@ketecode/loom 0.1.0 → 0.2.0

package/README.md

@@ -5,7 +5,11 @@
 <h1 align="center">Kete Loom</h1>
 
 <p align="center"><strong>Curated, tested Agent Skills, subagents and commands for coding agents.</strong><br/>
-One source. Installs unchanged in Claude Code, Codex, OpenCode, Cursor, Gemini CLI, GitHub Copilot and Kete Code.</p>
+One source. Installs unchanged in Claude Code, Codex, OpenCode, Cursor, Gemini CLI, GitHub Copilot, Kete Code and Kiro.</p>
+
+<!-- counts:start -->
+<p align="center">211 skills · 59 agents · 46 commands · 19 rules · 12 hooks · 20 MCP servers</p>
+<!-- counts:end -->
 
 <!-- languages:start -->
 <p align="center"><a href="README.md">English</a> · <a href="docs/i18n/README.ar.md">العربية</a> · <a href="docs/i18n/README.de.md">Deutsch</a> · <a href="docs/i18n/README.es.md">Español</a> · <a href="docs/i18n/README.fr.md">Français</a> · <a href="docs/i18n/README.ja.md">日本語</a> · <a href="docs/i18n/README.pt-BR.md">Português (Brasil)</a> · <a href="docs/i18n/README.sw.md">Kiswahili</a> · <a href="docs/i18n/README.zh-CN.md">简体中文</a> · <a href="https://kete-org.github.io/kete-loom/">Browse the catalog ↗</a></p>
@@ -13,10 +17,10 @@ One source. Installs unchanged in Claude Code, Codex, OpenCode, Cursor, Gemini C
 
 ---
 
-Kete Loom is the skills library behind [Kete Code](https://ketecode.ai). It ships three kinds of items: **skills** (folders the agent loads when relevant), **agents** (subagents it delegates to) and **commands** (slash commands you type). It takes a quality-first approach: fewer items, and every one of them is
+Kete Loom is the skills library behind [Kete Code](https://ketecode.ai). It ships **skills** (folders the agent loads when relevant), **agents** (subagents it delegates to), **commands** (slash commands you type), **rules** (short always-on guidance), **hooks** (checks that run around the agent's tool calls and when it finishes) and **MCP server configs**. It takes a quality-first approach: fewer items, and every one of them is
 
 - **portable**: uses the strictest common subset of the [Agent Skills](https://agentskills.io) format, so no host rejects it;
-- **tested**: skills and agents ship trigger evals that check they load for the right requests and stay out of the way for the wrong ones;
+- **tested**: skills and agents ship trigger evals that check they load for the right requests and stay out of the way for the wrong ones, and the discipline skills add behaviour evals that check the agent actually follows them under pressure, compared with a run without the skill;
 - **short**: under 300 lines, with detail moved into `references/` that the agent reads only when needed;
 - **versioned and labelled**: semver, category and a risk level (`read-only`, `writes-files`, `runs-commands`, `network`) in its metadata;
 - **script-backed** where the work is deterministic.
@@ -29,7 +33,7 @@ Kete Loom is the skills library behind [Kete Code](https://ketecode.ai). It ship
 npx @ketecode/loom install
 ```
 
-This installs every skill into `~/.agents/skills` (read by Codex, OpenCode, Cursor, Gemini CLI, GitHub Copilot and Kete Code) and `~/.claude/skills` (Claude Code). Agents and commands go into `~/.claude/agents` and `~/.claude/commands` (read by Claude Code, and for agents also Cursor and VS Code Copilot), and into Codex, OpenCode, Gemini CLI and Kete Code's own folders when those hosts are installed. Each agent and command is converted to the format its host expects. Restart your agent afterwards.
+This installs every skill into `~/.agents/skills` (read by Codex, OpenCode, Cursor, Gemini CLI, GitHub Copilot and Kete Code) and `~/.claude/skills` (Claude Code). Agents and commands go into `~/.claude/agents` and `~/.claude/commands` (read by Claude Code, and for agents also Cursor and VS Code Copilot), and into Codex, OpenCode, Gemini CLI, Kete Code and Kiro's own folders when those hosts are installed (Kiro also gets its own copy of the skills). Each agent and command is converted to the format its host expects. Restart your agent afterwards.
 
 Or pick a profile instead of installing everything:
 
@@ -38,10 +42,12 @@ Or pick a profile instead of installing everything:
 | `minimal` | Test-first work, verification, security review, code review |
 | `core` | The essentials, planning, git, onboarding and session handoff, **plus the language and framework packs your project uses** (detected from `package.json`, `go.mod`, `pyproject.toml`, `Cargo.toml`, `Dockerfile` and so on) |
 | `developer` | `core` plus the four safety hooks |
+| `strict` | `developer` plus the opt-in guardrails: read before edit, protected lint configs, background dev servers, lint and type-check before finishing |
+| `method` | A full development method: design before code, granular plans, a fresh subagent per task with spec and quality review, systematic debugging, responding to review, worktrees and a clean finish |
 | `security` | Every security and compliance item, plus the safety hooks |
 | `ai`, `data` | `core` plus every AI or data item |
 | `business` | Marketing, research, investor, writing, PRD and operations skills |
-| `full` | Everything, including every hook |
+| `full` | Everything, with every hook that isn't opt-in |
 
 ```bash
 npx @ketecode/loom install --profile developer     # run it inside your project so detection sees it
@@ -83,15 +89,35 @@ irm https://raw.githubusercontent.com/Kete-org/kete-loom/main/install.ps1 | iex
 
 Plugin installs update through the host's own plugin manager. Use either a plugin install or the `npx` installer for a given host, not both, or the host may list each skill twice.
 
+## A development method
+
+Install `--profile method` for a complete way of working, from idea to merged branch, with a review gate at each step:
+
+| Step | Use | What happens |
+|---|---|---|
+| 1. Design | `/brainstorm` (`design-brainstorming`) | One question at a time, two or three approaches with trade-offs, your approval section by section, HTML mockups for visual choices, then a design doc in the repo. |
+| 2. Isolate | `git-worktrees` | A separate, git-ignored worktree with dependencies installed and a baseline test run, so existing failures are known. |
+| 3. Plan | `/plan-feature` (`implementation-plans`) | Tasks of a few minutes each, with exact files, the failing test to write first, the command to run and its expected output, and a commit per task. |
+| 4. Build | `subagent-driven-development` with the `task-implementer` agent | A fresh subagent per task works test-first and reports a status. The `spec-reviewer` checks it against the task, then `code-reviewer` checks its quality, looping until both pass. |
+| 5. Debug | `/debug` (`systematic-debugging`) | Root cause before any fix: reproduce, trace the bad value to its source, one hypothesis at a time. After three failed fixes it stops and questions the design. |
+| 6. Review | `responding-to-code-review` | Checks each comment against the code, pushes back with evidence when a suggestion is wrong, and replies in the review thread. |
+| 7. Finish | `/finish-branch` (`finishing-a-branch`) | Tests first, then merge locally, open a pull request, keep the branch, or discard it (only after you type a confirmation). |
+
+`/feature-dev` runs the whole sequence with a stop for your approval between stages, and the `use-skills` rule keeps the agent reaching for these skills instead of working from memory.
+
 ## Skills
 
 <!-- catalog:start -->
 | Name | Category | Risk | What it does |
 |---|---|---|---|
 | [`accounting-api-integration`](skills/accounting-api-integration/SKILL.md) | integrations | network | Connects an application's sales and payments to QuickBooks Online and Xero through their accounting APIs, handling the OAuth 2.0 authorisation code flow with rotating refresh tokens, per-company realm or tenant IDs, chart of accounts and tax code mapping, posting customers, invoices, payments and credit notes, safe retries with requestid or Idempotency-Key, HMAC-verified webhooks, 429 rate-limit backoff, and nightly reconciliation against the ledger. |
+| [`agent-failure-debugging`](skills/agent-failure-debugging/SKILL.md) | ai | runs-commands | Post-mortem for a single failed or poor LLM agent run, reading its transcript, tool-call log or trace to find the first step where it went wrong, sorting the cause into a fixed taxonomy (tool loop, tool error mishandled, context lost or overflowed, ambiguous or conflicting instructions, wrong tool chosen, missing tool or permission, model limit), then changing the prompt, tool definitions or harness and re-running the same task to prove the fix. |
 | [`agent-harness-design`](skills/agent-harness-design/SKILL.md) | ai | writes-files | Architecture for the loop around an LLM agent, covering which tools to give it, how to manage and compact its context window, plan-act-verify cycles, permission tiers and sandboxing, tracing and cost limits, and recovery when steps fail or the agent loops. |
+| [`agent-outbound-messaging`](skills/agent-outbound-messaging/SKILL.md) | ai | network | Send policy for AI agents that write to people over email, Slack, Teams, SMS, issue trackers or social channels, sorting every message by audience (internal, external, public) before it is written, gating @-mentions, @channel and @here broadcasts and mass sends, requiring a draft-then-approve step for anything leaving the organisation, stripping internal context, secrets and other people's personal data, and keeping an audit log of what was sent, to whom and who approved it. |
+| [`agent-security`](skills/agent-security/SKILL.md) | security | writes-files | Hardens AI coding agents and their configuration against hijacking and overreach, tracing prompt-injection paths through tool output, fetched web pages and repository files, cutting shell and tool permissions to least privilege, pinning and vetting MCP servers before they are added, keeping secrets out of the agent's reach, and putting spend caps and human approval on agents that can move money or sign wallet transactions. |
 | [`ai-media-generation`](skills/ai-media-generation/SKILL.md) | ai | network | Product features built on hosted generative image, video, speech and music models, including prompt templates with fixed parameters and seeds, long-running jobs submitted then polled or confirmed by signed webhooks, per-user quotas and cost estimates before submission, input and output moderation, C2PA content credentials and AI-generated labels, and copying results to your own storage before provider URLs expire. |
 | [`angular-patterns`](skills/angular-patterns/SKILL.md) | coding | runs-commands | Modern Angular guidance for standalone components, signal state with input(), output(), model(), computed and effect, RxJS subscriptions that cannot leak, OnPush and zoneless change detection, inject()-based dependency injection, typed reactive or signal forms, and TestBed component tests. |
+| [`api-client-integration`](skills/api-client-integration/SKILL.md) | integrations | network | Builds a dependable client or connector for any third-party HTTP API that has no dedicated Kete Loom skill, covering API-key and OAuth 2.0 auth with single-flight token refresh, connect and read timeouts, retries with exponential backoff and jitter limited to idempotent calls or calls carrying an idempotency key, Retry-After and rate-limit headers, cursor, offset and Link-header pagination, HMAC webhook signature checks on the raw body, and recorded-response contract tests, all shaped to the integration patterns the repo already uses. |
 | [`api-design`](skills/api-design/SKILL.md) | coding | writes-files | HTTP API contract design covering resource modelling, REST versus RPC-style endpoints, status codes and RFC 9457 problem details, cursor pagination, filtering, versioning and deprecation headers, Idempotency-Key retries, OpenAPI-first contracts, and when GraphQL is worth it. |
 | [`architecture-decision-records`](skills/architecture-decision-records/SKILL.md) | docs | writes-files | Writes and maintains Architecture Decision Records (ADRs), deciding whether a choice deserves one, filling a short template (Nygard sections plus options considered) with context, the options weighed, the decision and its consequences, numbering and storing it next to the code, and superseding old records instead of rewriting them. |
 | [`article-writing`](skills/article-writing/SKILL.md) | business | read-only | Long-form article and blog post writing, from choosing a sharp angle and outlining, through gathering evidence and drafting in plain prose, to a structured editing pass and a final headline, summary and meta description. |
@@ -103,9 +129,12 @@ Plugin installs update through the host's own plugin manager. Use either a plugi
 | [`benchmark-methodology`](skills/benchmark-methodology/SKILL.md) | testing | runs-commands | Designs and runs performance benchmarks whose numbers hold up, with warmup, enough iterations, medians and p95/p99 with spread, a quiet and pinned machine, interleaved before/after comparison with a significance check, and guards against dead-code elimination and other microbenchmark traps in Go, JMH, BenchmarkDotNet, Criterion, pytest-benchmark and JS. |
 | [`bgp-diagnostics`](skills/bgp-diagnostics/SKILL.md) | devops | read-only | Diagnoses Border Gateway Protocol problems on Cisco, Juniper, Arista and FRR routers by reading neighbor state (Idle, Active, OpenSent, Established) and NOTIFICATION codes, checking which prefixes are received, accepted and advertised through prefix-lists, route-maps and max-prefix limits, walking best-path selection, decoding standard and large communities, spotting RPKI-invalid or leaked routes, and confirming what the internet sees from RIPEstat, RouteViews and other looking glasses. |
 | [`bioinformatics-workflows`](skills/bioinformatics-workflows/SKILL.md) | data | runs-commands | Bioinformatics pipeline work on FASTA, FASTQ, SAM/BAM/CRAM and VCF files with Biopython, samtools, bcftools, seqkit, FastQC, aligners such as bwa-mem2 and minimap2, and Snakemake or Nextflow workflows run in pinned conda, Docker or Apptainer environments so results reproduce. |
+| [`blender-automation`](skills/blender-automation/SKILL.md) | coding | runs-commands | Scripts Blender through its bpy Python API and command line - inspecting armatures, bone hierarchies, rest and pose transforms, constraints and vertex groups, diagnosing broken rigs and retargeted animation (wrong bone roll, scale on the armature, mismatched rest poses, missing action slots), editing actions and F-Curves through layers, strips and channelbags, batch-editing objects, materials and modifiers across many .blend files, and rendering headless with blender -b. |
+| [`brand-strategy`](skills/brand-strategy/SKILL.md) | business | writes-files | Brand identity strategy run as a structured interview, one question block at a time, covering purpose, positioning against named alternatives, the primary audience and their job to be done, three to five values tied to behaviours, personality traits and a naming brief, then written up as a one-page brand brief with open questions marked. |
 | [`brand-voice`](skills/brand-voice/SKILL.md) | business | read-only | Defines a company's written brand voice as three to five attributes with "this, not that" boundaries, paired do and don't rewrites, a preferred and banned vocabulary list and tone shifts by context, then checks or rewrites copy against that guide. |
 | [`browser-qa`](skills/browser-qa/SKILL.md) | testing | runs-commands | Exploratory, manual-style QA session on a running web app through a real browser, walking the critical user journeys, abusing forms and validation, spot-checking small screens, keyboard use and contrast, and watching the console and network panel, then filing reproducible bug reports. |
 | [`bun-runtime`](skills/bun-runtime/SKILL.md) | coding | runs-commands | Working with Bun as a JavaScript runtime, package manager, test runner and bundler, and knowing where it differs from Node and npm, including bun.lock and trustedDependencies, bunfig.toml, bun test with bun:test mocks, bun build and --compile, Bun.serve, automatic .env loading, Node API compatibility gaps, and when to stay on Node. |
+| [`change-impact-analysis`](skills/change-impact-analysis/SKILL.md) | coding | runs-commands | Blast-radius analysis for a code change, built from the real dependency graph rather than guesswork, using import search, the build graph and monorepo tooling (nx affected, turbo --affected, bazel query rdeps, go list, pnpm filters, Maven -amd, Gradle buildDependents) to find downstream consumers, then running the tests of changed modules and every dependent, and reconciling the predicted impact against the actual diff. |
 | [`cisco-ios-config`](skills/cisco-ios-config/SKILL.md) | devops | read-only | Reads and writes Cisco IOS and IOS-XE running configuration by hand without cutting off access, covering access and trunk switchports, VLANs and VTP, named extended ACLs edited by sequence number, static routes and basic OSPF, SSH and local user hardening, config archive with configure replace and revert timers, and the show commands that prove each change worked. |
 | [`clickhouse-patterns`](skills/clickhouse-patterns/SKILL.md) | data | runs-commands | ClickHouse table and query design for analytics, choosing a MergeTree family engine, ordering the sorting key for the filters that matter, keeping partitions coarse, building incremental and refreshable materialised views, batching or async-inserting writes to avoid too many parts, and reading EXPLAIN and system tables to make slow queries fast. |
 | [`clinical-decision-support`](skills/clinical-decision-support/SKILL.md) | compliance | writes-files | Engineering discipline for software that recommends or warns at the point of care, including CDS Hooks services (discovery, patient-view and order-sign hooks, prefetch, cards, suggestions, feedback), alert design that avoids alert fatigue, versioned rule logic tied to cited evidence, clinician sign-off and regression testing on synthetic cases, override and audit trails, and the regulatory line where software becomes a medical device (FDA CDS guidance, EU MDR Rule 11, UK DCB0129). |
@@ -114,6 +143,8 @@ Plugin installs update through the host's own plugin manager. Use either a plugi
 | [`cold-outreach-sequences`](skills/cold-outreach-sequences/SKILL.md) | business | read-only | Plans, writes and runs B2B cold outreach sequences to prospects who have not opted in - picking an ideal customer profile and a narrow segment, researching a genuine reason to write to each person, drafting short multi-touch email and LinkedIn steps with sensible spacing, staying within CAN-SPAM, GDPR and PECR, and judging results by positive replies and meetings rather than opens. |
 | [`content-repurposing`](skills/content-repurposing/SKILL.md) | business | read-only | Breaks one finished long-form source (article, talk recording, podcast episode, webinar or report) into channel-native derivatives such as LinkedIn posts, X threads, newsletter sections, short video clip scripts and quote cards, by extracting the core claims with timestamps or paragraph references, matching each to a format, and checking every derivative against the source so nothing is exaggerated, misquoted or stripped of its caveats. |
 | [`context-budget`](skills/context-budget/SKILL.md) | meta | writes-files | Keeps a long agent task inside its context window by deciding what to read in full versus search for, reading files in slices, summarising findings into a running notes file, pushing bulky reads and log analysis to subagents that return short answers, and checkpointing before the window runs out. |
+| [`contract-drafting`](skills/contract-drafting/SKILL.md) | compliance | writes-files | Assembles first-draft commercial agreements, namely master services agreements, NDAs, statements of work and GDPR-style data processing agreements, by filling the organisation's own clause template from a structured term sheet, logging every departure from the standard position in a deviation register with its risk and approver, and producing a plain-language redline summary, with a mandatory gate that a qualified lawyer reviews the draft before anyone signs or sends it. |
+| [`contract-first-development`](skills/contract-first-development/SKILL.md) | coding | runs-commands | Coordinates frontend and backend teams, or two services, around one machine-checked interface contract in OpenAPI, AsyncAPI, protobuf or JSON Schema that is reviewed and merged before code, then drives generated clients and server stubs, mock servers for parallel work, CI gates for breaking changes with oasdiff and buf breaking, and Pact consumer-driven contract tests with can-i-deploy checks. |
 | [`conventional-commits`](skills/conventional-commits/SKILL.md) | devops | runs-commands | Writes and checks commit messages in the Conventional Commits 1.0.0 format - choosing the type and scope, marking breaking changes with "!" or a BREAKING CHANGE footer, writing a body that explains why the change was made, and adding issue footers - so changelog and semantic-version tooling can read the history. |
 | [`cpp-patterns`](skills/cpp-patterns/SKILL.md) | coding | runs-commands | Modern C++ (17/20/23) house rules for writing and restructuring code - RAII for every resource, unique_ptr/shared_ptr ownership, value semantics and the rule of zero, const-correctness, steering clear of undefined behaviour, concepts used sparingly, target-based CMake, plus sanitizer and clang-tidy setup. |
 | [`cpp-testing`](skills/cpp-testing/SKILL.md) | testing | runs-commands | Writes and runs C++ unit tests with GoogleTest or Catch2 - test fixtures, parameterised cases, gMock mocks behind interfaces, CTest registration via gtest_discover_tests or catch_discover_tests, and running the suite under AddressSanitizer and UBSan. |
@@ -127,46 +158,59 @@ Plugin installs update through the host's own plugin manager. Use either a plugi
 | [`data-pipelines`](skills/data-pipelines/SKILL.md) | data | runs-commands | Batch data pipeline engineering for extract-load-transform jobs run by an orchestrator such as Airflow, Dagster or Prefect, built so every task is idempotent and safe to rerun for any past interval, partitioned by logical date, guarded by row-count, freshness and schema checks before data is published, tolerant of late-arriving records, and traceable through lineage. |
 | [`database-migrations`](skills/database-migrations/SKILL.md) | data | runs-commands | Plans and writes zero-downtime schema migrations with the expand-migrate-contract sequence, so columns, tables and indexes can be added, renamed, retyped or dropped while old and new app versions run side by side, with batched backfills, lock and statement timeouts, tested rollbacks, and the conventions of tools such as Flyway, Liquibase, Alembic, Django, Rails, Prisma and Knex. |
 | [`dbt-patterns`](skills/dbt-patterns/SKILL.md) | data | runs-commands | dbt project conventions for analytics engineering, laying models out in staging, intermediate and marts layers, declaring sources with freshness, using ref and source instead of hard-coded tables, adding data tests, unit tests and enforced model contracts, choosing an incremental strategy, building snapshots for slowly changing history, documenting columns, and running slim CI on only the modified nodes. |
+| [`decision-council`](skills/decision-council/SKILL.md) | ai | read-only | Runs a council of independent viewpoints on one hard call, giving several role-played advisers or separate models (or providers) the same brief in isolation so none sees another's answer, then cross-examining their positions and synthesising a single recommendation that records the strongest dissent, the confidence level and what evidence would change the outcome. |
 | [`deep-research`](skills/deep-research/SKILL.md) | meta | network | Investigates a technical question across many sources and produces a cited report. |
 | [`dependency-audit`](skills/dependency-audit/SKILL.md) | security | network | Software supply-chain audit of a project's third-party packages across npm, pnpm, Yarn, pip/uv, Cargo, Go modules and similar ecosystems. |
 | [`deployment-strategies`](skills/deployment-strategies/SKILL.md) | devops | runs-commands | Plans and runs low-risk production releases with blue-green switches, progressive canary rollouts, feature flags that separate deploy from release, expand-and-contract database changes ordered so old and new code both work, readiness and liveness health checks, rollback triggered automatically by error and latency signals, and smoke tests after every deploy. |
+| [`design-brainstorming`](skills/design-brainstorming/SKILL.md) | coding | writes-files | Collaborative design session that turns a rough idea into an approved design before any code is written. |
+| [`desktop-app-testing`](skills/desktop-app-testing/SKILL.md) | testing | runs-commands | Automates end-to-end UI tests for native desktop applications (WPF, WinForms, Win32, Qt and Electron) by driving them through UI Automation with pywinauto, through the Appium Windows driver backed by WinAppDriver, or through Playwright's Electron support, with stable automation IDs instead of screen coordinates, isolated app data per test, screenshots on failure, and CI runners that have a real interactive desktop session or a virtual display. |
 | [`django-patterns`](skills/django-patterns/SKILL.md) | coding | runs-commands | Django project conventions for building and changing apps, covering app layout, ORM query efficiency with select_related and prefetch_related, safe migrations, forms and model validation, auth and permission checks, per-environment settings, Celery tasks that run after commit, and production security settings. |
 | [`docker-patterns`](skills/docker-patterns/SKILL.md) | devops | runs-commands | Writes and fixes Dockerfiles and Docker Compose files that build small, cacheable, non-root images, using multi-stage builds, a tight .dockerignore, BuildKit cache and secret mounts, healthchecks, and a Compose setup for local development with dependent services. |
+| [`document-processing`](skills/document-processing/SKILL.md) | data | runs-commands | Pipelines for PDFs and scanned paperwork built on open tools - triage each file as born-digital, scanned or mixed, pull text and tables with pdfplumber or pdftotext, add a searchable text layer with OCRmyPDF and Tesseract language packs, split, merge, rotate, decrypt and repair with qpdf, read and fill AcroForm fields with pypdf or pdftk, redact so the underlying text and metadata are truly gone and prove it, and translate a document while keeping its layout. |
 | [`e2e-testing-playwright`](skills/e2e-testing-playwright/SKILL.md) | testing | runs-commands | Writes and maintains Playwright Test end-to-end suites for web apps, using role-based locators, web-first assertions that auto-wait, saved storageState for login, page.route network mocks, isolated per-test data, traces for flaky runs and a sharded CI job. |
 | [`ef-core-patterns`](skills/ef-core-patterns/SKILL.md) | coding | runs-commands | Entity Framework Core data-access rules for .NET - scoped DbContext lifetime, pooling and IDbContextFactory, AsNoTracking for read paths, LINQ that translates to SQL instead of throwing or evaluating on the client, projections, Include versus AsSplitQuery for N+1 and cartesian explosion, ExecuteUpdate and ExecuteDelete for bulk writes, safe dotnet ef migrations and idempotent scripts, and optimistic concurrency with row versions. |
 | [`email-deliverability`](skills/email-deliverability/SKILL.md) | business | network | Gets email into the inbox instead of spam by setting up SPF, DKIM, DMARC and BIMI DNS records with alignment, splitting transactional and marketing mail onto separate subdomains and streams, choosing a sending provider, processing bounces and complaints, keeping lists clean and warming a new domain or IP. |
+| [`energy-procurement`](skills/energy-procurement/SKILL.md) | business | read-only | Commercial electricity and natural gas buying for offices, plants, warehouses and multi-site portfolios, covering how to read utility bills and tariffs (energy, demand, capacity and transmission charges), analysing 15-minute interval load data for load factor and peaks, comparing fixed-price, index and block-and-index supply contracts, running a supplier RFP on a like-for-like basis, layering purchases to manage price risk, and renewable options such as green tariffs, unbundled certificates and power purchase agreements. |
 | [`error-handling-patterns`](skills/error-handling-patterns/SKILL.md) | coding | writes-files | Language-agnostic rules for designing how code fails, covering when to crash versus recover, typed and wrapped errors with context, retry with exponential backoff and jitter only for idempotent work, timeouts on every remote call, and separating what the user sees from what gets logged. |
 | [`estimation-and-scoping`](skills/estimation-and-scoping/SKILL.md) | docs | read-only | Software effort estimation and scope negotiation that breaks a project into small tasks, gives each a best, likely and worst case instead of a single number, surfaces unknowns and time-boxed spikes to resolve them, adds integration, review and release overhead, and offers concrete scope cuts that fit a deadline, finishing with a range and a stated confidence level. |
 | [`evm-dapp-integration`](skills/evm-dapp-integration/SKILL.md) | integrations | network | Connects web frontends and backends to Ethereum and EVM chains with viem (optionally wagmi) or ethers v6, covering EIP-1193 and EIP-6963 wallet discovery and connection, checking and switching chain IDs, typed contract reads, simulating before writes, token amounts kept as bigint with parseUnits and formatUnits against each token's decimals, the transaction lifecycle from signature to receipt status and confirmations, replaced or dropped transactions, event logs, and RPC rate limits and block-range caps. |
 | [`fastapi-patterns`](skills/fastapi-patterns/SKILL.md) | coding | runs-commands | FastAPI service construction with APIRouter modules, Pydantic models as the request and response contract, Depends-based injection for settings, database sessions and the current user, choosing async def versus def per endpoint, consistent error bodies, BackgroundTasks, lifespan startup, and tests through TestClient or httpx with dependency_overrides. |
 | [`ffmpeg-media-processing`](skills/ffmpeg-media-processing/SKILL.md) | coding | runs-commands | FFmpeg and ffprobe command lines for audio and video work - transcoding with libx264, libx265, libvpx-vp9, AAC and Opus, choosing containers, stream copy versus re-encode, frame-accurate trimming, concat demuxer joins, scale and pad filters, burned-in or soft subtitles, thumbnails and contact sheets, HLS VOD ladders, NVENC, VideoToolbox, QSV and VAAPI hardware encoding, and calling ffmpeg safely from code with argument arrays. |
 | [`fhir-integration`](skills/fhir-integration/SKILL.md) | integrations | network | HL7 FHIR R4 and R4B REST client and server work, covering resource modelling and references, search parameters with _include and chained queries, paging through Bundle next links, transaction and batch bundles with urn:uuid references, SMART on FHIR authorization (EHR and standalone launch, v2 scopes, PKCE, backend services), profile validation with $validate and the HL7 validator, and testing against public sandboxes. |
+| [`finishing-a-branch`](skills/finishing-a-branch/SKILL.md) | coding | runs-commands | Closes out completed work on a feature branch - re-runs the test suite and stops if it is red, confirms the base branch, then offers exactly four outcomes (merge locally, push and open a pull request, keep the branch for later, or discard it) and carries out the one the user picks, re-testing after a local merge and cleaning up the worktree only when the work has landed or been thrown away. |
 | [`flask-patterns`](skills/flask-patterns/SKILL.md) | coding | runs-commands | Flask application structure with a create_app factory, blueprints per feature, config loaded from objects and environment variables, extensions such as Flask-SQLAlchemy and Flask-Migrate initialised with init_app, application and request context pitfalls with current_app and g, security hardening, and pytest tests through the test client. |
 | [`flutter-patterns`](skills/flutter-patterns/SKILL.md) | coding | runs-commands | Flutter app architecture from the widget tree up, covering small const widgets and composition over inheritance, choosing between Riverpod, Bloc and Provider for state, declarative routing with go_router or Navigator, FutureBuilder and StreamBuilder async UI with loading and error states, rebuild and jank performance, and Dart-to-native platform channels or Pigeon. |
 | [`flutterwave-integration`](skills/flutterwave-integration/SKILL.md) | integrations | network | Builds and reviews Flutterwave v3 payment integrations across African markets, covering Flutterwave Standard hosted checkout, direct charges for mobile money (Ghana, Kenya M-Pesa, Uganda, Francophone) and cards, server-side verification by transaction id, verif-hash webhook checks and fulfilment that runs once per tx_ref. |
+| [`freight-carrier-management`](skills/freight-carrier-management/SKILL.md) | business | network | Truckload, LTL and intermodal carrier sourcing and governance for shippers and brokers, covering FMCSA operating authority and safety record checks on SAFER and SMS, certificates of insurance and cargo cover, double-brokering and identity fraud red flags, lane rate benchmarking against spot and contract indices, carrier scorecards for on-time, tender acceptance and claims, routing-guide tendering, and contract and rate negotiation. |
 | [`fsharp-patterns`](skills/fsharp-patterns/SKILL.md) | coding | writes-files | Idiomatic F# for writing and restructuring code - discriminated unions and records that make illegal states unrepresentable, Option and Result pipelines instead of exceptions and null, task/async/result computation expressions, compilation-order-aware module layout, and safe .NET interop. |
 | [`fsharp-testing`](skills/fsharp-testing/SKILL.md) | testing | runs-commands | Writes and fixes F# tests with Expecto or xUnit, FsCheck property-based tests for invariants, Unquote quotation assertions, and correct testing of task and async code without blocking. |
 | [`gcp-patterns`](skills/gcp-patterns/SKILL.md) | devops | network | Guides Google Cloud projects through service-account-based IAM without key files, choosing Cloud Run, GKE or Cloud Run functions, Cloud SQL connections through the Auth Proxy or connectors, Cloud Storage access control, Secret Manager, VPC and firewall basics, and the GCP billing gotchas such as idle GKE nodes, egress, and log ingestion. |
 | [`git-workflow`](skills/git-workflow/SKILL.md) | devops | runs-commands | Everyday team git without an interactive editor - feature branches, choosing rebase or merge, resolving conflicts, tidying commits with fixup and autosquash, recovering lost commits through the reflog, and force-pushing with --force-with-lease so nobody's work is overwritten. |
+| [`git-worktrees`](skills/git-worktrees/SKILL.md) | coding | runs-commands | Sets up an isolated git worktree for a feature or an implementation plan - detects whether the session is already in one, picks the worktree folder by the project's convention, confirms a project-local folder is git-ignored, creates the branch and worktree, installs dependencies from the lockfile, runs a baseline test pass so pre-existing failures are known, and later removes and prunes it. |
 | [`github-actions-ci`](skills/github-actions-ci/SKILL.md) | devops | runs-commands | Writes, hardens and debugs GitHub Actions workflows under .github/workflows, including triggers and job structure, dependency caching, build matrices, reusable workflows and composite actions, keyless OIDC login to AWS, Google Cloud and Azure, least-privilege GITHUB_TOKEN permissions, SHA-pinned third-party actions, and diagnosing red runs from their logs. |
 | [`github-api-automation`](skills/github-api-automation/SKILL.md) | integrations | network | Scripts and services that drive GitHub through the gh CLI, the REST and GraphQL APIs or a GitHub App, covering the choice between fine-grained tokens and app installation tokens, JWT-to-installation-token exchange, Link-header and cursor pagination, primary and secondary rate limits, X-Hub-Signature-256 webhook verification, and the Actions REST endpoints for dispatching, re-running and reading workflow runs. |
 | [`go-patterns`](skills/go-patterns/SKILL.md) | coding | runs-commands | Idiomatic Go for writing and restructuring code, covering package layout, error wrapping with %w and errors.Is/As, small consumer-side interfaces, context.Context propagation, goroutine and channel patterns that do not leak or race, Go modules hygiene, and golangci-lint setup. |
 | [`go-testing`](skills/go-testing/SKILL.md) | testing | runs-commands | Writes and fixes Go tests with the standard testing package, including table-driven tests with t.Run subtests, t.Helper and t.Cleanup, httptest servers and recorders, hand-written fakes instead of mock frameworks, the race detector, native fuzzing, benchmarks and golden files. |
+| [`google-workspace-integration`](skills/google-workspace-integration/SKILL.md) | integrations | network | Calls the Google Drive v3, Docs, Sheets and Slides REST APIs from application code, covering the choice between user OAuth, a service account and domain-wide delegation, the narrowest scopes (drive.file before restricted drive), files.list queries with shared-drive flags, documents and presentations batchUpdate requests applied in descending index order, Sheets A1 ranges with valueInputOption, and per-minute quotas handled with truncated exponential backoff on 429 and 403 rate errors. |
+| [`harmonyos-arkts`](skills/harmonyos-arkts/SKILL.md) | coding | runs-commands | Builds and fixes HarmonyOS NEXT apps written in ArkTS with ArkUI declarative components, choosing between the V1 state decorators (@State, @Prop, @Link, @Observed/@ObjectLink) and the V2 set (@ComponentV2, @Local, @Param, @Event, @ObservedV2/@Trace, @Monitor, @Computed) without mixing them illegally, wiring the UIAbility lifecycle and page routing, and running hvigorw and ohpm builds and clearing typical ArkTS compiler, signing and dependency errors. |
 | [`hexagonal-architecture`](skills/hexagonal-architecture/SKILL.md) | coding | writes-files | Applies ports and adapters (hexagonal, clean or onion architecture) pragmatically, keeping domain rules and use cases free of framework, database and HTTP imports, pointing dependencies inward, and untangling an existing codebase one seam at a time. |
 | [`hipaa-compliance`](skills/hipaa-compliance/SKILL.md) | compliance | writes-files | Engineering rules for US HIPAA work on protected health information (PHI and ePHI), covering whether HIPAA applies, Security Rule safeguards such as role-based access, audit trails, encryption and automatic logoff, business associate agreements with cloud, email, SMS and AI vendors, the minimum necessary standard, de-identification, PHI-free logging, and breach readiness, with a clear not-legal-advice line. |
 | [`hl7v2-integration`](skills/hl7v2-integration/SKILL.md) | integrations | network | Parses, generates and routes pipe-delimited HL7 version 2.x messages such as ADT admit/discharge/transfer events, ORM and OML orders and ORU results, handling MSH encoding characters and escape sequences, repeating fields and components, MSH-10 control IDs, original and enhanced ACK/NACK modes, MLLP framing over TCP, interface engines like Mirth Connect (NextGen Connect), and mapping v2 segments to FHIR resources. |
 | [`homelab-network-setup`](skills/homelab-network-setup/SKILL.md) | devops | writes-files | Plans and builds a self-hosted home lab network from an address and VLAN plan through inter-VLAN firewall policy, local DNS filtering with Pi-hole or AdGuard Home, WireGuard remote access, configuration backups, and exposing a few services to the internet without opening the whole LAN. |
 | [`hubtel-integration`](skills/hubtel-integration/SKILL.md) | integrations | network | Guides Ghana-focused Hubtel merchant integrations end to end, from Online Checkout (redirect or onsite iframe) and Direct Receive Money prompts on MTN, Telecel and AirtelTigo wallets to callback handling, the mandatory Transaction Status Check, Basic auth with API ID and key, the 4-IP whitelist, and sending SMS through the Hubtel SMS API. |
 | [`i18n-localization`](skills/i18n-localization/SKILL.md) | coding | writes-files | Internationalises an application so it can ship in more languages and regions, by moving user-facing text into message catalogs, writing ICU MessageFormat messages with plural and select rules, formatting dates, numbers, currency and lists through locale-aware APIs, making layouts work right-to-left, testing with pseudo-localisation, and keeping translation keys in sync across locales. |
+| [`implementation-plans`](skills/implementation-plans/SKILL.md) | coding | runs-commands | Writes a saved, executable implementation plan that an engineer with zero context could follow, then works through it. |
 | [`incident-postmortem`](skills/incident-postmortem/SKILL.md) | docs | runs-commands | Blameless post-incident review writing that rebuilds a timestamped timeline from alerts, chat and deploy logs, quantifies customer and business impact, separates the trigger from root causes and contributing factors, records what went well and where the team got lucky, and turns findings into a short list of owned, dated action items with a follow-up review. |
 | [`inventory-demand-planning`](skills/inventory-demand-planning/SKILL.md) | business | writes-files | Inventory and demand planning for stocked SKUs, from cleaning sales history and picking a simple forecast to sizing safety stock for a target service level, setting reorder points and order quantities from lead times, ranking items with ABC analysis, and weighing stockout cost against overstock cost, built as a spreadsheet or a small script. |
 | [`investor-materials`](skills/investor-materials/SKILL.md) | business | read-only | Drafts startup fundraising documents, namely a pitch deck outline, a one-page investor summary and the recurring investor update, built around a clear narrative, the few metrics investors judge a company on, a specific ask and use of funds. |
 | [`invoicing-and-tax`](skills/invoicing-and-tax/SKILL.md) | business | writes-files | Guides software teams through issuing legally usable invoices and charging sales tax, VAT or GST correctly, covering required invoice fields and sequential numbering, choosing a tax calculation service or merchant of record over hand-rolled rate tables, registration thresholds and nexus at a high level, reverse charge for B2B, tax-inclusive versus exclusive pricing, line-level rounding, and national e-invoicing mandates such as Peppol, KSeF and Factur-X, with a firm handoff to a qualified accountant for anything that is a tax position. |
+| [`ios-platform-features`](skills/ios-platform-features/SKILL.md) | coding | writes-files | Adopts recent Apple platform APIs in an existing app without dropping older OS versions, covering the Liquid Glass design (glassEffect, GlassEffectContainer, glass button styles, UIGlassEffect, UIDesignRequiresCompatibility), the on-device Foundation Models framework with SystemLanguageModel availability, LanguageModelSession, @Generable guided generation and the Tool protocol, #available checks with real fallbacks, and layered Icon Composer app icons. |
 | [`java-patterns`](skills/java-patterns/SKILL.md) | coding | writes-files | Idiomatic modern Java (17 and 21 LTS and later) for writing and restructuring code with records, sealed interfaces, switch pattern matching, Optional, streams, checked versus unchecked exceptions, immutable collections, virtual threads and a standard Maven or Gradle layout. |
 | [`java-testing`](skills/java-testing/SKILL.md) | testing | runs-commands | Writes and repairs JVM tests in Java with JUnit Jupiter, AssertJ assertions, Mockito mocks, parameterized cases, Testcontainers-backed integration tests and Spring Boot test slices, and tracks down flaky tests. |
 | [`jetpack-compose-patterns`](skills/jetpack-compose-patterns/SKILL.md) | coding | runs-commands | Android Jetpack Compose UI work centred on hoisting state into stateless composables, understanding recomposition, stability and strong skipping, choosing the right side-effect API (LaunchedEffect, DisposableEffect, rememberUpdatedState, derivedStateOf, snapshotFlow), exposing ViewModel state with collectAsStateWithLifecycle, type-safe Navigation Compose routes, and lazy-list and baseline-profile performance. |
 | [`jira-integration`](skills/jira-integration/SKILL.md) | integrations | network | Connects code to Jira Cloud through the REST API v3, from picking basic auth with an Atlassian API token or OAuth 2.0 (3LO) with a cloudId, through enhanced JQL search on /rest/api/3/search/jql with nextPageToken paging, creating issues with Atlassian Document Format bodies, looking up custom field IDs and running workflow transitions, to registering webhooks and coping with 429 burst and points-based quotas. |
 | [`jpa-hibernate`](skills/jpa-hibernate/SKILL.md) | data | runs-commands | Jakarta Persistence and Hibernate ORM data-layer rules for entity and association mapping, LAZY-by-default fetch plans, finding and fixing N+1 selects with JOIN FETCH, entity graphs or batch fetching, transaction scope and LazyInitializationException, @Version optimistic locking, and evolving the schema through Flyway or Liquibase rather than ddl-auto. |
+| [`jvm-sql-mappers`](skills/jvm-sql-mappers/SKILL.md) | coding | runs-commands | Writes and reviews SQL-first data access on the JVM without an ORM session, using MyBatis XML or annotation mappers with dynamic SQL and resultMaps, jOOQ's generated typesafe DSL, or Kotlin Exposed DSL and DAO tables, plus explicit transaction boundaries, HikariCP pool sizing, JDBC batch inserts and loading child rows without one query per parent. |
 | [`kotlin-multiplatform`](skills/kotlin-multiplatform/SKILL.md) | coding | runs-commands | Sets up and evolves Kotlin Multiplatform (KMP) and Compose Multiplatform projects, covering the shared module and source-set layout (commonMain, androidMain, iosMain), expect/actual versus interfaces with injected platform implementations, choosing multiplatform-ready libraries, exporting a framework to Xcode, exposing suspend functions and Flows to Swift, and Gradle build setup for Android and iOS targets. |
 | [`kotlin-patterns`](skills/kotlin-patterns/SKILL.md) | coding | writes-files | Idiomatic Kotlin for JVM and Android code, covering null safety without !!, data and sealed classes with exhaustive when, restrained extension functions, structured concurrency with coroutine scopes and dispatchers, cold Flow versus StateFlow and SharedFlow, Result and exception handling, and Gradle Kotlin DSL build scripts with version catalogs. |
 | [`kotlin-testing`](skills/kotlin-testing/SKILL.md) | testing | runs-commands | Writes and repairs Kotlin tests on JUnit 5 or Kotest, with MockK for coroutine-aware mocks, kotlinx-coroutines-test for runTest, virtual time and Dispatchers.setMain, and Turbine for asserting Flow and StateFlow emissions, plus a checklist for making flaky coroutine tests deterministic. |
@@ -184,17 +228,22 @@ Plugin installs update through the host's own plugin manager. Use either a plugi
 | [`mcp-server-patterns`](skills/mcp-server-patterns/SKILL.md) | ai | runs-commands | Model Context Protocol server construction, from naming tools and writing their JSON Schema inputs to returning isError results, structured output, tool annotations, OAuth-protected Streamable HTTP or local stdio transports, and testing with the MCP Inspector. |
 | [`metrics-dashboards`](skills/metrics-dashboards/SKILL.md) | data | read-only | Designs business and product metric dashboards that people act on, starting from the decisions the audience makes, writing each metric as a precise definition with formula, grain, filters, time zone and owner, picking a chart type per question, laying out headline numbers then trends then breakdowns, showing data freshness and quality status on the page, and cutting vanity metrics that never change a decision. |
 | [`ml-experiment-workflow`](skills/ml-experiment-workflow/SKILL.md) | ai | runs-commands | Plans and runs machine learning experiments so results can be trusted, from a dumb baseline and leakage-free train, validation and test splits, through tracked runs, metrics chosen to match the business goal, and ablations, to turning a notebook into a repeatable pipeline. |
+| [`mobile-accessibility`](skills/mobile-accessibility/SKILL.md) | coding | writes-files | Makes native iOS and Android screens usable with VoiceOver and TalkBack by fixing labels, traits and roles, grouping and reading order, focus moves after navigation, Dynamic Type and sp font scaling, 44pt and 48dp touch targets and colour contrast, across SwiftUI, UIKit, Jetpack Compose and Android Views, then proving it with Accessibility Inspector, Accessibility Scanner and automated audits in UI tests. |
 | [`mongodb-patterns`](skills/mongodb-patterns/SKILL.md) | data | runs-commands | MongoDB document modelling and query tuning, from embed-versus-reference decisions and unbounded-array traps to compound indexes ordered by the ESR rule, reading explain executionStats, aggregation pipelines, multi-document transactions on replica sets, and $jsonSchema collection validation. |
 | [`mpesa-daraja-integration`](skills/mpesa-daraja-integration/SKILL.md) | integrations | network | Implements and audits direct Safaricom M-Pesa integrations on the Daraja API in Kenya, including the OAuth client-credentials token, Lipa na M-Pesa Online (STK Push) with the base64 shortcode+passkey+timestamp password, stkCallback parsing, confirmation through the STK Push Query endpoint, C2B URL registration with validation and confirmation, B2C payouts with SecurityCredential, and the sandbox-to-production go-live path. |
 | [`mtn-momo-integration`](skills/mtn-momo-integration/SKILL.md) | integrations | network | Builds and reviews direct integrations with the MTN Mobile Money (MoMo) Open API from momodeveloper.mtn.com, including Collection request-to-pay, Disbursement transfers and refunds, API user and access token handling, X-Reference-Id idempotency, unsigned callbacks confirmed by status checks, and sandbox testing for MTN markets such as Ghana, Uganda and Cameroon. |
 | [`mysql-patterns`](skills/mysql-patterns/SKILL.md) | data | runs-commands | MySQL and MariaDB on InnoDB, covering clustered primary keys and secondary index design, reading EXPLAIN and EXPLAIN ANALYZE output, utf8mb4 character sets and collations, REPEATABLE READ with gap and next-key locks, deadlock diagnosis, online DDL algorithms, and stale reads from lagging replicas. |
 | [`nestjs-patterns`](skills/nestjs-patterns/SKILL.md) | coding | writes-files | NestJS application structure and conventions, covering feature modules, providers and dependency-injection scopes, ValidationPipe with class-validator DTOs, guards, interceptors, exception filters, ConfigModule, database modules (TypeORM, Prisma, Mongoose) and Test.createTestingModule unit and e2e tests. |
 | [`network-automation`](skills/network-automation/SKILL.md) | devops | network | Automates configuration of routers, switches and firewalls with Netmiko, NAPALM, Nornir or Ansible network collections, building a source-of-truth inventory, idempotent templates and resource modules, dry runs that show a diff before any push, commit-confirm style rollback, vaulted credentials, and testing against a containerlab or CML lab before production. |
+| [`network-design`](skills/network-design/SKILL.md) | devops | read-only | Produces a vendor-neutral design for an enterprise campus or multi-site network before anything is configured, from requirements and an aggregatable IPv4 and IPv6 addressing plan through OSPF area layout, the BGP edge to ISPs, VLANs, VRFs and segmentation zones, first-hop redundancy and dual uplinks, WAN or SD-WAN topology, and a staged cutover plan with rollback points and validation tests. |
 | [`network-troubleshooting`](skills/network-troubleshooting/SKILL.md) | devops | runs-commands | Layer-by-layer diagnosis of network faults on Linux, macOS and Windows, working up from link and IP routing through DNS resolution, TCP/UDP port reachability and firewalls, TLS certificates and SNI, to latency, packet loss and MTU black holes, with the exact command for each check and how to read its output. |
 | [`nextjs-patterns`](skills/nextjs-patterns/SKILL.md) | coding | runs-commands | Next.js App Router conventions for the app/ directory - splitting Server and Client Components, async params and request APIs, fetch caching and revalidation (including Cache Components and "use cache"), Route Handlers, Server Actions with auth checks, the Metadata API, middleware/proxy, NEXT_PUBLIC_ environment variables and self-hosting or Vercel deployment traps. |
 | [`node-backend-patterns`](skills/node-backend-patterns/SKILL.md) | coding | writes-files | Production rules for Node.js HTTP services written directly on Express or Fastify, without a full framework, including app/server split, schema validation of request input, centralised error middleware, graceful SIGTERM shutdown, structured pino logging, streaming with pipeline, helmet security headers, CORS and rate limiting. |
 | [`nuxt-patterns`](skills/nuxt-patterns/SKILL.md) | coding | runs-commands | Nuxt 3 and 4 full-stack app guidance for choosing SSR, SPA, prerender or hybrid route rules, fetching data once with useFetch and useAsyncData instead of double-fetching with $fetch, writing Nitro server routes, wiring runtimeConfig secrets, setting SEO metadata, and tracking down hydration mismatches. |
+| [`observability`](skills/observability/SKILL.md) | devops | writes-files | OpenTelemetry-first service instrumentation that adds structured JSON logs carrying trace IDs, RED metrics with bounded-cardinality labels and distributed traces (SDK and exporter setup, semantic conventions, W3C traceparent propagation, head and tail sampling), then turns them into SLIs, SLOs, multi-window burn-rate alerts and on-call dashboards in Grafana, Prometheus or a vendor backend. |
+| [`open-source-release`](skills/open-source-release/SKILL.md) | devops | runs-commands | Takes a private or internal codebase public safely by scanning the working tree and full git history for secrets, personal data and internal hostnames with gitleaks and trufflehog, rewriting history with git filter-repo or starting a fresh history, choosing an outbound licence and checking third-party licence compatibility, adding README, CONTRIBUTING, SECURITY and CODE_OF_CONDUCT files and public CI, then walking a pre-publish checklist with explicit sign-off points. |
 | [`parallel-agent-orchestration`](skills/parallel-agent-orchestration/SKILL.md) | meta | runs-commands | Fans a large coding job out to several subagents at once and merges the results. |
+| [`patent-research`](skills/patent-research/SKILL.md) | compliance | network | Patent and trademark search groundwork across USPTO Patent Public Search and Trademark Search, EPO Espacenet, Google Patents and WIPO PATENTSCOPE and Global Brand Database, covering breaking an invention into searchable features, keyword and CPC classification queries, prior-art and freedom-to-operate lead lists, reading independent claims element by element, checking legal status, family and expiry, and knockout trademark screens by Nice class, with every result labelled as leads for a registered patent attorney or trademark lawyer to assess. |
 | [`paystack-integration`](skills/paystack-integration/SKILL.md) | integrations | network | Builds and reviews Paystack payment integrations, including transaction initialisation, server-side verification, webhooks with HMAC-SHA512 signature checks, idempotent fulfilment, and Ghana mobile money (MTN, Telecel, AT) charges. |
 | [`pci-dss-scope`](skills/pci-dss-scope/SKILL.md) | compliance | writes-files | Shrinks PCI DSS scope by keeping cardholder data off your own systems, using processor-hosted payment pages, redirects or iframe hosted fields, provider tokens instead of card numbers, strict rules on what never to log or store (full PAN, CVV, track data, PIN), and a high-level guide to which self-assessment questionnaire (SAQ A, A-EP, D and others) the design points to, with a clear not-legal-advice and not-QSA line. |
 | [`perl-patterns`](skills/perl-patterns/SKILL.md) | coding | writes-files | Modern Perl 5 conventions for writing and restructuring code - strict and warnings, lexical scope, references and nested data, Moo or Moose classes, try/catch error handling, cpanfile with cpanm or Carton, Perl::Critic policy and taint-safe system calls. |
@@ -207,19 +256,26 @@ Plugin installs update through the host's own plugin manager. Use either a plugi
 | [`privacy-compliance`](skills/privacy-compliance/SKILL.md) | compliance | writes-files | Turns data protection law (EU/UK GDPR, Ghana Data Protection Act 2012, Nigeria Data Protection Act 2023, Kenya Data Protection Act 2019) into engineering work on personal data, covering data mapping, lawful basis and consent records, retention and deletion jobs, subject access and erasure requests, cross-border transfers to cloud vendors, and breach notice timelines. |
 | [`production-scheduling`](skills/production-scheduling/SKILL.md) | business | writes-files | Production and job-shop scheduling for factories, print shops, kitchens and other work centres, covering capacity checks, finding the bottleneck, dispatching rules such as SPT, EDD and Johnson's rule, sequence-dependent changeovers, time and WIP buffers, rescheduling after a breakdown or rush order, and when to move from heuristics to a constraint solver like OR-Tools CP-SAT. |
 | [`prompt-engineering`](skills/prompt-engineering/SKILL.md) | ai | runs-commands | Writes, diagnoses and rewrites production prompts for language models, using clear task instructions with the context the model lacks, a few well-chosen examples, an explicit output format, splitting a hard job into chained steps, and proving each revision against a fixed set of test inputs before it ships. |
+| [`prospect-research`](skills/prospect-research/SKILL.md) | business | network | B2B prospect list building and enrichment from public sources such as company websites, filings, job posts, press and public directories, with a written ideal-customer-fit scorecard, a 0-100 fit score and a cited reason per account, buying-committee roles to contact, and warm-introduction paths found in the user's own contacts and investors, while keeping to platform terms and privacy law with no scraping behind logins. |
+| [`python-app-distribution`](skills/python-app-distribution/SKILL.md) | devops | runs-commands | Ships a Python application to people who do not have Python, by freezing it with PyInstaller or compiling it with Nuitka per target OS, wrapping Windows builds in an Inno Setup or MSIX installer with Authenticode signing, signing macOS app bundles with a Developer ID under the hardened runtime and notarizing them with notarytool, and publishing wheels and an sdist to PyPI through GitHub trusted publishing. |
 | [`python-patterns`](skills/python-patterns/SKILL.md) | coding | runs-commands | Idiomatic modern Python 3 for writing and restructuring application code, covering type hints, dataclasses versus pydantic at trust boundaries, exception design, context managers, pyproject.toml packaging with uv, poetry or pip, ruff and mypy/pyright setup, and asyncio pitfalls. |
 | [`python-testing`](skills/python-testing/SKILL.md) | testing | runs-commands | Writes and repairs pytest suites for Python code using fixtures and conftest.py, parametrize, monkeypatch and unittest.mock, tmp_path, pytest-asyncio for coroutines, coverage with pytest-cov, and a procedure for diagnosing flaky or order-dependent tests. |
 | [`pytorch-patterns`](skills/pytorch-patterns/SKILL.md) | ai | runs-commands | Writes and fixes PyTorch training code, covering nn.Module and training loop structure, device and dtype placement, DataLoader setup, torch.amp mixed precision, checkpoint save and resume, seeding for reproducibility, and tracking down NaN losses and tensor shape errors. |
+| [`quality-nonconformance`](skills/quality-nonconformance/SKILL.md) | compliance | read-only | Nonconformance report (NCR) and corrective and preventive action (CAPA) workflow for regulated manufacturing such as medical devices under FDA's Quality Management System Regulation (21 CFR 820, which incorporates ISO 13485:2016) and automotive suppliers under IATF 16949, covering NCR intake and severity triage, containment and quarantine, root cause analysis with 5 Whys, Ishikawa diagrams and 8D, disposition decisions (use as is, rework, repair, scrap, return to supplier), CAPA plans, and effectiveness verification before closure. |
 | [`quarkus-patterns`](skills/quarkus-patterns/SKILL.md) | coding | runs-commands | Quarkus service conventions for ArC CDI beans, Quarkus REST (formerly RESTEasy Reactive) endpoints, Hibernate ORM with Panache, @ConfigMapping and %dev/%test/%prod profiles, Dev Services containers, GraalVM native-image limits, and @QuarkusTest or @QuarkusIntegrationTest suites. |
 | [`rag-pipeline-patterns`](skills/rag-pipeline-patterns/SKILL.md) | ai | writes-files | Retrieval-augmented generation pipeline design covering document chunking, embedding choice, hybrid keyword plus vector search with reranking, metadata and permission filters, grounded answers with citations, index freshness, and measuring retrieval quality apart from answer quality. |
 | [`rails-patterns`](skills/rails-patterns/SKILL.md) | coding | runs-commands | Ruby on Rails application work that follows the framework's conventions - fat-enough models and thin controllers, Active Record queries without N+1 (includes, preload, strict_loading), strong parameters with params.expect or require/permit, Active Job enqueued after commit, zero-downtime migrations, encrypted credentials, Turbo Frames and Streams, and Rails tests for models, requests, jobs and system flows. |
 | [`react-native-patterns`](skills/react-native-patterns/SKILL.md) | coding | runs-commands | React Native and Expo app guidance for picking a navigation library, keeping global state small, writing or wrapping native modules for the New Architecture, fixing slow lists and needless re-renders, handling iOS versus Android differences, and shipping over-the-air updates with EAS Update without breaking installed binaries. |
 | [`react-patterns`](skills/react-patterns/SKILL.md) | coding | writes-files | React component design rules for function components and hooks, covering where state should live, the Rules of Hooks, effects used only to synchronise with external systems, data fetching without race conditions, controlled and uncontrolled forms with React 19 actions, error boundaries, choosing context versus a state library, and accessible markup. |
 | [`react-performance`](skills/react-performance/SKILL.md) | coding | runs-commands | Measure-first workflow for slow React UIs - profile renders with React DevTools and the Profiler API, cut wasted re-renders with memo, useMemo and useCallback only where the profile shows a win (or let React Compiler do it), virtualise long lists, split code with lazy and Suspense, remove request waterfalls, and shrink the JavaScript bundle. |
+| [`react-testing`](skills/react-testing/SKILL.md) | testing | runs-commands | React Testing Library tests for components and custom hooks under Vitest or Jest, written the way a user drives the UI - userEvent.setup() interactions, getByRole and accessible-name queries, findBy and waitFor for async updates, MSW request handlers instead of mocked fetch, render wrappers for providers, routers and query clients, and renderHook for hooks. |
+| [`recommender-systems`](skills/recommender-systems/SKILL.md) | data | runs-commands | Designs and debugs recommendation, ranking and personalised feed systems as a multi-stage pipeline, from candidate generation with co-visitation, two-tower retrieval and approximate nearest neighbour indexes (FAISS, ScaNN, HNSW), through a learned ranker on logged impressions, to re-ranking for diversity, freshness and business rules, plus cold-start fallbacks, leakage-free time-based offline evaluation with recall@k, NDCG and coverage, and online A/B tests with guardrail metrics. |
 | [`redis-patterns`](skills/redis-patterns/SKILL.md) | data | runs-commands | Redis and Valkey design for application code, covering which data structure fits each job, key naming and TTLs, cache-aside with stampede protection, single-instance locks and their limits, Streams consumer groups versus pub/sub, and maxmemory, eviction and persistence settings. |
 | [`refactoring-safely`](skills/refactoring-safely/SKILL.md) | coding | runs-commands | Step-by-step method for restructuring code while proving its observable behaviour stays identical, by pinning current output with characterisation tests, making one small reversible move at a time, preferring automated IDE-style transformations, and using a strangler fig to replace large legacy modules incrementally. |
 | [`release-management`](skills/release-management/SKILL.md) | devops | runs-commands | Ships a software release end to end - deciding the next semantic version from what changed, updating the changelog, tagging, writing release notes for users, cutting alpha/beta/rc pre-releases, patching an old version from a hotfix branch, and wiring up release tooling such as release-please, semantic-release or Changesets. |
 | [`remotion-video`](skills/remotion-video/SKILL.md) | coding | runs-commands | Remotion video projects written in React, covering Composition and Sequence timing, frame-driven animation with interpolate and spring, staticFile assets, font loading held by delayRender, deterministic rendering with the remotion CLI or renderMedia, and serverless rendering on AWS Lambda with concurrency and S3 privacy settings. |
+| [`reproducible-dev-environments`](skills/reproducible-dev-environments/SKILL.md) | devops | runs-commands | Pins a project's whole toolchain so a fresh laptop and the CI runner get identical versions from one setup command, choosing between Nix flakes or Flox, Dev Containers, and mise or asdf version files, pinning the JavaScript package manager through the packageManager field and corepack, committing every lockfile, and making CI install from the same pins. |
+| [`responding-to-code-review`](skills/responding-to-code-review/SKILL.md) | coding | runs-commands | Works through review comments left on your own pull request or change with technical rigour - reads every comment before touching code, restates each one, asks about unclear items first, checks each suggestion against the codebase before agreeing, pushes back with evidence when a suggestion is wrong, applies YAGNI to scope creep, fixes one item at a time with a test, and replies in the review thread itself. |
 | [`returns-reverse-logistics`](skills/returns-reverse-logistics/SKILL.md) | business | writes-files | Returns and reverse-logistics flow design for physical goods, from writing the return policy and issuing RMA authorisations to receiving, inspecting and grading items, routing each one to restock, refurbish, liquidate, recycle or dispose, timing the refund against receipt, and flagging return-fraud patterns such as wardrobing, item swaps and empty boxes. |
 | [`ruby-patterns`](skills/ruby-patterns/SKILL.md) | coding | runs-commands | Ruby 3 idioms for plain Ruby and gem code - small objects with clear responsibilities, blocks and Enumerable over manual loops, custom exception hierarchies and narrow rescue, frozen string literals, keyword arguments, Bundler and Gemfile.lock discipline, RuboCop configuration, optional RBS or Sorbet signatures, and the allocation and lookup mistakes that make Ruby slow. |
 | [`ruby-testing`](skills/ruby-testing/SKILL.md) | testing | runs-commands | Writes and stabilises Ruby test suites in whichever framework the project already runs, RSpec or Minitest, with FactoryBot or fixtures, verifying doubles and stubs, frozen or travelled time, WebMock and VCR to keep tests off the network, and a seed-and-bisect routine for order-dependent or flaky specs. |
@@ -232,24 +288,34 @@ Plugin installs update through the host's own plugin manager. Use either a plugi
 | [`session-handoff`](skills/session-handoff/SKILL.md) | meta | writes-files | Writes a structured handoff note into the repo (goal, current state, decisions with reasons, exact next steps, open questions) so a later agent session or a teammate can pick up mid-task, and resumes work from such a note by re-checking it against the code before acting. |
 | [`skill-authoring`](skills/skill-authoring/SKILL.md) | meta | writes-files | Creates or improves an Agent Skill (a SKILL.md folder) so it loads reliably and works unchanged in Claude Code, Codex, OpenCode, Cursor, Gemini CLI, GitHub Copilot and Kete Code, including portable frontmatter, a tight trigger description, short instructions, helper scripts and trigger evals. |
 | [`slack-app-integration`](skills/slack-app-integration/SKILL.md) | integrations | network | Builds Slack apps on the Bolt framework (JavaScript, Python or Java), from the app manifest and minimal bot scopes through Events API subscriptions, slash commands and shortcuts acknowledged within three seconds, Block Kit messages and modals with interactive actions, and v0 HMAC request signing checks, to tiered Web API rate limits with Retry-After, Socket Mode versus HTTP endpoints, and OAuth v2 installs for distributing an app to other workspaces. |
+| [`slide-decks`](skills/slide-decks/SKILL.md) | docs | runs-commands | Builds presentation decks end to end - a storyline of one idea per slide with action titles, then layouts, charts and speaker notes - as reveal.js or hand-written HTML/CSS slides, or as PowerPoint files generated with python-pptx or pandoc, edited from an existing .pptx or brand template, and exported to PDF with reveal.js print-pdf, decktape or LibreOffice. |
 | [`smart-contract-security`](skills/smart-contract-security/SKILL.md) | security | runs-commands | Security audit procedure for Solidity and EVM smart contracts that maps the system's funds, roles and trust assumptions, then hunts reentrancy (including cross-function and read-only), broken access control, price oracle and flash-loan manipulation, rounding and precision loss in share maths, front-running and MEV exposure, signature replay across chains and nonces, and proxy upgrade risks, backed by Slither static analysis plus Foundry, Echidna or Medusa fuzzing and invariant tests, ending in a severity-rated report with a clear professional-audit boundary. |
 | [`social-media-publishing`](skills/social-media-publishing/SKILL.md) | integrations | network | Posts text, images and video to X, LinkedIn, Facebook Pages and Instagram through their official APIs, covering OAuth app setup and token refresh, the scopes each platform needs, media upload flows, rate and publishing limits, queued scheduling with retries, and per-platform length and formatting rules. |
 | [`solidity-patterns`](skills/solidity-patterns/SKILL.md) | security | runs-commands | Writes Solidity contracts for Ethereum and other EVM chains the safe way, applying checks-effects-interactions ordering, Ownable2Step or AccessControl roles, OpenZeppelin Contracts instead of hand-rolled tokens, a deliberate choice between immutable and UUPS or transparent proxy deployments with ERC-7201 namespaced storage, events for every state change, custom errors and basic gas hygiene, inside a Foundry or Hardhat project with tests. |
 | [`spring-boot-patterns`](skills/spring-boot-patterns/SKILL.md) | coding | runs-commands | Spring Boot application structure and conventions, covering controller-service-repository layering, constructor injection, typed @ConfigurationProperties, @Transactional boundaries, Bean Validation, ProblemDetail error responses, SecurityFilterChain setup, Actuator exposure and focused test slices such as @WebMvcTest and @DataJpaTest. |
 | [`stripe-integration`](skills/stripe-integration/SKILL.md) | integrations | network | Builds and hardens Stripe payments and billing, from Checkout Sessions and Payment Intents with SCA and 3D Secure handling to Stripe-Signature webhook verification on the unparsed request body, Idempotency-Key headers on every POST, subscriptions driven by invoice events, the Billing customer portal, and test clocks for simulating renewals and trial ends. |
+| [`subagent-driven-development`](skills/subagent-driven-development/SKILL.md) | coding | runs-commands | Carries out a written implementation plan one task at a time, handing each task to a fresh implementer subagent with the full task text and context pasted in, answering its questions before work begins, and requiring a self-review and report. |
 | [`subscription-billing-ops`](skills/subscription-billing-ops/SKILL.md) | business | writes-files | Runs the day-to-day mechanics of recurring revenue in any billing system, whether a provider's billing product or your own ledger, covering plan and price changes with grandfathering, proration on upgrades and downgrades, trials and trial conversion, failed-payment dunning and retry schedules, invoice and credit note lifecycles, cancellation and refund policy, and basic MRR, churn and deferred revenue reporting. |
 | [`svelte-patterns`](skills/svelte-patterns/SKILL.md) | coding | runs-commands | Svelte 5 runes and SvelteKit 2 guidance for $state, $derived, $effect and $props reactivity, snippets instead of slots, universal versus server load functions, form actions with use:enhance and fail(), $lib/server and $env/static/private for server-only code, and SSR traps such as shared module state leaking between users. |
 | [`swift-patterns`](skills/swift-patterns/SKILL.md) | coding | writes-files | Idiomatic Swift 5.x and 6 for writing or restructuring code, covering structs and enums over classes, protocols with associated types and some/any, optional handling without force unwraps, typed and untyped throws, async/await, actors, Sendable and strict concurrency checking, plus Package.swift layout for SwiftPM. |
 | [`swift-testing`](skills/swift-testing/SKILL.md) | testing | runs-commands | Writes and fixes Swift unit, async and UI tests using Apple's Swift Testing framework (@Test, @Suite, #expect, #require, parameterized arguments, confirmation) alongside XCTest, with protocol-based fakes injected through initializers instead of mocking frameworks, and XCUITest basics for UI flows. |
 | [`swiftui-patterns`](skills/swiftui-patterns/SKILL.md) | coding | runs-commands | SwiftUI view design built on structural identity, with property-wrapper choices (@State, @Binding, @Observable models with @Bindable, @Environment), NavigationStack and value-based navigation paths, one-way data flow, keeping body cheap to avoid excess view updates, #Preview setups with sample data, and UIKit interop through UIViewRepresentable and UIHostingController. |
+| [`systematic-debugging`](skills/systematic-debugging/SKILL.md) | coding | runs-commands | Root-cause investigation for any bug, failing test, crash or surprising behaviour, done before a single fix is proposed. |
 | [`tdd-workflow`](skills/tdd-workflow/SKILL.md) | testing | runs-commands | Test-first development loop that writes a failing test, makes it pass with the smallest change, then refactors with the suite green. |
 | [`technical-writing`](skills/technical-writing/SKILL.md) | docs | runs-commands | Writes and restructures developer-facing documentation people actually use, such as READMEs, how-to guides, tutorials and API reference, by naming the audience first, organising around the reader's task, shipping copy-paste examples that are run before publishing, and keeping docs beside the code they describe. |
 | [`terraform-patterns`](skills/terraform-patterns/SKILL.md) | devops | runs-commands | Terraform and OpenTofu infrastructure-as-code practice, from root and child module layout, pinned providers and remote state with locking, through per-environment variables, reading a plan before apply, detecting drift, adopting existing resources with import blocks, and renaming or moving resources safely with moved and removed blocks instead of destroy and recreate. |
 | [`test-coverage-improvement`](skills/test-coverage-improvement/SKILL.md) | testing | runs-commands | Raises meaningful test coverage by measuring line and branch coverage, ranking untested code by risk and churn, adding tests that pin observable behaviour rather than executing lines, and using mutation testing (Stryker, PIT, mutmut, cargo-mutants, Infection) to prove the new tests catch faults. |
 | [`threat-modeling`](skills/threat-modeling/SKILL.md) | security | read-only | STRIDE threat modelling for a planned feature or an existing system, done before or alongside the code. |
+| [`transactional-email`](skills/transactional-email/SKILL.md) | integrations | network | Application code that sends one-to-one system email (sign-up confirmation, password reset, receipts, alerts) through a provider HTTP API such as Postmark, Amazon SES, Resend, Mailtrap or SendGrid, with versioned templates rendered from a typed model, sends queued and made idempotent by a stored message key, test inboxes and simulator addresses instead of real recipients, verified bounce, complaint and delivery webhooks, and a suppression check before every send. |
 | [`typescript-patterns`](skills/typescript-patterns/SKILL.md) | coding | writes-files | Idiomatic TypeScript and modern JavaScript for Node.js and the browser, covering strict tsconfig settings, discriminated unions and narrowing, restrained generics, typed error handling, async/await pitfalls, ESM versus CommonJS packaging, project layout and ESLint/Prettier setup. |
 | [`typescript-testing`](skills/typescript-testing/SKILL.md) | testing | runs-commands | Vitest and Jest test suites for TypeScript and JavaScript projects, picking whichever runner the repo already uses, with module mocks, spies, fake timers, async assertions, fixtures, coverage thresholds and a procedure for diagnosing flaky tests. |
+| [`ui-demo-recording`](skills/ui-demo-recording/SKILL.md) | coding | runs-commands | Produces polished, repeatable product demo videos and feature walkthroughs of a web app by scripting the story as a Playwright run with recordVideo, seeding fixed demo data and a frozen clock, pacing actions for a human viewer, injecting a visible cursor and click ripples, adding captions or chapter titles, then trimming, scaling and encoding the WebM with FFmpeg into MP4 or GIF. |
+| [`ui-design-polish`](skills/ui-design-polish/SKILL.md) | coding | writes-files | Visual design direction and design-engineering finish for product UI - choosing a deliberate aesthetic instead of template defaults, then applying a spacing scale, a modular type scale, semantic colour tokens, hover, focus, active and disabled states, optical alignment, and real empty, loading and error states; also inventories an existing codebase's ad-hoc colours, sizes and components into a design-system audit. |
+| [`ui-flow-audit`](skills/ui-flow-audit/SKILL.md) | coding | runs-commands | Static trace of every user-facing control in a frontend, following each click, toggle or submit through its event handler, state setters, effects, store actions, network calls and their responses to the final rendered state, to find interactions that each work alone but cancel each other, race, double-fire or leave the screen in the wrong state, reported flow by flow. |
+| [`ui-motion`](skills/ui-motion/SKILL.md) | coding | writes-files | Interface animation for the web with the Motion library (motion/react, formerly Framer Motion) and plain CSS transitions, keyframes and the View Transitions API - motion duration and easing tokens, spring physics, hover, tap and drag gestures, AnimatePresence exit animations, layout and shared-element transitions, route changes, prefers-reduced-motion fallbacks, and keeping animation on transform and opacity within the frame budget. |
+| [`unicode-text-processing`](skills/unicode-text-processing/SKILL.md) | data | writes-files | Code-level correctness for text in complex and non-Latin scripts such as Bengali, Devanagari, Tamil, Arabic, Hebrew, Thai, Khmer, Chinese, Japanese and Korean - choosing NFC versus NFKC normalization and case folding, counting and truncating by grapheme cluster instead of code unit, detecting scripts from the Unicode Script property, dictionary-based word segmentation for languages written without spaces, ICU collation, locale-aware sorting and search folding, bidirectional text isolation, display width, and confusable or invisible characters. |
 | [`verification-loop`](skills/verification-loop/SKILL.md) | testing | runs-commands | Pre-merge verification that detects the project's build, lint, type-check and test commands, runs them in order, fixes what it safely can and reports a pass/fail verdict. |
+| [`video-editing`](skills/video-editing/SKILL.md) | coding | runs-commands | Editorial workflow for turning raw footage into a finished cut - logging clips and pulling selects, building a paper edit, rough cut then fine cut, pacing and J/L cuts, matching the rhythm of a reference edit, subtitles and captions in SRT or WebVTT, loudness to a delivery target, basic colour correction, and conforming from an edit decision list with FFmpeg or DaVinci Resolve's Python scripting API. |
 | [`vite-patterns`](skills/vite-patterns/SKILL.md) | coding | writes-files | Configuring and debugging Vite builds and dev servers, covering vite.config with defineConfig and loadEnv, VITE_ env variables and modes, path aliases, plugin ordering and writing small plugins, library mode with package exports, SSR entry builds, base path and build output, and fixing breakage when moving from webpack or Create React App or across Vite majors (Rollup to Rolldown). |
 | [`vue-patterns`](skills/vue-patterns/SKILL.md) | coding | writes-files | Vue 3 Composition API guidance for writing and fixing single-file components with script setup, covering ref versus reactive, reactivity lost by destructuring, computed and watch rules, composables with cleanup, typed defineProps, defineEmits and defineModel, Pinia stores with storeToRefs, and component tests with Vue Test Utils. |
 | [`web-accessibility`](skills/web-accessibility/SKILL.md) | coding | writes-files | Builds and fixes web UI so it meets WCAG 2.2 Level AA, starting from semantic HTML and adding keyboard support, focus management, labelled forms with announced errors, sufficient colour contrast and ARIA only where native elements fall short, then checks the result with axe and a screen reader. |
@@ -288,6 +354,7 @@ Subagents your agent can delegate to. Each runs in its own context and returns a
 | [`go-reviewer`](agents/go-reviewer/AGENT.md) | coding | runs-commands | Go-specific reviewer subagent that reads a Go diff or package and reports verified defects such as unchecked errors, leaked goroutines, data races, misused context.Context, nil-pointer dereferences, typed-nil interfaces and slice or map aliasing, ranked by severity and without modifying code. |
 | [`healthcare-reviewer`](agents/healthcare-reviewer/AGENT.md) | compliance | runs-commands | Read-only reviewer for clinical and patient-data code that hunts for patient data leaking into logs, error messages, analytics and URLs, record access with no audit entry, unsafe clinical defaults such as missing data treated as normal or silent unit assumptions, FHIR and HL7 v2 handling bugs like single-page searches, name-based patient matching and ACK-before-persist, and absent consent or break-the-glass checks, returning a ranked list of verified findings without changing any file. |
 | [`i18n-reviewer`](agents/i18n-reviewer/AGENT.md) | coding | runs-commands | Localisation-readiness reviewer that reads a UI diff in its own context and reports verified defects that will break in other languages - user-visible text left out of the message catalog, sentences glued together from fragments, hand-rolled or missing plural forms, dates, numbers and currency formatted without the locale, keys missing from or orphaned in locale files, and layout that won't mirror right-to-left - without editing any files. |
+| [`inbox-triager`](agents/inbox-triager/AGENT.md) | business | network | Message triage subagent for email, Slack, Teams and similar threads the user points it at, which sorts each item by urgency and type, pulls out deadlines, commitments and follow-ups, drafts replies for the user to approve, and returns one prioritised digest, without ever sending, deleting, archiving, labelling or marking anything read. |
 | [`infra-reviewer`](agents/infra-reviewer/AGENT.md) | devops | runs-commands | Audits infrastructure files in a separate context, covering Dockerfiles, Compose files, Kubernetes manifests and Helm charts, Terraform or OpenTofu code and plans, and CI pipeline configs, and returns verified findings on security misconfiguration, missing resource limits and probes, state and secret exposure, and plan changes that would replace or destroy live resources, without editing files or applying anything. |
 | [`java-build-resolver`](agents/java-build-resolver/AGENT.md) | coding | runs-commands | Repairs failing Maven and Gradle builds for Java projects, covering javac compile errors, unresolved or conflicting dependency versions, annotation processors such as Lombok and MapStruct, and JDK, toolchain or release-level mismatches, using the smallest edit and re-running the build to prove it passes. |
 | [`java-reviewer`](agents/java-reviewer/AGENT.md) | coding | runs-commands | Java-specific code reviewer that inspects a diff for NullPointerException paths, unclosed streams and connections, broken equals/hashCode contracts, data races and lock misuse, swallowed or mis-wrapped exceptions, and misuse of JDK and framework APIs, then returns verified findings without editing files. |
@@ -315,8 +382,10 @@ Subagents your agent can delegate to. Each runs in its own context and returns a
 | [`security-reviewer`](agents/security-reviewer/AGENT.md) | security | runs-commands | Isolated security pass over a diff, branch or pull request that traces untrusted input to where it is used and reports only exploitable problems - leaked secrets, SQL, shell and template injection, path traversal and SSRF, missing or broken authorization (IDOR), weak input validation, and sensitive data in responses or logs - each ranked by severity with an attack scenario and a fix, never modifying the code. |
 | [`silent-failure-hunter`](agents/silent-failure-hunter/AGENT.md) | coding | runs-commands | Read-only auditor that searches a diff, module or service for places where failures vanish without a trace, such as empty or catch-all exception handlers, discarded error returns, unawaited promises, fallback values that mask a broken dependency, and error paths with no log or metric, then reports each with its concrete consequence. |
 | [`solidity-reviewer`](agents/solidity-reviewer/AGENT.md) | security | runs-commands | Read-only Solidity diff reviewer that inspects changed contracts in its own context for reentrancy through external calls made before state updates, privileged or initializer functions left without access control, low-level calls whose return value is ignored, unsafe downcasts and rounding that favours the caller, storage layout collisions between proxy implementation versions, and state changes that emit no event, then returns line-anchored findings it has traced or proven with a test, never editing files. |
+| [`spec-reviewer`](agents/spec-reviewer/AGENT.md) | coding | runs-commands | Requirements-conformance reviewer that compares a finished change against the ticket, task or spec it was supposed to satisfy, reading the real code and tests instead of believing the implementer's summary. |
 | [`swift-build-resolver`](agents/swift-build-resolver/AGENT.md) | coding | runs-commands | Repairs failing Swift and Xcode builds with the smallest diff, working through compiler errors, Swift 6 strict concurrency diagnostics such as non-Sendable sends and actor-isolated access, SwiftPM dependency resolution and Package.resolved conflicts, and build settings like SWIFT_VERSION or search paths, then re-runs the failing build to prove it passes. |
 | [`swift-reviewer`](agents/swift-reviewer/AGENT.md) | coding | runs-commands | Read-only Swift code reviewer that inspects a diff for crash-prone force unwraps and try!, retain cycles in escaping closures, actor isolation mistakes and Sendable violations, UIKit or SwiftUI state touched off the main actor, and swallowed or misrouted errors, then returns verified findings ranked by severity. |
+| [`task-implementer`](agents/task-implementer/AGENT.md) | coding | writes-files | Focused build subagent that carries out exactly one task from an implementation plan, from the full task text and context handed to it. |
 | [`typescript-build-resolver`](agents/typescript-build-resolver/AGENT.md) | coding | runs-commands | Repairs failing TypeScript and JavaScript builds with the smallest diff, working through tsc type errors, "Cannot find module" and module resolution failures, ESM/CJS interop errors, bundler (Vite, webpack, esbuild, tsup) failures and broken or mismatched npm/pnpm dependencies, then re-runs the failing command to prove it passes. |
 | [`typescript-reviewer`](agents/typescript-reviewer/AGENT.md) | coding | runs-commands | TypeScript and JavaScript diff reviewer that hunts type holes (any, unsafe casts, non-null assertions, ts-ignore), floating or unhandled promises, async races, ESM/CommonJS import breakage and runtime bugs the compiler cannot see, then returns verified findings without touching files. |
 | [`vue-reviewer`](agents/vue-reviewer/AGENT.md) | coding | runs-commands | Read-only reviewer for Vue 3 and Nuxt diffs that hunts for state which silently stops being reactive, watchers and listeners never torn down, props or store state mutated from a child, server and client rendering that disagree, and Nuxt data fetched twice or secrets exposed through public runtime config, then returns verified findings with file and line. |
@@ -330,16 +399,21 @@ Slash commands you type, for example `/verify`. Supported in Claude Code, OpenCo
 | Name | Category | Risk | What it does |
 |---|---|---|---|
 | [`/aside`](commands/aside.md) | meta | read-only | Answer a quick side question without changing files or losing the thread of the current task, then pick the task up where it was. |
+| [`/brainstorm`](commands/brainstorm.md) | coding | writes-files | Turn a rough idea into an approved design before any code is written, asking one question at a time and comparing approaches. |
 | [`/build-fix`](commands/build-fix.md) | coding | runs-commands | Fix the current build, compile or type-check failure with the smallest change, routed to the build resolver for that language. |
 | [`/campaign`](commands/campaign.md) | business | read-only | Plan a marketing campaign: audience, positioning, channels, messages, calendar, budget split and success metrics. |
 | [`/changelog`](commands/changelog.md) | meta | writes-files | Write changelog entries for the changes since the last release tag, grouped by type, with breaking changes called out first. |
 | [`/checkpoint`](commands/checkpoint.md) | devops | runs-commands | Save a restorable snapshot of the working tree after running the project's checks, without committing or changing anything, or list and restore earlier ones. |
 | [`/codemap`](commands/codemap.md) | docs | writes-files | Write or refresh a short architecture map of the codebase (entry points, modules, data flow, commands) at docs/CODEMAP.md, so agents can orient without reading everything. |
 | [`/commit`](commands/commit.md) | meta | runs-commands | Write a Conventional Commits message for the staged changes, show it, and commit only after the user confirms. |
+| [`/debug`](commands/debug.md) | coding | runs-commands | Find the root cause of a bug, failing test or unexpected behaviour by evidence before proposing or making any fix. |
 | [`/deps-audit`](commands/deps-audit.md) | security | runs-commands | Audit the project's dependencies for known vulnerabilities, abandoned or risky packages and licence problems, and report fixes by severity. |
+| [`/dual-review`](commands/dual-review.md) | coding | runs-commands | Two independent reviewers, optionally on different models or providers, review the same change against one rubric; fix and repeat until both approve or the round limit is hit, then report disagreements. |
 | [`/epic-decompose`](commands/epic-decompose.md) | docs | network | Break a feature or epic into small, independently shippable issues with acceptance criteria, and create them in GitHub, Jira or Linear after approval. |
 | [`/explain`](commands/explain.md) | docs | read-only | Explain how a piece of code or a flow works, tracing it through the codebase with file:line references, without changing anything. |
 | [`/feature-dev`](commands/feature-dev.md) | coding | writes-files | Build a feature end to end: plan it, implement it test-first, review it and verify it, stopping for approval between stages. |
+| [`/finish-branch`](commands/finish-branch.md) | coding | runs-commands | Finish the current branch - run the checks, confirm the base, then merge locally, open a pull request, keep it or discard it, with cleanup and no force-push or deletion without consent. |
+| [`/fix-bug`](commands/fix-bug.md) | coding | runs-commands | Fix a reported bug by reproducing it as a failing regression test, finding the root cause, making the smallest fix, verifying, reviewing the diff and offering a commit. |
 | [`/hookify`](commands/hookify.md) | security | writes-files | Turn a rule the agent must never break into an enforced hook: write it in the portable Kete Loom hook format, test it with cases, and show how to register it. |
 | [`/i18n-check`](commands/i18n-check.md) | coding | runs-commands | Check the current UI changes for internationalisation problems such as hard-coded strings, concatenation, plurals, and date or currency formatting. |
 | [`/issue-sync`](commands/issue-sync.md) | devops | network | Bring tracked issues in line with the work: find the issues this branch or PR addresses and propose status updates, comments and links, applying them after approval. |
@@ -355,6 +429,7 @@ Slash commands you type, for example `/verify`. Supported in Claude Code, OpenCo
 | [`/pr`](commands/pr.md) | devops | network | Open a pull request for the current branch: check it is ready, write the title and description, push, and create the PR, asking before anything leaves the machine. |
 | [`/pr-describe`](commands/pr-describe.md) | docs | runs-commands | Draft a pull request title and description for the current branch from its commits and diff against the base branch. |
 | [`/prd`](commands/prd.md) | meta | writes-files | Draft a product requirements document for a feature, with problem, users, requirements, success metrics and open questions. |
+| [`/production-readiness`](commands/production-readiness.md) | devops | runs-commands | Audit a service before launch for health checks, observability, rollback, backups, limits, secrets and runbooks, and return a go/no-go list with evidence. |
 | [`/project-init`](commands/project-init.md) | meta | writes-files | Set a repository up for coding agents: write or improve AGENTS.md, install the Kete Loom packs for its stack, and fix what the readiness audit flags. |
 | [`/refactor-clean`](commands/refactor-clean.md) | coding | runs-commands | Find and remove dead code, unused exports and unused dependencies, verifying with the build and tests after each removal. |
 | [`/resume-session`](commands/resume-session.md) | meta | read-only | Resume work from the latest session handoff note, checking it against the repository before taking the next step. |
@@ -367,6 +442,7 @@ Slash commands you type, for example `/verify`. Supported in Claude Code, OpenCo
 | [`/test-coverage`](commands/test-coverage.md) | testing | runs-commands | Find untested behaviour in the current change and add focused tests for it, then show the coverage before and after. |
 | [`/threat-model`](commands/threat-model.md) | security | read-only | Produce a threat model for a feature or system, with assets, trust boundaries, data flows, STRIDE threats and ranked mitigations. |
 | [`/update-docs`](commands/update-docs.md) | docs | writes-files | Update the README, API docs, changelog and code comments that the current change made stale, without touching unrelated docs. |
+| [`/usage-report`](commands/usage-report.md) | ai | runs-commands | Summarise token usage and estimated cost per session, project and model from local agent session logs (Claude Code, Codex, Gemini CLI, OpenCode, Kete Code), read-only. |
 | [`/verify`](commands/verify.md) | testing | runs-commands | Verify the current changes by running the project's build, lint, type-check and tests, then report pass or fail. |
 <!-- commands:end -->
 
@@ -400,29 +476,36 @@ npx @ketecode/loom install --profile core      # common rules plus the ones for
 | [`swift`](rules/swift.md) | coding | read-only | Always-on rules for Swift code, covering optionals, value types, error handling, Swift concurrency and actors, memory and retain cycles, and build and test checks. |
 | [`testing`](rules/testing.md) | testing | read-only | Always-on rules for writing and running tests in any language, covering behaviour-focused tests, failing tests first for bugs, determinism, isolation, speed and running the suite before finishing. |
 | [`typescript`](rules/typescript.md) | coding | read-only | Always-on rules for TypeScript and JavaScript files, covering type safety, untrusted input, async errors, modules and the project's own tooling. |
+| [`use-skills`](rules/use-skills.md) | meta | read-only | Always-on rule to check for an installed skill, agent or command that fits a task before starting it, say which one is used, and follow its steps rather than working from memory. |
 <!-- rules:end -->
 
 ## Hooks
 
-Checks that run automatically at points in the agent loop: before a shell command or a file edit (and can block it, with a reason the agent sees), after an edit, or when a session starts. Hooks are opt-in: `install` never adds them unless you ask.
+Checks that run automatically at points in the agent loop: before a shell command or a file edit (and can block it, with a reason the agent sees), after an edit, when a session starts, or when the agent finishes its turn (and can send it back to work). Hooks are opt-in: `install` never adds them unless you ask. Hooks marked opt-in change how the agent works, so `--hooks` leaves them out; name them, or use `--profile strict`.
 
 ```bash
 npx @ketecode/loom install --hook block-dangerous-commands,guard-secrets   # chosen hooks
-npx @ketecode/loom install --hooks                           # everything, plus every hook
+npx @ketecode/loom install --hooks                           # everything, plus every hook not marked opt-in
 npx @ketecode/loom uninstall --hook block-dangerous-commands
 ```
 
-The installer registers each hook with Claude Code and every other host it finds: Claude Code and Gemini CLI in their `settings.json`, Kete Code in `kete.json`, Codex and Cursor in their `hooks.json`, Copilot CLI in `~/.copilot/hooks/` and OpenCode as a plugin. It only adds and removes its own entries, backs a file up to `<file>.kete-loom-backup` before changing it, and never rewrites a file that has comments (it prints the snippet to paste instead). Codex runs a new hook only after you trust it with `/hooks`. Hooks install for your user only, not per project. Cursor has no hook before an edit and OpenCode none that adds context at session start, so those hooks skip them.
+The installer registers each hook with Claude Code and every other host it finds: Claude Code and Gemini CLI in their `settings.json`, Kete Code in `kete.json`, Codex and Cursor in their `hooks.json`, Copilot CLI in `~/.copilot/hooks/` and OpenCode as a plugin. It only adds and removes its own entries, backs a file up to `<file>.kete-loom-backup` before changing it, and never rewrites a file that has comments (it prints the snippet to paste instead). Codex runs a new hook only after you trust it with `/hooks`. Hooks install for your user only, not per project. Cursor has no hook before an edit and OpenCode none that adds context at session start, so those hooks skip them; hooks that send the agent back when it finishes skip Kete Code and OpenCode, whose stop hooks can't. Kiro hooks belong to its agent configs and aren't installed.
 
 <!-- hooks:start -->
 | Name | Category | Risk | What it does |
 |---|---|---|---|
 | [`block-dangerous-commands`](hooks/block-dangerous-commands/HOOK.md) | security | read-only | Stops the agent before it runs shell commands that destroy data or systems, such as rm -rf on / or your home folder, force-pushing main, wiping disks, piping curl into a shell, dropping databases or auto-approved terraform destroy. |
+| [`block-foreground-servers`](hooks/block-foreground-servers/HOOK.md) | devops | read-only | Stops the agent from starting a dev server or file watcher in the foreground, where it never exits and hangs the agent's shell, and tells it to run it in the background with output going to a log. |
 | [`block-no-verify`](hooks/block-no-verify/HOOK.md) | security | read-only | Stops the agent from skipping the project's git hooks with git commit --no-verify, -n, HUSKY=0, SKIP= or a swapped core.hooksPath, so pre-commit checks keep running. |
+| [`capture-lessons`](hooks/capture-lessons/HOOK.md) | meta | writes-files | Once per session, when the agent finishes with changes in the repository, asks it to propose up to three reusable lessons from the session for /learn, saving nothing unless you approve. |
 | [`format-on-edit`](hooks/format-on-edit/HOOK.md) | coding | runs-commands | After the agent edits a file, formats it with the formatter the project already uses (Biome or Prettier, Ruff or Black, gofmt, rustfmt), so agent changes match the project's style. |
 | [`guard-secrets`](hooks/guard-secrets/HOOK.md) | security | read-only | Stops the agent from writing API keys, tokens, passwords, connection strings or private keys into files, using the same rules as the security-review secret scanner. |
 | [`load-session-context`](hooks/load-session-context/HOOK.md) | meta | runs-commands | At the start of each session, tells the agent the current branch, how many uncommitted changes there are, and the latest session handoff note, so it picks up where the last session stopped. |
+| [`notify-on-stop`](hooks/notify-on-stop/HOOK.md) | meta | runs-commands | Shows a desktop notification when the agent finishes its turn, so you can switch away during long tasks and come back when it is your move. |
 | [`protect-files`](hooks/protect-files/HOOK.md) | security | read-only | Stops the agent from editing files that should never be hand-edited, such as .env files with secrets, package lockfiles, anything inside .git, and private keys. |
+| [`protect-lint-config`](hooks/protect-lint-config/HOOK.md) | coding | read-only | Stops the agent from editing existing linter, formatter and type-checker configs, so it fixes the code that breaks a rule instead of weakening or switching off the rule. |
+| [`read-before-edit`](hooks/read-before-edit/HOOK.md) | coding | writes-files | Stops the first edit of each existing file in a session and tells the agent to read the file and search for its callers first, so changes are grounded in the real code rather than a guess. |
+| [`verify-before-stop`](hooks/verify-before-stop/HOOK.md) | testing | runs-commands | When the agent says it is done, runs the project's own lint and type-check commands if files changed, and sends it back to fix any failure instead of letting it finish with broken code. |
 <!-- hooks:end -->
 
 ## MCP servers
@@ -431,7 +514,7 @@ Curated MCP server configs, registered with every host you use in that host's ow
 
 ```bash
 npx @ketecode/loom install --mcp github,playwright          # chosen servers
-npx @ketecode/loom install --profile mcp-web                # a pack: playwright, chrome-devtools, context7, fetch
+npx @ketecode/loom install --profile mcp-web                # a pack: playwright, chrome-devtools, context7, fetch, exa, firecrawl
 npx @ketecode/loom uninstall --mcp github
 ```
 
@@ -442,10 +525,13 @@ Packs: `mcp-web`, `mcp-code` (GitHub, Git, Sentry), `mcp-team` (Linear, Notion,
 |---|---|---|---|
 | [`atlassian`](mcp/atlassian.json) | remote | OAuth | Atlassian's remote MCP server for Jira and Confluence: issues, pages and search, signed in with Atlassian OAuth. |
 | [`chrome-devtools`](mcp/chrome-devtools.json) | local | none | The Chrome DevTools MCP server: control and inspect a live Chrome, including console, network, performance traces and screenshots. |
+| [`clickhouse`](mcp/clickhouse.json) | remote | OAuth | ClickHouse Cloud's remote MCP server: list databases and tables and run read-only SQL on services you enable it for, signed in with ClickHouse Cloud OAuth. |
 | [`cloudflare`](mcp/cloudflare.json) | remote | OAuth | Cloudflare's remote MCP server for the Cloudflare API and docs, signed in with Cloudflare OAuth. |
 | [`context7`](mcp/context7.json) | remote | OAuth | Context7 by Upstash: up-to-date, version-specific library documentation and code examples for the model. Works without a key at lower rate limits. |
+| [`exa`](mcp/exa.json) | remote | none | Exa's remote MCP server: web search, page contents and code search for the model. Free and rate-limited without a key; no sign-in needed. |
 | [`fetch`](mcp/fetch.json) | local | none | The reference Fetch MCP server: fetch a web page and return it as Markdown for the model to read. |
 | [`figma`](mcp/figma.json) | remote | OAuth | Figma's remote MCP server: bring design context (frames, components, variables) into code, signed in with Figma. |
+| [`firecrawl`](mcp/firecrawl.json) | remote | OAuth | Firecrawl's remote MCP server: scrape, crawl, map and search websites into clean Markdown or structured data, signed in with Firecrawl OAuth. |
 | [`git`](mcp/git.json) | local | none | The reference Git MCP server: read history, diffs and status and make commits in a local repository. |
 | [`github`](mcp/github.json) | remote | OAuth | GitHub's official remote MCP server: repositories, issues, pull requests and Actions, signed in with GitHub OAuth. |
 | [`linear`](mcp/linear.json) | remote | OAuth | Linear's remote MCP server: read and update issues, projects and comments, signed in with Linear OAuth. |
@@ -456,6 +542,7 @@ Packs: `mcp-web`, `mcp-code` (GitHub, Git, Sentry), `mcp-team` (Linear, Notion,
 | [`stripe`](mcp/stripe.json) | remote | OAuth | Stripe's remote MCP server: work with the Stripe API and search Stripe docs, signed in with Stripe OAuth. |
 | [`supabase`](mcp/supabase.json) | remote | OAuth | Supabase's remote MCP server in read-only mode: inspect projects, schemas and data, and search the docs, signed in with Supabase OAuth. |
 | [`time`](mcp/time.json) | local | none | The reference Time MCP server: current time and timezone conversion. |
+| [`vercel`](mcp/vercel.json) | remote | OAuth | Vercel's remote MCP server: search the docs, manage projects and deployments, read deployment logs and query Web Analytics, signed in with Vercel OAuth. |
 <!-- mcp:end -->
 
 ## Housekeeping
@@ -466,6 +553,7 @@ npx @ketecode/loom outdated           # installed items older than the latest Ke
 npx @ketecode/loom audit              # score this project's readiness for coding agents, with fixes
 npx @ketecode/loom check ./my-skills  # lint your own skills, agents, commands, rules or hooks
 npx @ketecode/loom doctor             # what is installed where
+npx @ketecode/loom doctor --fix       # repair the hook runtime and drop stale hook registrations
 ```
 
 `audit` checks the things that make agents work well in a repository: agent instructions (`AGENTS.md`/`CLAUDE.md`), the Kete Loom packs for the stack it detects, test and lint commands, CI, the safety hooks, and that `.env` files are ignored and not committed. It exits non-zero when a check fails, so it can run in CI.
@@ -485,6 +573,7 @@ Inside your agent, `/loom` finds the right items for a task, `/checkpoint` saves
 | Gemini CLI only | `~/.gemini/skills` | `.gemini/skills` |
 | GitHub Copilot only | `~/.copilot/skills` | `.github/skills` |
 | Kete Code only | `~/.config/kete/skills` | `.kete/skills` |
+| Kiro | `~/.kiro/skills` | `.kiro/skills` |
 
 ### Agents and commands
 
@@ -497,8 +586,9 @@ Inside your agent, `/loom` finds the right items for a task, `/checkpoint` saves
 | Kete Code | `~/.config/kete/agents` | `~/.config/kete/commands` | when `~/.config/kete` exists |
 | Gemini CLI | `~/.gemini/agents` | `~/.gemini/commands` (TOML) | when `~/.gemini` exists |
 | Copilot CLI | `~/.copilot/agents` (`.agent.md`) | not supported | with `--target copilot` |
+| Kiro | `~/.kiro/agents` | `~/.kiro/prompts` | when `~/.kiro` exists |
 
-Project installs (`--project`) use the same folders inside the repo (`.github/agents` for Copilot, `.kete/` for Kete Code).
+Project installs (`--project`) use the same folders inside the repo (`.github/agents` for Copilot, `.kete/` for Kete Code, `.kiro/` for Kiro). Kiro rules become steering files in `~/.kiro/steering`, scoped with `fileMatch`.
 
 ## Contributing
 
@@ -507,7 +597,17 @@ Read [`docs/SKILL_SPEC.md`](docs/SKILL_SPEC.md) (skills, agents and commands) an
 ```bash
 npm run lint      # frontmatter, length, references, evals, manifest versions
 npm test          # installer and linter tests
-npm run eval      # eval file checks (CI also runs live routing evals)
+npm run eval      # trigger and behaviour eval file checks (CI also runs them live)
+```
+
+Two kinds of evals keep items honest:
+
+- **Trigger evals** (`evals/triggers.json`): a model routes realistic prompts and near misses the way hosts do, and each item must be picked for its own prompts and only those.
+- **Behaviour evals** (`evals/behavior.json`): scenarios that pressure the agent to skip the item's discipline ("just patch it, we ship in ten minutes"). Each runs with the item and without it, a judge model grades every reply, and the report shows what the item adds. `--host claude` runs them as real headless Claude Code sessions.
+
+```bash
+npm run eval:live -- --skill my-skill                     # routing
+npm run eval:behavior -- --live --skill my-skill          # behaviour, with and without the skill
 ```
 
 The `skill-authoring` skill walks your agent through writing a new skill to this standard.