@geraldmaron/construct 1.0.0

package/skills/roles/qa.test-automation.md

@@ -0,0 +1,49 @@
+<!--
+skills/roles/qa.test-automation.md — Anti-pattern guidance for the Qa.test-automation (test automation) role.
+
+Loaded at sync time to inline role-specific failure modes into specialist agent prompts.
+Covers common failure modes for the qa.test-automation (test automation) domain and counter-moves to avoid them.
+Applies to: cx-test-automation.
+-->
+---
+role: qa.test-automation
+applies_to: [cx-test-automation]
+inherits: qa
+version: 1
+---
+# Test Automation Overlay
+
+Additional failure modes on top of the qa core.
+
+
+### 1. Flaky tests tolerated
+**Symptom**: tests retried until green; flakes treated as "environmental noise."
+**Why it fails**: signal erodes — real regressions hide among the flakes. Developers stop trusting the suite.
+**Counter-move**: quarantine flakes immediately with a tracking ticket. Target zero retries for trusted tests.
+
+### 2. E2E-heavy pyramid
+**Symptom**: test suite dominated by slow, wide end-to-end tests with few unit tests.
+**Why it fails**: feedback loops get slow; debug surface is huge; CI time balloons.
+**Counter-move**: push coverage down the pyramid: unit > integration > e2e. Each layer tests what the one below can't.
+
+### 3. Shared state between tests
+**Symptom**: tests that must run in a specific order or share a database row.
+**Why it fails**: parallelization breaks; reordering breaks; failures become non-reproducible.
+**Counter-move**: every test sets up and tears down its own fixtures. Parallelize-safe by default.
+
+### 4. Assertions on implementation
+**Symptom**: tests that snapshot internal state or spy on private methods.
+**Why it fails**: refactors break the suite without changing behavior; test trust drops, tests get deleted.
+**Counter-move**: assert on observable behavior (outputs, side effects at boundaries). Treat internals as off-limits.
+
+### 5. CI as the only runner
+**Symptom**: tests only pass in CI; developers can't run them locally.
+**Why it fails**: debug cycles are 10x slower; test health decays between CI runs.
+**Counter-move**: every test runnable locally with one command. Fixtures and mocks self-contained.
+
+## Self-check before shipping
+- [ ] Zero flakes in the trusted suite
+- [ ] Pyramid shape: mostly unit, some integration, few e2e
+- [ ] Tests isolated; no shared state
+- [ ] Assertions on behavior, not internals
+- [ ] Suite runs locally with one command

package/skills/roles/qa.web-ui.md

@@ -0,0 +1,37 @@
+<!--
+skills/roles/qa.web-ui.md — Anti-pattern guidance for the Qa.web-ui (web ui) role.
+
+Loaded at sync time to inline role-specific failure modes into specialist agent prompts.
+Covers common failure modes for the qa.web-ui (web ui) domain and counter-moves to avoid them.
+Applies to: cx-qa, cx-test-automation.
+-->
+---
+role: qa.web-ui
+applies_to: [cx-qa, cx-test-automation]
+inherits: qa
+version: 1
+---
+# Web UI QA Overlay
+
+Additional failure modes on top of the QA core.
+
+### 1. Testing screens instead of user flows
+**Symptom**: tests assert that elements exist but not that the user can complete the job.
+**Why it fails**: visual presence is not behavioral confidence.
+**Counter-move**: cover critical flows across loading, empty, error, keyboard, and responsive states.
+
+### 2. Accessibility left to a separate pass
+**Symptom**: keyboard navigation, focus management, labels, and contrast are not acceptance criteria.
+**Why it fails**: accessibility defects are product defects and often break automation too.
+**Counter-move**: include keyboard-only and screen-reader-relevant checks in the test plan.
+
+### 3. Fragile selectors
+**Symptom**: tests depend on CSS classes, animation timing, or arbitrary sleeps.
+**Why it fails**: automation becomes flaky and loses trust.
+**Counter-move**: use stable roles, labels, test IDs, and deterministic waits.
+
+## Self-check before shipping
+- [ ] Critical flows include loading, empty, error, and responsive states
+- [ ] Keyboard and accessible-name checks are included
+- [ ] Selectors are stable and waits are deterministic
+- [ ] Visual regressions cover states that users actually encounter

package/skills/roles/researcher.explorer.md

@@ -0,0 +1,43 @@
+<!--
+skills/roles/researcher.explorer.md — Anti-pattern guidance for the Researcher.explorer (explorer) role.
+
+Loaded at sync time to inline role-specific failure modes into specialist agent prompts.
+Covers common failure modes for the researcher.explorer (explorer) domain and counter-moves to avoid them.
+Applies to: cx-explorer.
+-->
+---
+role: researcher.explorer
+applies_to: [cx-explorer]
+inherits: researcher
+version: 1
+---
+# Codebase Explorer Overlay
+
+Additional failure modes on top of the researcher core.
+
+
+### 1. Summarizing without paths
+**Symptom**: "there's a validation layer in the auth module" with no file or line reference.
+**Why it fails**: the reader can't verify or act on the claim. The next session re-does the search.
+**Counter-move**: cite every finding with `path:line` or at minimum `path`. No claim without a pointer.
+
+### 2. Pattern-match by name
+**Symptom**: assuming `validateUser()` does what its name suggests without reading the body.
+**Why it fails**: names lie. The function may wrap, delegate, or do something unrelated.
+**Counter-move**: read the function body and its callers before asserting what it does.
+
+### 3. Shallow single-grep conclusions
+**Symptom**: one grep returns nothing, conclude "feature doesn't exist."
+**Why it fails**: the feature may use a different term, be split across files, or be dynamically dispatched.
+**Counter-move**: try 3+ naming variations. Check adjacent directories. Read the entry points.
+
+### 4. Over-scoping the exploration
+**Symptom**: producing a 5-page architecture tour for a question that only needed one file.
+**Why it fails**: burns the consumer's time and context window; the answer drowns in tangent.
+**Counter-move**: answer the question asked. Link supporting material; don't inline it unless asked.
+
+## Self-check before shipping
+- [ ] Every claim cites a path, ideally with a line
+- [ ] Function behavior verified from the body, not the name
+- [ ] Searched multiple naming variants and entry points
+- [ ] Response scoped to the question asked

package/skills/roles/researcher.md

@@ -0,0 +1,68 @@
+<!--
+skills/roles/researcher.md — Anti-pattern guidance for the Researcher role.
+
+Loaded at sync time to inline role-specific failure modes into specialist agent prompts.
+Covers common failure modes for the researcher domain and counter-moves to avoid them.
+Applies to: cx-researcher, cx-ux-researcher, cx-explorer.
+-->
+---
+role: researcher
+applies_to: [cx-researcher, cx-ux-researcher, cx-explorer]
+inherits: null
+version: 1
+---
+# Researcher — Role guidance
+
+Load this before drafting. These are the failure modes that separate strong role output from weak role output — check your draft against each.
+
+
+### 1. Confirmation bias
+**Symptom**: the research converges on the answer the author already suspected, using sources selected to support it.
+**Why it fails**: the reader learns nothing new; decisions rest on motivated reasoning.
+**Counter-move**: actively search for disconfirming evidence. Name the strongest counter-finding and address it.
+
+### 2. Single-source conclusions
+**Symptom**: a finding rests on one blog post, one vendor page, or one paper.
+**Why it fails**: any single source can be wrong, outdated, or biased. Confidence is borrowed from the source's authority, not the evidence.
+**Counter-move**: require at least two independent sources for each load-bearing claim. Note when they disagree.
+
+### 3. Freshness blindness
+**Symptom**: cited source dated 2019 used as current for a fast-moving topic — AI capabilities, framework APIs, security advisories.
+**Why it fails**: the reader assumes the finding is current; acts on stale information.
+**Counter-move**: check and record the publication date of every source. For fast-moving topics, prefer sources within the last 12 months.
+
+### 4. Findings without confidence
+**Symptom**: all findings presented flatly, with no distinction between what is well-established and what is speculative.
+**Why it fails**: the reader cannot decide how much weight to place on each claim.
+**Counter-move**: label each finding high / medium / low confidence, with a one-line reason.
+
+### 5. Observation confused with inference
+**Symptom**: the doc presents what the author concluded as what the source said.
+**Why it fails**: the conclusion cannot be audited. Reviewers who disagree cannot find the step where the logic turned.
+**Counter-move**: separate "what the source said" from "what I infer from this". Label them.
+
+### 6. Secondary sources passed as primary
+**Symptom**: citations point to summaries, listicles, or syntheses instead of the underlying paper, spec, or changelog.
+**Why it fails**: the summary may misrepresent the primary source. The chain of error is invisible.
+**Counter-move**: cite primary sources — the actual paper, spec, commit, or dataset. Use secondary sources only to discover primary ones.
+
+### 7. Scope creep
+**Symptom**: the research question was about X but the brief covers X, Y, and Z because they came up.
+**Why it fails**: the original question does not get answered well; reviewers cannot tell which findings are load-bearing.
+**Counter-move**: answer the original question first and completely. Tangential findings go into a separate section or a follow-up.
+
+### 8. Action without evidence threshold
+**Symptom**: the implications section recommends a change without stating what evidence would have led to a different recommendation.
+**Why it fails**: the research is unfalsifiable. Any finding leads to the same recommendation.
+**Counter-move**: state up-front what evidence would cause the recommendation to flip. Verify the actual evidence meets the threshold.
+
+## Self-check before shipping
+
+- [ ] Strongest counter-finding is named and addressed
+- [ ] Each load-bearing claim has at least two independent sources
+- [ ] Source dates recorded; fast-moving topics use recent sources
+- [ ] Each finding labeled with confidence and reason
+- [ ] Observation separated from inference
+- [ ] Citations point to primary sources
+- [ ] Original question is answered first; tangents are separate
+- [ ] Evidence threshold for the recommendation is stated

package/skills/roles/researcher.ux.md

@@ -0,0 +1,43 @@
+<!--
+skills/roles/researcher.ux.md — Anti-pattern guidance for the Researcher.ux (ux) role.
+
+Loaded at sync time to inline role-specific failure modes into specialist agent prompts.
+Covers common failure modes for the researcher.ux (ux) domain and counter-moves to avoid them.
+Applies to: cx-ux-researcher.
+-->
+---
+role: researcher.ux
+applies_to: [cx-ux-researcher]
+inherits: researcher
+version: 1
+---
+# UX Researcher Overlay
+
+Additional failure modes on top of the researcher core.
+
+
+### 1. Leading questions
+**Symptom**: asking "do you like X?" or "would this feature be useful?"
+**Why it fails**: social desirability bias; users say yes to things they'd never actually use.
+**Counter-move**: ask about past behavior, not future preference. "When did you last do X? Walk me through it."
+
+### 2. Confusing opinion with evidence
+**Symptom**: reporting "users said they want Y" as a finding.
+**Why it fails**: stated preference diverges from revealed preference. Features built on asked-for wants often go unused.
+**Counter-move**: separate self-report from observed behavior. Weight observed behavior higher.
+
+### 3. Sample of one
+**Symptom**: quoting a single interviewee as representative of the user base.
+**Why it fails**: any one user is an outlier on some axis. Decisions built on N=1 encode that person's quirks.
+**Counter-move**: aim for 5+ on any behavioral claim. Flag "from 1 of 5 participants" explicitly.
+
+### 4. Prescribing solutions in findings
+**Symptom**: findings document recommending specific UI changes.
+**Why it fails**: collapses the problem-space exploration into a solution bias; design has less room to iterate.
+**Counter-move**: report the problem (friction, confusion, unmet need). Let design own the solution.
+
+## Self-check before shipping
+- [ ] Questions focus on past behavior, not hypothetical future
+- [ ] Observed behavior weighted over self-report
+- [ ] Sample size stated for every claim
+- [ ] Findings describe problems, not prescribe solutions

package/skills/roles/reviewer.devil-advocate.md

@@ -0,0 +1,43 @@
+<!--
+skills/roles/reviewer.devil-advocate.md — Anti-pattern guidance for the Reviewer.devil-advocate (devil advocate) role.
+
+Loaded at sync time to inline role-specific failure modes into specialist agent prompts.
+Covers common failure modes for the reviewer.devil-advocate (devil advocate) domain and counter-moves to avoid them.
+Applies to: cx-devil-advocate.
+-->
+---
+role: reviewer.devil-advocate
+applies_to: [cx-devil-advocate]
+inherits: reviewer
+version: 1
+---
+# Devil's Advocate Overlay
+
+Additional failure modes on top of the reviewer core.
+
+
+### 1. Objecting in the abstract
+**Symptom**: "this seems risky" or "have you considered scale?" with no concrete scenario.
+**Why it fails**: generic concerns are dismissable. The author has no material to respond to.
+**Counter-move**: pose a specific failure scenario with inputs, state, and the resulting failure mode.
+
+### 2. Stopping at the first objection
+**Symptom**: raising one issue, declaring the plan "needs rework," stepping back.
+**Why it fails**: high-stakes decisions need the full surface area of risk, not one cherry-picked flaw.
+**Counter-move**: produce three distinct categories of objection (technical, operational, strategic) before concluding.
+
+### 3. Contrarianism for its own sake
+**Symptom**: objecting to every proposal, including the ones that are well-reasoned.
+**Why it fails**: becomes noise; teams learn to route around the skeptic. Real risks stop being heard.
+**Counter-move**: explicitly rank objections by severity. Mark some as "acknowledge but proceed."
+
+### 4. Missing the reversibility lens
+**Symptom**: treating a cheap, reversible experiment with the same caution as a one-way door.
+**Why it fails**: slows down learning that should be fast; teams stop bringing you early ideas.
+**Counter-move**: classify the decision on the reversibility axis first. Calibrate pushback accordingly.
+
+## Self-check before shipping
+- [ ] Each objection names a concrete scenario
+- [ ] At least three categories of risk covered
+- [ ] Objections ranked by severity
+- [ ] Reversibility of the decision assessed

package/skills/roles/reviewer.evaluator.md

@@ -0,0 +1,43 @@
+<!--
+skills/roles/reviewer.evaluator.md — Anti-pattern guidance for the Reviewer.evaluator (evaluator) role.
+
+Loaded at sync time to inline role-specific failure modes into specialist agent prompts.
+Covers common failure modes for the reviewer.evaluator (evaluator) domain and counter-moves to avoid them.
+Applies to: cx-evaluator.
+-->
+---
+role: reviewer.evaluator
+applies_to: [cx-evaluator]
+inherits: reviewer
+version: 1
+---
+# Evaluator Overlay
+
+Additional failure modes on top of the reviewer core.
+
+
+### 1. Rubric-free scoring
+**Symptom**: giving a 7/10 without declaring what 7 means or what distinguishes it from 6 or 8.
+**Why it fails**: scores aren't comparable across reviewers or over time. No one can act on them.
+**Counter-move**: state the rubric (criteria + level descriptors) before scoring. Score against the rubric, not against vibes.
+
+### 2. Single-sample conclusions
+**Symptom**: evaluating on one example and extrapolating to the system.
+**Why it fails**: the sample may be unrepresentative. Confidence intervals are meaningless at N=1.
+**Counter-move**: require a sample size appropriate to the claim. Report N alongside the result.
+
+### 3. Missing counterfactuals
+**Symptom**: rating a new approach as "good" without comparing to the current baseline.
+**Why it fails**: any output looks fine in isolation. The real question is whether it's better than what's shipping.
+**Counter-move**: always include an A/B against baseline. Report the delta, not the absolute.
+
+### 4. Confounded comparisons
+**Symptom**: changing the prompt, model, and retrieval at once and attributing gains to "the new system."
+**Why it fails**: can't tell which change did what; can't roll back specifically if quality regresses.
+**Counter-move**: change one variable at a time. Pin the others.
+
+## Self-check before shipping
+- [ ] Rubric declared before scoring
+- [ ] Sample size reported and defensible
+- [ ] Baseline comparison included
+- [ ] One variable changed per run; others pinned

package/skills/roles/reviewer.md

@@ -0,0 +1,68 @@
+<!--
+skills/roles/reviewer.md — Anti-pattern guidance for the Reviewer role.
+
+Loaded at sync time to inline role-specific failure modes into specialist agent prompts.
+Covers common failure modes for the reviewer domain and counter-moves to avoid them.
+Applies to: cx-reviewer, cx-devil-advocate, cx-evaluator, cx-trace-reviewer.
+-->
+---
+role: reviewer
+applies_to: [cx-reviewer, cx-devil-advocate, cx-evaluator, cx-trace-reviewer]
+inherits: null
+version: 1
+---
+# Reviewer — Role guidance
+
+Load this before drafting. These are the failure modes that separate strong role output from weak role output — check your draft against each.
+
+
+### 1. Nit-picking over structure
+**Symptom**: the review focuses on variable names and formatting while leaving the structural problem — wrong abstraction, missing tests, unsafe concurrency — unflagged.
+**Why it fails**: the author fixes the surface and ships the real bug. The reviewer signals thoroughness while providing no real coverage.
+**Counter-move**: audit structure first — correctness, blast radius, invariants, test coverage — before any style feedback.
+
+### 2. LGTM without running the code
+**Symptom**: approval given based on reading the diff, with no build, no test run, no exploration of the change in situ.
+**Why it fails**: the diff hides integration bugs, broken imports, and runtime behavior that reading cannot catch.
+**Counter-move**: pull the branch. Run the build. Run the tests. Exercise the changed path at least once.
+
+### 3. Missed blast radius
+**Symptom**: the review evaluates the change in isolation without identifying what else the change could affect.
+**Why it fails**: shared utilities, public APIs, and cross-module contracts get broken silently.
+**Counter-move**: grep for callers of anything changed. Check whether the change is backwards-compatible for each.
+
+### 4. No severity
+**Symptom**: all feedback presented at the same weight — a typo and a security vulnerability get equal prominence.
+**Why it fails**: the author cannot tell what blocks merge versus what is optional. Real issues get lost.
+**Counter-move**: label each finding CRITICAL / HIGH / MEDIUM / LOW. State what the author must address before merge.
+
+### 5. Unfalsifiable suggestions
+**Symptom**: feedback like "this feels off" or "consider a cleaner approach" without a specific alternative or reason.
+**Why it fails**: the author cannot act on it; rounds of revision drift without convergence.
+**Counter-move**: name the concrete alternative or the specific principle being violated. If you cannot, omit the comment.
+
+### 6. Skipping the tests
+**Symptom**: review approves without looking at whether new behavior is covered by tests, whether tests actually test what they claim, or whether existing tests still pass.
+**Why it fails**: coverage erodes quietly; bugs ship under the protection of a passing suite that tests the wrong thing.
+**Counter-move**: verify new behavior has at least one test that would fail if the behavior regressed. Read the tests, not just the coverage number.
+
+### 7. Overriding instead of reviewing
+**Symptom**: the reviewer rewrites the change themselves instead of explaining the problem.
+**Why it fails**: the author does not learn. The reviewer becomes the bottleneck. The code loses the author's context.
+**Counter-move**: describe the issue and the principle. Let the author propose the fix. Rewrite only when specifically asked.
+
+### 8. Silent approval of risky changes
+**Symptom**: a change touching auth, payments, migrations, or data integrity gets waved through without explicit scrutiny of the risk.
+**Why it fails**: high-blast-radius changes ship without the review rigor they warrant.
+**Counter-move**: flag risky changes up-front. Require the author to state the rollback plan. Escalate to security or SRE if the domain warrants.
+
+## Self-check before shipping
+
+- [ ] Structural issues evaluated before stylistic ones
+- [ ] Branch pulled, build run, tests run, changed path exercised
+- [ ] Callers of changed code identified; backwards-compatibility checked
+- [ ] Each finding labeled CRITICAL / HIGH / MEDIUM / LOW
+- [ ] Every suggestion names a concrete alternative or principle
+- [ ] New behavior has a test that would catch its regression
+- [ ] High-risk domains (auth, payments, data) explicitly scrutinized
+- [ ] Rewrote only when asked; otherwise described the issue

package/skills/roles/reviewer.trace.md

@@ -0,0 +1,43 @@
+<!--
+skills/roles/reviewer.trace.md — Anti-pattern guidance for the Reviewer.trace (trace) role.
+
+Loaded at sync time to inline role-specific failure modes into specialist agent prompts.
+Covers common failure modes for the reviewer.trace (trace) domain and counter-moves to avoid them.
+Applies to: cx-trace-reviewer.
+-->
+---
+role: reviewer.trace
+applies_to: [cx-trace-reviewer]
+inherits: reviewer
+version: 1
+---
+# Trace Reviewer Overlay
+
+Additional failure modes on top of the reviewer core.
+
+
+### 1. Reading traces in isolation
+**Symptom**: judging a single trace as good or bad without the context of the surrounding distribution.
+**Why it fails**: an individual trace may be fine while the system is failing in aggregate, or vice versa.
+**Counter-move**: pull a sample (20+) of similar traces. Characterize the distribution before judging any one.
+
+### 2. Score without evidence citation
+**Symptom**: writing a low score with a general complaint ("response is unclear") and no span reference.
+**Why it fails**: the author can't locate the issue; the feedback isn't actionable.
+**Counter-move**: cite the specific span, step, or tool call by ID. Quote the offending output.
+
+### 3. Confusing latency with quality
+**Symptom**: marking slow traces as bad or fast traces as good without checking the output.
+**Why it fails**: two orthogonal axes; conflating them drives optimization at the expense of correctness.
+**Counter-move**: score latency and quality separately. Report both.
+
+### 4. Ignoring tool-call failures
+**Symptom**: reviewing the final output while skipping over failed or retried tool calls mid-trace.
+**Why it fails**: the final output may mask a degraded path that costs time, money, or reliability.
+**Counter-move**: examine the full tool-call chain. Flag any failure, retry, or fallback.
+
+## Self-check before shipping
+- [ ] Judged against a sampled distribution, not one trace
+- [ ] Each issue cites a specific span or tool call
+- [ ] Latency and quality reported separately
+- [ ] Full tool-call chain examined

package/skills/roles/security.ai.md

@@ -0,0 +1,37 @@
+<!--
+skills/roles/security.ai.md — Anti-pattern guidance for the Security.ai (ai) role.
+
+Loaded at sync time to inline role-specific failure modes into specialist agent prompts.
+Covers common failure modes for the security.ai (ai) domain and counter-moves to avoid them.
+Applies to: cx-security, cx-ai-engineer.
+-->
+---
+role: security.ai
+applies_to: [cx-security, cx-ai-engineer]
+inherits: security
+version: 1
+---
+# AI Security Overlay
+
+Additional failure modes on top of the security core.
+
+### 1. Prompt injection treated as prompt quality
+**Symptom**: hostile instructions in retrieved or user-provided content are handled by stronger wording.
+**Why it fails**: model obedience is not a security boundary.
+**Counter-move**: separate data from instructions, constrain tools, validate outputs, and deny unsafe actions by policy.
+
+### 2. Tool access too broad
+**Symptom**: the model can call tools unrelated to the current task or with unchecked arguments.
+**Why it fails**: compromised context can trigger real side effects.
+**Counter-move**: scope tools per task, validate schemas, and require approval for destructive or external actions.
+
+### 3. Retrieval leaks data
+**Symptom**: vector search ignores tenant, permission, retention, or sensitivity labels.
+**Why it fails**: embeddings can bypass normal access-control paths.
+**Counter-move**: enforce ACL-aware retrieval, source citation, redaction, and index freshness checks.
+
+## Self-check before shipping
+- [ ] Prompt injection paths are modeled
+- [ ] Tool access is scoped and schema-validated
+- [ ] Retrieval respects ACL, tenant, retention, and sensitivity boundaries
+- [ ] Unsafe outputs have validation or human review

package/skills/roles/security.appsec.md

@@ -0,0 +1,37 @@
+<!--
+skills/roles/security.appsec.md — Anti-pattern guidance for the Security.appsec (appsec) role.
+
+Loaded at sync time to inline role-specific failure modes into specialist agent prompts.
+Covers common failure modes for the security.appsec (appsec) domain and counter-moves to avoid them.
+Applies to: cx-security.
+-->
+---
+role: security.appsec
+applies_to: [cx-security]
+inherits: security
+version: 1
+---
+# AppSec Overlay
+
+Additional failure modes on top of the security core.
+
+### 1. Trusting framework defaults
+**Symptom**: auth, CSRF, XSS, serialization, or validation is assumed safe because the framework usually handles it.
+**Why it fails**: custom glue code is where defaults stop applying.
+**Counter-move**: trace untrusted input from boundary to sink and verify explicit controls at each hop.
+
+### 2. Authorization checked only at the UI
+**Symptom**: controls hide actions but APIs still accept them.
+**Why it fails**: attackers call APIs directly.
+**Counter-move**: verify server-side authorization for every privileged operation.
+
+### 3. Errors and logs leak context
+**Symptom**: debug details, identifiers, tokens, or PII are logged or returned.
+**Why it fails**: observability becomes data exposure.
+**Counter-move**: check log paths and error responses for sensitive data.
+
+## Self-check before shipping
+- [ ] Input-to-sink paths are traced
+- [ ] Server-side authorization gates privileged operations
+- [ ] Error and log output avoids sensitive data
+- [ ] Tests cover malicious and unauthorized requests

package/skills/roles/security.cloud.md

@@ -0,0 +1,37 @@
+<!--
+skills/roles/security.cloud.md — Anti-pattern guidance for the Security.cloud (cloud) role.
+
+Loaded at sync time to inline role-specific failure modes into specialist agent prompts.
+Covers common failure modes for the security.cloud (cloud) domain and counter-moves to avoid them.
+Applies to: cx-security.
+-->
+---
+role: security.cloud
+applies_to: [cx-security]
+inherits: security
+version: 1
+---
+# Cloud Security Overlay
+
+Additional failure modes on top of the security core.
+
+### 1. Overbroad identity
+**Symptom**: services run with wildcard permissions, shared roles, or long-lived credentials.
+**Why it fails**: one compromise becomes account-wide access.
+**Counter-move**: require least privilege, workload identity, rotation, and clear blast-radius boundaries.
+
+### 2. Public exposure by default
+**Symptom**: buckets, queues, databases, dashboards, or admin endpoints rely on obscurity or network convention.
+**Why it fails**: accidental public access is a common cloud breach path.
+**Counter-move**: verify network policy, encryption, logging, and public access blocks.
+
+### 3. No evidence trail
+**Symptom**: security controls exist but cannot be demonstrated.
+**Why it fails**: incidents and audits require evidence, not intent.
+**Counter-move**: ensure audit logs, policy-as-code checks, and drift detection are present.
+
+## Self-check before shipping
+- [ ] IAM is least-privilege and scoped by workload
+- [ ] Public access, encryption, network policy, and secrets are checked
+- [ ] Audit logs and drift detection exist
+- [ ] Blast radius is explicit

package/skills/roles/security.legal-compliance.md

@@ -0,0 +1,49 @@
+<!--
+skills/roles/security.legal-compliance.md — Anti-pattern guidance for the Security.legal-compliance (legal compliance) role.
+
+Loaded at sync time to inline role-specific failure modes into specialist agent prompts.
+Covers common failure modes for the security.legal-compliance (legal compliance) domain and counter-moves to avoid them.
+Applies to: cx-legal-compliance.
+-->
+---
+role: security.legal-compliance
+applies_to: [cx-legal-compliance]
+inherits: security
+version: 1
+---
+# Legal & Compliance Overlay
+
+Additional failure modes on top of the security core.
+
+
+### 1. Compliance theater
+**Symptom**: producing policy documents to pass audit while the implementation doesn't match.
+**Why it fails**: real incidents expose the gap; regulators and customers lose trust faster than they were gained.
+**Counter-move**: each policy commitment maps to a testable control in the code or process. No control, no commitment.
+
+### 2. Data retention without deletion
+**Symptom**: a retention policy on paper; no automated purge job in production.
+**Why it fails**: PII accumulates; GDPR/CCPA deletion requests can't be honored; breach blast radius grows.
+**Counter-move**: implement retention as scheduled deletion at the storage layer. Test the purge quarterly.
+
+### 3. Consent as checkbox
+**Symptom**: a single pre-checked "I agree" that bundles analytics, marketing, and third-party sharing.
+**Why it fails**: fails GDPR specificity requirements; CCPA opt-out obligations get buried.
+**Counter-move**: granular consent per purpose; opt-in unchecked; withdrawal as easy as granting.
+
+### 4. AI features without disclosure
+**Symptom**: shipping an AI-powered feature without telling users their data trains or feeds a model.
+**Why it fails**: growing disclosure obligations (EU AI Act, FTC guidance); trust loss if discovered later.
+**Counter-move**: disclose AI use, data flow, and opt-out path in-product. Update privacy policy in the same change.
+
+### 5. License drift in dependencies
+**Symptom**: adding a GPL or AGPL dependency to a proprietary product without review.
+**Why it fails**: contaminates the license of the whole product; costly to unwind later.
+**Counter-move**: automated license scan in CI; allowlist policy per product tier.
+
+## Self-check before shipping
+- [ ] Policies map to testable controls
+- [ ] Retention enforced by automated deletion
+- [ ] Consent granular, opt-in, withdrawable
+- [ ] AI use disclosed in-product and in policy
+- [ ] Dependency licenses scanned and allowlisted