@event4u/agent-config 9.7.0 → 9.9.0

package/docs/skills-catalog.md

@@ -1,265 +0,0 @@
-# Skills Catalog
-
-All **251 skills** available in this package, in alphabetical order.
-Click a skill name to open its SKILL.md and read the full guidance.
-
-> **Regenerate:** `./scripts-run src/scripts/generate_catalog`
-> This file is auto-generated from `SKILL.md` frontmatter — do not edit manually.
-
-| Skill | What your agent learns |
-|---|---|
-| [`accessibility-auditor`](../dist/agent-src/skills/accessibility-auditor/SKILL.md) | Use when reviewing UI for accessibility — WCAG 2.2 AA, keyboard nav, focus, ARIA, contrast, screen-reader semantics — even on 'is this a11y-OK?' or 'mach das barrierefrei'. |
-| [`activation-design`](../dist/agent-src/skills/activation-design/SKILL.md) | Use when defining or auditing the activation event — aha-moment selection, retention correlation, falsifiable definition. Triggers on 'what is our aha moment', 'redefine activation'. |
-| [`adr-create`](../dist/agent-src/skills/adr-create/SKILL.md) | Use when capturing an architectural decision — naming the file, picking the next ADR number, filling Status / Context / Decision / Consequences, and regenerating the index — even without saying 'ADR'. |
-| [`adversarial-review`](../dist/agent-src/skills/adversarial-review/SKILL.md) | ONLY when user requests adversarial review, devil's advocate, stress-test, OR honest critique of finished work ('poke holes', 'be brutal', 'was hältst du davon') — NOT for routine code/design review. |
-| [`agent-docs-writing`](../dist/agent-src/skills/agent-docs-writing/SKILL.md) | Use when reading, creating, or updating agent documentation, module docs, roadmaps, or AGENTS.md. Understands the full .augment/, agents/, and copilot-instructions structure. |
-| [`agent-security-review`](../dist/agent-src/skills/agent-security-review/SKILL.md) | Use for an adversarial red-team / blue-team / auditor review of an AI agent's CONFIG + behaviour (rules, skills, MCP, hooks, permissions) — attack-chain → defensive-gap list, not a code audit. |
-| [`agents-md-thin-root`](../dist/agent-src/skills/agents-md-thin-root/SKILL.md) | Use when editing AGENTS.md (package root) or templates/AGENTS.md (consumer) — enforces Thin-Root contract: hard char ceilings, ≥40% pointer ratio, mandatory emergency-triage block. |
-| [`ai-council`](../dist/agent-src/skills/ai-council/SKILL.md) | Use when polling external AIs (OpenAI, Anthropic) outside the host session for a neutral second opinion on a roadmap, diff, prompt, or file set — or 'cross-check with another model'. |
-| [`analysis-autonomous-mode`](../dist/agent-src/skills/analysis-autonomous-mode/SKILL.md) | ONLY when user explicitly requests autonomous analysis, deep investigation, multi-step research, or 'dig into this end-to-end without asking me each step' — NOT for normal feature work. |
-| [`analysis-skill-router`](../dist/agent-src/skills/analysis-skill-router/SKILL.md) | Use when picking which analysis or project-analysis-* skill fits a request — routes by scope, framework, and symptom — even if the user just says 'analyze this' or 'dig into the codebase'. |
-| [`api-design`](../dist/agent-src/skills/api-design/SKILL.md) | Use when designing APIs, planning endpoints, REST conventions, versioning, or deprecation — even when the user just says 'expose this as an endpoint' without naming API design. |
-| [`api-endpoint`](../dist/agent-src/skills/api-endpoint/SKILL.md) | Use when creating an API endpoint or HTTP route handler — detects the project stack and routes to the matching carve-out (laravel-api-endpoint, nextjs-patterns, symfony-workflow). |
-| [`api-testing`](../dist/agent-src/skills/api-testing/SKILL.md) | Use when writing API endpoint tests — integration tests, contract validation, response assertions, mocked external services — even when the user says 'test this route' without naming API testing. |
-| [`architecture-review-lens`](../dist/agent-src/skills/architecture-review-lens/SKILL.md) | Use when a diff may break system boundaries, dependency direction, or cross-service contracts — fifth judge dispatched by /review-changes alongside the four standard judges. |
-| [`artisan-commands`](../dist/agent-src/skills/artisan-commands/SKILL.md) | Use when creating or modifying Artisan commands. Covers clear signatures, safe execution flow, helpful output, and project conventions for console tooling. |
-| [`async-python-patterns`](../dist/agent-src/skills/async-python-patterns/SKILL.md) | Use when writing Python asyncio code — picking between gather / TaskGroup / wait, structured concurrency, timeouts, cancellation, sync-bridging — decision framework only, cookbook externalized. |
-| [`authz-review`](../dist/agent-src/skills/authz-review/SKILL.md) | Use when reviewing authorization end-to-end — route → gate → policy → query scope → response filter — before changes to permissions, tenants, ownership, or admin flows. |
-| [`aws-infrastructure`](../dist/agent-src/skills/aws-infrastructure/SKILL.md) | Use when working with AWS resources — ECS Fargate, ECR, EFS, Secrets Manager, gomplate templates, multi-env deployments — even when the user says 'deploy to staging' without naming AWS. |
-| [`blade-ui`](../dist/agent-src/skills/blade-ui/SKILL.md) | Use when the project's frontend stack is Blade — dispatched by `directives/ui/{apply,review,polish}.py`. Covers views, components, partials, layouts, and view logic. |
-| [`blameless-post-mortem`](../dist/agent-src/skills/blameless-post-mortem/SKILL.md) | Use after an incident or outage is resolved — blame-free facilitation, root cause, corrective actions, memory write-back — even for a near-miss. Consumes the incident-commander skeleton. |
-| [`blast-radius-analyzer`](../dist/agent-src/skills/blast-radius-analyzer/SKILL.md) | Use BEFORE editing shared code — enumerates every call site, event consumer, queue worker, API client, migration, and test that a planned change will touch, with a file:line citation per dependency. |
-| [`brand`](../dist/agent-src/skills/brand/SKILL.md) | Grounded brand decisions from a curated corpus — archetype, voice, naming, colour psychology, logo-style fit, messaging frameworks, archetype→type mapping. Use to ground brand strategy and identity. |
-| [`brand-asset-generation`](../dist/agent-src/skills/brand-asset-generation/SKILL.md) | Generate brand assets — banners, social cards, CIP elements — with brand-token injection + provider routing. Use when generating a banner / social image / branded asset. |
-| [`brand-audit`](../dist/agent-src/skills/brand-audit/SKILL.md) | Audit how a brand is currently expressed across touchpoints and flag drift from its defined tokens, voice, and strategy. Use to inventory and critique an existing brand before changing it. |
-| [`brand-identity`](../dist/agent-src/skills/brand-identity/SKILL.md) | Define a brand identity constraint set from a confirmed strategy — colour story, type story, logo direction, imagery direction. Defines the tokens that token emission and asset generation consume. |
-| [`brand-strategy`](../dist/agent-src/skills/brand-strategy/SKILL.md) | Ground a brand strategy from the corpus — archetype, opposable positioning, voice and tone, messaging framework. Use to decide who a brand is for, what it stands for, and how it sounds. |
-| [`brand-to-tokens`](../dist/agent-src/skills/brand-to-tokens/SKILL.md) | Derive a DTCG .tokens.json source of truth from confirmed brand decisions, emit CSS vars + Tailwind via design-tokens, and export locked brand deck templates. Use to turn a brand identity into tokens. |
-| [`bug-analyzer`](../dist/agent-src/skills/bug-analyzer/SKILL.md) | Use when the user shares a Sentry error, Jira bug ticket, or error description and wants root cause analysis. Also for proactive bug hunting and code audits for hidden bugs. |
-| [`build-buy-partner`](../dist/agent-src/skills/build-buy-partner/SKILL.md) | Use when deciding insource vs outsource vs acquire — integration-cost analysis, dependency-risk, optionality preservation. Triggers on 'should we build', 'buy vs partner'. |
-| [`canvas-design`](../dist/agent-src/skills/canvas-design/SKILL.md) | Use when creating static visual art — posters, marketing visuals, brand assets, PDF/PNG design pieces — even if the user just says 'design a poster' or 'mach uns ein Visual'. |
-| [`character-consistency`](../dist/agent-src/skills/character-consistency/SKILL.md) | Use when a character must stay visually identical across AI video scenes — locks identity tokens (silhouette, palette, wardrobe, prop) in JSON. Triggers 'character lock', 'same character'. |
-| [`check-refs`](../dist/agent-src/skills/check-refs/SKILL.md) | Use when verifying cross-references between skills, rules, commands, guidelines, and context documents are not broken after edits, renames, or deletions. |
-| [`churn-prevention`](../dist/agent-src/skills/churn-prevention/SKILL.md) | Use when designing churn defence — health-score signals, churn-cause split (involuntary / value / relationship / fit), early-warning loop. Triggers on 'why are accounts leaving'. |
-| [`code-refactoring`](../dist/agent-src/skills/code-refactoring/SKILL.md) | Use when the user says 'refactor this', 'rename class', or 'move method'. Safely refactors code in any language — finds all callers, updates downstream dependencies, verifies via quality tools. |
-| [`code-review`](../dist/agent-src/skills/code-review/SKILL.md) | Use when the user says \"review this\", \"check my code\", or wants feedback on changes. Reviews for correctness, quality, security, and coding standards. |
-| [`command-routing`](../dist/agent-src/skills/command-routing/SKILL.md) | Use when the user invokes a slash command like /create-pr, /commit, /fix-ci, or pastes command file content — routes to the right command with context inference and GitHub API patterns. |
-| [`command-writing`](../dist/agent-src/skills/command-writing/SKILL.md) | Use when creating or editing a slash command in src/agent-src/commands/ — frontmatter, numbered steps, safety gates — even when the user just says 'add a /command for X'. |
-| [`comp-banding`](../dist/agent-src/skills/comp-banding/SKILL.md) | Use when designing levels, comp bands, equity-vs-cash, geo adjustments, or raise vs promotion vs market correction. Triggers on 'set our comp bands', 'is this raise market'. |
-| [`competitive-moat-analysis`](../dist/agent-src/skills/competitive-moat-analysis/SKILL.md) | Use when mapping competitors, naming defensibility, and finding white-space — moat reasoning, where-to-play, where-not-to-play. Triggers on 'who are we competing with', 'what's our moat'. |
-| [`competitive-positioning`](../dist/agent-src/skills/competitive-positioning/SKILL.md) | Use when comparing this package to a peer / competitor — ours-vs-theirs verdict table, axis selection, adoption queue. Triggers on 'how do we compare to X', 'should we adopt their pattern'. |
-| [`complexity-first-planning`](../dist/agent-src/skills/complexity-first-planning/SKILL.md) | Use when staging multi-component or uncertain work — tackle the load-bearing unknown first (risk-first decomposition), not the easy parts first. |
-| [`composer-packages`](../dist/agent-src/skills/composer-packages/SKILL.md) | Use when building or maintaining a Composer library — versioning, Laravel integration, autoloading, publishing to private registries — even when the user says 'release a new version'. |
-| [`condense-memory`](../dist/agent-src/skills/condense-memory/SKILL.md) | Use when shrinking always-loaded memory files (AGENTS.md, CLAUDE.md, .cursorrules) via telegraph grammar — refuses sensitive paths, round-trips via .original.md backup. |
-| [`content-funnel-design`](../dist/agent-src/skills/content-funnel-design/SKILL.md) | Use when mapping funnel-stage to content shape — conversion-pathway, content-as-system, leverage-point selection. Triggers on 'design our content funnel', 'why does mid-funnel leak'. |
-| [`context-authoring`](../dist/agent-src/skills/context-authoring/SKILL.md) | Use when filling in knowledge-layer context files — auth-model, tenant-boundaries, data-sensitivity, deployment-order, observability — interactive walkthrough that turns templates into reviewer fuel. |
-| [`context-document`](../dist/agent-src/skills/context-document/SKILL.md) | Use when the user says \"create context\", \"document this area\", or wants a structured snapshot of a codebase area for agent orientation. |
-| [`contracts-cognition`](../dist/agent-src/skills/contracts-cognition/SKILL.md) | Use when reading a contract for risk and constraint — clause shape, redline priority, what the contract actually binds. Triggers on 'review this contract', 'what does this MSA constrain'. |
-| [`conventional-commits-writing`](../dist/agent-src/skills/conventional-commits-writing/SKILL.md) | Use when writing commit messages or squash-merge titles — `feat:`, `fix:`, `chore:`, scopes, breaking changes — even when the user just says 'commit this' without naming Conventional Commits. |
-| [`copilot-agents-optimization`](../dist/agent-src/skills/copilot-agents-optimization/SKILL.md) | Use when optimizing AGENTS.md or copilot-instructions.md — deduplicates against .augment/ content, enforces line budgets, and focuses each file on its audience. |
-| [`copilot-config`](../dist/agent-src/skills/copilot-config/SKILL.md) | Tune the GitHub Copilot AI — `copilot-instructions.md`, PR-review patterns, suggestion behavior, output verbosity. NOT for dev-environment setup (use `devcontainer`). |
-| [`corpus-grounding`](../dist/agent-src/skills/corpus-grounding/SKILL.md) | Shared corpus-grounding engine — BM25 + structured filters + decision rules over CSV corpora via a domain manifest. Use when a skill needs grounded pre-action option-space constraints. |
-| [`customer-research`](../dist/agent-src/skills/customer-research/SKILL.md) | Use when shaping a discovery slice — JTBD-framed interview guide, switch-event focus, verbatim quotes not summaries. Triggers on 'talk to users', 'why did they cancel', 'before we build X'. |
-| [`dashboard-design`](../dist/agent-src/skills/dashboard-design/SKILL.md) | Use when designing monitoring dashboards — visualization selection, layout principles, observability strategies (RED/USE/Golden Signals), and data storytelling. |
-| [`data-flow-mapper`](../dist/agent-src/skills/data-flow-mapper/SKILL.md) | Use BEFORE editing code that touches user data — traces the value from entry → validation → transformation → storage → egress, every hop cited with file:line. |
-| [`data-handling-judgment`](../dist/agent-src/skills/data-handling-judgment/SKILL.md) | Use when classifying data, setting retention, judging cross-border transfer, or shaping DSR workflow. Triggers on 'how long do we keep this', 'can this data go to the US'. |
-| [`database`](../dist/agent-src/skills/database/SKILL.md) | Use when working with database architecture, MariaDB/MySQL tuning, indexing strategies, slow queries, or multi-connection patterns — even when the user just says 'this query is slow'. |
-| [`dcf-modeling`](../dist/agent-src/skills/dcf-modeling/SKILL.md) | Wing-4 valuation cognition for a CFO / finance-partner. Use when a deal, internal investment, or board ask names DCF, intrinsic value, WACC, terminal value, or 'what's it worth on a 5-year hold'. |
-| [`deal-qualification-meddic`](../dist/agent-src/skills/deal-qualification-meddic/SKILL.md) | Use when qualifying or disqualifying a single deal — MEDDIC slots with evidence, inversion test, disqualification heuristic. Triggers on 'is this deal real', 'should we walk away'. |
-| [`decision-record`](../dist/agent-src/skills/decision-record/SKILL.md) | Use when choosing between alternatives with trade-offs — X-or-Y decisions (pattern vs pattern, strategy vs strategy) — frames options · trade-offs · consequences; ADR draft via `adr-create`. |
-| [`decision-review`](../dist/agent-src/skills/decision-review/SKILL.md) | Use to audit a past architectural decision — did the chosen option hold up, what assumptions drifted, should the ADR be superseded? Backward review only; does not lock new choices. |
-| [`deep-reading-analyst`](../dist/agent-src/skills/deep-reading-analyst/SKILL.md) | Deep analysis of articles/long-form via thinking frameworks (SCQA, mental models, inversion) — 'analyze article', 'deep dive', 'extract insights', URL/text wanting depth not summary. |
-| [`defense-in-depth`](../dist/agent-src/skills/defense-in-depth/SKILL.md) | Use when validation needs entry, business-logic, environment, and instrumentation guards so a bad value cannot reach the failure point — turns a local bug fix into a structural one. |
-| [`dependency-upgrade`](../dist/agent-src/skills/dependency-upgrade/SKILL.md) | Use when upgrading dependencies — 'update framework X', 'bump runtime version', or 'upgrade packages'. Covers changelog review, breaking-change detection, and verification. Stack-agnostic. |
-| [`description-assist`](../dist/agent-src/skills/description-assist/SKILL.md) | Use when polishing a skill/rule/command/guideline frontmatter description — pushier phrasing, trigger coverage, undertrigger audit — even if the user just says 'make this pushier'. |
-| [`design-intelligence`](../dist/agent-src/skills/design-intelligence/SKILL.md) | Grounded design brief from the adopted corpus — style, WCAG-checked color tokens, typography, layout pattern, anti-patterns. Use on ui-design-brief or any which-style/palette/font/chart decision. |
-| [`design-review`](../dist/agent-src/skills/design-review/SKILL.md) | Use when the user says \"review the design\", \"check the UI\", or wants a comprehensive UI/UX review. Uses a 7-phase methodology covering interaction, responsiveness, accessibility, and more. |
-| [`design-tokens`](../dist/agent-src/skills/design-tokens/SKILL.md) | Author a 3-layer DTCG token system (primitive → semantic → component) with light/dark theming; generate CSS vars + Tailwind colors and lint hardcoded values. Use on design tokens / CSS variables. |
-| [`devcontainer`](../dist/agent-src/skills/devcontainer/SKILL.md) | Wire up DevContainers / GitHub Codespaces — `devcontainer.json`, container images, secrets, VS Code features, port forwarding. NOT for tuning Copilot itself (use `copilot-config`). |
-| [`developer-like-execution`](../dist/agent-src/skills/developer-like-execution/SKILL.md) | Use when implementing, debugging, refactoring, or reviewing code — enforces the think → analyze → verify → execute workflow — even when the user just says 'implement X' without naming it. |
-| [`discovery-interview`](../dist/agent-src/skills/discovery-interview/SKILL.md) | Use when running discovery interviews — question-bank build, bias audit, insight extraction. Triggers on 'audit my guide', 'extract insights from transcript', 'is my hypothesis falsifiable'. |
-| [`doc-coauthoring`](../dist/agent-src/skills/doc-coauthoring/SKILL.md) | Use when co-authoring a PRD, design doc, RFC, decision doc, or technical spec — 3-stage flow (context → section-by-section → reader-test) — even if the user just says 'help me write this spec'. |
-| [`docker`](../dist/agent-src/skills/docker/SKILL.md) | Use when working with Docker — Dockerfile edits, docker-compose services, containers, or the dual-container (fast + Xdebug) setup — even when the user just says 'my container won't start'. |
-| [`editorial-calendar`](../dist/agent-src/skills/editorial-calendar/SKILL.md) | Use when shaping cadence — evergreen / campaign / reactive split, beat-mapping across channel stages, content-debt management. Triggers on 'plan our content cadence', 'what should we publish'. |
-| [`eloquent`](../dist/agent-src/skills/eloquent/SKILL.md) | Use when writing Eloquent models, relationships, scopes, or queries via Model:: — 'fetch users with their orders'. NOT for PHPStan output, non-Eloquent services, or raw SQL questions. |
-| [`emit-tickets`](../dist/agent-src/skills/emit-tickets/SKILL.md) | Use when materialising a roadmap into a ticket bundle — 'turn this roadmap into tickets', 'materialise tickets', 'mach Tickets aus der Roadmap', 'emit tickets for this plan'. |
-| [`error-handling-patterns`](../dist/agent-src/skills/error-handling-patterns/SKILL.md) | Use when picking a failure-reporting strategy — exceptions vs Result types, recoverable vs not, retry / circuit-breaker / graceful degradation — decision framework only, catalogues externalized. |
-| [`"estimate-ticket"`](../dist/agent-src/skills/"estimate-ticket"/SKILL.md) | Estimate a Jira/Linear ticket — 'estimate PROJ-123', 'wie groß ist das?', 'should we split this?' — size + risk + split + uncertainty, sibling of /refine-ticket, close-prompt. |
-| [`existing-ui-audit`](../dist/agent-src/skills/existing-ui-audit/SKILL.md) | Use BEFORE writing or editing any non-trivial UI — inventories components, design tokens, shadcn primitives, and reusable patterns into state.ui_audit. Hard gate for the ui directive set. |
-| [`expansion-playbook`](../dist/agent-src/skills/expansion-playbook/SKILL.md) | Use when designing account-expansion mechanics — upsell vs cross-sell, expansion-trigger signals, NRR cognition. Triggers on 'lift NRR', 'when do we upsell vs cross-sell'. |
-| [`fe-design`](../dist/agent-src/skills/fe-design/SKILL.md) | Reference for frontend-design heuristics — component architecture, layout patterns, form/table design, responsive strategy, a11y, UX principles. Stack-agnostic; cited by directives/ui/design.py. |
-| [`feature-planning`](../dist/agent-src/skills/feature-planning/SKILL.md) | Use when the user says \"plan a feature\", \"brainstorm\", \"explore this idea\", or wants to go from idea to structured plan and roadmap. |
-| [`file-editor`](../dist/agent-src/skills/file-editor/SKILL.md) | Use when opening edited files in the user's IDE. Reads settings from .agent-settings.yml to determine IDE and whether auto-open is enabled. |
-| [`finishing-a-development-branch`](../dist/agent-src/skills/finishing-a-development-branch/SKILL.md) | Use when the feature is implementation-complete and the next step is 'ship it' — verifies, cleans up, and routes to merge/PR/park/discard — even when the user just says 'I'm done, what now?'. |
-| [`flux`](../dist/agent-src/skills/flux/SKILL.md) | Use when the project uses `livewire/flux` — dispatched by `directives/ui/{apply,review,polish}.py`. Covers Flux components, slots, variants, and form primitives. |
-| [`forecast-accuracy`](../dist/agent-src/skills/forecast-accuracy/SKILL.md) | Use when constructing the forecast call — commit / best-case / pipeline categorisation, deal-level evidence test, accuracy retro-loop. Triggers on 'build the forecast', 'why does our commit miss'. |
-| [`forecasting`](../dist/agent-src/skills/forecasting/SKILL.md) | Use when constructing the finance-side forecast — top-down vs bottom-up shape, confidence bands, retro-loop. Triggers on 'build the forecast model', 'reconcile top-down with bottom-up'. |
-| [`form-handler`](../dist/agent-src/skills/form-handler/SKILL.md) | Use when designing or reviewing a form — validation timing, error display, submission lifecycle, optimistic UI, dirty/pristine state, idempotency — even on 'why does submit double-fire?'. |
-| [`fundraising-narrative`](../dist/agent-src/skills/fundraising-narrative/SKILL.md) | Use when shaping a capital-raise pitch — why-now / why-us / why-this framing, market-size reasoning, traction-story construction. Triggers on 'tighten the pitch', 'why-now is weak'. |
-| [`funnel-analysis`](../dist/agent-src/skills/funnel-analysis/SKILL.md) | Use when diagnosing where a SaaS or product funnel leaks — visitor → signup → activation → paid → retained — channel-agnostic, conversion-rate-driven. |
-| [`git-workflow`](../dist/agent-src/skills/git-workflow/SKILL.md) | Use when working with Git — branch naming, commit messages, PR creation, rebasing, or the code review process — even when the user says 'push this' or 'merge the branch' without naming Git. |
-| [`github-ci`](../dist/agent-src/skills/github-ci/SKILL.md) | Use when working with GitHub Actions — workflow YAML, quality gates, test matrices, deployment triggers, reusable workflows — even when the user just says 'my CI is failing' or 'add a check'. |
-| [`grafana`](../dist/agent-src/skills/grafana/SKILL.md) | Use when working with Grafana — dashboards, Loki LogQL queries, alerting rules, monitoring panels — even when the user just says 'build me a dashboard' or 'query the logs' without naming Grafana. |
-| [`gtm-launch`](../dist/agent-src/skills/gtm-launch/SKILL.md) | Use when sequencing a launch — alpha / beta / GA waves, audience-by-wave logic, narrative beats per wave, engineering-readiness gates. Triggers on 'plan the launch', 'sequence GA'. |
-| [`guideline-writing`](../dist/agent-src/skills/guideline-writing/SKILL.md) | Use when creating or editing a guideline in docs/guidelines/ — reference material cited by skills, no auto-triggers — even when the user just says 'write up our naming conventions'. |
-| [`hiring-loop-design`](../dist/agent-src/skills/hiring-loop-design/SKILL.md) | Use when shaping an engineering hiring loop — stages, take-home vs live, calibration, bar-raiser, signal-vs-noise audit. Triggers on 'design our interview loop', 'audit our hiring bar'. |
-| [`iconography`](../dist/agent-src/skills/iconography/SKILL.md) | Resolve an icon request to a concrete Iconify name and emit the embedding for the project's stack. Use when adding icons, picking an icon set, or wiring Lucide/Heroicons/Phosphor/Tabler. |
-| [`image-analyser`](../dist/agent-src/skills/image-analyser/SKILL.md) | Use to analyse a character image down to the smallest mole and diff against a canon — per-feature spec, OCR-reads tattoo text, flags drift. Triggers 'analyse this image', 'match the canon'. |
-| [`image-creator`](../dist/agent-src/skills/image-creator/SKILL.md) | Use to generate a character image to spec — max-fidelity reproducible prompt from a Canon Spec, anchors-first, provider/governance-gated. Triggers 'generate this character', 'render to spec'. |
-| [`image-editing`](../dist/agent-src/skills/image-editing/SKILL.md) | Edit an existing image — inpaint, background swap, variation — via providers that support it. Use when editing/modifying/inpainting an image or making variations. |
-| [`image-generation`](../dist/agent-src/skills/image-generation/SKILL.md) | Generate an image from a brief — provider-agnostic blueprint then provider-specific translation, with ref-image/seed reuse for consistency. Use when generating/creating an image. |
-| [`image-provider-routing`](../dist/agent-src/skills/image-provider-routing/SKILL.md) | Select the right image-generation provider from job shape — text-in-image to Ideogram, photoreal to Flux, vector/logo to Recraft, general to Gemini/GPT. |
-| [`incident-commander`](../dist/agent-src/skills/incident-commander/SKILL.md) | Use during or right after an incident — frames severity, sets comms cadence, drafts the post-mortem skeleton — even when the user just says 'production is down' or 'wir haben einen Vorfall'. |
-| [`jira-integration`](../dist/agent-src/skills/jira-integration/SKILL.md) | Use when the user says \"check Jira\", \"create ticket\", \"update issue\", or needs JQL queries, ticket transitions, or branch-to-ticket linking. |
-| [`jobs-events`](../dist/agent-src/skills/jobs-events/SKILL.md) | Use when creating Laravel jobs, queued workflows, events, or listeners. Covers clear responsibilities, safe serialization, and retry/failure handling. |
-| [`judge-bug-hunter`](../dist/agent-src/skills/judge-bug-hunter/SKILL.md) | Use when a diff needs correctness review — null-safety, edge cases, off-by-one, races, error handling — dispatched by /review-changes, /do-and-judge, /judge, even without 'judge'. |
-| [`judge-code-quality`](../dist/agent-src/skills/judge-code-quality/SKILL.md) | Use when a diff needs a readability review — naming, single-responsibility, DRY, dead code, mismatch with codebase conventions — dispatched by /review-changes, /do-and-judge, /judge. |
-| [`judge-security-auditor`](../dist/agent-src/skills/judge-security-auditor/SKILL.md) | Use when a diff may introduce security risk — authZ, injection, secrets, unsafe deserialization, SSRF, XSS, mass assignment — dispatched by /review-changes, /do-and-judge, /judge. |
-| [`judge-test-coverage`](../dist/agent-src/skills/judge-test-coverage/SKILL.md) | Use when a diff may lack tests — missing assertions, uncovered branches, over-mocking, no regression test for a bug fix — dispatched by /review-changes, /do-and-judge, /judge, even without 'tests'. |
-| [`laravel`](../dist/agent-src/skills/laravel/SKILL.md) | Writes Laravel PHP — Eloquent, Artisan controllers, FormRequests, jobs, events, policies, providers. For Symfony / Doctrine use `symfony-workflow`. For framework-free PHP use `php-coder`. |
-| [`laravel-api-endpoint`](../dist/agent-src/skills/laravel-api-endpoint/SKILL.md) | Use when creating a new Laravel API endpoint — Controller, FormRequest, Resource, route, Policy, OpenAPI annotations — versioned route layout, single-action `__invoke` controllers. |
-| [`laravel-dto`](../dist/agent-src/skills/laravel-dto/SKILL.md) | Use when creating a Laravel/PHP DTO with the SimpleDto base class and attribute mapping. For DTOs in other stacks, use the stack-native skill (TypeScript, Python, Rust, Go). |
-| [`laravel-horizon`](../dist/agent-src/skills/laravel-horizon/SKILL.md) | Use when working with Laravel queues in production — Horizon dashboard, worker supervision, job metrics, balancing strategies — even when the user just says 'my jobs are piling up'. |
-| [`laravel-mail`](../dist/agent-src/skills/laravel-mail/SKILL.md) | Use when building Laravel emails — Mailables, Markdown templates, queued sending, attachments, previews — even when the user says 'send this as an email' without naming Mailables. |
-| [`laravel-middleware`](../dist/agent-src/skills/laravel-middleware/SKILL.md) | Use when creating or modifying Laravel middleware — request/response filtering, groups, priority, terminable middleware, or route-level assignment. |
-| [`laravel-migration`](../dist/agent-src/skills/laravel-migration/SKILL.md) | Use when creating a Laravel migration — table prefixes, column naming, multi-tenant awareness, php artisan make:migration. Other stacks: use stack-native migration tooling. |
-| [`laravel-notifications`](../dist/agent-src/skills/laravel-notifications/SKILL.md) | Use when sending notifications via mail, Slack, database, or custom channels — with queuing, on-demand recipients, and notification preferences. |
-| [`laravel-pennant`](../dist/agent-src/skills/laravel-pennant/SKILL.md) | Use when working with feature flags — Laravel Pennant, gradual rollouts, A/B testing, scope-based flags — even when the user just says 'hide this behind a flag' without naming Pennant. |
-| [`laravel-pulse`](../dist/agent-src/skills/laravel-pulse/SKILL.md) | Use when setting up Laravel Pulse — real-time dashboard, built-in cards, custom recorders, performance insights — even when the user just says 'I need app monitoring' without naming Pulse. |
-| [`laravel-reverb`](../dist/agent-src/skills/laravel-reverb/SKILL.md) | Use when configuring Laravel Reverb — the first-party WebSocket server with Pusher protocol compatibility, horizontal scaling, and Pulse monitoring. |
-| [`laravel-scheduling`](../dist/agent-src/skills/laravel-scheduling/SKILL.md) | Use when configuring Laravel task scheduling — cron expressions, frequency helpers, overlap prevention, maintenance mode, or output handling. |
-| [`laravel-validation`](../dist/agent-src/skills/laravel-validation/SKILL.md) | Use when writing validation — Form Requests, rules, custom rule objects, request-boundary design — even when the user just says 'validate this input' or 'check the request' without naming it. |
-| [`laravel-websocket`](../dist/agent-src/skills/laravel-websocket/SKILL.md) | Use when building Laravel real-time features — Broadcasting events, ShouldBroadcast, private/presence channels, Echo client. For non-Laravel WebSockets, use the stack-native skill. |
-| [`launch-readiness`](../dist/agent-src/skills/launch-readiness/SKILL.md) | Use before merging a release-shaped PR — pre-merge checklist, rollout plan, rollback criteria, ops handoff. Triggers on 'ready to ship', 'launch checklist', 'rollout plan for X'. |
-| [`learning-to-rule-or-skill`](../dist/agent-src/skills/learning-to-rule-or-skill/SKILL.md) | Use when a repeated learning, mistake, or successful pattern should be turned into a new rule or skill. Also use after completing a task to capture learnings from the work. |
-| [`lint-skills`](../dist/agent-src/skills/lint-skills/SKILL.md) | Use when running the package's skill linter against all skills and rules to validate frontmatter, required sections, and execution metadata. |
-| [`livewire`](../dist/agent-src/skills/livewire/SKILL.md) | Use when the project's frontend stack is Livewire — dispatched by `directives/ui/{apply,review,polish}.py`. Covers reactive state, events, lifecycle hooks, and component/view separation. |
-| [`livewire-architect`](../dist/agent-src/skills/livewire-architect/SKILL.md) | Use when shaping a Livewire component before code — full-page vs partial, parent/child split, event flow, state-vs-props boundary, hydration cost — even on 'add this Livewire component'. |
-| [`logging-monitoring`](../dist/agent-src/skills/logging-monitoring/SKILL.md) | Use when working with logging or monitoring — Sentry error tracking, Grafana/Loki log aggregation, structured logging channels, or monitoring helpers. |
-| [`logo-generation`](../dist/agent-src/skills/logo-generation/SKILL.md) | Generate a logo or brand mark — structured prompt + provider routing, with a true-vector path via a vector-native provider or LLM-authored SVG for simple marks. Use for logo or brand mark generation. |
-| [`market-entry-analysis`](../dist/agent-src/skills/market-entry-analysis/SKILL.md) | Use when sequencing market entry — geo / segment / vertical, beachhead selection, regulatory-delta. Triggers on 'should we enter market X', 'which segment first'. |
-| [`markitdown`](../dist/agent-src/skills/markitdown/SKILL.md) | Use when converting PDF, DOCX, XLSX, PPTX, EPUB, images, or audio to Markdown for LLM ingestion via the upstream markitdown-mcp server — 'extract this PDF', 'OCR this image', 'transcribe this audio'. |
-| [`mcp`](../dist/agent-src/skills/mcp/SKILL.md) | Use when working with MCP (Model Context Protocol) servers — their tools, capabilities, and best practices for effective agent workflows. |
-| [`mcp-builder`](../dist/agent-src/skills/mcp-builder/SKILL.md) | Use when building an MCP server in Python (FastMCP) or Node/TypeScript (MCP SDK) — agent-centric tool design, input schemas, error handling, and the 10-question evaluation harness. |
-| [`md-language-check`](../dist/agent-src/skills/md-language-check/SKILL.md) | Use BEFORE saving any .md under .augment/, dist/agent-src*/, or agents/ — scans umlauts, German function words, and German phrases outside DE:/EN: anchor blocks. Hard gate per language-and-tone. |
-| [`memory-consolidation`](../dist/agent-src/skills/memory-consolidation/SKILL.md) | Use when consolidating session signals into curated memory — four-phase loop ORIENT → GATHER → CONSOLIDATE → PRUNE. Triggers on 'mine my sessions', 'consolidate memory', 'review intake signals'. |
-| [`merge-conflicts`](../dist/agent-src/skills/merge-conflicts/SKILL.md) | Use when the user has merge conflicts or says \"resolve conflicts\". Understands conflict markers, resolution strategies, and verification workflow. |
-| [`messaging-architecture`](../dist/agent-src/skills/messaging-architecture/SKILL.md) | Use when shaping the primary message, supporting proofs, and audience-by-message matrix from a locked positioning frame — before any copy or launch beat. Triggers on 'tighten the message stack'. |
-| [`migration-architect`](../dist/agent-src/skills/migration-architect/SKILL.md) | Use when shaping a non-trivial migration — rollout phases, dual-write windows, cutover sequencing, deprecation cycles — hands off to the framework-specific migration skill for DDL once locked. |
-| [`mobile-e2e-strategy`](../dist/agent-src/skills/mobile-e2e-strategy/SKILL.md) | Use when picking a mobile E2E framework — Detox / Appium / Maestro / XCUITest / Espresso — or planning iOS Simulator / Android Emulator coverage in CI for RN, Expo, or native apps. |
-| [`module-detect-on-the-fly`](../dist/agent-src/skills/module-detect-on-the-fly/SKILL.md) | Use when editing a file under a module-shaped path (`Modules/*`, `packages/*`, `apps/*`, `internal/*`) while `modules.enabled` is `false` — asks the user once whether to enable the config. |
-| [`module-management`](../dist/agent-src/skills/module-management/SKILL.md) | Use when working within any module under `modules.root_paths` from `.agent-project-settings.yml` — Laravel HMVC, Symfony DDD-lite, Node monorepo, Python src/, Go internal/, or a custom path. |
-| [`motion-choreographer`](../dist/agent-src/skills/motion-choreographer/SKILL.md) | Use when turning a locked still + blueprint into a provider-tuned motion prompt — camera, primary + secondary motion, physics, native-audio sync. Triggers 'motion prompt for Veo/Kling/Sora'. |
-| [`multi-tenancy`](../dist/agent-src/skills/multi-tenancy/SKILL.md) | Use when working with the multi-tenant architecture — customer DB switching, FQDN routing, tenant isolation, or cross-tenant operations. |
-| [`nextjs-patterns`](../dist/agent-src/skills/nextjs-patterns/SKILL.md) | Writes Next.js App Router code — Server Components, Server Actions, RSC boundaries, route handlers, caching, and streaming — matching framework conventions and project architecture. |
-| [`okr-tree-modeling`](../dist/agent-src/skills/okr-tree-modeling/SKILL.md) | Use when decomposing a company objective into team OKRs, auditing a draft OKR tree, or stress-testing an existing one for measurability and laddering. |
-| [`onboarding-design`](../dist/agent-src/skills/onboarding-design/SKILL.md) | Use when designing customer onboarding — time-to-first-value, milestone design, friction audit, drop-off diagnosis. Triggers on 'fix onboarding', 'why do new accounts churn fast'. |
-| [`onboarding-program`](../dist/agent-src/skills/onboarding-program/SKILL.md) | Use when shaping employee onboarding — time-to-productivity, role-by-role program, mentor pairing, 30/60/90 milestones. Triggers on 'design our onboarding', 'why are new hires ramping slow'. |
-| [`one-on-one-cadence`](../dist/agent-src/skills/one-on-one-cadence/SKILL.md) | Use when designing engineering 1:1s — cadence, agenda mix, growth-vs-blocker-vs-trust shape, cancellation anti-patterns. Triggers on 'fix my 1:1s', 'should I cancel 1:1s this week'. |
-| [`openapi`](../dist/agent-src/skills/openapi/SKILL.md) | Use when documenting APIs — OpenAPI/Swagger, PHP attributes, Redocly validation, versioned specs — even when the user just says 'document this endpoint' without naming OpenAPI. |
-| [`org-design`](../dist/agent-src/skills/org-design/SKILL.md) | Use when shaping team structure — functional vs squad, span-of-control, reorg cost, Conway-aware boundaries. Triggers on 'should we reorg', 'how do we split this team'. |
-| [`override-management`](../dist/agent-src/skills/override-management/SKILL.md) | Creates and manages project-level overrides for shared skills, rules, and commands — extending or replacing originals from .augment/ with project-specific behavior in agents/overrides/. |
-| [`perf-feedback-craft`](../dist/agent-src/skills/perf-feedback-craft/SKILL.md) | Use when shaping feedback — situation-behavior-impact, growth-vs-corrective split, cadence design, ladder-of-inference checks. Triggers on 'how do I give this feedback', 'perf review shape'. |
-| [`performance`](../dist/agent-src/skills/performance/SKILL.md) | Use when optimizing application performance — caching strategies, eager loading, query optimization, Redis patterns, or background job design. |
-| [`performance-analysis`](../dist/agent-src/skills/performance-analysis/SKILL.md) | ONLY when user explicitly requests: performance audit, bottleneck analysis, or N+1 query detection. NOT for regular feature work. |
-| [`persona-writing`](../dist/agent-src/skills/persona-writing/SKILL.md) | Use when creating or editing a persona in src/agent-src/personas/ — voice / focus / unique questions / output expectations — even when the user just says 'add a reviewer voice for X'. |
-| [`pest-testing`](../dist/agent-src/skills/pest-testing/SKILL.md) | Use when writing, generating, or improving Pest tests for Laravel — clear intent, good coverage, maintainable structure, and alignment with project testing conventions. |
-| [`php-coder`](../dist/agent-src/skills/php-coder/SKILL.md) | Writes or edits PHP code — controllers, classes, type hints, SOLID refactors, modern idioms — even without naming PHP. NOT for writing tests (use pest-testing) or explaining PHP concepts. |
-| [`php-debugging`](../dist/agent-src/skills/php-debugging/SKILL.md) | Use when debugging PHP with Xdebug — breakpoints, step-through, dual-container setup, IDE configuration, header-based routing — even when the user just says 'why does this blow up on request X'. |
-| [`php-service`](../dist/agent-src/skills/php-service/SKILL.md) | Use when the user says 'create service', 'new service class', or needs a PHP service following SOLID principles with proper DI and repository usage. |
-| [`pipeline-strategy`](../dist/agent-src/skills/pipeline-strategy/SKILL.md) | Use when designing or auditing a sales pipeline — stage exit criteria, per-cell conversion, coverage reasoning, leak detection. Triggers on 'tighten our pipeline', 'where is the leak'. |
-| [`pixar-storyteller`](../dist/agent-src/skills/pixar-storyteller/SKILL.md) | Use when turning an idea into a Pixar-style animation prompt — character sheet, scene, image, video — anchored in emotional beat, want, obstacle. Triggers 'Pixar prompt', 'animated scene'. |
-| [`playwright-architect`](../dist/agent-src/skills/playwright-architect/SKILL.md) | Use when shaping a Playwright suite — locator strategy, Page Object boundaries, fixture composition, flake-prevention architecture, CI-vs-local split — even on 'design our E2E tests'. |
-| [`playwright-testing`](../dist/agent-src/skills/playwright-testing/SKILL.md) | Use when writing Playwright E2E tests — browser automation, visual regression testing, Page Objects, fixtures, and reliable test patterns. |
-| [`po-discovery`](../dist/agent-src/skills/po-discovery/SKILL.md) | Use when shaping a fuzzy product ask into a refined backlog item — problem framing, user-story rewrite, AC tightening — even if the user just says 'help me write this ticket'. |
-| [`positioning-strategy`](../dist/agent-src/skills/positioning-strategy/SKILL.md) | Use when locking the market frame — category, segment, alternative, point-of-view — before messaging, launch, or pricing rides on it. Triggers on 'who are we for', 'opposable audit'. |
-| [`prediction-pool-optimizer`](../dist/agent-src/skills/prediction-pool-optimizer/SKILL.md) | Optimize prediction-pool tips (kicktipp etc.): rules + multi-book consensus odds → expected-points-max answer for every question, scores AND bonus. Triggers 'optimize my pool tips', 'predict'. |
-| [`premortem`](../dist/agent-src/skills/premortem/SKILL.md) | Use before committing to a heavy or irreversible plan — imagine it's 6 months later and this failed; enumerate why, score each mode, derive early-warning signals and preventive guardrails. |
-| [`privacy-review`](../dist/agent-src/skills/privacy-review/SKILL.md) | Use when reviewing data flows, support macros, refund templates for GDPR/CCPA/HIPAA fit — regime, consent, PII redaction (email, order-id), breach triage. Triggers 'is this GDPR-safe', 'PII redact'. |
-| [`project-analysis-core`](../dist/agent-src/skills/project-analysis-core/SKILL.md) | Raw discovery primitives — project discovery, version resolution, docs loading, architecture mapping, execution flow. Called by `universal-project-analysis`. Single-pass scan → `project-analyzer`. |
-| [`project-analysis-hypothesis-driven`](../dist/agent-src/skills/project-analysis-hypothesis-driven/SKILL.md) | Use when a bug has multiple plausible causes across layers — competing hypotheses, validation loops, evidence-based conclusions — even when the user just says 'why is this happening?'. |
-| [`project-analysis-laravel`](../dist/agent-src/skills/project-analysis-laravel/SKILL.md) | Use for deep Laravel project analysis: boot flow, request lifecycle, container usage, Eloquent/data flow, async systems, and Laravel-specific failure patterns. |
-| [`project-analysis-nextjs`](../dist/agent-src/skills/project-analysis-nextjs/SKILL.md) | Use for deep Next.js analysis: server vs client boundaries, routing, data fetching, caching, rendering modes, and hydration/runtime issues. |
-| [`project-analysis-node-express`](../dist/agent-src/skills/project-analysis-node-express/SKILL.md) | Use for deep Node.js / Express project analysis: boot flow, middleware order, async behavior, data layer, auth/security, and Node-specific runtime failure patterns. |
-| [`project-analysis-react`](../dist/agent-src/skills/project-analysis-react/SKILL.md) | Use for deep React analysis: component tree, state flow, props flow, hooks usage, rendering behavior, and React-specific failure patterns. |
-| [`project-analysis-symfony`](../dist/agent-src/skills/project-analysis-symfony/SKILL.md) | Use for deep Symfony project analysis: kernel/bootstrap, container wiring, routing/request flow, Doctrine, security, Messenger, and Symfony-specific failure patterns. |
-| [`project-analysis-zend-laminas`](../dist/agent-src/skills/project-analysis-zend-laminas/SKILL.md) | Use for deep Zend Framework or Laminas project analysis: bootstrap, config merge order, service manager, MVC flow, data layer, and migration-specific risks. |
-| [`project-analyzer`](../dist/agent-src/skills/project-analyzer/SKILL.md) | ONLY when user asks for single-pass tech-stack detection or `agents/evidence/analysis/` write-up. Deep multi-pass audit → `universal-project-analysis`. Raw primitives → `project-analysis-core`. |
-| [`project-docs`](../dist/agent-src/skills/project-docs/SKILL.md) | Use when looking for project-specific documentation. Knows which docs exist in agents/reference/docs/ and agents/settings/contexts/ and maps work areas to relevant docs. |
-| [`prompt-engineering-image`](../dist/agent-src/skills/prompt-engineering-image/SKILL.md) | Translate an image brief into provider-specific prompt grammar per model. Use when writing or refining an image-generation prompt for Ideogram, Flux, Gemini, GPT Image 2, or Recraft. |
-| [`prompt-engineering-patterns`](../dist/agent-src/skills/prompt-engineering-patterns/SKILL.md) | Use when designing production-LLM prompts — few-shot, chain-of-thought, system prompts, templates, self-verification — distinct from prompt-optimizer and refine-prompt. |
-| [`prompt-optimizer`](../dist/agent-src/skills/prompt-optimizer/SKILL.md) | Use when the user wants a prompt optimized for ChatGPT, Claude, Gemini, or another AI — 'make this prompt better', 'optimize for ChatGPT', 'rewrite my prompt' — even without saying 'optimize'. |
-| [`prompt-validator`](../dist/agent-src/skills/prompt-validator/SKILL.md) | Pre-spend contradiction gate for AI-video runs: checks every prompt in the batch, blocks on style / character / physics mismatch. Triggers 'validate the prompts', 'check the storyboard'. |
-| [`quality-tools`](../dist/agent-src/skills/quality-tools/SKILL.md) | Use when PHPStan, Rector, or ECS output appears — \"phpstan says mixed\", type errors, \"fix code style\", \"run rector\" — even when Eloquent/Laravel/model code is also mentioned. |
-| [`react-native-setup`](../dist/agent-src/skills/react-native-setup/SKILL.md) | Use when setting up React Native or Expo dev environments — Xcode, Android Studio, CocoaPods, EAS, Metro, New Architecture — even when the user just says 'my RN build won't start'. |
-| [`react-shadcn-ui`](../dist/agent-src/skills/react-shadcn-ui/SKILL.md) | Use when building React UI on shadcn/ui primitives + Tailwind — the apply/review/polish skill dispatched by `directives/ui/*` for the `react-shadcn` stack. |
-| [`readme-reviewer`](../dist/agent-src/skills/readme-reviewer/SKILL.md) | Use when reviewing a README for accuracy, usability, and alignment with the actual repository. Detects invented content, broken setup steps, and structural issues. |
-| [`readme-writing`](../dist/agent-src/skills/readme-writing/SKILL.md) | Use when creating, rewriting, or significantly improving a README based on the actual repository structure, commands, and intended audience. |
-| [`readme-writing-package`](../dist/agent-src/skills/readme-writing-package/SKILL.md) | Use when creating or rewriting a README for a reusable package or library. Focus on installability, minimal usage example, compatibility, and developer onboarding. |
-| [`reasoning-orchestrator`](../dist/agent-src/skills/reasoning-orchestrator/SKILL.md) | Use for multi-step / ambiguous / end-to-end work — refactor a whole module, drive a vague ticket to a verified result, plan+build+verify a migration; coordinates the reasoning chain across skills. |
-| [`receiving-code-review`](../dist/agent-src/skills/receiving-code-review/SKILL.md) | Use when processing code review feedback (bot or human) before changing anything — triages, verifies, and pushes back with technical reasoning — even when the user just says 'fix the comments'. |
-| [`"refine-prompt"`](../dist/agent-src/skills/"refine-prompt"/SKILL.md) | Reconstruct a free-form prompt into actionable AC + assumptions + confidence band before the engine plans — '/work \"…\"', 'baue X', 'ist der Prompt klar genug für die Engine?'. |
-| [`"refine-ticket"`](../dist/agent-src/skills/"refine-ticket"/SKILL.md) | Refine a Jira/Linear ticket before planning — 'refine ticket', 'tighten AC on PROJ-123', 'ist das Ticket klar?' — rewritten ticket, Top-5 risks, persona voices, sub-skills orchestrated, close-prompt. |
-| [`release-comms`](../dist/agent-src/skills/release-comms/SKILL.md) | Use when turning a shipped changelog into a release narrative — value-not-feature framing, audience-segmented surfaces, one source of truth. Triggers on 'announce the release', 'write changelog post'. |
-| [`repomix-packer`](../dist/agent-src/skills/repomix-packer/SKILL.md) | Use when packaging a codebase to a single AI-friendly file for LLM analysis — local or remote, XML/Markdown/JSON, token counting, gitignore filtering, peer-side `repomix` CLI. |
-| [`requesting-code-review`](../dist/agent-src/skills/requesting-code-review/SKILL.md) | Use when asking for a review or creating a PR — self-review first, frame the right context, test plan included — even when the user just says 'open a PR' or 'ready to merge'. |
-| [`retention-loops`](../dist/agent-src/skills/retention-loops/SKILL.md) | Use when designing product-led retention — habit formation, trigger-action-reward, network vs single-user loops. Triggers on 'why don't users come back', 'design a habit loop'. |
-| [`review-routing`](../dist/agent-src/skills/review-routing/SKILL.md) | Use when preparing a PR description, suggesting reviewers, or flagging risk — produces owner-mapped roles plus historical bug-pattern matches from project-local YAML. |
-| [`rice-prioritization`](../dist/agent-src/skills/rice-prioritization/SKILL.md) | Use when ranking competing initiatives for a roadmap, breaking a tie between two features, or auditing a backlog for hidden low-value work via Reach × Impact × Confidence ÷ Effort. |
-| [`risk-officer`](../dist/agent-src/skills/risk-officer/SKILL.md) | Use when surfacing and prioritising risk before commit — blast-radius framing, mitigations, residual-risk verdict — even if the user just says 'what could go wrong here?'. |
-| [`roadmap-management`](../dist/agent-src/skills/roadmap-management/SKILL.md) | Use when the user says \"create roadmap\", \"show roadmap\", or \"execute roadmap\". Creates, reads, and manages roadmap files with phase tracking. |
-| [`roadmap-writing`](../dist/agent-src/skills/roadmap-writing/SKILL.md) | Use when authoring or rewriting a roadmap in agents/roadmaps/ — phase prose, goal sentence, acceptance criteria, council notes — even when the user just says 'write a plan for X' or 'draft a roadmap'. |
-| [`root-cause-frameworks`](../dist/agent-src/skills/root-cause-frameworks/SKILL.md) | Use when tracing the root cause of a resolved incident or recurring bug — 5-whys chain, fishbone categorisation, contributing-factors split — even if the user says 'why does this keep breaking?'. |
-| [`rtk-output-filtering`](../dist/agent-src/skills/rtk-output-filtering/SKILL.md) | Use when running verbose CLI commands — wraps them with rtk (Rust Token Killer) for 60-90% token savings. Covers installation, configuration, and usage patterns. |
-| [`rule-refactor`](../dist/agent-src/skills/rule-refactor/SKILL.md) | Use when the rule set is over the Augment budget, when a new rule would breach it, or when asked to audit / merge / prune rules — runs the audit pipeline and proposes a verdict per rule. |
-| [`rule-writing`](../dist/agent-src/skills/rule-writing/SKILL.md) | Use when creating or editing a rule in src/rules/ — trigger wording, always vs auto classification, size budget — even when the user just says 'add a rule for X'. |
-| [`runway-cognition`](../dist/agent-src/skills/runway-cognition/SKILL.md) | Use when reasoning about cash runway — burn shape, fundraise triggers, layoff-vs-cut-vs-grow decisions. Triggers on 'how long do we have', 'should we raise', 'cut or grow'. |
-| [`scenario-modeling`](../dist/agent-src/skills/scenario-modeling/SKILL.md) | Use when constructing base / upside / downside scenarios — three-statement modeling, sensitivity analysis, optionality reasoning. Triggers on 'model the scenarios', 'what if growth halves'. |
-| [`scene-expander`](../dist/agent-src/skills/scene-expander/SKILL.md) | Use when expanding a one-line idea into the 12-block Cinematic Scene Blueprint — provider-agnostic, includes optional dialogue + ambient. Triggers 'expand this scene', 'blueprint for X'. |
-| [`script-writing`](../dist/agent-src/skills/script-writing/SKILL.md) | Use when adding or editing any script under `scripts/` — `--quiet` flag, `_lib/script_output` helpers, silent Taskfile wiring, Iron-Law carve-outs — even when you just say 'add a check script for X'. |
-| [`secrets-management`](../dist/agent-src/skills/secrets-management/SKILL.md) | Use when picking a secrets store, designing rotation, or wiring scanning gates — multi-cloud (Vault, AWS, Azure, GCP), CI, and Kubernetes — decision framework, provider deep-dives externalized. |
-| [`security`](../dist/agent-src/skills/security/SKILL.md) | Use when applying security best practices — authentication, authorization, CSRF protection, input sanitization, rate limiting, or secure coding — stack-agnostic. |
-| [`security-audit`](../dist/agent-src/skills/security-audit/SKILL.md) | ONLY when user explicitly requests: security audit, vulnerability scan, or penetration test review. NOT for regular feature work. |
-| [`sentry-integration`](../dist/agent-src/skills/sentry-integration/SKILL.md) | Use when the user shares a Sentry URL, says \"check Sentry\", or wants to investigate production errors. Uses Sentry MCP tools for deep analysis. |
-| [`sequential-thinking`](../dist/agent-src/skills/sequential-thinking/SKILL.md) | ONLY when user explicitly requests: step-by-step reasoning, structured problem decomposition, or iterative analysis. NOT for regular coding tasks. |
-| [`skill-improvement-pipeline`](../dist/agent-src/skills/skill-improvement-pipeline/SKILL.md) | ONLY when user explicitly requests: run the skill improvement pipeline after a learning was detected. Orchestrates capture, classify, create, validate, and apply. |
-| [`skill-management`](../dist/agent-src/skills/skill-management/SKILL.md) | Use when condensing, decondenseing, refactoring, or improving existing skills. Covers the full skill lifecycle from verbose → sharp → maintained. |
-| [`skill-reviewer`](../dist/agent-src/skills/skill-reviewer/SKILL.md) | Use when reviewing, auditing, or optimizing skills — validates against the 7 Skill Killers checklist and produces fix recommendations. |
-| [`skill-writing`](../dist/agent-src/skills/skill-writing/SKILL.md) | Use when deciding 'should this be a skill or a rule?', creating/improving/reviewing agent skills, SKILL.md frontmatter, or procedure sections — even without saying 'skill-writing'. |
-| [`song-to-script`](../dist/agent-src/skills/song-to-script/SKILL.md) | Turn an audio track into a timed `## Scene N` script: song sections → per-scene durations, auto mode adds mood + lip-sync lines. Triggers 'music video', 'from the song', 'cut to the beat'. |
-| [`source-discovery`](../dist/agent-src/skills/source-discovery/SKILL.md) | Use BEFORE planning/coding against a DB schema, API/GraphQL shape, DTO/Model/Entity, or vendor package — read the real source, emit an Evidence Report, stop inventing fields. |
-| [`sql-writing`](../dist/agent-src/skills/sql-writing/SKILL.md) | Use when writing raw SQL — MariaDB/MySQL syntax, parameterization, raw migrations, seeders with `DB::statement` — even when the user just pastes a query and asks 'why is this slow' without naming SQL. |
-| [`stakeholder-tradeoff`](../dist/agent-src/skills/stakeholder-tradeoff/SKILL.md) | Use when stakeholders pull a decision in different directions — frames each lens, builds a trade-off matrix, surfaces the cost of every choice — even if the user just says 'PO and ops disagree'. |
-| [`standards-from-config`](../dist/agent-src/skills/standards-from-config/SKILL.md) | Use when you need this project's coding standards (line length, quotes, import order, naming, commit format) — derive them from the REAL tooling config as a pointer + digest, never a guessed claim. |
-| [`subagent-orchestration`](../dist/agent-src/skills/subagent-orchestration/SKILL.md) | Use when orchestrating implementer/judge subagents — seven modes (do-and-judge ±two-stage, do-in-steps/parallel/worktrees, do-competitively, judge-with-debate) — models from .agent-settings.yml. |
-| [`symfony-workflow`](../dist/agent-src/skills/symfony-workflow/SKILL.md) | Writes Symfony PHP — DI container, bundles, Doctrine, Messenger, Security voters, console commands. For Laravel / Eloquent / Artisan use `laravel`. For framework-free PHP use `php-coder`. |
-| [`systematic-debugging`](../dist/agent-src/skills/systematic-debugging/SKILL.md) | Use when hitting a bug, test failure, crash, or unexpected behavior — enforces reproduce → isolate → hypothesize → verify before any fix — even when the user just says 'this is broken' or 'quick fix'. |
-| [`tailwind-engineer`](../dist/agent-src/skills/tailwind-engineer/SKILL.md) | Use when writing or reviewing Tailwind CSS — utility-first, design-token discipline, no inline-style drift, responsive variants, dark mode — even on 'style this' or 'mach das hübsch'. |
-| [`tech-debt-tracker`](../dist/agent-src/skills/tech-debt-tracker/SKILL.md) | Use when surfacing tech debt as trackable items — interest-vs-principal framing, prioritisation by carrying cost, repayment plan — even if the user just says 'this codebase is a mess'. |
-| [`technical-specification`](../dist/agent-src/skills/technical-specification/SKILL.md) | Use when the user says \"write a spec\", \"create RFC\", \"write a PRD\", or \"document this decision\". Writes technical specifications, PRDs, RFCs, and ADRs with clear structure. |
-| [`terraform`](../dist/agent-src/skills/terraform/SKILL.md) | Use when writing Terraform — AWS modules, resources, variables, outputs, remote state — even when the user just says 'provision this infra' or 'add an S3 bucket' without naming Terraform. |
-| [`terragrunt`](../dist/agent-src/skills/terragrunt/SKILL.md) | Use when working with Terragrunt — DRY multi-env configs, module dependencies, remote state orchestration — even when the user just says 'deploy this to staging and prod' without naming Terragrunt. |
-| [`test-driven-development`](../dist/agent-src/skills/test-driven-development/SKILL.md) | Use when implementing a feature, fixing a bug, or refactoring — write a failing test first, then the code — even if the user just says 'add this function' or 'fix this bug'. |
-| [`test-performance`](../dist/agent-src/skills/test-performance/SKILL.md) | Use when optimizing test suite performance — database setup, seeder optimization, parallel testing, CI pipeline efficiency, or RefreshDatabase alternatives. |
-| [`testing-anti-patterns`](../dist/agent-src/skills/testing-anti-patterns/SKILL.md) | Use BEFORE writing or changing tests, adding mocks, or putting test-only methods on production classes — five Iron Laws and gates against mocking-the-mock, production pollution, silent partial mocks. |
-| [`threat-modeling`](../dist/agent-src/skills/threat-modeling/SKILL.md) | Use when adding auth, webhooks, uploads, queues, secrets, tenant boundaries, or public endpoints — produces trust boundaries + abuse cases mapped to files, BEFORE implementation. |
-| [`throughput-vs-morale-tradeoff`](../dist/agent-src/skills/throughput-vs-morale-tradeoff/SKILL.md) | Use when balancing eng-team velocity vs quality vs burnout — on-call load, focus fragmentation, reorg shock. Triggers on 'team is burning out', 'why is velocity dropping'. |
-| [`token-optimizer`](../dist/agent-src/skills/token-optimizer/SKILL.md) | Use BEFORE any verbose CLI run, large file read, doc conversion, or near-context handoff — single decision tree keyed by intent that cites the canonical token-saving asset. Consult before the action. |
-| [`traefik`](../dist/agent-src/skills/traefik/SKILL.md) | Use when setting up Traefik as a local reverse proxy — real domains on 127.0.0.1, trusted HTTPS via mkcert, automatic service discovery, and multi-project routing. |
-| [`typography-system`](../dist/agent-src/skills/typography-system/SKILL.md) | Derive a type system from a style constraint — query curated font pairings, set scale/line-height/weights, emit DTCG tokens via design-tokens. Use when choosing fonts or building a typographic scale. |
-| [`ui-component-architect`](../dist/agent-src/skills/ui-component-architect/SKILL.md) | Use when shaping a UI component tree — composition vs inheritance, slot patterns, prop API design, controlled vs uncontrolled, polymorphic — even on 'split this component'. |
-| [`unit-economics-modeling`](../dist/agent-src/skills/unit-economics-modeling/SKILL.md) | Use when modeling CAC, LTV, payback, contribution margin, or burn-multiple per customer — SaaS, marketplace, or transactional. Triggers on 'are we unit-economic', 'what is our LTV/CAC'. |
-| [`universal-project-analysis`](../dist/agent-src/skills/universal-project-analysis/SKILL.md) | ONLY when user asks for deep multi-pass codebase audit — orchestrator routing to `project-analysis-core` + framework-specific `project-analysis-*`. Single-pass scan → `project-analyzer`. |
-| [`upstream-contribute`](../dist/agent-src/skills/upstream-contribute/SKILL.md) | Use when a learning, new skill, rule improvement, or bug fix from a consumer project should be contributed back to the shared agent-config package. |
-| [`using-git-worktrees`](../dist/agent-src/skills/using-git-worktrees/SKILL.md) | Use when starting parallel work in isolation from the current branch — spawn a git worktree with ignore-safety checks and a clean test baseline — even when the user says 'try this on the side'. |
-| [`"validate-feature-fit"`](../dist/agent-src/skills/"validate-feature-fit"/SKILL.md) | Validate whether a feature request fits the existing codebase — check for duplicates, contradictions, scope creep, and architectural misfit |
-| [`verify-completion-evidence`](../dist/agent-src/skills/verify-completion-evidence/SKILL.md) | Use when claiming 'done', suggesting a commit, push, or PR — runs the evidence gate so completion claims come from fresh output in this message, not memory or earlier runs. |
-| [`verify-repair-loop`](../dist/agent-src/skills/verify-repair-loop/SKILL.md) | Use to iterate a change until tests/quality checks pass — bounded run→revise→re-run gated by a numeric threshold, then a judge confirms. Triggers 'iterate to green', 'keep fixing until tests pass'. |
-| [`video-director`](../dist/agent-src/skills/video-director/SKILL.md) | Use when turning a scene idea into the 11-block cinematic prompt for live-action AI video — lens, lighting, blocking, motion, negatives. Triggers 'cinematic prompt', 'film-grade scene'. |
-| [`vision-articulation`](../dist/agent-src/skills/vision-articulation/SKILL.md) | Use when articulating internal vision — where we're going / why now / why us, founder-mode anchor, distinct from fundraising pitch. Triggers on 'what's our vision', 'why are we doing this'. |
-| [`voc-extract`](../dist/agent-src/skills/voc-extract/SKILL.md) | Use when extracting Voice-of-Customer themes from existing artefacts — GH issues, PR threads, Sentry patterns. Triggers on 'what are users saying', 'recurring complaints', 'top themes'. |
-| [`voice-and-tone-design`](../dist/agent-src/skills/voice-and-tone-design/SKILL.md) | Use when shaping brand voice — voice attributes, tone-by-context matrix, consistency review. Triggers on 'define our voice', 'why does our copy sound different on every surface'. |
-
----
-
-← [Back to README](../README.md)

package/docs/skills-taxonomy.md

@@ -1,90 +0,0 @@
-# Skill-family taxonomy
-
-A navigable grouping of the **227 skills** into families, so you can find a skill
-by *what it's for* rather than scrolling the flat [catalog](catalog.md). This is a
-**navigation aid, not a contract** — no file moves, no description edits, no
-merges. A skill appears in exactly one family (its primary use); many are useful
-across families.
-
-> **Derivation (reproducible):** each skill is bucketed by declared `pack:` where
-> present, otherwise by a name/topic pattern. The grouping is heuristic and
-> refinable — when a skill reads better in another family, move the entry.
-> Counts here match the [artefact census](artefact-census.md) (227 skills).
-
-## Engineering
-
-### Backend & data (34)
-`api-design` · `api-endpoint` · `artisan-commands` · `async-python-patterns` · `composer-packages` · `database` · `eloquent` · `form-handler` · `jobs-events` · `laravel` · `laravel-api-endpoint` · `laravel-dto` · `laravel-horizon` · `laravel-mail` · `laravel-middleware` · `laravel-migration` · `laravel-notifications` · `laravel-pennant` · `laravel-pulse` · `laravel-reverb` · `laravel-scheduling` · `laravel-validation` · `laravel-websocket` · `multi-tenancy` · `nextjs-patterns` · `php-coder` · `php-debugging` · `php-service` · `project-analysis-laravel` · `project-analysis-nextjs` · `project-analysis-node-express` · `project-analysis-symfony` · `sql-writing` · `symfony-workflow`
-
-### Frontend & design (15)
-`accessibility-auditor` · `blade-ui` · `canvas-design` · `design-intelligence` · `design-tokens` · `existing-ui-audit` · `fe-design` · `flux` · `livewire` · `livewire-architect` · `project-analysis-react` · `react-native-setup` · `react-shadcn-ui` · `tailwind-engineer` · `ui-component-architect`
-
-### Architecture & refactor (7)
-`code-refactoring` · `dependency-upgrade` · `error-handling-patterns` · `messaging-architecture` · `migration-architect` · `openapi` · `performance`
-
-### Engineering workflow (8)
-`conventional-commits-writing` · `developer-like-execution` · `finishing-a-development-branch` · `git-workflow` · `merge-conflicts` · `quality-tools` · `technical-specification` · `verify-completion-evidence`
-
-### Testing (8)
-`api-testing` · `mobile-e2e-strategy` · `pest-testing` · `playwright-architect` · `playwright-testing` · `test-driven-development` · `test-performance` · `testing-anti-patterns`
-
-### DevOps & infra (7)
-`aws-infrastructure` · `docker` · `github-ci` · `grafana` · `terraform` · `terragrunt` · `traefik`
-
-### Debugging & analysis (12)
-`analysis-autonomous-mode` · `analysis-skill-router` · `bug-analyzer` · `deep-reading-analyst` · `image-analyser` · `performance-analysis` · `project-analysis-core` · `project-analysis-hypothesis-driven` · `project-analysis-zend-laminas` · `project-analyzer` · `systematic-debugging` · `universal-project-analysis`
-
-## Quality & risk
-
-### Review & judging (12)
-`architecture-review-lens` · `authz-review` · `code-review` · `design-review` · `judge-bug-hunter` · `judge-code-quality` · `judge-security-auditor` · `judge-test-coverage` · `privacy-review` · `receiving-code-review` · `requesting-code-review` · `review-routing`
-
-### Security (8)
-`blast-radius-analyzer` · `data-flow-mapper` · `data-handling-judgment` · `defense-in-depth` · `secrets-management` · `security` · `security-audit` · `threat-modeling`
-
-### Operations & reliability (6)
-`dashboard-design` · `incident-commander` · `jira-integration` · `launch-readiness` · `logging-monitoring` · `sentry-integration`
-
-### AI Council & decision (5)
-`adversarial-review` · `ai-council` · `decision-record` · `risk-officer` · `stakeholder-tradeoff`
-
-## Product, growth & business
-
-### Product & discovery (12)
-`activation-design` · `churn-prevention` · `customer-research` · `discovery-interview` · `estimate-ticket` · `feature-planning` · `funnel-analysis` · `onboarding-design` · `po-discovery` · `refine-ticket` · `retention-loops` · `rice-prioritization`
-
-### Strategy (9)
-`build-buy-partner` · `competitive-moat-analysis` · `competitive-positioning` · `contracts-cognition` · `market-entry-analysis` · `okr-tree-modeling` · `positioning-strategy` · `validate-feature-fit` · `vision-articulation`
-
-### Finance (7)
-`dcf-modeling` · `forecast-accuracy` · `forecasting` · `fundraising-narrative` · `runway-cognition` · `scenario-modeling` · `unit-economics-modeling`
-
-### GTM & sales (4)
-`deal-qualification-meddic` · `expansion-playbook` · `gtm-launch` · `pipeline-strategy`
-
-### People & org (7)
-`comp-banding` · `hiring-loop-design` · `onboarding-program` · `one-on-one-cadence` · `org-design` · `perf-feedback-craft` · `throughput-vs-morale-tradeoff`
-
-## Content & media
-
-### Content & writing (7)
-`content-funnel-design` · `doc-coauthoring` · `editorial-calendar` · `release-comms` · `script-writing` · `voc-extract` · `voice-and-tone-design`
-
-### AI video & image (8)
-`character-consistency` · `image-creator` · `motion-choreographer` · `pixar-storyteller` · `prediction-pool-optimizer` · `scene-expander` · `song-to-script` · `video-director`
-
-## Platform & maintenance
-
-### Agent-admin & meta (51)
-The largest family — skills that maintain the package itself (authoring,
-condensation, routing, memory, MCP, prompt tooling). Day-to-day product work
-rarely touches these directly.
-
-`adr-create` · `agent-docs-writing` · `agents-md-thin-root` · `check-refs` · `command-routing` · `command-writing` · `condense-memory` · `context-authoring` · `context-document` · `copilot-agents-optimization` · `copilot-config` · `corpus-grounding` · `description-assist` · `devcontainer` · `file-editor` · `guideline-writing` · `learning-to-rule-or-skill` · `lint-skills` · `markitdown` · `mcp` · `mcp-builder` · `md-language-check` · `memory-consolidation` · `module-detect-on-the-fly` · `module-management` · `override-management` · `persona-writing` · `project-docs` · `prompt-engineering-patterns` · `prompt-optimizer` · `prompt-validator` · `readme-reviewer` · `readme-writing` · `readme-writing-package` · `refine-prompt` · `repomix-packer` · `roadmap-management` · `roadmap-writing` · `rtk-output-filtering` · `rule-refactor` · `rule-writing` · `sequential-thinking` · `skill-improvement-pipeline` · `skill-management` · `skill-reviewer` · `skill-writing` · `subagent-orchestration` · `tech-debt-tracker` · `token-optimizer` · `upstream-contribute` · `using-git-worktrees`
-
-## See also
-
-- [`catalog.md`](catalog.md) — the flat, public capability surface (all types).
-- [`flows.md`](flows.md) — the work journeys these skills compose into.
-- [`profiles.md`](profiles.md) · [`experiences/`](experiences/) — which profiles surface which families.
-- [`artefact-census.md`](artefact-census.md) — the counted baseline (227 skills).

package/docs/spawn-site-policy.md

@@ -1,72 +0,0 @@
-# Spawn-Site Policy — subprocess env-hardening classification
-
-> Every place agent-config spawns a subprocess is classified into one of four
-> buckets. The bucket decides whether the spawn MUST route its environment
-> through `hardenedSpawnEnv()` (`src/scripts/_lib/spawn_env.ts`). This document
-> is the single authoritative inventory — a new spawn site is visible in a PR
-> diff as either an addition to a bucket below or an unclassified site that
-> contradicts this doc's completeness claim. That git-diff visibility is the
-> enforcement mechanism (a dedicated lint was considered and **rejected** — see
-> ADR-123 and the "No lint" note below).
-
-## The buckets
-
-| Bucket | Definition | Env rule |
-|---|---|---|
-| **Consumer Runtime** | Runs on the end-user's machine as part of the installed package — the hook dispatcher, dispatched hook concerns, and the AI-council CLI transport. The parent `process.env` is whatever the user's agent/shell exposes and is influenceable by repo content the agent just read. | **MUST** pass `env: hardenedSpawnEnv(overrides?)`. |
-| **Maintainer CLI / tooling** | Runs on a maintainer's dev machine, invoked explicitly (benchmarks, fixture replay, wizards, one-off scripts). The env is the maintainer's own. | SHOULD prefer the helper; MAY use raw env with a stated reason. Not attacker-controlled. |
-| **CI (trusted)** | Runs inside this repo's GitHub Actions on the repo's own refs (git/gh helpers reading `git log` / `gh pr view`). Env is set by the workflow file, not by PR content; fork PRs get no secrets. | Raw env permitted. Migrate only if a job begins consuming untrusted fork content into its env. |
-| **Install-time** | Runs during `npx`/install (the installer spawning package managers from a lockfile). | Raw env permitted; installs are lockfile-pinned. Revisit if an installer step ingests untrusted input. |
-
-## Consumer-Runtime inventory (the security-critical set)
-
-All Consumer-Runtime spawns route through `hardenedSpawnEnv()`:
-
-| Site | Spawns | Status |
-|---|---|---|
-| `src/scripts/ai_council/clients.ts::_runSubprocess` | provider CLIs (`codex`/`claude`/`gemini`) | ✅ hardened (ADR-123 / PR #984) |
-| `src/scripts/hot_context_hook.ts` | `git rev-parse` | ✅ hardened (PR #984) |
-| `src/scripts/roadmap_progress_hook.ts` | tsx regenerator (runs git) | ✅ hardened (PR #984) |
-| `src/scripts/hooks/dispatch_hook.ts` | every hook concern via tsx | ✅ hardened (this roadmap) |
-| `src/scripts/hooks/replay_hook.ts` | re-dispatches through the runtime | Maintainer/fixture tool; its downstream concern spawn is hardened by `dispatch_hook` above. Exempt at this layer. |
-
-Any NEW consumer-runtime spawn (a new hook that shells out, a new installed
-runtime path) MUST be added to this table and route through `hardenedSpawnEnv`.
-
-## Maintainer / CI / Install (exempt, with rationale)
-
-The remaining spawn sites (benchmarks `bench_*`, `consumer_matrix`, the
-installer `install.ts`, the fleet CLI, and the ~15 git/gh maintainer helpers
-such as `check_trunk_drift`, `evidence_report`, `print_required_checks`,
-`check_release_pr_shape`, `migration_status`, …) are Maintainer CLI, trusted CI,
-or install-time. Their environment is the maintainer's own or GitHub Actions'
-workflow-controlled env — not influenced by untrusted repo content the agent
-read at runtime. They are exempt from the MUST rule. A maintainer/CI site moves
-to the Consumer-Runtime bucket (and MUST harden) only if it starts running on an
-end-user machine or ingesting untrusted fork content into its spawn env.
-
-## What `hardenedSpawnEnv` scrubs
-
-Deny-by-family (not an allowlist — the CLIs legitimately need arbitrary env):
-dynamic loader (`LD_*`, `DYLD_*`, `GCONV_PATH`), git command hooks
-(`GIT_*_COMMAND`, `GIT_EXTERNAL_DIFF`, `GIT_SSH_COMMAND`, `GIT_PAGER`, `PAGER`),
-**git config-injection** (`GIT_CONFIG` and the whole `GIT_CONFIG_*` family —
-`GIT_CONFIG_COUNT`/`_KEY_<n>`/`_VALUE_<n>`/`_GLOBAL`/`_SYSTEM`, the
-`core.fsmonitor` RCE primitive), `GIT_ALTERNATE_OBJECT_DIRECTORIES`,
-`HOSTALIASES`, runtime auto-exec hooks (`NODE_OPTIONS`, `BASH_ENV`, `ENV`,
-`PYTHON*`, `PERL5*`, `RUBYOPT`), and `IFS`. Everything else is preserved.
-
-## No lint (deliberate)
-
-A CI lint forbidding raw spawn in runtime paths was proposed and **rejected**
-(council 2026-07-21; recorded in ADR-123): it is net-new governance surface (a
-CI gate + allowlist + exemption-adjudication + false-positive triage), which the
-complexity-budget lock forbids ("must not become a new rule/linter/gate"). This
-inventory doc is the self-enforcing substitute — its completeness claim is
-checked by git-diff visibility at review time, not by a build gate.
-
-## See also
-
-- `docs/decisions/ADR-123-runtime-security-scope-and-spawn-hardening.md` — the runtime-security scope decision + the rejected-lint record.
-- `docs/threat-model.md` row (g) — the subprocess-env-inheritance vector.
-- `src/scripts/_lib/spawn_env.ts` — the helper.