@mmerterden/multi-agent-pipeline 20.2.0 → 20.3.0

package/pipeline/skills/shared/external/eventkit-calendar/SKILL.md

@@ -1,6 +1,8 @@
 ---
 name: eventkit-calendar
 description: "Create, read, and manage calendar events and reminders using EventKit and EventKitUI. Use when adding events to the user's calendar, creating reminders, setting recurrence rules, requesting calendar or reminders access, presenting event editors, choosing calendars, handling alarms, observing calendar changes, or working with EKEventStore, EKEvent, EKReminder, EKCalendar, EKRecurrenceRule, EKEventEditViewController, EKCalendarChooser, or EventKitUI views."
+metadata:
+  source: "dpearson2699/swift-ios-skills (PolyForm Perimeter 1.0.0)"
 ---
 
 # EventKit
@@ -71,7 +73,7 @@ read, edit, delete, or fetch calendar events.
 
 ### Write-Only Access to Events
 
-Use when your app only creates events (e.g., saving a booking) and does not
+Use when your app only creates events (e.g., saving an appointment) and does not
 need to read existing events.
 
 Call `try await eventStore.requestWriteOnlyAccessToEvents()` before direct

package/pipeline/skills/shared/external/eventkit-calendar/evals/evals.json

@@ -1,9 +1,9 @@
 {
-  "skill_name": "eventkit",
+  "skill_name": "eventkit-calendar",
   "evals": [
     {
       "id": 1,
-      "prompt": "Review this iOS 26 calendar integration plan: the app asks for `NSCalendarsUsageDescription`, calls `requestAccess(to: .event)`, requests write-only access, then fetches the user's existing events to avoid conflicts before saving a booking. The team also wants an Add to Calendar button where the user can edit the event in the system sheet. Give corrected guidance with Swift API names where useful.",
+      "prompt": "Review this iOS 26 calendar integration plan: the app asks for `NSCalendarsUsageDescription`, calls `requestAccess(to: .event)`, requests write-only access, then fetches the user's existing events to avoid conflicts before saving an appointment. The team also wants an Add to Calendar button where the user can edit the event in the system sheet. Give corrected guidance with Swift API names where useful.",
       "expected_output": "A review that fixes iOS 17+ calendar authorization, Info.plist keys, write-only read limitations, full-access requirements for fetching, and EventKitUI no-authorization creation.",
       "files": [],
       "assertions": [

package/pipeline/skills/shared/external/fastapi-pro/SKILL.md

@@ -1,189 +1,120 @@
 ---
 name: fastapi-pro
-description: "Build high-performance async APIs with FastAPI, SQLAlchemy 2.0, and Pydantic V2. Master microservices, WebSockets, and modern Python async patterns. Use when building or reviewing an async Python API with FastAPI, SQLAlchemy or Pydantic."
-risk: unknown
-source: community
-date_added: '2026-02-27'
+description: "FastAPI with Pydantic v2: lifespan, settings, Annotated dependencies, async SQLAlchemy 2.0 sessions, error handlers, background work, httpx tests. Use when building or reviewing a FastAPI service."
+metadata:
+  risk: safe
+  source: multi-agent-pipeline
+  date_added: "2026-09-25"
 ---
 
-## Use this skill when
-
-- Working on fastapi pro tasks or workflows
-- Needing guidance, best practices, or checklists for fastapi pro
-
-## Do not use this skill when
-
-- The task is unrelated to fastapi pro
-- You need a different domain or tool outside this scope
-
-## Instructions
-
-- Clarify goals, constraints, and required inputs.
-- Apply relevant best practices and validate outcomes.
-- Provide actionable steps and verification.
-
-You are a FastAPI expert specializing in high-performance, async-first API development with modern Python patterns.
-
-## Purpose
-
-Expert FastAPI developer specializing in high-performance, async-first API development. Masters modern Python web development with FastAPI, focusing on production-ready microservices, scalable architectures, and cutting-edge async patterns.
-
-## Capabilities
-
-### Core FastAPI Expertise
-
-- FastAPI 0.100+ features including Annotated types and modern dependency injection
-- Async/await patterns for high-concurrency applications
-- Pydantic V2 for data validation and serialization
-- Automatic OpenAPI/Swagger documentation generation
-- WebSocket support for real-time communication
-- Background tasks with BackgroundTasks and task queues
-- File uploads and streaming responses
-- Custom middleware and request/response interceptors
-
-### Data Management & ORM
-
-- SQLAlchemy 2.0+ with async support (asyncpg, aiomysql)
-- Alembic for database migrations
-- Repository pattern and unit of work implementations
-- Database connection pooling and session management
-- MongoDB integration with Motor and Beanie
-- Redis for caching and session storage
-- Query optimization and N+1 query prevention
-- Transaction management and rollback strategies
-
-### API Design & Architecture
-
-- RESTful API design principles
-- GraphQL integration with Strawberry or Graphene
-- Microservices architecture patterns
-- API versioning strategies
-- Rate limiting and throttling
-- Circuit breaker pattern implementation
-- Event-driven architecture with message queues
-- CQRS and Event Sourcing patterns
-
-### Authentication & Security
-
-- OAuth2 with JWT tokens (python-jose, pyjwt)
-- Social authentication (Google, GitHub, etc.)
-- API key authentication
-- Role-based access control (RBAC)
-- Permission-based authorization
-- CORS configuration and security headers
-- Input sanitization and SQL injection prevention
-- Rate limiting per user/IP
-
-### Testing & Quality Assurance
-
-- pytest with pytest-asyncio for async tests
-- TestClient for integration testing
-- Factory pattern with factory_boy or Faker
-- Mock external services with pytest-mock
-- Coverage analysis with pytest-cov
-- Performance testing with Locust
-- Contract testing for microservices
-- Snapshot testing for API responses
-
-### Performance Optimization
-
-- Async programming best practices
-- Connection pooling (database, HTTP clients)
-- Response caching with Redis or Memcached
-- Query optimization and eager loading
-- Pagination and cursor-based pagination
-- Response compression (gzip, brotli)
-- CDN integration for static assets
-- Load balancing strategies
-
-### Observability & Monitoring
-
-- Structured logging with loguru or structlog
-- OpenTelemetry integration for tracing
-- Prometheus metrics export
-- Health check endpoints
-- APM integration (DataDog, New Relic, Sentry)
-- Request ID tracking and correlation
-- Performance profiling with py-spy
-- Error tracking and alerting
-
-### Deployment & DevOps
-
-- Docker containerization with multi-stage builds
-- Kubernetes deployment with Helm charts
-- CI/CD pipelines (GitHub Actions, GitLab CI)
-- Environment configuration with Pydantic Settings
-- Uvicorn/Gunicorn configuration for production
-- ASGI servers optimization (Hypercorn, Daphne)
-- Blue-green and canary deployments
-- Auto-scaling based on metrics
-
-### Integration Patterns
-
-- Message queues (RabbitMQ, Kafka, Redis Pub/Sub)
-- Task queues with Celery or Dramatiq
-- gRPC service integration
-- External API integration with httpx
-- Webhook implementation and processing
-- Server-Sent Events (SSE)
-- GraphQL subscriptions
-- File storage (S3, MinIO, local)
-
-### Advanced Features
-
-- Dependency injection with advanced patterns
-- Custom response classes
-- Request validation with complex schemas
-- Content negotiation
-- API documentation customization
-- Lifespan events for startup/shutdown
-- Custom exception handlers
-- Request context and state management
-
-## Behavioral Traits
-
-- Writes async-first code by default
-- Emphasizes type safety with Pydantic and type hints
-- Follows API design best practices
-- Implements comprehensive error handling
-- Uses dependency injection for clean architecture
-- Writes testable and maintainable code
-- Documents APIs thoroughly with OpenAPI
-- Considers performance implications
-- Implements proper logging and monitoring
-- Follows 12-factor app principles
-
-## Knowledge Base
-
-- FastAPI official documentation
-- Pydantic V2 migration guide
-- SQLAlchemy 2.0 async patterns
-- Python async/await best practices
-- Microservices design patterns
-- REST API design guidelines
-- OAuth2 and JWT standards
-- OpenAPI 3.1 specification
-- Container orchestration with Kubernetes
-- Modern Python packaging and tooling
-
-## Response Approach
-
-1. **Analyze requirements** for async opportunities
-2. **Design API contracts** with Pydantic models first
-3. **Implement endpoints** with proper error handling
-4. **Add comprehensive validation** using Pydantic
-5. **Write async tests** covering edge cases
-6. **Optimize for performance** with caching and pooling
-7. **Document with OpenAPI** annotations
-8. **Consider deployment** and scaling strategies
-
-## Example Interactions
-
-- "Create a FastAPI microservice with async SQLAlchemy and Redis caching"
-- "Implement JWT authentication with refresh tokens in FastAPI"
-- "Design a scalable WebSocket chat system with FastAPI"
-- "Optimize this FastAPI endpoint that's causing performance issues"
-- "Set up a complete FastAPI project with Docker and Kubernetes"
-- "Implement rate limiting and circuit breaker for external API calls"
-- "Create a GraphQL endpoint alongside REST in FastAPI"
-- "Build a file upload system with progress tracking"
+# FastAPI Pro
+
+FastAPI makes the happy path short: type-hint a function and you get parsing,
+validation and an OpenAPI document. The hard parts are the ones the tutorial
+skips: where resources are created and closed, how a session maps to a
+transaction, what happens when someone calls blocking code inside `async def`,
+and how to test all of it without a real network.
+
+Language-level guidance (typing, dataclasses, Pydantic basics) is in
+`python-patterns`; schema and migrations in `database-patterns`; test strategy
+in `testing-backend`.
+
+## 1. Layout
+
+```text
+app/
+  main.py            # create_app(): routers, middleware, handlers, lifespan
+  settings.py        # pydantic-settings
+  db.py              # engine, session factory, get_session dependency
+  errors.py          # domain exceptions and handlers
+  notes/
+    router.py        # HTTP only: parse, call service, return schema
+    schemas.py       # NoteCreate, NoteUpdate, NoteRead
+    models.py        # SQLAlchemy ORM classes
+    service.py       # business rules
+    repository.py    # queries
+tests/
+  conftest.py
+  test_notes.py
+```
+
+Keep routers thin. A router function that contains query logic and business
+rules cannot be reused by a CLI command or a worker.
+
+## 2. Core wiring
+
+Load `references/app-structure.md` for the full code. The rules it implements:
+
+- **Settings**: one `pydantic-settings` class read from the environment, cached
+  behind `get_settings()` so tests can override it; the app fails to start on a
+  missing or malformed value.
+- **Lifespan**: `create_app()` builds routers, middleware and handlers; engines,
+  HTTP clients and caches are created in the `lifespan` context and closed on
+  shutdown, stored on `app.state`, never at import time.
+- **Session per request**: a `get_session` dependency opens an `AsyncSession`
+  from an `async_sessionmaker(expire_on_commit=False)` and wraps it in
+  `session.begin()`, so the request commits on success and rolls back on any
+  exception. Relationships are loaded explicitly (`selectinload`), never lazily.
+- **Schemas**: separate input models (`NoteCreate`, `NoteUpdate` with
+  `extra="forbid"`, no server-owned fields) from output models (`NoteRead`,
+  `from_attributes=True`); endpoints declare `response_model`.
+- **Dependencies**: `Annotated` aliases (`SessionDep`, `CurrentUser`) compose
+  authentication, services and scoping; every query filters by the principal.
+- **Errors**: services raise domain exceptions; one handler module maps them,
+  and `RequestValidationError`, to RFC 9457 problem details.
+
+## 3. async def versus def
+
+- `async def` endpoints run on the event loop. Any blocking call inside them
+  (a sync database driver, `requests`, `time.sleep`, heavy CPU work) stalls every
+  concurrent request.
+- Plain `def` endpoints run in a thread pool. Use them when the code is
+  synchronous and you cannot change it.
+- Offload blocking calls from async code with `await anyio.to_thread.run_sync(fn, ...)`;
+  CPU-bound work belongs in a process pool or a job queue.
+- Use async clients throughout: `asyncpg` or `psycopg` 3 async under SQLAlchemy,
+  `httpx.AsyncClient`, `redis.asyncio`.
+
+## 4. Background work
+
+- `BackgroundTasks` runs after the response in the same process. It is fine for
+  best-effort, short work (an audit log line). It is lost on crash or deploy.
+- Anything that must happen (emails, webhooks, report generation, retries) goes
+  to a durable queue: Celery, Dramatiq, arq, Taskiq, or a cloud queue. Make jobs
+  idempotent and keyed.
+- Enqueue in the same transaction as the domain change using an outbox table
+  when losing the job would be a bug.
+
+## 5. Testing and deployment
+
+Tests create the app with `create_app()`, override dependencies such as
+`get_current_user` and `get_settings`, and call it through `httpx.AsyncClient`
+with `ASGITransport`. The transport does not run the lifespan, so wrap the app
+in `asgi_lifespan.LifespanManager`. Fixtures, example tests and production
+server settings (Uvicorn, proxy headers, instrumentation) are in
+`references/testing-and-deployment.md`, together with notes on streaming
+responses and WebSockets.
+
+## Review checklist
+
+- [ ] Resources are created in `lifespan` and closed on shutdown.
+- [ ] One session per request, transaction committed or rolled back by the dependency.
+- [ ] No blocking calls inside `async def`; relationships loaded explicitly.
+- [ ] Input models forbid unknown and server-owned fields; responses use output models.
+- [ ] Every query is scoped by the current principal.
+- [ ] Domain exceptions map to problem details in one place.
+- [ ] Durable work uses a queue, not `BackgroundTasks`.
+- [ ] Tests use `AsyncClient` with lifespan and dependency overrides.
+
+## References
+
+- `references/app-structure.md`: settings, lifespan, session dependency, models, schemas, routers and error handlers in full.
+- `references/testing-and-deployment.md`: test fixtures, dependency overrides, Uvicorn in production, streaming and WebSockets.
+
+## Related skills
+
+- `python-patterns`: typing, Pydantic, async fundamentals.
+- `api-patterns`, `rest-api-design`: contract design.
+- `api-security-best-practices`: authentication and authorization dependencies.
+- `database-patterns`: schema, indexes, Alembic migrations.
+- `testing-backend`: fixtures and test pyramid.

package/pipeline/skills/shared/external/fastapi-pro/references/app-structure.md

@@ -0,0 +1,235 @@
+# FastAPI app structure
+
+Worked code for the settings, app factory, per-request session, schemas, dependencies and error handlers summarised in SKILL.md.
+
+## Contents
+
+- Settings
+- App factory and lifespan
+- Database session per request
+- Schemas: separate in from out
+- Dependencies
+- Errors
+
+## Settings
+
+```python
+# app/settings.py
+from functools import lru_cache
+from pydantic import PostgresDsn, SecretStr
+from pydantic_settings import BaseSettings, SettingsConfigDict
+
+class Settings(BaseSettings):
+    model_config = SettingsConfigDict(env_file=".env", env_prefix="APP_", extra="ignore")
+
+    environment: str = "development"
+    database_url: PostgresDsn
+    jwt_audience: str = "notes-api"
+    signing_key: SecretStr
+    db_pool_size: int = 10
+
+@lru_cache
+def get_settings() -> Settings:
+    return Settings()
+```
+
+`SecretStr` keeps secrets out of `repr` and logs. Because `get_settings` is a
+dependency, tests override it instead of patching environment variables.
+
+## App factory and lifespan
+
+Create shared resources once per process in the lifespan and close them on
+shutdown. Module-level engines and clients make tests and workers awkward.
+
+```python
+# app/main.py
+from contextlib import asynccontextmanager
+import httpx
+from fastapi import FastAPI
+from sqlalchemy.ext.asyncio import async_sessionmaker, create_async_engine
+
+from app.settings import get_settings
+from app.errors import register_error_handlers
+from app.notes.router import router as notes_router
+
+@asynccontextmanager
+async def lifespan(app: FastAPI):
+    settings = get_settings()
+    engine = create_async_engine(
+        str(settings.database_url), pool_size=settings.db_pool_size, pool_pre_ping=True
+    )
+    app.state.sessionmaker = async_sessionmaker(engine, expire_on_commit=False)
+    app.state.http = httpx.AsyncClient(timeout=httpx.Timeout(5.0))
+    try:
+        yield
+    finally:
+        await app.state.http.aclose()
+        await engine.dispose()
+
+def create_app() -> FastAPI:
+    app = FastAPI(title="Notes API", lifespan=lifespan)
+    register_error_handlers(app)
+    app.include_router(notes_router, prefix="/notes", tags=["notes"])
+    return app
+
+app = create_app()
+```
+
+The old `@app.on_event("startup")` hooks are deprecated; use `lifespan`.
+
+## Database session per request
+
+```python
+# app/db.py
+from collections.abc import AsyncIterator
+from typing import Annotated
+from fastapi import Depends, Request
+from sqlalchemy.ext.asyncio import AsyncSession
+
+async def get_session(request: Request) -> AsyncIterator[AsyncSession]:
+    async with request.app.state.sessionmaker() as session:
+        async with session.begin():
+            yield session
+
+SessionDep = Annotated[AsyncSession, Depends(get_session)]
+```
+
+- `session.begin()` commits when the request succeeds and rolls back when any
+  exception escapes, so handlers never call `commit()` themselves.
+- `expire_on_commit=False` lets you return ORM objects after commit without
+  triggering lazy loads, which fail in async code.
+- Lazy loading of relationships raises in async; load what you need explicitly
+  with `selectinload` or `joinedload`, or declare `lazy="raise"` to catch it in
+  tests.
+
+Models with SQLAlchemy 2.0 typing:
+
+```python
+# app/notes/models.py
+from datetime import datetime
+from sqlalchemy import ForeignKey, String, func
+from sqlalchemy.orm import DeclarativeBase, Mapped, mapped_column
+
+class Base(DeclarativeBase):
+    pass
+
+class Note(Base):
+    __tablename__ = "notes"
+    id: Mapped[int] = mapped_column(primary_key=True)
+    owner_id: Mapped[int] = mapped_column(ForeignKey("users.id"), index=True)
+    title: Mapped[str] = mapped_column(String(200))
+    body: Mapped[str]
+    created_at: Mapped[datetime] = mapped_column(server_default=func.now())
+```
+
+Migrations: Alembic with the async template (`alembic init -t async`), run as a
+deploy step, never from the app's lifespan.
+
+## Schemas: separate in from out
+
+```python
+# app/notes/schemas.py
+from datetime import datetime
+from pydantic import BaseModel, ConfigDict, Field
+
+class NoteCreate(BaseModel):
+    model_config = ConfigDict(extra="forbid", str_strip_whitespace=True)
+    title: str = Field(min_length=1, max_length=200)
+    body: str = Field(max_length=20_000)
+
+class NoteUpdate(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+    title: str | None = Field(default=None, min_length=1, max_length=200)
+    body: str | None = Field(default=None, max_length=20_000)
+
+class NoteRead(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+    id: int
+    title: str
+    body: str
+    created_at: datetime
+```
+
+- Input models forbid unknown fields and never include `id` or `owner_id`.
+- Output models are what the client may see; set `response_model` (or the return
+  annotation) so FastAPI filters the ORM object through it.
+- For PATCH, apply only fields the client sent: `data.model_dump(exclude_unset=True)`.
+
+## Dependencies
+
+Dependencies are FastAPI's composition tool: authentication, sessions, settings,
+pagination, feature flags.
+
+```python
+# app/notes/router.py
+from typing import Annotated
+from fastapi import APIRouter, Depends, Query, status
+
+from app.db import SessionDep
+from app.auth import CurrentUser
+from app.notes import service
+from app.notes.schemas import NoteCreate, NoteRead
+
+router = APIRouter()
+
+class Page:
+    def __init__(self, limit: Annotated[int, Query(ge=1, le=100)] = 20, after: int | None = None):
+        self.limit, self.after = limit, after
+
+@router.get("", response_model=list[NoteRead])
+async def list_notes(user: CurrentUser, session: SessionDep, page: Annotated[Page, Depends()]):
+    return await service.list_for_owner(session, user.id, page.limit, page.after)
+
+@router.post("", response_model=NoteRead, status_code=status.HTTP_201_CREATED)
+async def create_note(data: NoteCreate, user: CurrentUser, session: SessionDep):
+    return await service.create(session, owner_id=user.id, data=data)
+```
+
+- Declare reusable aliases with `Annotated[..., Depends(...)]` (`SessionDep`,
+  `CurrentUser`) instead of repeating `Depends` in every signature.
+- Dependencies are cached per request: two dependencies that both need the
+  session get the same one.
+- Dependencies with `yield` run their cleanup after the response is produced; use
+  them for anything that must be released.
+- Router-level `dependencies=[Depends(require_scope("notes:write"))]` applies
+  authorization to a whole group of routes.
+
+Scope every query by the current user (`WHERE owner_id = :user_id`); see
+`api-security-best-practices` for object-level authorization.
+
+## Errors
+
+Raise domain exceptions from services and translate them once.
+
+```python
+# app/errors.py
+from fastapi import FastAPI, Request
+from fastapi.exceptions import RequestValidationError
+from fastapi.responses import JSONResponse
+
+class DomainError(Exception):
+    status = 400
+    code = "bad-request"
+    def __init__(self, detail: str):
+        self.detail = detail
+
+class NotFound(DomainError):
+    status, code = 404, "not-found"
+
+def _problem(status: int, code: str, title: str, request: Request, **extra) -> JSONResponse:
+    body = {"type": f"https://api.example.com/problems/{code}", "title": title,
+            "status": status, "instance": str(request.url.path), **extra}
+    return JSONResponse(body, status_code=status, media_type="application/problem+json")
+
+def register_error_handlers(app: FastAPI) -> None:
+    @app.exception_handler(DomainError)
+    async def domain(request: Request, exc: DomainError):
+        return _problem(exc.status, exc.code, exc.detail, request)
+
+    @app.exception_handler(RequestValidationError)
+    async def validation(request: Request, exc: RequestValidationError):
+        errors = [{"loc": e["loc"], "detail": e["msg"]} for e in exc.errors()]
+        return _problem(422, "validation", "Request is invalid", request, errors=errors)
+```
+
+Services then stay free of HTTP: `raise NotFound("note not found")`.

package/pipeline/skills/shared/external/fastapi-pro/references/testing-and-deployment.md

@@ -0,0 +1,69 @@
+# Testing, Deployment and Streaming
+
+Companion to the FastAPI skill: testing an app built with `create_app()` and a lifespan, and running it in production.
+
+## Testing
+
+```python
+# tests/conftest.py
+import pytest
+from asgi_lifespan import LifespanManager
+from httpx import ASGITransport, AsyncClient
+
+from app.main import create_app
+from app.auth import get_current_user
+
+@pytest.fixture
+async def client(test_user):
+    app = create_app()
+    app.dependency_overrides[get_current_user] = lambda: test_user
+    async with LifespanManager(app):
+        transport = ASGITransport(app=app)
+        async with AsyncClient(transport=transport, base_url="http://test") as c:
+            yield c
+    app.dependency_overrides.clear()
+```
+
+```python
+# tests/test_notes.py
+async def test_create_rejects_unknown_fields(client):
+    res = await client.post("/notes", json={"title": "a", "body": "b", "owner_id": 9})
+    assert res.status_code == 422
+
+async def test_create_then_read(client):
+    created = await client.post("/notes", json={"title": "Shopping", "body": "milk"})
+    assert created.status_code == 201
+    note_id = created.json()["id"]
+    fetched = await client.get(f"/notes/{note_id}")
+    assert fetched.json()["title"] == "Shopping"
+```
+
+- `ASGITransport` does not run the lifespan; wrap the app in
+  `asgi_lifespan.LifespanManager` (or use the sync `TestClient` as a context
+  manager) so resources exist.
+- Run async tests with `pytest-asyncio` (`asyncio_mode = "auto"`) or AnyIO's
+  pytest plugin.
+- Override dependencies (`get_settings`, `get_current_user`, `get_session`)
+  rather than monkeypatching modules.
+- For database tests, run Postgres in Testcontainers and wrap each test in a
+  transaction that is rolled back, or truncate between tests.
+
+## Running in production
+
+- `fastapi run` (Uvicorn under the hood) or Uvicorn directly behind a reverse
+  proxy; one process per container and scale horizontally, or use
+  `--workers` on a single VM.
+- Set `--proxy-headers` and `--forwarded-allow-ips` to your load balancer so
+  client IPs and schemes are correct.
+- Disable or protect `/docs` and `/openapi.json` on internal-only APIs if
+  exposure is a concern.
+- Instrument with OpenTelemetry (`opentelemetry-instrumentation-fastapi`,
+  `-sqlalchemy`, `-httpx`) and emit structured JSON logs.
+
+## Streaming and WebSockets
+
+- `StreamingResponse` with an async generator for large exports; server-sent
+  events for one-way live updates.
+- WebSockets: authenticate during the handshake (token in a query parameter or
+  subprotocol, since browsers cannot set headers), handle `WebSocketDisconnect`,
+  and use a broker (Redis pub/sub) when more than one process must broadcast.

package/pipeline/skills/shared/external/firebase/SKILL.md

@@ -1,9 +1,10 @@
 ---
 name: firebase
 description: "You're a developer who has shipped dozens of Firebase projects. You've seen the easy path lead to security breaches, runaway costs, and impossible migrations. You know Firebase is powerful, but you also know its sharp edges. Use when integrating or reviewing Firebase: auth, Firestore, functions, or its cost and scaling traps."
-risk: unknown
-source: "vibeship-spawner-skills (Apache 2.0)"
-date_added: "2026-02-27"
+metadata:
+  risk: unknown
+  source: "vibeforge1111/vibeship-spawner-skills (Apache 2.0)"
+  date_added: "2026-02-27"
 ---
 
 # Firebase