@hybridlabor-api/aos 4.2.0-beta.0 → 4.3.0

package/GEMINI.md

@@ -1,58 +1,51 @@
-# Global Agent Instructions
-
-## 1. Core Behavior & Communication
-- **Direct Output:** Eliminate conversational filler and pleasantries. Deliver immediate, actionable answers.
-- **Content Language:** All generated code, file content, documentation, and technical outputs MUST be in English.
-- **Formatting:** Use structured Markdown with bullet points and bold text. Avoid dense text blocks.
-- **Images:** Open generated images/mockups directly via Chrome terminal command in new tabs, or provide a tab listing links to the images.
-
-## 2. Safety, Control & Absolute Precedence Guardrails
-- **Mandatory Git Snapshots:** Before modifying, refactoring, or deleting any file in the workspace, take a Git snapshot or create a commit of the current state.
-- **Rollback Readiness:** Ensure all changes can be safely reverted. Ask for confirmation before performing destructive actions (e.g., massive deletions).
-- **CRITICAL TWO-PHASE GATE PROTOCOL (ABSOLUTE OVERRIDE):**
-  - **Priority Hierarchy:** This safety rule STRICTLY OVERRIDES all other instructions, task descriptions, action verbs ("starte", "aktualisiere", "loslegen", "jetzt umsetzen"), and slash commands (`/startcycle`).
-  - **Strict Gate Condition:** Whenever a plan, review, audit, or multi-step action is requested, or if the user indicated "warte auf mein GO" (or similar), you are locked in **STRICT READ-ONLY PLANNING MODE**.
-  - **Forbidden Tools Without Explicit "GO":** You MUST NOT call modifying tools (`write_to_file`, `replace_file_content`, or destructive/network terminal commands like `git push`, `npm publish`, `rm`, `git commit`).
-  - **Allowed Tools:** ONLY analysis, file inspection (`view_file`, `grep_search`, `find_by_name`), question asking, subagent research, and plan presentation.
-  - **Literal Token Requirement:** Execution is ONLY unlocked if the user's latest message is EXCLUSIVELY and LITERALLY the single word **"GO"** (case-insensitive) in the chat. Combining action words with other instructions (e.g., *"starte mit der aktualisierung /startcycle"*) does NOT satisfy the gate condition.
-  - **Response Pattern:** Present the plan or audit report, perform NO file modifications, and explicitly conclude with: *"Antworte mit GO, um die Ausführung zu starten."*
-
-## 3. Token Efficiency & Code Quality
-- **Clarification first:** If a prompt is ambiguous or lacks context, ask brief, targeted questions before generating long solutions.
-- **Minimalist Comments:** Write clean, modular, self-documenting code. Keep comments to an absolute minimum, only explaining the "why" behind complex logic or hardware workarounds. Do not restate obvious operations.
-
-## 4. Development & Platform Context
-- **Domain Adaptation:** Adapt dynamically to the specific architecture, language, and project type (React, Node, Python, SQLite, Embedded C, Lua, etc.). Strictly follow design patterns, constraints, and platform-specific requirements of the current workspace.
-- **Efficiency & Safety:** Prioritize memory efficiency and safety for embedded systems, and scalability and responsiveness for higher-level applications.
-
-## 5. Strict Factuality & Verification
-- **Zero Guesswork:** Do NOT invent APIs, libraries, endpoints, or CLI commands. Explicitly state if you lack knowledge.
-- **Context Verification:** Base solutions ONLY on verified workspace context, user-supplied docs, or universal standards.
-- **Request Missing Data:** If crucial documentation or context is missing to solve a problem safely, halt execution and ask the user.
-
-## 6. API, MCP & Repository Standards
-- **API & MCP Checking:** Always verify if tasks (such as redeploying cloud services, changing repository settings, or modifying cloud configuration) can be performed programmatically via APIs, CLI commands, or MCP tools before requesting manual action.
-- **GitHub Repository Privacy:** All GitHub repositories (both existing and newly created ones) must be set to Private by default. Always verify and enforce private repository status.
-
-## 7. Docs & Pipeline
-- **Start here:** `.openwiki/quickstart.md` (architecture: `.openwiki/architecture.md`, releases: `.openwiki/release_notes.md`)
-- **Multi-agent build pipelines** — three variants, pick by how much machinery the task needs:
-  - `/startcycle` — linear chain, file hand-offs in `production_artifacts/`, no state machine (`skills/basic/startcycle/SKILL.md`)
-  - `/startcycle-graph` — dispatcher graph with durable `state.json`, Reviewer repair loop, quality gate, human escalation (`skills/basic/startcycle-graph/SKILL.md`, contract in `.agents/graph.md`)
-  - `/startcycle-graph-user` — throwaway 2-4 node fan-out, nothing persistent left behind (`skills/basic/startcycle-graph-user/SKILL.md`)
-
-## 8. How many agents
-Ask one question first: **do the workers need to see each other?**
-- **No — independent sub-tasks** → subagents. Each gets a self-contained slice, returns a result, done. The normal case, and what all three pipelines above already use.
-- **Yes — they must react to each other, or claim work dynamically from a shared list** → an orchestrated agent team (via `send_message`). Currently only `/bdbrainstorm` qualifies, where the spec demands a real debate rather than parallel monologues. True Agent Teams were evaluated and deferred for `/startcycle-graph` (needs an interactive session; the graph runs headless) — see `.agents/graph.md` and F-17's addendum in `docs/sessions/audit-agents.md`.
-- **Small task** → do it yourself. A two-file edit needs no agents.
-
-"Runs in parallel" is not a reason to reach for a team — subagents already run in parallel. Peer communication and dynamic task claiming are the only things a team adds.
-
-## 9. Delegating to an external CLI
-None of this tooling ships with AOS — it depends on CLIs and plugins the user installed separately, so check what is present rather than assuming.
-- **Prefer a plugin's delegation subagent over shelling out to its CLI.** Where installed, it already handles the wrapper flags, cost discipline, and digest contract: `antigravity:antigravity-delegate` (agy), `opencode:opencode-rescue`, `codex:codex-rescue`. These are Claude Code plugins — on another harness, calling the CLI directly is the only path.
-- **Delegate only above the break-even.** A small, self-contained, or judgement-heavy task costs more to hand off and verify than to just do. Keep the digest, not the raw output.
-- **Give it a real timeout.** Measured 2026-09: a trivial headless `agy` prompt took **605s**. `agy-delegate` defaults to `--print-timeout 5m`, so it aborts at 300s and reports an empty body while the answer is still coming — pass `--timeout 15m` for anything non-trivial.
-- **Match the model to the task, not to the default.** The wrapper's tiers map to models that go stale (built-in `flash` still points at Gemini 3.7 while 3.8 ships). Media and fast/mechanical coding → `Gemini 3.8 Flash (Medium)`; trivial → `Gemini 3.8 Flash (Low)`; review, architecture and hard reasoning → `Claude Sonnet 4.6 (Thinking)`. Adversarial review most repays the stronger model: a Flash tier tends to agree with what it is shown, which is exactly what a reviewer must not do. Pass `--model` per call, or remap the tiers once via `CLAUDE_PLUGIN_OPTION_TIER_{FLASH,FLASH_LO,PRO}` — in `~/.zshenv`, not `~/.zshrc`, which non-interactive tool shells never source. Re-check names against `agy models` after an upgrade.
-- **Verify the result, never the status field.** A timed-out delegation returns `{"status": "SUCCESS", "usage": {"total": 0}}` with an empty body — success by every field except the one that matters, and the zero token counts are *not* proof the prompt never arrived (headless usage reporting is simply unpopulated). Treat an empty body as failure regardless of status, and never report a delegated step as done on the strength of its own self-report.
+# AOS — Antigravity / Gemini
+
+**Read [AGENTS.md](AGENTS.md) first.** It holds every rule that applies to all
+harnesses: the non-negotiables, the release gate, Conventional Commits, the
+skill contract and category routing, the pipeline variants, and the delegation
+policy. Nothing from it is repeated here — a rule that lives in two files is a
+rule that will eventually disagree with itself.
+
+This file covers only what is specific to running AOS under Antigravity.
+
+## Nothing enforces the gate here — you are the enforcement
+
+`.claude/hooks/go-gate.mjs` is a Claude Code hook and does not run on this
+harness. Not one of the four release commands is mechanically blocked for you,
+and neither is anything else.
+
+So the full rule in AGENTS.md applies here in its entirety, not just its
+hook-enforced subset: when the user asks for a plan, review, audit or
+multi-step action, you are read-only until they answer with the literal **GO**
+— including file writes and `git commit`. On Claude Code a hook would catch the
+four worst cases if discipline failed. Here there is no backstop, which makes
+this the harness where the rule matters most, not least.
+
+## Model routing
+
+The tier names in `agy-delegate` map to models that go stale — the built-in
+`flash` still points at Gemini 3.7 while 3.8 ships. Re-check against
+`agy models` after every upgrade; the id carries both the version and the
+effort suffix.
+
+| Work | Model |
+|---|---|
+| Media, fast or mechanical coding, boilerplate | `Gemini 3.8 Flash (Medium)` |
+| Trivial one-liners | `Gemini 3.8 Flash (Low)` |
+| Review, architecture, hard reasoning | `Claude Sonnet 4.6 (Thinking)` |
+
+Set these once via `CLAUDE_PLUGIN_OPTION_TIER_{FLASH,FLASH_LO,PRO}` in
+`~/.zshenv` — **not** `~/.zshrc`, which non-interactive tool shells never
+source.
+
+Adversarial review is the case that most repays the stronger model: a Flash
+tier tends to agree with what it is shown, which is the one thing a reviewer
+must not do.
+
+## Headless timeouts
+
+A trivial headless `agy` prompt was measured at **605s** in 2026-09.
+`agy-delegate` defaults to `--print-timeout 5m`, so it aborts at 300s and
+reports an empty body while the answer is still arriving. Pass `--timeout 15m`
+for anything non-trivial. A short timeout does not read as "slow", it reads as
+"broken".

package/README.de.md

@@ -21,6 +21,7 @@
 [![runtime](https://img.shields.io/badge/node-20+-blue.svg)](https://github.com/hybridlabor-api/aos)
 [![license](https://img.shields.io/badge/license-Apache%202.0-blue.svg)](LICENSE)
 [![skills](https://img.shields.io/badge/skills-154%20kuratiert-brightgreen.svg)](https://github.com/hybridlabor-api/aos)
+[![SkillSpector](https://img.shields.io/badge/NVIDIA%20SkillSpector-CLEAN-76B900?logo=nvidia&logoColor=white)](https://github.com/NVIDIA/SkillSpector)
 
 > **Supercharging von KI-Coding-Agenten mit 154 hochkuratierten Skills, 21 lokalen MCP Wrappern und tiefgreifenden Integrationen für die Creative-Technology-Branche.**
 
@@ -501,18 +502,18 @@ Dieses Repository enthält außerdem 14 Tiefensystem-Konfigurationen und Dokumen
 <details>
 <summary><strong>System-Skill-Liste anzeigen</strong></summary>
 
-- [`bdb-unreal-mcp.md`](skills/global_config/bdb-unreal-mcp.md)
-- [`bdb-rhino-mcp.md`](skills/global_config/bdb-rhino-mcp.md)
-- [`bdb-davinci-mcp.md`](skills/global_config/bdb-davinci-mcp.md)
-- [`bdb-blender-mcp.md`](skills/global_config/bdb-blender-mcp.md)
-- [`bdb-after-effects-mcp.md`](skills/global_config/bdb-after-effects-mcp.md)
-- [`bdb-vectorworks-mcp.md`](skills/global_config/bdb-vectorworks-mcp.md)
-- [`bdb-touchdesigner-mcp.md`](skills/global_config/bdb-touchdesigner-mcp.md)
-- [`bdb-computer-use-mcp.md`](skills/global_config/bdb-computer-use-mcp.md)
-- [`bdb-grandma3-mcp.md`](skills/global_config/bdb-grandma3-mcp.md)
-- [`bdb-resolume-mcp.md`](skills/global_config/bdb-resolume-mcp.md)
-- [`bdb-adobe-suite-mcp.md`](skills/global_config/bdb-adobe-suite-mcp.md)
-- [`bdb-memb-mcp.md`](skills/global_config/bdb-memb-mcp.md)
+- [`bdb-unreal-mcp`](skills/global_config/bdb-unreal-mcp/SKILL.md)
+- [`bdb-rhino-mcp`](skills/global_config/bdb-rhino-mcp/SKILL.md)
+- [`bdb-davinci-mcp`](skills/global_config/bdb-davinci-mcp/SKILL.md)
+- [`bdb-blender-mcp`](skills/global_config/bdb-blender-mcp/SKILL.md)
+- [`bdb-after-effects-mcp`](skills/global_config/bdb-after-effects-mcp/SKILL.md)
+- [`bdb-vectorworks-mcp`](skills/global_config/bdb-vectorworks-mcp/SKILL.md)
+- [`bdb-touchdesigner-mcp`](skills/global_config/bdb-touchdesigner-mcp/SKILL.md)
+- [`bdb-computer-use-mcp`](skills/global_config/bdb-computer-use-mcp/SKILL.md)
+- [`bdb-grandma3-mcp`](skills/global_config/bdb-grandma3-mcp/SKILL.md)
+- [`bdb-resolume-mcp`](skills/global_config/bdb-resolume-mcp/SKILL.md)
+- [`bdb-adobe-suite-mcp`](skills/global_config/bdb-adobe-suite-mcp/SKILL.md)
+- [`bdb-memb-mcp`](skills/global_config/bdb-memb-mcp/SKILL.md)
 - [`openwiki-skill`](skills/global_config/openwiki-skill/SKILL.md): Direkte, Gemini-native Integration von OpenWiki für autonomes, hochgradig eigenverantwortliches Dokumentationsmanagement und Release Notes-Pflege.
 - [`memb-skill`](skills/global_config/memb-skill/SKILL.md): BDB Local-First-Langzeitgedächtnis-Engine (memB). Erfragen, merken und anpassen von Präferenzen, Code-Architekturen und Entwicklermustern über alle Aufgaben hinweg.
 </details>

package/README.md

@@ -14,6 +14,7 @@
 [![MCPs](https://img.shields.io/badge/local%20MCPs-21-brightgreen.svg)](mcps/)
 [![harnesses](https://img.shields.io/badge/harnesses-9%20supported-blueviolet.svg)](#-installation)
 [![runtime](https://img.shields.io/badge/node-20+-blue.svg)](https://github.com/hybridlabor-api/aos)
+[![SkillSpector](https://img.shields.io/badge/NVIDIA%20SkillSpector-CLEAN-76B900?logo=nvidia&logoColor=white)](https://github.com/NVIDIA/SkillSpector)
 
 > **Supercharging AI coding agents with 169 hyper-curated skills, 21 local MCP wrappers, and a runnable multi-agent dispatcher graph.**
 
@@ -548,18 +549,18 @@ This repository contains deep-system configurations and documentation guidelines
 <details>
 <summary><strong>View System Skills List</strong></summary>
 
-- [`bdb-unreal-mcp.md`](skills/global_config/bdb-unreal-mcp.md)
-- [`bdb-rhino-mcp.md`](skills/global_config/bdb-rhino-mcp.md)
-- [`bdb-davinci-mcp.md`](skills/global_config/bdb-davinci-mcp.md)
-- [`bdb-blender-mcp.md`](skills/global_config/bdb-blender-mcp.md)
-- [`bdb-after-effects-mcp.md`](skills/global_config/bdb-after-effects-mcp.md)
-- [`bdb-vectorworks-mcp.md`](skills/global_config/bdb-vectorworks-mcp.md)
-- [`bdb-touchdesigner-mcp.md`](skills/global_config/bdb-touchdesigner-mcp.md)
-- [`bdb-computer-use-mcp.md`](skills/global_config/bdb-computer-use-mcp.md)
-- [`bdb-grandma3-mcp.md`](skills/global_config/bdb-grandma3-mcp.md)
-- [`bdb-resolume-mcp.md`](skills/global_config/bdb-resolume-mcp.md)
-- [`bdb-adobe-suite-mcp.md`](skills/global_config/bdb-adobe-suite-mcp.md)
-- [`bdb-memb-mcp.md`](skills/global_config/bdb-memb-mcp.md)
+- [`bdb-unreal-mcp`](skills/global_config/bdb-unreal-mcp/SKILL.md)
+- [`bdb-rhino-mcp`](skills/global_config/bdb-rhino-mcp/SKILL.md)
+- [`bdb-davinci-mcp`](skills/global_config/bdb-davinci-mcp/SKILL.md)
+- [`bdb-blender-mcp`](skills/global_config/bdb-blender-mcp/SKILL.md)
+- [`bdb-after-effects-mcp`](skills/global_config/bdb-after-effects-mcp/SKILL.md)
+- [`bdb-vectorworks-mcp`](skills/global_config/bdb-vectorworks-mcp/SKILL.md)
+- [`bdb-touchdesigner-mcp`](skills/global_config/bdb-touchdesigner-mcp/SKILL.md)
+- [`bdb-computer-use-mcp`](skills/global_config/bdb-computer-use-mcp/SKILL.md)
+- [`bdb-grandma3-mcp`](skills/global_config/bdb-grandma3-mcp/SKILL.md)
+- [`bdb-resolume-mcp`](skills/global_config/bdb-resolume-mcp/SKILL.md)
+- [`bdb-adobe-suite-mcp`](skills/global_config/bdb-adobe-suite-mcp/SKILL.md)
+- [`bdb-memb-mcp`](skills/global_config/bdb-memb-mcp/SKILL.md)
 - [`openwiki-skill`](skills/global_config/openwiki-skill/SKILL.md): Direct Gemini-native integration of OpenWiki for autonomous, high-agency documentation management and release notes maintenance.
 - [`memb-skill`](skills/global_config/memb-skill/SKILL.md): BDB local-first long-term memory engine (memB). Query, remember, and adapt preferences, code architectures, and developer patterns across tasks.
 </details>

package/README.pt.md

@@ -21,6 +21,7 @@
 [![runtime](https://img.shields.io/badge/node-20+-blue.svg)](https://github.com/hybridlabor-api/aos)
 [![license](https://img.shields.io/badge/license-Apache%202.0-blue.svg)](LICENSE)
 [![skills](https://img.shields.io/badge/skills-154%20curadas-brightgreen.svg)](https://github.com/hybridlabor-api/aos)
+[![SkillSpector](https://img.shields.io/badge/NVIDIA%20SkillSpector-CLEAN-76B900?logo=nvidia&logoColor=white)](https://github.com/NVIDIA/SkillSpector)
 
 > **Potencializando agentes de código de IA com 154 skills hipercuradas, 21 wrappers MCP locais e um grafo dispatcher de multi-agentes executável.**
 
@@ -494,18 +495,18 @@ Este repositório também contém 14 configurações profundas de sistema e dire
 <details>
 <summary><strong>Ver Lista de Skills do Sistema</strong></summary>
 
-- [`bdb-unreal-mcp.md`](skills/global_config/bdb-unreal-mcp.md)
-- [`bdb-rhino-mcp.md`](skills/global_config/bdb-rhino-mcp.md)
-- [`bdb-davinci-mcp.md`](skills/global_config/bdb-davinci-mcp.md)
-- [`bdb-blender-mcp.md`](skills/global_config/bdb-blender-mcp.md)
-- [`bdb-after-effects-mcp.md`](skills/global_config/bdb-after-effects-mcp.md)
-- [`bdb-vectorworks-mcp.md`](skills/global_config/bdb-vectorworks-mcp.md)
-- [`bdb-touchdesigner-mcp.md`](skills/global_config/bdb-touchdesigner-mcp.md)
-- [`bdb-computer-use-mcp.md`](skills/global_config/bdb-computer-use-mcp.md)
-- [`bdb-grandma3-mcp.md`](skills/global_config/bdb-grandma3-mcp.md)
-- [`bdb-resolume-mcp.md`](skills/global_config/bdb-resolume-mcp.md)
-- [`bdb-adobe-suite-mcp.md`](skills/global_config/bdb-adobe-suite-mcp.md)
-- [`bdb-memb-mcp.md`](skills/global_config/bdb-memb-mcp.md)
+- [`bdb-unreal-mcp`](skills/global_config/bdb-unreal-mcp/SKILL.md)
+- [`bdb-rhino-mcp`](skills/global_config/bdb-rhino-mcp/SKILL.md)
+- [`bdb-davinci-mcp`](skills/global_config/bdb-davinci-mcp/SKILL.md)
+- [`bdb-blender-mcp`](skills/global_config/bdb-blender-mcp/SKILL.md)
+- [`bdb-after-effects-mcp`](skills/global_config/bdb-after-effects-mcp/SKILL.md)
+- [`bdb-vectorworks-mcp`](skills/global_config/bdb-vectorworks-mcp/SKILL.md)
+- [`bdb-touchdesigner-mcp`](skills/global_config/bdb-touchdesigner-mcp/SKILL.md)
+- [`bdb-computer-use-mcp`](skills/global_config/bdb-computer-use-mcp/SKILL.md)
+- [`bdb-grandma3-mcp`](skills/global_config/bdb-grandma3-mcp/SKILL.md)
+- [`bdb-resolume-mcp`](skills/global_config/bdb-resolume-mcp/SKILL.md)
+- [`bdb-adobe-suite-mcp`](skills/global_config/bdb-adobe-suite-mcp/SKILL.md)
+- [`bdb-memb-mcp`](skills/global_config/bdb-memb-mcp/SKILL.md)
 - [`openwiki-skill`](skills/global_config/openwiki-skill/SKILL.md): Direct Gemini-native integration of OpenWiki for autonomous, high-agency documentation management and release notes maintenance.
 - [`memb-skill`](skills/global_config/memb-skill/SKILL.md): BDB local-first long-term memory engine (memB). Query, remember, and adapt preferences, code architectures, and developer patterns across tasks.
 </details>

package/THIRD_PARTY_NOTICES.md

@@ -127,6 +127,110 @@ SOFTWARE.
 
 ---
 
+## mattpocock/skills
+
+<https://github.com/mattpocock/skills> — MIT.
+
+The grilling family and the domain-modeling discipline it composes with:
+
+| In AOS | Upstream |
+|---|---|
+| `skills/global_config/grilling/` | `skills/productivity/grilling/` |
+| `skills/global_config/grill-me/` | `skills/productivity/grill-me/` |
+| `skills/global_config/grill-with-docs/` | `skills/engineering/grill-with-docs/` |
+| `skills/global_config/domain-modeling/` | `skills/engineering/domain-modeling/` (incl. `ADR-FORMAT.md`, `CONTEXT-FORMAT.md`) |
+| `skills/global_config/triage/` | `skills/engineering/triage/` |
+| `skills/global_config/prototype/` | `skills/engineering/prototype/` |
+
+`grilling`'s interview protocol and `domain-modeling` are carried over
+essentially verbatim; `grill-me` and `grill-with-docs` are rewritten to name AOS's
+own pipelines in their hand-off sections, but keep upstream's composition — both
+are thin wrappers that invoke the primitive rather than restating it. Upstream's
+`agents/openai.yaml` under `domain-modeling` is harness-specific to that project
+and was not carried over.
+
+`skills/global_config/ask-tim/` is derived from upstream's `ask-matt` router. It
+is not a copy: the flow it maps is AOS's own, since most of the skills on
+upstream's main flow have no AOS equivalent.
+
+```
+MIT License
+
+Copyright (c) 2026 Matt Pocock
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+```
+
+---
+
+## Other vendored skills
+
+Skills in `skills/` that were derived from an external project record that
+project in their own `source:` frontmatter. Every upstream named there is
+listed below. Licences were verified against each repository's own `LICENSE`
+file via the GitHub API on 2026-09-12; where a copyright line is quoted, it is
+quoted verbatim from that file.
+
+| Upstream | Licence | Copyright | Skills in AOS |
+|---|---|---|---|
+| [bitjaru/styleseed](https://github.com/bitjaru/styleseed) | MIT | Copyright (c) 2026 StyleSeed Contributors | `ui-component`, `ui-page`, `ui-pattern`, `ui-review`, `ui-tokens`, `ux-audit`, `ux-feedback`, `ux-flow` |
+| [firecrawl/skills](https://github.com/firecrawl/skills) | ISC | Copyright (c) Firecrawl | `firecrawl-build-scrape`, `firecrawl-build-search`, `firecrawl-build-interact`, `firecrawl-build-onboarding` |
+| [Dimillian/Skills](https://github.com/Dimillian/Skills) | MIT | Copyright (c) 2026 Thomas Ricouard | `github`, `react-component-performance`, `simplify-code` |
+| [anthropics/skills](https://github.com/anthropics/skills) | Apache-2.0 (per-skill `LICENSE.txt`; the repo has no root licence) | Copyright 2026 Anthropic, PBC. | `webapp-testing`, `web-artifacts-builder` |
+| [AgriciDaniel/claude-seo](https://github.com/AgriciDaniel/claude-seo) | MIT | Copyright (c) 2026 agricidaniel | `seo`, `seo-technical` |
+| [neondatabase/agent-skills](https://github.com/neondatabase/agent-skills) | Apache-2.0 | template placeholder upstream; holder is Neon | `using-neon` |
+| [sanjay3290/ai-skills](https://github.com/sanjay3290/ai-skills) | Apache-2.0 | see upstream `LICENSE` | `deep-research`, `google-sheets-automation` |
+| [shadcn-ui/ui](https://github.com/shadcn-ui/ui) | MIT | Copyright (c) 2023 shadcn | `shadcn` |
+| [kepano/obsidian-skills](https://github.com/kepano/obsidian-skills) | MIT | Copyright (c) 2026 Steph Ango | `obsidian-markdown` |
+| [alirezarezvani/claude-skills](https://github.com/alirezarezvani/claude-skills) | MIT | Copyright (c) 2025 Alireza Rezvani | `senior-frontend`, `landing-page-generator` |
+| [playwright-community/playwright-go](https://github.com/playwright-community/playwright-go) | MIT | Copyright (c) 2020 Max Schmitt | `go-playwright` |
+| [wrsmith108/linear-claude-skill](https://github.com/wrsmith108/linear-claude-skill) | MIT | see upstream `LICENSE` | `linear-claude-skill` |
+| [langchain-ai/openwiki](https://github.com/langchain-ai/openwiki) | MIT | see upstream `LICENSE` | `openwiki-skill` |
+
+`webapp-testing` and `web-artifacts-builder` each ship upstream's own
+`LICENSE.txt` verbatim, as Apache-2.0 §4 requires. Note that `anthropics/skills`
+licenses its document skills (`docx`, `pdf`, `pptx`, `xlsx`) as
+**source-available, not open source** — neither skill vendored here comes from
+that set, and nothing from it may be vendored under this notice.
+
+Three further skills carry an in-tree provenance marker rather than a public
+upstream repository, recorded here so the claim is not lost:
+
+| Skill | Evidence in this repo |
+|---|---|
+| `react-best-practices` | `metadata.json` → `"organization": "Vercel Engineering"` |
+| `postgres-best-practices` | `metadata.json` → `"organization": "Supabase"` |
+| `playwright-skill` | `package.json` → `"author": "lackeyjb"`, `"license": "MIT"` |
+
+### Unresolved provenance
+
+These upstreams could not be cleared. They are recorded rather than hidden, and
+each needs a decision before the affected skills can be considered safely
+redistributable.
+
+| Upstream | Problem | Skills affected |
+|---|---|---|
+| `vibeforge1111/vibeship-spawner-skills` | Repository has **no `LICENSE` file**. Its README states "Apache 2.0", but a README statement is not a licence grant — absent a licence file the default is all rights reserved. | `agent-tool-builder`, `ai-product`, `browser-automation`, `crewai`, `neon-postgres`, `rag-engineer`, `vercel-deployment` |
+| `jackjin1997/ClawForge` | No `LICENSE` file; README claims MIT. | `clean-code` |
+| `CloudAI-X/threejs-skills` | No `LICENSE` file; README claims MIT. | `threejs-skills` |
+| `Shpigford/skills` | Repository returns **404** — deleted, renamed, or made private. Provenance cannot be verified at all. | `readme` |
+
 ## Note on `mcps/`
 
 Sub-repositories vendored under `mcps/` carry their own `LICENSE` files in

package/docs/skills_table.md

@@ -48,6 +48,7 @@
 | `subagent-driven-development` | Use when executing implementation plans with independent tasks in the current session |
 | `tdd-workflow` | Test-Driven Development workflow principles. RED-GREEN-REFACTOR cycle. |
 | `tmux` | Expert tmux session, window, and pane management for terminal multiplexing, persistent remote workflows, and shell scripting automation. |
+| `teamwork-preview` | Interactive 9-step prompt crafting and delegation protocol for autonomous multi-agent teams across harnesses. |
 
 #### 🎨 Frontend & UI/UX
 | Skill Name | Description |

package/installer.js

@@ -2021,17 +2021,19 @@ function resolveTargetPaths(platformValue, customPaths) {
 }
 
 function getTierExcludeSkills(tier) {
+    // Matched against directory entry names by copyDirRecursiveSync, so these
+    // carry no extension: the MCP guides became <name>/SKILL.md directories.
     return tier === '2' ? [
-        'bdb-adobe-suite-mcp.md',
-        'bdb-after-effects-mcp.md',
-        'bdb-blender-mcp.md',
-        'bdb-davinci-mcp.md',
-        'bdb-grandma3-mcp.md',
-        'bdb-resolume-mcp.md',
-        'bdb-rhino-mcp.md',
-        'bdb-touchdesigner-mcp.md',
-        'bdb-unreal-mcp.md',
-        'bdb-vectorworks-mcp.md',
+        'bdb-adobe-suite-mcp',
+        'bdb-after-effects-mcp',
+        'bdb-blender-mcp',
+        'bdb-davinci-mcp',
+        'bdb-grandma3-mcp',
+        'bdb-resolume-mcp',
+        'bdb-rhino-mcp',
+        'bdb-touchdesigner-mcp',
+        'bdb-unreal-mcp',
+        'bdb-vectorworks-mcp',
         'bdbmediastorm'
     ] : [];
 }
@@ -2554,6 +2556,21 @@ function injectHarnessRules() {
             log.step(`Installed GEMINI.md to ${path.join(geminiDir, 'GEMINI.md')}`);
         }, 'The harness injection below still runs.');
 
+        // Dispatcher scripts must land in ~/.claude/workflows/, because that is
+        // where the skills that route to them look: startcycle-graph's SKILL.md
+        // and teamwork-preview's both tell the model to call `Workflow` with
+        // scriptPath `$HOME/.claude/workflows/<name>.mjs`. installProjectHarness()
+        // copies them into a *project*, which only helps a project that opted into
+        // the local harness -- on a plain global install those paths did not exist
+        // at all, so the skill pointed at a file that was never delivered.
+        installStep(`install dispatcher workflows to ${path.join(homeDir, '.claude', 'workflows')}`, () => {
+            const workflowsSrc = path.join(srcDir, '.claude', 'workflows');
+            if (fs.existsSync(workflowsSrc)) {
+                copyDirRecursiveSync(workflowsSrc, path.join(homeDir, '.claude', 'workflows'));
+                log.step(`Installed dispatcher workflows to ${path.join(homeDir, '.claude', 'workflows')}`);
+            }
+        }, '/startcycle-graph and /teamwork-preview fall back to their prose protocols.');
+
         const startcycleWorkflowSrc = path.join(srcDir, '.agents', 'workflows', 'startcycle.md');
         const sources = installStep('read the global rule sources', () => ({
             globalRules: fs.readFileSync(geminiMdSrc, 'utf8'),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hybridlabor-api/aos",
-  "version": "4.2.0-beta.0",
+  "version": "4.3.0",
   "description": "AOS — A Curated AI AGENT OS. Optimized agent skills and add-ons like memB, OpenWiki, Heimdall Token Saver, and Godmode architectures.",
   "main": "installer.js",
   "bin": {
@@ -11,6 +11,11 @@
     "setup-saas": "bin/setup-saas.mjs",
     "aos-plan-canvas": "skills/global_config/plan-canvas/scripts/plan-canvas.js"
   },
+  "scripts": {
+    "validate": "node scripts/validate-skills.mjs",
+    "validate:strict": "node scripts/validate-skills.mjs --strict",
+    "test": "node scripts/validate-skills.mjs --selftest && node scripts/validate-skills.mjs"
+  },
   "publishConfig": {
     "access": "public"
   },