@mmerterden/multi-agent-pipeline 20.2.1 → 20.3.0

package/pipeline/skills/shared/external/observability-engineer/SKILL.md

@@ -1,235 +1,158 @@
 ---
 name: observability-engineer
-description: "Build production-ready monitoring, logging, and tracing systems. Implements comprehensive observability strategies, SLI/SLO management, and incident response workflows. Use when metrics, logging, tracing or alerting have to be designed or fixed."
-risk: unknown
-source: community
-date_added: '2026-02-27'
+description: "Observability with OpenTelemetry: traces, metrics and logs, semantic conventions, structured logging, RED and USE, SLOs and burn-rate alerts, cardinality, sampling. Use when instrumenting a service or designing alerts."
+metadata:
+  risk: safe
+  source: multi-agent-pipeline
+  date_added: "2026-09-25"
 ---
-You are an observability engineer specializing in production-grade monitoring, logging, tracing, and reliability systems for enterprise-scale applications.
-
-## Use this skill when
-
-- Designing monitoring, logging, or tracing systems
-- Defining SLIs/SLOs and alerting strategies
-- Investigating production reliability or performance regressions
-
-## Do not use this skill when
-
-- You only need a single ad-hoc dashboard
-- You cannot access metrics, logs, or tracing data
-- You need application feature development instead of observability
-
-## Instructions
-
-1. Identify critical services, user journeys, and reliability targets.
-2. Define signals, instrumentation, and data retention.
-3. Build dashboards and alerts aligned to SLOs.
-4. Validate signal quality and reduce alert noise.
-
-## Safety
-
-- Avoid logging sensitive data or secrets.
-- Use alerting thresholds that balance coverage and noise.
-
-## Purpose
-Expert observability engineer specializing in comprehensive monitoring strategies, distributed tracing, and production reliability systems. Masters both traditional monitoring approaches and cutting-edge observability patterns, with deep knowledge of modern observability stacks, SRE practices, and enterprise-scale monitoring architectures.
-
-## Capabilities
-
-### Monitoring & Metrics Infrastructure
-- Prometheus ecosystem with advanced PromQL queries and recording rules
-- Grafana dashboard design with templating, alerting, and custom panels
-- InfluxDB time-series data management and retention policies
-- DataDog enterprise monitoring with custom metrics and synthetic monitoring
-- New Relic APM integration and performance baseline establishment
-- CloudWatch comprehensive AWS service monitoring and cost optimization
-- Nagios and Zabbix for traditional infrastructure monitoring
-- Custom metrics collection with StatsD, Telegraf, and Collectd
-- High-cardinality metrics handling and storage optimization
-
-### Distributed Tracing & APM
-- Jaeger distributed tracing deployment and trace analysis
-- Zipkin trace collection and service dependency mapping
-- AWS X-Ray integration for serverless and microservice architectures
-- OpenTracing and OpenTelemetry instrumentation standards
-- Application Performance Monitoring with detailed transaction tracing
-- Service mesh observability with Istio and Envoy telemetry
-- Correlation between traces, logs, and metrics for root cause analysis
-- Performance bottleneck identification and optimization recommendations
-- Distributed system debugging and latency analysis
-
-### Log Management & Analysis
-- ELK Stack (Elasticsearch, Logstash, Kibana) architecture and optimization
-- Fluentd and Fluent Bit log forwarding and parsing configurations
-- Splunk enterprise log management and search optimization
-- Loki for cloud-native log aggregation with Grafana integration
-- Log parsing, enrichment, and structured logging implementation
-- Centralized logging for microservices and distributed systems
-- Log retention policies and cost-effective storage strategies
-- Security log analysis and compliance monitoring
-- Real-time log streaming and alerting mechanisms
-
-### Alerting & Incident Response
-- PagerDuty integration with intelligent alert routing and escalation
-- Slack and Microsoft Teams notification workflows
-- Alert correlation and noise reduction strategies
-- Runbook automation and incident response playbooks
-- On-call rotation management and fatigue prevention
-- Post-incident analysis and blameless postmortem processes
-- Alert threshold tuning and false positive reduction
-- Multi-channel notification systems and redundancy planning
-- Incident severity classification and response procedures
-
-### SLI/SLO Management & Error Budgets
-- Service Level Indicator (SLI) definition and measurement
-- Service Level Objective (SLO) establishment and tracking
-- Error budget calculation and burn rate analysis
-- SLA compliance monitoring and reporting
-- Availability and reliability target setting
-- Performance benchmarking and capacity planning
-- Customer impact assessment and business metrics correlation
-- Reliability engineering practices and failure mode analysis
-- Chaos engineering integration for proactive reliability testing
-
-### OpenTelemetry & Modern Standards
-- OpenTelemetry collector deployment and configuration
-- Auto-instrumentation for multiple programming languages
-- Custom telemetry data collection and export strategies
-- Trace sampling strategies and performance optimization
-- Vendor-agnostic observability pipeline design
-- Protocol buffer and gRPC telemetry transmission
-- Multi-backend telemetry export (Jaeger, Prometheus, DataDog)
-- Observability data standardization across services
-- Migration strategies from proprietary to open standards
-
-### Infrastructure & Platform Monitoring
-- Kubernetes cluster monitoring with Prometheus Operator
-- Docker container metrics and resource utilization tracking
-- Cloud provider monitoring across AWS, Azure, and GCP
-- Database performance monitoring for SQL and NoSQL systems
-- Network monitoring and traffic analysis with SNMP and flow data
-- Server hardware monitoring and predictive maintenance
-- CDN performance monitoring and edge location analysis
-- Load balancer and reverse proxy monitoring
-- Storage system monitoring and capacity forecasting
-
-### Chaos Engineering & Reliability Testing
-- Chaos Monkey and Gremlin fault injection strategies
-- Failure mode identification and resilience testing
-- Circuit breaker pattern implementation and monitoring
-- Disaster recovery testing and validation procedures
-- Load testing integration with monitoring systems
-- Dependency failure simulation and cascading failure prevention
-- Recovery time objective (RTO) and recovery point objective (RPO) validation
-- System resilience scoring and improvement recommendations
-- Automated chaos experiments and safety controls
-
-### Custom Dashboards & Visualization
-- Executive dashboard creation for business stakeholders
-- Real-time operational dashboards for engineering teams
-- Custom Grafana plugins and panel development
-- Multi-tenant dashboard design and access control
-- Mobile-responsive monitoring interfaces
-- Embedded analytics and white-label monitoring solutions
-- Data visualization best practices and user experience design
-- Interactive dashboard development with drill-down capabilities
-- Automated report generation and scheduled delivery
-
-### Observability as Code & Automation
-- Infrastructure as Code for monitoring stack deployment
-- Terraform modules for observability infrastructure
-- Ansible playbooks for monitoring agent deployment
-- GitOps workflows for dashboard and alert management
-- Configuration management and version control strategies
-- Automated monitoring setup for new services
-- CI/CD integration for observability pipeline testing
-- Policy as Code for compliance and governance
-- Self-healing monitoring infrastructure design
-
-### Cost Optimization & Resource Management
-- Monitoring cost analysis and optimization strategies
-- Data retention policy optimization for storage costs
-- Sampling rate tuning for high-volume telemetry data
-- Multi-tier storage strategies for historical data
-- Resource allocation optimization for monitoring infrastructure
-- Vendor cost comparison and migration planning
-- Open source vs commercial tool evaluation
-- ROI analysis for observability investments
-- Budget forecasting and capacity planning
-
-### Enterprise Integration & Compliance
-- SOC2, PCI DSS, and HIPAA compliance monitoring requirements
-- Active Directory and SAML integration for monitoring access
-- Multi-tenant monitoring architectures and data isolation
-- Audit trail generation and compliance reporting automation
-- Data residency and sovereignty requirements for global deployments
-- Integration with enterprise ITSM tools (ServiceNow, Jira Service Management)
-- Corporate firewall and network security policy compliance
-- Backup and disaster recovery for monitoring infrastructure
-- Change management processes for monitoring configurations
-
-### AI & Machine Learning Integration
-- Anomaly detection using statistical models and machine learning algorithms
-- Predictive analytics for capacity planning and resource forecasting
-- Root cause analysis automation using correlation analysis and pattern recognition
-- Intelligent alert clustering and noise reduction using unsupervised learning
-- Time series forecasting for proactive scaling and maintenance scheduling
-- Natural language processing for log analysis and error categorization
-- Automated baseline establishment and drift detection for system behavior
-- Performance regression detection using statistical change point analysis
-- Integration with MLOps pipelines for model monitoring and observability
-
-## Behavioral Traits
-- Prioritizes production reliability and system stability over feature velocity
-- Implements comprehensive monitoring before issues occur, not after
-- Focuses on actionable alerts and meaningful metrics over vanity metrics
-- Emphasizes correlation between business impact and technical metrics
-- Considers cost implications of monitoring and observability solutions
-- Uses data-driven approaches for capacity planning and optimization
-- Implements gradual rollouts and canary monitoring for changes
-- Documents monitoring rationale and maintains runbooks religiously
-- Stays current with emerging observability tools and practices
-- Balances monitoring coverage with system performance impact
-
-## Knowledge Base
-- Latest observability developments and tool ecosystem evolution (2024/2025)
-- Modern SRE practices and reliability engineering patterns with Google SRE methodology
-- Enterprise monitoring architectures and scalability considerations for Fortune 500 companies
-- Cloud-native observability patterns and Kubernetes monitoring with service mesh integration
-- Security monitoring and compliance requirements (SOC2, PCI DSS, HIPAA, GDPR)
-- Machine learning applications in anomaly detection, forecasting, and automated root cause analysis
-- Multi-cloud and hybrid monitoring strategies across AWS, Azure, GCP, and on-premises
-- Developer experience optimization for observability tooling and shift-left monitoring
-- Incident response best practices, post-incident analysis, and blameless postmortem culture
-- Cost-effective monitoring strategies scaling from startups to enterprises with budget optimization
-- OpenTelemetry ecosystem and vendor-neutral observability standards
-- Edge computing and IoT device monitoring at scale
-- Serverless and event-driven architecture observability patterns
-- Container security monitoring and runtime threat detection
-- Business intelligence integration with technical monitoring for executive reporting
-
-## Response Approach
-1. **Analyze monitoring requirements** for comprehensive coverage and business alignment
-2. **Design observability architecture** with appropriate tools and data flow
-3. **Implement production-ready monitoring** with proper alerting and dashboards
-4. **Include cost optimization** and resource efficiency considerations
-5. **Consider compliance and security** implications of monitoring data
-6. **Document monitoring strategy** and provide operational runbooks
-7. **Implement gradual rollout** with monitoring validation at each stage
-8. **Provide incident response** procedures and escalation workflows
-
-## Example Interactions
-- "Design a comprehensive monitoring strategy for a microservices architecture with 50+ services"
-- "Implement distributed tracing for a complex e-commerce platform handling 1M+ daily transactions"
-- "Set up cost-effective log management for a high-traffic application generating 10TB+ daily logs"
-- "Create SLI/SLO framework with error budget tracking for API services with 99.9% availability target"
-- "Build real-time alerting system with intelligent noise reduction for 24/7 operations team"
-- "Implement chaos engineering with monitoring validation for Netflix-scale resilience testing"
-- "Design executive dashboard showing business impact of system reliability and revenue correlation"
-- "Set up compliance monitoring for SOC2 and PCI requirements with automated evidence collection"
-- "Optimize monitoring costs while maintaining comprehensive coverage for startup scaling to enterprise"
-- "Create automated incident response workflows with runbook integration and Slack/PagerDuty escalation"
-- "Build multi-region observability architecture with data sovereignty compliance"
-- "Implement machine learning-based anomaly detection for proactive issue identification"
-- "Design observability strategy for serverless architecture with AWS Lambda and API Gateway"
-- "Create custom metrics pipeline for business KPIs integrated with technical monitoring"
+
+# Observability
+
+Telemetry exists to answer one question during an incident: what changed, for
+whom, and where. Collecting more data does not answer it; collecting correlated
+data does. This skill covers what to emit, how to keep it affordable, and how to
+alert on it without paging people for noise.
+
+## The three signals and how they join
+
+| Signal | Best at | Join key |
+|--------|---------|----------|
+| Traces | where time went in one request across services | `trace_id`, `span_id` |
+| Metrics | how much and how often, cheaply, over long periods | resource attributes, exemplars |
+| Logs | the detail of one event | `trace_id` / `span_id` fields |
+
+A metric spike links to example traces through exemplars; a trace links to its
+log lines through the trace id. If any of those links is missing, the signals
+become three separate searches.
+
+## Structured logging
+
+- One JSON object per line, written to stdout.
+- Fixed fields: `timestamp`, `level`, `message`, `service`, `trace_id`,
+  `span_id`, plus event fields. Let the logging bridge inject trace context
+  instead of passing ids by hand.
+- Message is a stable event name ("order payment declined"); variables go in
+  fields. Stable messages make grouping and counting possible.
+- Levels mean something: `error` is actionable by someone, `warn` is degraded
+  but handled, `info` is a business event, `debug` is off in production.
+- Redact at the source and again in the Collector: tokens, passwords, card data,
+  emails and free-text user input.
+
+```json
+{"timestamp":"2026-09-25T10:14:03.112Z","level":"warn","message":"inventory reservation retried","service":"orders","trace_id":"4bf92f3577b34da6a3ce929d0e0e4736","span_id":"00f067aa0ba902b7","order_id":"ord_8812","attempt":2}
+```
+
+## Which metrics to emit
+
+For every request-driven service, **RED**:
+
+- **Rate**: requests per second, by route and outcome.
+- **Errors**: failed requests, by route and error type.
+- **Duration**: a latency histogram, by route.
+
+For every resource (CPU, memory, pool, queue, disk), **USE**:
+
+- **Utilization**: fraction busy.
+- **Saturation**: work waiting (queue depth, pool wait time).
+- **Errors**: resource-level failures.
+
+Add a few business metrics that show the product working: orders placed,
+payments captured, notes saved. They catch failures that return 200.
+
+Use histograms for latency, never averages. OpenTelemetry exponential
+histograms avoid hand-tuning bucket boundaries.
+
+## Cardinality
+
+Every unique combination of attribute values is a separate time series, and
+cost grows with that count.
+
+- Never use unbounded values as metric attributes: user id, order id, email,
+  raw URL, full error message, timestamps.
+- Use `http.route` (`/orders/{id}`), not `url.path` (`/orders/8812`).
+- Bucket open-ended values (status class `5xx`, size bands).
+- High-cardinality detail belongs on spans and logs, which are sampled or
+  retained for shorter periods.
+- Enforce limits with Collector processors or SDK views that drop or rewrite
+  attributes.
+
+## Sampling
+
+- **Head sampling** (decided at the root span, for example 10% with
+  `parentbased_traceidratio`) is cheap but blind to outcome.
+- **Tail sampling** in the Collector decides after the trace completes: keep all
+  errors, all traces slower than a threshold, and a small percentage of the
+  rest. It needs every span of a trace to reach the same Collector instance
+  (load-balancing exporter keyed by trace id).
+- Metrics are never sampled; derive RED metrics from spans before sampling
+  (span metrics connector) or emit them directly.
+
+## SLIs and SLOs
+
+An SLI is a ratio of good events to valid events, measured as close to the user
+as practical:
+
+- Availability: requests not returning 5xx / all requests.
+- Latency: requests faster than 400 ms / all requests.
+- Freshness (pipelines): records processed within 5 minutes / all records.
+
+An SLO sets a target over a window, for example 99.9% over 28 days. The error
+budget is the remainder (0.1%, about 40 minutes of total outage in 28 days).
+Spending policy is agreed in advance: budget exhausted means reliability work
+before features.
+
+## Alerting on burn rate
+
+Alert on how fast the budget is being consumed, not on raw thresholds. Burn
+rate 1 spends exactly the budget over the window. Common multi-window pairs for
+a 28 to 30 day SLO:
+
+| Severity | Long window | Short window | Burn rate | Budget spent if sustained |
+|----------|-------------|--------------|-----------|---------------------------|
+| page | 1 h | 5 min | 14.4 | 2% in an hour |
+| page | 6 h | 30 min | 6 | 5% in six hours |
+| ticket | 3 days | 6 h | 1 | 10% in three days |
+
+Both windows must exceed the rate; the short window makes the alert reset soon
+after recovery. PromQL shape for the first row, with a 99.9% target:
+
+```promql
+(
+  sum(rate(http_server_errors_total{service="orders"}[1h]))
+  / sum(rate(http_server_requests_total{service="orders"}[1h]))
+) > (14.4 * 0.001)
+and
+(
+  sum(rate(http_server_errors_total{service="orders"}[5m]))
+  / sum(rate(http_server_requests_total{service="orders"}[5m]))
+) > (14.4 * 0.001)
+```
+
+Every page links a runbook and a dashboard. Cause-based alerts (CPU high, pod
+restarted) become tickets or dashboard panels unless they reliably predict user
+impact.
+
+## Dashboards
+
+One service dashboard, top to bottom:
+
+1. SLO status and remaining budget.
+2. RED for the service's entry points.
+3. RED for each downstream dependency, from the client side.
+4. USE for the resources it owns (pools, queues, runtime memory, GC).
+5. Deploy and feature-flag annotations on every graph.
+
+## Review checklist
+
+- Every signal carries `service.name`, `service.version` and environment.
+- Traces cross every service and queue hop without breaking.
+- Logs are JSON, carry trace ids, and contain no secrets or personal data.
+- No metric attribute is unbounded.
+- Each user-facing service has at least one SLO with burn-rate alerts and a
+  runbook link.
+- Sampling keeps every error trace.
+
+## References
+
+- `references/patterns.md`: SDK setup, resource attributes, semantic conventions and context propagation, plus a Collector pipeline. Load it when the task reaches those topics.

package/pipeline/skills/shared/external/observability-engineer/references/patterns.md

@@ -0,0 +1,75 @@
+# OpenTelemetry setup
+
+Loaded on demand from `../SKILL.md`.
+
+## Instrument with OpenTelemetry
+
+Use the OpenTelemetry SDK for the language and export OTLP to a Collector,
+never straight to a vendor. The Collector is where batching, redaction,
+sampling and routing happen, and swapping backends becomes a config change.
+
+Order of work:
+
+1. **Resource attributes** on every signal: `service.name`, `service.version`,
+   `deployment.environment.name`, plus `k8s.*` or `cloud.*` from detectors.
+2. **Auto-instrumentation** for HTTP servers and clients, gRPC, database
+   drivers and message clients. It gives correct span kinds and semantic
+   convention attributes for free.
+3. **Manual spans** only around business steps that auto-instrumentation cannot
+   see, such as pricing an order or rendering a report.
+4. **Propagation**: W3C `traceparent` over HTTP, and the same context injected
+   into message headers so consumers continue the trace (use span links when a
+   consumer batches many messages).
+
+Node.js example of a manual span:
+
+```ts
+import { trace, SpanStatusCode } from "@opentelemetry/api";
+
+const tracer = trace.getTracer("orders-service");
+
+export async function priceOrder(order: Order) {
+  return tracer.startActiveSpan("price_order", async (span) => {
+    span.setAttribute("order.line_count", order.lines.length);
+    try {
+      const total = await pricing.compute(order);
+      span.setAttribute("order.currency", total.currency);
+      return total;
+    } catch (err) {
+      span.recordException(err as Error);
+      span.setStatus({ code: SpanStatusCode.ERROR });
+      throw err;
+    } finally {
+      span.end();
+    }
+  });
+}
+```
+
+Semantic conventions to follow rather than invent: `http.request.method`,
+`http.route`, `http.response.status_code`, `url.path`, `server.address`,
+`db.system`, `db.operation.name`, `messaging.system`, `error.type`. Custom
+attributes get a namespace (`order.*`, `product.*`).
+
+## Collector pipeline sketch
+
+```yaml
+receivers:
+  otlp:
+    protocols: { grpc: {}, http: {} }
+processors:
+  memory_limiter: { check_interval: 1s, limit_percentage: 80 }
+  attributes/redact:
+    actions:
+      - { key: user.email, action: delete }
+  batch: {}
+exporters:
+  otlphttp: { endpoint: https://telemetry.example.com }
+service:
+  pipelines:
+    traces:  { receivers: [otlp], processors: [memory_limiter, attributes/redact, batch], exporters: [otlphttp] }
+    metrics: { receivers: [otlp], processors: [memory_limiter, batch], exporters: [otlphttp] }
+    logs:    { receivers: [otlp], processors: [memory_limiter, attributes/redact, batch], exporters: [otlphttp] }
+```
+
+`memory_limiter` goes first and `batch` last.

package/pipeline/skills/shared/external/passkit-wallet/SKILL.md

@@ -1,6 +1,8 @@
 ---
 name: passkit-wallet
 description: "Integrate Apple Pay payments and Wallet passes using PassKit. Use when adding Apple Pay buttons, creating payment requests, handling payment authorization, adding passes to Wallet, configuring merchant capabilities, managing shipping/contact fields, or working with PKPaymentRequest, PKPaymentAuthorizationController, PKPaymentButton, AddPassToWalletButton, PKPass, PKAddPassesViewController, PKPassLibrary, Wallet pass distribution, or Apple Pay checkout flows for physical goods, real-world services, donations, and eligible recurring payments."
+metadata:
+  source: "dpearson2699/swift-ios-skills (PolyForm Perimeter 1.0.0)"
 ---
 
 # PassKit

package/pipeline/skills/shared/external/passkit-wallet/evals/evals.json

@@ -1,5 +1,5 @@
 {
-  "skill_name": "passkit",
+  "skill_name": "passkit-wallet",
   "evals": [
     {
       "id": 1,
@@ -34,7 +34,7 @@
     },
     {
       "id": 3,
-      "prompt": "I need advanced Apple Pay support for a travel marketplace: recurring service membership, coupon entry in the payment sheet, two end merchants that need separate tokens, and a hotel preauthorization charged later. Outline the PassKit APIs and gotchas without drifting into FinanceKit or StoreKit implementation.",
+      "prompt": "I need advanced Apple Pay support for a home-goods marketplace: recurring service membership, coupon entry in the payment sheet, two end merchants that need separate tokens, and a furniture pre-order charged later. Outline the PassKit APIs and gotchas without drifting into FinanceKit or StoreKit implementation.",
       "expected_output": "An advanced PassKit outline using the optional request types and update callbacks correctly, with decimal amounts, management URLs, coupon update details, multi-token contexts, and sibling-skill boundaries.",
       "files": [],
       "assertions": [

package/pipeline/skills/shared/external/passkit-wallet/references/wallet-passes.md

@@ -119,43 +119,43 @@ func createMultiMerchantRequest() -> PKPaymentRequest {
 
     request.paymentSummaryItems = [
         PKPaymentSummaryItem(
-            label: "Hotel Stay",
+            label: "Furniture",
             amount: NSDecimalNumber(string: "299.00")
         ),
         PKPaymentSummaryItem(
-            label: "Car Rental",
+            label: "Lighting",
             amount: NSDecimalNumber(string: "89.00")
         ),
         PKPaymentSummaryItem(
-            label: "Travel Platform",
+            label: "Home Goods Marketplace",
             amount: NSDecimalNumber(string: "388.00")
         )
     ]
 
-    let hotelContext = PKPaymentTokenContext(
-        merchantIdentifier: "merchant.com.example.hotel",
-        externalIdentifier: "hotel-booking-123",
-        merchantName: "Example Hotel",
-        merchantDomain: "hotel.example.com",
+    let furnitureContext = PKPaymentTokenContext(
+        merchantIdentifier: "merchant.com.example.furniture",
+        externalIdentifier: "furniture-order-123",
+        merchantName: "Example Furniture",
+        merchantDomain: "furniture.example.com",
         amount: NSDecimalNumber(string: "299.00")
     )
 
-    let carContext = PKPaymentTokenContext(
-        merchantIdentifier: "merchant.com.example.carrental",
-        externalIdentifier: "car-rental-456",
-        merchantName: "Example Car Rental",
-        merchantDomain: "carrental.example.com",
+    let lightingContext = PKPaymentTokenContext(
+        merchantIdentifier: "merchant.com.example.lighting",
+        externalIdentifier: "lighting-order-456",
+        merchantName: "Example Lighting",
+        merchantDomain: "lighting.example.com",
         amount: NSDecimalNumber(string: "89.00")
     )
 
-    request.multiTokenContexts = [hotelContext, carContext]
+    request.multiTokenContexts = [furnitureContext, lightingContext]
     return request
 }
 ```
 
 ## Deferred Payments
 
-Set up payments that charge later, such as hotel bookings or pre-orders.
+Set up payments that charge later, such as pre-orders or made-to-order goods.
 
 ```swift
 func createDeferredPaymentRequest() -> PKPaymentRequest {
@@ -166,15 +166,15 @@ func createDeferredPaymentRequest() -> PKPaymentRequest {
     )!
 
     let deferredBilling = PKDeferredPaymentSummaryItem(
-        label: "Hotel Stay (charged at check-in)",
+        label: "Sofa (charged at shipment)",
         amount: NSDecimalNumber(string: "299.00")
     )
     deferredBilling.deferredDate = deferredDate
 
     let deferredRequest = PKDeferredPaymentRequest(
-        paymentDescription: "Hotel Booking - Check-in",
+        paymentDescription: "Made-to-order Sofa - Shipment",
         deferredBilling: deferredBilling,
-        managementURL: URL(string: "https://example.com/bookings")!
+        managementURL: URL(string: "https://example.com/orders")!
     )
     deferredRequest.freeCancellationDate = deferredDate
     deferredRequest.freeCancellationDateTimeZone = .current

package/pipeline/skills/shared/external/pdfkit/SKILL.md

@@ -1,8 +1,9 @@
 ---
 name: pdfkit
 description: "Display and manipulate PDF documents using PDFKit. Use when embedding PDFView to show PDF files, creating or modifying PDFDocument instances, adding annotations (highlights, notes, signature widgets), extracting text with PDFSelection, navigating pages, generating thumbnails, filling PDF forms, or wrapping PDFView in SwiftUI."
+metadata:
+  source: "dpearson2699/swift-ios-skills (PolyForm Perimeter 1.0.0)"
 ---
-
 # PDFKit
 
 Display, navigate, search, annotate, and manipulate PDF documents with `PDFView`, `PDFDocument`, `PDFPage`, `PDFAnnotation`, and `PDFSelection`. Targets Swift 6.3 / iOS 26+.

package/pipeline/skills/shared/external/pencilkit-drawing/SKILL.md

@@ -1,6 +1,8 @@
 ---
 name: pencilkit-drawing
 description: "Add Apple Pencil drawing with PKCanvasView, PKToolPicker, PKDrawing serialization/export, stroke inspection, and PencilKit/PaperKit handoffs. Use when building drawing apps, annotation features, handwriting capture, signature fields, content-version-safe ink workflows, or Apple Pencil-powered experiences on iOS/iPadOS/visionOS."
+metadata:
+  source: "dpearson2699/swift-ios-skills (PolyForm Perimeter 1.0.0)"
 ---
 
 # PencilKit

package/pipeline/skills/shared/external/pencilkit-drawing/evals/evals.json

@@ -1,5 +1,5 @@
 {
-  "skill_name": "pencilkit",
+  "skill_name": "pencilkit-drawing",
   "evals": [
     {
       "id": 0,

package/pipeline/skills/shared/external/permissionkit/SKILL.md

@@ -1,6 +1,8 @@
 ---
 name: permissionkit
 description: "Create child communication safety experiences using PermissionKit to request parental permission for children. Use when building apps that involve child-to-contact communication, need to check communication limits, request parent/guardian approval, or handle permission responses for minors."
+metadata:
+  source: "dpearson2699/swift-ios-skills (PolyForm Perimeter 1.0.0)"
 ---
 
 # PermissionKit

package/pipeline/skills/shared/external/photos-camera-media/SKILL.md

@@ -1,8 +1,9 @@
 ---
 name: photos-camera-media
 description: "Implement, review, or improve photo picking, camera capture, and media handling in iOS apps using PhotoKit and AVFoundation. Use when working with PhotosPicker, PHPickerViewController, camera capture sessions (AVCaptureSession), photo library access, image loading and display, video recording, or media permissions. Also use when selecting photos from the library, taking pictures, recording video, processing images, or handling photo/camera privacy permissions in Swift apps."
+metadata:
+  source: "dpearson2699/swift-ios-skills (PolyForm Perimeter 1.0.0)"
 ---
-
 # PhotoKit
 
 Modern patterns for photo picking, camera capture, image loading, and media permissions targeting iOS 26+ with Swift 6.3. Patterns are backward-compatible to iOS 16 unless noted. See [references/photokit-patterns.md](references/photokit-patterns.md) for complete picker recipes and [references/camera-capture.md](references/camera-capture.md) for AVCaptureSession patterns.