@hybridlabor-api/aos 4.12.1 → 4.13.0

package/.agents/vendor-manifest.json

@@ -64,6 +64,12 @@
       "purpose": "Generator/validator pairs for GitHub Actions, Dockerfile, bash scripts and Makefiles, with reference libraries",
       "target_skill": "skills/global_config/{github-actions,dockerfile,bash-script,makefile}-{generator,validator}"
     },
+    "humanlayer-skills": {
+      "upstream": "https://github.com/humanlayer/skills",
+      "pinned_commit": "ca7c8088db69e315a8b2deea43820270457f8f3c",
+      "purpose": "Interview-driven generator for recurring agentic control loops in CI (manual, opt-in, not a pipeline node)",
+      "target_skill": "design-control-loop"
+    },
     "claude-code-templates": {
       "upstream": "https://github.com/davila7/claude-code-templates",
       "pinned_commit": "691832ad9c2506d15a8b752826135f0afa83d197",

package/.claude/agents/reviewer.md

@@ -1,7 +1,7 @@
 ---
 name: reviewer
 description: "Adversarial review of build-node output against the plan's stated contract, before Shipping runs its automated gate. Modeled on the `doubt-driven-development` discipline (see `.agents/graph.md`): reads the artifacts and the contract, never the implementer's claim that it's done, never their reasoning — passing the claim biases toward agreement. Prompted adversarially (\"find what is wrong,\" never \"does this look good\"). Classifies every finding by a fixed precedence (contract misread → valid & actionable → valid trade-off → noise). The dispatcher escalates instead of repeating a cycle if a repair round reports the exact same finding ID Reviewer already flagged (a no-progress guard — see `.agents/graph.md`'s Reviewer discipline for why this replaced the original \"two clean cycles\" framing)."
-model: o3-mini
+model: opus
 ---
 Adversarial review of build-node output against the plan's stated contract, before Shipping runs its automated gate. Modeled on the `doubt-driven-development` discipline (see `.agents/graph.md`): reads the artifacts and the contract, never the implementer's claim that it's done, never their reasoning — passing the claim biases toward agreement. Prompted adversarially ("find what is wrong," never "does this look good"). Classifies every finding by a fixed precedence (contract misread → valid & actionable → valid trade-off → noise). The dispatcher escalates instead of repeating a cycle if a repair round reports the exact same finding ID Reviewer already flagged (a no-progress guard — see `.agents/graph.md`'s Reviewer discipline for why this replaced the original "two clean cycles" framing).
 

package/.claude/agents/techlead.md

@@ -1,7 +1,7 @@
 ---
 name: techlead
 description: "Reviews Architect's plan for a capability map (module boundaries, dependency direction, build order) before any build node starts. Approves or rejects the plan back to Architect. Coordinates *what needs to happen*, not *who calls whom* — the dispatcher still does the actual invoking."
-model: gemini-3.8-flash-high
+model: sonnet
 ---
 Reviews Architect's plan for a capability map (module boundaries, dependency direction, build order) before any build node starts. Approves or rejects the plan back to Architect. Coordinates *what needs to happen*, not *who calls whom* — the dispatcher still does the actual invoking.
 

package/.opencode/agents/architect.md

@@ -1,7 +1,7 @@
 ---
 description: "Turns the user's goal (or `/bdbrainstorm` / `/grill-me` output) into a system plan. Reads existing architecture before proposing changes. Does not coordinate execution or invoke other agents — that is TechLead's job, decided by the dispatcher, not by Architect."
 mode: subagent
-model: opus
+model: opencode/muse-spark-1.3-contributor-free
 ---
 Turns the user's goal (or `/bdbrainstorm` / `/grill-me` output) into a system plan. Reads existing architecture before proposing changes. Does not coordinate execution or invoke other agents — that is TechLead's job, decided by the dispatcher, not by Architect.
 

package/.opencode/agents/reviewer.md

@@ -1,7 +1,7 @@
 ---
 description: "Adversarial review of build-node output against the plan's stated contract, before Shipping runs its automated gate. Modeled on the `doubt-driven-development` discipline (see `.agents/graph.md`): reads the artifacts and the contract, never the implementer's claim that it's done, never their reasoning — passing the claim biases toward agreement. Prompted adversarially (\"find what is wrong,\" never \"does this look good\"). Classifies every finding by a fixed precedence (contract misread → valid & actionable → valid trade-off → noise). The dispatcher escalates instead of repeating a cycle if a repair round reports the exact same finding ID Reviewer already flagged (a no-progress guard — see `.agents/graph.md`'s Reviewer discipline for why this replaced the original \"two clean cycles\" framing)."
 mode: subagent
-model: o3-mini
+model: opencode/muse-spark-1.3-contributor-free
 ---
 Adversarial review of build-node output against the plan's stated contract, before Shipping runs its automated gate. Modeled on the `doubt-driven-development` discipline (see `.agents/graph.md`): reads the artifacts and the contract, never the implementer's claim that it's done, never their reasoning — passing the claim biases toward agreement. Prompted adversarially ("find what is wrong," never "does this look good"). Classifies every finding by a fixed precedence (contract misread → valid & actionable → valid trade-off → noise). The dispatcher escalates instead of repeating a cycle if a repair round reports the exact same finding ID Reviewer already flagged (a no-progress guard — see `.agents/graph.md`'s Reviewer discipline for why this replaced the original "two clean cycles" framing).
 

package/.opencode/agents/techlead.md

@@ -1,7 +1,7 @@
 ---
 description: "Reviews Architect's plan for a capability map (module boundaries, dependency direction, build order) before any build node starts. Approves or rejects the plan back to Architect. Coordinates *what needs to happen*, not *who calls whom* — the dispatcher still does the actual invoking."
 mode: subagent
-model: gemini-3.8-flash-high
+model: opencode/muse-spark-1.3-contributor-free
 ---
 Reviews Architect's plan for a capability map (module boundaries, dependency direction, build order) before any build node starts. Approves or rejects the plan back to Architect. Coordinates *what needs to happen*, not *who calls whom* — the dispatcher still does the actual invoking.
 

package/README.de.md

@@ -11,10 +11,11 @@
 [![CI](https://github.com/hybridlabor-api/aos/actions/workflows/ci.yml/badge.svg)](https://github.com/hybridlabor-api/aos/actions)
 [![license](https://img.shields.io/badge/license-Apache%202.0-blue.svg)](LICENSE)
 [![node](https://img.shields.io/badge/node-%3E%3D20-blue.svg)](package.json)
-[![skills](https://img.shields.io/badge/skills-213%20curated-brightgreen.svg)](#skills)
+[![skills](https://img.shields.io/badge/skills-214%20curated-brightgreen.svg)](#skills)
 [![MCPs](https://img.shields.io/badge/local%20MCPs-21-brightgreen.svg)](#mcp-server)
 [![harnesses](https://img.shields.io/badge/harnesses-9%20supported-blueviolet.svg)](#unterstützte-harnesses)
 [![SkillSpector](https://img.shields.io/badge/NVIDIA%20SkillSpector-CLEAN-76B900?logo=nvidia&logoColor=white)](https://github.com/NVIDIA/SkillSpector)
+[![skills.sh](https://skills.sh/b/hybridlabor-api/aos)](https://skills.sh/hybridlabor-api/aos)
 
 AOS installiert eine kuratierte Skill-Bibliothek, ein Subagent-Verzeichnis, Gate-Hooks und eine ausführbare Multi-Agent-Build-Pipeline in jeden auf deinem Rechner installierten Coding-Agent-Harness.
 
@@ -26,7 +27,7 @@ Entwickelt für Nutzer, die bereits **Claude Code, Google Antigravity, Codex CLI
 
 Nach der Installation hast du:
 
-- **<!-- count:skills -->213<!-- /count --> Skills** in sechs Kategorien, von jedem Harness als `<name>/SKILL.md` auffindbar.
+- **<!-- count:skills -->214<!-- /count --> Skills** in sechs Kategorien, von jedem Harness als `<name>/SKILL.md` auffindbar.
 - **<!-- count:agents -->13<!-- /count --> Subagents** (Architect, TechLead, Reviewer, die Godmodes, Security- und Silent-Failure-Reviewer) als natives Agenten-Format jedes Harness kompiliert.
 - **<!-- count:mcps -->21<!-- /count --> MCP-Server** für Creative Software, Betriebssystemsteuerung, Memory und Harness-übergreifende Delegation.
 - **Drei Pipelines** — `/startcycle`, `/startcycle-graph`, `/startcycle-graph-user` — und ein **GO-Gate**, das `git push`, `npm publish`, `npm version` und rekursive `rm` mechanisch blockiert.
@@ -173,7 +174,7 @@ Das Erreichen von `ready_to_ship` ist kein Versand. [`.claude/hooks/go-gate.mjs`
 | Plan Canvas | `aos-plan-canvas open <file>` (skill `plan-canvas`) | Öffnet einen Plan oder HTML-Artefakt in einer lokalen Browser-Canvas, wo du Elemente annotierst, chattest und Änderungen genehmigst oder anforderst. Pläne aus den Pipelines öffnen sich hier standardmäßig. |
 | agenttrail | `aos-trail` (skill `agenttrail`, port 5330) | Live-Board einer Multi-Agent-Build: welche Komponente, welcher Agent oder Harness, was ist fertig, was ist stecken geblieben. Gespeist von den Trail-Relay-Hooks und von `mcsc`. |
 | archify | `aos-archify` (skill `archify`) | Validierte Architektur-, Sequenz-, Datenfluss- und State-Diagramme als eigenständige HTML mit SVG-Export; akzeptiert Mermaid. |
-| AOS Store | `aos store list \| search <q> \| install <name> [--project]`, `aos store ui` (auch `aos-store`, slash command `/aos-store`) | Durchsuche und installiere AOS Core und ECC Skills und Agents. Die Web-UI auf `http://127.0.0.1:4322` zeigt, was installiert ist, zeigt die genauen Zielpfade in der Vorschau an und installiert nur nach deiner Bestätigung. Multi-Datei-Skills werden komplett installiert. `list` und `search` lesen einen angehefteten Offline-Index. |
+| AOS Store | `aos store list \| search <q> \| install <name> [--project]`, `aos store ui` (auch `aos-store`, slash command `/aos-store`) | Durchsuche und installiere Skills und Agents aus AOS Core, ECC und Scenario (scenario-labs/skills, MIT); benötigte Skills werden mitinstalliert, jede Datei wird per SHA-256 geprüft. Die Web-UI auf `http://127.0.0.1:4322` zeigt, was installiert ist, zeigt die genauen Zielpfade in der Vorschau an und installiert nur nach deiner Bestätigung. Multi-Datei-Skills werden komplett installiert. `list` und `search` lesen einen angehefteten Offline-Index. |
 | Launchpad | `aos-dashboard [--port 7900] [--no-open]` | Eine Seite mit jedem lokalen BDB-Service (memB, Synapse, OpenWiki, AO, Remote, AOS Store): Status, Start/Stop, Logs. Registriert als Autostart-Eintrag. |
 | Doctor | `aos doctor [--json] [--net]` (auch `aos-doctor`) | Überprüft Abhängigkeiten, Skill-Platzierung pro Harness, Daemons, Hooks und Module; beendet sich mit 1, wenn etwas Aufmerksamkeit benötigt. Das erste, das zu laufen ist, wenn etwas nicht funktioniert. |
 | Config | `aos-config show \| propose \| set <key> <value>` | Maschinenebene `~/.agents/aos-config.json`: Workspace-Root, Domänen, Benutzer-ID. |
@@ -207,7 +208,7 @@ Installiere es durch den AOS Installer mit dem AOS CLI Target: `npx -y @hybridla
 npx skills add hybridlabor-api/aos
 ```
 
-Dies entdeckt alle <!-- count:skills -->213<!-- /count --> kuratierten Skills und installiert sie in das universelle `~/.agents/skills` Verzeichnis (verwendet von allen Harnesses und dem AOS CLI).
+Dies entdeckt alle <!-- count:skills -->214<!-- /count --> kuratierten Skills und installiert sie in das universelle `~/.agents/skills` Verzeichnis (verwendet von allen Harnesses und dem AOS CLI).
 
 ---
 
@@ -248,22 +249,22 @@ Der Dispatcher-Graph kompiliert diese Agents, verfügbar als Claude Code Subagen
 
 ### Skills nach Kategorie
 
-<!-- count:skills -->213<!-- /count --> kuratierte Skills, von jedem Harness auffindbar:
+<!-- count:skills -->214<!-- /count --> kuratierte Skills, von jedem Harness auffindbar:
 
-- **bdb-core** (30 Skills): Core AOS Infrastruktur, Pipelines, Tools und Utilities — `startcycle`, `startcycle-graph`, `startcycle-graph-user`, `agent-orchestrator`, `agenttrail`, `plan-canvas`, `aos-doctor`, `aos-store`, `bdb-dev-os-skill` und mehr.
+- **bdb-core** (31 Skills): Core AOS Infrastruktur, Pipelines, Tools und Utilities — `startcycle`, `startcycle-graph`, `startcycle-graph-user`, `agent-orchestrator`, `agenttrail`, `plan-canvas`, `aos-doctor`, `aos-store`, `bdb-dev-os-skill` und mehr.
 - **design-ui-ux** (19 Skills): Frontend, UI Design, Barrierefreiheit, Tokens, Motion, Anti-Slop — `senior-frontend`, `ui-component`, `ui-review`, `tailwind-patterns`, `shadcn`, `wcag-audit-patterns` und mehr.
 - **engineering-method** (46 Skills): Architektur, Testing, Debugging, CI/CD, Code-Qualität — `software-architecture`, `test-driven-development`, `systematic-debugging`, `ci-pipeline`, `github-actions-generator`, `dockerfile-validator` und mehr.
 - **library** (98 Skills): Language/Framework-Spezifika — TypeScript, Node.js, Python, React, Postgres, Prisma, Next.js, Drizzle ORM, Go und mehr.
 - **media-eventtech** (19 Skills): 3D, Video, Show Control, Spatial Design — `godmode-eventtech`, `synapse-integration-skill`, `threejs-skills`, `blender-expert` und mehr.
 - **engineering-hardware** (1 Skill): PCB und Electrical Design — `godmode-hardware-pcb`.
 
-Der vollständige Katalog mit detaillierten Beschreibungen: [docs/skills_table.md](docs/skills_table.md) — Hinweis: Diese Datei ist veraltet und listet 164 von 213 Skills auf.
+Der vollständige Katalog mit detaillierten Beschreibungen: [docs/skills_table.md](docs/skills_table.md) — Hinweis: Diese Datei ist veraltet und listet 164 von 214 Skills auf.
 
 ---
 
 ## Skills
 
-<!-- count:skills -->213<!-- /count --> Skills, kuratiert aus Open-Source- und proprietären Sammlungen, die die gesamte Software-Entwicklung und Creative-Pipeline abdecken. Jeder Skill ist ein Verzeichnis mit einem `SKILL.md` Frontmatter, das `name`, `description` und eine `category` erklärt: `bdb-core`, `design-ui-ux`, `engineering-method`, `engineering-hardware`, `media-eventtech`, `library`.
+<!-- count:skills -->214<!-- /count --> Skills, kuratiert aus Open-Source- und proprietären Sammlungen, die die gesamte Software-Entwicklung und Creative-Pipeline abdecken. Jeder Skill ist ein Verzeichnis mit einem `SKILL.md` Frontmatter, das `name`, `description` und eine `category` erklärt: `bdb-core`, `design-ui-ux`, `engineering-method`, `engineering-hardware`, `media-eventtech`, `library`.
 
 **Persona Layer:** Die **Godmode** Skills sind spezialisierte Personas, die direkt den Build- und Shipping-Knoten des Dispatcher-Graphs zugeordnet sind:
 
@@ -286,7 +287,7 @@ Der vollständige Katalog mit detaillierten Beschreibungen: [docs/skills_table.m
 - **Code Qualität** — `bdb-security-audit`, `systematic-debugging`, `silent-failure-hunter`, `bdbresilience`
 - **Framework Spezialisten** — Vollständige Abdeckung von TypeScript, React, Next.js, Drizzle ORM, Prisma, Python, Go und mehr
 
-Der vollständige Katalog mit Beschreibungen und Details: [docs/skills_table.md](docs/skills_table.md) (Hinweis: listet derzeit 164 von 213).
+Der vollständige Katalog mit Beschreibungen und Details: [docs/skills_table.md](docs/skills_table.md) (Hinweis: listet derzeit 164 von 214).
 
 Die Bibliothek ist auch durch die `skills` CLI lesbar:
 

package/README.md

@@ -11,10 +11,11 @@
 [![CI](https://github.com/hybridlabor-api/aos/actions/workflows/ci.yml/badge.svg)](https://github.com/hybridlabor-api/aos/actions)
 [![license](https://img.shields.io/badge/license-Apache%202.0-blue.svg)](LICENSE)
 [![node](https://img.shields.io/badge/node-%3E%3D20-blue.svg)](package.json)
-[![skills](https://img.shields.io/badge/skills-213%20curated-brightgreen.svg)](#skills)
+[![skills](https://img.shields.io/badge/skills-214%20curated-brightgreen.svg)](#skills)
 [![MCPs](https://img.shields.io/badge/local%20MCPs-21-brightgreen.svg)](#mcp-servers)
 [![harnesses](https://img.shields.io/badge/harnesses-9%20supported-blueviolet.svg)](#supported-harnesses)
 [![SkillSpector](https://img.shields.io/badge/NVIDIA%20SkillSpector-CLEAN-76B900?logo=nvidia&logoColor=white)](https://github.com/NVIDIA/SkillSpector)
+[![skills.sh](https://skills.sh/b/hybridlabor-api/aos)](https://skills.sh/hybridlabor-api/aos)
 
 AOS installs a curated skill library, a subagent roster, gate hooks and a runnable multi-agent build pipeline into every coding-agent harness on your machine.
 
@@ -26,7 +27,7 @@ Built for people who already run **Claude Code, Google Antigravity, Codex CLI, O
 
 After install you have:
 
-- **<!-- count:skills -->213<!-- /count --> skills** in six categories, discoverable by every harness as `<name>/SKILL.md`.
+- **<!-- count:skills -->214<!-- /count --> skills** in six categories, discoverable by every harness as `<name>/SKILL.md`.
 - **<!-- count:agents -->13<!-- /count --> subagents** (Architect, TechLead, Reviewer, the Godmodes, security and silent-failure reviewers) compiled into each harness's native agent format.
 - **<!-- count:mcps -->21<!-- /count --> MCP servers** for creative software, OS control, memory and cross-harness delegation.
 - **Three pipelines** — `/startcycle`, `/startcycle-graph`, `/startcycle-graph-user` — and a **GO gate** that mechanically blocks `git push`, `npm publish`, `npm version` and recursive `rm`.
@@ -173,7 +174,7 @@ Reaching `ready_to_ship` is not shipping. [`.claude/hooks/go-gate.mjs`](.claude/
 | Plan Canvas | `aos-plan-canvas open <file>` (skill `plan-canvas`) | Opens a plan or HTML artifact in a local browser canvas where you annotate elements, chat, and approve or request changes. Plans from the pipelines open here by default. |
 | agenttrail | `aos-trail` (skill `agenttrail`, port 5330) | Live board of a multi-agent build: which component, which agent or harness, what is done, what is stuck. Fed by the trail-relay hooks and by `mcsc`. |
 | archify | `aos-archify` (skill `archify`) | Validated architecture, sequence, data-flow and state diagrams as standalone HTML with SVG export; accepts Mermaid. |
-| AOS Store | `aos store list \| search <q> \| install <name> [--project]`, `aos store ui` (also `aos-store`, slash command `/aos-store`) | Browse and install AOS Core and ECC skills and agents. The web UI on `http://127.0.0.1:4322` shows what is installed, previews the exact target paths, and installs only after you confirm. Multi-file skills are installed completely. `list` and `search` read a pinned offline index. |
+| AOS Store | `aos store list \| search <q> \| install <name> [--project]`, `aos store ui` (also `aos-store`, slash command `/aos-store`) | Browse and install AOS Core, ECC and Scenario (scenario-labs/skills, MIT) skills and agents; required skills are installed together and every file is SHA-256 verified. The web UI on `http://127.0.0.1:4322` shows what is installed, previews the exact target paths, and installs only after you confirm. Multi-file skills are installed completely. `list` and `search` read a pinned offline index. |
 | Launchpad | `aos-dashboard [--port 7900] [--no-open]` | One page with every local BDB service (memB, Synapse, OpenWiki, AO, Remote, AOS Store): status, start/stop, logs. Registered as an autostart entry. |
 | Doctor | `aos doctor [--json] [--net]` (also `aos-doctor`) | Verifies dependencies, skill placement per harness, daemons, hooks and modules; exits 1 when something needs attention. The first thing to run when anything misbehaves. |
 | Config | `aos-config show \| propose \| set <key> <value>` | Machine-level `~/.agents/aos-config.json`: workspace root, domains, user id. |
@@ -207,7 +208,7 @@ Install it through the AOS installer with the AOS CLI target: `npx -y @hybridlab
 npx skills add hybridlabor-api/aos
 ```
 
-This discovers all <!-- count:skills -->213<!-- /count --> curated skills and installs them into the universal `~/.agents/skills` directory (used by all harnesses and the AOS CLI).
+This discovers all <!-- count:skills -->214<!-- /count --> curated skills and installs them into the universal `~/.agents/skills` directory (used by all harnesses and the AOS CLI).
 
 ---
 
@@ -248,22 +249,22 @@ The dispatcher graph compiles these agents, available as Claude Code subagents a
 
 ### Skills by Category
 
-<!-- count:skills -->213<!-- /count --> curated skills, discoverable by every harness:
+<!-- count:skills -->214<!-- /count --> curated skills, discoverable by every harness:
 
-- **bdb-core** (30 skills): Core AOS infrastructure, pipelines, tools, and utilities — `startcycle`, `startcycle-graph`, `startcycle-graph-user`, `agent-orchestrator`, `agenttrail`, `plan-canvas`, `aos-doctor`, `aos-store`, `bdb-dev-os-skill`, and more.
+- **bdb-core** (31 skills): Core AOS infrastructure, pipelines, tools, and utilities — `startcycle`, `startcycle-graph`, `startcycle-graph-user`, `agent-orchestrator`, `agenttrail`, `plan-canvas`, `aos-doctor`, `aos-store`, `bdb-dev-os-skill`, and more.
 - **design-ui-ux** (19 skills): Frontend, UI design, accessibility, tokens, motion, anti-slop — `senior-frontend`, `ui-component`, `ui-review`, `tailwind-patterns`, `shadcn`, `wcag-audit-patterns`, and more.
 - **engineering-method** (46 skills): Architecture, testing, debugging, CI/CD, code quality — `software-architecture`, `test-driven-development`, `systematic-debugging`, `ci-pipeline`, `github-actions-generator`, `dockerfile-validator`, and more.
 - **library** (98 skills): Language/framework specifics — TypeScript, Node.js, Python, React, Postgres, Prisma, Next.js, Drizzle ORM, Go, and more.
 - **media-eventtech** (19 skills): 3D, video, show control, spatial design — `godmode-eventtech`, `synapse-integration-skill`, `threejs-skills`, `blender-expert`, and more.
 - **engineering-hardware** (1 skill): PCB and electrical design — `godmode-hardware-pcb`.
 
-The full catalog with detailed descriptions: [docs/skills_table.md](docs/skills_table.md) — note: this file is out of date and lists 164 of 213 skills.
+The full catalog with detailed descriptions: [docs/skills_table.md](docs/skills_table.md) — note: this file is out of date and lists 164 of 214 skills.
 
 ---
 
 ## Skills
 
-<!-- count:skills -->213<!-- /count --> skills, curated from open-source and proprietary collections, covering the full software development and creative pipeline. Every skill is a directory with a `SKILL.md` frontmatter declaring `name`, `description`, and one `category`: `bdb-core`, `design-ui-ux`, `engineering-method`, `engineering-hardware`, `media-eventtech`, `library`.
+<!-- count:skills -->214<!-- /count --> skills, curated from open-source and proprietary collections, covering the full software development and creative pipeline. Every skill is a directory with a `SKILL.md` frontmatter declaring `name`, `description`, and one `category`: `bdb-core`, `design-ui-ux`, `engineering-method`, `engineering-hardware`, `media-eventtech`, `library`.
 
 **Persona Layer:** The **Godmode** skills are specialized personas that directly map to the build and ship nodes of the dispatcher graph:
 
@@ -286,7 +287,7 @@ The full catalog with detailed descriptions: [docs/skills_table.md](docs/skills_
 - **Code Quality** — `bdb-security-audit`, `systematic-debugging`, `silent-failure-hunter`, `bdbresilience`
 - **Framework Specialists** — Full coverage of TypeScript, React, Next.js, Drizzle ORM, Prisma, Python, Go, and more
 
-The full catalog with descriptions and details: [docs/skills_table.md](docs/skills_table.md) (note: currently lists 164 of 213).
+The full catalog with descriptions and details: [docs/skills_table.md](docs/skills_table.md) (note: currently lists 164 of 214).
 
 The library is also readable by the `skills` CLI:
 

package/README.pt.md

@@ -11,10 +11,11 @@
 [![CI](https://github.com/hybridlabor-api/aos/actions/workflows/ci.yml/badge.svg)](https://github.com/hybridlabor-api/aos/actions)
 [![license](https://img.shields.io/badge/license-Apache%202.0-blue.svg)](LICENSE)
 [![node](https://img.shields.io/badge/node-%3E%3D20-blue.svg)](package.json)
-[![skills](https://img.shields.io/badge/skills-213%20curated-brightgreen.svg)](#skills)
+[![skills](https://img.shields.io/badge/skills-214%20curated-brightgreen.svg)](#skills)
 [![MCPs](https://img.shields.io/badge/local%20MCPs-21-brightgreen.svg)](#servidores-mcp)
 [![harnesses](https://img.shields.io/badge/harnesses-9%20supported-blueviolet.svg)](#harnesses-suportados)
 [![SkillSpector](https://img.shields.io/badge/NVIDIA%20SkillSpector-CLEAN-76B900?logo=nvidia&logoColor=white)](https://github.com/NVIDIA/SkillSpector)
+[![skills.sh](https://skills.sh/b/hybridlabor-api/aos)](https://skills.sh/hybridlabor-api/aos)
 
 AOS instala uma biblioteca de skills curada, um roster de subagentes, hooks de portão e um pipeline multi-agente executável em todos os harnesses de agentes de código da sua máquina.
 
@@ -26,7 +27,7 @@ Construído para pessoas que já executam **Claude Code, Google Antigravity, Cod
 
 Após a instalação, você tem:
 
-- **<!-- count:skills -->213<!-- /count --> skills** em seis categorias, descobríveis por cada harness como `<name>/SKILL.md`.
+- **<!-- count:skills -->214<!-- /count --> skills** em seis categorias, descobríveis por cada harness como `<name>/SKILL.md`.
 - **<!-- count:agents -->13<!-- /count --> subagentes** (Architect, TechLead, Reviewer, os Godmodes, revisores de segurança e falhas silenciosas) compilados em cada formato nativo de agente do harness.
 - **<!-- count:mcps -->21<!-- /count --> servidores MCP** para software criativo, controle de SO, memória e delegação entre harnesses.
 - **Três pipelines** — `/startcycle`, `/startcycle-graph`, `/startcycle-graph-user` — e um **portão GO** que bloqueia mecanicamente `git push`, `npm publish`, `npm version` e `rm` recursivo.
@@ -173,7 +174,7 @@ Alcançar `ready_to_ship` não é enviar. [`.claude/hooks/go-gate.mjs`](.claude/
 | Plan Canvas | `aos-plan-canvas open <file>` (skill `plan-canvas`) | Abre um plano ou artefato HTML em um canvas de navegador local onde você anota elementos, conversa e aprova ou solicita mudanças. Planos dos pipelines abrem aqui por padrão. |
 | agenttrail | `aos-trail` (skill `agenttrail`, porta 5330) | Quadro ao vivo de uma compilação multi-agente: qual componente, qual agente ou harness, o que está pronto, o que está preso. Alimentado pelos hooks trail-relay e por `mcsc`. |
 | archify | `aos-archify` (skill `archify`) | Arquitetura validada, sequência, fluxo de dados e diagramas de estado como HTML autossuficiente com exportação SVG; aceita Mermaid. |
-| AOS Store | `aos store list \| search <q> \| install <name> [--project]`, `aos store ui` (também `aos-store`, comando slash `/aos-store`) | Procure e instale skills e agentes AOS Core e ECC. A interface web em `http://127.0.0.1:4322` mostra o que está instalado, visualiza o exato caminho de alvo e instala apenas após você confirmar. Skills multi-arquivo são instaladas completamente. `list` e `search` leem um índice fixo offline. |
+| AOS Store | `aos store list \| search <q> \| install <name> [--project]`, `aos store ui` (também `aos-store`, comando slash `/aos-store`) | Procure e instale skills e agentes do AOS Core, do ECC e do Scenario (scenario-labs/skills, MIT); as skills necessárias são instaladas juntas e cada arquivo é verificado por SHA-256. A interface web em `http://127.0.0.1:4322` mostra o que está instalado, visualiza o exato caminho de alvo e instala apenas após você confirmar. Skills multi-arquivo são instaladas completamente. `list` e `search` leem um índice fixo offline. |
 | Launchpad | `aos-dashboard [--port 7900] [--no-open]` | Uma página com todos os serviços BDB locais (memB, Synapse, OpenWiki, AO, Remote, AOS Store): status, iniciar/parar, logs. Registrado como entrada de inicialização automática. |
 | Doctor | `aos doctor [--json] [--net]` (também `aos-doctor`) | Verifica dependências, posicionamento de skills por harness, daemons, hooks e módulos; sai com 1 quando algo precisa de atenção. A primeira coisa a executar quando algo se comporta mal. |
 | Config | `aos-config show \| propose \| set <key> <value>` | Nível de máquina `~/.agents/aos-config.json`: raiz do workspace, domínios, id do usuário. |
@@ -207,7 +208,7 @@ Instale através do instalador AOS com o alvo AOS CLI: `npx -y @hybridlabor-api/
 npx skills add hybridlabor-api/aos
 ```
 
-Isto descobre todas as <!-- count:skills -->213<!-- /count --> skills curadas e as instala no diretório universal `~/.agents/skills` (usado por todos os harnesses e o AOS CLI).
+Isto descobre todas as <!-- count:skills -->214<!-- /count --> skills curadas e as instala no diretório universal `~/.agents/skills` (usado por todos os harnesses e o AOS CLI).
 
 ---
 
@@ -248,22 +249,22 @@ O grafo do dispatcher compila estes agentes, disponíveis como subagentes Claude
 
 ### Skills por Categoria
 
-<!-- count:skills -->213<!-- /count --> skills curadas, descobríveis por todo harness:
+<!-- count:skills -->214<!-- /count --> skills curadas, descobríveis por todo harness:
 
-- **bdb-core** (30 skills): Infraestrutura AOS principal, pipelines, ferramentas e utilidades — `startcycle`, `startcycle-graph`, `startcycle-graph-user`, `agent-orchestrator`, `agenttrail`, `plan-canvas`, `aos-doctor`, `aos-store`, `bdb-dev-os-skill` e mais.
+- **bdb-core** (31 skills): Infraestrutura AOS principal, pipelines, ferramentas e utilidades — `startcycle`, `startcycle-graph`, `startcycle-graph-user`, `agent-orchestrator`, `agenttrail`, `plan-canvas`, `aos-doctor`, `aos-store`, `bdb-dev-os-skill` e mais.
 - **design-ui-ux** (19 skills): Frontend, design UI, acessibilidade, tokens, movimento, anti-slop — `senior-frontend`, `ui-component`, `ui-review`, `tailwind-patterns`, `shadcn`, `wcag-audit-patterns` e mais.
 - **engineering-method** (46 skills): Arquitetura, testes, debugging, CI/CD, qualidade de código — `software-architecture`, `test-driven-development`, `systematic-debugging`, `ci-pipeline`, `github-actions-generator`, `dockerfile-validator` e mais.
 - **library** (98 skills): Especificidades de linguagem/framework — TypeScript, Node.js, Python, React, Postgres, Prisma, Next.js, Drizzle ORM, Go e mais.
 - **media-eventtech** (19 skills): 3D, vídeo, controle de shows, design espacial — `godmode-eventtech`, `synapse-integration-skill`, `threejs-skills`, `blender-expert` e mais.
 - **engineering-hardware** (1 skill): Design de PCB e elétrico — `godmode-hardware-pcb`.
 
-O catálogo completo com descrições detalhadas: [docs/skills_table.md](docs/skills_table.md) — nota: este arquivo está desatualizado e lista 164 de 213 skills.
+O catálogo completo com descrições detalhadas: [docs/skills_table.md](docs/skills_table.md) — nota: este arquivo está desatualizado e lista 164 de 214 skills.
 
 ---
 
 ## Skills
 
-<!-- count:skills -->213<!-- /count --> skills, curadas de coleções de código aberto e proprietárias, cobrindo o pipeline completo de desenvolvimento de software e criativo. Cada skill é um diretório com um `SKILL.md` frontmatter declarando `name`, `description` e uma `category`: `bdb-core`, `design-ui-ux`, `engineering-method`, `engineering-hardware`, `media-eventtech`, `library`.
+<!-- count:skills -->214<!-- /count --> skills, curadas de coleções de código aberto e proprietárias, cobrindo o pipeline completo de desenvolvimento de software e criativo. Cada skill é um diretório com um `SKILL.md` frontmatter declarando `name`, `description` e uma `category`: `bdb-core`, `design-ui-ux`, `engineering-method`, `engineering-hardware`, `media-eventtech`, `library`.
 
 **Camada de Persona:** As skills **Godmode** são personas especializadas que mapeiam diretamente para os nós de compilação e envio do grafo do dispatcher:
 
@@ -286,7 +287,7 @@ O catálogo completo com descrições detalhadas: [docs/skills_table.md](docs/sk
 - **Qualidade de Código** — `bdb-security-audit`, `systematic-debugging`, `silent-failure-hunter`, `bdbresilience`
 - **Especialistas de Framework** — Cobertura completa de TypeScript, React, Next.js, Drizzle ORM, Prisma, Python, Go e mais
 
-O catálogo completo com descrições e detalhes: [docs/skills_table.md](docs/skills_table.md) (nota: atualmente lista 164 de 213).
+O catálogo completo com descrições e detalhes: [docs/skills_table.md](docs/skills_table.md) (nota: atualmente lista 164 de 214).
 
 A biblioteca também é legível pela CLI `skills`:
 

package/THIRD_PARTY_NOTICES.md

@@ -413,7 +413,101 @@ store. Reasons are in `docs/handover/` and the branch description for
 
 ---
 
+## humanlayer/skills
+
+<https://github.com/humanlayer/skills> — MIT. Copyright (c) 2026 HumanLayer.
+
+Tracked in `.agents/vendor-manifest.json` at pinned commit
+`ca7c8088db69e315a8b2deea43820270457f8f3c`.
+
+One skill is vendored as `skills/global_config/design-control-loop/`
+(`SKILL.md` plus its 10 `references/` files, including the unmodified
+`agent-iteration.ts` and `workflow-template.yml` templates). The upstream
+`.claude-plugin/plugin.json` was not carried over.
+
+AOS modifications, all in `SKILL.md` only: `category:`, `source:` and `license:`
+added to the frontmatter; one delimited "AOS notes" section inserted directly
+after the H1. Upstream prose and all `references/` files are byte-identical.
+
+```
+MIT License
+
+Copyright (c) 2026 HumanLayer
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+```
+
+---
+
 ## Note on `mcps/`
 
 Sub-repositories vendored under `mcps/` carry their own `LICENSE` files in
 their own directories and are not restated here.
+
+---
+
+## scenario-labs/skills
+
+- **Upstream:** <https://github.com/scenario-labs/skills>
+- **License:** MIT
+- **Copyright:** Copyright (c) 2026 Scenario
+- **Pinned commit:** `5786accd3bb6d79808330230c698898862e8a1d4`
+
+### Store index (second AOS Store source)
+
+The AOS Store lists a starter set of skills from this project through
+`lib/scenario-store-index.json` (regenerated by
+`scripts/build-scenario-store-index.mjs` from a local clone and the pinned
+commit). The index holds metadata and a per-file SHA-256 list only. The files
+are not vendored: they are downloaded from
+`https://raw.githubusercontent.com/scenario-labs/skills/<pinned commit>/` on
+demand, only after an explicit `--net` or UI confirmation, and each file is
+verified against its SHA-256 before anything is written.
+
+Some of these skills contain Python and C# scripts, one of which
+(`scenario-unity-expert`) executes code received through a local channel
+without authentication. The store and its UI mark this before installation.
+
+The MIT license covers the software and documentation in that repository. The
+Scenario name and logo are trademarks of their owner and are **not** licensed
+by it; AOS does not use the logo.
+
+```
+MIT License
+
+Copyright (c) 2026 Scenario
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+```

package/bin/aos-store.mjs

@@ -1,15 +1,13 @@
 #!/usr/bin/env node
 
 import { createHash } from 'node:crypto';
-import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
-import { dirname, join, resolve } from 'node:path';
+import { mkdirSync, writeFileSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { fetchSkillFiles, fileTargets, localAgents, localSkills, targetsFor as sharedTargetsFor, validateFiles, writeSkillFiles } from '../lib/store-shared.mjs';
+import { fetchSkillFiles, fileTargets, findItem, installPlan, loadSources, localAgents, localSkills, planSkillFiles, planSummary, targetsFor as sharedTargetsFor, validateFiles, writePlan } from '../lib/store-shared.mjs';
 
 const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
-const INDEX_PATH = process.env.AOS_STORE_INDEX || join(ROOT, 'lib', 'ecc-store-index.json');
-const RAW_BASE = (process.env.AOS_STORE_RAW_BASE || 'https://raw.githubusercontent.com/affaan-m/ECC').replace(/\/+$/, '');
-const index = JSON.parse(readFileSync(INDEX_PATH, 'utf8'));
+const sources = loadSources(ROOT);
 const args = process.argv.slice(2);
 const dryRun = args.includes('--dry-run');
 const project = args.includes('--project');
@@ -17,21 +15,9 @@ const net = args.includes('--net');
 const positional = args.filter((arg) => !arg.startsWith('--'));
 const option = (name) => args.find((arg) => arg === name || arg.startsWith(`${name}=`))?.split('=').slice(1).join('=');
 
-function loadIndex() {
-  if (!index.pinned_commit || !index.skills || !index.subagents) throw new Error('Invalid AOS store index');
-  return index;
-}
-
 function allItems(type) {
   const selected = type === 'agents' || type === 'subagents' ? 'subagents' : 'skills';
-  return Object.entries(index[selected] || {}).map(([name, item]) => ({ name, item, type: selected }));
-}
-
-function findItem(name) {
-  for (const type of ['skills', 'subagents']) {
-    if (index[type]?.[name]) return { name, item: index[type][name], type };
-  }
-  return null;
+  return sources.flatMap((src) => Object.entries(src.index[selected] || {}).map(([name, item]) => ({ name, item, type: selected, src })));
 }
 
 const localSkillNames = () => new Set(localSkills(ROOT).keys());
@@ -42,15 +28,15 @@ function printItems(items) {
     console.log('No store items found.');
     return;
   }
-  for (const { name, item, type } of items) {
+  for (const { name, item, type, src } of items) {
     const kind = type === 'skills' ? 'skill' : 'agent';
-    console.log(`${kind}\t${name}\t${item.category}\t${item.description}`);
+    console.log(`${kind}\t${name}\t${item.category}\t${src.label}\t${item.description}`);
   }
   console.log(`\n${items.length} item(s).`);
 }
 
-async function download(upstreamPath) {
-  const url = `${RAW_BASE}/${index.pinned_commit}/${upstreamPath}`;
+async function download(src, upstreamPath) {
+  const url = `${src.raw_base}/${src.pinned_commit}/${upstreamPath}`;
   const response = await fetch(url, { headers: { 'user-agent': 'aos-store' } });
   if (!response.ok) throw new Error(`Download failed (${response.status}): ${url}`);
   return Buffer.from(await response.arrayBuffer());
@@ -60,42 +46,60 @@ const targetsFor = (type, name) => sharedTargetsFor(type, name, { project });
 
 async function install(name) {
   if (!/^[A-Za-z0-9_-]+$/.test(name)) throw new Error(`Invalid store name: ${name}`);
-  const found = findItem(name);
+  const found = findItem(sources, name);
   if (!found) throw new Error(`Store item not found: ${name}`);
-  const { item, type } = found;
+  const { type, src } = found;
   const coreNames = type === 'skills' ? localSkillNames() : localAgentNames();
   if (coreNames.has(name)) {
     console.log(`Skipped ${name}: AOS core already provides it.`);
     return;
   }
-  const targets = targetsFor(type, name);
-  const multi = type === 'skills' && item.files?.length > 1;
-  if (multi) validateFiles(item.files);
+  const plan = installPlan(sources, found).filter((p) => !(p.type === 'skills' && p.name !== name && localSkillNames().has(p.name)));
+  for (const p of plan) if (p.item.files?.length > 1) validateFiles(p.item.files);
+  const multi = (p) => p.type === 'skills' && p.item.files?.length > 1;
+  const summary = planSummary(plan);
+  const notes = [];
+  if (summary.requires.length) notes.push(`also installs required skill(s): ${summary.requires.join(', ')}`);
+  if (summary.execBridge) notes.push(`WARNING: contains a script that executes code received over a local socket or file channel without authentication (${summary.execBridgeFiles.map((f) => `${f.skill}/${f.path}`).join(', ')}); install only if you use this bridge`);
+  else if (summary.hasScripts) notes.push(`WARNING: contains ${summary.scriptCount} script file(s); review before use`);
   if (dryRun) {
-    for (const target of targets) {
-      if (multi) for (const file of fileTargets(target, item.files)) console.log(`[dry-run] write ${file}`);
-      else console.log(`[dry-run] write ${target}`);
+    for (const note of notes) console.log(note);
+    for (const p of plan) {
+      for (const target of targetsFor(p.type, p.name)) {
+        if (multi(p)) for (const file of fileTargets(target, p.item.files)) console.log(`[dry-run] write ${file}`);
+        else console.log(`[dry-run] write ${target}`);
+      }
     }
     return;
   }
   if (!net) {
     throw new Error(`Downloading '${name}' requires internet access to fetch from upstream GitHub. Pass --net to confirm: aos store install ${name} --net`);
   }
-  if (multi) {
-    const files = await fetchSkillFiles(RAW_BASE, index.pinned_commit, dirname(item.upstream_path), item.files);
-    for (const target of targets) {
-      const written = writeSkillFiles(target, files);
-      console.log(`Installed ${name} (${written.length} files) -> ${dirname(target)}`);
+  // All-or-nothing: download, hash-check and path-check every skill in memory before the first write.
+  const writes = [];
+  for (const p of plan) {
+    const pSrc = p.src;
+    let files;
+    if (multi(p)) {
+      files = await fetchSkillFiles(pSrc.raw_base, pSrc.pinned_commit, dirname(p.item.upstream_path), p.item.files);
+    } else {
+      const content = await download(pSrc, p.item.upstream_path);
+      const digest = createHash('sha256').update(content).digest('hex');
+      if (digest !== p.item.sha256) throw new Error(`SHA-256 mismatch for ${p.name}: expected ${p.item.sha256}, got ${digest}`);
+      files = null;
+      for (const target of targetsFor(p.type, p.name)) writes.push({ name: p.name, single: { target, content } });
     }
-    return;
+    if (files) for (const target of targetsFor(p.type, p.name)) writes.push({ name: p.name, target, plan: planSkillFiles(target, files) });
   }
-  const content = await download(item.upstream_path);
-  const digest = createHash('sha256').update(content).digest('hex');
-  if (digest !== item.sha256) throw new Error(`SHA-256 mismatch for ${name}: expected ${item.sha256}, got ${digest}`);
-  for (const target of targets) {
-    mkdirSync(dirname(target), { recursive: true });
-    writeFileSync(target, content);
-    console.log(`Installed ${name} -> ${target}`);
+  for (const note of notes) console.log(note);
+  for (const w of writes) {
+    if (w.single) {
+      mkdirSync(dirname(w.single.target), { recursive: true });
+      writeFileSync(w.single.target, w.single.content);
+      console.log(`Installed ${w.name} -> ${w.single.target}`);
+    } else {
+      console.log(`Installed ${w.name} (${writePlan(w.plan).length} files) -> ${dirname(w.target)}`);
+    }
   }
 }
 
@@ -108,7 +112,6 @@ function usage() {
 }
 
 async function main() {
-  loadIndex();
   const command = positional[0] || 'list';
   if (command === 'list') {
     printItems(allItems(option('--type') || 'skills'));