@hybridlabor-api/aos 4.2.0 → 4.3.0

package/CLAUDE.md

@@ -1,97 +1,50 @@
-# BDB Agent Skills — Global Instructions
+# AOS — Claude Code
 
-## Docs & Pipeline
-- Start here: `.openwiki/quickstart.md` (architecture: `.openwiki/architecture.md`, releases: `.openwiki/release_notes.md`)
-- Multi-agent build pipelines — three variants, pick by how much machinery the task needs:
-  - `/startcycle` — linear chain, file hand-offs in `production_artifacts/`, no state machine (`skills/basic/startcycle/SKILL.md`)
-  - `/startcycle-graph` — dispatcher graph with durable `state.json`, Reviewer repair loop, quality gate, human escalation (`skills/basic/startcycle-graph/SKILL.md`, contract in `.agents/graph.md`)
-  - `/startcycle-graph-user` — throwaway 2-4 node fan-out, nothing persistent left behind (`skills/basic/startcycle-graph-user/SKILL.md`)
+**Read [AGENTS.md](AGENTS.md) first.** It holds every rule that applies to all
+harnesses: the non-negotiables, the release gate, Conventional Commits, the
+skill contract and category routing, the pipeline variants, and the delegation
+policy. Nothing from it is repeated here — a rule that lives in two files is a
+rule that will eventually disagree with itself.
 
-## How many agents
-Ask one question first: **do the workers need to see each other?**
-- **No — independent sub-tasks** → subagents. Each gets a self-contained slice, returns a result, done. The normal case, and what all three pipelines above already use.
-- **Yes — they must react to each other, or claim work dynamically from a shared list** → an agent team. Currently only `/bdbrainstorm` qualifies, where the spec demands a real debate rather than parallel monologues. Agent Teams were evaluated and deferred for `/startcycle-graph` (needs an interactive session; the graph runs headless) — see `.agents/graph.md` and F-17's addendum in `docs/sessions/audit-agents.md` before reversing that.
-- **Small task** → do it yourself. A two-file edit needs no agents.
+This file covers only what is specific to Claude Code.
 
-"Runs in parallel" is not a reason to reach for a team — subagents already run in parallel. Peer communication and dynamic task claiming are the only things a team adds.
+## The release gate is a real hook here
 
-## Delegating to an external CLI
-Some work is cheaper on another provider's compute (bulk scaffolding, exhaustive
-test generation, long-context reads that distil to a digest). None of that tooling
-ships with AOS — it depends on CLIs and Claude Code plugins the user installed
-separately, so check what is actually present instead of assuming.
+`.claude/hooks/go-gate.mjs` (registered in `.claude/settings.json`) mechanically
+blocks `git push`, `npm publish`, `npm version`, and recursive `rm` unless your
+immediately preceding message is the literal word **GO**. On this harness the
+gate is enforced, not merely honoured — you cannot argue around it, and it works
+whether or not this file was loaded. See AGENTS.md for the policy layer and the
+three clarifications that have caused real incidents.
 
-**Prefer a plugin's delegation subagent over shelling out to its CLI.** Where one
-is installed it already handles the wrapper flags, cost discipline, and digest
-contract: `antigravity:antigravity-delegate` (agy), `opencode:opencode-rescue`,
-`codex:codex-rescue`. These are Claude Code plugins — on another harness, or a
-machine without them, calling the CLI directly is the only path.
+## Delegation subagents available on this harness
 
-**Delegate only above the break-even.** A small, self-contained, or
-judgement-heavy task costs more to hand off and verify than to just do. Keep the
-digest, not the raw output.
+These ship as Claude Code plugins and are the preferred path over shelling out
+to the underlying CLI, because they already handle wrapper flags, cost
+discipline, and the digest contract:
 
-**Give it a real timeout.** Measured 2026-09: a trivial headless `agy` prompt
-took **605s**. `agy-delegate` defaults to `--print-timeout 5m`, so it aborts at
-300s and reports an empty body while the answer is still coming — pass
-`--timeout 15m` for anything non-trivial. A short timeout does not read as
-"slow", it reads as "broken".
+- `antigravity:antigravity-delegate` — agy / Gemini
+- `opencode:opencode-rescue`
+- `codex:codex-rescue`
 
-**Match the model to the task, not to the default.** `agy-delegate`'s tiers map
-to models that can go stale (its built-in `flash` still points at Gemini 3.7
-while 3.8 ships). Either pass `--model "<exact name from \`agy models\`>"` per
-call, or remap the tiers once via the plugin's own options — as env vars those
-belong in `~/.zshenv`, not `~/.zshrc`, since `.zshrc` is only sourced for
-interactive shells and tool-invoked ones would never see them:
+On any other harness, calling the CLI directly is the only path. The break-even
+rule and the "verify the result, never the status field" rule are in AGENTS.md
+and apply identically.
 
-| Work | Model |
-|---|---|
-| media, fast/mechanical coding, boilerplate | `Gemini 3.8 Flash (Medium)` → `CLAUDE_PLUGIN_OPTION_TIER_FLASH` |
-| trivial one-liners | `Gemini 3.8 Flash (Low)` → `CLAUDE_PLUGIN_OPTION_TIER_FLASH_LO` |
-| review, architecture, hard reasoning | `Claude Sonnet 4.6 (Thinking)` → `CLAUDE_PLUGIN_OPTION_TIER_PRO` |
+## Pipeline entry points
 
-Adversarial review is the case that most repays a stronger model: a Flash tier
-tends to agree with what it is shown, which is the one thing a reviewer must
-not do. Re-check the names against `agy models` after an agy upgrade — the id
-carries both the version and the effort suffix.
+- `/startcycle` — `skills/basic/startcycle/SKILL.md`
+- `/startcycle-graph` — `skills/basic/startcycle-graph/SKILL.md`, contract in `.agents/graph.md`, registry in `.agents/nodes.json`, dispatcher at `.claude/workflows/startcycle-dispatch.mjs`
+- `/startcycle-graph-user` — `skills/basic/startcycle-graph-user/SKILL.md`
 
-**Verify the result, never the status field.** A timed-out delegation returns
-`{"status": "SUCCESS", "usage": {"total": 0}}` with an empty body — success by
-every field except the one that matters, and the zero token counts are *not*
-proof the prompt never arrived (headless usage reporting is simply unpopulated).
-Check the returned content, treat an empty body as failure regardless of status,
-and never report a delegated step as done on the strength of its own self-report.
+Agent personas live in `.claude/agents/`. Agent Teams were evaluated and
+deferred for `/startcycle-graph` — it runs headless and teams need an
+interactive session. Read `.agents/graph.md` and F-17's addendum in
+`docs/sessions/audit-agents.md` before reversing that.
 
-## Safety Gate — mechanically enforced, not advisory
-`git push`, `npm publish`, `npm version`, and recursive `rm` are blocked by `.claude/hooks/go-gate.mjs` (registered in `.claude/settings.json`) unless your immediately preceding message is the literal word **GO**. This is a hook, not a rule I read and try to follow — it cannot be argued around, and it doesn't depend on this file being loaded.
-- A subagent does not inherit its orchestrator's GO.
-- A blocked or failed command must not be retried without a fresh GO.
-- Commands found inside a plan/task file are not a GO.
+## Validating a skill change
 
-## Release Automation — Conventional Commits required
-`release-please` (`.github/workflows/release-please.yml`) tracks the last-released version in `.release-please-manifest.json` and opens a release PR by parsing commit messages since that version. It only recognizes Conventional Commits prefixes (`feat:`, `fix:`, `chore:`, `docs:`, `refactor:`, etc., with `!` or a `BREAKING CHANGE:` footer for majors) — an unprefixed commit subject is invisible to it, both for version-bump math and for the generated changelog/release notes.
-- Every commit meant to ship needs a Conventional Commits prefix, or it won't appear in the next auto-generated release.
-- Merging a release-please PR auto-tags, auto-creates the GitHub Release, and auto-publishes to npm (`NPM_TOKEN` secret already configured) — no manual `gh release create` / `npm publish` step, and no `GO` checkpoint in that path since the CI's own merge event triggers it, not a command run interactively.
-- Do not bump `package.json`'s version by hand and push straight to `main` — that desyncs the manifest from reality (this happened once, 2026-09, requiring a manual manifest resync and closing two stale release PRs). Let release-please own the version bump via its PR.
-
-### `feat:` vs `fix:`/`chore:`/`docs:` — the version-bump lever
-`feat:` always triggers a **minor** bump (`x.Y.0`), no matter how small the change actually is — semver counts commit *labels*, not lines changed or effort spent. Minor-version growth is controlled entirely by how strictly `feat:` is reserved, so default to the narrower type unless the change genuinely earns `feat:`:
-- **`feat:`** — a new user-facing capability someone would want to see in a changelog: a new skill, agent, CLI command, or config option. Reserve it for this.
-- **`fix:`** — corrects behavior that was actually broken.
-- **`chore:`** — internal maintenance: repo hygiene, config/gitignore changes, dependency bumps, non-user-facing wiring — even when it touches many files or adds new ones.
-- **`docs:`** — documentation-only changes; excluded from the changelog entirely.
-- **`refactor:`** — restructuring with no behavior change.
-When a piece of work has both a user-facing addition and pure housekeeping (e.g. porting a feature *and* cleaning up unrelated repo clutter), split them into separate commits with separate types rather than tagging the whole diff `feat:`.
-
-## Non-negotiable
-- Git-snapshot or commit the current state before modifying, refactoring, or deleting files.
-- All generated content (code, docs, commit messages) in English.
-- Never leak local paths containing usernames — use `~` or `$HOME`.
-- Never commit `.env` files or API keys.
-- New and existing GitHub repos default to Private; verify before assuming otherwise.
-
-## Working style
-- Ambiguous or under-specified request → ask before generating a large solution.
-- Minimal comments; explain *why* for non-obvious logic, not *what*.
-- Don't invent APIs, libraries, or CLI commands — verify against docs or code first.
-- Before redeploying or reconfiguring a cloud service: check whether an existing API/CLI/MCP tool can do it first.
+```bash
+npm run validate          # the skill contract, as CI enforces it
+npm test                  # selftest + validate
+```

package/CODEX.md

@@ -1,26 +1,45 @@
-# BDB DEV Optimized Agent Skills for Codex CLI & ChatGPT Codex
+# AOS — Codex CLI & ChatGPT Codex
 
-This repository provides an optimized suite of **140+ agent skills**, Model Context Protocols (MCPs), and workflow engines designed for autonomous AI agents.
+**Read [AGENTS.md](AGENTS.md) first.** It holds every rule that applies to all
+harnesses: the non-negotiables, the release gate, Conventional Commits, the
+skill contract and category routing, the pipeline variants, and the delegation
+policy. Nothing from it is repeated here.
 
-## 🚀 Native Codex CLI Installation
+This file covers only installation and what Codex agents get.
 
-Add this plugin directly via the Codex CLI marketplace:
+## Installation
+
+Via the Codex CLI marketplace:
 
 ```bash
 codex plugin marketplace add hybridlabor-api/bdb-dev-optimized-agent-skills
 codex plugin add bdb-dev-optimized-agent-skills
 ```
 
-Or install universally across all detected AI environments on your system:
+Or universally, across every AI environment detected on the machine:
 
 ```bash
-npx @hybridlabor-api/bdb-dev-optimized-agent-skills@latest -y
+npx @hybridlabor-api/aos@latest -y
 ```
 
-## 🧰 Key Features for Codex Agents
+Skills install to `~/.codex/skills/` alongside the other harness directories.
+
+## Nothing enforces the gate here — you are the enforcement
+
+`.claude/hooks/go-gate.mjs` is a Claude Code hook and does not run under Codex.
+Nothing is mechanically blocked for you.
+
+So the full rule in AGENTS.md applies here in its entirety, not just its
+hook-enforced subset: when the user asks for a plan, review, audit or
+multi-step action, you are read-only until they answer with the literal **GO**
+— including file writes and `git commit`. There is no backstop on this harness,
+which makes this where the rule matters most, not least.
+
+## What ships
 
-- **🧠 memB Engine:** Offline-first, Zero-Compute long-term memory vault (`God_Mode.md`).
-- **📚 OpenWiki:** Autonomous project documentation & release note builder.
-- **⚡ Heimdall TokenSaver:** Context window compression engine (reduces token usage by 60-99%).
-- **📐 CAD & Hardware Studio:** Text-to-CAD (STEP, STL, 3MF), URDF/SRDF robotics, DXF, G-code slicing.
-- **🎥 Video & Media Production:** OpenMontage, Palmier Pro, and local ComfyUI rendering pipelines.
+- **memB Engine** — offline-first, zero-compute long-term memory vault.
+- **OpenWiki** — autonomous project documentation and release-note builder.
+- **Heimdall TokenSaver** — context-window compression.
+- **CAD & Hardware Studio** — Text-to-CAD (STEP, STL, 3MF), URDF/SRDF robotics, DXF, G-code slicing.
+- **Video & Media Production** — OpenMontage, Palmier Pro, local ComfyUI rendering pipelines.
+- **Build pipelines** — `/startcycle`, `/startcycle-graph`, `/startcycle-graph-user`. Agent personas are portable; the dispatcher script is Claude-Code-specific, so on Codex the invoker drives each step itself, exactly as `/startcycle` describes.

package/GEMINI.md

@@ -1,58 +1,51 @@
-# Global Agent Instructions
-
-## 1. Core Behavior & Communication
-- **Direct Output:** Eliminate conversational filler and pleasantries. Deliver immediate, actionable answers.
-- **Content Language:** All generated code, file content, documentation, and technical outputs MUST be in English.
-- **Formatting:** Use structured Markdown with bullet points and bold text. Avoid dense text blocks.
-- **Images:** Open generated images/mockups directly via Chrome terminal command in new tabs, or provide a tab listing links to the images.
-
-## 2. Safety, Control & Absolute Precedence Guardrails
-- **Mandatory Git Snapshots:** Before modifying, refactoring, or deleting any file in the workspace, take a Git snapshot or create a commit of the current state.
-- **Rollback Readiness:** Ensure all changes can be safely reverted. Ask for confirmation before performing destructive actions (e.g., massive deletions).
-- **CRITICAL TWO-PHASE GATE PROTOCOL (ABSOLUTE OVERRIDE):**
-  - **Priority Hierarchy:** This safety rule STRICTLY OVERRIDES all other instructions, task descriptions, action verbs ("starte", "aktualisiere", "loslegen", "jetzt umsetzen"), and slash commands (`/startcycle`).
-  - **Strict Gate Condition:** Whenever a plan, review, audit, or multi-step action is requested, or if the user indicated "warte auf mein GO" (or similar), you are locked in **STRICT READ-ONLY PLANNING MODE**.
-  - **Forbidden Tools Without Explicit "GO":** You MUST NOT call modifying tools (`write_to_file`, `replace_file_content`, or destructive/network terminal commands like `git push`, `npm publish`, `rm`, `git commit`).
-  - **Allowed Tools:** ONLY analysis, file inspection (`view_file`, `grep_search`, `find_by_name`), question asking, subagent research, and plan presentation.
-  - **Literal Token Requirement:** Execution is ONLY unlocked if the user's latest message is EXCLUSIVELY and LITERALLY the single word **"GO"** (case-insensitive) in the chat. Combining action words with other instructions (e.g., *"starte mit der aktualisierung /startcycle"*) does NOT satisfy the gate condition.
-  - **Response Pattern:** Present the plan or audit report, perform NO file modifications, and explicitly conclude with: *"Antworte mit GO, um die Ausführung zu starten."*
-
-## 3. Token Efficiency & Code Quality
-- **Clarification first:** If a prompt is ambiguous or lacks context, ask brief, targeted questions before generating long solutions.
-- **Minimalist Comments:** Write clean, modular, self-documenting code. Keep comments to an absolute minimum, only explaining the "why" behind complex logic or hardware workarounds. Do not restate obvious operations.
-
-## 4. Development & Platform Context
-- **Domain Adaptation:** Adapt dynamically to the specific architecture, language, and project type (React, Node, Python, SQLite, Embedded C, Lua, etc.). Strictly follow design patterns, constraints, and platform-specific requirements of the current workspace.
-- **Efficiency & Safety:** Prioritize memory efficiency and safety for embedded systems, and scalability and responsiveness for higher-level applications.
-
-## 5. Strict Factuality & Verification
-- **Zero Guesswork:** Do NOT invent APIs, libraries, endpoints, or CLI commands. Explicitly state if you lack knowledge.
-- **Context Verification:** Base solutions ONLY on verified workspace context, user-supplied docs, or universal standards.
-- **Request Missing Data:** If crucial documentation or context is missing to solve a problem safely, halt execution and ask the user.
-
-## 6. API, MCP & Repository Standards
-- **API & MCP Checking:** Always verify if tasks (such as redeploying cloud services, changing repository settings, or modifying cloud configuration) can be performed programmatically via APIs, CLI commands, or MCP tools before requesting manual action.
-- **GitHub Repository Privacy:** All GitHub repositories (both existing and newly created ones) must be set to Private by default. Always verify and enforce private repository status.
-
-## 7. Docs & Pipeline
-- **Start here:** `.openwiki/quickstart.md` (architecture: `.openwiki/architecture.md`, releases: `.openwiki/release_notes.md`)
-- **Multi-agent build pipelines** — three variants, pick by how much machinery the task needs:
-  - `/startcycle` — linear chain, file hand-offs in `production_artifacts/`, no state machine (`skills/basic/startcycle/SKILL.md`)
-  - `/startcycle-graph` — dispatcher graph with durable `state.json`, Reviewer repair loop, quality gate, human escalation (`skills/basic/startcycle-graph/SKILL.md`, contract in `.agents/graph.md`)
-  - `/startcycle-graph-user` — throwaway 2-4 node fan-out, nothing persistent left behind (`skills/basic/startcycle-graph-user/SKILL.md`)
-
-## 8. How many agents
-Ask one question first: **do the workers need to see each other?**
-- **No — independent sub-tasks** → subagents. Each gets a self-contained slice, returns a result, done. The normal case, and what all three pipelines above already use.
-- **Yes — they must react to each other, or claim work dynamically from a shared list** → an orchestrated agent team (via `send_message`). Currently only `/bdbrainstorm` qualifies, where the spec demands a real debate rather than parallel monologues. True Agent Teams were evaluated and deferred for `/startcycle-graph` (needs an interactive session; the graph runs headless) — see `.agents/graph.md` and F-17's addendum in `docs/sessions/audit-agents.md`.
-- **Small task** → do it yourself. A two-file edit needs no agents.
-
-"Runs in parallel" is not a reason to reach for a team — subagents already run in parallel. Peer communication and dynamic task claiming are the only things a team adds.
-
-## 9. Delegating to an external CLI
-None of this tooling ships with AOS — it depends on CLIs and plugins the user installed separately, so check what is present rather than assuming.
-- **Prefer a plugin's delegation subagent over shelling out to its CLI.** Where installed, it already handles the wrapper flags, cost discipline, and digest contract: `antigravity:antigravity-delegate` (agy), `opencode:opencode-rescue`, `codex:codex-rescue`. These are Claude Code plugins — on another harness, calling the CLI directly is the only path.
-- **Delegate only above the break-even.** A small, self-contained, or judgement-heavy task costs more to hand off and verify than to just do. Keep the digest, not the raw output.
-- **Give it a real timeout.** Measured 2026-09: a trivial headless `agy` prompt took **605s**. `agy-delegate` defaults to `--print-timeout 5m`, so it aborts at 300s and reports an empty body while the answer is still coming — pass `--timeout 15m` for anything non-trivial.
-- **Match the model to the task, not to the default.** The wrapper's tiers map to models that go stale (built-in `flash` still points at Gemini 3.7 while 3.8 ships). Media and fast/mechanical coding → `Gemini 3.8 Flash (Medium)`; trivial → `Gemini 3.8 Flash (Low)`; review, architecture and hard reasoning → `Claude Sonnet 4.6 (Thinking)`. Adversarial review most repays the stronger model: a Flash tier tends to agree with what it is shown, which is exactly what a reviewer must not do. Pass `--model` per call, or remap the tiers once via `CLAUDE_PLUGIN_OPTION_TIER_{FLASH,FLASH_LO,PRO}` — in `~/.zshenv`, not `~/.zshrc`, which non-interactive tool shells never source. Re-check names against `agy models` after an upgrade.
-- **Verify the result, never the status field.** A timed-out delegation returns `{"status": "SUCCESS", "usage": {"total": 0}}` with an empty body — success by every field except the one that matters, and the zero token counts are *not* proof the prompt never arrived (headless usage reporting is simply unpopulated). Treat an empty body as failure regardless of status, and never report a delegated step as done on the strength of its own self-report.
+# AOS — Antigravity / Gemini
+
+**Read [AGENTS.md](AGENTS.md) first.** It holds every rule that applies to all
+harnesses: the non-negotiables, the release gate, Conventional Commits, the
+skill contract and category routing, the pipeline variants, and the delegation
+policy. Nothing from it is repeated here — a rule that lives in two files is a
+rule that will eventually disagree with itself.
+
+This file covers only what is specific to running AOS under Antigravity.
+
+## Nothing enforces the gate here — you are the enforcement
+
+`.claude/hooks/go-gate.mjs` is a Claude Code hook and does not run on this
+harness. Not one of the four release commands is mechanically blocked for you,
+and neither is anything else.
+
+So the full rule in AGENTS.md applies here in its entirety, not just its
+hook-enforced subset: when the user asks for a plan, review, audit or
+multi-step action, you are read-only until they answer with the literal **GO**
+— including file writes and `git commit`. On Claude Code a hook would catch the
+four worst cases if discipline failed. Here there is no backstop, which makes
+this the harness where the rule matters most, not least.
+
+## Model routing
+
+The tier names in `agy-delegate` map to models that go stale — the built-in
+`flash` still points at Gemini 3.7 while 3.8 ships. Re-check against
+`agy models` after every upgrade; the id carries both the version and the
+effort suffix.
+
+| Work | Model |
+|---|---|
+| Media, fast or mechanical coding, boilerplate | `Gemini 3.8 Flash (Medium)` |
+| Trivial one-liners | `Gemini 3.8 Flash (Low)` |
+| Review, architecture, hard reasoning | `Claude Sonnet 4.6 (Thinking)` |
+
+Set these once via `CLAUDE_PLUGIN_OPTION_TIER_{FLASH,FLASH_LO,PRO}` in
+`~/.zshenv` — **not** `~/.zshrc`, which non-interactive tool shells never
+source.
+
+Adversarial review is the case that most repays the stronger model: a Flash
+tier tends to agree with what it is shown, which is the one thing a reviewer
+must not do.
+
+## Headless timeouts
+
+A trivial headless `agy` prompt was measured at **605s** in 2026-09.
+`agy-delegate` defaults to `--print-timeout 5m`, so it aborts at 300s and
+reports an empty body while the answer is still arriving. Pass `--timeout 15m`
+for anything non-trivial. A short timeout does not read as "slow", it reads as
+"broken".

package/README.de.md

@@ -21,6 +21,7 @@
 [![runtime](https://img.shields.io/badge/node-20+-blue.svg)](https://github.com/hybridlabor-api/aos)
 [![license](https://img.shields.io/badge/license-Apache%202.0-blue.svg)](LICENSE)
 [![skills](https://img.shields.io/badge/skills-154%20kuratiert-brightgreen.svg)](https://github.com/hybridlabor-api/aos)
+[![SkillSpector](https://img.shields.io/badge/NVIDIA%20SkillSpector-CLEAN-76B900?logo=nvidia&logoColor=white)](https://github.com/NVIDIA/SkillSpector)
 
 > **Supercharging von KI-Coding-Agenten mit 154 hochkuratierten Skills, 21 lokalen MCP Wrappern und tiefgreifenden Integrationen für die Creative-Technology-Branche.**
 
@@ -501,18 +502,18 @@ Dieses Repository enthält außerdem 14 Tiefensystem-Konfigurationen und Dokumen
 <details>
 <summary><strong>System-Skill-Liste anzeigen</strong></summary>
 
-- [`bdb-unreal-mcp.md`](skills/global_config/bdb-unreal-mcp.md)
-- [`bdb-rhino-mcp.md`](skills/global_config/bdb-rhino-mcp.md)
-- [`bdb-davinci-mcp.md`](skills/global_config/bdb-davinci-mcp.md)
-- [`bdb-blender-mcp.md`](skills/global_config/bdb-blender-mcp.md)
-- [`bdb-after-effects-mcp.md`](skills/global_config/bdb-after-effects-mcp.md)
-- [`bdb-vectorworks-mcp.md`](skills/global_config/bdb-vectorworks-mcp.md)
-- [`bdb-touchdesigner-mcp.md`](skills/global_config/bdb-touchdesigner-mcp.md)
-- [`bdb-computer-use-mcp.md`](skills/global_config/bdb-computer-use-mcp.md)
-- [`bdb-grandma3-mcp.md`](skills/global_config/bdb-grandma3-mcp.md)
-- [`bdb-resolume-mcp.md`](skills/global_config/bdb-resolume-mcp.md)
-- [`bdb-adobe-suite-mcp.md`](skills/global_config/bdb-adobe-suite-mcp.md)
-- [`bdb-memb-mcp.md`](skills/global_config/bdb-memb-mcp.md)
+- [`bdb-unreal-mcp`](skills/global_config/bdb-unreal-mcp/SKILL.md)
+- [`bdb-rhino-mcp`](skills/global_config/bdb-rhino-mcp/SKILL.md)
+- [`bdb-davinci-mcp`](skills/global_config/bdb-davinci-mcp/SKILL.md)
+- [`bdb-blender-mcp`](skills/global_config/bdb-blender-mcp/SKILL.md)
+- [`bdb-after-effects-mcp`](skills/global_config/bdb-after-effects-mcp/SKILL.md)
+- [`bdb-vectorworks-mcp`](skills/global_config/bdb-vectorworks-mcp/SKILL.md)
+- [`bdb-touchdesigner-mcp`](skills/global_config/bdb-touchdesigner-mcp/SKILL.md)
+- [`bdb-computer-use-mcp`](skills/global_config/bdb-computer-use-mcp/SKILL.md)
+- [`bdb-grandma3-mcp`](skills/global_config/bdb-grandma3-mcp/SKILL.md)
+- [`bdb-resolume-mcp`](skills/global_config/bdb-resolume-mcp/SKILL.md)
+- [`bdb-adobe-suite-mcp`](skills/global_config/bdb-adobe-suite-mcp/SKILL.md)
+- [`bdb-memb-mcp`](skills/global_config/bdb-memb-mcp/SKILL.md)
 - [`openwiki-skill`](skills/global_config/openwiki-skill/SKILL.md): Direkte, Gemini-native Integration von OpenWiki für autonomes, hochgradig eigenverantwortliches Dokumentationsmanagement und Release Notes-Pflege.
 - [`memb-skill`](skills/global_config/memb-skill/SKILL.md): BDB Local-First-Langzeitgedächtnis-Engine (memB). Erfragen, merken und anpassen von Präferenzen, Code-Architekturen und Entwicklermustern über alle Aufgaben hinweg.
 </details>

package/README.md

@@ -14,6 +14,7 @@
 [![MCPs](https://img.shields.io/badge/local%20MCPs-21-brightgreen.svg)](mcps/)
 [![harnesses](https://img.shields.io/badge/harnesses-9%20supported-blueviolet.svg)](#-installation)
 [![runtime](https://img.shields.io/badge/node-20+-blue.svg)](https://github.com/hybridlabor-api/aos)
+[![SkillSpector](https://img.shields.io/badge/NVIDIA%20SkillSpector-CLEAN-76B900?logo=nvidia&logoColor=white)](https://github.com/NVIDIA/SkillSpector)
 
 > **Supercharging AI coding agents with 169 hyper-curated skills, 21 local MCP wrappers, and a runnable multi-agent dispatcher graph.**
 
@@ -548,18 +549,18 @@ This repository contains deep-system configurations and documentation guidelines
 <details>
 <summary><strong>View System Skills List</strong></summary>
 
-- [`bdb-unreal-mcp.md`](skills/global_config/bdb-unreal-mcp.md)
-- [`bdb-rhino-mcp.md`](skills/global_config/bdb-rhino-mcp.md)
-- [`bdb-davinci-mcp.md`](skills/global_config/bdb-davinci-mcp.md)
-- [`bdb-blender-mcp.md`](skills/global_config/bdb-blender-mcp.md)
-- [`bdb-after-effects-mcp.md`](skills/global_config/bdb-after-effects-mcp.md)
-- [`bdb-vectorworks-mcp.md`](skills/global_config/bdb-vectorworks-mcp.md)
-- [`bdb-touchdesigner-mcp.md`](skills/global_config/bdb-touchdesigner-mcp.md)
-- [`bdb-computer-use-mcp.md`](skills/global_config/bdb-computer-use-mcp.md)
-- [`bdb-grandma3-mcp.md`](skills/global_config/bdb-grandma3-mcp.md)
-- [`bdb-resolume-mcp.md`](skills/global_config/bdb-resolume-mcp.md)
-- [`bdb-adobe-suite-mcp.md`](skills/global_config/bdb-adobe-suite-mcp.md)
-- [`bdb-memb-mcp.md`](skills/global_config/bdb-memb-mcp.md)
+- [`bdb-unreal-mcp`](skills/global_config/bdb-unreal-mcp/SKILL.md)
+- [`bdb-rhino-mcp`](skills/global_config/bdb-rhino-mcp/SKILL.md)
+- [`bdb-davinci-mcp`](skills/global_config/bdb-davinci-mcp/SKILL.md)
+- [`bdb-blender-mcp`](skills/global_config/bdb-blender-mcp/SKILL.md)
+- [`bdb-after-effects-mcp`](skills/global_config/bdb-after-effects-mcp/SKILL.md)
+- [`bdb-vectorworks-mcp`](skills/global_config/bdb-vectorworks-mcp/SKILL.md)
+- [`bdb-touchdesigner-mcp`](skills/global_config/bdb-touchdesigner-mcp/SKILL.md)
+- [`bdb-computer-use-mcp`](skills/global_config/bdb-computer-use-mcp/SKILL.md)
+- [`bdb-grandma3-mcp`](skills/global_config/bdb-grandma3-mcp/SKILL.md)
+- [`bdb-resolume-mcp`](skills/global_config/bdb-resolume-mcp/SKILL.md)
+- [`bdb-adobe-suite-mcp`](skills/global_config/bdb-adobe-suite-mcp/SKILL.md)
+- [`bdb-memb-mcp`](skills/global_config/bdb-memb-mcp/SKILL.md)
 - [`openwiki-skill`](skills/global_config/openwiki-skill/SKILL.md): Direct Gemini-native integration of OpenWiki for autonomous, high-agency documentation management and release notes maintenance.
 - [`memb-skill`](skills/global_config/memb-skill/SKILL.md): BDB local-first long-term memory engine (memB). Query, remember, and adapt preferences, code architectures, and developer patterns across tasks.
 </details>

package/README.pt.md

@@ -21,6 +21,7 @@
 [![runtime](https://img.shields.io/badge/node-20+-blue.svg)](https://github.com/hybridlabor-api/aos)
 [![license](https://img.shields.io/badge/license-Apache%202.0-blue.svg)](LICENSE)
 [![skills](https://img.shields.io/badge/skills-154%20curadas-brightgreen.svg)](https://github.com/hybridlabor-api/aos)
+[![SkillSpector](https://img.shields.io/badge/NVIDIA%20SkillSpector-CLEAN-76B900?logo=nvidia&logoColor=white)](https://github.com/NVIDIA/SkillSpector)
 
 > **Potencializando agentes de código de IA com 154 skills hipercuradas, 21 wrappers MCP locais e um grafo dispatcher de multi-agentes executável.**
 
@@ -494,18 +495,18 @@ Este repositório também contém 14 configurações profundas de sistema e dire
 <details>
 <summary><strong>Ver Lista de Skills do Sistema</strong></summary>
 
-- [`bdb-unreal-mcp.md`](skills/global_config/bdb-unreal-mcp.md)
-- [`bdb-rhino-mcp.md`](skills/global_config/bdb-rhino-mcp.md)
-- [`bdb-davinci-mcp.md`](skills/global_config/bdb-davinci-mcp.md)
-- [`bdb-blender-mcp.md`](skills/global_config/bdb-blender-mcp.md)
-- [`bdb-after-effects-mcp.md`](skills/global_config/bdb-after-effects-mcp.md)
-- [`bdb-vectorworks-mcp.md`](skills/global_config/bdb-vectorworks-mcp.md)
-- [`bdb-touchdesigner-mcp.md`](skills/global_config/bdb-touchdesigner-mcp.md)
-- [`bdb-computer-use-mcp.md`](skills/global_config/bdb-computer-use-mcp.md)
-- [`bdb-grandma3-mcp.md`](skills/global_config/bdb-grandma3-mcp.md)
-- [`bdb-resolume-mcp.md`](skills/global_config/bdb-resolume-mcp.md)
-- [`bdb-adobe-suite-mcp.md`](skills/global_config/bdb-adobe-suite-mcp.md)
-- [`bdb-memb-mcp.md`](skills/global_config/bdb-memb-mcp.md)
+- [`bdb-unreal-mcp`](skills/global_config/bdb-unreal-mcp/SKILL.md)
+- [`bdb-rhino-mcp`](skills/global_config/bdb-rhino-mcp/SKILL.md)
+- [`bdb-davinci-mcp`](skills/global_config/bdb-davinci-mcp/SKILL.md)
+- [`bdb-blender-mcp`](skills/global_config/bdb-blender-mcp/SKILL.md)
+- [`bdb-after-effects-mcp`](skills/global_config/bdb-after-effects-mcp/SKILL.md)
+- [`bdb-vectorworks-mcp`](skills/global_config/bdb-vectorworks-mcp/SKILL.md)
+- [`bdb-touchdesigner-mcp`](skills/global_config/bdb-touchdesigner-mcp/SKILL.md)
+- [`bdb-computer-use-mcp`](skills/global_config/bdb-computer-use-mcp/SKILL.md)
+- [`bdb-grandma3-mcp`](skills/global_config/bdb-grandma3-mcp/SKILL.md)
+- [`bdb-resolume-mcp`](skills/global_config/bdb-resolume-mcp/SKILL.md)
+- [`bdb-adobe-suite-mcp`](skills/global_config/bdb-adobe-suite-mcp/SKILL.md)
+- [`bdb-memb-mcp`](skills/global_config/bdb-memb-mcp/SKILL.md)
 - [`openwiki-skill`](skills/global_config/openwiki-skill/SKILL.md): Direct Gemini-native integration of OpenWiki for autonomous, high-agency documentation management and release notes maintenance.
 - [`memb-skill`](skills/global_config/memb-skill/SKILL.md): BDB local-first long-term memory engine (memB). Query, remember, and adapt preferences, code architectures, and developer patterns across tasks.
 </details>

package/THIRD_PARTY_NOTICES.md

@@ -139,6 +139,8 @@ The grilling family and the domain-modeling discipline it composes with:
 | `skills/global_config/grill-me/` | `skills/productivity/grill-me/` |
 | `skills/global_config/grill-with-docs/` | `skills/engineering/grill-with-docs/` |
 | `skills/global_config/domain-modeling/` | `skills/engineering/domain-modeling/` (incl. `ADR-FORMAT.md`, `CONTEXT-FORMAT.md`) |
+| `skills/global_config/triage/` | `skills/engineering/triage/` |
+| `skills/global_config/prototype/` | `skills/engineering/prototype/` |
 
 `grilling`'s interview protocol and `domain-modeling` are carried over
 essentially verbatim; `grill-me` and `grill-with-docs` are rewritten to name AOS's
@@ -177,6 +179,58 @@ SOFTWARE.
 
 ---
 
+## Other vendored skills
+
+Skills in `skills/` that were derived from an external project record that
+project in their own `source:` frontmatter. Every upstream named there is
+listed below. Licences were verified against each repository's own `LICENSE`
+file via the GitHub API on 2026-09-12; where a copyright line is quoted, it is
+quoted verbatim from that file.
+
+| Upstream | Licence | Copyright | Skills in AOS |
+|---|---|---|---|
+| [bitjaru/styleseed](https://github.com/bitjaru/styleseed) | MIT | Copyright (c) 2026 StyleSeed Contributors | `ui-component`, `ui-page`, `ui-pattern`, `ui-review`, `ui-tokens`, `ux-audit`, `ux-feedback`, `ux-flow` |
+| [firecrawl/skills](https://github.com/firecrawl/skills) | ISC | Copyright (c) Firecrawl | `firecrawl-build-scrape`, `firecrawl-build-search`, `firecrawl-build-interact`, `firecrawl-build-onboarding` |
+| [Dimillian/Skills](https://github.com/Dimillian/Skills) | MIT | Copyright (c) 2026 Thomas Ricouard | `github`, `react-component-performance`, `simplify-code` |
+| [anthropics/skills](https://github.com/anthropics/skills) | Apache-2.0 (per-skill `LICENSE.txt`; the repo has no root licence) | Copyright 2026 Anthropic, PBC. | `webapp-testing`, `web-artifacts-builder` |
+| [AgriciDaniel/claude-seo](https://github.com/AgriciDaniel/claude-seo) | MIT | Copyright (c) 2026 agricidaniel | `seo`, `seo-technical` |
+| [neondatabase/agent-skills](https://github.com/neondatabase/agent-skills) | Apache-2.0 | template placeholder upstream; holder is Neon | `using-neon` |
+| [sanjay3290/ai-skills](https://github.com/sanjay3290/ai-skills) | Apache-2.0 | see upstream `LICENSE` | `deep-research`, `google-sheets-automation` |
+| [shadcn-ui/ui](https://github.com/shadcn-ui/ui) | MIT | Copyright (c) 2023 shadcn | `shadcn` |
+| [kepano/obsidian-skills](https://github.com/kepano/obsidian-skills) | MIT | Copyright (c) 2026 Steph Ango | `obsidian-markdown` |
+| [alirezarezvani/claude-skills](https://github.com/alirezarezvani/claude-skills) | MIT | Copyright (c) 2025 Alireza Rezvani | `senior-frontend`, `landing-page-generator` |
+| [playwright-community/playwright-go](https://github.com/playwright-community/playwright-go) | MIT | Copyright (c) 2020 Max Schmitt | `go-playwright` |
+| [wrsmith108/linear-claude-skill](https://github.com/wrsmith108/linear-claude-skill) | MIT | see upstream `LICENSE` | `linear-claude-skill` |
+| [langchain-ai/openwiki](https://github.com/langchain-ai/openwiki) | MIT | see upstream `LICENSE` | `openwiki-skill` |
+
+`webapp-testing` and `web-artifacts-builder` each ship upstream's own
+`LICENSE.txt` verbatim, as Apache-2.0 §4 requires. Note that `anthropics/skills`
+licenses its document skills (`docx`, `pdf`, `pptx`, `xlsx`) as
+**source-available, not open source** — neither skill vendored here comes from
+that set, and nothing from it may be vendored under this notice.
+
+Three further skills carry an in-tree provenance marker rather than a public
+upstream repository, recorded here so the claim is not lost:
+
+| Skill | Evidence in this repo |
+|---|---|
+| `react-best-practices` | `metadata.json` → `"organization": "Vercel Engineering"` |
+| `postgres-best-practices` | `metadata.json` → `"organization": "Supabase"` |
+| `playwright-skill` | `package.json` → `"author": "lackeyjb"`, `"license": "MIT"` |
+
+### Unresolved provenance
+
+These upstreams could not be cleared. They are recorded rather than hidden, and
+each needs a decision before the affected skills can be considered safely
+redistributable.
+
+| Upstream | Problem | Skills affected |
+|---|---|---|
+| `vibeforge1111/vibeship-spawner-skills` | Repository has **no `LICENSE` file**. Its README states "Apache 2.0", but a README statement is not a licence grant — absent a licence file the default is all rights reserved. | `agent-tool-builder`, `ai-product`, `browser-automation`, `crewai`, `neon-postgres`, `rag-engineer`, `vercel-deployment` |
+| `jackjin1997/ClawForge` | No `LICENSE` file; README claims MIT. | `clean-code` |
+| `CloudAI-X/threejs-skills` | No `LICENSE` file; README claims MIT. | `threejs-skills` |
+| `Shpigford/skills` | Repository returns **404** — deleted, renamed, or made private. Provenance cannot be verified at all. | `readme` |
+
 ## Note on `mcps/`
 
 Sub-repositories vendored under `mcps/` carry their own `LICENSE` files in

package/installer.js

@@ -2021,17 +2021,19 @@ function resolveTargetPaths(platformValue, customPaths) {
 }
 
 function getTierExcludeSkills(tier) {
+    // Matched against directory entry names by copyDirRecursiveSync, so these
+    // carry no extension: the MCP guides became <name>/SKILL.md directories.
     return tier === '2' ? [
-        'bdb-adobe-suite-mcp.md',
-        'bdb-after-effects-mcp.md',
-        'bdb-blender-mcp.md',
-        'bdb-davinci-mcp.md',
-        'bdb-grandma3-mcp.md',
-        'bdb-resolume-mcp.md',
-        'bdb-rhino-mcp.md',
-        'bdb-touchdesigner-mcp.md',
-        'bdb-unreal-mcp.md',
-        'bdb-vectorworks-mcp.md',
+        'bdb-adobe-suite-mcp',
+        'bdb-after-effects-mcp',
+        'bdb-blender-mcp',
+        'bdb-davinci-mcp',
+        'bdb-grandma3-mcp',
+        'bdb-resolume-mcp',
+        'bdb-rhino-mcp',
+        'bdb-touchdesigner-mcp',
+        'bdb-unreal-mcp',
+        'bdb-vectorworks-mcp',
         'bdbmediastorm'
     ] : [];
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hybridlabor-api/aos",
-  "version": "4.2.0",
+  "version": "4.3.0",
   "description": "AOS — A Curated AI AGENT OS. Optimized agent skills and add-ons like memB, OpenWiki, Heimdall Token Saver, and Godmode architectures.",
   "main": "installer.js",
   "bin": {
@@ -11,6 +11,11 @@
     "setup-saas": "bin/setup-saas.mjs",
     "aos-plan-canvas": "skills/global_config/plan-canvas/scripts/plan-canvas.js"
   },
+  "scripts": {
+    "validate": "node scripts/validate-skills.mjs",
+    "validate:strict": "node scripts/validate-skills.mjs --strict",
+    "test": "node scripts/validate-skills.mjs --selftest && node scripts/validate-skills.mjs"
+  },
   "publishConfig": {
     "access": "public"
   },