@event4u/agent-config 9.9.0 → 9.11.0

package/dist/agent-src/skills/decision-record/SKILL.md

@@ -129,31 +129,33 @@ Output the structured payload (below). The user — or
 ## Weighted-matrix mode (quantitative)
 
 Optional numeric variant of step 3. **Gate — fire only when ALL hold:**
-≥ 3 options · no single dominant criterion · costly / hard-to-reverse ·
-commensurable criteria (no values conflict). 2-option or reversible choice →
-one-line redirect: just decide, or qualitative matrix above. Full procedure,
-anchors, worked example: [`references/weighted-matrix.md`](references/weighted-matrix.md).
-
-1. User states decision + options.
-2. **User lists criteria + weights (1-10) BEFORE any scoring** — AI may
-   append missed criteria afterward, each labeled `(AI-suggested)`. Never
-   propose criteria first (anchoring).
+≥ 3 options · no single dominant criterion · costly / hard-to-reverse
+decision · commensurable criteria (no values conflict). A 2-option or
+reversible choice gets a one-line redirect: just decide, or use the
+qualitative matrix above. Full procedure, anchors, worked example:
+[`references/weighted-matrix.md`](references/weighted-matrix.md).
+
+1. User states the decision + options.
+2. **User lists criteria and weights (1-10) BEFORE any scoring** — the AI
+   may append missed criteria afterward, each labeled `(AI-suggested)`.
+   Never propose criteria first (anchoring).
 3. Criteria hygiene: cap 4-8, merge near-synonyms (double-counting check).
 4. Score options 1-10 against **fixed anchors** (each criterion declares
    what 1 and what 10 mean — never relative-to-best-in-set).
-5. Weighted sums, then **sensitivity block — the load-bearing gate**:
+5. Weighted sums, then the **sensitivity block — the load-bearing gate**:
    close-call margin (< 10 % = "no clear winner — decide on unquantified
    factors"), smallest weight change that flips the winner, ±1-score flip
-   test. Fragile winner reported as fragile, never as "the rational choice".
-6. Delegate argue-against to
+   test. A fragile winner is reported as fragile, never as "the rational
+   choice".
+6. Delegate the argue-against pass to
    [`adversarial-review`](../adversarial-review/SKILL.md), scoped: "attack
-   the winner, using the losing options' strongest criteria" (`premortem`
-   delegation pattern — never reimplemented inline).
+   the winner, using the losing options' strongest criteria" (the
+   `premortem` delegation pattern — never reimplemented inline).
 
-Output appends matrix + sensitivity block + attack summary + intuition
+Output appends matrix + sensitivity block + attack summary + the intuition
 caveat (resistance to the result signals a wrong weight or unquantified
 information — surface it, don't ignore it). **The score is a structured
-argument, not a verdict.** Hand-off to `adr-create` unchanged.
+argument, not a verdict.** Hand-off to `adr-create` is unchanged.
 
 ## Related Skills
 
@@ -189,8 +191,8 @@ argument, not a verdict.** Hand-off to `adr-create` unchanged.
 - "Wir müssen ein ADR draus machen."
 - "Trade-off-Matrix für X vs Y."
 - "Diese Entscheidung überschreibt das alte ADR-NN."
-- "Weighted decision matrix für die Optionen" / "score my options
-  against my criteria" — fires the weighted-matrix mode (gate permitting).
+- "Weighted decision matrix für die Optionen" / "score my options against
+  my criteria" — fires the weighted-matrix mode (gate permitting).
 
 ## Output
 

package/dist/agent-src/skills/design-intelligence/SKILL.md

@@ -139,10 +139,10 @@ Dials persist in `DESIGN.md`; the stack executors (`tailwind-engineer`,
 design direction, cross-check your first impulse against the current-generation
 tells in [`design-antipatterns.md`](../../../docs/guidelines/design-antipatterns.md)
 (§ Current-generation tells — the warm-editorial C5+T2+T7 signature and the
-previous-generation C1/C2 gradient) plus the L1/L2 layout defaults. If a tell was
-your first reach, name a different direction or explicitly justify why this brief
-genuinely calls for it. (The finalization cross-check against the full catalog is
-under *Anti-slop discipline* below.)
+previous-generation C1/C2 gradient) plus the L1/L2 layout defaults. If a tell
+was your first reach, name a different direction or explicitly justify why this
+brief genuinely calls for it. (The finalization cross-check against the full
+catalog is under *Anti-slop discipline* below.)
 
 ## Honesty / real-system grounding
 

package/dist/agent-src/skills/design-review/SKILL.md

@@ -58,19 +58,19 @@ A **live preview URL** is required for testing.
 ### Phase 1: Interaction
 
 - Test user flows end-to-end.
-- **Six interaction states — every interactive element asserts each one** (single
-  canonical states checklist; no other review phase repeats it):
-  1. **default** — resting state is a deliberate style, not the browser default.
-  2. **hover** — pointer feedback present (not the *only* affordance — see focus).
+- **Six interaction states — every interactive element asserts each one** (this
+  is the single canonical states checklist; no other review phase repeats it):
+  1. **default** — the resting state is a deliberate style, not the browser default.
+  2. **hover** — pointer feedback present (and not the *only* affordance — see focus).
   3. **active** — pressed/engaged state visibly distinct from hover.
-  4. **disabled** — unmistakably non-interactive (a contrast dip a user cannot read
-     as "disabled" is a WCAG 1.4.1 failure — see `accessibility-auditor`).
-  5. **focus** — visible `:focus-visible` indicator (Q6 floor, `lint_design_quality`).
-  6. **loading** — explicit pending state (skeleton/spinner/disabled-submit), never a dead frozen control.
+  4. **disabled** — visually unmistakable as non-interactive (a contrast dip alone
+     that a user cannot read as "disabled" is a WCAG 1.4.1 failure — see `accessibility-auditor`).
+  5. **focus** — a visible `:focus-visible` indicator (Q6 floor, `lint_design_quality`).
+  6. **loading** — an explicit pending state (skeleton/spinner/disabled-submit), never a dead frozen control.
 - **Transition timing** between these states follows the motion bands in
   [`fe-design`](../fe-design/SKILL.md) § Motion (micro-feedback ~100–200 ms;
   structural open/close ~200–500 ms) — the timing source of truth; do not restate
-  a competing band set here. Every animated transition carries a
+  a competing band set here. Every animated transition also carries a
   `prefers-reduced-motion` alternative (M5 / Q4).
 - Test keyboard navigation (Tab, Enter, Escape, Arrow keys).
 - Verify form submission and error recovery.
@@ -312,11 +312,12 @@ and position it against [`verify-repair-loop`](../verify-repair-loop/SKILL.md)
 **Why the audit passes stay serial (not a parallel-4 fan-out).** A fan-out of
 a11y + slop + hierarchy + states across four subagents was evaluated and
 deferred: the passes share one live browser/navigation session and later phases
-build on state established by earlier ones — not cleanly independent; and the
-expensive part (browser probing / screenshots) is already offloaded by the async
-verifier above, which captures the fan-out's main win without four separate
-views. Reconsider only when `design-review` runs as a standalone heavy batch over
-many *independent* surfaces, where per-surface `do-in-parallel` genuinely pays.
+build on state established by earlier ones, so they are not cleanly independent;
+and the expensive part — browser probing / screenshots — is already offloaded by
+the async verifier above, which captures the fan-out's main win without spinning
+up four separate views. Reconsider only when `design-review` runs as a standalone
+heavy batch over many *independent* surfaces, where per-surface
+`do-in-parallel` genuinely pays.
 
 ## Gotcha
 

package/dist/agent-src/skills/design-system-capture/reference/design-system-json.md

@@ -1,10 +1,10 @@
 # `design-system.json` — import contract
 
 > Lazy-loaded by `design-system-capture` ONLY when importing an extracted design
-> system. Not in the always-on skill body. The **consumer-side contract**: any
-> external static-extraction tool (URL / git repo / local dir) emits this shape;
-> the skill READS it to seed/merge `DESIGN.md`. We own the contract, not the
-> crawler (council 2026-06-28).
+> system. Not part of the always-on skill body. This is the **consumer-side
+> contract**: any external static-extraction tool (URL / git repo / local dir
+> crawler) emits this shape; the skill READS it to seed/merge `DESIGN.md`. We
+> own the contract, not the crawler (council 2026-06-28).
 
 ## Shape
 
@@ -31,32 +31,35 @@
 ## Field rules
 
 - **Map to DTCG where it maps cleanly.** `colors` / `typography` / `spacing` /
-  `radius` / `shadow` = the DTCG `.tokens.json` shape `design-tokens` /
-  `brand-to-tokens` already author — reuse it; never a parallel token format.
-- **Mark extraction-only metadata.** Observation, not a token decision, lives
-  under `_meta` (`motion._meta.detected_libs`, `components[].observed`). Informs
-  the human; never becomes a token.
-- **`source` is mandatory** — `kind` + `ref` + `captured_at`. No provenance →
-  reject (can't confirm what you can't trace).
-- **`bundled_local`** is a flag, not an instruction: the package never
-  downloads/bundles fonts (out of scope); it records that the source did.
+  `radius` / `shadow` correspond to the DTCG `.tokens.json` shape that
+  `design-tokens` / `brand-to-tokens` already author — reuse it; do **not**
+  invent a parallel token format.
+- **Mark extraction-only metadata.** Anything that is *observation*, not a
+  token decision, lives under a `_meta` key (e.g. `motion._meta.detected_libs`,
+  `components[].observed`). It informs the human; it never becomes a token.
+- **`source` is mandatory** — `kind` + `ref` + `captured_at`. An artifact with
+  no provenance is rejected (you cannot confirm what you cannot trace).
+- **`bundled_local`** on a font family is a flag, not an instruction: the
+  package never downloads or bundles fonts (out of scope) — it records that the
+  source did.
 
 ## Trust posture (mandatory)
 
-An import is **observed, not authoritative** (mirrors `source-discovery`:
-evidence vs. authoritative). It seeds `DESIGN.md` as a **proposal the human
-confirms per field** — never a silent write. A field conflicting with a
-registered brand value (confirmed `.tokens.json` / brand token) is **flagged,
-never auto-applied** (`brand-source-of-truth`). Precedence: registered brand
-tokens > confirmed `DESIGN.md` > imported observation.
+An imported artifact is **observed, not authoritative** (mirrors
+`source-discovery`: evidence vs. authoritative). It seeds `DESIGN.md` as a
+**proposal the human confirms per field** — never a silent write. A field that
+conflicts with a registered brand value (a confirmed `.tokens.json` / brand
+token) is **flagged, never auto-applied** (`brand-source-of-truth`: consumer
+brand wins). Precedence on import: registered brand tokens > confirmed
+`DESIGN.md` > imported observation.
 
 ## Two sources, one shape
 
-- **External target** (a site/repo you don't own) → external standalone tool
-  emits `design-system.json`; hand it to `design-system-capture`.
+- **External target** (a site/repo you do not own) → an external standalone
+  tool emits `design-system.json`; hand it to `design-system-capture`.
 - **Current repo** → prefer [`existing-ui-audit`](../../existing-ui-audit/SKILL.md):
-  it inventories the codebase and emits the same shape, so the import path is
-  identical either way.
+  it already inventories the codebase's components/tokens and can emit the same
+  `design-system.json` shape, so the import path is identical either way.
 
-Package **owns this contract**; does **not** ship the crawler, the Playwright
-runtime, or a font-bundler.
+The package **owns this contract**; it does **not** ship the crawler, the
+Playwright runtime, or a font-bundler.

package/dist/agent-src/skills/devcontainer/SKILL.md

@@ -23,7 +23,7 @@ Do NOT use when:
 
 1. **Gather context** — read `.devcontainer/devcontainer.json`, check `.devcontainer/` for env files and docs, check `agents/overrides/skills/devcontainer.md` for project-specific overrides.
 2. **Identify change type** — classify: image change, feature addition, secret addition, extension change, or env var change.
-3. **Make the change** — edit `devcontainer.json` (or related files). Follow conventions below for secrets, features, and env variables.
+3. **Make the change** — edit `devcontainer.json` (or related files). Follow conventions below for secrets, features, and environment variables.
 4. **Build and verify** — run `devcontainer build` to confirm the container builds. Check that extensions load and ports forward correctly.
 5. **Document** — if adding a new secret or dependency, update the onboarding docs in `.devcontainer/`.
 
@@ -97,7 +97,7 @@ Read `devcontainer.json` for the actual secret definitions and requirements.
 
 - DevContainer
 - Codespaces
-- dev env
+- dev environment
 - container setup
 
 ### Validate

package/dist/agent-src/skills/docker/SKILL.md

@@ -242,7 +242,7 @@ RUN --mount=type=cache,target=/root/.npm \
 
 - All PHP commands (artisan, composer, phpunit) must run INSIDE the PHP container — never on the host.
 - The fast container and Xdebug container share the same codebase but have different PHP configs — don't confuse them.
-- `docker compose down -v` destroys volumes including the DB — use `down` without `-v` unless you mean it.
+- `docker compose down -v` destroys volumes including the database — use `down` without `-v` unless you mean it.
 - The model forgets to use `docker compose exec -T` (no TTY) when running in scripts or CI.
 
 ## Do NOT

package/dist/agent-src/skills/docx-authoring/evals/triggers.json

@@ -0,0 +1,52 @@
+{
+    "skill": "docx-authoring",
+    "last_eval": "2026-07-30",
+    "description": "5 should-trigger + 5 should-not-trigger queries. Should-trigger covers DE + EN phrasings for WRITING a Word .docx — create from content, fill a supplied template, surgical body-XML edit. Should-not-trigger covers the near-miss neighbours (docx→Markdown reading, PDF authoring, spreadsheets, slide decks, prose co-authoring) whose vocabulary overlaps.",
+    "queries": [
+        {
+            "q": "generate a .docx report from this content",
+            "trigger": true
+        },
+        {
+            "q": "fill this Word template with these values and save a copy",
+            "trigger": true
+        },
+        {
+            "q": "edit the heading and one table cell inside this existing .docx",
+            "trigger": true
+        },
+        {
+            "q": "erzeuge daraus ein Word-Dokument mit A4-Seitenformat und einer Tabelle",
+            "trigger": true
+        },
+        {
+            "q": "produce the contract as a Word file, not a PDF",
+            "trigger": true
+        },
+        {
+            "q": "extract the text of this .docx into Markdown so I can read it here",
+            "trigger": false,
+            "note": "reading a docx into the conversation, not writing one → markitdown"
+        },
+        {
+            "q": "merge these PDFs and fill the PDF form fields",
+            "trigger": false,
+            "note": "PDF authoring surface, different library-per-task path → pdf-tools"
+        },
+        {
+            "q": "build me a budget model with formulas in a spreadsheet",
+            "trigger": false,
+            "note": "spreadsheet/model authoring, not an OOXML text document → spreadsheet-authoring"
+        },
+        {
+            "q": "turn this into a slide deck for the pitch tomorrow",
+            "trigger": false,
+            "note": "presentation surface; pptx is gated, decks go to → html-deck"
+        },
+        {
+            "q": "help me write the PRD itself — structure the sections and stress-test the reader test",
+            "trigger": false,
+            "note": "authoring the prose/content of a spec, not producing the .docx container → doc-coauthoring"
+        }
+    ]
+}

package/dist/agent-src/skills/emit-tickets/SKILL.md

@@ -97,7 +97,7 @@ Apply this floor **before** marking any ticket `lite`:
 - Any miss → split the ticket further, or escalate to `medium`
 - Architectural / multi-module → `high` (use `adr-create` first)
 
-**Gate:** run `./scripts-run src/scripts/lint_ticket_buildable agents/tickets/{slug}/`
+**Gate:** run `./scripts-run src/scripts/lint_ticket_buildable.ts agents/tickets/{slug}/`
 and fix all errors before declaring any ticket `lite`. This is the only
 authoritative check — do not skip it.
 
@@ -154,7 +154,7 @@ If the file does not exist, create it with the `bundles:` root.
 ### §8 — Run the buildability gate
 
 ```bash
-./scripts-run src/scripts/lint_ticket_buildable agents/tickets/{slug}/
+./scripts-run src/scripts/lint_ticket_buildable.ts agents/tickets/{slug}/
 ```
 
 Fix every reported error. Re-run until exit code 0. Max 3 attempts; if still

package/dist/agent-src/skills/error-handling-patterns/SKILL.md

@@ -126,7 +126,7 @@ Exactly **one** layer translates internal errors to the egress format (HTTP stat
 
 ## Provenance
 
-- Adopted from: an external reference (MIT, © 2025 an external reference) — **Sunset Policy applied**: 636-line source reduced to a ~150-line decision framework; language catalogues externalized to the upstream resources below.
+- Adopted from: an external reference (internal provenance, redacted) — **Sunset Policy applied**: a large source reduced to a ~150-line decision framework; language catalogues externalized to the upstream resources below.
 - Externalized catalogues:
   - Python: https://docs.python.org/3/tutorial/errors.html · https://docs.python.org/3/library/exceptions.html
   - PHP / Laravel: https://laravel.com/docs/errors · https://www.php.net/manual/en/language.exceptions.php

package/dist/agent-src/skills/estimate-ticket/SKILL.md

@@ -74,7 +74,7 @@ Before producing numbers, check:
 - Is there a rollback plan implied?
 
 If the ticket scores low on estimability (vague AC, no out-of-scope,
-no mention of deps), set `uncertainty = Underspecified` and
+no mention of dependencies), set `uncertainty = Underspecified` and
 emit a single-line redirect to `/refine-ticket` at the top of the output.
 
 A **cross-source discrepancy** (per [`cross-source-consistency`](../../rules/cross-source-consistency.md), gated by `consistency.cross_source`) — ticket text contradicting an attached mockup, or a clearly-needed-but-unstated behavior (weekend/holiday shift) — is not estimable as-is: it hides an open scope decision. Raise `uncertainty` and name the discrepancy in the redirect rather than sizing over a contradiction.
@@ -177,7 +177,7 @@ copy-paste instructions if missing.
 - Estimators default to optimism. Every size must cite evidence for at least one of the four axes — not "feels like M".
 - `Underspecified` is not a safe default. Use it only when estimability actually fails; otherwise pick a size and state the risk.
 - `Split: Yes` without concrete split points is useless. Name the slices or drop the recommendation.
-- Persona voices drift into general feedback. Each sentence must be about **sizing** — developer talks impl size, stakeholder talks timeline fit, etc.
+- Persona voices drift into general feedback. Each sentence must be about **sizing** — developer talks implementation size, stakeholder talks timeline fit, etc.
 - Story-point mapping (`S=2 / M=3 / L=5 / XL=8`) is the default; projects may override — do NOT hardcode their scale into this skill.
 
 ## Do NOT

package/dist/agent-src/skills/evaluate-llm-feature/SKILL.md

@@ -2,7 +2,6 @@
 model_tier: high
 name: evaluate-llm-feature
 description: "Black-box evaluation of a shipped LLM feature — adversarial probes for hallucination, prompt-injection, and cost-runaway vs stated expectations. Not RAG/embedding. Triggers 'review my chatbot'."
-source: package
 personas:
   - security-engineer
 domain: quality

package/dist/agent-src/skills/evaluate-llm-feature/evals/triggers.json

@@ -0,0 +1,52 @@
+{
+    "skill": "evaluate-llm-feature",
+    "last_eval": "2026-07-30",
+    "description": "5 should-trigger + 5 should-not-trigger queries. Should-trigger covers DE + EN phrasings for black-box evaluation of a SHIPPED consumer LLM feature — hallucination, prompt-injection and cost-runaway probes against stated expectations. Should-not-trigger covers the near-miss neighbours (this suite's own agent config red-team, LLM app-building/RAG, prompt authoring, the single-response injection judge, code security audit) whose vocabulary overlaps.",
+    "queries": [
+        {
+            "q": "review my support chatbot before launch — does it hallucinate or leak its system prompt?",
+            "trigger": true
+        },
+        {
+            "q": "is my summariser safe to ship? probe it for prompt injection through the documents it retrieves",
+            "trigger": true
+        },
+        {
+            "q": "evaluate my deployed AI assistant against what it claims to do and its token budget",
+            "trigger": true
+        },
+        {
+            "q": "teste meinen ausgelieferten KI-Assistenten adversarial auf Halluzinationen und Kosten-Runaway",
+            "trigger": true
+        },
+        {
+            "q": "our doc-QA feature invents API names — run adversarial probes and give me a ship / do-not-ship verdict",
+            "trigger": true
+        },
+        {
+            "q": "red-team my own agent setup — my CLAUDE.md, hooks and MCP servers",
+            "trigger": false,
+            "note": "config-layer red/blue review of this suite's agents, not a shipped consumer feature → agent-security-review"
+        },
+        {
+            "q": "what chunk size and embedding model should I use for my RAG pipeline?",
+            "trigger": false,
+            "note": "building an LLM app (explicitly out of mission for this skill); provider facts → llm-provider-knowledge, prompt design → prompt-engineering-patterns"
+        },
+        {
+            "q": "make this system prompt better — add few-shot examples and self-verification",
+            "trigger": false,
+            "note": "authoring/optimising a prompt, not evaluating a running feature → prompt-engineering-patterns / prompt-optimizer"
+        },
+        {
+            "q": "score whether this single agent response resisted the injected instruction",
+            "trigger": false,
+            "note": "one-response injection-resistance scoring on an axis, not a feature-wide probe campaign → judge-injection-defense"
+        },
+        {
+            "q": "audit the source code of our chat backend for vulnerabilities",
+            "trigger": false,
+            "note": "white-box code vulnerability hunt; this skill is black-box only → security-audit"
+        }
+    ]
+}

package/dist/agent-src/skills/existing-ui-audit/SKILL.md

@@ -31,7 +31,7 @@ Use this skill when:
 Do NOT use when:
 - `directive_set="ui-trivial"` — the trivial path bypasses audit by precondition (≤1 file, ≤5 lines, no new component, no new state, no new dep)
 - `directive_set="backend"` — no UI surface to inventory
-- The audit findings already exist in `state.ui_audit` for this state-file (cached) — re-run only if `package.json` or `composer.json` mtime changed
+- The audit findings already exist in `state.ui_audit` for this state-file — the gate round-trips through SUCCESS once `audit_path` is set, and does **not** re-run for the life of that state-file (see Gotchas for what that does and does not cover)
 
 ## Resource-first context gate (design fidelity)
 
@@ -229,11 +229,12 @@ violations will surface as new findings on every run.
 7. **`state.ui_audit.greenfield`** — boolean; when true, `greenfield_decision` MUST also be set before the dispatcher advances
 8. **`state.ui_audit.a11y_baseline`** *(optional)* — array of `{rule, selector, severity?}` entries documenting pre-existing a11y violations the review gate should treat as informational. Omit the key entirely when no baseline applies; do not write `[]` for "I checked and there are none" — that disables the gate's filter for every future run.
 
-**Design-system export (current-repo source):** to seed `DESIGN.md` from *this*
-repo, emit the inventory as a `design-system.json` artifact (the import contract
-in [`design-system-capture`](../design-system-capture/reference/design-system-json.md))
-and hand it to `design-system-capture` — same shape an external tool produces,
-so the import path is uniform.
+**Design-system export (current-repo source):** when the goal is to seed
+`DESIGN.md` from *this* repo, emit the inventory as a `design-system.json`
+artifact (the import contract in
+[`design-system-capture`](../design-system-capture/reference/design-system-json.md))
+and hand it to `design-system-capture` — the same shape an external extraction
+tool produces, so the import path is uniform.
 
 ## Gotcha
 
@@ -242,7 +243,20 @@ so the import path is uniform.
 - Don't assume a Radix-only `package.json` means shadcn — shadcn requires `components.json` at repo root.
 - `state.ui_audit.shadcn_inventory.version` is often missing; the shadcn CLI does not always pin itself in `package.json`. Record `null` rather than guessing.
 - Greenfield is detected, not assumed — a project with one Blade layout and no components is still greenfield only if tokens AND design system markers AND components are all empty.
-- Re-running the skill on a stale state-file: cache by `(composer.json mtime, package.json mtime)`; if either changed, re-audit and overwrite.
+- **There is no mtime cache.** An earlier revision told you to cache by
+  `(composer.json mtime, package.json mtime)` and re-audit when either changed.
+  No code implemented it, and the key was the wrong one anyway: `apply` adds
+  components without touching a manifest, so a manifest-keyed cache never
+  invalidates on the change that matters. What the engine does is simpler and
+  stricter — `audit.ts` returns SUCCESS unconditionally once `audit_path` is
+  `high_confidence` or `ambiguous`, so the inventory is computed **once per
+  state-file** and never refreshed.
+- **What that means in practice.** A single request is one pass, so the
+  inventory is fresh where it matters. The bounded gap is a run that reuses one
+  state-file across several component additions: components written earlier in
+  that run are absent from the inventory the later ones are checked against.
+  Adding a second component in the same run → re-read the component directories
+  directly rather than trusting `state.ui_audit.components_found`.
 
 ## Anti-slop cross-reference
 

package/dist/agent-src/skills/fe-design/SKILL.md

@@ -63,6 +63,16 @@ where the corpus reports an evidence gap or the audit already pins a
 project pattern. Stack-specific choices come from the dispatched
 implementation skill, not from here.
 
+> **When the corpus is not installed.** `design-intelligence` ships in the
+> `frontend-design` pack; this skill ships in `engineering-base`. A consumer
+> who installed only `laravel` or only `react` therefore has this skill and
+> **not** the corpus. Fall back to the heuristics here and say so in the
+> result — "selected from heuristics; `frontend-design` not installed, so no
+> corpus grounding". The evidence-gap fallback above is about a corpus that
+> answered "nothing here"; this is about a corpus that is absent. Never
+> present an ungrounded pick as grounded, and never record a missing pack as
+> an evidence gap.
+
 ## Component Architecture
 
 ### Page structure (universal shape)

package/dist/agent-src/skills/feature-planning/SKILL.md

@@ -167,7 +167,7 @@ complexity: lightweight  # default — skips bite-sized granularity
 ---
 ```
 
-Source: adapted from an external reference `writing-plans/SKILL.md` § Task Structure + § No Placeholders (v5.1.0); complexity-gating is our addition (Council Round 1, Q4 — mitigates UX pushback for senior engineers on well-scoped work).
+Source: adapted from an external reference; complexity-gating is our addition (Council Round 1, Q4 — mitigates UX pushback for senior engineers on well-scoped work).
 
 ## Self-review (3-scan checklist)
 
@@ -179,7 +179,7 @@ Before presenting any plan, run these three scans in order. Each is a fast pass
 
 This scan is **separate from** adversarial-review (below). Self-review catches mechanical gaps (missing AC, leftover placeholders, mis-shaped types); adversarial-review challenges the plan's reasoning.
 
-Source: adapted from an external reference `writing-plans/SKILL.md` § Self-Review (v5.1.0).
+Source: adapted from an external reference.
 
 ## Adversarial self-review
 

package/dist/agent-src/skills/finishing-a-development-branch/SKILL.md

@@ -63,10 +63,10 @@ or [`fix-pr-comments`](../../commands/fix-pr-comments.md) instead.
 Run the end-of-work gate before presenting any options — see
 [`verify-before-complete`](../verify-before-complete/SKILL.md).
 Steps 1–3 run only when `quality.local_auto_run: true`; under the
-default (`false` / missing) skip them without asking — user runs
+default (`false` / missing) skip them without asking — the user runs
 quality tools manually, remote CI on the PR is the authoritative gate,
-readiness report says *"quality gates delegated to remote CI"* instead
-of claiming them green:
+and the readiness report says *"quality gates delegated to remote CI"*
+instead of claiming them green:
 
 1. Targeted tests green
 2. Full test suite green

package/dist/agent-src/skills/flux/SKILL.md

@@ -115,7 +115,7 @@ current state on the next polish round.
 
 ## Taste Dials
 
-`DESIGN.md` `## Taste Dials` → honour: Variance → layout-family spread + asymmetry; Motion → animation budget + reduced-motion posture; Density → spacing scale + info-per-viewport. Absent → follow brief's inferred dials.
+When `DESIGN.md` declares `## Taste Dials`, honour them: Variance → layout-family spread + asymmetry tolerance; Motion → animation budget + reduced-motion posture; Density → spacing scale + information-per-viewport. Absent → follow the design brief's inferred dials.
 
 ## Do NOT
 

package/dist/agent-src/skills/frontend-render-security/SKILL.md

@@ -11,15 +11,15 @@ packs:
 
 # frontend-render-security
 
-AI optimizes for the shortest code producing the requested visible behavior and omits the invisible defensive layer — the sanitizer, origin check, server-side gate, security header. Large samples put XSS in a majority of AI frontend code, ~2.74× more than human; every agent in the Tenzai benchmark shipped client-side flaws. High-precision, grep-catchable patterns — stop them at authoring time.
+AI optimizes for the shortest code that produces the requested visible behavior and omits the invisible defensive layer — the sanitizer, the origin check, the server-side gate, the security header. Large samples put XSS in a majority of AI frontend code and ~2.74× more XSS than human code; every agent in the Tenzai benchmark shipped client-side flaws. These are high-precision, grep-catchable patterns — stop them at authoring time.
 
 ## When to use
 
-- Writing/modifying a component, template, or client-side script that renders data, calls an API, handles auth, or reads the URL / `postMessage`.
+- Writing or modifying a component, template, or client-side script that renders data, calls an API, handles auth, or reads the URL / `postMessage`.
 - Reviewing an AI-authored frontend diff.
 - Editing `.tsx` / `.jsx` / `.vue` / `.svelte` / `.html` or client-side `.js` / `.ts`.
 
-Do NOT use when: change is server-only, CLI, or non-UI — route to `security` / `security-sensitive-stop`.
+Do NOT use when: the change is server-only, CLI, or non-UI — route to `security` / `security-sensitive-stop`.
 
 ## The Iron Law
 
@@ -38,15 +38,15 @@ NO SECRET, PRIVILEGED KEY, OR SESSION TOKEN LIVES IN CLIENT CODE OR localStorage
 
 ## The patterns AI ships by default
 
-| Pattern | Why dangerous | Do instead |
+| Pattern | Why it's dangerous | Do instead |
 |---|---|---|
-| `dangerouslySetInnerHTML` / `v-html` / `.innerHTML =` on non-constant value | Stored/DOM XSS (CWE-79) | render as text, or sanitize (DOMPurify) if HTML required |
-| Secret / API key inline or in `NEXT_PUBLIC_*` / `VITE_*` | Bundler inlines it into shipped JS (CWE-798) | call third party via backend-for-frontend proxy; only truly-public values get a public prefix |
-| Client-side-only auth / role / validation | Bypassable via dev tools or proxy (CWE-602) | client gate = UX only; enforce server-side |
+| `dangerouslySetInnerHTML` / `v-html` / `.innerHTML =` on non-constant value | Stored/DOM XSS (CWE-79) | render as text, or sanitize (DOMPurify) if HTML is required |
+| Secret / API key inline or in `NEXT_PUBLIC_*` / `VITE_*` | Bundler inlines it into shipped JS (CWE-798) | call the third party via a backend-for-frontend proxy; only truly-public values get a public prefix |
+| Client-side-only auth / role / validation | Bypassable with dev tools or a proxy (CWE-602) | client gate is UX only; enforce the same check server-side |
 | `location.*` / query param → HTML or JS sink | DOM XSS (CWE-79) | `textContent`; never pass URL data into an HTML/exec sink |
 | CORS `origin: '*'` (esp. with credentials) | Any site reads authenticated responses (CWE-942) | explicit origin allow-list; never reflect `Origin` on credentialed routes |
 | Token / JWT in `localStorage` / `sessionStorage` | XSS-exfiltratable (CWE-522) | `HttpOnly; Secure; SameSite` cookie |
-| `addEventListener('message', …)` without `event.origin` check | Any embedder drives the handler (CWE-346) | strict-equality `event.origin` vs allow-list first |
+| `addEventListener('message', …)` without `event.origin` check | Any embedder drives the handler (CWE-346) | strict-equality check `event.origin` against an allow-list first |
 | `redirect` / `next` param → `location` / `router.push` | Open redirect / phishing (CWE-601) | relative-path or allow-listed-host only; reject external / non-http schemes |
 | `eval` / `new Function` / string-`setTimeout` on input | Eval injection / RCE (CWE-95) | a parser or explicit allow-list |
 | `target="_blank"` without `rel="noopener"` | Reverse tabnabbing (CWE-1022) | add `rel="noopener noreferrer"` |
@@ -54,7 +54,7 @@ NO SECRET, PRIVILEGED KEY, OR SESSION TOKEN LIVES IN CLIENT CODE OR localStorage
 
 ## Backstop greps
 
-Run before committing frontend changes; each returns zero (or every hit is read + justified):
+Run before committing frontend changes; each should return zero (or every hit is read and justified):
 
 ```bash
 # Insecure render + eval sinks
@@ -70,16 +70,16 @@ rg -n 'target=["'\'']_blank["'\'']'   # then confirm rel="noopener" present
 
 ## Output format
 
-1. A per-diff verdict listing each pattern class checked + result (`clean` / `hit at file:line → fixed by <change>`).
+1. A per-diff verdict listing each pattern class checked and its result (`clean` / `hit at file:line → fixed by <change>`).
 2. The backstop greps run, with results.
-3. For any client gate added, file:line of its **server-side twin** (or an explicit note the server check already exists + where).
+3. For any client gate added, the file:line of its **server-side twin** (or an explicit note that the server check already exists and where).
 
 ## Gotcha
 
-- Modern browsers default `_blank` to `noopener`, but legacy/embedded webviews don't — keep the `rel` for portability.
+- Modern browsers default `_blank` to `noopener`, but legacy/embedded webviews do not — keep the `rel` for portability.
 - `NEXT_PUBLIC_`/`VITE_` on a *genuinely* public value (a publishable analytics ID) is fine; the violation is a *sensitive* name behind that prefix. Read the name, don't blanket-block the prefix.
 - A sanitizer (DOMPurify) is the fix only when HTML output is actually required; if plain text suffices, render text and skip the dependency.
-- Client-side validation isn't wrong — it's wrong *as the only* enforcement. Keep it for UX; add the server twin.
+- Client-side validation is not wrong — it is wrong *as the only* enforcement. Keep it for UX; add the server twin.
 
 ## Do NOT