@geraldmaron/construct 1.0.4 → 1.0.6

package/skills/roles/product-manager.growth.md

@@ -1,5 +1,5 @@
 <!--
-skills/roles/product-manager.growth.md — Anti-pattern guidance for the Product-manager.growth (growth) role.
+skills/roles/product-manager.growth.md. Anti-pattern guidance for the Product-manager.growth (growth) role.
 
 Loaded at sync time to inline role-specific failure modes into specialist agent prompts.
 Covers common failure modes for the product-manager.growth (growth) domain and counter-moves to avoid them.
@@ -9,7 +9,9 @@ Applies to: cx-product-manager, cx-business-strategist.
 role: product-manager.growth
 applies_to: [cx-product-manager, cx-business-strategist]
 inherits: product-manager
-version: 1
+version: 2
+profiles: [rnd]
+cap: 1
 ---
 # Growth PM Overlay
 

package/skills/roles/product-manager.md

@@ -1,5 +1,5 @@
 <!--
-skills/roles/product-manager.md — Anti-pattern guidance for the Product-manager role.
+skills/roles/product-manager.md. Anti-pattern guidance for the Product-manager role.
 
 Loaded at sync time to inline role-specific failure modes into specialist agent prompts.
 Covers common failure modes for the product-manager domain and counter-moves to avoid them.
@@ -9,11 +9,13 @@ Applies to: cx-product-manager, cx-business-strategist.
 role: product-manager
 applies_to: [cx-product-manager, cx-business-strategist]
 inherits: null
-version: 1
+version: 2
+profiles: [rnd]
+cap: 1
 ---
-# Product Manager — Role guidance
+# Product Manager. Role guidance
 
-Load this before drafting. These are the failure modes that separate strong role output from weak role output — check your draft against each.
+Load this before drafting. These are the failure modes that separate strong role output from weak role output. check your draft against each.
 
 
 ### 1. Solution in the problem statement

package/skills/roles/product-manager.platform.md

@@ -1,5 +1,5 @@
 <!--
-skills/roles/product-manager.platform.md — Anti-pattern guidance for the Product-manager.platform (platform) role.
+skills/roles/product-manager.platform.md. Anti-pattern guidance for the Product-manager.platform (platform) role.
 
 Loaded at sync time to inline role-specific failure modes into specialist agent prompts.
 Covers common failure modes for the product-manager.platform (platform) domain and counter-moves to avoid them.
@@ -9,7 +9,9 @@ Applies to: cx-product-manager.
 role: product-manager.platform
 applies_to: [cx-product-manager]
 inherits: product-manager
-version: 1
+version: 2
+profiles: [rnd]
+cap: 1
 ---
 # Platform PM Overlay
 

package/skills/roles/product-manager.product.md

@@ -1,5 +1,5 @@
 <!--
-skills/roles/product-manager.product.md — Anti-pattern guidance for the Product-manager.product (product) role.
+skills/roles/product-manager.product.md. Anti-pattern guidance for the Product-manager.product (product) role.
 
 Loaded at sync time to inline role-specific failure modes into specialist agent prompts.
 Covers common failure modes for the product-manager.product (product) domain and counter-moves to avoid them.
@@ -9,7 +9,9 @@ Applies to: cx-product-manager.
 role: product-manager.product
 applies_to: [cx-product-manager]
 inherits: product-manager
-version: 1
+version: 2
+profiles: [rnd]
+cap: 1
 ---
 # Product PM Overlay
 

package/skills/roles/qa.ai-eval.md

@@ -1,5 +1,5 @@
 <!--
-skills/roles/qa.ai-eval.md — Anti-pattern guidance for the Qa.ai-eval (ai eval) role.
+skills/roles/qa.ai-eval.md. Anti-pattern guidance for the Qa.ai-eval (ai eval) role.
 
 Loaded at sync time to inline role-specific failure modes into specialist agent prompts.
 Covers common failure modes for the qa.ai-eval (ai eval) domain and counter-moves to avoid them.
@@ -9,7 +9,9 @@ Applies to: cx-qa, cx-test-automation, cx-evaluator.
 role: qa.ai-eval
 applies_to: [cx-qa, cx-test-automation, cx-evaluator]
 inherits: qa
-version: 1
+version: 2
+profiles: [rnd]
+cap: 1
 ---
 # AI Eval QA Overlay
 

package/skills/roles/qa.api-contract.md

@@ -1,5 +1,5 @@
 <!--
-skills/roles/qa.api-contract.md — Anti-pattern guidance for the Qa.api-contract (api contract) role.
+skills/roles/qa.api-contract.md. Anti-pattern guidance for the Qa.api-contract (api contract) role.
 
 Loaded at sync time to inline role-specific failure modes into specialist agent prompts.
 Covers common failure modes for the qa.api-contract (api contract) domain and counter-moves to avoid them.
@@ -9,7 +9,9 @@ Applies to: cx-qa, cx-test-automation.
 role: qa.api-contract
 applies_to: [cx-qa, cx-test-automation]
 inherits: qa
-version: 1
+version: 2
+profiles: [rnd]
+cap: 1
 ---
 # API Contract QA Overlay
 

package/skills/roles/qa.data-pipeline.md

@@ -1,5 +1,5 @@
 <!--
-skills/roles/qa.data-pipeline.md — Anti-pattern guidance for the Qa.data-pipeline (data pipeline) role.
+skills/roles/qa.data-pipeline.md. Anti-pattern guidance for the Qa.data-pipeline (data pipeline) role.
 
 Loaded at sync time to inline role-specific failure modes into specialist agent prompts.
 Covers common failure modes for the qa.data-pipeline (data pipeline) domain and counter-moves to avoid them.
@@ -9,7 +9,9 @@ Applies to: cx-qa, cx-test-automation.
 role: qa.data-pipeline
 applies_to: [cx-qa, cx-test-automation]
 inherits: qa
-version: 1
+version: 2
+profiles: [rnd]
+cap: 1
 ---
 # Data Pipeline QA Overlay
 

package/skills/roles/qa.md

@@ -1,5 +1,5 @@
 <!--
-skills/roles/qa.md — Anti-pattern guidance for the Qa role.
+skills/roles/qa.md. Anti-pattern guidance for the Qa role.
 
 Loaded at sync time to inline role-specific failure modes into specialist agent prompts.
 Covers common failure modes for the qa domain and counter-moves to avoid them.
@@ -9,15 +9,17 @@ Applies to: cx-qa, cx-test-automation.
 role: qa
 applies_to: [cx-qa, cx-test-automation]
 inherits: null
-version: 1
+version: 2
+profiles: [rnd]
+cap: 1
 ---
-# QA — Role guidance
+# QA. Role guidance
 
-Load this before drafting. These are the failure modes that separate strong role output from weak role output — check your draft against each.
+Load this before drafting. These are the failure modes that separate strong role output from weak role output. check your draft against each.
 
 
 ### 1. Testing the mock
-**Symptom**: the test asserts that the mock was called with the expected arguments — and that is all it asserts.
+**Symptom**: the test asserts that the mock was called with the expected arguments. and that is all it asserts.
 **Why it fails**: the test passes regardless of whether the real system would. Mocks drift from the real contract silently.
 **Counter-move**: assert on observable outputs or state. Use mocks for isolation, not as the thing being tested.
 

package/skills/roles/qa.test-automation.md

@@ -1,5 +1,5 @@
 <!--
-skills/roles/qa.test-automation.md — Anti-pattern guidance for the Qa.test-automation (test automation) role.
+skills/roles/qa.test-automation.md. Anti-pattern guidance for the Qa.test-automation (test automation) role.
 
 Loaded at sync time to inline role-specific failure modes into specialist agent prompts.
 Covers common failure modes for the qa.test-automation (test automation) domain and counter-moves to avoid them.
@@ -9,7 +9,9 @@ Applies to: cx-test-automation.
 role: qa.test-automation
 applies_to: [cx-test-automation]
 inherits: qa
-version: 1
+version: 2
+profiles: [rnd]
+cap: 1
 ---
 # Test Automation Overlay
 
@@ -18,7 +20,7 @@ Additional failure modes on top of the qa core.
 
 ### 1. Flaky tests tolerated
 **Symptom**: tests retried until green; flakes treated as "environmental noise."
-**Why it fails**: signal erodes — real regressions hide among the flakes. Developers stop trusting the suite.
+**Why it fails**: signal erodes. real regressions hide among the flakes. Developers stop trusting the suite.
 **Counter-move**: quarantine flakes immediately with a tracking ticket. Target zero retries for trusted tests.
 
 ### 2. E2E-heavy pyramid

package/skills/roles/qa.web-ui.md

@@ -1,5 +1,5 @@
 <!--
-skills/roles/qa.web-ui.md — Anti-pattern guidance for the Qa.web-ui (web ui) role.
+skills/roles/qa.web-ui.md. Anti-pattern guidance for the Qa.web-ui (web ui) role.
 
 Loaded at sync time to inline role-specific failure modes into specialist agent prompts.
 Covers common failure modes for the qa.web-ui (web ui) domain and counter-moves to avoid them.
@@ -9,7 +9,9 @@ Applies to: cx-qa, cx-test-automation.
 role: qa.web-ui
 applies_to: [cx-qa, cx-test-automation]
 inherits: qa
-version: 1
+version: 2
+profiles: [rnd]
+cap: 1
 ---
 # Web UI QA Overlay
 

package/skills/roles/researcher.explorer.md

@@ -1,5 +1,5 @@
 <!--
-skills/roles/researcher.explorer.md — Anti-pattern guidance for the Researcher.explorer (explorer) role.
+skills/roles/researcher.explorer.md. Anti-pattern guidance for the Researcher.explorer (explorer) role.
 
 Loaded at sync time to inline role-specific failure modes into specialist agent prompts.
 Covers common failure modes for the researcher.explorer (explorer) domain and counter-moves to avoid them.
@@ -9,7 +9,9 @@ Applies to: cx-explorer.
 role: researcher.explorer
 applies_to: [cx-explorer]
 inherits: researcher
-version: 1
+version: 2
+profiles: [rnd]
+cap: 1
 ---
 # Codebase Explorer Overlay
 

package/skills/roles/researcher.md

@@ -1,5 +1,5 @@
 <!--
-skills/roles/researcher.md — Anti-pattern guidance for the Researcher role.
+skills/roles/researcher.md. Anti-pattern guidance for the Researcher role.
 
 Loaded at sync time to inline role-specific failure modes into specialist agent prompts.
 Covers common failure modes for the researcher domain and counter-moves to avoid them.
@@ -9,11 +9,13 @@ Applies to: cx-researcher, cx-ux-researcher, cx-explorer.
 role: researcher
 applies_to: [cx-researcher, cx-ux-researcher, cx-explorer]
 inherits: null
-version: 1
+version: 2
+profiles: [rnd]
+cap: 1
 ---
-# Researcher — Role guidance
+# Researcher. Role guidance
 
-Load this before drafting. These are the failure modes that separate strong role output from weak role output — check your draft against each.
+Load this before drafting. These are the failure modes that separate strong role output from weak role output. check your draft against each.
 
 
 ### 1. Confirmation bias
@@ -27,17 +29,17 @@ Load this before drafting. These are the failure modes that separate strong role
 **Counter-move**: require at least two independent sources for each load-bearing claim. Note when they disagree.
 
 ### 3. Freshness blindness
-**Symptom**: cited source dated 2019–2024 used as current for a fast-moving topic — AI capabilities, framework APIs, security advisories.
+**Symptom**: cited source dated 2019–2024 used as current for a fast-moving topic. AI capabilities, framework APIs, security advisories.
 **Why it fails**: the reader assumes the finding is current; acts on stale information.
 **Counter-move**: start searches from the most recent year and step backward only if insufficient. Record the publication date of every source. For fast-moving topics (LLM behavior, security advisories, market data), treat anything older than 12 months as presumptively stale unless a newer source confirms it is still accurate.
 
 ### 4. Wrong starting point
-**Symptom**: searching Google or a general index when a domain-specific authoritative source exists — arXiv for AI research, NVD for CVEs, NeurIPS/ICML proceedings for ML, official vendor docs for APIs.
+**Symptom**: searching Google or a general index when a domain-specific authoritative source exists. arXiv for AI research, NVD for CVEs, NeurIPS/ICML proceedings for ML, official vendor docs for APIs.
 **Why it fails**: general search returns popularity-ranked results, not authority-ranked ones. The most-cited blog post is not the same as the primary paper.
 **Counter-move**: use the domain's authoritative starting point first (see `rules/common/research.md` §2). Only fall back to general search if the authoritative source is insufficient.
 
 ### 5. Unverified URLs
-**Symptom**: URLs included in the brief have not been fetched — the researcher copied them from a search result or from memory.
+**Symptom**: URLs included in the brief have not been fetched. the researcher copied them from a search result or from memory.
 **Why it fails**: URLs rot. A confident citation pointing to a 404 or a different page than intended is worse than no citation.
 **Counter-move**: fetch every URL before including it. Confirm the content matches the cited claim. Mark any URL that cannot be fetched `[unverified]` and flag it as a gap.
 
@@ -54,7 +56,7 @@ Load this before drafting. These are the failure modes that separate strong role
 ### 8. Secondary sources passed as primary
 **Symptom**: citations point to summaries, listicles, or syntheses instead of the underlying paper, spec, or changelog.
 **Why it fails**: the summary may misrepresent the primary source. The chain of error is invisible.
-**Counter-move**: cite primary sources — the actual paper, spec, commit, or dataset. Use secondary sources only to discover primary ones.
+**Counter-move**: cite primary sources. the actual paper, spec, commit, or dataset. Use secondary sources only to discover primary ones.
 
 ### 9. Scope creep
 **Symptom**: the research question was about X but the brief covers X, Y, and Z because they came up.
@@ -75,7 +77,7 @@ Load this before drafting. These are the failure modes that separate strong role
 - [ ] Each load-bearing claim has at least two independent sources (or one authoritative primary)
 - [ ] Source dates recorded; fast-moving topics use sources within last 12 months
 - [ ] Each finding labeled with confidence (high/medium/low) and one-line reason
-- [ ] Observation separated from inference — labeled differently
+- [ ] Observation separated from inference. labeled differently
 - [ ] Citations point to primary sources, not summaries or index pages
 - [ ] Original question answered first; tangents in a separate section
 - [ ] Evidence threshold for the recommendation is stated explicitly

package/skills/roles/researcher.ux.md

@@ -1,5 +1,5 @@
 <!--
-skills/roles/researcher.ux.md — Anti-pattern guidance for the Researcher.ux (ux) role.
+skills/roles/researcher.ux.md. Anti-pattern guidance for the Researcher.ux (ux) role.
 
 Loaded at sync time to inline role-specific failure modes into specialist agent prompts.
 Covers common failure modes for the researcher.ux (ux) domain and counter-moves to avoid them.
@@ -9,7 +9,9 @@ Applies to: cx-ux-researcher.
 role: researcher.ux
 applies_to: [cx-ux-researcher]
 inherits: researcher
-version: 1
+version: 2
+profiles: [rnd]
+cap: 1
 ---
 # UX Researcher Overlay
 

package/skills/roles/reviewer.devil-advocate.md

@@ -1,5 +1,5 @@
 <!--
-skills/roles/reviewer.devil-advocate.md — Anti-pattern guidance for the Reviewer.devil-advocate (devil advocate) role.
+skills/roles/reviewer.devil-advocate.md. Anti-pattern guidance for the Reviewer.devil-advocate (devil advocate) role.
 
 Loaded at sync time to inline role-specific failure modes into specialist agent prompts.
 Covers common failure modes for the reviewer.devil-advocate (devil advocate) domain and counter-moves to avoid them.
@@ -9,7 +9,9 @@ Applies to: cx-devil-advocate.
 role: reviewer.devil-advocate
 applies_to: [cx-devil-advocate]
 inherits: reviewer
-version: 1
+version: 2
+profiles: [rnd]
+cap: 1
 ---
 # Devil's Advocate Overlay
 

package/skills/roles/reviewer.evaluator.md

@@ -1,5 +1,5 @@
 <!--
-skills/roles/reviewer.evaluator.md — Anti-pattern guidance for the Reviewer.evaluator (evaluator) role.
+skills/roles/reviewer.evaluator.md. Anti-pattern guidance for the Reviewer.evaluator (evaluator) role.
 
 Loaded at sync time to inline role-specific failure modes into specialist agent prompts.
 Covers common failure modes for the reviewer.evaluator (evaluator) domain and counter-moves to avoid them.
@@ -9,7 +9,9 @@ Applies to: cx-evaluator.
 role: reviewer.evaluator
 applies_to: [cx-evaluator]
 inherits: reviewer
-version: 1
+version: 2
+profiles: [rnd]
+cap: 1
 ---
 # Evaluator Overlay
 

package/skills/roles/reviewer.md

@@ -1,5 +1,5 @@
 <!--
-skills/roles/reviewer.md — Anti-pattern guidance for the Reviewer role.
+skills/roles/reviewer.md. Anti-pattern guidance for the Reviewer role.
 
 Loaded at sync time to inline role-specific failure modes into specialist agent prompts.
 Covers common failure modes for the reviewer domain and counter-moves to avoid them.
@@ -9,17 +9,19 @@ Applies to: cx-reviewer, cx-devil-advocate, cx-evaluator, cx-trace-reviewer.
 role: reviewer
 applies_to: [cx-reviewer, cx-devil-advocate, cx-evaluator, cx-trace-reviewer]
 inherits: null
-version: 1
+version: 2
+profiles: [rnd]
+cap: 1
 ---
-# Reviewer — Role guidance
+# Reviewer. Role guidance
 
-Load this before drafting. These are the failure modes that separate strong role output from weak role output — check your draft against each.
+Load this before drafting. These are the failure modes that separate strong role output from weak role output. check your draft against each.
 
 
 ### 1. Nit-picking over structure
-**Symptom**: the review focuses on variable names and formatting while leaving the structural problem — wrong abstraction, missing tests, unsafe concurrency — unflagged.
+**Symptom**: the review focuses on variable names and formatting while leaving the structural problem. wrong abstraction, missing tests, unsafe concurrency. unflagged.
 **Why it fails**: the author fixes the surface and ships the real bug. The reviewer signals thoroughness while providing no real coverage.
-**Counter-move**: audit structure first — correctness, blast radius, invariants, test coverage — before any style feedback.
+**Counter-move**: audit structure first. correctness, blast radius, invariants, test coverage. before any style feedback.
 
 ### 2. LGTM without running the code
 **Symptom**: approval given based on reading the diff, with no build, no test run, no exploration of the change in situ.
@@ -32,7 +34,7 @@ Load this before drafting. These are the failure modes that separate strong role
 **Counter-move**: grep for callers of anything changed. Check whether the change is backwards-compatible for each.
 
 ### 4. No severity
-**Symptom**: all feedback presented at the same weight — a typo and a security vulnerability get equal prominence.
+**Symptom**: all feedback presented at the same weight. a typo and a security vulnerability get equal prominence.
 **Why it fails**: the author cannot tell what blocks merge versus what is optional. Real issues get lost.
 **Counter-move**: label each finding CRITICAL / HIGH / MEDIUM / LOW. State what the author must address before merge.
 
@@ -71,11 +73,11 @@ Load this before drafting. These are the failure modes that separate strong role
 
 A review that approves while these gates would fail in CI is a failed review. Run or confirm the author ran:
 
-- [ ] `npm test` — 0 failed
-- [ ] `node bin/construct lint:comments` — 0 errors AND 0 warnings (treat warnings as blocking)
-- [ ] `node bin/construct docs:verify` — all checks passed, no warnings
-- [ ] `node bin/construct docs:update --check` — AUTO regions up to date
-- [ ] `npm run lint:templates` — commit subjects + PR body match the canonical templates
+- [ ] `npm test`. 0 failed
+- [ ] `node bin/construct lint:comments`. 0 errors AND 0 warnings (treat warnings as blocking)
+- [ ] `node bin/construct docs:verify`. all checks passed, no warnings
+- [ ] `node bin/construct docs:update --check`. AUTO regions up to date
+- [ ] `npm run lint:templates`. commit subjects + PR body match the canonical templates
 
 See `rules/common/release-gates.md`. Block approval until evidence is in the PR body.
 

package/skills/roles/reviewer.trace.md

@@ -1,5 +1,5 @@
 <!--
-skills/roles/reviewer.trace.md — Anti-pattern guidance for the Reviewer.trace (trace) role.
+skills/roles/reviewer.trace.md. Anti-pattern guidance for the Reviewer.trace (trace) role.
 
 Loaded at sync time to inline role-specific failure modes into specialist agent prompts.
 Covers common failure modes for the reviewer.trace (trace) domain and counter-moves to avoid them.
@@ -9,7 +9,9 @@ Applies to: cx-trace-reviewer.
 role: reviewer.trace
 applies_to: [cx-trace-reviewer]
 inherits: reviewer
-version: 1
+version: 2
+profiles: [rnd]
+cap: 1
 ---
 # Trace Reviewer Overlay
 

package/skills/roles/security.ai.md

@@ -1,5 +1,5 @@
 <!--
-skills/roles/security.ai.md — Anti-pattern guidance for the Security.ai (ai) role.
+skills/roles/security.ai.md. Anti-pattern guidance for the Security.ai (ai) role.
 
 Loaded at sync time to inline role-specific failure modes into specialist agent prompts.
 Covers common failure modes for the security.ai (ai) domain and counter-moves to avoid them.
@@ -9,7 +9,9 @@ Applies to: cx-security, cx-ai-engineer.
 role: security.ai
 applies_to: [cx-security, cx-ai-engineer]
 inherits: security
-version: 1
+version: 2
+profiles: [rnd]
+cap: 1
 ---
 # AI Security Overlay
 

package/skills/roles/security.appsec.md

@@ -1,5 +1,5 @@
 <!--
-skills/roles/security.appsec.md — Anti-pattern guidance for the Security.appsec (appsec) role.
+skills/roles/security.appsec.md. Anti-pattern guidance for the Security.appsec (appsec) role.
 
 Loaded at sync time to inline role-specific failure modes into specialist agent prompts.
 Covers common failure modes for the security.appsec (appsec) domain and counter-moves to avoid them.
@@ -9,7 +9,9 @@ Applies to: cx-security.
 role: security.appsec
 applies_to: [cx-security]
 inherits: security
-version: 1
+version: 2
+profiles: [rnd]
+cap: 1
 ---
 # AppSec Overlay
 

package/skills/roles/security.cloud.md

@@ -1,5 +1,5 @@
 <!--
-skills/roles/security.cloud.md — Anti-pattern guidance for the Security.cloud (cloud) role.
+skills/roles/security.cloud.md. Anti-pattern guidance for the Security.cloud (cloud) role.
 
 Loaded at sync time to inline role-specific failure modes into specialist agent prompts.
 Covers common failure modes for the security.cloud (cloud) domain and counter-moves to avoid them.
@@ -9,7 +9,9 @@ Applies to: cx-security.
 role: security.cloud
 applies_to: [cx-security]
 inherits: security
-version: 1
+version: 2
+profiles: [rnd]
+cap: 1
 ---
 # Cloud Security Overlay
 

package/skills/roles/security.legal-compliance.md

@@ -1,5 +1,5 @@
 <!--
-skills/roles/security.legal-compliance.md — Anti-pattern guidance for the Security.legal-compliance (legal compliance) role.
+skills/roles/security.legal-compliance.md. Anti-pattern guidance for the Security.legal-compliance (legal compliance) role.
 
 Loaded at sync time to inline role-specific failure modes into specialist agent prompts.
 Covers common failure modes for the security.legal-compliance (legal compliance) domain and counter-moves to avoid them.
@@ -9,7 +9,9 @@ Applies to: cx-legal-compliance.
 role: security.legal-compliance
 applies_to: [cx-legal-compliance]
 inherits: security
-version: 1
+version: 2
+profiles: [rnd]
+cap: 1
 ---
 # Legal & Compliance Overlay
 

package/skills/roles/security.md

@@ -1,5 +1,5 @@
 <!--
-skills/roles/security.md — Anti-pattern guidance for the Security role.
+skills/roles/security.md. Anti-pattern guidance for the Security role.
 
 Loaded at sync time to inline role-specific failure modes into specialist agent prompts.
 Covers common failure modes for the security domain and counter-moves to avoid them.
@@ -9,15 +9,17 @@ Applies to: cx-security, cx-legal-compliance.
 role: security
 applies_to: [cx-security, cx-legal-compliance]
 inherits: null
-version: 1
+version: 2
+profiles: [rnd]
+cap: 1
 ---
-# Security — Role guidance
+# Security. Role guidance
 
-Load this before drafting. These are the failure modes that separate strong role output from weak role output — check your draft against each.
+Load this before drafting. These are the failure modes that separate strong role output from weak role output. check your draft against each.
 
 
 ### 1. Defense in absence
-**Symptom**: protection depends on a single layer — a firewall, a middleware, a validation step — with no defense if that layer is bypassed.
+**Symptom**: protection depends on a single layer. a firewall, a middleware, a validation step. with no defense if that layer is bypassed.
 **Why it fails**: one misconfiguration or bug eliminates all protection at once.
 **Counter-move**: assume any single control can fail. Layer controls at the network, application, and data boundaries.
 

package/skills/roles/security.privacy.md

@@ -1,5 +1,5 @@
 <!--
-skills/roles/security.privacy.md — Anti-pattern guidance for the Security.privacy (privacy) role.
+skills/roles/security.privacy.md. Anti-pattern guidance for the Security.privacy (privacy) role.
 
 Loaded at sync time to inline role-specific failure modes into specialist agent prompts.
 Covers common failure modes for the security.privacy (privacy) domain and counter-moves to avoid them.
@@ -9,7 +9,9 @@ Applies to: cx-security, cx-legal-compliance.
 role: security.privacy
 applies_to: [cx-security, cx-legal-compliance]
 inherits: security
-version: 1
+version: 2
+profiles: [rnd]
+cap: 1
 ---
 # Privacy Security Overlay
 

package/skills/roles/security.supply-chain.md

@@ -1,5 +1,5 @@
 <!--
-skills/roles/security.supply-chain.md — Anti-pattern guidance for the Security.supply-chain (supply chain) role.
+skills/roles/security.supply-chain.md. Anti-pattern guidance for the Security.supply-chain (supply chain) role.
 
 Loaded at sync time to inline role-specific failure modes into specialist agent prompts.
 Covers common failure modes for the security.supply-chain (supply chain) domain and counter-moves to avoid them.
@@ -9,7 +9,9 @@ Applies to: cx-security, cx-platform-engineer.
 role: security.supply-chain
 applies_to: [cx-security, cx-platform-engineer]
 inherits: security
-version: 1
+version: 2
+profiles: [rnd]
+cap: 1
 ---
 # Supply Chain Security Overlay
 

package/skills/routing.md

@@ -1,9 +1,9 @@
 <!--
-skills/routing.md — Construct AI Agent — Skill Routing — Read the matching skill file before responding when the user's request matches t
+skills/routing.md (Construct AI Agent) Skill Routing: Read the matching skill file before responding when the user's request matches t
 
 Read the matching skill file before responding when the user's request matches trigger keywords below. ## Exploration Domain
 -->
-# Construct AI Agent — Skill Routing
+# Construct AI Agent: Skill Routing
 
 Read the matching skill file before responding when the user's request matches trigger keywords below.
 
@@ -11,7 +11,7 @@ Read the matching skill file before responding when the user's request matches t
 
 | Trigger Keywords | Skill File | Description |
 |---|---|---|
-| explore repo, map codebase, understand codebase, unfamiliar codebase, slog through, get oriented, codebase map, how is this structured, how does this work, where is X, entry point, hot path, code map | `skills/exploration/repo-map.md` | Systematic repo exploration — produce .cx/codebase-map.md |
+| explore repo, map codebase, understand codebase, unfamiliar codebase, slog through, get oriented, codebase map, how is this structured, how does this work, where is X, entry point, hot path, code map | `skills/exploration/repo-map.md` | Systematic repo exploration: produce .cx/codebase-map.md |
 
 ## Quality Gates
 
@@ -120,15 +120,15 @@ Read the matching skill file before responding when the user's request matches t
 | Trigger Keywords | Skill File | Description |
 |---|---|---|
 | init docs, create docs structure, set up documentation, docs scaffold, documentation init | `skills/docs/init-docs.md` | Initialize required project-state docs and documentation structure |
-| research X, investigate X, find evidence, gather evidence | `skills/docs/research-workflow.md` | Research workflow — question to .cx/research/ file |
-| product intelligence, customer notes, field notes, product signals, customer profile, evidence brief, signal brief, backlog proposal | `skills/docs/product-intelligence-workflow.md` | Product Intelligence workflow — evidence to product artifacts |
-| strategy, product strategy, strategic bet, non-bet, north star, time horizon, competitive positioning | `skills/docs/strategy-workflow.md` | Product strategy — read, update, and reason about the strategy store |
-| ingest evidence, ingest customer notes, ingest Slack thread, ingest support ticket, normalize field notes | `skills/docs/evidence-ingest-workflow.md` | Evidence ingest workflow — raw source to .cx/knowledge/ |
-| write a PRD, create requirements, spec out, requirements document, Meta PRD, platform PRD | `skills/docs/prd-workflow.md` | PRD workflow — requirements to docs/prd/ or docs/meta-prd/ |
-| write a PRFAQ, working backwards doc, press release FAQ | `skills/docs/prfaq-workflow.md` | PRFAQ workflow — launch narrative from PRD or evidence |
-| create Jira proposal, update Linear, backlog proposal, issue proposal | `skills/docs/backlog-proposal-workflow.md` | Backlog proposal workflow — approval-gated issue tracker changes |
-| record this decision, create an ADR, architecture decision | `skills/docs/adr-workflow.md` | ADR workflow — decision to docs/adr/ file |
-| write a runbook, document this operation, operational procedure | `skills/docs/runbook-workflow.md` | Runbook workflow — operation to docs/runbooks/ file |
+| research X, investigate X, find evidence, gather evidence | `skills/docs/research-workflow.md` | Research workflow: question to .cx/research/ file |
+| product intelligence, customer notes, field notes, product signals, customer profile, evidence brief, signal brief, backlog proposal | `skills/docs/product-intelligence-workflow.md` | Product Intelligence workflow: evidence to product artifacts |
+| strategy, product strategy, strategic bet, non-bet, north star, time horizon, competitive positioning | `skills/docs/strategy-workflow.md` | Product strategy: read, update, and reason about the strategy store |
+| ingest evidence, ingest customer notes, ingest Slack thread, ingest support ticket, normalize field notes | `skills/docs/evidence-ingest-workflow.md` | Evidence ingest workflow: raw source to .cx/knowledge/ |
+| write a PRD, create requirements, spec out, requirements document, Meta PRD, platform PRD | `skills/docs/prd-workflow.md` | PRD workflow: requirements to docs/prd/ or docs/meta-prd/ |
+| write a PRFAQ, working backwards doc, press release FAQ | `skills/docs/prfaq-workflow.md` | PRFAQ workflow: launch narrative from PRD or evidence |
+| create Jira proposal, update Linear, backlog proposal, issue proposal | `skills/docs/backlog-proposal-workflow.md` | Backlog proposal workflow: approval-gated issue tracker changes |
+| record this decision, create an ADR, architecture decision | `skills/docs/adr-workflow.md` | ADR workflow: decision to docs/adr/ file |
+| write a runbook, document this operation, operational procedure | `skills/docs/runbook-workflow.md` | Runbook workflow: operation to docs/runbooks/ file |
 | init project, new project setup, join project, set up doc structure | `skills/docs/init-project.md` | Project initialization via construct init-docs |
 
 ## Routing Rules
@@ -141,6 +141,6 @@ Read the matching skill file before responding when the user's request matches t
 
 ## Agent Roster Disambiguation
 
-**cx-engineer vs cx-platform-engineer:** cx-engineer builds product features for end users. cx-platform-engineer builds the internal platform — CI/CD, deployment tooling, developer environments, internal APIs, and reliability infrastructure. They operate in distinct domains with different quality bars (user-facing UX vs. developer ergonomics and system reliability). Use cx-platform-engineer when the subject is a platform service, internal tool, build pipeline, or infrastructure component that engineers consume, not end users.
+**cx-engineer vs cx-platform-engineer:** cx-engineer builds product features for end users. cx-platform-engineer builds the internal platform: CI/CD, deployment tooling, developer environments, internal APIs, and reliability infrastructure. They operate in distinct domains with different quality bars (user-facing UX vs. developer ergonomics and system reliability). Use cx-platform-engineer when the subject is a platform service, internal tool, build pipeline, or infrastructure component that engineers consume, not end users.
 
-**Platform domain overlays** (`roles/product-manager.platform`, `roles/architect.platform`, `roles/engineer.platform`) apply when the PRODUCT being designed or built is a platform — an API, SDK, or developer surface consumed by other developers. These are skill overlays on PM/architect/engineer roles, not routing to cx-platform-engineer. Route to cx-platform-engineer only when the work is infra/ops, not product.
+**Platform domain overlays** (`roles/product-manager.platform`, `roles/architect.platform`, `roles/engineer.platform`) apply when the PRODUCT being designed or built is a platform: an API, SDK, or developer surface consumed by other developers. These are skill overlays on PM/architect/engineer roles, not routing to cx-platform-engineer. Route to cx-platform-engineer only when the work is infra/ops, not product.

package/skills/security/blue-team.md

@@ -1,5 +1,5 @@
 <!--
-skills/security/blue-team.md — Blue Team — Use this skill when defending systems, responding to incidents, or building dete
+skills/security/blue-team.md (Blue Team) Use this skill when defending systems, responding to incidents, or building dete
 
 Use this skill when defending systems, responding to incidents, or building detection and monitoring capabilities. ## Detection Engineering
 -->

package/skills/security/code-audit.md

@@ -1,5 +1,5 @@
 <!--
-skills/security/code-audit.md — Code Audit — Use this skill when reviewing source code for security vulnerabilities through s
+skills/security/code-audit.md (Code Audit) Use this skill when reviewing source code for security vulnerabilities through s
 
 Use this skill when reviewing source code for security vulnerabilities through static analysis. ## Taint Analysis
 -->