@kensaurus/skills 0.0.0-stage → 2.1.0

package/skills/housekeep-dead-code/references/ratchet-ci.md

@@ -0,0 +1,205 @@
+# Ratchet install — scripts, lint, CI, aggregator
+
+The point: the next agent session cannot leave the repo with more dead code
+than it found. One number, shrink-only, enforced in CI. Cleanup without this
+regrows within weeks.
+
+## 1. `package.json` scripts
+
+CI calls the scripts, never raw flags, so local and CI cannot drift.
+
+```json
+{
+  "scripts": {
+    "knip": "knip --production --max-issues 0",
+    "knip:all": "knip --max-issues 3 --treat-config-hints-as-errors",
+    "typecheck": "tsc --noEmit"
+  }
+}
+```
+
+Pin `knip` exactly as a devDependency (`npm view knip version` at install
+time); never `^` and never `latest` in a gate.
+
+**`--treat-config-hints-as-errors` goes on the default-mode script only.**
+Knip computes `isDisableConfigHints = --no-config-hints || isProduction`, so
+under `--production` hints are never collected and the flag is inert. Putting
+it there looks like drift protection and provides none.
+
+If the production count is not yet 0, use `--max-issues <N>` there too and
+write the rule down in `CONTRIBUTING.md`:
+
+> `knip` and `knip:all` carry `--max-issues` ceilings. A PR may lower a
+> ceiling, never raise it. Raising one is a separate PR titled
+> `chore(dead-code): raise ceiling` with the reason in the body.
+
+Per-type ceilings are possible with `--reporter json` plus a compare script,
+but one number is easier to review and harder to game. Start with one number.
+
+## 2. Guard the ratchet, not just the number
+
+`--max-issues` totals only issue types whose rule is `error`. Everything below
+moves the metric without removing code:
+
+| Bypass | Why it works |
+|---|---|
+| `rules: { files: "warn" }` | **The quietest one.** Warns are excluded from the total, so every dead file is reported and the job still exits `0` |
+| `--no-exit-code` | Green unconditionally |
+| `--exclude <type>` / narrowed `--include` | Whole issue classes vanish from the run |
+| `--workspace <one>` | Scopes a monorepo run to the clean package |
+| `ignore`, `ignoreFiles`, `ignoreIssues`, `ignoreDependencies` | Hides findings rather than resolving them |
+| `noUnusedLocals: false`, disabling the lint rule | Zeroes the in-file surface |
+
+Review changes to `knip.json`, the scripts, and the job's flags with the same
+care as the count. A scope or rule change is a baseline change and belongs in
+its own reviewed PR.
+
+## 3. tsconfig
+
+```json
+{
+  "compilerOptions": {
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+    "verbatimModuleSyntax": true
+  }
+}
+```
+
+`verbatimModuleSyntax` keeps type-only imports type-only, which helps both
+Knip's graph and tree-shaking.
+
+Turning these on in an AI-written repo produces a burst of errors. That burst
+*is* the unused-locals cascade, so enable them **during** the export/cascade
+category, not after — otherwise the typecheck gate between commits is red for
+reasons unrelated to the batch.
+
+## 4. ESLint (flat config)
+
+```js
+// eslint.config.js
+import unusedImports from "eslint-plugin-unused-imports";
+
+export default [
+  // ...existing config
+  {
+    plugins: { "unused-imports": unusedImports },
+    rules: {
+      "unused-imports/no-unused-imports": "error",
+      "unused-imports/no-unused-vars": [
+        "warn",
+        { vars: "all", varsIgnorePattern: "^_", args: "after-used", argsIgnorePattern: "^_" },
+      ],
+      "no-console": ["error", { allow: ["warn", "error"] }],
+      "no-debugger": "error",
+    },
+  },
+];
+```
+
+`no-unused-imports` autofixes; core `no-unused-vars` does not. The `^_`
+patterns keep deliberate placeholders legal.
+
+Biome or oxlint instead: `noUnusedImports` / `noUnusedVariables` are
+equivalent and faster. Keep **one** linter — `audit-gate-logic` flags two as
+duplicate enforcement.
+
+## 5. lint-staged, and why Knip is not in pre-commit
+
+```json
+{
+  "lint-staged": {
+    "*.{ts,tsx}": ["eslint --fix --max-warnings=0", "prettier --write"]
+  }
+}
+```
+
+Knip is repo-wide and too slow for pre-commit. If a local gate is wanted, use
+pre-push, calling the same script CI calls:
+
+```bash
+# .husky/pre-push
+npm run knip
+```
+
+## 6. GitHub Actions job
+
+```yaml
+# add to the existing ci.yml rather than a new workflow if one exists
+  dead-code:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@<pinned-sha>
+      - uses: actions/setup-node@<pinned-sha>
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+      - run: npm ci --ignore-scripts
+      - run: npm run knip        # production, ceiling 0
+      - run: npm run knip:all    # default mode + config-hint drift
+```
+
+Pin action SHAs per `plan-dependency-provenance`. Add `merge_group` to the
+workflow triggers if a merge queue is in use, and keep check names identical
+across `pull_request` and `merge_group`, or queued PRs wait on checks that
+never start.
+
+Exit codes: `0` clean · `1` issues found · `2` Knip failed to run. A job that
+only distinguishes `0` from `1` reports a **crashed** run as green.
+
+`--cache` is deliberately absent: Knip caches into
+`node_modules/.cache/knip`, which `npm ci` wipes, and `cache: npm` only
+restores `~/.npm`. Add an explicit `actions/cache` step if you want it.
+
+## 7. Aggregator wiring (`housekeep-gates` contract)
+
+Add one job to the existing aggregator's `needs:` — do not create a second
+required check.
+
+```yaml
+  gate:
+    needs: [typecheck, lint, test, build, dead-code]
+    if: always()
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo '${{ toJSON(needs) }}' | jq -e 'to_entries | all(.value.result == "success")'
+```
+
+`if: always()` plus the explicit result check is what makes a **skipped**
+`dead-code` job fail the gate instead of silently passing it. If the repo has
+no aggregator, mark `dead-code` required and leave a note for
+`housekeep-gates`.
+
+## 8. Types-drift guard (Supabase repos)
+
+A generated types file that no longer matches the schema is how sessions end
+up querying columns that do not exist.
+
+```yaml
+  supabase-types:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@<pinned-sha>
+      - uses: supabase/setup-cli@<pinned-sha>
+      - run: supabase gen types typescript --project-id "$SUPABASE_PROJECT_REF" > /tmp/supabase.ts
+        env:
+          SUPABASE_PROJECT_REF: ${{ secrets.SUPABASE_PROJECT_REF }}
+          SUPABASE_ACCESS_TOKEN: ${{ secrets.SUPABASE_ACCESS_TOKEN }}
+      - run: diff -u /tmp/supabase.ts src/types/supabase.ts
+```
+
+Add it to the aggregator's `needs:` as well.
+
+## 9. Ratchet the other counts
+
+A metric with no gate grows back. Once the Knip job is green, add the residue
+numbers from the plan's baseline: duplication percentage, suppression count,
+`console.*` count. Same shrink-only rule, same review discipline.
+
+## 10. Agent rule (hand to `enhance-agent-guardrails`)
+
+One line for `.cursor/rules/*.mdc` or `AGENTS.md`:
+
+> Before claiming a task done: `npm run typecheck && npm run knip`. New unused
+> exports, files, or dependencies are not done.

package/skills/housekeep-dead-code/references/supabase-hygiene.md

@@ -0,0 +1,152 @@
+# Supabase arm — dead schema, orphan functions, drift
+
+Knip stops at the JavaScript boundary. AI-generated Supabase projects carry
+the same debt on the other side: tables created for a feature that was
+rewritten, RPCs nobody calls, Edge Functions nobody invokes, forty tiny
+migrations, and a `supabase.ts` that no longer matches the schema.
+
+**Discovery here is read-only and safe against any target, including
+production. Every drop is a migration, requires the approved plan row, and
+stops before `db push` unless the plan says push.**
+
+Subcommand names move between CLI versions. Run `supabase inspect db --help`
+once and use what your installed version actually has.
+
+## 0. Precondition — how old are the statistics?
+
+```bash
+psql "$DB_URL" -c "select datname, stats_reset from pg_stat_database where datname = current_database();"
+```
+
+`pg_stat_*` counters accumulate since `stats_reset`. **A table with zero scans
+on a database reset yesterday proves nothing.** Require ~30 days, or one known
+full traffic cycle, before calling anything dead on usage evidence — and
+record the window in the report. Below that, rely on the code cross-reference
+alone.
+
+This is also why usage statistics are best read from **production**: a staging
+database with no real traffic makes everything look dead.
+
+## 1. What the code actually touches
+
+```bash
+rg -o "\.from\(['\"][a-zA-Z0-9_]+['\"]\)"           src supabase/functions | sed -E "s/.*\(['\"]//; s/['\"]\)//" | sort | uniq -c | sort -rn > /tmp/sb-tables
+rg -o "\.rpc\(['\"][a-zA-Z0-9_]+['\"]"              src supabase/functions | sed -E "s/.*\(['\"]//; s/['\"]//"   | sort -u > /tmp/sb-rpcs
+rg -o "functions\.invoke\(['\"][a-zA-Z0-9_-]+['\"]" src                    | sed -E "s/.*\(['\"]//; s/['\"]//"   | sort -u > /tmp/sb-fns
+rg -o "storage\.from\(['\"][a-zA-Z0-9_-]+['\"]"     src supabase/functions | sed -E "s/.*\(['\"]//; s/['\"]//"   | sort -u > /tmp/sb-buckets
+rg -o "channel\(['\"][^'\"]+['\"]"                  src                    | sort -u > /tmp/sb-channels
+```
+
+A table reached only through a view needs the view name grepped too.
+
+## 2. Schema inventory (read-only SQL)
+
+```sql
+-- Usage counters per table
+select relname, seq_scan, idx_scan, n_live_tup,
+       n_tup_ins + n_tup_upd + n_tup_del as writes
+from pg_stat_user_tables where schemaname = 'public'
+order by seq_scan + idx_scan, writes;
+
+-- Functions
+select p.proname, pg_get_function_identity_arguments(p.oid) as args
+from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+where n.nspname = 'public' order by 1;
+
+-- In-database callers the client grep can never see
+select tgname, tgrelid::regclass as tbl, tgfoid::regproc as fn
+from pg_trigger where not tgisinternal;
+select policyname, tablename, qual, with_check
+from pg_policies where schemaname = 'public';
+select proname from pg_proc where prosrc ilike '%<candidate_name>%';
+select jobname, command from cron.job;          -- only if pg_cron is enabled
+
+select id, public from storage.buckets;
+```
+
+That third block is the one people skip. **An RPC called only from an RLS
+policy, a trigger, or a `pg_cron` job has zero client references and is
+fully alive.** Deleting it silently breaks authorization.
+
+CLI equivalents, documented at the time of writing: `supabase inspect db
+unused-indexes`, `seq-scans`, `table-sizes`, `index-sizes`, `cache-hit`,
+`bloat`. The set has changed across CLI releases, so confirm with
+`supabase inspect db --help` before scripting any of them; the SQL above is
+the version-independent path.
+
+## 3. Cross-reference → candidates
+
+| Object | Dead when… | **Not** dead if… |
+|---|---|---|
+| Table | absent from `/tmp/sb-tables`, unreferenced by any function/trigger/policy body, zero reads and writes across a valid stats window | written by a trigger or cron; read by an Edge Function; a webhook target; an audit/log table by design |
+| Function (RPC) | absent from `/tmp/sb-rpcs`, not a trigger function, not in any policy `qual`/`with_check`, not called from another function body | an RLS helper (`is_admin()`, `auth.uid()` wrapper) or a trigger target |
+| Edge Function | directory exists, absent from `/tmp/sb-fns` | `verify_jwt = false` in `config.toml`, or a Stripe / GitHub / Resend webhook points at it — **external callers never appear in your grep** |
+| Index | reported by `unused-indexes` **and** not backing a PK or unique constraint | it backs a constraint, or supports a query that runs monthly (check the stats window) |
+| Bucket | absent from `/tmp/sb-buckets` **and** empty | non-empty — objects are data, not dead code. Escalate as data retention |
+| Migration file | every earlier migration is applied in every environment | any environment is behind — do not squash |
+
+Repo-vs-deployed drift: `supabase functions list` shows functions deployed
+from someone's laptop that never landed in git. Those are candidates to
+**redeploy from git first**, then delete if still unreferenced.
+
+## 4. Function-body hygiene
+
+```bash
+supabase db lint --level warning        # add --linked or --db-url for a remote target
+```
+
+`plpgsql_check` reports unused variables and arguments, dead code after
+`RETURN`, missing returns, hidden casts, and `EXECUTE` strings open to
+injection. Fix findings in the function's migration, never in the dashboard —
+a dashboard edit is drift the repo cannot see.
+
+## 5. Migration sprawl
+
+Agent sessions produce one migration per thought. Only once every environment
+is at the same version:
+
+```bash
+ls supabase/migrations | wc -l
+supabase migration squash              # squashes local migrations to one file
+supabase db reset                      # prove the squashed set builds a clean database
+supabase test db                       # pgTAP, if present
+```
+
+Keep the squash in its own PR. It is a large diff that says nothing about
+behavior, and mixing it with deletions makes both unreviewable.
+
+## 6. Types drift
+
+```bash
+supabase gen types typescript --linked > /tmp/supabase.ts
+diff -u /tmp/supabase.ts src/types/supabase.ts || echo "DRIFT"
+```
+
+Regenerate in the **same commit** as the schema change, and install the CI
+guard from [`ratchet-ci.md`](ratchet-ci.md) §8 so it cannot drift again.
+
+## 7. Drops — the only writes in this arm
+
+Ask the human to name the target database first and wait for the reply. Do not
+infer it from `.env` or a linked project ref.
+
+- **Tables — two steps.** Migration 1 renames to `_deprecated_<name>`: errors
+  surface immediately, the data is intact, and rollback is another rename.
+  Migration 2 drops, one release cycle later. A rename is reversible; a drop
+  destroys data.
+- **Functions / Edge Functions** — direct drop or directory delete. Cheap to
+  restore from git.
+- **Indexes** — `drop index concurrently`. Never a PK or unique index.
+- **Policies** — never dropped here. A table that stays needs RLS →
+  `plan-rls-audit`.
+- **Buckets holding objects** — never here. Retention is a product decision.
+
+Every migration: `supabase db reset` green locally, `supabase db lint` clean,
+types regenerated in the same commit. Then stop.
+
+## 8. Advisors, last
+
+Supabase's advisors (dashboard, or the Supabase MCP) flag RLS-off tables,
+unindexed foreign keys, and duplicate or unused indexes. Run them **after**
+the drops, since drops change the findings. RLS results belong to
+`plan-rls-audit`, not this skill.

package/skills/housekeep-design/SKILL.md

@@ -0,0 +1,207 @@
+---
+name: housekeep-design
+description: >
+  Consolidate a drifted design system into one token and component source of
+  truth. Use after an approved plan-uiux-unification, or when "clean up the
+  design system now", "migrate to one button", or "resolve token conflicts".
+license: MIT
+---
+
+# housekeep-design — Consolidate a Drifted Design System to One SSOT
+
+**Degree of freedom: MIXED.** Canonical-form judgment `[HIGH freedom]`;
+inventory searches, migration batches, and the zero-hit re-search
+`[LOW freedom — run exactly]`.
+
+Multiple sessions and multiple devs leave a design system full of competing truths: three
+button variants that look the same, `--brand`, `--primary`, and `#3B82F6` all meaning the
+same blue, `text-[13px]` next to `text-sm`, Lucide and Heroicons side by side. This skill
+picks one canonical form for each conflict, migrates everything to it, and locks the door
+behind you.
+
+## How to reason
+
+1. **Observe** — which tokens, components, or icon libraries compete?
+2. **Interpret** — is this duplication or an intentional variant?
+3. **Classify** — merge-to-canonical / keep-as-variant / ask (visible brand change)
+4. **Severity** — a second Button that ships in prod outranks a unused hex alias
+
+## Worked example
+
+> **Observe:** `--brand`, `--primary`, and `#3B82F6` are the same blue; two Button
+> files; Lucide + Heroicons.
+> **Interpret:** color and Button are duplicates; icon mix is library drift.
+> **Classify:** merge colors to `--color-primary`; keep `components/ui/button.tsx`;
+> standardize Lucide.
+> **Verify:** `rg` for `--brand` and `#3B82F6` → 0 hits; screenshots stay equivalent.
+
+## Self-critique before reporting
+
+- **Zero-hit** — every deprecated form was re-searched from scratch, not from memory
+- **Equivalent** — screenshots or an explicit authorized upgrade; no silent restyle
+- **One SSOT** — no leftover parallel token file or second Button
+- **Right owner** — plan-only burndown still open → `plan-uiux-unification`, not this
+
+> **One source of truth per decision.** When two patterns compete, take the **best of
+> both** (more accessible, tokenized, more reused, better named) as canonical and migrate
+> the rest to it — never leave both. Consolidation is mechanical and verifiable, not
+> vibes: a fresh search for the deprecated form must return zero.
+
+**This skill changes code.** It edits tokens, components, and usages. It is destructive to
+*duplication*, never to *behavior*: the rendered result must stay visually equivalent
+(verified) unless a conflict resolution intentionally upgrades it.
+
+**Before any browser interaction, read `protocol-browser-anti-stall` and apply it.**
+
+---
+
+## Phase 0 — Detect and scope  [HIGH freedom]
+
+### 0a. Consume an existing plan
+
+If a `plan-uiux-unification` plan exists (in `.cursor/plans/` or provided), read it fully —
+this skill is its executor. Otherwise run the detect loop below.
+
+### 0b. Detect the design system
+
+Reuse the `audit-uiux-design-system` Step 0 detection: CSS framework (Tailwind v3/v4, CSS
+Modules, CSS-in-JS), component library (shadcn/Radix/MUI/Chakra/custom), icon library, and
+the token source file(s). Record it.
+
+---
+
+## Phase 1 — Establish the SSOT structure (3-layer tokens)  [HIGH freedom]
+
+Define (or normalize onto) a three-layer token taxonomy — the standard shape for
+drift-proof systems:
+
+| Layer | Role | Example |
+|---|---|---|
+| **Primitive / global** | Raw values, no meaning | `--blue-500: oklch(...)`, `--space-2: 0.5rem` |
+| **Semantic** | Intent, references primitives | `--color-primary: var(--blue-500)`, `--radius-card` |
+| **Component** | Component-scoped, references semantic | `--button-bg: var(--color-primary)` |
+
+Components reference **semantic** tokens, never primitives or raw values. Record the
+canonical token file as the SSOT and note where duplicate/parallel token sets live.
+
+---
+
+## Phase 2 — Detect every conflict (the drift inventory)  [LOW freedom — run the searches exactly]
+
+Search the whole repo (use Shell/`rg`, not the plan's file list) and build a durable
+checklist at `.cursor/housekeep-design-state.md`. Hunt each conflict class:
+
+```bash
+# Raw values that should be tokens
+rg -n "#[0-9a-fA-F]{3,8}|rgb\(|hsl\([^v]" -g "*.{tsx,jsx,css,vue}"
+rg -n "(text|p|m|gap|rounded|w|h)-\[" -g "*.{tsx,jsx}"      # arbitrary values
+# Duplicate / near-duplicate tokens (same value, different name)
+rg -n "^\s*--" -g "*.css"                                    # then group by value
+# Competing component implementations
+rg -n "function (Button|Card|Modal|Dialog|Input|Badge|Tabs)\b" -g "*.{tsx,jsx}" -l
+rg -n "<button |<input |<select |<a " -g "*.{tsx,jsx}"       # raw elements outside ui/
+# Mixed icon libraries
+rg -n "from '(lucide-react|@heroicons|react-icons|@phosphor)" -g "*.{tsx,jsx}" -c
+```
+
+Conflict classes to record:
+- **Token duplication** — same value under multiple names; near-duplicate values (e.g.
+  `#3B82F6` and `#3C82F7`) that should collapse to one.
+- **Naming drift** — visual names (`--blue`) vs semantic (`--primary`); inconsistent scales.
+- **Component duplication** — multiple implementations of the same UI (2 Buttons, 3 Cards).
+- **Raw / arbitrary usage** — hardcoded colors, `text-[13px]`, off-scale spacing/radius.
+- **Mixed icon libraries** — pick one, migrate the rest.
+- **Dark-mode gaps** — tokens without dark variants; hardcoded `bg-white`/`text-black`.
+
+State totals out loud: "Found N conflicts across M files."
+
+---
+
+## Phase 3 — Reconcile: pick the canonical (best-of-both)  [HIGH freedom]
+
+For each conflict, choose the canonical form using explicit criteria, and log the decision
+in a **SSOT decision log** so future contributors know *why*:
+
+Canonical wins if it is (in priority order): **more accessible** → **properly tokenized /
+semantic** → **more widely used already** (least migration churn) → **better named** →
+**more complete** (has all states/variants). When two are equal, keep the one closer to the
+component library's idiom (e.g. shadcn `cva` variants).
+
+```md
+## SSOT decisions (in .cursor/housekeep-design-state.md)
+- Blue: `--color-primary` ← merge `--brand`, `#3B82F6`, `--blue-accent`  (reason: semantic, most used)
+- Button: keep `components/ui/button.tsx` (cva variants) ← remove `components/Button2.tsx`, inline buttons
+- Icons: standardize on `lucide-react` ← migrate 12 `@heroicons` usages
+- Radius: `--radius-card` (8px) ← collapse `rounded-[6px]`, `rounded-lg` in card contexts
+```
+
+STOP and ask the human only when a resolution changes visible behavior/brand in a way the
+plan didn't authorize. Pure de-duplication proceeds.
+
+---
+
+## Phase 4 — Migrate all usages (mechanical, per-batch)  [LOW freedom — run exactly]
+
+Work the checklist in batches of 5–10 files. Batches are independent: when the sweep is large, launch one subagent per batch in one message, each briefed once with its file list and the canonical forms and returning only the files it changed; keep the Phase 6 zero-hit re-search in the main thread. Prefer codemods for coverage you can verify:
+
+- **Token usages:** replace deprecated names/raw values with the canonical token
+  (`rg` → scripted replace, or `eslint --fix` with a custom rule).
+- **Component usages:** replace duplicate/raw components with the canonical import;
+  migrate props to the canonical API.
+- **Icons:** swap import + component name to the chosen library.
+
+Flip each item `[ ]`→`[x]` in the state file **immediately** per batch (survives context
+truncation). For large mechanical sweeps, hand the coverage loop to **`burndown-full`**
+with MATCH=deprecated form, DONE=canonical form — its from-scratch-search gate proves
+completeness. Append any newly discovered occurrences and burn them down too.
+
+---
+
+## Phase 5 — Install guardrails so drift can't recur  [LOW freedom — run exactly]
+
+Consolidation without guardrails regresses in a week. Add:
+
+- **Lint-as-policy:** rules that block off-system styles — no raw hex/`rgb`/`hsl` in
+  components, no arbitrary Tailwind values (`no-restricted-syntax` / a Tailwind lint
+  plugin), single icon library. Wire into the repo's lint step.
+- **Documented escape hatches:** one sanctioned way to add a new token (edit the SSOT
+  file) and to opt out (a commented, reviewed exception) — so the rules don't just get
+  disabled wholesale.
+- Note (do not force) that a visual-regression check (Chromatic/Storybook) in CI is the
+  durable long-term guard; recommend it if Storybook exists.
+
+For a deeper guardrail install (hooks + CI gates), hand off to `enhance-agent-guardrails`.
+
+---
+
+## Phase 6 — Verify and report  [LOW freedom — do not skip]
+
+- **Fresh search:** `rg` for every deprecated form → **zero** hits (except logged
+  exceptions). Any hit → back to Phase 4.
+- **Visual equivalence:** playwright-cli before/after screenshots of key pages in light + dark;
+  confirm no unintended visual change. Save to `.playwright-mcp/`.
+- **Build/typecheck/lint:** run the repo's commands; the new lint rules must pass.
+
+```markdown
+## Design Housekeep — report
+**SSOT:** [token file] · 3-layer taxonomy established
+**Conflicts resolved:** tokens [N→M] · components [N→M] · icons [→1 lib] · arbitrary values [N→0]
+**Decision log:** [N] canonical choices recorded (.cursor/housekeep-design-state.md)
+**Migration:** [M] files updated · deprecated-form search → 0 hits
+**Guardrails:** lint-as-policy added (raw color/arbitrary/icon rules) · escape hatch documented
+**Verification:** build ✓ · lint ✓ · visual before/after equivalent (screenshots [paths])
+```
+
+Leave `.cursor/housekeep-design-state.md` as an audit trail unless asked to delete it.
+
+---
+
+## Related
+
+- `plan-uiux-unification` — produces the plan this skill executes (audit → approve → here)
+- `audit-uiux-design-system` — the read-only audit that surfaces the drift
+- `enhance-agent-guardrails` — deeper guardrail install (hooks, CI gates)
+- `burndown-full` — mechanical repo-wide coverage for the usage migration
+- `enhance-motion` — consolidate motion incoherence as part of the same pass
+- `workflow-housekeep` — the file/dependency counterpart (dead files, README, deps)
+- `design-system` — authoring conventions for the canonical components