@event4u/agent-config 8.6.0 → 8.8.0

package/dist/agent-src/skills/supply-chain-intake/SKILL.md

@@ -0,0 +1,100 @@
+---
+model_tier: medium
+name: supply-chain-intake
+description: "Before adding/installing any dependency the agent named — verify the package exists (slopsquatting: ~1 in 5 AI suggestions are hallucinated), isn't typo-adjacent, is pinned + locked, and CVE-scanned"
+domain: devops
+workspaces:
+  - engineering
+packs:
+  - engineering-base
+---
+
+# supply-chain-intake
+
+An LLM generates a plausible-sounding package name token-by-token with no lookup against a real registry. ~19.7% of AI-recommended packages don't exist (576k-sample study); the same fake name recurs across runs, so attackers pre-register it as malware — "slopsquatting". The `huggingface-cli` PoC (an empty package matching a common hallucination) drew 30k+ downloads. Endor Labs: only ~1 in 5 AI-recommended dependency versions is both real *and* safe. A dependency the agent named is untrusted until verified — never install it just because the model produced the name.
+
+## When to use
+
+- About to add a dependency to `package.json` / `requirements.txt` / `go.mod` / `Cargo.toml` / `composer.json` / `pyproject.toml`, or run `npm/pnpm/yarn install`, `pip install`, `go get`, `cargo add`, `composer require`.
+- Reviewing an AI-authored diff touching a dependency manifest or lockfile.
+- An install command was suggested (especially `curl … | bash`).
+
+Do NOT use when: no dependency is added and no manifest/lockfile is touched.
+
+## The Iron Law
+
+```
+VERIFY THE PACKAGE EXISTS ON THE REAL REGISTRY BEFORE YOU INSTALL IT.
+A NAME THE MODEL PRODUCED IS A HYPOTHESIS, NOT A DEPENDENCY.
+PIN IT, LOCK IT, CVE-SCAN IT. NEVER PIPE A REMOTE SCRIPT STRAIGHT TO A SHELL.
+```
+
+## Procedure — intake gate (run in order before adding a dependency)
+
+1. **Existence** — confirm the exact string resolves on the real registry, published before your session, with real usage:
+   ```bash
+   npm view <pkg> version        # non-zero exit = does not exist (hallucination)
+   pip index versions <pkg>      # or: pip install <pkg>== to list
+   go list -m <module>@latest
+   cargo search <crate>
+   ```
+   Non-existent, brand-new (days old), or near-zero-download → **stop**, treat as hallucination/slopsquat.
+2. **Typo-adjacency** — name within 1–2 chars of a far-more-popular package (`python-dateutil` vs `dateutil`, `lodahs` vs `lodash`)? Probably want the popular one — confirm before installing.
+3. **Version safety** — the model's pin may predate a CVE fix (training-cutoff reintroduction). Take the current patched release, then scan:
+   ```bash
+   npm audit           # block on high/critical
+   pip-audit
+   osv-scanner -r .
+   ```
+4. **Pin + lock** — install exact + commit the lockfile; reject floating ranges (`^`, `latest`, no lockfile) on production deps.
+   ```bash
+   npm install --save-exact <pkg> && git add package-lock.json
+   ```
+5. **License** — confirm compatible with the project's declared license before it lands.
+6. **No pipe-to-shell** — never `curl … | bash` an install; download → inspect → execute over pinned HTTPS, or surface it to the user for confirmation.
+
+## Backstop greps
+
+```bash
+# Floating / unpinned production deps (npm)
+rg -n '"[^"]+":\s*"(\^|~|\*|latest)' package.json
+# Missing lockfile alongside a manifest
+[ -f package.json ] && [ ! -f package-lock.json ] && echo "no lockfile"
+# curl|bash install patterns anywhere in the change
+rg -n 'curl[^|]*\|\s*(bash|sh)|wget[^|]*\|\s*(bash|sh)' .
+```
+
+## Output format
+
+1. Per new dependency: name, resolved registry version, publish date / usage signal, and the existence-check command output (`npm view … → 4.17.21`) — proving it real.
+2. The lockfile diff staged, and the `audit` / `osv-scanner` result (`0 high/critical`, or the finding + resolution).
+3. For any suggested install command, confirmation it isn't `curl|bash` and the source is pinned HTTPS.
+
+## Gotcha
+
+- Hallucinated names are *repeatable* — re-prompting the same model yields the same fake name, so "it looked confident / consistent" isn't evidence it exists. Only the registry is.
+- Short, "obvious" variants (`X-cli`, `X-client`, `X-sdk`) are the prime hallucination shape — verify these hardest.
+- A package that exists but was published this week with 12 downloads is a slopsquat candidate, not a safe dep — weigh age + usage, not just existence.
+- Lockfile integrity is part of the threat model: an unhashed or floating entry can pull a freshly-poisoned release even when a lockfile is "present".
+
+## Do NOT
+
+- Do NOT run an install command for a package you haven't existence-checked this session.
+- Do NOT accept the model's version pin as authoritative — re-check against current CVEs.
+- Do NOT commit a manifest change without its lockfile.
+- Do NOT pipe a fetched script into an interpreter.
+- Do NOT inline code that duplicates a copyleft source without carrying its license.
+
+## Auto-trigger keywords
+
+- dependency intake
+- package hallucination
+- slopsquatting
+- add a dependency
+- npm install / pip install / go get
+
+## See also
+
+- [`ai-code-blindspots`](../ai-code-blindspots/SKILL.md) — the surface→controls checklist that routes here.
+- [`senior-engineering-discipline`](../../rules/senior-engineering-discipline.md) — anchor rule.
+- [`dependency-upgrade`](../dependency-upgrade/SKILL.md), [`secrets-management`](../secrets-management/SKILL.md), [`security`](../security/SKILL.md).

package/dist/agent-src/skills/supply-chain-intake/evals/triggers.json

@@ -0,0 +1,52 @@
+{
+    "skill": "supply-chain-intake",
+    "last_eval": "2026-07-09",
+    "description": "5 should-trigger + 5 should-not-trigger queries. Should-trigger covers DE + EN phrasings for verifying a new third-party dependency before install (existence/slopsquatting, pin+lock, CVE, no curl|bash). Should-not-trigger covers near-miss neighbours (upgrading existing deps, secrets, generic checklist, server auth) whose vocabulary overlaps.",
+    "queries": [
+        {
+            "q": "add the package the model suggested to package.json and install it",
+            "trigger": true
+        },
+        {
+            "q": "is this pip package real or a hallucination before I install?",
+            "trigger": true
+        },
+        {
+            "q": "the install command is a curl piped to bash — is that safe?",
+            "trigger": true
+        },
+        {
+            "q": "prüf diese neue Abhängigkeit bevor ich sie installiere (existiert sie überhaupt?)",
+            "trigger": true
+        },
+        {
+            "q": "should I pin this dependency and commit a lockfile?",
+            "trigger": true
+        },
+        {
+            "q": "upgrade our existing lodash to the latest major and fix breakages",
+            "trigger": false,
+            "note": "upgrading an already-trusted dep → dependency-upgrade"
+        },
+        {
+            "q": "rotate the API keys stored in our secret manager",
+            "trigger": false,
+            "note": "secrets lifecycle → secrets-management"
+        },
+        {
+            "q": "what cross-cutting controls did I miss across this diff?",
+            "trigger": false,
+            "note": "cross-surface checklist → ai-code-blindspots"
+        },
+        {
+            "q": "review the authorization on this endpoint",
+            "trigger": false,
+            "note": "server-side authz → authz-review"
+        },
+        {
+            "q": "why is my build failing on a type error?",
+            "trigger": false,
+            "note": "build/type debugging — not dependency intake"
+        }
+    ]
+}

package/dist/agent-src/skills/testing-anti-patterns/SKILL.md

@@ -1,7 +1,7 @@
 ---
 model_tier: medium
 name: testing-anti-patterns
-description: "Use BEFORE writing/changing tests, adding mocks, or test-only methods on production classes — Iron Laws against mocking-the-mock, production pollution, silent partial mocks."
+description: "Use BEFORE writing/changing tests, adding mocks, or test-only methods on production classes — vs mocking-the-mock, production pollution, partial mocks, and overfit/tautological assertions"
 domain: quality
 workspaces:
   - engineering
@@ -42,6 +42,7 @@ Do NOT use when:
 3. NEVER mock without understanding the dependency chain — observe first, mock minimally.
 4. NEVER ship partial mocks — mirror the real response shape completely.
 5. NEVER treat tests as an afterthought — write the failing test first.
+6. NEVER overfit an assertion — assert the general rule, derive expected values from inputs/seeded data, cover boundary + error cases.
 ```
 
 ## Procedure: Run the gate before each anti-pattern
@@ -126,6 +127,40 @@ Symptom: "Implementation complete, ready for testing." Implementation went in wi
 
 Gate: a feature is not complete until a failing-then-passing test cycle ran for it. Route to [`test-driven-development`](../test-driven-development/SKILL.md).
 
+### Anti-Pattern 6 — Overfit / tautological assertions & unrealistic test data
+
+Symptom: the test passes only for one crafted input and proves nothing about the general rule — a hardcoded expected value the code always emits, a narrow regex pinned to a fixed date/id, or an assertion restating the seed. AI-written tests reach the same coverage as human tests but ~4× worse fault detection (weak-oracle): they execute the path, then assert something too weak to catch a bug. Same shape as mocking-the-mock — asserting on your own construction, not the system's behavior.
+
+Gate:
+
+```
+BEFORE writing an assertion:
+  Ask: "Would this still pass if the input changed, and FAIL if the RULE broke?"
+  IF it only passes for one crafted value, or restates a hardcoded literal:
+    STOP — derive the expected from the input, and add cases that vary it.
+```
+
+Test-data realism — seeders/factories emit random data; the test derives its expectation from that data, never a hardcoded literal:
+
+```js
+// ❌ WRONG — hardcoded expectation, single happy case
+const res = await api.get('/users/1')
+expect(res.body).toEqual({ id: 1, name: 'Alice', email: 'alice@example.com' })
+expect(log).toMatch(/User 1 logged in at 2026-01-01/)   // pins incidental values
+
+// ✅ RIGHT — derive from seeded random data + cover more than the happy path
+const user = await seedUser()                     // faker-random name/email
+const res = await api.get(`/users/${user.id}`)
+expect(res.body.id).toBe(user.id)                 // derived, not hardcoded
+expect(res.body.name).toBe(user.name)
+expect(res.body).not.toHaveProperty('passwordHash')            // security property
+expect((await api.get('/users/999999')).status).toBe(404)      // boundary: missing
+expect((await api.get('/users/abc')).status).toBe(400)         // error: invalid input
+expect([403, 404]).toContain((await api.get(`/users/${otherTenantUser.id}`)).status) // abuse: tenant isolation (404 hides existence)
+```
+
+Deriving from seeded data is necessary but **not sufficient** — a test that only reads back the exact fields it seeded is still overfit (a code mutation survives it). A real test also exercises boundary (empty / null / max / Unicode), error (missing / invalid), and, on security-sensitive paths, an abuse case (IDOR, injection string, XSS payload). Coverage of *cases*, not just lines.
+
 ## Output format
 
 1. The mocking decision recorded as a one-line comment in the test file (`// mock at <seam>: <reason>`).
@@ -139,6 +174,7 @@ Gate: a feature is not complete until a failing-then-passing test cycle ran for
 - Layer 3 environment guards from [`defense-in-depth`](../defense-in-depth/SKILL.md) often expose anti-pattern 2: if a production guard fires only in tests, the test setup is wrong, not the guard.
 - Long mock setups (> 50% of the test) are a signal that integration tests would be simpler — consider it before piling on more mocks.
 - **Diagnose, do not brute-force.** If a test fails after a mock change, **never guess** at another mock tweak — drop a debugger / Xdebug breakpoint at the seam, observe the real call shape, then mock minimally. Two retries without a root-cause hypothesis = STOP and rethink.
+- An assertion that derives from seeded data but only checks the happy path is still overfit — a code mutation survives it. Require ≥1 boundary/error/abuse case per behavior, not just line coverage.
 
 ## Do NOT
 
@@ -147,6 +183,7 @@ Gate: a feature is not complete until a failing-then-passing test cycle ran for
 - Do NOT mock a method whose side effects the test depends on without reading the implementation.
 - Do NOT invent mock data shapes from memory — record from the real source.
 - Do NOT mark a story complete until at least one test was watched failing first.
+- Do NOT hardcode an expected value the code will emit, or pin a regex to an incidental fixed date/id — derive from inputs and seeded data, and vary the input across cases.
 
 ## Auto-trigger keywords
 
@@ -155,10 +192,14 @@ Gate: a feature is not complete until a failing-then-passing test cycle ran for
 - test-only method
 - partial mock
 - mock without understanding
+- overfit assertion
+- tautological test
+- hardcoded expected value
 
 ## Provenance
 
 - Adopted from: an external reference (MIT, © 2025 an external reference).
 - Cross-linked: [`pest-testing`](../pest-testing/SKILL.md), [`test-driven-development`](../test-driven-development/SKILL.md), [`judge-test-coverage`](../judge-test-coverage/SKILL.md).
 - Provenance registry: `agents/settings/contexts/skills-provenance.yml` (entry: `testing-anti-patterns`).
-- Iron-Law floor: `verify-before-complete`, `skill-quality`.
+- Iron-Law floor: `verify-before-complete`, `skill-quality`, `senior-engineering-discipline`.
+- Cross-cutting anchor: [`ai-code-blindspots`](../ai-code-blindspots/SKILL.md) routes here for the test surface.

package/dist/agent-src/templates/agents/agent-project-settings.example.yml

@@ -39,7 +39,7 @@ schema_version: 1
 # CI guard: a release bump of `package.json` must update this value
 # in lockstep — see scripts/check_template_pin_drift.ts (road-to-
 # portable-runtime-and-update-check P3.3).
-agent_config_version: "8.6.0"
+agent_config_version: "8.8.0"
 
 # --- Project identity ---
 project:

package/dist/agent-src/templates/roadmaps.md

@@ -156,6 +156,30 @@ Templates for roadmap files stored in `agents/roadmaps/` or `{module_root}/{Modu
     structured form above; renders richer instructions in per-roadmap
     breakdown.
 
+21. **Related roadmaps share a common filename prefix.** When you create
+    more than one roadmap that belongs together — a follow-up, siblings
+    split from one body of work in a single pass, or phases of one
+    initiative in separate files — give them a shared `road-to-<family>-…`
+    prefix so relatedness is visible in `agents/roadmaps/` and the
+    dashboard groups them. `<family>` = short kebab slug for the shared
+    initiative; the suffix distinguishes members:
+    - **Split-in-one-pass siblings** → `road-to-<family>-<part>.md`
+      (e.g. `road-to-auth-hardening-backend.md`,
+      `road-to-auth-hardening-frontend.md`,
+      `road-to-auth-hardening-infra.md`).
+    - **Follow-ups** → `road-to-<parent>-followup.md` (rule 17): the
+      special case where `<parent>` is the family prefix; keep the
+      `parent_roadmap:` back-link.
+    - **Sibling (non-parent/child) roadmaps** carry no `parent_roadmap:`;
+      the shared prefix is the only linkage — do **not** invent a new
+      frontmatter field. Cross-link siblings by name in each `## Context`
+      block when it helps a reader.
+    Pick the `<family>` slug **once, up front**, before the first of the
+    set — renaming a prefix later means migrating inbound references. A
+    lone roadmap keeps plain `road-to-<slug>.md`; the convention fires
+    only when ≥2 related roadmaps are created together or as a follow-up
+    chain.
+
 ---
 
 ## Quality Gates (remote CI by default)

package/dist/discovery/deprecation-report.md

@@ -1,6 +1,6 @@
 # Discovery — Deprecation Report
 
-- Generated: `2026-07-08T14:10:55Z`
+- Generated: `2026-07-09T12:23:58Z`
 - Deprecated artefacts: **0**
 
 _None. Tree is clean._

package/dist/discovery/discovery-manifest.json

@@ -4714,6 +4714,27 @@
         "agent-config-maintainer"
       ]
     },
+    {
+      "category": "rule",
+      "checksum": "sha256:946542c49f853be23686ab459da7c76c4cc31c710bf43b25c94f5991355f7c11",
+      "install": {
+        "default": true,
+        "removable": false
+      },
+      "lifecycle": "active",
+      "packs": [
+        "engineering-base"
+      ],
+      "path": "src/rules/active-remediation.md",
+      "trust": {
+        "confidence": "high",
+        "human_review_required": false,
+        "level": "core"
+      },
+      "workspaces": [
+        "engineering"
+      ]
+    },
     {
       "category": "rule",
       "checksum": "sha256:d64b9dea4d70a0392472bf94cf1ebc374e18196119e58e20fd660c5d4a3ed7a2",
@@ -4955,6 +4976,27 @@
         "engineering"
       ]
     },
+    {
+      "category": "rule",
+      "checksum": "sha256:edaeae5044cbda656f1abb2377f56cdfb38cce48108e8e83872bd67a1da6ff87",
+      "install": {
+        "default": true,
+        "removable": false
+      },
+      "lifecycle": "active",
+      "packs": [
+        "engineering-base"
+      ],
+      "path": "src/rules/broken-access-control.md",
+      "trust": {
+        "confidence": "high",
+        "human_review_required": false,
+        "level": "core"
+      },
+      "workspaces": [
+        "engineering"
+      ]
+    },
     {
       "category": "rule",
       "checksum": "sha256:9c8f9b1ded54c9601f66c0c87b84c3b2aff4726514ec0231a3cd04c6b58c0cd2",
@@ -5049,6 +5091,36 @@
         "engineering"
       ]
     },
+    {
+      "category": "rule",
+      "checksum": "sha256:f1bc4a87f5a26163cce17fc4b3a8cd4f1dfd4ad52c9fe65da97c9357becbcf35",
+      "install": {
+        "default": true,
+        "removable": false
+      },
+      "lifecycle": "active",
+      "packs": [
+        "engineering-base"
+      ],
+      "path": "src/rules/communication-through-line.md",
+      "trust": {
+        "confidence": "high",
+        "human_review_required": false,
+        "level": "core"
+      },
+      "workspaces": [
+        "agent-config-maintainer",
+        "construction",
+        "engineering",
+        "finance",
+        "founder",
+        "gtm",
+        "legal-review-prep",
+        "ops",
+        "product",
+        "small-business"
+      ]
+    },
     {
       "category": "rule",
       "checksum": "sha256:44216e854bddb1c0fae430451262756ca5e7d13c41ddbe440cecdb678cecf99c",
@@ -5133,7 +5205,7 @@
     },
     {
       "category": "rule",
-      "checksum": "sha256:5bdcb01badd0faf96e0a1a56a487f7ae7d757526e7fdb4c36a75ddf4b0510519",
+      "checksum": "sha256:4e3fc01547374c7d76af3b02a77e0667ad10544c63c035ba34b78e90fedaee11",
       "install": {
         "default": true,
         "removable": false
@@ -5874,7 +5946,7 @@
     },
     {
       "category": "rule",
-      "checksum": "sha256:1b04f71b85e755fc0319ac67a0447919bb084019ade11c21a616bd3f6739a206",
+      "checksum": "sha256:2ffc4bd12a025affa1097dd9f67cdb0732efac53a97d7a0f6b65b4470974f81e",
       "install": {
         "default": true,
         "removable": false
@@ -6235,6 +6307,27 @@
         "engineering"
       ]
     },
+    {
+      "category": "rule",
+      "checksum": "sha256:0bac9f181f420e3262b44097ed2a192d0f71f40071aa3f7d7b39b798b2cf834b",
+      "install": {
+        "default": true,
+        "removable": false
+      },
+      "lifecycle": "active",
+      "packs": [
+        "engineering-base"
+      ],
+      "path": "src/rules/prefer-enums-over-literals.md",
+      "trust": {
+        "confidence": "high",
+        "human_review_required": false,
+        "level": "core"
+      },
+      "workspaces": [
+        "engineering"
+      ]
+    },
     {
       "category": "rule",
       "checksum": "sha256:f80fdd3259c50aac130892d9e147821a0275f5832c0d58817e2081fa342e736b",
@@ -6461,6 +6554,27 @@
         "engineering"
       ]
     },
+    {
+      "category": "rule",
+      "checksum": "sha256:cac72a508d3680861fdb81c7a62ea17e59c7e8564f92c8b1663c92db4d197381",
+      "install": {
+        "default": true,
+        "removable": false
+      },
+      "lifecycle": "active",
+      "packs": [
+        "engineering-base"
+      ],
+      "path": "src/rules/senior-engineering-discipline.md",
+      "trust": {
+        "confidence": "high",
+        "human_review_required": false,
+        "level": "core"
+      },
+      "workspaces": [
+        "engineering"
+      ]
+    },
     {
       "category": "rule",
       "checksum": "sha256:6bc6052a9c5230706a1d6e79e98b947aea690791c1f7915b99878e5bf6ba01a2",
@@ -7096,6 +7210,28 @@
         "agent-config-maintainer"
       ]
     },
+    {
+      "category": "skill",
+      "checksum": "sha256:54152dfc1fd9b0d269d1d60d4c7c036521de7685005c245cc30757e1f2513847",
+      "install": {
+        "default": true,
+        "removable": false
+      },
+      "lifecycle": "active",
+      "name": "ai-code-blindspots",
+      "packs": [
+        "engineering-base"
+      ],
+      "path": "src/skills/ai-code-blindspots/SKILL.md",
+      "trust": {
+        "confidence": "high",
+        "human_review_required": false,
+        "level": "core"
+      },
+      "workspaces": [
+        "engineering"
+      ]
+    },
     {
       "category": "skill",
       "checksum": "sha256:f40f6c16309f9b749e947f404344763d155f994e4b09b06a932a3517fa8604ab",
@@ -7296,7 +7432,7 @@
     },
     {
       "category": "skill",
-      "checksum": "sha256:b32785552236766bf5641710105d32a5aa79b9104b602364bfcd58f6ba1ad22d",
+      "checksum": "sha256:d3bf7c4c62cb48619aee3ded4d008d273708688566992206f53603410eb061bd",
       "install": {
         "default": true,
         "removable": false
@@ -8330,7 +8466,7 @@
     },
     {
       "category": "skill",
-      "checksum": "sha256:6d43cfc5df9f745b583d09c2b2204859ff18a6c06bb269e3a8d48eb7bb76fb69",
+      "checksum": "sha256:b1b597da66c9594e4ac58c8bc41373bbb6e4d1bd25b972cda434c02eab1d0725",
       "install": {
         "default": true,
         "removable": false
@@ -8944,6 +9080,28 @@
         "engineering"
       ]
     },
+    {
+      "category": "skill",
+      "checksum": "sha256:149996466060c6ab2214ffd0e1b5129cd62b655037ea3fab440ab2bb0ca33c3c",
+      "install": {
+        "default": true,
+        "removable": false
+      },
+      "lifecycle": "active",
+      "name": "frontend-render-security",
+      "packs": [
+        "engineering-base"
+      ],
+      "path": "src/skills/frontend-render-security/SKILL.md",
+      "trust": {
+        "confidence": "high",
+        "human_review_required": false,
+        "level": "core"
+      },
+      "workspaces": [
+        "engineering"
+      ]
+    },
     {
       "category": "skill",
       "checksum": "sha256:f1d5f7060b2252ff93e75a95773f6e84e5b83a182faebabff430f77650e768b1",
@@ -11608,7 +11766,7 @@
     },
     {
       "category": "skill",
-      "checksum": "sha256:66c7c7d8c94ab40537a0e8dbf39af7bc9f45dc4c1ce207b9b37589a806694489",
+      "checksum": "sha256:08320d5aa61763262860bab8fc5f137f808ed5cb795f3d90f75c4f66e99263c7",
       "install": {
         "default": true,
         "removable": false
@@ -11982,7 +12140,7 @@
     },
     {
       "category": "skill",
-      "checksum": "sha256:ce7bb5aa334783a058f320faf1dfb41aa70140d0a557be29d942ddc08898b239",
+      "checksum": "sha256:87eaa14cd95565d3c642e6e5a3ba1e26ac3b0ee1904e05f92c28ea9512c5dbc6",
       "install": {
         "default": true,
         "removable": false
@@ -12134,6 +12292,28 @@
         "agent-config-maintainer"
       ]
     },
+    {
+      "category": "skill",
+      "checksum": "sha256:3a3a2157368c778a5276fd14dc64055fdf02742a2f72d0639eb10c0dcc0446e8",
+      "install": {
+        "default": true,
+        "removable": false
+      },
+      "lifecycle": "active",
+      "name": "supply-chain-intake",
+      "packs": [
+        "engineering-base"
+      ],
+      "path": "src/skills/supply-chain-intake/SKILL.md",
+      "trust": {
+        "confidence": "high",
+        "human_review_required": false,
+        "level": "core"
+      },
+      "workspaces": [
+        "engineering"
+      ]
+    },
     {
       "category": "skill",
       "checksum": "sha256:fb616defc5389d3c921ae0f6554054ac3f6ed8c20f55d75c9452738b2cc57323",
@@ -12334,7 +12514,7 @@
     },
     {
       "category": "skill",
-      "checksum": "sha256:244c5db9cd5b7f40f1dfaac9a489973a22be9b7a6b2345370f3da75719a77d50",
+      "checksum": "sha256:0387d4a8a245a15a6a13b951b9721cf0f491dd11c4a66f604619ee480f9b407f",
       "install": {
         "default": true,
         "removable": false
@@ -12769,7 +12949,7 @@
       "workspaces": []
     }
   ],
-  "checksum": "sha256:373d4519debcdb5a39c065b83e496247480fc44a91aeb6f495ba5024f2a7192b",
+  "checksum": "sha256:236db1c9e47c8fb6c769af3954d78b738af4308cccd100d55683fbc64ed05fd1",
   "deprecations": [
     {
       "key": "tier",
@@ -12912,10 +13092,10 @@
       "reason": "scaffold template for ticket-bundle tickets (ADR-101); carries no runtime frontmatter — emit-tickets fills it in per ticket"
     }
   ],
-  "generated_at": "2026-07-08T14:10:55Z",
+  "generated_at": "2026-07-09T12:23:58Z",
   "packs": [
     {
-      "artefact_count": 95,
+      "artefact_count": 103,
       "description": "Framework-neutral engineering hygiene — git, tests, reviews.",
       "domain": "engineering",
       "human_review_required": 0,
@@ -12925,7 +13105,7 @@
       "trust_level_default": "core",
       "trust_summary": {
         "advisory": 0,
-        "core": 93,
+        "core": 101,
         "experimental": 1,
         "professional": 1,
         "restricted": 0
@@ -13685,26 +13865,26 @@
   "stats": {
     "by_category": {
       "command": 172,
-      "rule": 95,
-      "skill": 264,
+      "rule": 100,
+      "skill": 267,
       "subagent": 1,
       "template": 1
     },
     "by_lifecycle": {
-      "active": 517,
+      "active": 525,
       "archived": 0,
       "deprecated": 0,
       "experimental": 16
     },
     "by_trust_level": {
       "advisory": 8,
-      "core": 409,
+      "core": 417,
       "experimental": 20,
       "professional": 96,
       "restricted": 0
     },
     "documented_unassigned_count": 26,
-    "total_artefacts": 533,
+    "total_artefacts": 541,
     "unassigned_count": 0
   },
   "unassigned": [],

package/dist/discovery/discovery-manifest.json.sha256

@@ -1 +1 @@
-01ac916a948ce2e4232ae06f46e3c626f31a3e328c66904dbfd61ef731a13b1c  discovery-manifest.json
+312e96cd7419ad7db0a90c2a3d76784285c009e41656ee5f98353d9c9457a29f  discovery-manifest.json

package/dist/discovery/discovery-manifest.summary.md

@@ -1,8 +1,8 @@
 # Discovery Manifest — Summary
 
-- Generated: `2026-07-08T14:10:55Z`
+- Generated: `2026-07-09T12:23:58Z`
 - Scanner: `f36b5a348348`
-- Artefacts: **533**
+- Artefacts: **541**
 - Unassigned: **0**
 
 ## `engineering` — Engineering
@@ -11,7 +11,7 @@
 
 | Pack | Artefacts |
 |---|---|
-| `engineering-base` — Engineering Base | 95 |
+| `engineering-base` — Engineering Base | 103 |
 | `git` — Git | 4 |
 | `php` — PHP | 6 |
 | `laravel` — Laravel | 25 |