@ketecode/loom 0.0.0-stage → 0.2.0

package/package.json

@@ -1,6 +1,63 @@
 {
   "name": "@ketecode/loom",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.2.0",
+  "description": "Kete Loom: curated, tested, portable Agent Skills, subagents, commands, rules, hooks and MCP configs. One source, installable in Claude Code, Codex, OpenCode, Cursor, Gemini CLI, GitHub Copilot, Kete Code and Kiro.",
+  "license": "MIT",
+  "author": "Kete-org <support@ketecode.ai>",
+  "homepage": "https://ketecode.ai",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/kete-org/kete-loom.git"
+  },
+  "bugs": "https://github.com/kete-org/kete-loom/issues",
+  "keywords": [
+    "agent-skills",
+    "skills",
+    "claude-code",
+    "codex",
+    "opencode",
+    "cursor",
+    "gemini-cli",
+    "copilot",
+    "kete-code",
+    "kiro"
+  ],
+  "bin": {
+    "kete-loom": "bin/kete-loom.js"
+  },
+  "files": [
+    "bin/",
+    "scripts/lib/",
+    "skills/",
+    "agents/",
+    "commands/",
+    "hooks/",
+    "rules/",
+    "mcp/",
+    "profiles.json",
+    "schemas/",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "lint": "node scripts/lint-skills.js",
+    "eval": "node scripts/run-evals.js && node scripts/run-behavior-evals.js",
+    "eval:estimate": "node scripts/run-evals.js --estimate",
+    "eval:live": "node scripts/run-evals.js --live",
+    "eval:behavior": "node scripts/run-behavior-evals.js",
+    "test": "node --test",
+    "check": "npm run lint && npm test && npm run eval",
+    "catalog": "node scripts/build-catalog.js",
+    "site": "node scripts/build-site.js",
+    "prepublishOnly": "npm run check"
+  },
+  "devDependencies": {
+    "@anthropic-ai/sdk": "^0.135.0"
+  }
+}

package/profiles.json

@@ -0,0 +1,214 @@
+{
+  "minimal": {
+    "description": "The essentials: test-first work, verification before merge, security review and code review.",
+    "skills": [
+      "tdd-workflow",
+      "verification-loop",
+      "security-review"
+    ],
+    "agents": [
+      "code-reviewer"
+    ],
+    "commands": [
+      "review",
+      "verify"
+    ],
+    "rules": [
+      "common",
+      "security"
+    ]
+  },
+  "core": {
+    "description": "Everyday development: the essentials, planning, git, onboarding and session handoff, plus the language and framework packs this project uses.",
+    "extends": [
+      "minimal"
+    ],
+    "skills": [
+      "search-first",
+      "git-workflow",
+      "conventional-commits",
+      "codebase-onboarding",
+      "session-handoff",
+      "error-handling-patterns",
+      "refactoring-safely"
+    ],
+    "agents": [
+      "planner",
+      "security-reviewer",
+      "refactor-cleaner"
+    ],
+    "commands": [
+      "build-fix",
+      "plan-feature",
+      "commit",
+      "pr-describe",
+      "tdd",
+      "explain",
+      "save-session",
+      "resume-session",
+      "test-coverage"
+    ],
+    "rules": [
+      "testing",
+      "git"
+    ],
+    "detect": true
+  },
+  "developer": {
+    "description": "Core plus the safety hooks: block dangerous commands, --no-verify, edits to protected files and secrets in code.",
+    "extends": [
+      "core"
+    ],
+    "hooks": [
+      "block-dangerous-commands",
+      "block-no-verify",
+      "protect-files",
+      "guard-secrets"
+    ]
+  },
+  "strict": {
+    "description": "Developer plus the opt-in guardrails: read files before editing them, don't weaken lint configs, keep dev servers in the background, and pass lint and type-check before finishing.",
+    "extends": [
+      "developer"
+    ],
+    "hooks": [
+      "read-before-edit",
+      "protect-lint-config",
+      "block-foreground-servers",
+      "verify-before-stop"
+    ]
+  },
+  "method": {
+    "description": "A full development method: design before code, granular plans, a fresh subagent per task with spec and quality review, systematic debugging, rigorous responses to review, worktrees and a clean finish.",
+    "skills": [
+      "design-brainstorming",
+      "implementation-plans",
+      "subagent-driven-development",
+      "systematic-debugging",
+      "tdd-workflow",
+      "verification-loop",
+      "responding-to-code-review",
+      "git-worktrees",
+      "finishing-a-branch"
+    ],
+    "agents": [
+      "planner",
+      "task-implementer",
+      "spec-reviewer",
+      "code-reviewer"
+    ],
+    "commands": [
+      "brainstorm",
+      "plan-feature",
+      "feature-dev",
+      "debug",
+      "verify",
+      "review",
+      "finish-branch"
+    ],
+    "rules": [
+      "use-skills",
+      "common",
+      "testing"
+    ]
+  },
+  "security": {
+    "description": "Security and compliance: every security and compliance item, the essentials, and the four safety hooks.",
+    "extends": [
+      "minimal"
+    ],
+    "categories": [
+      "security",
+      "compliance"
+    ],
+    "commands": [
+      "security-scan",
+      "threat-model",
+      "deps-audit"
+    ],
+    "rules": [
+      "security"
+    ],
+    "hooks": [
+      "block-dangerous-commands",
+      "block-no-verify",
+      "protect-files",
+      "guard-secrets"
+    ]
+  },
+  "ai": {
+    "description": "Building AI features: LLM apps, prompts, evals, RAG, MCP servers, agents and ML, on top of core.",
+    "extends": [
+      "core"
+    ],
+    "categories": [
+      "ai"
+    ]
+  },
+  "data": {
+    "description": "Data work: databases, pipelines, dbt, scraping, dashboards and analysis, on top of core.",
+    "extends": [
+      "core"
+    ],
+    "categories": [
+      "data"
+    ]
+  },
+  "business": {
+    "description": "Founders and product teams: marketing, SEO, research, investor materials, writing, PRDs and operations.",
+    "categories": [
+      "business",
+      "docs"
+    ],
+    "commands": [
+      "prd",
+      "postmortem"
+    ]
+  },
+  "full": {
+    "description": "Everything in Kete Loom, with every hook that isn't opt-in (add those with --hook or the strict profile).",
+    "all": true
+  },
+  "mcp-web": {
+    "description": "MCP pack for web work: Playwright and Chrome DevTools browsers, Context7 library docs, Fetch, Exa web search and Firecrawl scraping.",
+    "mcp": [
+      "playwright",
+      "chrome-devtools",
+      "context7",
+      "fetch",
+      "exa",
+      "firecrawl"
+    ]
+  },
+  "mcp-code": {
+    "description": "MCP pack for code hosting and errors: GitHub, local Git and Sentry.",
+    "mcp": [
+      "github",
+      "git",
+      "sentry"
+    ]
+  },
+  "mcp-team": {
+    "description": "MCP pack for team tools: Linear, Notion and Atlassian (Jira and Confluence).",
+    "mcp": [
+      "linear",
+      "notion",
+      "atlassian"
+    ]
+  },
+  "mcp-cloud": {
+    "description": "MCP pack for cloud and payments: Cloudflare, Vercel, Supabase (read-only) and Stripe.",
+    "mcp": [
+      "cloudflare",
+      "supabase",
+      "stripe",
+      "vercel"
+    ]
+  },
+  "mcp-design": {
+    "description": "MCP pack for design handoff: Figma.",
+    "mcp": [
+      "figma"
+    ]
+  }
+}

package/rules/common.md

@@ -0,0 +1,21 @@
+---
+name: common
+description: Always-on engineering rules for any project, covering scope, verification, honesty about results, safe changes and secrets.
+license: MIT
+metadata:
+  kete-loom/version: "0.1.0"
+  kete-loom/category: coding
+  kete-loom/risk: read-only
+  kete-loom/owner: "Kete-org"
+---
+
+- Read the code you change and the code that calls it before editing. Search for an existing helper before writing a new one.
+- Keep the change to what was asked. Mention other problems you notice instead of fixing them unasked.
+- Match the surrounding code: its naming, structure, error handling and comment style.
+- Prove a change works by running the project's own build, lint and tests. Never claim something passes without having run it.
+- Report results as they are. If a test fails, a step was skipped or you are unsure, say so plainly.
+- Never delete, skip or weaken a test to make a suite pass.
+- Handle errors where they can be handled; never swallow them silently.
+- Never put secrets, tokens or credentials in code, logs, commits or test fixtures. Read them from the environment or a secret store.
+- Ask before anything destructive or hard to undo: deleting data, force-pushing, rewriting history, dropping tables, changing production config.
+- Prefer small, reversible steps. Commit only when the user asks.

package/rules/cpp.md

@@ -0,0 +1,29 @@
+---
+name: cpp
+description: Always-on rules for modern C++ code, covering ownership and RAII, undefined behaviour, bounds and lifetimes, concurrency, headers, and sanitizer-backed build and test checks.
+license: MIT
+metadata:
+  kete-loom/version: "0.1.0"
+  kete-loom/category: coding
+  kete-loom/risk: read-only
+  kete-loom/paths: "**/*.cpp, **/*.cc, **/*.cxx, **/*.c++, **/*.hpp, **/*.hh, **/*.hxx, **/*.h, **/*.ipp, **/*.ixx, **/*.cppm"
+  kete-loom/owner: "Kete-org"
+---
+
+- Write to the C++ standard the project's build sets; do not use features newer than it.
+- Manage every resource with RAII. Never use raw `new`/`delete` for ownership; use `std::make_unique`, `std::make_shared` or a container.
+- Use `std::unique_ptr` by default; reach for `std::shared_ptr` only for genuinely shared ownership. Raw pointers and references never own.
+- Follow the rule of zero; if you write one of destructor, copy or move operations, define or delete all five.
+- Never return or store a reference, pointer, `std::string_view` or `std::span` to a local or temporary that will die first.
+- Never use an iterator, pointer or reference into a container after an operation that may invalidate it, such as `push_back` or `erase`.
+- Check bounds on untrusted indices; never index past the end. Prefer `std::array`, `std::vector` and `std::string` over C arrays and `char*` buffers.
+- Never use `strcpy`, `sprintf`, `gets` or other unbounded C string functions.
+- Initialize every variable, and avoid signed overflow, unchecked narrowing and C-style casts; use `static_cast` and friends.
+- Guard all shared mutable state with `std::mutex` and `std::lock_guard`/`std::scoped_lock`, or `std::atomic`; a data race is undefined behaviour.
+- Mark functions `noexcept` only when they truly cannot throw, and destructors must never throw.
+- Mark overriding functions `override`, give polymorphic bases a virtual or protected destructor, and make single-argument constructors `explicit`.
+- Never put `using namespace` in a header; use include guards or `#pragma once` as the project does.
+- Build with warnings on (for example `-Wall -Wextra`) and fix them; run tests under AddressSanitizer and UndefinedBehaviorSanitizer (`-fsanitize=address,undefined`) when the toolchain supports them.
+- Use the project's configured build system, formatter and test framework.
+
+For more, load the cpp-patterns and cpp-testing skills.

package/rules/csharp.md

@@ -0,0 +1,25 @@
+---
+name: csharp
+description: Always-on rules for C# and .NET code, covering nullable reference types, async and await, disposal, exceptions, data access safety, and build and test checks.
+license: MIT
+metadata:
+  kete-loom/version: "0.1.0"
+  kete-loom/category: coding
+  kete-loom/risk: read-only
+  kete-loom/paths: "**/*.cs"
+  kete-loom/owner: "Kete-org"
+---
+
+- Keep nullable reference types enabled and fix nullable warnings; never silence them with `!` unless the value is proven non-null.
+- Never block on async code with `.Result`, `.Wait()` or `.GetAwaiter().GetResult()`; use `await` all the way up.
+- Never write `async void` except for event handlers. Return `Task` or `ValueTask`.
+- Accept a `CancellationToken` in async APIs that do I/O and pass it to every call that takes one.
+- Dispose every `IDisposable` with `using` or `await using`; never leave a stream, connection or reader open.
+- Do not create a new `HttpClient` per request; use `IHttpClientFactory` or a shared instance.
+- Throw specific exceptions and rethrow with `throw;`, never `throw ex;`, which loses the stack trace.
+- Never build SQL by string concatenation or interpolation; use parameters or the ORM's parameterized APIs.
+- Never deserialize untrusted data with `BinaryFormatter` or with type-name handling (such as Newtonsoft `TypeNameHandling` other than `None`) that lets the payload choose the type.
+- Avoid enumerating an `IEnumerable<T>` or LINQ query more than once; materialize it with `ToList()` when you need it twice.
+- Run `dotnet build` with warnings visible and `dotnet test`, and use the project's configured formatter and analyzers.
+
+For more, load the csharp-patterns and csharp-testing skills.

package/rules/dart.md

@@ -0,0 +1,29 @@
+---
+name: dart
+description: Always-on rules for Dart and Flutter code, covering null safety, async, widget lifecycle, analysis, formatting and tests.
+license: MIT
+metadata:
+  kete-loom/version: "0.1.0"
+  kete-loom/category: coding
+  kete-loom/risk: read-only
+  kete-loom/paths: "**/*.dart"
+  kete-loom/owner: "Kete-org"
+---
+
+- Run `dart analyze` (or `flutter analyze`) and fix every issue you introduce. Respect the project's `analysis_options.yaml`; never add `// ignore:` to silence a real problem.
+- Format with `dart format`. Do not hand-format against it.
+- Make a type nullable only when absence is a real state. Promote with a null check or a local copy; use `!` only for an invariant the analyzer cannot see, never to silence an error.
+- Use `late` only when the value is always set before first read; reading it earlier throws at runtime.
+- Never `as`-cast decoded JSON blindly; check shape and types (patterns or explicit checks) before use.
+- Await every `Future` or mark intentional fire-and-forget with `unawaited(...)`. Unawaited errors escape every `try`.
+- Catch specific types with `on`, and use `rethrow` (not `throw e`) to keep the stack trace.
+- Don't add a `_` default to a switch over a sealed type or enum; it hides new cases from the exhaustiveness check.
+- In Flutter, check `mounted` (or `context.mounted`) after any `await` before using `BuildContext` or calling `setState`.
+- In `dispose()`, dispose every controller and `FocusNode` you create and cancel every `StreamSubscription` and `Timer`.
+- Never do I/O or heavy work in `build()`; it must be fast and side-effect free.
+- Use the project's state management and routing approach; do not introduce a new one.
+- Give list items in reorderable or stateful lists a stable `Key`.
+- Never ship secrets in an app, in source or via `--dart-define`; anything in the binary is readable.
+- Add or update tests with `package:test` or `flutter_test` for changed logic; run `dart test` or `flutter test`.
+
+For more, load the dart-patterns, dart-testing and flutter-patterns skills.

package/rules/fsharp.md

@@ -0,0 +1,28 @@
+---
+name: fsharp
+description: Always-on rules for F# code, covering immutability, discriminated unions and exhaustive matching, Option and Result, async and task code, .NET interop, and checks.
+license: MIT
+metadata:
+  kete-loom/version: "0.1.0"
+  kete-loom/category: coding
+  kete-loom/risk: read-only
+  kete-loom/paths: "**/*.fs, **/*.fsi, **/*.fsx"
+  kete-loom/owner: "Kete-org"
+---
+
+- Prefer immutable values, records and F# collections; use `mutable` or `ref` only for local, contained state.
+- Model closed sets of cases with discriminated unions and match them exhaustively; never ignore incomplete-match warnings.
+- Avoid the wildcard `_` case over a union you own, so a new case is a compile warning at every match.
+- Use `Option` for absence and `Result` for expected failures; keep exceptions for truly exceptional conditions.
+- Never call `Option.get`, `List.head` or `.Value` on something that can be empty; match on it or use a safe function such as `List.tryHead`.
+- Convert nulls from .NET APIs at the boundary with `Option.ofObj` or `Option.ofNullable`.
+- Keep file order in the project file meaningful: a file only uses what is defined above it, so put new types before their users.
+- Never block on async work with `Async.RunSynchronously` or `.Result` inside library or server code; compose with `async { }` or `task { }`.
+- Pass a `CancellationToken` through async and task workflows that do I/O.
+- Dispose resources with `use` or `use!`, not `let`.
+- Never build SQL by string concatenation; use parameters or the data library's parameterized API.
+- Annotate parameter and return types on public functions so an inference change cannot silently change the API.
+- Treat compiler warnings as errors where the project does, and run `dotnet build` and `dotnet test` before finishing.
+- Use the project's configured formatter and test framework.
+
+For more, load the fsharp-patterns and fsharp-testing skills.

package/rules/git.md

@@ -0,0 +1,26 @@
+---
+name: git
+description: Always-on git hygiene rules for agents, covering small focused commits, Conventional Commits messages, keeping secrets and generated files out, safe pushing and never rewriting shared history.
+license: MIT
+metadata:
+  kete-loom/version: "0.1.0"
+  kete-loom/category: devops
+  kete-loom/risk: read-only
+  kete-loom/owner: "Kete-org"
+---
+
+- Never commit directly to the default branch unless that is the project's workflow; branch first.
+- Run `git status` and `git diff --staged` before every commit and check that only the intended changes are staged.
+- Stage files by name. Avoid `git add -A` or `git add .` when unrelated or untracked files are present.
+- Keep each commit small and focused on one logical change that builds and passes tests on its own.
+- Follow the project's commit message convention (check recent `git log`); if it has none, use Conventional Commits, `type(scope): summary`. Write the summary in the imperative and add a body that explains why when the reason is not obvious.
+- Never commit secrets, `.env` files, credentials, private keys or personal data. If one was committed, stop and tell the user; removing it from history does not un-leak it, so it must be rotated.
+- Never commit build output, dependency folders, caches or editor files. Keep lockfiles the project already tracks in sync with its manifest.
+- Never skip hooks with `--no-verify`. If a hook fails, fix the cause and commit again; do not amend an earlier commit to work around it.
+- Never force-push a shared branch or rewrite published history. On your own branch, use `--force-with-lease`, never plain `--force`.
+- Never run destructive commands (`reset --hard`, `clean -fd`, `checkout -- .`, `branch -D`, `stash drop`) without the user's consent; they discard uncommitted work.
+- Do not change git config, remotes or signing settings unless asked.
+- Use non-interactive commands; avoid flags that open an editor or prompt, such as `rebase -i` or `add -p`.
+- Resolve merge conflicts by reading both sides; never accept one side wholesale to make the conflict go away.
+
+For more, load the git-workflow and conventional-commits skills.

package/rules/go.md

@@ -0,0 +1,29 @@
+---
+name: go
+description: Always-on rules for Go files, covering formatting, vet, error handling, context, goroutine and resource lifetimes, and concurrency safety.
+license: MIT
+metadata:
+  kete-loom/version: "0.1.0"
+  kete-loom/category: coding
+  kete-loom/risk: read-only
+  kete-loom/paths: "**/*.go"
+  kete-loom/owner: "Kete-org"
+---
+
+- Format with `gofmt` (or the project's `goimports`). Run `go vet ./...` and `go test ./...` after a change, plus the project's configured linter.
+- Run tests with `-race` when the code uses goroutines or shared state.
+- Check every returned error. Never discard one with `_` unless a comment says why.
+- Wrap errors with context using `fmt.Errorf("doing x: %w", err)`, and inspect them with `errors.Is` and `errors.As`, never by comparing strings.
+- Handle an error or return it, not both: do not log and then return the same error.
+- Never `panic` for expected failures in library code; return an error.
+- Pass `context.Context` as the first parameter of anything that does I/O or may block, and honour its cancellation. Never store it in a struct.
+- `defer` the `Close` of files, response bodies and rows right after the error check; check `rows.Err()` after iterating.
+- Give every goroutine a way to stop (context, closed channel or `sync.WaitGroup`). Never start one you cannot end.
+- Protect shared state with a mutex or channels. Never copy a value that contains a `sync.Mutex`.
+- Only the sender closes a channel. Never close a channel twice or send on a closed one.
+- Set a timeout on outbound HTTP calls (client `Timeout` or a context deadline); `http.Get` and `http.DefaultClient` have none. Set `ReadHeaderTimeout` on `http.Server`.
+- Use parameterized queries in `database/sql`; never build SQL with `fmt.Sprintf`.
+- Pass `exec.Command` separate arguments; never run `sh -c` with a string built from input.
+- Keep `go.mod` and `go.sum` tidy with `go mod tidy`; never edit `go.sum` by hand.
+
+For more, load the go-patterns and go-testing skills.

package/rules/java.md

@@ -0,0 +1,29 @@
+---
+name: java
+description: Always-on rules for Java files, covering build tooling, null handling, exceptions, resources, concurrency and injection safety.
+license: MIT
+metadata:
+  kete-loom/version: "0.1.0"
+  kete-loom/category: coding
+  kete-loom/risk: read-only
+  kete-loom/paths: "**/*.java"
+  kete-loom/owner: "Kete-org"
+---
+
+- Use the project's build tool through its wrapper (`./mvnw` or `./gradlew`), not a globally installed `mvn` or `gradle`.
+- Use the project's configured formatter and static analysis; never disable a check to make the build pass.
+- Use `try`-with-resources for streams, readers, connections and statements so they always close.
+- Never catch and ignore an exception. Catch the narrowest type, and pass the original as the cause when wrapping.
+- Never catch `Throwable` or `Error`; when catching `InterruptedException`, restore the flag with `Thread.currentThread().interrupt()`.
+- Return empty collections or `Optional`, not `null`. Use `Optional` only as a return type, never for fields or parameters.
+- Validate parameters at public boundaries with `Objects.requireNonNull` or explicit checks.
+- Override `equals` and `hashCode` together, never one alone.
+- Compare strings and boxed numbers with `equals`, never `==`.
+- Pass an explicit `Charset` (`StandardCharsets.UTF_8`) when converting bytes and text.
+- Use `java.time` (`Instant`, `LocalDate`, `ZonedDateTime`), never `Date` or `Calendar` in new code.
+- Use `PreparedStatement` or the framework's parameter binding; never concatenate user input into SQL or JPQL. Run processes with `ProcessBuilder` and an argument list.
+- Never deserialize untrusted data with `ObjectInputStream`. Disable external entities when parsing untrusted XML.
+- Run concurrent work on an `ExecutorService` (or the framework's executor) and shut it down, rather than unmanaged `new Thread(...)`. Guard shared mutable state with `java.util.concurrent` types or locks.
+- Use `SecureRandom`, not `Random`, for tokens and keys.
+
+For more, load the java-patterns and java-testing skills.

package/rules/kotlin.md

@@ -0,0 +1,27 @@
+---
+name: kotlin
+description: Always-on rules for Kotlin code, covering null safety, sealed types, coroutines and structured concurrency, Java interop, and build and test checks.
+license: MIT
+metadata:
+  kete-loom/version: "0.1.0"
+  kete-loom/category: coding
+  kete-loom/risk: read-only
+  kete-loom/paths: "**/*.kt, **/*.kts"
+  kete-loom/owner: "Kete-org"
+---
+
+- Never use `!!` in new code. Use `?:` with an early return or error, `requireNotNull`/`checkNotNull`, or a non-null type validated at the boundary.
+- Give values from unannotated Java APIs an explicit Kotlin type at the call site so a null fails where it enters.
+- Use `lateinit var` only for values a framework sets before first use, never for values that can be missing.
+- Prefer `val` and read-only collection types; never put mutable collections in a `data class`, since `copy()` shares them.
+- Model closed sets of states with `sealed interface` or `sealed class`, and match them with `when` as an expression with no `else`.
+- Never use `GlobalScope`. Launch coroutines in a scope tied to a lifecycle and let structured concurrency cancel them.
+- Never block a coroutine thread with `Thread.sleep` or blocking I/O; use `delay`, suspending APIs, or `withContext(Dispatchers.IO)`.
+- Never swallow `CancellationException`. When catching `Exception` or `Throwable` (or using `runCatching`) in suspending code, rethrow it.
+- Do not use `runBlocking` in production code paths; keep it to `main` and tests that cannot use `runTest`.
+- Make shared mutable state safe with `Mutex`, atomics or confinement to one dispatcher; never mutate it from several coroutines unguarded.
+- Use `use { }` on every `Closeable` so it is closed on all paths.
+- Use the project's configured build (Gradle or Maven), formatter and linter, and run its tests before finishing.
+- Test suspending code with `runTest` from kotlinx-coroutines-test, not `runBlocking` with real delays.
+
+For more, load the kotlin-patterns and kotlin-testing skills.

package/rules/perl.md

@@ -0,0 +1,26 @@
+---
+name: perl
+description: Always-on rules for modern Perl 5 code, covering strict and warnings, lexical scope, safe open and system calls, untrusted input, SQL, encoding and tests.
+license: MIT
+metadata:
+  kete-loom/version: "0.1.0"
+  kete-loom/category: coding
+  kete-loom/risk: read-only
+  kete-loom/paths: "**/*.pl, **/*.pm, **/*.t, **/*.psgi"
+  kete-loom/owner: "Kete-org"
+---
+
+- Start every file with `use strict;` and `use warnings;` (or the project's equivalent bundle, such as `use v5.36;`).
+- Declare variables with `my` in the smallest scope. Never use undeclared globals; use `our` only for package interfaces.
+- Use three-argument `open` with a lexical filehandle and check it: `open(my $fh, '<', $path) or die "Can't open $path: $!";`.
+- Check the result of every system call (`open`, `close`, `mkdir`, `unlink`, `rename`) and include `$!` in the error, or `use autodie`.
+- Call external programs with list-form `system` or `exec` (`system('cmd', @args)`), never one interpolated string. Check `$?` afterwards.
+- Never pass untrusted input to string `eval`, two-argument `open`, or backticks. Catch exceptions with block `eval { }` or the project's try/catch module.
+- Localise special variables (`local $_`, `local $/`) when you change them.
+- Use placeholders (`?`) with DBI `prepare`/`execute`; never interpolate values into SQL.
+- Pass and return complex data by reference; don't flatten hashes and arrays you need to keep separate.
+- Decode input and encode output explicitly (`use utf8;` when the source has non-ASCII text, `:encoding(UTF-8)` layers on handles).
+- Run `perl -c` and the project's configured Perl::Critic and Perl::Tidy settings on changed files.
+- Write tests in `t/*.t` with `Test::More` (or the project's framework), end with `done_testing`, and run them with `prove -lr t`.
+
+For more, load the perl-patterns and perl-testing skills.

package/rules/php.md

@@ -0,0 +1,28 @@
+---
+name: php
+description: Always-on rules for modern PHP 8 code, covering strict types, typed signatures, input handling, SQL, errors, Composer and tests.
+license: MIT
+metadata:
+  kete-loom/version: "0.1.0"
+  kete-loom/category: coding
+  kete-loom/risk: read-only
+  kete-loom/paths: "**/*.php"
+  kete-loom/owner: "Kete-org"
+---
+
+- Start new files with `declare(strict_types=1);` and match existing files that already use it.
+- Type every parameter, return and property. Use `?T` or union types only when null or another type is a real state.
+- Use enums for fixed sets of values when the project's PHP version supports them (8.1+), not loose strings.
+- Compare with `===` and `!==`. Use `match` over `switch` when mapping values; it compares strictly and throws `UnhandledMatchError` on no match.
+- Never build SQL by string concatenation. Use prepared statements with bound parameters (PDO or the project's query builder/ORM).
+- Escape output for its context: `htmlspecialchars($v, ENT_QUOTES, 'UTF-8')` for HTML, or the template engine's auto-escaping.
+- Never pass user input to `eval`, `include`/`require`, `unserialize`, `exec`, `shell_exec` or `system`. Use `json_decode` for untrusted data and `escapeshellarg` if a shell is unavoidable.
+- Hash passwords with `password_hash` and check with `password_verify`. Use `random_bytes`/`random_int` for tokens, never `rand` or `mt_rand`.
+- Throw specific exceptions and catch them where you can act. Never suppress errors with `@`.
+- Run the project's configured formatter and code style tool; keep classes in PSR-4 autoload paths (one class per file, namespace matches directory).
+- Run the project's static analyser (PHPStan or Psalm) at its configured level and fix what you introduce.
+- Add dependencies with `composer require`, commit `composer.lock` in applications, and never edit `vendor/`.
+- Validate request input at the boundary; never trust `$_GET`, `$_POST`, `$_COOKIE` or headers.
+- Add or update tests with the project's test framework (PHPUnit or Pest) and run them.
+
+For more, load the php-patterns, php-testing and laravel-patterns skills.

package/rules/python.md

@@ -0,0 +1,30 @@
+---
+name: python
+description: Always-on rules for Python 3 files, covering environments, type hints, exceptions, resource handling, untrusted input and the project's own tooling.
+license: MIT
+metadata:
+  kete-loom/version: "0.1.0"
+  kete-loom/category: coding
+  kete-loom/risk: read-only
+  kete-loom/paths: "**/*.py, **/*.pyi"
+  kete-loom/owner: "Kete-org"
+---
+
+- Use the project's environment and dependency tool (its lockfile or `pyproject.toml` shows which). Never install packages into the system Python.
+- Use the project's configured formatter, linter, type checker and test runner, and run them after a change.
+- Where the project uses type hints, add them to new and changed function signatures. Never use `# type: ignore` without a specific error code and a reason.
+- Never use a mutable default argument (`def f(x=[])`); default to `None` and create the value inside.
+- Never use a bare `except:` or `except Exception: pass`. Catch the narrowest exception, and use `raise ... from err` when wrapping.
+- Open files, locks, connections and sockets with `with` so they always close.
+- Pass `encoding="utf-8"` when opening text files.
+- Resolve any path built from user input and check it stays inside the allowed directory before using it.
+- Never pass user input to `eval`, `exec`, `pickle.loads`, `yaml.load` without `SafeLoader`, or `subprocess` with `shell=True`. Pass `subprocess` an argument list.
+- Use parameterized queries; never format SQL with f-strings or `%`.
+- Use `secrets`, not `random`, for tokens and passwords.
+- Use timezone-aware datetimes (`datetime.now(timezone.utc)`); never compare naive and aware values.
+- Use `logging` in library code, not `print`.
+- Set a timeout on every network call; `requests` and `urllib` wait forever by default.
+- Never call blocking I/O inside `async def`; use an async library or `asyncio.to_thread`.
+- Compare to `None` with `is` / `is not`.
+
+For more, load the python-patterns and python-testing skills.

package/rules/ruby.md

@@ -0,0 +1,27 @@
+---
+name: ruby
+description: Always-on rules for Ruby code, covering style, nil handling, exceptions, unsafe input, Bundler, Rails safety and tests.
+license: MIT
+metadata:
+  kete-loom/version: "0.1.0"
+  kete-loom/category: coding
+  kete-loom/risk: read-only
+  kete-loom/paths: "**/*.rb, **/*.rake, **/*.erb, **/*.gemspec, **/Gemfile, **/Rakefile"
+  kete-loom/owner: "Kete-org"
+---
+
+- Run the project's configured linter and formatter (RuboCop or Standard) and fix what you introduce. Don't add inline disables to hide real problems.
+- Match the project's use of `# frozen_string_literal: true`; don't mutate string literals.
+- Handle `nil` explicitly. Use `fetch` for required keys so a missing key raises instead of returning `nil`; use `&.` only where `nil` is a valid state.
+- Rescue specific exception classes. Never `rescue Exception` (it catches `Interrupt` and `SystemExit`); re-raise with bare `raise` when you can't handle it.
+- Use `ensure` or block forms (`File.open { }`) so resources are always released.
+- Never pass user input to `eval`, `instance_eval`, `send`, `public_send`, `constantize` or `Object.const_get` without an allowlist.
+- Call shell commands with argument arrays (`system("cmd", arg)`, `Open3.capture3("cmd", arg)`), never interpolated strings or backticks.
+- Never use `Marshal.load` or `YAML.load` on untrusted data; use `JSON.parse` or `YAML.safe_load`.
+- In Rails, never interpolate into SQL; use `where(name: v)` or bound placeholders. Permit params with strong parameters, never `permit!`.
+- In Rails views, never call `html_safe` or `raw` on user input; let ERB escape it.
+- In Rails, avoid N+1 queries with `includes`/`preload`, and change the schema only through migrations.
+- Add gems through the `Gemfile` with Bundler and commit `Gemfile.lock`. Run commands with `bundle exec`.
+- Add or update tests with the project's framework (RSpec or Minitest) and run them.
+
+For more, load the ruby-patterns, ruby-testing and rails-patterns skills.