@ikon85/agent-workflow-kit 0.10.0

package/.agents/skills/codebase-design/SKILL.md

@@ -0,0 +1,114 @@
+---
+name: codebase-design
+description: "Shared vocabulary for designing deep modules. Use when the user wants to design or improve a module's interface, find deepening opportunities, decide where a seam goes, make code more testable or AI-navigable, or when another skill needs the deep-module vocabulary."
+---
+
+# Codebase Design
+
+Design **deep modules**: a lot of behaviour behind a small interface, placed at a clean seam, testable through that interface. Use this language and these principles wherever code is being designed or restructured. The aim is leverage for callers, locality for maintainers, and testability for everyone.
+
+## Glossary
+
+Use these terms exactly — don't substitute "component," "service," "API," or "boundary." Consistent language is the whole point.
+
+**Module** — anything with an interface and an implementation. Deliberately scale-agnostic: a function, class, package, or tier-spanning slice. _Avoid_: unit, component, service.
+
+**Interface** — everything a caller must know to use the module correctly: the type signature, but also invariants, ordering constraints, error modes, required configuration, and performance characteristics. _Avoid_: API, signature (too narrow — they refer only to the type-level surface).
+
+**Implementation** — what's inside a module, its body of code. Distinct from **Adapter**: a thing can be a small adapter with a large implementation (a Postgres repo) or a large adapter with a small implementation (an in-memory fake). Reach for "adapter" when the seam is the topic; "implementation" otherwise.
+
+**Depth** — leverage at the interface: the amount of behaviour a caller (or test) can exercise per unit of interface they have to learn. A module is **deep** when a large amount of behaviour sits behind a small interface, **shallow** when the interface is nearly as complex as the implementation.
+
+**Seam** _(Michael Feathers)_ — a place where you can alter behaviour without editing in that place; the *location* at which a module's interface lives. Where to put the seam is its own design decision, distinct from what goes behind it. _Avoid_: boundary (overloaded with DDD's bounded context).
+
+**Adapter** — a concrete thing that satisfies an interface at a seam. Describes *role* (what slot it fills), not substance (what's inside).
+
+**Leverage** — what callers get from depth: more capability per unit of interface they learn. One implementation pays back across N call sites and M tests.
+
+**Locality** — what maintainers get from depth: change, bugs, knowledge, and verification concentrate in one place rather than spreading across callers. Fix once, fixed everywhere.
+
+## Deep vs shallow
+
+**Deep module** = small interface + lots of implementation:
+
+```
+┌─────────────────────┐
+│   Small Interface   │  ← Few methods, simple params
+├─────────────────────┤
+│                     │
+│  Deep Implementation│  ← Complex logic hidden
+│                     │
+└─────────────────────┘
+```
+
+**Shallow module** = large interface + little implementation (avoid):
+
+```
+┌─────────────────────────────────┐
+│       Large Interface           │  ← Many methods, complex params
+├─────────────────────────────────┤
+│  Thin Implementation            │  ← Just passes through
+└─────────────────────────────────┘
+```
+
+When designing an interface, ask:
+
+- Can I reduce the number of methods?
+- Can I simplify the parameters?
+- Can I hide more complexity inside?
+
+## Principles
+
+- **Depth is a property of the interface, not the implementation.** A deep module can be internally composed of small, mockable, swappable parts — they just aren't part of the interface. A module can have **internal seams** (private to its implementation, used by its own tests) as well as the **external seam** at its interface.
+- **The deletion test.** Imagine deleting the module. If complexity vanishes, it was a pass-through. If complexity reappears across N callers, it was earning its keep.
+- **The interface is the test surface.** Callers and tests cross the same seam. If you want to test *past* the interface, the module is probably the wrong shape.
+- **One adapter means a hypothetical seam. Two adapters means a real one.** Don't introduce a seam unless something actually varies across it.
+
+## Designing for testability
+
+Good interfaces make testing natural:
+
+1. **Accept dependencies, don't create them.**
+
+   ```typescript
+   // Testable
+   function processOrder(order, paymentGateway) {}
+
+   // Hard to test
+   function processOrder(order) {
+     const gateway = new StripeGateway();
+   }
+   ```
+
+2. **Return results, don't produce side effects.**
+
+   ```typescript
+   // Testable
+   function calculateDiscount(cart): Discount {}
+
+   // Hard to test
+   function applyDiscount(cart): void {
+     cart.total -= discount;
+   }
+   ```
+
+3. **Small surface area.** Fewer methods = fewer tests needed. Fewer params = simpler test setup.
+
+## Relationships
+
+- A **Module** has exactly one **Interface** (the surface it presents to callers and tests).
+- **Depth** is a property of a **Module**, measured against its **Interface**.
+- A **Seam** is where a **Module**'s **Interface** lives.
+- An **Adapter** sits at a **Seam** and satisfies the **Interface**.
+- **Depth** produces **Leverage** for callers and **Locality** for maintainers.
+
+## Rejected framings
+
+- **Depth as ratio of implementation-lines to interface-lines** (Ousterhout): rewards padding the implementation. We use depth-as-leverage instead.
+- **"Interface" as the TypeScript `interface` keyword or a class's public methods**: too narrow — interface here includes every fact a caller must know.
+- **"Boundary"**: overloaded with DDD's bounded context. Say **seam** or **interface**.
+
+## Going deeper
+
+- **Deepening a cluster given its dependencies** — see [DEEPENING.md](DEEPENING.md): dependency categories, seam discipline, and replace-don't-layer testing.
+- **Exploring alternative interfaces** — see [DESIGN-IT-TWICE.md](DESIGN-IT-TWICE.md): spin up parallel sub-agents to design the interface several radically different ways, then compare on depth, locality, and seam placement.

package/.agents/skills/codebase-design/THIRD-PARTY-NOTICES.md

@@ -0,0 +1,29 @@
+# Third-Party Notices
+
+This skill is adapted from **Matt Pocock's skills**
+(https://github.com/mattpocock/skills), `skills/engineering/codebase-design` @ d574778, Copyright (c) 2026 Matt Pocock,
+used under the MIT License. Locally adapted (fork-and-own); see PROVENANCE.md.
+
+```
+MIT License
+
+Copyright (c) 2026 Matt Pocock
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+```

package/.agents/skills/codex-adapter-sync/SKILL.md

@@ -0,0 +1,151 @@
+---
+name: codex-adapter-sync
+description: "Use to audit and update the Codex adapter after changes to CLAUDE.md, package CLAUDE.md files, .claude/skills, .claude/agents, or Codex setup. Checks AGENTS.md, .agents/skills, .codex/config.toml, .codex/agents, and .gitignore for drift."
+---
+
+# Codex Adapter Sync
+
+Use this skill when the user asks for a Codex adapter sync, Codex drift check,
+Claude-to-Codex migration check, or when changes to Claude-facing project
+knowledge may need to be reflected in Codex-facing files.
+
+## Scope
+
+Source side:
+- `CLAUDE.md`
+- `frontend/CLAUDE.md`
+- `backend/CLAUDE.md`
+- `~/.claude/CLAUDE.md` when the user explicitly mentions global Claude
+  instruction drift or global Claude changes
+- `.claude/skills/`
+- `.claude/agents/`
+- `.gitignore`
+
+Codex adapter side:
+- `AGENTS.md`
+- `.agents/skills/`
+- `.codex/config.toml`
+- `.codex/agents/`
+- `.gitignore`
+
+## Workflow
+
+1. Establish a worktree before making adapter changes — pick the mode by how
+   the sync was triggered:
+   - **In-current-worktree (default for a per-slice gate).** If you are already
+     in a non-main slice/feature worktree — e.g. invoked as the mandatory
+     `codex-adapter-sync` gate at the end of a skill-touching slice — sync the
+     adapter **here**, in that same worktree. Commit the adapter changes
+     alongside the slice and ship them in the slice's own PR. Do **not** spin up
+     a separate adapter branch or PR: a per-slice gate that demanded its own
+     worktree/PR would collide with the slice it is gating.
+   - **Dedicated adapter worktree.** Only when invoked standalone from the main
+     checkout (no active slice worktree): create or reuse a dedicated adapter
+     worktree before inventory or edits — your project's worktree helper (or
+     `git worktree add`) on an issue-anchored branch when an anchor exists, or a
+     `chore/codex-adapter-sync-<slug>` worktree for a deliberate no-issue chore
+     — and ship it through its own PR.
+   - Either way: never land adapter changes directly on `main`. Move any
+     accidental main-checkout adapter diff into the chosen worktree first, then
+     leave the main checkout clean.
+2. Inventory the source side and adapter side from inside that worktree. If
+   global Claude instructions are in scope, read them from the main thread but
+   keep personal overrides, secrets, and machine-local state out of the repo
+   diff.
+3. Compare project knowledge:
+   - New or changed durable conventions in `CLAUDE.md` should be reflected in
+     `AGENTS.md` only as concise adapter guidance or references.
+   - Do not duplicate long `CLAUDE.md` sections into `AGENTS.md`.
+   - Keep `CLAUDE.md` as the source of truth.
+   - Durable global safety/workflow rules from `~/.claude/CLAUDE.md` should be
+     mirrored only when Codex would otherwise miss them. Prefer a short
+     Codex-facing adapter rule in `AGENTS.md` or a minimal safe Codex config
+     change; do not copy personal style, identities, credentials, or long
+     global sections.
+4. Compare skills:
+   - Important repo/domain/workflow skills from `.claude/skills/` belong in
+     `.agents/skills/`.
+   - Keep each `SKILL.md` and its support files together.
+   - Do not copy skills into `.codex/skills/`.
+   - Leave clearly Claude-only setup, hook, or personal/meta skills out unless
+     the user explicitly wants them ported.
+   - Translate Claude-specific model delegation instead of copying it
+     literally (tier mapping per your routing doctrine; if the repo carries a
+     Codex mirror table in `AGENTS.md`, keep it in sync). In particular, Claude `Agent` dispatches with
+     `model: sonnet` should become Codex `spawn_agent` dispatches with the
+     appropriate `agent_type`; for mechanical coding/git work use a `worker`
+     subagent with `model: gpt-5.4-mini` and `reasoning_effort: low` unless the
+     source skill gives a stronger task-specific reason. Claude `opus` /
+     judgment-tier dispatches (subtle logic, review/verify verdicts) map to
+     `model: gpt-5.5` with `reasoning_effort: high` (verdicts never below
+     high). Translate Claude `effort:` params to the nearest
+     `reasoning_effort` value (`minimal|low|medium|high|xhigh`; Claude `max`
+     → `xhigh`). Keep user gates, security judgment, and approval decisions
+     in the main thread.
+   - Keep dual-surface generic/vendored skill bodies content-synced. When a
+     Codex mirror must intentionally differ from the Claude source, bracket the
+     source region and the Codex replacement with a matching transform marker
+     pair:
+     `<!-- mirror-xform:start <short-reason> -->` and
+     `<!-- mirror-xform:end -->`. The `<short-reason>` must match, in order,
+     on both sides. Stale source content is not a transform: copy it into the
+     Codex mirror instead. A mirror-parity lint (if your project ships one)
+     strips paired regions and fails on unmarked or unpaired drift.
+   - **Escalation-target rewrite (standard adaptation).** A Claude-only,
+     vendored escalation skill (`surfaces: [claude]` in the manifest — e.g.
+     `grill-with-docs-codex`, `grill-me-codex`, Chase AI's cross-model Act-2
+     variants) has no `.agents` mirror. Any Codex-side reference to that skill
+     name is a dangling target and must be rewritten to its plain, dual-surface
+     counterpart (`grill-with-docs`, `grill-me`) instead. Reword the sentence
+     around the swapped name so it stays coherent on the Codex surface — in
+     particular, drop any claim that a *different* model reviews the plan
+     afterwards (Act 2): that mechanic is Claude-orchestrator-specific
+     (dispatches `codex exec` as a subprocess) and does not apply once the
+     agent running the skill already is Codex. For a dual-surface
+     generic/vendored skill, do this inside a paired `mirror-xform` region (see
+     above) so the Claude source keeps citing the real `-codex` skill
+     unchanged while the Codex mirror gets the plain, reworded sentence; for a
+     Codex-only project-private skill, rewrite the reference directly, no
+     marker needed. A reference to the skill's real upstream repo name or a
+     real doc file path that merely happens to contain the string (e.g.
+     `chaseai-yt/grill-me-codex`, `docs/agents/skills/grill-with-docs-codex.md`)
+     is not an escalation target and must NOT be rewritten — rewriting it would
+     break attribution/a real link.
+5. Validate Codex skill frontmatter:
+   - `name` and `description` are required.
+   - Quote `description` when it contains colons, arrows, commas, or other
+     YAML-sensitive punctuation.
+   - Keep `description` under 1024 characters.
+   - Keep trigger detail in the body if the original Claude description is too
+     long.
+6. Compare agents:
+   - Claude agents are `.md` files under `.claude/agents/`.
+   - Codex agents are `.toml` files under `.codex/agents/`.
+   - Convert agent instruction bodies into `developer_instructions`.
+   - If no Claude agents exist, keep only a short README or no-op note.
+7. Compare config and ignore rules:
+   - Keep `.codex/config.toml` minimal and safe.
+   - Never add secrets, provider credentials, auth tokens, or local personal
+     overrides.
+   - Ensure `.gitignore` excludes local Codex state and override files while
+     allowing checked-in project config, agents, and skills.
+8. Before edits, show the exact files that will be created or changed.
+9. After edits, validate:
+   - `.codex/config.toml` parses as TOML.
+   - All `.agents/skills/*/SKILL.md` files load without Codex warnings.
+   - No skill description exceeds 1024 characters.
+   - `.codex/config.toml`, `.codex/agents/*.toml`, and `.agents/skills/**`
+     are not accidentally ignored.
+10. Prepare the branch for review:
+   - Commit the adapter changes on the worktree branch after checking for
+     secrets and ignored files.
+   - Push the branch and create or update a PR.
+   - Report the PR URL, changed files, skipped items, and verification results.
+
+## Output
+
+Report:
+- What changed.
+- What was intentionally skipped.
+- Any source files that still need human judgment.
+- Verification commands and results.

package/.agents/skills/decision-gate/SKILL.md

@@ -0,0 +1,67 @@
+---
+name: decision-gate
+"description": "Resolve a bounded trade-off choice or a targeted research gap with read-only investigation, a documented weigh-up, and a reasoned decision. Use when a plan or slice hinges on a concrete \"which option\" choice or a \"need to research this first\" gap that is above a binary yes/no fact (verify-spike) but below a high-stakes, hard-to-reverse, ADR-worthy decision (grill-with-docs-codex). Output is a trade-off table plus a justified pick sunk into an ADR/issue/comment. NOT for binary fact-checks (verify-spike), open-ended design feel (prototype), or bug root-cause (diagnose)."
+---
+
+# Decision Gate
+
+A decision-gate resolves **a bounded "which option" choice — or a targeted research gap — with evidence, not a hunch.** You have two or more candidate approaches (or one approach you cannot yet commit to), the call is small enough that a full design-grill is overkill, but it is more than a single yes/no fact. The gate makes the choice **documented and defensible** instead of decided in your head.
+
+This is the "Architecture Decisions — best-practice first" rule at small scale: when a slice carries a real trade-off or an unresearched assumption, do the read-only legwork, lay the options side by side, and write down the pick with its reasons before any build slice depends on it.
+
+## When this and not another skill
+
+<!-- mirror-xform:start codex-escalation -->
+| You are deciding… | Skill |
+|---|---|
+| "Which of these options, given these trade-offs?" / "I need to research this before I can choose." (bounded, sub-grill) | **decision-gate** |
+| "Is this one fact true against the real lib / runtime / DB / platform?" (binary yes/no) | `verify-spike` |
+| "Is this high-stakes / hard-to-reverse / ADR-worthy?" (auth, schema, concurrency, migrations, payments) | `grill-with-docs` |
+| "Does this design / state model / UI feel right?" (open-ended exploration) | `prototype` |
+| "Why is this broken / slow?" (root-cause of a known defect) | `diagnose` |
+<!-- mirror-xform:end -->
+
+<!-- mirror-xform:start codex-escalation -->
+Threshold check, both directions: if the choice is **binary and empirically settleable**, drop down to `verify-spike`. If it is **high-stakes or hard-to-reverse** (a central seam, a one-way door, an ADR), escalate up to `grill-with-docs` — do not let a real architecture decision hide in a decision-gate.
+<!-- mirror-xform:end -->
+
+## Placement — which altitude owns a decision
+
+Deciding *when* to run a decision-gate is one question; deciding *where a choice
+gets resolved* is a separate one. This skill is the **single owner** of that
+placement rule — `to-waves`'s program-grill agenda, `to-issues`'s gate-slice
+placement note, and a `validate-graph` structural-suspicion warning all
+**reference** this rule; none of them re-state it.
+
+> A decision is resolved at the altitude whose cut it changes — at that
+> altitude's lock point, never as a work item inside it.
+
+- A phase/wave cut → resolved at the program's macro-grill, before the wave
+  plan locks.
+- A slice cut → resolved at the feature-grill (`grill-with-docs`/`to-prd`/
+  `to-issues`), before the slice table locks.
+- A question local to one slice → a gate slice (this skill or `verify-spike`)
+  or an inline call — it never needs to escalate upward.
+
+A structure-bearing decision surfacing **inside** a build slice — a gate slice
+whose dependents reach outside its own slice or wave — is a misplacement, not
+a normal case: push it back up to the altitude whose cut it actually changes,
+instead of quietly resolving it wherever it happened to surface.
+
+## Steps
+
+1. **Frame the options and the criteria.** Name the competing approaches (or the single unresearched approach) as a short list, and the axes the choice turns on — e.g. complexity, blast radius, performance, reversibility, fit with existing patterns. Write down what "good" looks like on each axis *before* you research, so the pick is not retrofitted to a foregone conclusion.
+2. **Research/measure read-only, per option.** Gather evidence for each option against the real thing — read the consuming code (`grep`/Read), the actual lib/runtime behaviour, an official doc/best-practice source, or a quick throwaway measurement. Borrow the feedback-loop toolkit from `diagnose` Phase 1 for any measurement. Read-only: no schema/migration/shared-state writes; if you need numbers, measure against a scratch read, never mutate.
+3. **Lay it out as a trade-off table.** Options × criteria, one row per option, with a **cited cell** (a `file:line`, a measured value, a doc link) — not an adjective. An empty or hand-waved cell means that option is not actually researched yet.
+4. **Decide and sink it durably, with reasons inline.** State the chosen option and *why it wins on the criteria that matter*, plus what you consciously traded away. Sink it where the decision lives — an ADR (if it grew ADR-worthy, reconsider escalating), the issue body, the plan, or a PR comment — with the trade-off evidence attached so a later reader trusts the pick without redoing the research.
+5. **Delete throwaway measurement code.** Any scratch probe built in step 2 is thrown away (or folded into real code). The *decision + its table* is the only keeper; nothing throwaway rots in the repo (`prototype`'s closing rule).
+
+## Rules
+
+1. **Read-only.** No schema changes, no migrations, no writes to a shared/prod resource. Research and measurement only; a DB question hits a read or a scratch row.
+2. **Evidence per cell, not assertion.** "Option A is faster/cleaner" is not a trade-off — the measured number, the `file:line`, the doc is. A table of adjectives is an unresearched guess in a table costume.
+3. **Decide — do not just survey.** The output is a *pick with reasons*, not a neutral menu. Name what you traded away so the runner-up's strengths are on record. A genuine tie on the criteria that matter is a finding, not a license to coin-flip: default to the most reversible option and say why, or surface the tie to the user as an outcome question.
+4. **Scope honestly.** The decision holds for the options and context you weighed. State that scope so a new option or a changed constraint re-opens the gate instead of inheriting a stale pick.
+<!-- mirror-xform:start codex-escalation -->
+5. **Respect the threshold.** Mid-gate, if it turns high-stakes or hard-to-reverse → stop and escalate to `grill-with-docs`; if it collapses to one binary fact → drop to `verify-spike`. The gate is for the bounded middle, not a place to quietly settle a big decision.
+<!-- mirror-xform:end -->

package/.agents/skills/diagnose/SKILL.md

@@ -0,0 +1,136 @@
+---
+name: diagnose
+description: "Disciplined diagnosis loop for hard bugs and performance regressions. Reproduce → minimise → hypothesise → instrument → fix → regression-test. Use when user says \"diagnose this\" / \"debug this\", reports a bug, says something is broken/throwing/failing, or describes a performance regression."
+---
+
+# Diagnose
+
+> **Skill identity (don't get confused):** the folder `diagnose` + invocation `/diagnose` map to Matt Pocock's upstream skill **`diagnosing-bugs`**. Upstream renamed `diagnose` → `diagnosing-bugs`; we deliberately keep the folder name `diagnose` (invocation stability `/diagnose`). Content = upstream `diagnosing-bugs` @ `7a83a3a`, locally adapted (description kept with full trigger coverage). Provenance/rename ledger: `docs/agents/provenance.md` (§Re-Sync-Log), at the project root.
+
+A discipline for hard bugs. Skip phases only when explicitly justified.
+
+When exploring the codebase, read `CONTEXT.md` (if it exists) to get a clear mental model of the relevant modules, and check ADRs in the area you're touching.
+
+## Phase 1 — Build a feedback loop
+
+**This is the skill.** Everything else is mechanical. If you have a **tight** pass/fail signal for the bug — one that goes red on _this_ bug — you will find the cause; bisection, hypothesis-testing, and instrumentation all just consume it. If you don't have one, no amount of staring at code will save you.
+
+Spend disproportionate effort here. **Be aggressive. Be creative. Refuse to give up.**
+
+### Ways to construct one — try them in roughly this order
+
+1. **Failing test** at whatever seam reaches the bug — unit, integration, e2e.
+2. **Curl / HTTP script** against a running dev server.
+3. **CLI invocation** with a fixture input, diffing stdout against a known-good snapshot.
+4. **Headless browser script** (Playwright / Puppeteer) — drives the UI, asserts on DOM/console/network.
+5. **Replay a captured trace.** Save a real network request / payload / event log to disk; replay it through the code path in isolation.
+6. **Throwaway harness.** Spin up a minimal subset of the system (one service, mocked deps) that exercises the bug code path with a single function call.
+7. **Property / fuzz loop.** If the bug is "sometimes wrong output", run 1000 random inputs and look for the failure mode.
+8. **Bisection harness.** If the bug appeared between two known states (commit, dataset, version), automate "boot at state X, check, repeat" so you can `git bisect run` it.
+9. **Differential loop.** Run the same input through old-version vs new-version (or two configs) and diff outputs.
+10. **HITL bash script.** Last resort. If a human must click, drive _them_ with `scripts/hitl-loop.template.sh` so the loop is still structured. Captured output feeds back to you.
+
+Build the right feedback loop, and the bug is 90% fixed.
+
+### Tighten the loop
+
+Treat the loop as a product. Once you have _a_ loop, **tighten** it:
+
+- Can I make it faster? (Cache setup, skip unrelated init, narrow the test scope.)
+- Can I make the signal sharper? (Assert on the specific symptom, not "didn't crash".)
+- Can I make it more deterministic? (Pin time, seed RNG, isolate filesystem, freeze network.)
+
+A 30-second flaky loop is barely better than no loop; a 2-second deterministic one is tight — a debugging superpower.
+
+### Non-deterministic bugs
+
+The goal is not a clean repro but a **higher reproduction rate**. Loop the trigger 100×, parallelise, add stress, narrow timing windows, inject sleeps. A 50%-flake bug is debuggable; 1% is not — keep raising the rate until it's debuggable.
+
+### When you genuinely cannot build a loop
+
+Stop and say so explicitly. List what you tried. Ask the user for: (a) access to whatever environment reproduces it, (b) a captured artifact (HAR file, log dump, core dump, screen recording with timestamps), or (c) permission to add temporary production instrumentation. Do **not** proceed to hypothesise without a loop.
+
+### Completion criterion — a tight loop that goes red
+
+Phase 1 is done when the loop is **tight** and **red-capable**: you can name **one command** — a script path, a test invocation, a curl — that you have **already run at least once** (paste the invocation and its output), and that is:
+
+- [ ] **Red-capable** — it drives the actual bug code path and asserts the **user's exact symptom**, so it can go red on this bug and green once fixed. Not "runs without erroring" — it must be able to _catch this specific bug_.
+- [ ] **Deterministic** — same verdict every run (flaky bugs: a pinned, high reproduction rate, per above).
+- [ ] **Fast** — seconds, not minutes.
+- [ ] **Agent-runnable** — you can run it unattended; a human in the loop only via `scripts/hitl-loop.template.sh`.
+
+If you catch yourself reading code to build a theory before this command exists, **stop — jumping straight to a hypothesis is the exact failure this skill prevents.** No red-capable command, no Phase 2.
+
+## Phase 2 — Reproduce + minimise
+
+Run the loop. Watch it go red — the bug appears.
+
+Confirm:
+
+- [ ] The loop produces the failure mode the **user** described — not a different failure that happens to be nearby. Wrong bug = wrong fix.
+- [ ] The failure is reproducible across multiple runs (or, for non-deterministic bugs, reproducible at a high enough rate to debug against).
+- [ ] You have captured the exact symptom (error message, wrong output, slow timing) so later phases can verify the fix actually addresses it.
+
+### Minimise
+
+Once it's red, shrink the repro to the **smallest scenario that still goes red**. Cut inputs, callers, config, data, and steps **one at a time**, re-running the loop after each cut — keep only what's load-bearing for the failure.
+
+Why bother: a minimal repro shrinks the hypothesis space in Phase 3 (fewer moving parts left to suspect) and becomes the clean regression test in Phase 5.
+
+Done when **every remaining element is load-bearing** — removing any one of them makes the loop go green.
+
+Do not proceed until you have reproduced **and** minimised.
+
+## Phase 3 — Hypothesise
+
+Generate **3–5 ranked hypotheses** before testing any of them. Single-hypothesis generation anchors on the first plausible idea.
+
+Each hypothesis must be **falsifiable**: state the prediction it makes.
+
+> Format: "If <X> is the cause, then <changing Y> will make the bug disappear / <changing Z> will make it worse."
+
+If you cannot state the prediction, the hypothesis is a vibe — discard or sharpen it.
+
+**Show the ranked list to the user before testing.** They often have domain knowledge that re-ranks instantly ("we just deployed a change to #3"), or know hypotheses they've already ruled out. Cheap checkpoint, big time saver. Don't block on it — proceed with your ranking if the user is AFK.
+
+## Phase 4 — Instrument
+
+Each probe must map to a specific prediction from Phase 3. **Change one variable at a time.**
+
+Tool preference:
+
+1. **Debugger / REPL inspection** if the env supports it. One breakpoint beats ten logs.
+2. **Targeted logs** at the boundaries that distinguish hypotheses.
+3. Never "log everything and grep".
+
+**Tag every debug log** with a unique prefix, e.g. `[DEBUG-a4f2]`. Cleanup at the end becomes a single grep. Untagged logs survive; tagged logs die.
+
+**Perf branch.** For performance regressions, logs are usually wrong. Instead: establish a baseline measurement (timing harness, `performance.now()`, profiler, query plan), then bisect. Measure first, fix second.
+
+## Phase 5 — Fix + regression test
+
+Write the regression test **before the fix** — but only if there is a **correct seam** for it.
+
+A correct seam is one where the test exercises the **real bug pattern** as it occurs at the call site. If the only available seam is too shallow (single-caller test when the bug needs multiple callers, unit test that can't replicate the chain that triggered the bug), a regression test there gives false confidence.
+
+**If no correct seam exists, that itself is the finding.** Note it. The codebase architecture is preventing the bug from being locked down. Flag this for the next phase.
+
+If a correct seam exists:
+
+1. Turn the minimised repro into a failing test at that seam.
+2. Watch it fail.
+3. Apply the fix.
+4. Watch it pass.
+5. Re-run the Phase 1 feedback loop against the original (un-minimised) scenario.
+
+## Phase 6 — Cleanup + post-mortem
+
+Required before declaring done:
+
+- [ ] Original repro no longer reproduces (re-run the Phase 1 loop)
+- [ ] Regression test passes (or absence of seam is documented)
+- [ ] All `[DEBUG-...]` instrumentation removed (`grep` the prefix)
+- [ ] Throwaway prototypes deleted (or moved to a clearly-marked debug location)
+- [ ] The hypothesis that turned out correct is stated in the commit / PR message — so the next debugger learns
+
+**Then ask: what would have prevented this bug?** If the answer involves architectural change (no good test seam, tangled callers, hidden coupling) hand off to the `/improve-codebase-architecture` skill with the specifics. Make the recommendation **after** the fix is in, not before — you have more information now than when you started.

package/.agents/skills/diagnose/THIRD-PARTY-NOTICES.md

@@ -0,0 +1,29 @@
+# Third-Party Notices
+
+This skill is adapted from **Matt Pocock's skills**
+(https://github.com/mattpocock/skills), `skills/engineering/diagnosing-bugs` @ d574778, Copyright (c) 2026 Matt Pocock,
+used under the MIT License. Locally adapted (fork-and-own); see PROVENANCE.md.
+
+```
+MIT License
+
+Copyright (c) 2026 Matt Pocock
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+```

package/.agents/skills/diagnose/scripts/hitl-loop.template.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# Human-in-the-loop reproduction loop.
+# Copy this file, edit the steps below, and run it.
+# The agent runs the script; the user follows prompts in their terminal.
+#
+# Usage:
+#   bash hitl-loop.template.sh
+#
+# Two helpers:
+#   step "<instruction>"          → show instruction, wait for Enter
+#   capture VAR "<question>"      → show question, read response into VAR
+#
+# At the end, captured values are printed as KEY=VALUE for the agent to parse.
+
+set -euo pipefail
+
+step() {
+  printf '\n>>> %s\n' "$1"
+  read -r -p "    [Enter when done] " _
+}
+
+capture() {
+  local var="$1" question="$2" answer
+  printf '\n>>> %s\n' "$question"
+  read -r -p "    > " answer
+  printf -v "$var" '%s' "$answer"
+}
+
+# --- edit below ---------------------------------------------------------
+
+step "Open the app at http://localhost:3000 and sign in."
+
+capture ERRORED "Click the 'Export' button. Did it throw an error? (y/n)"
+
+capture ERROR_MSG "Paste the error message (or 'none'):"
+
+# --- edit above ---------------------------------------------------------
+
+printf '\n--- Captured ---\n'
+printf 'ERRORED=%s\n' "$ERRORED"
+printf 'ERROR_MSG=%s\n' "$ERROR_MSG"

package/.agents/skills/domain-modeling/ADR-FORMAT.md

@@ -0,0 +1,47 @@
+# ADR Format
+
+ADRs live in `docs/adr/` and use sequential numbering: `0001-slug.md`, `0002-slug.md`, etc.
+
+Create the `docs/adr/` directory lazily — only when the first ADR is needed.
+
+## Template
+
+```md
+# {Short title of the decision}
+
+{1-3 sentences: what's the context, what did we decide, and why.}
+```
+
+That's it. An ADR can be a single paragraph. The value is in recording *that* a decision was made and *why* — not in filling out sections.
+
+## Optional sections
+
+Only include these when they add genuine value. Most ADRs won't need them.
+
+- **Status** frontmatter (`proposed | accepted | deprecated | superseded by ADR-NNNN`) — useful when decisions are revisited
+- **Considered Options** — only when the rejected alternatives are worth remembering
+- **Consequences** — only when non-obvious downstream effects need to be called out
+
+## Numbering
+
+Scan `docs/adr/` for the highest existing number and increment by one.
+
+## When to offer an ADR
+
+All three of these must be true:
+
+1. **Hard to reverse** — the cost of changing your mind later is meaningful
+2. **Surprising without context** — a future reader will look at the code and wonder "why on earth did they do it this way?"
+3. **The result of a real trade-off** — there were genuine alternatives and you picked one for specific reasons
+
+If a decision is easy to reverse, skip it — you'll just reverse it. If it's not surprising, nobody will wonder why. If there was no real alternative, there's nothing to record beyond "we did the obvious thing."
+
+### What qualifies
+
+- **Architectural shape.** "We're using a monorepo." "The write model is event-sourced, the read model is projected into Postgres."
+- **Integration patterns between contexts.** "Ordering and Billing communicate via domain events, not synchronous HTTP."
+- **Technology choices that carry lock-in.** Database, message bus, auth provider, deployment target. Not every library — just the ones that would take a quarter to swap out.
+- **Boundary and scope decisions.** "Customer data is owned by the Customer context; other contexts reference it by ID only." The explicit no-s are as valuable as the yes-s.
+- **Deliberate deviations from the obvious path.** "We're using manual SQL instead of an ORM because X." Anything where a reasonable reader would assume the opposite. These stop the next engineer from "fixing" something that was deliberate.
+- **Constraints not visible in the code.** "We can't use AWS because of compliance requirements." "Response times must be under 200ms because of the partner API contract."
+- **Rejected alternatives when the rejection is non-obvious.** If you considered GraphQL and picked REST for subtle reasons, record it — otherwise someone will suggest GraphQL again in six months.