@hybridlabor-api/aos 4.2.0 → 4.4.0

package/skills/global_config/ask-tim/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: ask-tim
-description: Ask which skill or flow fits your situation. A route through AOS's skills for work that travels idea to ship, plus a catalogue of the ~169 available options for lookup. Use when unsure where to start, or when picking between overlapping choices.
+description: Ask which skill or flow fits your situation. A route through AOS's skills for work that travels idea to ship, plus a catalogue of the 185 available options for lookup. Use when unsure where to start, or when picking between overlapping choices.
 category: bdb-core
 disable-model-invocation: true
 ---
@@ -145,7 +145,7 @@ Use these skills for UI development, component architecture, and design taste.
 * **`zustand-store-ts`**: Client-side state stores with Zustand, typed and with middleware.
 * **`web-performance-optimization`**: Broader than component-level — Core Web Vitals, bundle size, caching across the whole app.
 * **`wcag-audit-patterns`**: Accessibility compliance auditing against WCAG 2.2, not general UX review.
-* **`senior-fullstack`** / **`frontend-dev-guidelines`**: General-purpose fullstack/frontend engineering standards when the task doesn't need a narrower skill above.
+* **`frontend-dev-guidelines`**: General-purpose frontend engineering standards when the task doesn't need a narrower skill above. For the backend half, `godmode-engineering` and `software-architecture`.
 * **`landing-page-generator`**: Specifically a high-converting marketing landing page (PAS/AIDA/BAB copy frameworks), not a general app page.
 
 ### Overlap: The UX Cluster
@@ -290,6 +290,8 @@ Use these for 3D, motion, video and live show control.
 * **Godmodes**: Determine the overarching flow (3D, Media, EventTech).
 * **Implementations**: `MCP_Manage` drives the creative applications over MCP, `spline-3d-integration` (web 3D), `threejs-skills` (WebGL), `remotion` (React → MP4, deterministic frame counts).
 
+* **Per-application MCP guides**: once `MCP_Manage` has told you *which* server to use, these document the tool surface of one application each — `bdb-touchdesigner-mcp`, `bdb-resolume-mcp`, `bdb-grandma3-mcp`, `bdb-davinci-mcp`, `bdb-adobe-suite-mcp`, `bdb-after-effects-mcp`, `bdb-blender-mcp`, `bdb-unreal-mcp`, `bdb-rhino-mcp`, `bdb-vectorworks-mcp`. Reach for one only when you already know the application; `MCP_Manage` is the way in.
+
 ### Which video route?
 
 The choice is driven by where the pixels come from, not by the output format — all four end in a video file.

package/skills/global_config/{bdb-adobe-suite-mcp.md → bdb-adobe-suite-mcp/SKILL.md}

@@ -1,6 +1,7 @@
 ---
 name: bdb-adobe-suite-mcp
 description: Utilizes the Adobe Suite MCP servers (adobe_mcp.py and adobe_uxp_mcp) to automate Photoshop, Illustrator, Premiere Pro, and After Effects using ExtendScript and UXP WebSocket bridges.
+category: media-eventtech
 ---
 
 # Adobe Creative Suite MCP — Integration and AI Guide

package/skills/global_config/{bdb-after-effects-mcp.md → bdb-after-effects-mcp/SKILL.md}

@@ -1,6 +1,7 @@
 ---
 name: bdb-after-effects-mcp
 description: Utilizes the After Effects MCP servers (after-effects-mcp and ae-mcp) to create compositions, layers, masks, keyframe animations, and run ExtendScript.
+category: media-eventtech
 ---
 
 # After Effects MCP — Integration and AI Agent Guide

package/skills/global_config/{bdb-blender-mcp.md → bdb-blender-mcp/SKILL.md}

@@ -1,6 +1,7 @@
 ---
 name: bdb-blender-mcp
 description: Utilizes the Blender MCP server and addon to build 3D assets, apply materials, inspect scenes, and script bpy.
+category: media-eventtech
 ---
 
 # Blender MCP — Integration and AI Agent Guide

package/skills/global_config/{bdb-computer-use-mcp.md → bdb-computer-use-mcp/SKILL.md}

@@ -1,6 +1,7 @@
 ---
 name: bdb-computer-use-mcp
 description: Utilizes native Rust/Node and Python-based computer-use-mcp servers to control macOS, Windows, and Linux desktops.
+category: engineering-method
 ---
 
 # Computer Use & OS Control MCP — Integration and AI Agent Guide

package/skills/global_config/{bdb-davinci-mcp.md → bdb-davinci-mcp/SKILL.md}

@@ -1,6 +1,7 @@
 ---
 name: bdb-davinci-mcp
 description: Utilizes the DaVinci Resolve MCP servers to control timeline editing, media analysis, color grading, and Fusion/Fairlight scripting.
+category: media-eventtech
 ---
 
 # DaVinci Resolve MCP — Integration and AI Agent Guide

package/skills/global_config/bdb-ecosystem-health/SKILL.md

@@ -36,7 +36,7 @@ Autonomous verification and remediation skill for maintaining 100% operational i
 
 ## Verification
 - [ ] Health check script `ecosystem-health-audit.js` run completed with exit code `0`.
-- [ ] HTML report generated and verifiable at `~/bdb-dev/marketing-intern/reports/ecosystem_health_latest.html`.
+- [ ] HTML report generated and verifiable at `production_artifacts/ecosystem_health_latest.html`.
 - [ ] Git working trees for all 8 repositories are clean.
 - [ ] NPM versions are fully synchronized with remote packages.
 
@@ -53,11 +53,11 @@ Autonomous verification and remediation skill for maintaining 100% operational i
 ## Automated Health Check Script
 Run the automated audit at any time:
 ```bash
-~/bdb-dev/scripts/ecosystem-health-audit.js
+scripts/ecosystem-health-audit.js
 ```
 
 ### Script Output:
-* **HTML Dashboard**: `~/bdb-dev/marketing-intern/reports/ecosystem_health_latest.html`
+* **HTML Dashboard**: `production_artifacts/ecosystem_health_latest.html`
 * **Browser Launch**: Automatically opens the report in Chrome / Default Browser.
 * **Exit Code**: Returns `0` if all healthy, `1` if attention/remediation is required.
 

package/skills/global_config/{bdb-grandma3-mcp.md → bdb-grandma3-mcp/SKILL.md}

@@ -1,6 +1,7 @@
 ---
 name: bdb-grandma3-mcp
 description: Utilizes the grandMA3 MCP server to patch fixtures, execute console commands, and trigger macros via OSC.
+category: media-eventtech
 ---
 
 # grandMA3 MCP — Integration and AI Agent Guide

package/skills/global_config/{bdb-memb-mcp.md → bdb-memb-mcp/SKILL.md}

@@ -1,3 +1,13 @@
+---
+name: bdb-memb-mcp
+description: >-
+  Model Context Protocol interface to the memB persistent agent memory layer.
+  Use when an agent needs to add, search, list or delete persistent memories
+  locally and offline. Exposes add_memory, search_memory, list_memories and
+  delete_memory.
+category: bdb-core
+---
+
 # BDB memB Persistent Memory MCP Server
 
 The `memb-mcp` server provides a standard Model Context Protocol (MCP) interface to the **memB** persistent agent memory layer. It allows any compatible developer agent (such as Cursor, Google Antigravity, Claude Code, or VS Code Cline) to read, write, and query persistent memories locally and offline.

package/skills/global_config/{bdb-resolume-mcp.md → bdb-resolume-mcp/SKILL.md}

@@ -1,6 +1,7 @@
 ---
 name: bdb-resolume-mcp
 description: Utilizes the Resolume Arena MCP server to trigger clips, clear layers, adjust speeds, and query composition status via the Resolume REST API.
+category: media-eventtech
 ---
 
 # Resolume Arena MCP — Integration and AI Agent Guide

package/skills/global_config/{bdb-rhino-mcp.md → bdb-rhino-mcp/SKILL.md}

@@ -1,6 +1,7 @@
 ---
 name: bdb-rhino-mcp
 description: Utilizes the Rhino MCP servers (RhinoMCP and golem-rhino-mcp) to create and manipulate 3D models and run Grasshopper graphs.
+category: media-eventtech
 ---
 
 # Rhino 3D MCP — Integration and AI Agent Guide

package/skills/global_config/{bdb-touchdesigner-mcp.md → bdb-touchdesigner-mcp/SKILL.md}

@@ -1,6 +1,7 @@
 ---
 name: bdb-touchdesigner-mcp
 description: Utilizes the TouchDesigner MCP servers (tdmcp and touchdesigner-mcp) to create TOP/CHOP chains, script operators, inspect parameters, and debug node networks.
+category: media-eventtech
 ---
 
 # TouchDesigner MCP — Integration and AI Agent Guide

package/skills/global_config/{bdb-unreal-mcp.md → bdb-unreal-mcp/SKILL.md}

@@ -1,6 +1,7 @@
 ---
 name: bdb-unreal-mcp
 description: Utilizes the Unreal Engine MCP server to control UE5 via a native C++ Automation Bridge plugin.
+category: media-eventtech
 ---
 
 # Unreal Engine MCP — Integration and AI Agent Guide

package/skills/global_config/{bdb-vectorworks-mcp.md → bdb-vectorworks-mcp/SKILL.md}

@@ -1,6 +1,7 @@
 ---
 name: bdb-vectorworks-mcp
 description: Utilizes the Vectorworks RAG + MCP server to search and retrieve Python and VectorScript API documentation.
+category: media-eventtech
 ---
 
 # Vectorworks RAG MCP — Integration and AI Agent Guide

package/skills/global_config/bdbsaashost/SKILL.md

@@ -9,7 +9,7 @@ date_added: "2026-08-27"
 
 # 🚀 BDB SaaS Host - Master Fleet & AI-Agent Operations Skill (`/bdbsaashost`)
 
-Du bist der autoritative **BDB SaaS Host Operator**. Du verstehst die standardisierte Multi-Cloud-Architektur (Primary Compute Node, GCP Identity Hub, Oracle Auxiliary) und steuerst die Infrastruktur dynamisch über das **FastMCP Remote Gateway** sowie die **Zero-Trust SSH Guardrails** (`agent-sudo`).
+You are the authoritative **BDB SaaS Host Operator**. You understand the standardized Multi-Cloud architecture (Primary Compute Node, GCP Identity Hub, Oracle Auxiliary) and operate the infrastructure dynamically via the **FastMCP Remote Gateway** and the **Zero-Trust SSH Guardrails** (`agent-sudo`).
 
 ---
 
@@ -47,79 +47,79 @@ Master operational skill for the BDB Multi-Cloud Fleet, governing interactions w
 
 ## 🌐 1. Multi-Cloud Fleet Reference Architecture
 
-Die Endpunkte werden **dynamisch** aus der lokalen Projekt-Konfiguration (`.env`, `~/.gemini/antigravity-cli/mcp/` oder `config.json`) bezogen:
+Endpoints are resolved **dynamically** from the local project configuration (`.env`, `~/.gemini/antigravity-cli/mcp/`, or `config.json`):
 
-| Komponente | Referenz / Standard-Port | Zweck & Services |
+| Component | Reference / Standard Port | Purpose & Services |
 | :--- | :--- | :--- |
 | **Primary Compute Node** | `NETCUP_IP` / `PRIMARY_HOST` | Incus System-Container, Staging/Production Apps, WordPress, Froxlor, Caddy Proxy, FastMCP Gateway, AI Agent Sandboxes |
 | **Identity Hub** | `GCP_IP` / `IDENTITY_HOST` | LLDAP Directory (`:3890`, `:17170`), Authelia 2FA / Passkeys / WebAuthn SSO (`:9091`), Step-CA (SSH CA `:9000`), Uptime Kuma |
 | **Auxiliary Services** | `ORACLE_IP` / `AUX_HOST` | Background Job Queues (BullMQ), PostgreSQL Replicas, Media Engines |
-| **FastMCP Gateway (Machine API)** | `https://api.<PROJECT_DOMAIN>/tools/*` | REST-Endpunkte für autonome Agenten (OIDC Bearer Auth) |
-| **Human Approval Dashboard** | `https://gateway.<PROJECT_DOMAIN>/approvals` | 4-Augen-Freigabe-Dashboard für mutierende/gefährliche Aktionen und `agent-sudo` |
-| **Identity & SSO Portal** | `https://auth.<PROJECT_DOMAIN>` | Zentrales Authelia 2FA Login-Portal |
-| **Status Page** | `https://status.<PROJECT_DOMAIN>/status/services` | Öffentliche 24/7 Uptime Kuma Monitoring Statusseite |
+| **FastMCP Gateway (Machine API)** | `https://api.<PROJECT_DOMAIN>/tools/*` | REST endpoints for autonomous agents (OIDC Bearer Auth) |
+| **Human Approval Dashboard** | `https://gateway.<PROJECT_DOMAIN>/approvals` | Four-eyes approval dashboard for mutating/dangerous actions and `agent-sudo` |
+| **Identity & SSO Portal** | `https://auth.<PROJECT_DOMAIN>` | Central Authelia 2FA login portal |
+| **Status Page** | `https://status.<PROJECT_DOMAIN>/status/services` | Public 24/7 Uptime Kuma monitoring status page |
 
-> **Dynamische Parameter-Ermittlung:**  
-> Lies vor der Ausführung die aktiven Host-Adressen und Domains aus der lokalen Konfiguration (`~/.gemini/antigravity-cli/mcp/bdb_remoteos_gateway/config.json`, `.env` oder `~/.ssh/config`).
+> **Dynamic Parameter Resolution:**  
+> Before execution, read the active host addresses and domains from the local configuration (`~/.gemini/antigravity-cli/mcp/bdb_remoteos_gateway/config.json`, `.env`, or `~/.ssh/config`).
 
 ---
 
-## 🔐 2. Authentifizierung & Verbindungsaufbau (Zero-Key-Philosophy)
+## 🔐 2. Authentication & Connection Handshake (Zero-Key Philosophy)
 
-> **Single Source of Truth.** Diese Sektion ist die einzige normative Quelle für Auth-Fakten im BDB-Ökosystem — `AGENTS.md`, `bdbsaastraining/SKILL.md` und andere Skills zitieren sie, statt sie zu wiederholen (siehe `production_artifacts/00_execution_plan.md`, Finding B-4/Item B4).
+> **Single Source of Truth.** This section is the sole normative source for authentication facts in the BDB ecosystem — `AGENTS.md`, `bdbsaastraining/SKILL.md`, and other skills reference it instead of repeating it.
 
-Verlange vom Nutzer **NIEMALS** manuelle API-Keys oder statische Passwörter. Das BDB-System nutzt automatisierte Zero-Trust-Handshakes:
+**NEVER** ask the user for manual API keys or static passwords. The BDB system uses automated Zero-Trust handshakes:
 
-1. **In Antigravity / Cursor IDE (Lokale Workstation):**
-   * Das FastMCP-Gateway wird über `node bin/setup-workstation.mjs` (Browser-2FA via Authelia) automatisch angebunden.
-   * Das aktive Token liegt lokal in `~/.gemini/antigravity-cli/mcp/bdb_remoteos_gateway/config.json`.
-   * **Aktion:** Nutze direkt die bereitgestellten MCP-Tools (`remoteos_...`), ohne den Nutzer nach Verbindungsparametern zu fragen!
+1. **In Antigravity / Cursor IDE (Local Workstation):**
+   * The FastMCP Gateway is automatically wired via `node bin/setup-workstation.mjs` (Browser 2FA via Authelia).
+   * The active token lies locally in `~/.gemini/antigravity-cli/mcp/bdb_remoteos_gateway/config.json`.
+   * **Action:** Use the supplied MCP tools (`remoteos_...`) directly without asking the user for connection parameters!
 
-2. **Auf dem Linux-Server via SSH:**
-   * **Menschliche Admins:** Authentifizieren sich per `step ssh login <user>` (Authelia WebAuthn 2FA, 16h Ephemeral Certificates) und haben normales `sudo`.
-   * **Autonome KI-Agenten (`ai_agents`):** Beziehen per RFC 7523 / RFC 9068 `private_key_jwt` ein kurzlebiges OIDC Access Token von Authelia (`https://auth.<PROJECT_DOMAIN>/api/oidc/token`) unter Nutzung ihres im OS Keychain hinterlegten RSA-Schlüssels und rufen die Machine API (`https://api.<PROJECT_DOMAIN>/tools/*`) mit `Authorization: Bearer <token>` auf.
-   * **Privilegierte Befehle auf dem Server:** Müssen zwingend mit `agent-sudo <command>` ausgeführt werden.
+2. **On the Linux Server via SSH:**
+   * **Human Admins:** Authenticate via `step ssh login <user>` (Authelia WebAuthn 2FA, 16h ephemeral certificates) and have standard `sudo`.
+   * **Autonomous AI Agents (`ai_agents`):** Obtain per RFC 7523 / RFC 9068 a short-lived OIDC access token via `private_key_jwt` from Authelia (`https://auth.<PROJECT_DOMAIN>/api/oidc/token`) using their RSA key stored in the OS keychain, and call the Machine API (`https://api.<PROJECT_DOMAIN>/tools/*`) with `Authorization: Bearer <token>`.
+   * **Privileged Commands on the Server:** **MUST** be executed with `agent-sudo <command>`, without exception.
 
 ---
 
-## 🛠️ 3. Die FastMCP Werkzeugkiste (Tool-Übersicht)
+## 🛠️ 3. The FastMCP Toolkit (Tool Overview)
 
-Nutze für Cluster-Aufgaben direkt diese Tools:
+Use these tools directly for cluster tasks:
 
-| Tool-Name | Zweck & Funktionsweise | Guardrail-Verhalten |
+| Tool Name | Purpose & Function | Guardrail Behavior |
 | :--- | :--- | :--- |
-| `remoteos_get_system_status` | Fragt den Live-Status aller Nodes, Incus-Container & Cloudflare-DNS ab. | Sofortige Ausführung |
-| `remoteos_create_instance` | Erstellt einen neuen Incus System-Container (Froxlor, WordPress, AI-Agent-Sandbox) mit automatischem DNS/Caddy Setup. | `staging1`: Sofort / `production`: 4-Augen-Freigabe |
-| `remoteos_manage_instance` | Lifecycle-Steuerung (start, stop, restart, delete). | `start/stop`: Sofort / `restart/delete`: 4-Augen-Freigabe |
-| `remoteos_add_route` | Richtet Caddy Reverse-Proxy Routen mit Authelia 2FA und Cloudflare DNS-Sync ein. | Sofortige Ausführung |
-| `remoteos_get_dns_blueprint` | Generiert RFC-konforme DNS-Pakete (A, MX, SPF, DKIM, DMARC) für Kunden-Domains. | Sofortige Ausführung |
-| `create_lldap_user` | Erstellt echte Accounts in LLDAP (`admins`, `users`, `ai_agents`) und verknüpft Agenten permanent mit ihrem `owner`. | Sofortige Ausführung (Background-Worker versendet Mails für Menschen) |
+| `remoteos_get_system_status` | Queries the live status of all nodes, Incus containers, and Cloudflare DNS. | Immediate execution |
+| `remoteos_create_instance` | Creates a new Incus system container (Froxlor, WordPress, AI-Agent sandbox) with automatic DNS/Caddy setup. | `staging1`: Immediate / `production`: four-eyes approval |
+| `remoteos_manage_instance` | Lifecycle control (start, stop, restart, delete). | `start/stop`: Immediate / `restart/delete`: four-eyes approval |
+| `remoteos_add_route` | Sets up Caddy reverse-proxy routes with Authelia 2FA and Cloudflare DNS sync. | Immediate execution |
+| `remoteos_get_dns_blueprint` | Generates RFC-compliant DNS packets (A, MX, SPF, DKIM, DMARC) for customer domains. | Immediate execution |
+| `create_lldap_user` | Creates real accounts in LLDAP (`admins`, `users`, `ai_agents`) and permanently links agents to their `owner`. | Immediate execution (background worker sends emails for humans) |
 
 ---
 
-## 🛡️ 4. Das 4-Augen-Prinzip & `agent-sudo` (SSH-Ebene)
+## 🛡️ 4. The Four-Eyes Principle & `agent-sudo` (SSH Layer)
 
-Wenn ein Befehl oder ein MCP-Tool die Guardrails triggert:
+When a command or MCP tool triggers the guardrails:
 
-1. **Auto-Approve (Sichere Befehle):**
-   * Befehle wie `ls`, `cat`, `grep`, `pwd`, `whoami` werden von `agent-sudo` in Millisekunden **automatisch genehmigt und als Root ausgeführt**.
-2. **Manuelle Freigabe (Kritische Befehle):**
-   * Befehle wie `docker`, `systemctl`, `rm`, `apt`, `incus` werden in die `queue.db` eingereiht.
-   * Das Terminal blockiert ("*Warte auf Freigabe...*").
-   * Der Besitzer (`owner`) erhält einen Push auf sein Dashboard: `https://gateway.<PROJECT_DOMAIN>/approvals`.
-   * Nach dem Klick auf **Approve** führt der `agent-execution-daemon` den Befehl als `root` aus und liefert das Ergebnis in die Shell zurück.
+1. **Auto-Approve (Safe Commands):**
+   * Commands like `ls`, `cat`, `grep`, `pwd`, `whoami` are **automatically approved and executed as root** by `agent-sudo` in milliseconds.
+2. **Manual Approval (Critical Commands):**
+   * Commands like `docker`, `systemctl`, `rm`, `apt`, `incus` are queued into `queue.db`.
+   * The terminal blocks (*"Waiting for approval..."*).
+   * The owner (`owner`) receives a push to their dashboard: `https://gateway.<PROJECT_DOMAIN>/approvals`.
+   * After clicking **Approve**, the `agent-execution-daemon` executes the command as `root` and returns the result to the shell.
 
 ---
 
-## 📋 5. Standard-Reaktionsmuster
-
-* **Wenn der Nutzer fragt:** *"Wie verbinde ich mich mit dem Cluster?"*
-  $\rightarrow$ Erkläre, dass die MCP-Tools bereits aktiv sind, führe direkt `remoteos_get_system_status` aus und zeige die Cluster-Übersicht.
-* **Wenn der Nutzer fragt:** *"Lege einen neuen Agenten an"*
-  $\rightarrow$ Rufe `create_lldap_user(username="agent-...", group="ai_agents", owner="<AKTUELLER_ADMIN>")` auf. Nach erfolgreicher Ausführung antworte: *"Der Benutzer wurde in LLDAP angelegt. Der Background-Worker versendet nun automatisch die Setup-E-Mails."* Versuche NIEMALS selbst, E-Mails zu schreiben, SMTP-Befehle auszuführen oder Passwörter zu generieren — der Background-Worker erledigt das vollautomatisch.
-* **Wenn ein SSH-Befehl über `agent-sudo` blockiert wird (kritischer Befehl, `queue.db`):**
-  $\rightarrow$ Informiere den Nutzer: *"Diese Aktion erfordert eine 4-Augen-Freigabe. Bitte bestätige sie im Approval-Dashboard."*
-* **Wenn ein FastMCP-Tool-Aufruf (z. B. `incus_create_instance`, `incus_manage_instance`) mit `{"status": "queued", ...}` blockiert wird, weil du der LDAP-Gruppe `ai_agents` angehörst:**
-  $\rightarrow$ Mache KEINEN Retry und versuche nicht, den Fehler selbst zu beheben. Informiere den Nutzer **exakt so**: *"Meine Anfrage wurde durch die Guardrails blockiert. Bitte gib die Anfrage hier frei: [https://gateway.<PROJECT_DOMAIN>/approvals](https://gateway.<PROJECT_DOMAIN>/approvals)"*
-* **Wenn der Nutzer fragt:** *"Zeig mir ausstehende Anfragen"* oder *"Checke die Freigaben"*
-  $\rightarrow$ **`get_pending_approvals` wurde stillgelegt (A9, 2026-09-06)** — ein Maschinen-Tool, das die Freigabe-Queue lesen kann, untergräbt das Vier-Augen-Prinzip strukturell. Verweise den Nutzer direkt auf das Dashboard: *"Offene Freigaben siehst du direkt hier: https://gateway.\<PROJECT_DOMAIN\>/approvals"*
+## 📋 5. Standard Response Patterns
+
+* **When the user asks:** *"How do I connect to the cluster?"*
+  $\rightarrow$ Explain that the MCP tools are already active, run `remoteos_get_system_status` directly, and show the cluster overview.
+* **When the user asks:** *"Create a new agent"*
+  $\rightarrow$ Call `create_lldap_user(username="agent-...", group="ai_agents", owner="<CURRENT_ADMIN>")`. After successful execution, reply: *"The user has been created in LLDAP. The background worker now sends the setup emails automatically."* **NEVER** attempt to write emails yourself, execute SMTP commands, or generate passwords — the background worker handles this entirely automatically.
+* **When an SSH command via `agent-sudo` is blocked (critical command, `queue.db`):**
+  $\rightarrow$ Inform the user: *"This action requires four-eyes approval. Please confirm it in the Approval Dashboard."*
+* **When a FastMCP tool call (e.g. `incus_create_instance`, `incus_manage_instance`) is blocked with `{"status": "queued", ...}` because you belong to the LDAP group `ai_agents`:**
+  $\rightarrow$ Do NOT retry and do not attempt to fix the error yourself. Inform the user **exactly as follows**: *"My request was blocked by the guardrails. Please approve it here: [https://gateway.<PROJECT_DOMAIN>/approvals](https://gateway.<PROJECT_DOMAIN>/approvals)"*
+* **When the user asks:** *"Show me pending requests"* or *"Check the approvals"*
+  $\rightarrow$ **`get_pending_approvals` was decommissioned (A9, 2026-09-06)** — a machine tool that could read the approval queue would structurally undermine the four-eyes principle. Direct the user to the dashboard: *"You can see pending approvals here: https://gateway.\<PROJECT_DOMAIN\>/approvals"*

package/skills/global_config/browser-automation/SKILL.md

@@ -1,10 +1,10 @@
 ---
 name: browser-automation
-description: Browser automation powers web testing, scraping, and AI agent
+description: >-
+  Browser automation powers web testing, scraping, and AI agent interactions.
+  The difference between a flaky script and a reliable system comes down to
+  understanding selectors, waiting strategies, and anti-detection patterns.
 category: library
-  interactions. The difference between a flaky script and a reliable system
-  comes down to understanding selectors, waiting strategies, and anti-detection
-  patterns.
 risk: unknown
 source: vibeship-spawner-skills (Apache 2.0)
 date_added: 2026-02-27

package/skills/global_config/crewai/SKILL.md

@@ -1,8 +1,9 @@
 ---
 name: crewai
-description: Expert in CrewAI - the leading role-based multi-agent framework
+description: >-
+  Expert in CrewAI - the leading role-based multi-agent framework used by 60%
+  of Fortune 500 companies.
 category: library
-  used by 60% of Fortune 500 companies.
 risk: unknown
 source: vibeship-spawner-skills (Apache 2.0)
 date_added: 2026-02-27

package/skills/global_config/debugger/SKILL.md

@@ -1,11 +1,9 @@
 ---
 name: debugger
-description: 'Debugging specialist for errors, test failures, and unexpected
+description: >-
+  Debugging specialist for errors, test failures, and unexpected behavior.
+  Use proactively when encountering any issues.
 category: library
-
-  behavior. Use proactively when encountering any issues.
-
-  '
 risk: safe
 source: community
 date_added: '2026-02-27'
@@ -26,7 +24,6 @@ date_added: '2026-02-27'
 - Clarify goals, constraints, and required inputs.
 - Apply relevant best practices and validate outcomes.
 - Provide actionable steps and verification.
-- If detailed examples are required, open `resources/implementation-playbook.md`.
 
 You are an expert debugger specializing in root cause analysis.
 

package/skills/global_config/git-advanced-workflows/SKILL.md

@@ -21,7 +21,6 @@ Master advanced Git techniques to maintain clean history, collaborate effectivel
 - Clarify goals, constraints, and required inputs.
 - Apply relevant best practices and validate outcomes.
 - Provide actionable steps and verification.
-- If detailed examples are required, open `resources/implementation-playbook.md`.
 
 ## Use this skill when
 

package/skills/global_config/github-actions-templates/SKILL.md

@@ -21,7 +21,6 @@ Production-ready GitHub Actions workflow patterns for testing, building, and dep
 - Clarify goals, constraints, and required inputs.
 - Apply relevant best practices and validate outcomes.
 - Provide actionable steps and verification.
-- If detailed examples are required, open `resources/implementation-playbook.md`.
 
 ## Purpose
 
@@ -340,7 +339,6 @@ jobs:
 - `assets/test-workflow.yml` - Testing workflow template
 - `assets/deploy-workflow.yml` - Deployment workflow template
 - `assets/matrix-build.yml` - Matrix build template
-- `references/common-workflows.md` - Common workflow patterns
 
 ## Related Skills
 

package/skills/global_config/neon-postgres/SKILL.md

@@ -1,8 +1,9 @@
 ---
 name: neon-postgres
-description: Expert patterns for Neon serverless Postgres, branching, connection
+description: >-
+  Expert patterns for Neon serverless Postgres, branching, connection pooling,
+  and Prisma/Drizzle integration
 category: library
-  pooling, and Prisma/Drizzle integration
 risk: safe
 source: vibeship-spawner-skills (Apache 2.0)
 date_added: 2026-02-27

package/skills/global_config/playwright-skill/SKILL.md

@@ -3,7 +3,7 @@ name: playwright-skill
 description: General-purpose browser automation skill. Use when a task needs custom Playwright code — end-to-end testing, scraping a JS-rendered page, or driving a browser interactively — executed via this skill's universal executor rather than a one-off script.
 category: library
 risk: unknown
-source: community
+source: lackeyjb (MIT)
 date_added: "2026-02-27"
 plugin:
   setup:

package/skills/global_config/posix-shell-pro/SKILL.md

@@ -22,7 +22,6 @@ date_added: '2026-02-27'
 - Clarify goals, constraints, and required inputs.
 - Apply relevant best practices and validate outcomes.
 - Provide actionable steps and verification.
-- If detailed examples are required, open `resources/implementation-playbook.md`.
 
 ## Focus Areas
 

package/skills/global_config/postgres-best-practices/SKILL.md

@@ -3,7 +3,7 @@ name: postgres-best-practices
 description: "Postgres performance optimization and best practices from Supabase. Use this skill when writing, reviewing, or optimizing Postgres queries, schema designs, or database configurations."
 category: library
 risk: safe
-source: community
+source: Supabase
 date_added: "2026-02-27"
 ---
 

package/skills/global_config/prompt-engineering-patterns/SKILL.md

@@ -21,7 +21,6 @@ Master advanced prompt engineering techniques to maximize LLM performance, relia
 - Clarify goals, constraints, and required inputs.
 - Apply relevant best practices and validate outcomes.
 - Provide actionable steps and verification.
-- If detailed examples are required, open `resources/implementation-playbook.md`.
 
 ## Use this skill when
 

package/skills/global_config/rag-engineer/SKILL.md

@@ -1,9 +1,10 @@
 ---
 name: rag-engineer
-description: Expert in building Retrieval-Augmented Generation systems. Masters
+description: >-
+  Expert in building Retrieval-Augmented Generation systems. Masters embedding
+  models, vector databases, chunking strategies, and retrieval optimization for
+  LLM applications.
 category: library
-  embedding models, vector databases, chunking strategies, and retrieval
-  optimization for LLM applications.
 risk: unknown
 source: vibeship-spawner-skills (Apache 2.0)
 date_added: 2026-02-27

package/skills/global_config/react-best-practices/SKILL.md

@@ -3,7 +3,7 @@ name: react-best-practices
 description: "Comprehensive performance optimization guide for React and Next.js applications, maintained by Vercel. Use when writing new React components or Next.js pages, implementing data fetching (client or server-side), or reviewing code for performance issues."
 category: library
 risk: safe
-source: community
+source: Vercel Engineering
 date_added: "2026-02-27"
 ---
 

package/skills/global_config/remotion/SKILL.md

@@ -192,7 +192,6 @@ Create the video components following Remotion best practices:
 
 **Reference Resources:**
 - Use `resources/screen-slide-template.tsx` as starting point
-- Follow `resources/composition-checklist.md` for completeness
 - Review examples in `examples/walkthrough/` directory
 
 ### Step 3: Preview and Refine

package/skills/global_config/seo/SKILL.md

@@ -12,8 +12,7 @@ argument-hint: "[command] [url]"
 # SEO: Universal SEO Analysis Skill
 
 Comprehensive SEO analysis across all industries (SaaS, local services,
-e-commerce, publishers, agencies). Orchestrates 12 specialized sub-skills and 7 subagents
-(+ optional extension sub-skills like seo-dataforseo).
+e-commerce, publishers, agencies). Orchestrates 2 specialized sub-skills.
 
 ## When to Use
 - Use when the user asks for a full SEO audit or broad SEO strategy.
@@ -25,30 +24,16 @@ e-commerce, publishers, agencies). Orchestrates 12 specialized sub-skills and 7
 | Command | What it does |
 |---------|-------------|
 | `/seo audit <url>` | Full website audit with parallel subagent delegation |
-| `/seo page <url>` | Deep single-page analysis |
-| `/seo sitemap <url or generate>` | Analyze or generate XML sitemaps |
-| `/seo schema <url>` | Detect, validate, and generate Schema.org markup |
-| `/seo images <url>` | Image optimization analysis |
 | `/seo technical <url>` | Technical SEO audit (9 categories) |
-| `/seo content <url>` | E-E-A-T and content quality analysis |
-| `/seo geo <url>` | AI Overviews / Generative Engine Optimization |
-| `/seo plan <business-type>` | Strategic SEO planning |
-| `/seo programmatic [url\|plan]` | Programmatic SEO analysis and planning |
-| `/seo competitor-pages [url\|generate]` | Competitor comparison page generation |
-| `/seo hreflang [url]` | Hreflang/i18n SEO audit and generation |
-| `/seo dataforseo [command]` | Live SEO data via DataForSEO (extension) |
-| `/seo image-gen [use-case] <description>` | AI image generation for SEO assets (extension) |
 
 ## Orchestration Logic
 
-When the user invokes `/seo audit`, delegate to subagents in parallel:
+When the user invokes `/seo audit`, delegate to subagents:
 1. Detect business type (SaaS, local, ecommerce, publisher, agency, other)
-2. Spawn subagents: seo-technical, seo-content, seo-schema, seo-sitemap, seo-performance, seo-visual, seo-geo
+2. Spawn subagent: seo-technical for technical SEO analysis
 3. Collect results and generate unified report with SEO Health Score (0-100)
 4. Create prioritized action plan (Critical -> High -> Medium -> Low)
 
-For individual commands, load the relevant sub-skill directly.
-
 ## Industry Detection
 
 Detect business type from homepage signals:
@@ -99,35 +84,15 @@ Weighted aggregate of all categories:
 
 ## Sub-Skills
 
-This skill orchestrates 12 specialized sub-skills (+ 2 extensions):
+This skill orchestrates 2 specialized sub-skills:
 
 1. **seo-audit** -- Full website audit with parallel delegation
-2. **seo-page** -- Deep single-page analysis
-3. **seo-technical** -- Technical SEO (9 categories)
-4. **seo-content** -- E-E-A-T and content quality
-5. **seo-schema** -- Schema markup detection and generation
-6. **seo-images** -- Image optimization
-7. **seo-sitemap** -- Sitemap analysis and generation
-8. **seo-geo** -- AI Overviews / GEO optimization
-9. **seo-plan** -- Strategic planning with templates
-10. **seo-programmatic** -- Programmatic SEO analysis and planning
-11. **seo-competitor-pages** -- Competitor comparison page generation
-12. **seo-hreflang** -- Hreflang/i18n SEO audit and generation
-13. **seo-dataforseo** -- Live SEO data via DataForSEO MCP (extension)
-14. **seo-image-gen** -- AI image generation for SEO assets via Gemini (extension)
+2. **seo-technical** -- Technical SEO (9 categories)
 
 ## Subagents
 
-For parallel analysis during audits:
+For analysis during audits:
 - `seo-technical` -- Crawlability, indexability, security, CWV
-- `seo-content` -- E-E-A-T, readability, thin content
-- `seo-schema` -- Detection, validation, generation
-- `seo-sitemap` -- Structure, coverage, quality gates
-- `seo-performance` -- Core Web Vitals measurement
-- `seo-visual` -- Screenshots, mobile testing, above-fold
-- `seo-geo` -- AI crawler access, llms.txt, citability, brand mention signals
-- `seo-dataforseo` -- Live SERP, keyword, backlink, local SEO data (extension, optional)
-- `seo-image-gen` -- SEO image audit and generation plan (extension, optional)
 
 ## Error Handling
 

package/skills/global_config/systematic-debugging/CREATION-LOG.md

@@ -4,7 +4,7 @@ Reference example of extracting, structuring, and bulletproofing a critical skil
 
 ## Source Material
 
-Extracted debugging framework from `/Users/jesse/.claude/CLAUDE.md`:
+Extracted debugging framework from `~/.claude/CLAUDE.md`:
 - 4-phase systematic process (Investigation → Pattern Analysis → Hypothesis → Implementation)
 - Core mandate: ALWAYS find root cause, NEVER fix symptoms
 - Rules designed to resist time pressure and rationalization

package/skills/global_config/systematic-debugging/root-cause-tracing.md

@@ -33,7 +33,7 @@ digraph when_to_use {
 
 ### 1. Observe the Symptom
 ```
-Error: git init failed in /Users/jesse/project/packages/core
+Error: git init failed in ~/project/packages/core
 ```
 
 ### 2. Find Immediate Cause

package/skills/global_config/turborepo-caching/SKILL.md

@@ -21,7 +21,6 @@ Production patterns for Turborepo build optimization.
 - Clarify goals, constraints, and required inputs.
 - Apply relevant best practices and validate outcomes.
 - Provide actionable steps and verification.
-- If detailed examples are required, open `resources/implementation-playbook.md`.
 
 ## Use this skill when