-name
 
-After upgrading, run the full verification pipeline:
+# Check for vulnerabilities
+pip-audit                    # via pip-audit
+safety check                 # via safety
+```
+
+#### go.mod (Go)
 
 ```bash
-# PHP/Laravel
-vendor/bin/phpstan analyse           # Check for type errors
-vendor/bin/rector process            # Auto-fix refactoring
-vendor/bin/ecs check --fix           # Auto-fix code style
-php artisan test                     # Run all tests
-
-# JavaScript
-npm run build     # Check build succeeds
-npm test          # Run all tests
-npm run lint      # Check code style
+# List available updates
+go list -u -m all
+
+# Upgrade a specific module
+go get example.com/pkg@latest
+go get example.com/pkg@v1.2.3
+
+# Tidy after upgrade
+go mod tidy
+
+# Check for known vulnerabilities
+govulncheck ./...
 ```
 
+#### Cargo (Rust)
+
+```bash
+# Check outdated
+cargo outdated               # requires cargo-outdated
+
+# Upgrade
+cargo update -p crate-name
+cargo add crate-name@1.2     # edition-aware add
+
+# Audit
+cargo audit                  # requires cargo-audit
+```
+
+### 4. Verify
+
+After upgrading, run the project's full verification pipeline. The exact commands depend on the stack — resolve via the project's `Taskfile.yml`, `package.json scripts`, `composer.json scripts`, `Makefile`, or the `quality-tools` skill.
+
+| Stack | Type-check | Lint / autofix | Tests |
+|---|---|---|---|
+| PHP / Laravel | `vendor/bin/phpstan analyse` | `vendor/bin/rector process` + `vendor/bin/ecs check --fix` | `php artisan test` (or `vendor/bin/pest`) |
+| TypeScript | `tsc --noEmit` | `eslint --fix` + `prettier --write` | `pnpm test` (or `vitest run`, `jest`) |
+| Python | `mypy` / `pyright` | `ruff check --fix` + `ruff format` | `pytest` |
+| Go | `go vet ./...` | `golangci-lint run --fix` | `go test ./...` |
+| Rust | `cargo check` | `cargo clippy --fix` + `cargo fmt` | `cargo test` |
+
+Re-run the type-checker after any auto-fixer that can rewrite types (Rector for PHP, `eslint --fix` for TS).
+
 ### 5. Document
 
 - Note the upgrade in the commit message: `chore: upgrade vendor/package from 2.x to 3.x`
@@ -100,7 +158,7 @@ npm run lint      # Check code style
 When upgrading multiple packages:
 
 - **Upgrade one at a time** — easier to identify which upgrade broke something.
-- **Exception:** Tightly coupled packages (e.g., `laravel/framework` + `laravel/*`) can be upgraded together.
+- **Exception:** Tightly coupled packages can be upgraded together (e.g., `laravel/framework` + `laravel/*`; `@nestjs/core` + `@nestjs/*`; `react` + `react-dom`; `next` + `@next/*`).
 - **Run tests after each upgrade** — don't batch upgrades and test once at the end.
 
 ## Common pitfalls
@@ -111,7 +169,7 @@ When upgrading multiple packages:
 | Upgrading all packages at once | One package at a time (or tightly coupled groups) |
 | Trusting `composer update` blindly | Use `--dry-run` first, review changes |
 | Ignoring deprecation warnings | Fix deprecations before they become errors |
-| Skipping tests after upgrade | Full test suite + PHPStan after every upgrade |
+| Skipping tests after upgrade | Full test suite + project type-checker (PHPStan / tsc / mypy / `go vet` / `cargo check`) after every upgrade |
 | Lock file conflicts | Coordinate upgrades with the team |
 
 ## Version constraint guidelines
@@ -165,7 +223,7 @@ npm audit
 |---|---|---|
 | **Known CVEs** | `composer audit` / `npm audit` | Direct vulnerabilities |
 | **Maintenance status** | GitHub: last commit, open issues | Abandoned packages are a risk |
-| **Dependency tree** | `composer show -t vendor/pkg` / `npm ls new-package` | Transitive deps may conflict |
+| **Dependency tree** | `composer show -t vendor/pkg` / `npm ls new-package` | Transitive dependencies may conflict |
 | **License compatibility** | `composer licenses` / check `package.json` | Legal compliance |
 | **Bundle size** (npm) | `npx bundlephobia new-package` | Impact on frontend bundle |
 

package/.agent-src/skills/description-assist/SKILL.md

@@ -3,6 +3,18 @@ name: description-assist
 description: "Use when polishing a skill/rule/command/guideline frontmatter description — pushier phrasing, trigger coverage, undertrigger audit — even if the user just says 'make this pushier'."
 source: package
 domain: process
+workspaces:
+  - agent-config-maintainer
+packs:
+  - meta
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 <!-- cloud_safe: degrade -->

package/.agent-src/skills/design-review/SKILL.md

@@ -3,6 +3,18 @@ name: design-review
 description: "Use when the user says "review the design", "check the UI", or wants a comprehensive UI/UX review. Uses a 7-phase methodology covering interaction, responsiveness, accessibility, and more."
 source: package
 domain: quality
+workspaces:
+  - engineering
+packs:
+  - engineering-base
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # design-review

package/.agent-src/skills/devcontainer/SKILL.md

@@ -3,6 +3,18 @@ name: devcontainer
 description: "Wire up DevContainers / GitHub Codespaces — `devcontainer.json`, container images, secrets, VS Code features, port forwarding. NOT for tuning Copilot itself (use `copilot-config`)."
 source: package
 domain: devops
+workspaces:
+  - engineering
+packs:
+  - engineering-base
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # devcontainer

package/.agent-src/skills/developer-like-execution/SKILL.md

@@ -7,6 +7,18 @@ execution:
   type: assisted
   handler: internal
   allowed_tools: []
+workspaces:
+  - engineering
+packs:
+  - engineering-base
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # developer-like-execution
@@ -84,8 +96,8 @@ When UI changes are involved:
 - `rg`, `grep` for text: specific patterns, not full files
 - `head`, `tail`, `cut`, `sort`, `uniq` for narrowing results
 - `--filter`, `--json`, `--format` flags on CLI tools — always use them
-- Laravel: `route:list --json | jq '.[] | select(.uri | test("users"))'`
-- Logs: `rg "request_id=abc123" storage/logs` — never `cat storage/logs/laravel.log`
+- Route lookup — Laravel `php artisan route:list --json | jq '…'`, Rails `bin/rails routes | grep users`, Express `console.log(app._router.stack)`, FastAPI `app.routes`, Symfony `bin/console debug:router`.
+- Logs — `rg "request_id=abc123" <log-dir>` — never `cat <log-file>`. Log dirs by stack: Laravel `storage/logs/`, Rails `log/`, Node `./logs/` or `journalctl`, Python `./logs/` or `journalctl`, Docker `docker compose logs <svc> --since 5m`.
 
 ### Avoid large output by default
 
@@ -156,22 +168,33 @@ If full TDD is not practical: at least write down the expected output before cod
 #### Backend examples
 
 ```bash
-# Laravel route lookup — targeted, not full dump
-php artisan route:list --json | jq '.[] | select(.uri == "api/users") | {method, uri, name, action, middleware}'
-
-# Config/debug
-php artisan config:show app | grep env
+# Route lookup — pick the project's framework
+php artisan route:list --json | jq '.[] | select(.uri == "api/users") | {method, uri, name, action, middleware}'   # Laravel
+bin/console debug:router --format=json | jq '.[] | select(.path == "/api/users")'                                  # Symfony
+bin/rails routes -g users                                                                                          # Rails
+curl -s http://localhost:3000/__routes | jq '.[] | select(.path == "/api/users")'                                  # Express custom-introspection
+curl -s http://localhost:8000/openapi.json | jq '.paths["/api/users"]'                                             # FastAPI
+
+# Config inspection
+php artisan config:show app | grep env       # Laravel
+bin/console debug:config framework            # Symfony
+bin/rails runner 'puts Rails.application.config_for(:database)'  # Rails
 
 # API inspection — extract only what you need
 curl -s http://localhost/api/users | jq '.[0] | {id, email, status}'
 curl -s http://localhost/api/users/1 | jq '{id, name, roles: [.roles[].name]}'
 
-# Logs — scoped by request ID, timestamp, or error type
-rg "request_id=abc123|OrderFailed" storage/logs
-tail -n 200 storage/logs/laravel.log | rg "payment|timeout"
-
-# Database — targeted queries, not full table dumps
-php artisan tinker --execute="User::where('email', 'test@example.com')->first(['id','email','status'])"
+# Recent logs — targeted, not full dump
+tail -n 200 storage/logs/laravel.log | rg "payment|timeout"             # Laravel
+tail -n 200 log/development.log | rg "payment|timeout"                   # Rails
+docker compose logs api --since 5m --no-color | rg "payment|timeout"     # any container stack
+journalctl -u myapp --since "5 min ago" | rg "payment|timeout"           # systemd
+
+# DB-state probe — targeted single record, not full table
+php artisan tinker --execute="User::where('email','x@y')->first(['id','email','status'])"   # Laravel
+bin/rails runner "p User.where(email: 'x@y').first&.slice(:id,:email,:status)"               # Rails
+bin/console doctrine:query:sql "SELECT id,email,status FROM users WHERE email='x@y' LIMIT 1" # Symfony
+psql -d mydb -c "SELECT id,email,status FROM users WHERE email='x@y' LIMIT 1"                 # raw SQL fallback
 ```
 
 #### Debugging with Xdebug
@@ -218,7 +241,7 @@ Never load full output into context when a filter gives you the answer.
 
 Tests are mandatory when behavior changes or bugs are fixed.
 
-Prefer: failing test first → impl → passing test.
+Prefer: failing test first → implementation → passing test.
 
 Test types: unit (isolated logic), feature/integration (behavior), UI (frontend), regression (bugs).
 

package/.agent-src/skills/discovery-interview/SKILL.md

@@ -7,8 +7,18 @@ source: package
 domain: product
 context_spine: [product]
 recommended_for_user_types: [consultant, founder]
-
-
+workspaces:
+  - product
+packs:
+  - product-discovery
+lifecycle: active
+trust:
+  level: professional
+  confidence: high
+  human_review_required: false
+install:
+  default: false
+  removable: true
 ---
 
 # discovery-interview

package/.agent-src/skills/doc-coauthoring/SKILL.md

@@ -3,6 +3,18 @@ name: doc-coauthoring
 description: "Use when co-authoring a PRD, design doc, RFC, decision doc, or technical spec — 3-stage flow (context → section-by-section → reader-test) — even if the user just says 'help me write this spec'."
 source: package
 domain: process
+workspaces:
+  - agent-config-maintainer
+packs:
+  - meta
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # doc-coauthoring

package/.agent-src/skills/docker/SKILL.md

@@ -3,6 +3,18 @@ name: docker
 description: "Use when working with Docker — Dockerfile edits, docker-compose services, containers, or the dual-container (fast + Xdebug) setup — even when the user just says 'my container won't start'."
 source: package
 domain: devops
+workspaces:
+  - engineering
+packs:
+  - engineering-base
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # docker

package/.agent-src/skills/editorial-calendar/SKILL.md

@@ -7,8 +7,18 @@ source: package
 domain: product
 context_spine: [product, customer-segment, channel-stage, funnel-stage]
 recommended_for_user_types: [creator]
-
-
+workspaces:
+  - gtm
+packs:
+  - gtm-marketing
+lifecycle: active
+trust:
+  level: professional
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: true
 ---
 
 # editorial-calendar

package/.agent-src/skills/eloquent/SKILL.md

@@ -5,6 +5,18 @@ personas:
   - eloquent-tamer
 source: package
 domain: engineering
+workspaces:
+  - engineering
+packs:
+  - laravel
+lifecycle: active
+trust:
+  level: professional
+  confidence: high
+  human_review_required: false
+install:
+  default: false
+  removable: true
 ---
 
 # eloquent
@@ -15,7 +27,7 @@ Use when creating/modifying Eloquent models, relationships, scopes, or writing d
 
 Do NOT use when:
 - Schema design or query optimization (use `database` skill)
-- Creating migrations only (use `migration-creator` skill)
+- Creating migrations only (use `laravel-migration` skill)
 
 ## Procedure: Create or modify a model
 

package/.agent-src/skills/eloquent/evals/triggers.json

@@ -8,7 +8,7 @@
     {"q": "write a relationship from Invoice to LineItems using hasMany", "trigger": true},
     {"q": "this N+1 is killing me — how do I eager load nested relations?", "trigger": true},
     {"q": "create a migration for adding an index on users.email", "trigger": false},
-    {"q": "write a Pest test for the UserService", "trigger": true, "note": "A-class: 'User*' is inherently ambiguous (Model or Service). Router loading eloquent alongside pest-testing / php-service is defensible multi-skill activation, not a routing failure. Pushy 'NOT for non-Eloquent services' description tail was insufficient to override the lexical pull — see agents/docs/trigger-evals-poc-findings.md #3"},
+    {"q": "write a Pest test for the UserService", "trigger": true, "note": "A-class: 'User*' is inherently ambiguous (Model or Service). Router loading eloquent alongside pest-testing / php-service is defensible multi-skill activation, not a routing failure. Pushy 'NOT for non-Eloquent services' description tail was insufficient to override the lexical pull — see agents/reference/docs/trigger-evals-poc-findings.md #3"},
     {"q": "phpstan says mixed return type on my model method", "trigger": false},
     {"q": "run the seeder with --class=ProductSeeder", "trigger": false},
     {"q": "what SQL does chunk() generate under the hood?", "trigger": false}

package/.agent-src/skills/error-handling-patterns/SKILL.md

@@ -6,6 +6,18 @@ domain: engineering
 status: active
 refresh_trigger: "≥30% of cited upstream pattern catalogues become deprecated, OR a new top-2 ecosystem (Python/JS/PHP/Go/Rust) ships a paradigm-shifting standard error model"
 sunset_criterion: "When the upstream framework docs (Laravel, FastAPI, Express, Axum, Effect-TS) all carry an equivalent in-tree decision framework AND consumer projects no longer cite this skill in PR reviews for two consecutive review cycles."
+workspaces:
+  - engineering
+packs:
+  - engineering-base
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # error-handling-patterns
@@ -131,5 +143,5 @@ Exactly **one** layer translates internal errors to the egress format (HTTP stat
   - Rust: https://doc.rust-lang.org/book/ch09-00-error-handling.html
   - Resilience patterns: https://martinfowler.com/bliki/CircuitBreaker.html · https://aws.amazon.com/builders-library/timeouts-retries-and-backoff-with-jitter/
 - Cross-linked: [`defense-in-depth`](../defense-in-depth/SKILL.md), [`laravel-validation`](../laravel-validation/SKILL.md), [`bug-analyzer`](../bug-analyzer/SKILL.md), [`api-design`](../api-design/SKILL.md).
-- Provenance registry: `agents/contexts/skills-provenance.yml` (entry: `error-handling-patterns`).
+- Provenance registry: `agents/settings/contexts/skills-provenance.yml` (entry: `error-handling-patterns`).
 - Iron-Law floor: `verify-before-complete`, `skill-quality`, `non-destructive-by-default`.

package/.agent-src/skills/estimate-ticket/SKILL.md

@@ -14,6 +14,18 @@ execution:
   type: assisted
   handler: internal
   allowed_tools: []
+workspaces:
+  - product
+packs:
+  - product-basic
+lifecycle: active
+trust:
+  level: professional
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: true
 ---
 
 # Estimate Ticket

package/.agent-src/skills/existing-ui-audit/SKILL.md

@@ -5,6 +5,18 @@ personas:
   - frontend-engineer
 source: package
 domain: discovery
+workspaces:
+  - engineering
+packs:
+  - engineering-base
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # existing-ui-audit

package/.agent-src/skills/expansion-playbook/SKILL.md

@@ -6,6 +6,18 @@ tier: senior
 source: package
 domain: product
 context_spine: [product, customer-segment]
+workspaces:
+  - gtm
+packs:
+  - gtm-sales
+lifecycle: active
+trust:
+  level: professional
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: true
 ---
 
 # expansion-playbook

package/.agent-src/skills/fe-design/SKILL.md

@@ -5,6 +5,18 @@ personas:
   - frontend-engineer
 source: package
 domain: engineering
+workspaces:
+  - engineering
+packs:
+  - engineering-base
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # Frontend Design Skill (Reference)

package/.agent-src/skills/feature-planning/SKILL.md

@@ -3,6 +3,18 @@ name: feature-planning
 description: "Use when the user says "plan a feature", "brainstorm", "explore this idea", or wants to go from idea to structured plan and roadmap."
 source: package
 domain: product
+workspaces:
+  - product
+packs:
+  - product-basic
+lifecycle: active
+trust:
+  level: professional
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: true
 ---
 
 # feature-planning
@@ -145,7 +157,7 @@ Structural roadmap tasks must include:
 
 1. **Exact file path** — `app/Modules/Auth/Services/LoginService.php`, never *"the login service"*.
 2. **Complete code** — every method body, import, and signature ready to paste; no `// existing code` ellipses, no `…`.
-3. **Exact command** — `php artisan migrate --path=database/migrations/2026_05_09_create_logins.php`, never *"run the migration"*.
+3. **Exact command** — the precise CLI invocation, never *"run the migration"*. Examples: `php artisan migrate --path=database/migrations/2026_05_09_create_logins.php` (Laravel), `bin/console doctrine:migrations:migrate --no-interaction` (Symfony), `bin/rails db:migrate VERSION=20260509…` (Rails), `npx prisma migrate deploy` (Prisma), `alembic upgrade +1` (Python / Alembic), `sqlx migrate run` (Rust).
 4. **Expected output** — what success looks like (`Migrated: 2026_05_09_create_logins`) and the exit code.
 5. **No placeholders** — angle-bracket placeholders, `TODO`, `FIXME`, `tbd`, and `???` are blockers; resolve before the task ships.