@event4u/agent-config 8.9.0 → 8.11.0

package/dist/agent-src/skills/authz-review/SKILL.md

@@ -50,8 +50,9 @@ Do NOT use when:
   [`judge-security-auditor`](../judge-security-auditor/SKILL.md)
 * The concern is PII leakage into logs specifically — route to
   [`data-flow-mapper`](../data-flow-mapper/SKILL.md). (Role-based field-level
-  output filtering IS access gating — it stays in scope here + the vertical-BOPLA
-  section of [`broken-access-control`](../../rules/broken-access-control.md).)
+  output filtering IS access gating — it stays in scope here; see
+  § Broken-access-control depth below and the
+  [`broken-access-control`](../../rules/broken-access-control.md) rule.)
 * The concern is implementing a control once identified — route to
   [`security`](../security/SKILL.md)
 
@@ -91,6 +92,62 @@ For every gap, answer:
 Do **not** list generic findings ("should use policies") — always anchor to a
 file:line and a specific actor who can reach the gap.
 
+## Broken-access-control depth
+
+Depth for the [`broken-access-control`](../../rules/broken-access-control.md)
+rule (migrated per P4 of `road-to-kernel-and-router.md`); the Iron Law and the
+three negative tests stay in the rule.
+
+Why this class dominates: the single most common — and most damaging — failure
+in real systems and in AI-written code is that you log in as one user and see
+another user's data. The login check passes, so the endpoint *feels* protected;
+the per-object ownership/tenant check is the separate line devs and AI omit —
+especially when the object id comes straight from the request. Broken Access
+Control is OWASP Web #1 (A01:2021) and API #1 (BOLA/IDOR), trivially
+scriptable, and a recurring real-world breach class — e.g. First American
+Financial (885M documents exposed via sequential ids with no ownership check).
+
+### Non-optional controls (every data-returning surface)
+
+- **Server-derived principal.** Ownership/tenant derived from the session/token, **never** from a request header/param/body the caller controls. A matching id in the request is not authorization.
+- **Ownership/tenant check on every request id** before returning data. `findById(params.id)` with no `where owner/tenant = currentPrincipal` is the canonical bug.
+- **Tenant-scoped by construction.** Every query on a tenant table carries the tenant predicate; prefer a base scope that injects it so a forgotten clause can't leak. (DSGVO: Mandantentrennung / Trennungskontrolle is a required TOM — a missing `tenant_id` filter is a compliance failure, not just a bug.)
+- **Response minimization.** Return only entitled fields — no `SELECT *` / full-object serialization leaking PII "because the model has it" (Art. 25(2)).
+- **Property-level authz (BOPLA / mass assignment).** Reject `role` / `user_id` / `tenant_id` / `is_admin` from the request body; explicit field allow-list, never whole-body binding.
+- **Role/field-level output filtering (vertical BOPLA).** *Which* fields a principal receives depends on role + business rules — a driver role must not receive `price`; an office role must not receive the boss's `offer`. Serialize via a **role-scoped output DTO**, never the raw model / `to_json()`; sensitive fields (`price`/`cost`/`margin`/`salary`/`discount`/`offer`/internal notes) default-deny per role.
+- **No guessable public ids** on sensitive resources — UUID/ULID, not sequential integers (turns one bug into full-DB enumeration).
+
+### Role-based field-level access — both directions (vertical BOPLA + BFLA)
+
+Object-ownership (above) is *horizontal* (may this principal touch this record). This is *vertical*: which **fields** and which **functions** a role may reach — the maintainer's case (driver ≠ price, office worker ≠ boss's offer). Depends on role + business rules, and **the server is the only boundary** — the frontend hiding a field does not protect it: the raw JSON on the wire is readable via `curl`/DevTools/a proxy (3Fun leak: a privacy toggle filtered only in the app; the server returned every user's location to a direct query).
+
+- **Read side (CWE-213 / Excessive Data Exposure).** Build the response from a **role-scoped output DTO** — never serialize the ORM model directly. Sensitive fields default-deny per role. A client `?fields=` selection is ergonomics, not authorization — intersect it server-side with the role's read-allowlist.
+- **Write side (CWE-915).** Bind input through a **role-scoped write-allowlist** — never the raw body. Read-allowed ≠ write-allowed: a role may *see* `status` but not *set* `status:"approved"`; two independent sets.
+- **Function level (BFLA, OWASP API #5).** A role must not reach a function/verb reserved for a higher role. Gate **every mutating verb** (POST/PUT/PATCH/DELETE), deny-by-default — not just the GET you were asked about. The admin button being hidden is not a control.
+- **Nested / GraphQL.** Field-level checks propagate to nested selections; a low-role token selecting a restricted field gets null/error, not data.
+- **Negative tests, per (role × sensitive field), both directions:** lower-role token → the field is **absent from the raw response body** (assert the body, not the UI); lower-role setting it on input → rejected/ignored, **verified by re-reading the persisted record**; every privileged verb → 403 for lower roles (403/404 on sensitive object reads).
+
+### Defense-in-depth (so one miss can't leak)
+
+Stack ≥2 independent layers on sensitive data — query-level ownership scoping, a centralized default-deny policy layer (a route with no policy is denied, not silently open), and DB row-level security as the backstop for a forgotten `WHERE tenant_id`. (Merged with the pre-existing Gotcha bullet "Defense-in-depth so one miss can't leak" below — that bullet carries the concrete RLS configuration and is the stronger, operative statement.)
+
+### GDPR / DSGVO — data protection by design
+
+A cross-user data leak violates **Art. 5(1)(f)** (integrity & confidentiality — a principle → higher fine tier), **Art. 25** (by design/default: default-deny + least privilege + response minimization), and **Art. 32** — which also **mandates a process for regularly testing effectiveness** of these controls (untested authz is a direct Art. 32 gap; hence the three negative tests are non-optional). A discovered live exposure is a **notifiable breach** (Art. 33, 72 h from discovery) — surface as "notify + remediate", never a silent patch. Data-protection context, not legal advice → [`privacy-review`](../privacy-review/SKILL.md), `domain-safety-pii`.
+
+### Backstop greps (authoring-time)
+
+```bash
+# Record fetched by request id with no owner/tenant predicate nearby (high-noise — a hit means read the line, not auto-fix)
+rg -n '(findById|find|findOne|get)\(\s*(req\.|request\.|params\.|\$request|\$id)'
+# Client-supplied tenant/user hint used as the scope (should come from the session)
+rg -n '(tenant|tenantId|user_id|userId)\s*=\s*(req|request|params|headers|query)\.'
+```
+
+The full authoring-time grep set (mass-assignment, raw-serialization, secrets) lives once in [`ai-code-blindspots`](../ai-code-blindspots/SKILL.md).
+
+A hit means read that line — is the ownership/tenant check present? Some are safe (already scoped); none should ship unchecked.
+
 ## Validation
 
 Before finalizing the report, confirm:

package/dist/agent-src/skills/blast-radius-analyzer/SKILL.md

@@ -164,7 +164,7 @@ does not execute code, run tests, or touch the network**.
 ## Gotcha
 
 * **Reflection / string-based dispatch** — `call_user_func`, event names as
-  strings, Laravel `resolve($classString)`. Grep the string too, not just the symbol.
+  strings, DI-container string lookups (Laravel `resolve($classString)`, NestJS `moduleRef.get()`). Grep the string too, not just the symbol.
 * **Dynamic column access** — `$model->{$field}` or query builder `->get([...])`
   with variable arrays. A column rename can leak through these.
 * **Trait / mixin fan-out** — overriding a method pulled in via trait affects

package/dist/agent-src/skills/bug-analyzer/SKILL.md

@@ -76,6 +76,12 @@ create new bugs. Quick patches mask underlying issues.
 
 ## Procedure: Analyze a bug
 
+1. **Inspect inputs and reproducers** — Pull every source named in *Input sources* (branch, Jira, Sentry, error string, user description) before forming a hypothesis.
+2. **Investigate root cause** — Run Phase 1 below; gather evidence, walk the stacktrace, consult engineering memory.
+3. **Find the pattern** — Run Phase 2; check for similar bugs elsewhere in the codebase.
+4. **Form and test a hypothesis** — Run Phase 3; write a failing test that reproduces the bug.
+5. **Fix and verify** — Run Phase 4; apply the minimal change, re-run the failing test plus the wider suite.
+
 ### Phase 1: Root Cause Investigation
 
 Gather all available evidence before forming any hypothesis:
@@ -122,7 +128,7 @@ This is especially important for:
 
 - Find **working examples** of similar code paths in the codebase.
 - Compare the broken path against the working reference.
-- Identify the **specific difference** that → the failure.
+- Identify the **specific difference** that causes the failure.
 - Check if the issue is isolated or part of a broader pattern.
 
 ### Phase 3: Hypothesis and Testing
@@ -135,11 +141,11 @@ This is especially important for:
   - Each fix reveals new shared state or coupling in a different place.
   - Fixes require "massive refactoring" to implement.
   - Each fix creates new symptoms elsewhere.
-- Common root → in this project:
+- Common root causes in this project:
   - **Missing validation** on external sync data (CSV, XML, JSON imports).
   - **Null values** from optional DB columns not handled.
   - **Type mismatches** between legacy DB columns and PHP code.
-  - **Race conditions** in multi-tenant DB switching.
+  - **Race conditions** in multi-tenant database switching.
   - **Missing fallbacks** when external services are unavailable.
 
 ### Phase 4: Implementation
@@ -177,18 +183,9 @@ For each code path, test these scenarios mentally:
 | **State** | Uninitialized state, partial updates, rollback failures |
 | **External** | Network timeout, API errors, malformed responses |
 
-### 3. Known bug patterns (PHP/Laravel)
+### 3. Known bug patterns
 
-- N+1 queries hidden in loops or accessors
-- Missing `->fresh()` after update when using same instance
-- Eloquent lazy loading in queued jobs (serialization issues)
-- `now()` timezone mismatches
-- Missing FK constraints allowing orphaned records
-- `DB::transaction()` with external side effects (emails, API calls)
-- Model events firing during seeding or migration
-- Off-by-one errors in pagination or date ranges
-- Silent exception swallowing (`catch (\Exception $e) {}`)
-- Floating point comparison for money/quantities
+→ PHP/Laravel bug-pattern catalogue: see [`php-debugging`](../php-debugging/SKILL.md).
 
 ### 4. Output format (proactive mode)
 
@@ -227,10 +224,10 @@ Focus on the "Bug fixes" attack questions: Is this the root cause or a symptom?
 |---|---|
 | "Should work now" | RUN the verification — confidence ≠ evidence |
 | "It's probably X, let me fix that" | "Probably" = guessing. Complete Phase 1 first |
-| "Quick fix for now" | Quick fixes mask root → and create technical debt |
+| "Quick fix for now" | Quick fixes mask root causes and create technical debt |
 | "I'll investigate later" | Later never comes. Investigate now |
 | "One more fix attempt" (after 2+) | 3+ failures = architectural problem. Stop and discuss |
-| "Issue is simple, don't need process" | Simple issues have root → too. Process is fast for simple bugs |
+| "Issue is simple, don't need process" | Simple issues have root causes too. Process is fast for simple bugs |
 | "Emergency, no time for process" | Systematic debugging is FASTER than guess-and-check thrashing |
 
 ## Output format
@@ -239,6 +236,12 @@ Focus on the "Bug fixes" attack questions: Is this the root cause or a symptom?
 2. Fix implementation or fix plan with specific files and changes
 3. Regression test covering the failure scenario
 
+## Verification examples
+
+- **Backend bug**: reproduce with `curl` against the failing route (or an `actingAs()` HTTP test) before and after the fix; assert the new response shape with `assertJsonPath`.
+- **Runtime bug**: place a `xdebug` breakpoint at the suspect frame, step through, and inspect the stack trace; for log-only repros, dump the failing variable with `dd(` once, then remove.
+- **Regression test**: add a test that reproduces the original failure first (red), then makes it green — never write the test post-fix from memory.
+
 ## Gotcha
 
 - Don't assume the stacktrace shows the root cause — it often shows the symptom. Trace backwards.

package/dist/agent-src/skills/character-consistency/evals/evals.json

@@ -0,0 +1,16 @@
+{
+  "skill": "character-consistency",
+  "_calibration": "Behavioural fixture (road-to-skill-eval-coverage Phase 2, default-surface). Deterministic assertions on a real output property where reliable; rubric pins the qualitative core as a known-limit (pass ratified in PR review, not a hidden judge). finding_floor n is a conservative floor, not a calibrated per-host number.",
+  "scenarios": [
+    {
+      "id": "keep-character-consistent",
+      "prompt": "Keep this recurring character consistent across a multi-scene story.",
+      "assertions": [
+        {
+          "kind": "rubric",
+          "criterion": "Pins a character bible (traits, voice, visual anchors) and checks each scene against it, flagging drift — not re-inventing per scene."
+        }
+      ]
+    }
+  ]
+}

package/dist/agent-src/skills/code-refactoring/SKILL.md

@@ -100,7 +100,7 @@ Run the project's type-checker and linter after each significant step — do NOT
 
 | Stack | Typical pipeline |
 |---|---|
-| Laravel / PHP | `vendor/bin/phpstan analyse` → `vendor/bin/rector process` → `vendor/bin/ecs check --fix` → re-run PHPStan |
+| Laravel / PHP | `vendor/bin/phpstan analyse` → `vendor/bin/rector process` → `vendor/bin/ecs check --fix` → re-run the static analyser |
 | TypeScript | `tsc --noEmit` → `eslint --fix` → `prettier --write` |
 | Python | `mypy` (or `pyright`) → `ruff check --fix` → `ruff format` |
 | Go | `go vet ./...` → `golangci-lint run --fix` → `gofmt -w` |
@@ -137,35 +137,35 @@ After the code changes are verified, update all affected documentation:
 ## Common refactoring patterns
 
 ### Rename (method, class, property)
-1. Find all usages → update all usages → update docs → run PHPStan → run tests.
+1. Find all usages → update all usages → update docs → run the static analyser → run tests.
 
 ### Extract method / class
-1. Create the new method/class → move logic → update caller → update docs → run PHPStan → run tests.
+1. Create the new method/class → move logic → update caller → update docs → run the static analyser → run tests.
 
 ### Move class to different namespace
-1. Move file → update namespace → find all `use` statements → update imports → update docs → run PHPStan.
+1. Move file → update namespace → find all `use` statements → update imports → update docs → run the static analyser.
 
 ### Change method signature
-1. Update the method → find all callers → update each caller → present test changes → update docs → run PHPStan.
+1. Update the method → find all callers → update each caller → present test changes → update docs → run the static analyser.
 
 ### Change API endpoint
 1. Update controller + request + resource + OpenAPI schemas + route → present test changes →
-   update docs (`agents/reference/docs/controller.md`, `agents/reference/docs/api-resources.md`) → run PHPStan → run tests.
+   update docs (`agents/reference/docs/controller.md`, `agents/reference/docs/api-resources.md`) → run the static analyser → run tests.
 
 ### Replace implementation (e.g. switch service)
 1. Create new implementation → update binding → find all direct references → update → present test
-   changes → update docs → run PHPStan → run tests → remove old implementation.
+   changes → update docs → run the static analyser → run tests → remove old implementation.
 
 ### Move/restructure module
 1. Move files → update namespaces → update `ModuleServiceProvider` if needed → update module routes →
-   update module agent docs → update project contexts → run PHPStan → run tests.
+   update module agent docs → update project contexts → run the static analyser → run tests.
 
 ## Safety rules
 
 - **Never skip the caller search** — missing a caller is the #1 cause of broken refactorings.
 - **Never remove old code before verifying** the new code works everywhere.
 - **Never change test expectations without user approval** — explain what changes and why first.
-- **Run PHPStan after every step**, not just at the end.
+- **Run the static analyser after every step** (PHPStan, `tsc --noEmit`, mypy — whichever the project runs), not just at the end.
 - **Run tests after every step**, not just at the end.
 - **Update docs after code changes** — stale docs are worse than no docs.
 - **Do NOT commit or push** — only apply local changes.

package/dist/agent-src/skills/command-routing/evals/evals.json

@@ -0,0 +1,14 @@
+{
+  "skill": "command-routing",
+  "_calibration": "Behavioural fixtures (road-to-skill-eval-coverage Phase 2, router set). Deterministic `contains` asserts the invocation routes to the matching command (its file/path) rather than improvising — a mis-route runs the wrong command or reinvents it.",
+  "scenarios": [
+    {
+      "id": "route-create-pr",
+      "prompt": "I typed /create-pr — what runs, and which command file governs it?",
+      "assertions": [
+        { "kind": "contains", "value": "create-pr" },
+        { "kind": "rubric", "criterion": "Routes to the create-pr command file (commands/pr/create) and follows it rather than improvising a PR-creation flow." }
+      ]
+    }
+  ]
+}

package/dist/agent-src/skills/content-funnel-design/SKILL.md

@@ -177,3 +177,5 @@ Mid-market HR analytics, funnel-analysis diagnosed mid-funnel leak (decision-sta
 - Leverage point — *mid-funnel proof*, because the decision-stage call is starved of conviction; structural ripple.
 - Pathway — *"How HR directors lose 7 hours per board-quarter"* (top) → *"Cohort-retention deep-dive vs. spreadsheet rebuild"* (mid) → *ROI calculator* (decision).
 - Hand-off → `editorial-calendar` re-allocates campaign weight to mid-funnel; `funnel-analysis` re-diagnoses at week 4.
+
+→ Final prose pass for audience-facing output: [`humanizer`](../humanizer/SKILL.md) — remove AI-writing tells before delivery.

package/dist/agent-src/skills/dashboard-design/evals/evals.json

@@ -0,0 +1,16 @@
+{
+  "skill": "dashboard-design",
+  "_calibration": "Behavioural fixture (road-to-skill-eval-coverage Phase 2, default-surface). Deterministic assertions on a real output property where reliable; rubric pins the qualitative core as a known-limit (pass ratified in PR review, not a hidden judge). finding_floor n is a conservative floor, not a calibrated per-host number.",
+  "scenarios": [
+    {
+      "id": "design-metrics-dashboard",
+      "prompt": "Design a metrics dashboard for our SaaS ops team.",
+      "assertions": [
+        {
+          "kind": "rubric",
+          "criterion": "Leads with the decisions the viewer must make, groups metrics by that, uses the right chart per data shape, and avoids vanity metrics."
+        }
+      ]
+    }
+  ]
+}

package/dist/agent-src/skills/data-flow-mapper/SKILL.md

@@ -140,7 +140,7 @@ Runtime confirmation (e.g. *"actually POST a request and log the payload"*,
   it. If you stop at persistence you missed half the trace.
 * **Silent type coercion** — framework middleware often casts strings to
   ints or trims whitespace. Mark these as explicit hops.
-* **Confusing validation with authorization** — a FormRequest-style validator
+* **Confusing validation with authorization** — a request-validation-layer validator (FormRequest in Laravel, zod schema in Node)
   is a validation hop, not an authorization hop. They are distinct.
 * **Tenancy scope on retrieval** — the write path was tenant-scoped; the read
   path joined on a global table and leaked. Check both directions.

package/dist/agent-src/skills/dcf-modeling/evals/evals.json

@@ -0,0 +1,20 @@
+{
+  "skill": "dcf-modeling",
+  "_calibration": "Behavioural fixture (road-to-skill-eval-coverage Phase 2, default-surface). Deterministic assertions on a real output property where reliable; rubric pins the qualitative core as a known-limit (pass ratified in PR review, not a hidden judge). finding_floor n is a conservative floor, not a calibrated per-host number.",
+  "scenarios": [
+    {
+      "id": "dcf-terminal-value-and-sensitivity",
+      "prompt": "DCF this target: year-6 FCFF $108M, WACC 10%, terminal growth 2%, net debt $200M. Give enterprise + equity value and the discount-rate sensitivity.",
+      "assertions": [
+        {
+          "kind": "contains",
+          "value": "WACC"
+        },
+        {
+          "kind": "rubric",
+          "criterion": "Computes Gordon terminal value = FCFF_{n+1}/(WACC−g) = 108/0.08 = 1350, bridges EV→equity via net debt, and includes a WACC/terminal-growth sensitivity grid — never a single point estimate."
+        }
+      ]
+    }
+  ]
+}

package/dist/agent-src/skills/decision-record/evals/evals.json

@@ -0,0 +1,20 @@
+{
+  "skill": "decision-record",
+  "_calibration": "Behavioural fixture (road-to-skill-eval-coverage Phase 2, default-surface). Deterministic assertions on a real output property where reliable; rubric pins the qualitative core as a known-limit (pass ratified in PR review, not a hidden judge). finding_floor n is a conservative floor, not a calibrated per-host number.",
+  "scenarios": [
+    {
+      "id": "record-adr",
+      "prompt": "Record our decision to adopt Postgres over MySQL as an ADR.",
+      "assertions": [
+        {
+          "kind": "contains",
+          "value": "Consequences"
+        },
+        {
+          "kind": "rubric",
+          "criterion": "Uses the ADR shape — Status / Context / Decision / Consequences / Alternatives — and states the trade-off given up, not only the choice."
+        }
+      ]
+    }
+  ]
+}

package/dist/agent-src/skills/defense-in-depth/SKILL.md

@@ -36,7 +36,7 @@ Do NOT use when:
 
 ### Step 1: Layer 1 — Entry-point validation
 
-Reject obviously invalid input at the API / route / command boundary. In Laravel this is FormRequest rules; in pure PHP services it is the public method on the service.
+Reject obviously invalid input at the API / route / command boundary. In Laravel this is FormRequest rules; in Express a zod-validated middleware; in pure services it is the public method on the service.
 
 ```php
 public function createProject(string $name, string $workingDirectory): Project
@@ -152,6 +152,6 @@ BEFORE adding the 5th guard:
 
 ## Provenance
 
-- Adopted from: an external reference (MIT, © 2025 an external reference).
+- Adopted from: an external reference (internal provenance, redacted).
 - Provenance registry: `agents/settings/contexts/skills-provenance.yml` (entry: `defense-in-depth`).
 - Iron-Law floor: `non-destructive-by-default`, `verify-before-complete`, `skill-quality`.

package/dist/agent-src/skills/dependency-upgrade/SKILL.md

@@ -85,7 +85,7 @@ pip list --outdated         # pip
 poetry show --outdated       # poetry
 uv pip list --outdated       # uv
 
-# Upgrade a specific package
+# Upgrade a specific package (same shape for composer require / npm install pkg@latest)
 pip install --upgrade package-name
 poetry update package-name
 uv pip install --upgrade package-name
@@ -230,17 +230,17 @@ When `composer require` or `npm install` fails with conflicts:
 
 ## Post-update malware & behavior audit
 
-CVE scanning (above) catches *known-vulnerable* versions. It does **not** catch a **compromised update**: a trusted package with a legitimate history ships a normal-looking version bump that quietly adds data-exfiltration or other harmful behavior. This is how the biggest supply-chain attacks landed — event-stream (wallet stealer as a new transitive dep), ua-parser-js (`preinstall` miner + credential stealer), @solana/web3.js (key exfil hidden inside expected network calls), chalk/debug + 16 (browser crypto-drainer, 2B weekly downloads), the self-propagating Shai-Hulud worm (added a `.github/workflows` + secret-scanning `postinstall`), xz-utils (backdoor in the released tarball, not the git repo). Routine updates slip through because the version looks normal and install runs scripts across the whole transitive tree silently — the exact [`lethal-trifecta-guard`](../../rules/lethal-trifecta-guard.md) egress shape.
+CVE scanning (above) catches *known-vulnerable* versions. It does **not** catch a **compromised update**: a trusted package with a legitimate history ships a normal-looking version bump that quietly adds data-exfiltration or other harmful behavior. This is how the biggest supply-chain attacks landed — event-stream (wallet stealer as a new transitive dep), ua-parser-js (`preinstall` miner + credential stealer), @solana/web3.js (key exfil hidden inside expected network calls), chalk/debug + 16 (browser crypto-drainer, 2B weekly downloads), the self-propagating Shai-Hulud worm (added a `.github/workflows` + secret-scanning `postinstall`), xz-utils (backdoor in the released tarball, not the git repo). Routine updates slip through because the version looks normal and install runs scripts across the whole transitive tree silently — this is the exact [`lethal-trifecta-guard`](../../rules/lethal-trifecta-guard.md) egress shape.
 
 **Run this audit during/after any add or upgrade, then surface findings to the user and hold pending confirmation** (per [`active-remediation`](../../rules/active-remediation.md) — a live supply-chain risk is surfaced, never silently accepted):
 
-1. **Install without running scripts first** — `npm install --ignore-scripts` (npm v12 defaults to this), `composer install --no-scripts`, `pip install --only-binary :all:` (wheels only — no sdist build code) — so install-time code (the #1 RCE vector) can't run before inspection.
-2. **Diff the version delta old→new** — the `scripts` block (any newly-added `pre/post/install` hook), the dependency tree (any **new transitive dependency**), and where feasible the published tarball vs the git source (xz hid in the tarball).
+1. **Install without running scripts first** — `npm install --ignore-scripts` (npm v12 defaults to this), `composer install --no-scripts`, `pip install --only-binary :all:` (wheels only — no sdist build code) — so install-time code (the #1 RCE vector) cannot run before inspection.
+2. **Diff the version delta old→new** — the `scripts` block (any newly-added `pre/post/install` hook), the dependency tree (any **new transitive dependency**), and — where feasible — the published tarball vs the git source (xz hid in the tarball).
 3. **Capability / behavior diff** — did the new version add a capability its job doesn't need: network egress (`fetch`/`net`/`dns`/`http`), `child_process`/shell, env/secret/credential reads, filesystem writes, obfuscated/minified blobs, a `.github/workflows` file? Use `socket` / `guarddog <eco> scan <pkg>@<ver>` if available; else read the delta.
 4. **Purpose-vs-behavior legitimacy check** — a Slack/HTTP client legitimately makes network calls; a date/string/color util does not. For each new capability ask: *does the package's stated purpose require this?* A network/secret capability with no purpose justification — or a **new outbound endpoint** even in a package that already uses the network — is high-risk.
-5. **Provenance + advisory feeds** — `npm audit signatures` (flag a dep that *had* provenance and lost it — a token-theft-publish hallmark); `osv-scanner --lockfile=…` and the GitHub Advisory / Socket / Snyk malware feeds against the newly-resolved versions.
+5. **Provenance + advisory feeds** — `npm audit signatures` (flag a dep that *had* provenance and lost it — a hallmark of a token-theft publish); `osv-scanner --lockfile=…` and the GitHub Advisory / Socket / Snyk malware feeds against the newly-resolved versions.
 
-**Surface to the user** any: new install script · new transitive dep · new network endpoint / secret read · obfuscated blob · lost provenance · advisory/malware hit — with the version delta + the purpose-vs-behavior verdict, and hold the update until they decide. Never auto-accept a bump that introduced an unexplained capability.
+**Surface to the user** any: new install script · new transitive dep · new network endpoint / secret read · obfuscated blob · lost provenance · advisory/malware hit — with the version delta and the purpose-vs-behavior verdict, and hold the update until they decide. Never auto-accept a bump that introduced an unexplained capability.
 
 ## Output format
 
@@ -266,7 +266,7 @@ CVE scanning (above) catches *known-vulnerable* versions. It does **not** catch
 - Don't upgrade multiple major versions at once — one major version per upgrade cycle.
 - The model tends to skip reading the CHANGELOG — breaking changes hide in minor releases too.
 - Always run the full test suite after upgrading, not just the affected tests.
-- Lock file conflicts after upgrade are expected — resolve by re-running `composer update`.
+- Lock file conflicts after upgrade are expected — resolve by re-running the package manager's update (`composer update`, `npm update`, `poetry update`).
 
 ## Do NOT
 

package/dist/agent-src/skills/design-intelligence/SKILL.md

@@ -135,14 +135,14 @@ config, not a vibe — never re-infer when `DESIGN.md` already sets them
 Dials persist in `DESIGN.md`; the stack executors (`tailwind-engineer`,
 `react-shadcn-ui`, `blade-ui`, `flux`) read `DESIGN.md` and honour them.
 
-**Anti-Default Discipline — first-impulse check:** Before committing to any design direction, verify you are NOT defaulting to:
-- Purple/violet + cyan-on-dark gradient palette (AI color cliché)
-- Centered hero over a dark gradient mesh with a single CTA
-- Three equal-weight feature cards in a grid
-- Inter or Space Grotesk as the uncritical body font choice
-- "Premium consumer" cream/sand background + brass/clay accents
-
-If any of these was the first impulse, name a different direction or explicitly justify why this brief genuinely calls for it.
+**Anti-Default Discipline — first-impulse check:** Before committing to any
+design direction, cross-check your first impulse against the current-generation
+tells in [`design-antipatterns.md`](../../../docs/guidelines/design-antipatterns.md)
+(§ Current-generation tells — the warm-editorial C5+T2+T7 signature and the
+previous-generation C1/C2 gradient) plus the L1/L2 layout defaults. If a tell was
+your first reach, name a different direction or explicitly justify why this brief
+genuinely calls for it. (The finalization cross-check against the full catalog is
+under *Anti-slop discipline* below.)
 
 ## Honesty / real-system grounding
 

package/dist/agent-src/skills/design-intelligence/evals/evals.json

@@ -0,0 +1,14 @@
+{
+  "skill": "design-intelligence",
+  "_calibration": "Behavioural fixtures (road-to-skill-eval-coverage Phase 2, rich set). Deterministic `contains` asserts the WCAG-checked-token property the skill promises; the rubric (pinned-judge known-limit) checks the corpus-grounding — a grounded brief names a concrete style/palette/type decision, not arbitrary taste.",
+  "scenarios": [
+    {
+      "id": "grounded-brief-fintech-dashboard",
+      "prompt": "Give me a grounded design brief (style, color tokens, typography, layout pattern) for a serious fintech analytics dashboard. Justify the palette's contrast.",
+      "assertions": [
+        { "kind": "contains", "value": "WCAG" },
+        { "kind": "rubric", "criterion": "Selects a concrete named style/archetype + a specific palette and type pairing grounded in the design corpus (not arbitrary), and states at least one anti-pattern to avoid." }
+      ]
+    }
+  ]
+}

package/dist/agent-src/skills/design-review/SKILL.md

@@ -13,6 +13,12 @@ packs:
 
 ## When to use
 
+> **Render-verification gate.** A UI verdict is gated on the
+> [design-artifact verification checklist](../../../docs/contracts/design-artifact-verification.md#verification-checklist):
+> where render capability exists, do not pass a design task without render
+> evidence (checklist steps 1–5); where it is absent, scope the verdict to what
+> was statically checked and say so — never "looks good" without evidence.
+
 Use this skill when:
 - Reviewing pull requests with UI changes
 - Auditing frontend components for design quality
@@ -52,9 +58,21 @@ A **live preview URL** is required for testing.
 ### Phase 1: Interaction
 
 - Test user flows end-to-end.
-- Verify hover, focus, active, and disabled states.
+- **Six interaction states — every interactive element asserts each one** (single
+  canonical states checklist; no other review phase repeats it):
+  1. **default** — resting state is a deliberate style, not the browser default.
+  2. **hover** — pointer feedback present (not the *only* affordance — see focus).
+  3. **active** — pressed/engaged state visibly distinct from hover.
+  4. **disabled** — unmistakably non-interactive (a contrast dip a user cannot read
+     as "disabled" is a WCAG 1.4.1 failure — see `accessibility-auditor`).
+  5. **focus** — visible `:focus-visible` indicator (Q6 floor, `lint_design_quality`).
+  6. **loading** — explicit pending state (skeleton/spinner/disabled-submit), never a dead frozen control.
+- **Transition timing** between these states follows the motion bands in
+  [`fe-design`](../fe-design/SKILL.md) § Motion (micro-feedback ~100–200 ms;
+  structural open/close ~200–500 ms) — the timing source of truth; do not restate
+  a competing band set here. Every animated transition carries a
+  `prefers-reduced-motion` alternative (M5 / Q4).
 - Test keyboard navigation (Tab, Enter, Escape, Arrow keys).
-- Check loading states and transitions.
 - Verify form submission and error recovery.
 
 ### Phase 2: Responsiveness
@@ -291,6 +309,15 @@ dispatch it via [`subagent-orchestration`](../subagent-orchestration/SKILL.md)
 and position it against [`verify-repair-loop`](../verify-repair-loop/SKILL.md)
 (the existing verify skill); it complements them, it does not duplicate them.
 
+**Why the audit passes stay serial (not a parallel-4 fan-out).** A fan-out of
+a11y + slop + hierarchy + states across four subagents was evaluated and
+deferred: the passes share one live browser/navigation session and later phases
+build on state established by earlier ones — not cleanly independent; and the
+expensive part (browser probing / screenshots) is already offloaded by the async
+verifier above, which captures the fan-out's main win without four separate
+views. Reconsider only when `design-review` runs as a standalone heavy batch over
+many *independent* surfaces, where per-surface `do-in-parallel` genuinely pays.
+
 ## Gotcha
 
 - Don't review design without understanding the user's constraints (time, resources, scope).

package/dist/agent-src/skills/design-system-capture/SKILL.md

@@ -276,6 +276,27 @@ Fidelity declaration is load-bearing: hi-fi vs lo-fi tells the dev whether to
 recreate the mockup pixel-for-pixel or apply the existing system — the single
 most common handoff ambiguity.
 
+## Design-system extraction floor
+
+When the goal is to extract this repo's design system as a **reusable package
+artifact** (not just DESIGN.md prose), the extraction meets this floor — the
+handoff shape emitted alongside `design-system.json`
+([import contract](reference/design-system-json.md)).
+
+- **Contract contents.** A complete extraction carries: a root guide / manifest;
+  token CSS (or the stack's equivalent); the typography / colour / spacing /
+  iconography foundations; component specimens; an asset inventory (logos, icons,
+  fonts); UI-kit screens; and starting-point templates where appropriate.
+- **Specimen granularity.** Many small foundation cards beat one dense dump —
+  each specimen demonstrates ONE reusable sub-concept (a single button state,
+  one spacing step, one elevation level), so a consumer lifts concepts
+  individually rather than parsing a monolith.
+- **Developer handoff bundle** (extends § Design→dev handoff README): a
+  high-fidelity reference, behaviour notes, the assets list, the component
+  mapping (design name → code component), responsive states, known caveats, and
+  — when the artifact is a mock — an explicit "prototype, not production code"
+  warning so a consumer never ships the reference verbatim.
+
 ## Gotcha
 
 - **Over-writing instead of diff-updating** — the most common failure.

package/dist/agent-src/skills/design-system-capture/evals/evals.json

@@ -0,0 +1,15 @@
+{
+  "skill": "design-system-capture",
+  "_calibration": "Behavioural fixtures (road-to-skill-eval-coverage Phase 2, rich set). Deterministic `contains` asserts the two artifacts the skill's contract maintains (DESIGN.md + PRODUCT.md); the rubric checks it captures decisions rather than re-describing generic guidance.",
+  "scenarios": [
+    {
+      "id": "capture-from-repo",
+      "prompt": "Capture this project's design system so future sessions stay consistent: it uses a 4px spacing grid, 8px radius, a spring motion strategy, and a blue primary. Where do these decisions go?",
+      "assertions": [
+        { "kind": "contains", "value": "DESIGN.md" },
+        { "kind": "contains", "value": "PRODUCT.md" },
+        { "kind": "rubric", "criterion": "Routes the visual decisions (spacing/radius/motion/color) into DESIGN.md and interaction patterns into PRODUCT.md, and flags any TBD rather than inventing values." }
+      ]
+    }
+  ]
+}

package/dist/agent-src/skills/developer-like-execution/evals/evals.json

@@ -0,0 +1,16 @@
+{
+  "skill": "developer-like-execution",
+  "_calibration": "Behavioural fixture (road-to-skill-eval-coverage Phase 2, default-surface). Deterministic assertions on a real output property where reliable; rubric pins the qualitative core as a known-limit (pass ratified in PR review, not a hidden judge). finding_floor n is a conservative floor, not a calibrated per-host number.",
+  "scenarios": [
+    {
+      "id": "execute-like-dev",
+      "prompt": "Implement this small change end-to-end the way a senior would.",
+      "assertions": [
+        {
+          "kind": "rubric",
+          "criterion": "Reads before editing, keeps the diff minimal + scoped, updates downstream callers/tests, and verifies with a real run before claiming done."
+        }
+      ]
+    }
+  ]
+}

package/dist/agent-src/skills/doc-coauthoring/SKILL.md

@@ -13,6 +13,12 @@ packs:
 
 ## When to use
 
+> **Cross-surface handoff.** When this document consumes upstream work (research
+> → document, spreadsheet → report), read the handoff envelope from
+> [`surface-agent-contracts`](../../../docs/contracts/surface-agent-contracts.md#cross-surface-handoff-envelope):
+> trust `verification_already_done`, honour source restrictions, and don't
+> re-fetch what the source already grounded.
+
 Use this skill when:
 
 * User starts a substantial writing task — PRD, RFC, design doc, decision doc, technical spec, proposal
@@ -40,6 +46,27 @@ Move from a fuzzy ask to a complete document the user owns, by:
 * `save-file` and `str-replace-editor` available
 * Target path and filename agreed up front
 
+## Document format & export floor
+
+The document surface's floor (per
+[`surface-agent-contracts`](../../../docs/contracts/surface-agent-contracts.md)):
+
+- **Choose the format by intent.** Markdown vs `.docx` vs PDF follows what the
+  user will DO with it — when a named format is requested, produce THAT format
+  via the document tooling; never silently substitute markdown for a `.docx`
+  request. (fixture: `ssac-docx-requested-markdown-only`.)
+- **Preserve edit scope.** On an edit, change only what was asked and preserve
+  the rest of the document (mirrors
+  [`minimal-safe-diff`](../../rules/minimal-safe-diff.md)).
+- **Print/PDF preserves selectable text.** Never rasterize a text-heavy document
+  to an image-only PDF when browser print or native export keeps the text
+  selectable. (fixture: `ssac-pdf-screenshot-rasterized`.)
+- **Verify the output opens/exports.** Confirm the generated file opens /
+  round-trips
+  ([`design-artifact-verification`](../../../docs/contracts/design-artifact-verification.md));
+  where the format's tooling is absent, ship the source + say what could not be
+  verified rather than claiming a produced file.
+
 ## Procedure
 
 ### 0. Inspect existing material
@@ -131,3 +158,5 @@ Apply the [Frugality Charter](../../contexts/contracts/frugality-charter.md).
 * Reprint the whole doc on every iteration
 * Declare "done" without the Stage 3 reader test
 * Generate doc content from scratch when the user has existing context — gap-closing is the whole point
+
+→ Final prose pass for audience-facing output: [`humanizer`](../humanizer/SKILL.md) — remove AI-writing tells before delivery.

package/dist/agent-src/skills/doc-coauthoring/evals/evals.json

@@ -0,0 +1,16 @@
+{
+  "skill": "doc-coauthoring",
+  "_calibration": "Behavioural fixture (road-to-skill-eval-coverage Phase 2, default-surface). Deterministic assertions on a real output property where reliable; rubric pins the qualitative core as a known-limit (pass ratified in PR review, not a hidden judge). finding_floor n is a conservative floor, not a calibrated per-host number.",
+  "scenarios": [
+    {
+      "id": "coauthor-prd",
+      "prompt": "Help me write the PRD for our new onboarding flow.",
+      "assertions": [
+        {
+          "kind": "rubric",
+          "criterion": "Runs the 3-stage flow — context → section-by-section → reader-test — rather than dumping a full doc; asks for the missing context first."
+        }
+      ]
+    }
+  ]
+}