@massa-ai/cursor-plugin 1.60.1 → 1.62.0

package/skills/massa-ai/workflows/implementation/implementation-audit.md

@@ -38,11 +38,30 @@ Not for a single requested audit lens — route directly to that lens. Do not ed
    - For a broad/full audit, run Correctness, Architecture, Code Quality, Security, and Tests. Run Requirements only when a requirements source is available.
    - Supported lenses: Correctness -> `workflows/bugs/bugs-audit.md`; Architecture -> `workflows/architecture/architecture-audit.md`; Code Quality -> `workflows/code-quality/code-quality-audit.md`; Security -> `workflows/security/security-audit.md`; Requirements -> `workflows/requirements/requirements-audit.md`; Tests -> `workflows/tests/tests-audit.md`.
    - When a broad audit lacks requirements, ask for a source when interactive and not forbidden; otherwise mark Requirements `not evaluated: missing source`. Never report a requirements all-clear without a source.
-7. Establish child contracts and dispatch `audit-specialist` per lens through `references/agent-orchestration.md`:
+7. Establish child contracts and dispatch one agent per lens through `references/agent-orchestration.md`: `code-reviewer` for Correctness (`lens: bugs`), Architecture, Code Quality, and Security; `product-manager` for Requirements; `test-engineer` for Tests.
 
-> **Dispatch: `massa-ai-audit-specialist`** (role: `audit-specialist`) — charter `skills/agents/audit-specialist/SKILL.md`
+> **Dispatch: `code-reviewer`** (role: `code-reviewer`, mode: `audit`) — charter `skills/agents/code-reviewer/SKILL.md`
 > - trigger: broad/full audit requiring multiple lenses, or explicit multi-lens request
-> - scope: one lens per dispatch against the shared implementation scope packet (Correctness/Architecture/Code Quality/Security/Requirements/Tests)
+> - scope: one lens per dispatch against the shared implementation scope packet (Correctness as `lens: bugs`, Architecture as `lens: architecture`, Code Quality as `lens: code-quality`, Security as `lens: security`)
+> - inputs: exact `projectId`, parent `workflowSessionId`, child workflow, lens name, shared scope packet, resolved files/diff summary, relevant recalled facts, allowed surrounding-code depth, deterministic sensors, context-firewall limits, and output contract
+> - sensors: target-relevant deterministic commands (tests, builds, lint, type checks, static checks, import checks) per lens
+> - output: `Status`, `Scope checked`, `Evidence`, `Findings`, `Verification/Test Fidelity Checklist`, `Risks and skipped checks`, and `Exact next step`
+> - firewall: raw diffs/logs/search output summarized, not returned raw
+> - memory: suggest-only; children must not persist broad project memory unless assigned
+
+> **Dispatch: `product-manager`** (role: `product-manager`, mode: `audit`) — charter `skills/agents/product-manager/SKILL.md`
+> - trigger: the Requirements lens is in scope and a requirements source is available
+> - scope: the Requirements lens (`lens: requirements`) against the shared implementation scope packet and the resolved requirements source
+> - permissions: read-only
+> - inputs: exact `projectId`, parent `workflowSessionId`, child workflow, lens name, shared scope packet, resolved files/diff summary, relevant recalled facts, allowed surrounding-code depth, deterministic sensors, context-firewall limits, and output contract
+> - sensors: target-relevant deterministic commands (tests, builds, lint, type checks, static checks, import checks) per lens
+> - output: `Status`, `Scope checked`, `Evidence`, `Findings`, `Verification/Test Fidelity Checklist`, `Risks and skipped checks`, and `Exact next step`
+> - firewall: raw diffs/logs/search output summarized, not returned raw
+> - memory: suggest-only; children must not persist broad project memory unless assigned
+
+> **Dispatch: `test-engineer`** (role: `test-engineer`, mode: `audit`) — charter `skills/agents/test-engineer/SKILL.md`
+> - trigger: the Tests lens is in scope
+> - scope: the Tests lens (`lens: tests`) against the shared implementation scope packet
 > - permissions: read-only
 > - inputs: exact `projectId`, parent `workflowSessionId`, child workflow, lens name, shared scope packet, resolved files/diff summary, relevant recalled facts, allowed surrounding-code depth, deterministic sensors, context-firewall limits, and output contract
 > - sensors: target-relevant deterministic commands (tests, builds, lint, type checks, static checks, import checks) per lens

package/skills/massa-ai/workflows/implementation/implementation-fix.md

@@ -32,7 +32,7 @@ Do not execute from chat summaries, inline review comments, remembered findings,
    - `references/discrimination-sensor.md` before closing any finding at the tiers the verification-ladder's Independent Verification Mandate names.
    - `references/knowledge-verification-chain.md` when a finding's fix depends on external library/API behavior not already verified this session.
    - `references/brownfield-mapping.md` (Minimum Bar only) for Standard+ findings when recall returns no hit for the target and no gate command is derivable from the report's evidence.
-   - `references/agent-orchestration.md` for high-risk findings or disjoint implementation slices; the mandated verification-agent dispatch below is carved out of this trigger by agent-orchestration's Independent Verification Exception and always attempts dispatch at its own tier gate.
+   - `references/agent-orchestration.md` for high-risk findings or disjoint implementation slices; the mandated `code-reviewer` `verify` dispatch below is carved out of this trigger by agent-orchestration's Independent Verification Exception and always attempts dispatch at its own tier gate.
 3. `recall` -> load prior implementation audit decisions, known regressions, architecture/security boundaries, accepted exceptions, testing conventions, and reusable verification recipes for the target.
 4. Select the report with an explicit execution focus:
    - Establish report selector, target focus, and optional source-qualified finding IDs before selecting a report.
@@ -62,14 +62,14 @@ Do not execute from chat summaries, inline review comments, remembered findings,
 9. Size each finding with `references/verification-ladder.md`. Quick findings may proceed locally; Standard findings require characterization and an explicit recipe; ambiguous, cross-boundary, migration-heavy, or broad redesign findings pause and route to `spec-driven`.
 10. Orchestrate conservatively. The main agent owns report parsing, scope/freshness, prioritization, questions, memory, and final evidence. Dispatch per `references/agent-orchestration.md`:
 
-**Screen work — before writing or judging any user-facing screen:** when this task creates or modifies a screen, the `massa-ai-designer` dispatch below is mandatory rather than discretionary, carved out of ordinary delegation gating by the Screen Implementation Exception in `references/agent-orchestration.md`. It does not fire when the task touches no screen surface.
+**Screen work — before writing or judging any user-facing screen:** when this task creates or modifies a screen, the `designer` dispatch below is mandatory rather than discretionary, carved out of ordinary delegation gating by the Screen Implementation Exception in `references/agent-orchestration.md`. It does not fire when the task touches no screen surface.
 
-> **Dispatch: `massa-ai-designer`** (role: `designer`) — charter `skills/agents/designer/SKILL.md`
+> **Dispatch: `designer`** (role: `designer`, mode: `implement`) — charter `skills/agents/designer/SKILL.md`
 > - scope: the screens, views, components, layouts, styles, and design tokens in this task's UI surface — never the whole repository
 > - permissions: write, scoped to UI-layer files only with a disjoint write set
 > - output: per-element conformance table (element, expected, actual, verdict, severity) plus the UI files written; a missing or unreachable design source is listed as a skipped sensor, never a silent pass
 
-> **Dispatch: `massa-ai-builder`** (role: `builder`) — charter `skills/agents/builder/SKILL.md`
+> **Dispatch: `builder`** (role: `builder`) — charter `skills/agents/builder/SKILL.md`
 > - trigger: isolated finding with disjoint write set and concrete verification
 > - scope: one isolated implementation finding with a disjoint write set
 > - permissions: write (disjoint write set)
@@ -81,17 +81,16 @@ Do not execute from chat summaries, inline review comments, remembered findings,
 
     Never run parallel writers against shared files or contracts.
 
-> **Dispatch: `massa-ai-reviewer`** (role: `reviewer`) — charter `skills/agents/reviewer/SKILL.md`
+> **Dispatch: `code-reviewer`** (role: `code-reviewer`, mode: `review`) — charter `skills/agents/code-reviewer/SKILL.md`
 > - trigger: implementation complete, before the verification gate — never optional
 > - scope: the fix's diff surface and its task/AC context
-> - permissions: read-only
 > - inputs: diff, acceptance context, recalled code-quality conventions
 > - sensors: bugs, regressions, missing edge cases, smells introduced by the diff
 > - output: ranked findings, blocking vs advisory; blocking findings become fix items before verification runs
 > - firewall: summarized findings only, never raw diff dumps
 > - memory: suggest-only; main agent persists
 
-> **Dispatch: `massa-ai-verification-agent`** (role: `verification-agent`) — charter `skills/agents/verification-agent/SKILL.md`
+> **Dispatch: `code-reviewer`** (role: `code-reviewer`, mode: `verify`) — charter `skills/agents/code-reviewer/SKILL.md`
 > - trigger: an `Area/PREFIX-N` finding's closure meets the verification-ladder's Independent Verification Mandate tier gate — Standard+/Spec-driven size or any high/critical-severity finding
 > - scope: the closed `Area/PREFIX-N` finding's fix diff, its source-lens claim, and the validation assets the fix touches
 > - inputs: the source-qualified finding ID, the applied fix diff, the report's Verification Suggestion, and the pending closure-matrix row

package/skills/massa-ai/workflows/judge-with-debate.md

@@ -12,10 +12,10 @@ Use when the user explicitly asks to evaluate an artifact through multi-judge
 debate — "judge this", "judge-with-debate", "evaluate with debate", "run the judges on X". The
 user supplies artifact path(s) plus a task description (what the artifact was supposed to
 accomplish) and optionally evaluation context. Standalone, explicit-route workflow: never
-auto-selected by the router for generic review work (use `reviewer`, `*-audit`, or
-`plan-critic` for those).
+auto-selected by the router for generic review work (use `code-reviewer`, `*-audit`, or
+the Plan Challenge `judge` `plan-critique` dispatch for those).
 
-The protocol: a meta-judge authors a tailored evaluation specification **once**; three
+The protocol: one `judge` in `spec-author` mode authors a tailored evaluation specification **once**; three
 independent judges score the artifact against it with quoted evidence; the judges debate their
 disagreements over **up to 3 rounds**; the panel converges on a consensus verdict or reports an
 honest no-consensus. Ported from the NeoLabHQ `judge-with-debate` pattern; this file is the
@@ -57,7 +57,7 @@ Check whether the host supports **dispatch-time model selection** (a per-dispatc
 parameter on the task/subagent tool). This probe runs on every invocation — when a host gains
 the capability, per-slot diversity activates automatically with no harness edit.
 
-- Probe positive → request per-slot models at dispatch: meta-judge `kimi-k3`, Judge 1
+- Probe positive → request per-slot models at dispatch: spec-author `kimi-k3`, Judge 1
   `deepseek-v4-pro`, Judge 2 `minimax-m3`, Judge 3 `GLM-5.2`.
 - Probe negative (all four hosts today) → dispatch the charter-default artifacts and record the
   unmet per-slot requests. Every fallback is named; if any slot fell back the consensus file and
@@ -66,12 +66,12 @@ the capability, per-slot diversity activates automatically with no harness edit.
 - A pinned-but-unavailable model falls back to the host default for that slot, named loudly in
   the same way.
 
-## Step 1 — Meta-judge (exactly once)
+## Step 1 — Spec-author (exactly once)
 
-Dispatch `massa-ai-meta-judge` (read-only) with the task description, artifact type, context,
+Dispatch `judge` in `spec-author` mode (read-only) with the task description, artifact type, context,
 and artifact paths. Model request: `kimi-k3` (see Step 0.5).
 
-> **Dispatch: `massa-ai-meta-judge`** (role: `meta-judge`) — charter `skills/agents/meta-judge/SKILL.md`
+> **Dispatch: `judge`** (role: `judge`, mode: `spec-author`) — charter `skills/agents/judge/SKILL.md`
 > - trigger: judge-with-debate Step 1; runs exactly once per evaluation
 > - scope: the artifact under evaluation (paths supplied), task description, artifact type
 > - permissions: read-only
@@ -94,23 +94,23 @@ Validate the returned evaluation specification in two stages, in order; a retry
    `rubric` with anchors for scores 1, 3, 5, and a `checklist` with ≥1 item. Parseable but
    invalid specs (e.g. `scale.max: 7`) fail here, not at stage 1.
 
-On failure: retry the meta-judge **once** with the failed stage + check name. Second failure →
-stop `Blocked`. The meta-judge runs exactly once per evaluation — never re-run between rounds,
+On failure: retry the spec-author **once** with the failed stage + check name. Second failure →
+stop `Blocked`. The spec-author runs exactly once per evaluation — never re-run between rounds,
 never edited by the orchestrator; the YAML passes to all judges in all rounds **verbatim**.
 
-Feedback: `🤖 [Agent Started] Meta-Judge is authoring the evaluation specification.`
+Feedback: `🤖 [Agent Started] Judge (spec-author) is authoring the evaluation specification.`
 then `🤖 [Agent Done]` or `🤖 [Agent Blocked]` with the one-line reason.
 
 ## Step 2 — Independent analysis (3 judges in parallel)
 
-Dispatch three `massa-ai-judge` agents **in parallel** (round 0), one per judge number, each
+Dispatch three `judge` agents in `scorer` mode **in parallel** (round 0), one per judge number, each
 with: the verbatim specification YAML, task description, artifact paths, its own report path,
 `round: 0`, and its model request (Step 0.5). The fixed panel of 3 sits inside the wave cap of
 4 concurrent subagents (`references/agent-orchestration.md`, Orchestrator Working Memory).
 Each judge writes its own `audits/judge/<...> judge-N.md` per the report contract and returns
 the reply block:
 
-> **Dispatch: `massa-ai-judge`** (role: `judge`) — charter `skills/agents/judge/SKILL.md` — 3 per panel, rounds 0..3
+> **Dispatch: `judge`** (role: `judge`, mode: `scorer`) — charter `skills/agents/judge/SKILL.md` — 3 per panel, rounds 0..3
 > - trigger: judge-with-debate Steps 2 and 4; panel of exactly 3, never more
 > - scope: the artifact under evaluation, the verbatim specification YAML, own report path; debate rounds add all three report paths as peer paths and `round: R`
 > - permissions: read-only except appending to its own judge-N report file
@@ -159,7 +159,7 @@ Step 5. If no consensus and rounds remain → Step 4. If no consensus after roun
 
 ## Step 4 — Debate round (rounds 1..3, max 3)
 
-Increment the round. Dispatch three `massa-ai-judge` agents **in parallel** again, each with:
+Increment the round. Dispatch three `judge` agents **in parallel** again, each with:
 the verbatim specification YAML (unchanged), task description, artifact paths, its own report
 path, **all three** report paths as peer paths, and `round: R`. Each judge:
 
@@ -198,7 +198,7 @@ did not reach.**
 
 ## Pitfalls (each is a rule, not advice)
 
-- Never skip the meta-judge; never let judges score without the shared specification.
+- Never skip the spec-author; never let judges score without the shared specification.
 - Never modify or regenerate the specification between rounds — verbatim, every round.
 - Never let a debate judge create a new report file — append-only `## Debate Round {R}` sections.
 - Never relay reports between judges through the orchestrator — filesystem channel only.

package/skills/massa-ai/workflows/mobile-figma/mobile-figma-audit.md

@@ -58,9 +58,9 @@ Do not edit code. Route direct design implementation to `design`. Not for Flutte
 16. Persist only durable token/component mappings, source-set ownership rules, approved accessibility/platform deviations, asset-pipeline rules, or reusable render recipes after Importance Calibration. Use `workflow:mobile-figma-audit` and required tags. Never persist screenshots, hierarchy dumps, raw logs, device IDs, or user data.
 17. Complete `references/evidence-gate.md`. A model visual impression cannot satisfy the gate.
 
-**Screen work — before writing or judging any user-facing screen:** when this task creates or modifies a screen, the `massa-ai-designer` dispatch below is mandatory rather than discretionary, carved out of ordinary delegation gating by the Screen Implementation Exception in `references/agent-orchestration.md`. It does not fire when the task touches no screen surface.
+**Screen work — unconditional in this workflow:** every task here judges a user-facing screen, so the `designer` dispatch below always runs; it is not gated on a screen-work condition (Screen Implementation Exception in `references/agent-orchestration.md`).
 
-> **Dispatch: `massa-ai-designer`** (role: `designer`) — charter `skills/agents/designer/SKILL.md`
+> **Dispatch: `designer`** (role: `designer`, mode: `audit`) — charter `skills/agents/designer/SKILL.md`
 > - scope: the screens, views, components, layouts, styles, and design tokens under audit — never the whole repository, and no edits
 > - permissions: read-only — this workflow is findings-only; the charter permits writes only when explicitly scoped, and its Restrictions win over the packet, so read-only governs
 > - output: per-element conformance table (element, expected, actual, verdict, severity) feeding `MFM-*` findings; a missing or unreachable design source is listed as a skipped sensor, never a silent pass

package/skills/massa-ai/workflows/mobile-figma/mobile-figma-fix.md

@@ -32,7 +32,7 @@ Do not execute from chat summaries, screenshots alone, remembered findings, or a
    - `references/audit-scope.md` and `references/codebase-investigation.md` for freshness and current source.
    - `references/verification-ladder.md` before edits.
    - `references/context-firewall.md` before large design/runtime artifacts.
-   - `references/agent-orchestration.md` for the tier-gated builder/verification-agent dispatch in the fix loop below.
+   - `references/agent-orchestration.md` for the designer/builder dispatches and the tier-gated `code-reviewer` `verify` dispatch in the fix loop below.
    - `references/discrimination-sensor.md` before closing any finding under the Mandatory Verification Fix Gate — the mobile-Figma token/value instantiation lives in `references/mobile-figma-matcher/core.md`'s Discrimination Sensor for Visual Parity section.
    - `references/knowledge-verification-chain.md` when a selected finding's fix direction depends on platform-API or external-library technique rather than the Figma-defined value.
    - `references/brownfield-mapping.md` (Minimum Bar only — the gate-command packet, `TESTING.md`-equivalent) when recall returns no hit for the target surface/module and no gate command is derivable from the report's evidence, for Standard+ findings; the report's Verification/Test Fidelity Checklist already carries the risk surface, so `CONCERNS.md` is satisfied-by-citation from that checklist rather than derived fresh.
@@ -58,36 +58,35 @@ Do not execute from chat summaries, screenshots alone, remembered findings, or a
    - Keep XML/Compose, UIKit/SwiftUI, and KMP/native interoperability explicit. Do not duplicate one visual rule across layers when an established shared source owns it.
    - Do not weaken screenshot tests, previews, fixtures, assertions, test tags, resource IDs, content descriptions, or Maestro selectors to hide a mismatch.
    - Modify tracked Maestro flows only when the selected finding explicitly identifies the flow as incorrect or missing and the user-approved scope includes that change.
-9. Dispatch per `references/agent-orchestration.md`; the verification-agent block below is tier-gated mandatory, not merely discretionary — carved out of ordinary delegation gating by that reference's Independent Verification Exception:
+9. Dispatch per `references/agent-orchestration.md`; the `code-reviewer` `verify` block below is tier-gated mandatory, not merely discretionary — carved out of ordinary delegation gating by that reference's Independent Verification Exception:
 
-**Screen work — before writing or judging any user-facing screen:** when this task creates or modifies a screen, the `massa-ai-designer` dispatch below is mandatory rather than discretionary, carved out of ordinary delegation gating by the Screen Implementation Exception in `references/agent-orchestration.md`. It does not fire when the task touches no screen surface.
+**Screen work — unconditional in this workflow:** every task here fixes a user-facing screen, so the `designer` dispatch below always runs; it is not gated on a screen-work condition (Screen Implementation Exception in `references/agent-orchestration.md`). `designer` implements every UI-layer `MFM-*` fix; `builder` is dispatched only for an `MFM-*` finding whose fix needs non-UI-layer changes (navigation, data, resource or build wiring), with a write set disjoint from the designer's.
 
-> **Dispatch: `massa-ai-designer`** (role: `designer`) — charter `skills/agents/designer/SKILL.md`
+> **Dispatch: `designer`** (role: `designer`, mode: `implement`) — charter `skills/agents/designer/SKILL.md`
 > - scope: the screens, views, components, layouts, styles, and design tokens in this task's UI surface — never the whole repository
 > - permissions: write, scoped to UI-layer files only with a disjoint write set
 > - output: per-element conformance table (element, expected, actual, verdict, severity) plus the UI files written; a missing or unreachable design source is listed as a skipped sensor, never a silent pass
 
-> **Dispatch: `massa-ai-builder`** (role: `builder`) — charter `skills/agents/builder/SKILL.md`
-> - trigger: a selected `MFM-*` finding spans a disjoint surface or shared-root slice, or an explicit subagent request
-> - scope: one `MFM-*` finding, or a coherent surface group sharing one KMP root cause, with a disjoint write set
-> - permissions: write (disjoint write set, per-surface or per-module ownership)
+> **Dispatch: `builder`** (role: `builder`) — charter `skills/agents/builder/SKILL.md`
+> - trigger: a selected `MFM-*` finding whose fix needs non-UI-layer changes (navigation, data, resource or build wiring) — never for a UI-layer fix, which belongs to `designer`
+> - scope: the non-UI-layer part of one `MFM-*` finding, or of a coherent surface group sharing one KMP root cause, with a write set disjoint from the designer's
+> - permissions: write (disjoint write set, non-UI-layer files only)
 > - inputs: the finding's Surface ID, Figma value, resolved token/resource/asset chain, current implementation value, and simplest fix direction
 > - sensors: the remediation matrix's assigned runtime sensor and optional Maestro packet for the surface
 > - output: implementation summary, changed files, commands run, per-surface render evidence
 > - firewall: raw diffs and screenshots summarized
 > - memory: suggest-only; main agent persists reusable token/mapping patterns
 
-> **Dispatch: `massa-ai-reviewer`** (role: `reviewer`) — charter `skills/agents/reviewer/SKILL.md`
+> **Dispatch: `code-reviewer`** (role: `code-reviewer`, mode: `review`) — charter `skills/agents/code-reviewer/SKILL.md`
 > - trigger: implementation complete, before the verification gate — never optional
 > - scope: the fix's diff surface and its task/AC context
-> - permissions: read-only
 > - inputs: diff, acceptance context, recalled code-quality conventions
 > - sensors: bugs, regressions, missing edge cases, smells introduced by the diff
 > - output: ranked findings, blocking vs advisory; blocking findings become fix items before verification runs
 > - firewall: summarized findings only, never raw diff dumps
 > - memory: suggest-only; main agent persists
 
-> **Dispatch: `massa-ai-verification-agent`** (role: `verification-agent`) — charter `skills/agents/verification-agent/SKILL.md`
+> **Dispatch: `code-reviewer`** (role: `code-reviewer`, mode: `verify`) — charter `skills/agents/code-reviewer/SKILL.md`
 > - trigger: mandatory at Standard+/Spec-driven size or high/critical severity per the Independent Verification Mandate in `references/verification-ladder.md`; a Quick-tier finding runs the fallback fresh-eyes self-check below instead
 > - scope: the fixed `MFM-*` finding's surface, resolved token/value, comparison-matrix row, and closure claim
 > - inputs: the finding, the applied fix, the comparison-matrix row, the render sensor used, and validation assets

package/skills/massa-ai/workflows/pr-review.md

@@ -17,7 +17,7 @@ conflict with the base.
 Use when the user explicitly asks to review a hosted PR (Pull Request, GitHub) or
 MR (Merge Request, GitLab) — "review PR 128", "review this MR", "check pull request
 42". Explicit route only: never auto-trigger during coding. Local working-tree diff
-review stays with the audit workflows and `massa-ai-reviewer`; this workflow exists
+review stays with the audit workflows and `code-reviewer`; this workflow exists
 to **post findings back to the host**.
 
 Load `references/project-context.md` (intake sweep) before the first substantive
@@ -142,19 +142,28 @@ the severity labels, and the reply contract.
 
 | # | Dimension | Agent | Packet delta (lens / scope) | Marker `{type}` |
 | --- | --- | --- | --- | --- |
-| 1 | Security | `massa-ai-audit-specialist` | `lens: security` — secrets, authn/authz on new endpoints, injection, unsafe deserialization, PII in logs, permissive CORS, leaking payload fields | `security` |
-| 2 | Requirements & DoD (Definition of Done) | `massa-ai-audit-specialist` | `lens: requirements` — score merged Track A + Track B criteria against the diff, evidence-or-zero: ✅ implemented (`path:line`) / 🟡 partial / ❌ missing; no source ⇒ report "requirements verification skipped" | `requirements` |
-| 3 | Architecture & conventions | `massa-ai-audit-specialist` | `lens: architecture` — extract every explicit rule from the profile's CONVENTIONS/REVIEW_SKILLS docs into a numbered matrix, grade each changed file PASS/VIOLATION/N/A; no docs ⇒ minimal generic boundary sweep, stated | `architecture` |
-| 4 | Performance | `massa-ai-audit-specialist` | `lens: performance` — only issues clearly visible in the diff: N+1 queries, unbounded fetches, per-row lazy I/O, sequential awaits of independent calls, loop-invariant recomputation, unbatched writes | `performance` |
-| 5 | Test coverage | `massa-ai-audit-specialist` | `lens: tests` (dedicated lens: coverage, regression protection, assertion quality, variation — `tests-audit.md` precedent) — new/changed behavior with no test, wrong level (unit vs integration), placement/naming vs profile TEST row, missing negative case, missing variation beyond the fixture example, assertions that exercise but never assert | `tests` |
-| 6 | Regression & hallucination | `massa-ai-reviewer` | diff review — unrelated deletions, references to symbols absent from the repo, wrong signature/arity, duplicated existing logic, weakened error handling or assertions, leftover TODO/stub, dead code | `regression` |
+| 1 | Security | `code-reviewer` | `lens: security` — secrets, authn/authz on new endpoints, injection, unsafe deserialization, PII in logs, permissive CORS, leaking payload fields | `security` |
+| 2 | Requirements & DoD (Definition of Done) | `product-manager` | `mode: audit` — score merged Track A + Track B criteria against the diff, evidence-or-zero: ✅ implemented (`path:line`) / 🟡 partial / ❌ missing; no source ⇒ report "requirements verification skipped" | `requirements` |
+| 3 | Architecture & conventions | `code-reviewer` | `lens: architecture` — extract every explicit rule from the profile's CONVENTIONS/REVIEW_SKILLS docs into a numbered matrix, grade each changed file PASS/VIOLATION/N/A; no docs ⇒ minimal generic boundary sweep, stated | `architecture` |
+| 4 | Performance | `code-reviewer` | `lens: performance` — only issues clearly visible in the diff: N+1 queries, unbounded fetches, per-row lazy I/O, sequential awaits of independent calls, loop-invariant recomputation, unbatched writes | `performance` |
+| 5 | Test coverage | `test-engineer` | `mode: audit` (dedicated tests lens: coverage, regression protection, assertion quality, variation — `tests-audit.md` precedent) — new/changed behavior with no test, wrong level (unit vs integration), placement/naming vs profile TEST row, missing negative case, missing variation beyond the fixture example, assertions that exercise but never assert | `tests` |
+| 6 | Regression & hallucination | `code-reviewer` | `mode: review` — diff review — unrelated deletions, references to symbols absent from the repo, wrong signature/arity, duplicated existing logic, weakened error handling or assertions, leftover TODO/stub, dead code | `regression` |
 
 Consolidation check (≥ 5 subagents): recorded in the feature design — rows 4 and 5
 share only the lens label, not a knowledge domain; they stay separate dispatches.
 
-> **Dispatch: `massa-ai-audit-specialist`** (role: `audit-specialist`) — charter `skills/agents/audit-specialist/SKILL.md`
-> - trigger: pr-review Step 2, dimension rows 1–5 (one dispatch per row)
-> - scope: the PR/MR diff and surrounding context for one dimension row; never the whole repository
+> **Dispatch: `code-reviewer`** (role: `code-reviewer`, mode: `audit`) — charter `skills/agents/code-reviewer/SKILL.md`
+> - trigger: pr-review Step 2, dimension rows 1, 3, and 4 (one dispatch per row)
+> - scope: the PR/MR diff and surrounding context for one dimension row; never the whole repository; no host CLI calls, no posting
+> - inputs: exact `projectId`, parent `workflowSessionId`, dimension row (lens + scope), DISCOVERY MAP, PR/MR intent, trimmed diff, existing-comment inventory, severity labels, reply contract
+> - sensors: second-pass sweep — re-read the full trimmed diff, list every file/hunk not commented on, and state per file why it is clean for this dimension before returning
+> - output: structured reply block — findings rows `{path, head-line, severity, marker type, title, body ≤ 6 lines, recommendation}` + exactly one positive highlight + files-swept-clean list; when uncertain a finding is real, withhold it (the source protocol's high-confidence bar, applied qualitatively)
+> - firewall: raw diff/log/search output summarized, never returned raw
+> - memory: suggest-only; the main agent persists durable outcomes
+
+> **Dispatch: `product-manager`** (role: `product-manager`, mode: `audit`) — charter `skills/agents/product-manager/SKILL.md`
+> - trigger: pr-review Step 2, dimension row 2 (requirements & DoD)
+> - scope: the PR/MR diff and surrounding context for dimension row 2; never the whole repository
 > - permissions: read-only; no host CLI calls, no posting
 > - inputs: exact `projectId`, parent `workflowSessionId`, dimension row (lens + scope), DISCOVERY MAP, PR/MR intent, trimmed diff, existing-comment inventory, severity labels, reply contract
 > - sensors: second-pass sweep — re-read the full trimmed diff, list every file/hunk not commented on, and state per file why it is clean for this dimension before returning
@@ -162,10 +171,19 @@ share only the lens label, not a knowledge domain; they stay separate dispatches
 > - firewall: raw diff/log/search output summarized, never returned raw
 > - memory: suggest-only; the main agent persists durable outcomes
 
-> **Dispatch: `massa-ai-reviewer`** (role: `reviewer`) — charter `skills/agents/reviewer/SKILL.md`
-> - trigger: pr-review Step 2, dimension row 6 (regression & hallucination)
-> - scope: the full PR/MR diff against the repository's real symbol surface
+> **Dispatch: `test-engineer`** (role: `test-engineer`, mode: `audit`) — charter `skills/agents/test-engineer/SKILL.md`
+> - trigger: pr-review Step 2, dimension row 5 (test coverage)
+> - scope: the PR/MR diff and surrounding context for dimension row 5; never the whole repository
 > - permissions: read-only; no host CLI calls, no posting
+> - inputs: exact `projectId`, parent `workflowSessionId`, dimension row (lens + scope), DISCOVERY MAP, PR/MR intent, trimmed diff, existing-comment inventory, severity labels, reply contract
+> - sensors: second-pass sweep — re-read the full trimmed diff, list every file/hunk not commented on, and state per file why it is clean for this dimension before returning
+> - output: structured reply block — findings rows `{path, head-line, severity, marker type, title, body ≤ 6 lines, recommendation}` + exactly one positive highlight + files-swept-clean list; when uncertain a finding is real, withhold it (the source protocol's high-confidence bar, applied qualitatively)
+> - firewall: raw diff/log/search output summarized, never returned raw
+> - memory: suggest-only; the main agent persists durable outcomes
+
+> **Dispatch: `code-reviewer`** (role: `code-reviewer`, mode: `review`) — charter `skills/agents/code-reviewer/SKILL.md`
+> - trigger: pr-review Step 2, dimension row 6 (regression & hallucination)
+> - scope: the full PR/MR diff against the repository's real symbol surface; no host CLI calls, no posting
 > - inputs: exact `projectId`, parent `workflowSessionId`, dimension row 6, DISCOVERY MAP, PR/MR intent, full diff, existing-comment inventory, severity labels, reply contract
 > - sensors: verify referenced symbols exist (`search_definitions`/`get_references` when INDEX is fresh, else grep); second-pass sweep as above
 > - output: structured reply block — findings rows tagged `{unrelated-deletion | phantom-reference | wrong-signature | duplicate | weakened-check | dead-code}` + one positive highlight + files-swept-clean list; withhold uncertain findings

package/skills/massa-ai/workflows/{discovery.md → product-discovery.md}

@@ -1,6 +1,6 @@
 ---
-name: discovery
-description: "Product discovery and brainstorming workflow — act as a sharp product thinking partner to explore problem spaces, generate and stress-test ideas, and spar on strategy before anything is spec-ready, ending with a mandatory offer to synthesize the conversation into a PRD via the to-prd workflow. Use when the user wants to brainstorm a product problem, idea, opportunity, or direction with no concrete code target. Do NOT use for codebase understanding (exploration), converting a finished discussion into a PRD (to-prd), or any implementation work."
+name: product-discovery
+description: "Product discovery and brainstorming workflow — act as a sharp product thinking partner to explore problem spaces, generate and stress-test ideas, and spar on strategy before anything is spec-ready, ending with a mandatory offer to synthesize the conversation into a PRD via the create-prd workflow. Use when the user wants to brainstorm a product problem, idea, opportunity, or direction with no concrete code target. Do NOT use for codebase understanding (exploration), converting a finished discussion into a PRD (create-prd), or any implementation work."
 license: Apache-2.0
 metadata:
   version: "1.0.0"
@@ -10,7 +10,7 @@ metadata:
 
 Attribution: adapted from the `product-brainstorming` skill in
 `anthropics/knowledge-work-plugins` (Apache-2.0). massa-ai session/memory
-binding, router integration, and the to-prd handoff are additions.
+binding, router integration, and the create-prd handoff are additions.
 
 Act as a sharp product thinking partner — the experienced PM (Product
 Manager) or design lead who challenges assumptions, asks hard questions, and
@@ -22,7 +22,7 @@ have reached alone.
 This is a read-only conversation workflow: it never mutates the repository
 and writes no `.specs/` artifacts. Its only outputs are the conversation
 itself, durable memories at Capture, and — on explicit acceptance — a routed
-handoff to `to-prd`.
+handoff to `create-prd`.
 
 Load `references/project-context.md` (intake sweep) before the first
 substantive read when the conversation touches an existing product or
@@ -30,7 +30,7 @@ codebase; product context grounds the brainstorm in what exists today.
 
 ## Session And Memory
 
-- `workflowSessionId`: `discovery-<entity>` (e.g., `discovery-onboarding-dropoff`),
+- `workflowSessionId`: `product-discovery-<entity>` (e.g., `product-discovery-onboarding-dropoff`),
   stable for the whole conversation.
 - Start with a budgeted `recall` (limit ≤ 3, minImportance ≥ 0.7, types
   `critical`/`decision`/`pattern`): prior product decisions, rejected
@@ -121,25 +121,25 @@ name the stage transition when it helps the user follow.
 At Capture, persist the durable subset via `remember`: chosen directions
 with their why and rejected directions with reasons as `decision`, reusable
 framings or cross-session insights as `pattern` — tagged
-`project:<projectId>`, `session:discovery-<entity>`, `workflow:discovery`,
+`project:<projectId>`, `session:product-discovery-<entity>`, `workflow:product-discovery`,
 `entity:<name>`, and a memory-tier tag. Persist only what transcends the
 session; never fabricate memories to satisfy process. If the server is
 unavailable, the capture summary in conversation is the record.
 
-## PRD Handoff (to-prd)
+## PRD Handoff (create-prd)
 
 End every Capture with an explicit offer — this step is mandatory, the PRD
 is not:
 
 > "Want me to turn this into a PRD (Product Requirements Document)? I'd
-> synthesize this conversation through the `to-prd` workflow — no new
+> synthesize this conversation through the `create-prd` workflow — no new
 > interview."
 
-- **Accepted** → route to `workflows/to-prd.md`. The user's acceptance is
-  the explicit request `to-prd`'s routing requires. Carry the current
+- **Accepted** → route to `workflows/create-prd.md`. The user's acceptance is
+  the explicit request `create-prd`'s routing requires. Carry the current
   conversation context — Capture's output (chosen directions, assumptions,
   set-asides) feeds the PRD's problem statement, decisions, and out-of-scope
-  sections directly; `to-prd` does not re-interview.
+  sections directly; `create-prd` does not re-interview.
 - **Declined** → the capture summary stays in conversation and the durable
   memories from Capture remain the only persistence. Offer nothing else.
 
@@ -200,5 +200,5 @@ Discovery completes at Capture plus the PRD offer. Before claiming the
 session complete, apply `references/evidence-gate.md`: the evidence here is
 the capture summary (ideas, assumptions, next steps, set-asides), the memory
 outcome (what was persisted or why persistence was skipped), and the
-recorded PRD-offer disposition (accepted → to-prd, declined, or
+recorded PRD-offer disposition (accepted → create-prd, declined, or
 not-PRD-shaped with the named research gap).

package/skills/massa-ai/workflows/refactor.md

@@ -61,23 +61,22 @@ Before the first repository mutation, load `references/implementation-delivery.m
    - Before PR creation, run `bun skills/massa-ai/scripts/check_specs_delivered.ts <slug> --kind refactor` (`--kind quick` for Quick-sized work) — a non-zero exit blocks Propose. If no code-execution tool is available, run the same checks by reading the artifact (graceful degradation preserved).
 10. Include file-integrity checks when tests, specs, benchmarks, fixtures, or snapshots are validation assets. If verification found a reusable signal (`ac_gap`, `surviving_mutant`, `spec_precision_gap`, `spec_deviation`, `gate_fail`), record it via `references/lessons.md`:
      `bun skills/massa-ai/scripts/lessons.ts --root . add --feature "<slug>" --signal "<signal>" --source "<ref>" --text "<one terse lesson>"`
-11. Use `references/agent-orchestration.md` for isolated implementation slices; the verification-agent dispatch below is not discretionary at Standard+ sizing or PR-group execution — that reference's Independent Verification Exception makes it a standing requirement, not a per-task judgment call.
+11. Use `references/agent-orchestration.md` for isolated implementation slices; the `code-reviewer` `verify` dispatch below is not discretionary at Standard+ sizing or PR-group execution — that reference's Independent Verification Exception makes it a standing requirement, not a per-task judgment call.
 12. At completion, persist (run the scoring rubric from `references/decision-engine.md`):
    - Refactored architectural decisions via `remember` as scored `decision` memories
    - Identified and decoupled anti-patterns via `remember` as scored `pattern` memories
 
-> **Dispatch: `massa-ai-reviewer`** (role: `reviewer`) — charter `skills/agents/reviewer/SKILL.md`
+> **Dispatch: `code-reviewer`** (role: `code-reviewer`, mode: `review`) — charter `skills/agents/code-reviewer/SKILL.md`
 > - trigger: implementation complete, before the verification gate — never optional
 > - scope: the change's diff surface and its task/AC context
-> - permissions: read-only
 > - inputs: diff, acceptance context, recalled code-quality conventions
 > - sensors: bugs, regressions, missing edge cases, smells introduced by the diff
 > - output: ranked findings, blocking vs advisory; blocking findings become fix items before verification runs
 > - firewall: summarized findings only, never raw diff dumps
 > - memory: suggest-only; main agent persists
 
-> **Dispatch: `massa-ai-verification-agent`** (role: `verification-agent`) — charter `skills/agents/verification-agent/SKILL.md`
-> - trigger: Standard+ refactor sizing or any PR-group execution per the Independent Verification Mandate in `references/verification-ladder.md` — mandatory once reviewer fix items are resolved; Quick-sized refactors dispatch only when validation assets were touched, otherwise run the fresh-eyes fallback below and record the skip reason
+> **Dispatch: `code-reviewer`** (role: `code-reviewer`, mode: `verify`) — charter `skills/agents/code-reviewer/SKILL.md`
+> - trigger: Standard+ refactor sizing or any PR-group execution per the Independent Verification Mandate in `references/verification-ladder.md` — mandatory once `code-reviewer` review fix items are resolved; Quick-sized refactors dispatch only when validation assets were touched, otherwise run the fresh-eyes fallback below and record the skip reason
 > - scope: the moved/transformed code across this refactor's PR groups and the characterization tests that must protect it
 > - inputs: the characterization baseline from step 6 (and step 7 for mobile refactors), the diff of moved code per PR group, and the PR-group map from step 9
 > - sensors: confirm the characterization tests still pass against the moved code's preserved behavior; discrimination sensor per `references/discrimination-sensor.md` (mutate the moved code — never new code — in scratch, one PR group at a time; characterization tests must kill each mutant)

package/skills/massa-ai/workflows/refinement/furps-refinement.md

@@ -12,7 +12,7 @@ Findings-only refinement of a Product Requirements Document (PRD) and/or Archite
 
 Load `references/project-context.md` (intake sweep) before the first substantive read.
 
-Not for authoring a new PRD (use `to-prd` or `spec-driven` Specify), authoring an ADR (use `adr`), proposing change (use `rfc`), auditing implementation against requirements (use `requirements-audit`), or auditing code/security/architecture. It refines the document itself; it does not edit code.
+Not for authoring a new PRD (use `create-prd` or `spec-driven` Specify), authoring an ADR (use `create-adr`), proposing change (use `create-rfc`), auditing implementation against requirements (use `requirements-audit`), or auditing code/security/architecture. It refines the document itself; it does not edit code.
 
 Findings-only: do not edit the PRD/ADR unless the user separately asks.
 
@@ -21,7 +21,7 @@ Findings-only: do not edit the PRD/ADR unless the user separately asks.
    - `references/furps/intake.md` before intake and sub-agent dispatch
    - `references/furps/checklist.md` for the per-dimension check items
    - `references/furps/report-contract.md` before writing the report
-   - `references/furps/analyst-role.md` and `skills/agents/furps-analyst/SKILL.md` before dispatching `massa-ai-furps-analyst`
+   - `references/furps/analyst-role.md` and `skills/agents/product-manager/SKILL.md` before dispatching `product-manager` in `furps` mode
    - `references/agent-orchestration.md` and `references/context-firewall.md` before dispatch
    - `references/audit-report-io.md` before writing the final report
    - `references/synapse-policy.md` when repeated massa-ai searches are expected
@@ -33,17 +33,17 @@ Findings-only: do not edit the PRD/ADR unless the user separately asks.
    - If the source is missing or ambiguous, ask once before proceeding.
 4. The Fool pre-validation (sub-agents, one per mode):
    - Load `workflows/the-fool.md`. Treat the PRD/ADR as the challenged thesis (direct challenge; inherit `projectId`/`workflowSessionId`).
-   - Dispatch a read-only `massa-ai-plan-critic` sub-agent in `evidence_audit` mode with the document packet, DoR, and recalled facts.
-   - Then dispatch a `massa-ai-plan-critic` sub-agent in `pre_mortem` mode, passing the `evidence_audit` summary as input.
+   - Dispatch a `judge` sub-agent in `plan-critique` mode (full depth, `fool_mode: evidence_audit`; it writes nothing) with the document packet, DoR, and recalled facts.
+   - Then dispatch a `judge` sub-agent in `plan-critique` mode (full depth, `fool_mode: pre_mortem`), passing the `evidence_audit` summary as input.
    - Collect the compact validation: source-confidence gaps, unsourceable claims, and execution-phase failure assumptions.
    - Gate: if `evidence_audit` surfaces critical gaps that block meaningful FURPS analysis, ask the user whether to proceed-with-caveats or pause for document completion. Otherwise attach the Fool summary to the FURPS packets.
 5. FURPS+ dimension analysis (sub-agents, one per dimension, parallel):
-   - Dispatch six `massa-ai-furps-analyst` sub-agents: F, U, R, P, S, X (X = FURPS+ Extensions).
+   - Dispatch six `product-manager` sub-agents in `furps` mode: F, U, R, P, S, X (X = FURPS+ Extensions).
    - Each receives its `checklist.md` section, the bounded document packet, the DoR, and the Fool summary.
    - Each returns per check-item status (`covered|partial|missing|unclear`), `FR-<letter>-<N>` findings, and contributions to Open Questions / Suggestions / Insights / Risks / DoR-gaps.
    - Dispatch the six dimensions in waves of at most 4 concurrent analysts (e.g. 4 then 2), per the wave cap in `references/agent-orchestration.md` (Orchestrator Working Memory). Dimension analyses are order-independent, so wave order does not matter. Each gets its own ephemeral Synapse session only if it performs >=2 searches.
 
-> **Dispatch: `massa-ai-furps-analyst`** (role: `furps-analyst`) — charter `skills/agents/furps-analyst/SKILL.md` — 6 dispatches, one per dimension, waves of ≤4
+> **Dispatch: `product-manager`** (role: `product-manager`, mode: `furps`) — charter `skills/agents/product-manager/SKILL.md` — 6 dispatches, one per dimension, waves of ≤4
 > - trigger: furps-refinement step 5; one analyst per FURPS+ dimension (F, U, R, P, S, X)
 > - scope: exactly one dimension's `checklist.md` section against the bounded document packet
 > - permissions: read-only
@@ -84,7 +84,7 @@ User asks: "Refine this PRD against FURPS before we start building."
 1. `workflowSessionId=furps-refinement-<entity>`.
 2. Ingest the PRD file; resolve DoR from a linked Confluence page via Atlassian MCP.
 3. Run The Fool (`evidence_audit` then `pre_mortem`); proceed (no critical blocker).
-4. Fan out six `massa-ai-furps-analyst` sub-agents (F, U, R, P, S, X) in parallel.
+4. Fan out six `product-manager` sub-agents in `furps` mode (F, U, R, P, S, X) in parallel.
 5. Synthesize; write `audits/refinement/<date> furps-refinement.md`; summarize in chat.
 
 User asks: "Run a FURPS+ analysis on ADR-007."

package/skills/massa-ai/workflows/requirements/requirements-audit.md

@@ -30,9 +30,9 @@ Findings-only: do not edit code unless the user separately asks for fixes.
    - Requirements source scope: use provided prompt text, PR description, issue text, task file, spec, RFC, ADR, acceptance criteria, or README section as the expected behavior source.
    - If requirements source is missing after checking the prompt, PR description, task file, spec, issue text, and repo docs, ask for the requirements source before proceeding.
 5. Resolve the selected branch's mechanics (modified files, commit range, codebase area, explicit-files/branch/symbol/feature/whole-repo, or implementation parent scope) per `references/audit-scope.md` (Lens Audit Scope Resolution Procedure, Requirements row of Per-Lens Scope Deltas). Implementation parent scope additionally carries the requirement source from `implementation-audit`.
-6. Investigation pass. Dispatch `audit-specialist` per `references/agent-orchestration.md` when the scope justifies an isolated read-only subagent:
+6. Investigation pass. Dispatch `product-manager` (`audit` mode) per `references/agent-orchestration.md` when the scope justifies an isolated read-only subagent:
 
-> **Dispatch: `massa-ai-audit-specialist`** (role: `audit-specialist`) — charter `skills/agents/audit-specialist/SKILL.md`
+> **Dispatch: `product-manager`** (role: `product-manager`, mode: `audit`) — charter `skills/agents/product-manager/SKILL.md`
 > - trigger: large scope, explicit parallel/subagent request, PR subagent invocation, or independent verification of high-impact finding
 > - scope: the requirements audit target — files, contracts, specs, acceptance criteria
 > - permissions: read-only

package/skills/massa-ai/workflows/requirements/requirements-fix.md

@@ -64,9 +64,9 @@ Not for findings-only requirements review — route to `workflows/requirements/r
    - Preserve non-goals and explicit constraints.
    - `references/knowledge-verification-chain.md`'s Step 5 settles technical facts only (library/API behavior), never product intent; a product decision gap still stops here regardless of how the chain resolved.
    - If a finding exposes a product decision gap, stop and ask rather than inventing policy.
-10. Use agent orchestration only when it improves signal, with one carve-out: the verification-agent dispatch below is mandatory at its tier gate rather than discretionary, per `references/agent-orchestration.md`'s Independent Verification Exception. Dispatch per `references/agent-orchestration.md`:
+10. Use agent orchestration only when it improves signal, with one carve-out: the `code-reviewer` `verify` dispatch below is mandatory at its tier gate rather than discretionary, per `references/agent-orchestration.md`'s Independent Verification Exception. Dispatch per `references/agent-orchestration.md`:
 
-> **Dispatch: `massa-ai-builder`** (role: `builder`) — charter `skills/agents/builder/SKILL.md`
+> **Dispatch: `builder`** (role: `builder`) — charter `skills/agents/builder/SKILL.md`
 > - trigger: large/high-risk finding, disjoint implementation slice, or explicit subagent request
 > - scope: one isolated requirements finding with a disjoint write set
 > - permissions: write (disjoint write set)
@@ -76,17 +76,16 @@ Not for findings-only requirements review — route to `workflows/requirements/r
 > - firewall: raw diffs/logs summarized
 > - memory: suggest-only; main agent persists reusable requirements patterns
 
-> **Dispatch: `massa-ai-reviewer`** (role: `reviewer`) — charter `skills/agents/reviewer/SKILL.md`
+> **Dispatch: `code-reviewer`** (role: `code-reviewer`, mode: `review`) — charter `skills/agents/code-reviewer/SKILL.md`
 > - trigger: implementation complete, before the verification gate — never optional
 > - scope: the fix's diff surface and its task/AC context
-> - permissions: read-only
 > - inputs: diff, acceptance context, recalled code-quality conventions
 > - sensors: bugs, regressions, missing edge cases, smells introduced by the diff
 > - output: ranked findings, blocking vs advisory; blocking findings become fix items before verification runs
 > - firewall: summarized findings only, never raw diff dumps
 > - memory: suggest-only; main agent persists
 
-> **Dispatch: `massa-ai-verification-agent`** (role: `verification-agent`) — charter `skills/agents/verification-agent/SKILL.md`
+> **Dispatch: `code-reviewer`** (role: `code-reviewer`, mode: `verify`) — charter `skills/agents/code-reviewer/SKILL.md`
 > - trigger: mandatory at Standard+/Spec-driven REQ-fix size or high/critical requirement severity, per the Independent Verification Mandate tier gate in `references/verification-ladder.md`'s Mandatory Verification Fix Gate; a Quick-tier REQ finding takes the fallback below instead
 > - scope: the closed REQ row's Requirement Source alignment, acceptance evidence, and report claim closure
 > - inputs: the finding, its Requirement Source and Requirement ID or Quote, the applied fix, the verification suggestion, and validation assets
@@ -101,7 +100,7 @@ Not for findings-only requirements review — route to `workflows/requirements/r
    - If verification found a reusable signal (`ac_gap`, `surviving_mutant`, `spec_precision_gap`, `spec_deviation`, `gate_fail`), record it via `references/lessons.md`:
      `bun skills/massa-ai/scripts/lessons.ts --root . add --feature "<slug>" --signal "<signal>" --source "<ref>" --text "<one terse lesson>"`
    - Apply the Mandatory Verification Fix Gate from `references/verification-ladder.md`: run the report's Verification Suggestion or an equivalent deterministic command/artifact check for each selected finding or coherent group.
-   - Dispatch the verification-agent block above once a REQ finding reaches Standard+/Spec-driven size or high/critical severity; a Quick-tier finding instead runs the listed fallback self-check — the tier gate decides the hop, never the check itself.
+   - Dispatch the `code-reviewer` `verify` block above once a REQ finding reaches Standard+/Spec-driven size or high/critical severity; a Quick-tier finding instead runs the listed fallback self-check — the tier gate decides the hop, never the check itself.
    - A surviving mutant on the discrimination sensor blocks the row: mark the finding's Closure Matrix status `blocked` and log a `surviving_mutant` signal through `references/lessons.md`.
    - `references/verification-ladder.md`'s Bounded Fix→Re-verify Loop caps re-verify cycles per REQ finding at 3; exhausting it also lands `blocked`.
    - A finding cannot be marked `fixed` when a target-relevant command or artifact check exists but was not attempted; if verification cannot run, mark it `blocked`, `deferred`, or `skipped` with an allowed skipped-check reason.

package/skills/massa-ai/workflows/security/security-audit.md

@@ -29,12 +29,11 @@ Findings-only: do not edit code unless the user separately asks for fixes.
    - Apply the Memory Freshness Gate from `references/audit-scope.md`; recalled exceptions are leads, not proof.
 4. Establish the investigation scope: select the scope type and build the shared scope packet per `references/audit-scope.md`, which owns the supported scope types, the ask-when-vague rule, and the packet fields. Carry the packet into the report.
 5. Resolve the selected branch's mechanics (modified files, commit range, codebase area, explicit-files/branch/symbol/feature/whole-repo, or implementation parent scope) per `references/audit-scope.md` (Lens Audit Scope Resolution Procedure, Security row of Per-Lens Scope Deltas).
-6. Investigation pass. Dispatch `audit-specialist` per `references/agent-orchestration.md` when the scope justifies an isolated read-only subagent:
+6. Investigation pass. Dispatch `code-reviewer` (`audit` mode) per `references/agent-orchestration.md` when the scope justifies an isolated read-only subagent:
 
-> **Dispatch: `massa-ai-audit-specialist`** (role: `audit-specialist`) — charter `skills/agents/audit-specialist/SKILL.md`
+> **Dispatch: `code-reviewer`** (role: `code-reviewer`, mode: `audit`) — charter `skills/agents/code-reviewer/SKILL.md`
 > - trigger: large scope, explicit parallel/subagent request, PR subagent invocation, or independent verification of high-impact finding
 > - scope: the security audit target — files, trust boundaries, auth paths, validators
-> - permissions: read-only
 > - inputs: shared scope packet; `lens: security`; recalled security decisions, auth boundaries, validation rules, accepted exceptions
 > - sensors: trace untrusted input -> validation -> authorization -> transformation -> persistence; authn/authz, object ownership, tenant isolation, input validation, secret handling, injection risks
 > - output: findings with security boundary, asset, trigger/exploit path, severity, confidence, evidence, simplest fix direction, verification suggestion