@mmerterden/multi-agent-pipeline 8.6.2 → 10.0.6

package/pipeline/skills/shared/external/callkit-voip/SKILL.md

@@ -3,12 +3,12 @@ name: callkit-voip
 description: "Implement VoIP calling with CallKit and PushKit. Use when building incoming/outgoing call flows, registering for VoIP push notifications, configuring CXProvider and CXCallController, handling call actions, coordinating audio sessions, or creating Call Directory extensions for caller ID and call blocking."
 ---
 
-# CallKit + PushKit VoIP
+# CallKit
 
 Build VoIP calling features that integrate with the native iOS call UI using
 CallKit and PushKit. Covers incoming/outgoing call flows, VoIP push
 registration, audio session coordination, and call directory extensions.
-Targets Swift 6.2 / iOS 26+.
+Targets Swift 6.3 / iOS 26+.
 
 ## Contents
 
@@ -18,7 +18,7 @@ Targets Swift 6.2 / iOS 26+.
 - [Outgoing Call Flow](#outgoing-call-flow)
 - [PushKit VoIP Registration](#pushkit-voip-registration)
 - [Audio Session Coordination](#audio-session-coordination)
-- [Call Directory Extension](#call-directory-extension)
+- [Call Directory Extension and Manager](#call-directory-extension-and-manager)
 - [Common Mistakes](#common-mistakes)
 - [Review Checklist](#review-checklist)
 - [References](#references)
@@ -40,6 +40,7 @@ Targets Swift 6.2 / iOS 26+.
 | `CXCallUpdate` | Describes call metadata (caller name, video, handle) |
 | `CXProviderDelegate` | Handles system call actions and audio session events |
 | `PKPushRegistry` | Registers for and receives VoIP push notifications |
+| `PKVoIPPushMetadata` | iOS 26.4+ metadata that says whether a VoIP push must be reported |
 
 ## Provider Configuration
 
@@ -77,10 +78,10 @@ final class CallManager: NSObject, @unchecked Sendable {
 
 ## Incoming Call Flow
 
-When a VoIP push arrives, report the incoming call to CallKit immediately.
-The system displays the native call UI. You must report the call before the
-PushKit completion handler returns -- failure to do so causes the system to
-terminate your app.
+When a required VoIP call push arrives, report the incoming call to CallKit
+immediately. The system displays the native call UI. You must report required
+calls before the PushKit completion handler returns -- failure to do so causes
+the system to terminate your app.
 
 ```swift
 func reportIncomingCall(
@@ -120,10 +121,20 @@ extension CallManager: CXProviderDelegate {
     }
 
     func provider(_ provider: CXProvider, perform action: CXAnswerCallAction) {
-        // Configure audio, connect to call server
+        // Prepare audio, then fulfill only after the call is actually ready
         configureAudioSession()
-        connectToCallServer(callUUID: action.callUUID)
-        action.fulfill()
+        connectToCallServer(callUUID: action.callUUID) { success in
+            if success {
+                action.fulfill()
+            } else {
+                provider.reportCall(
+                    with: action.callUUID,
+                    endedAt: Date(),
+                    reason: .failed
+                )
+                action.fail()
+            }
+        }
     }
 
     func provider(_ provider: CXProvider, perform action: CXEndCallAction) {
@@ -179,8 +190,19 @@ extension CallManager {
 
 ## PushKit VoIP Registration
 
-Register for VoIP pushes at every app launch. Send the token to your server
-whenever it changes.
+Register for VoIP pushes at every app launch and send token changes to your
+server. For iOS 13 SDK+ apps, every report-required VoIP call push must be
+reported before PushKit completion using CallKit, or LiveCommunicationKit for
+apps built on that framework. On iOS 26.4+, `PKVoIPPushMetadata.mustReport` is
+the gate: `true` means report before completion; `false` means no CallKit or
+LiveCommunicationKit report is required. Missing a required report before
+completion can terminate the app, and repeated failures may stop VoIP delivery.
+
+| Path | Report decision | Completion timing |
+|---|---|---|
+| iOS 26.4+ `mustReport == true` | Report with CallKit or LiveCommunicationKit | After report callback |
+| iOS 26.4+ `mustReport == false` | No CallKit/LiveCommunicationKit report required | After local handling |
+| Older delegate | iOS 13 SDK+ treats VoIP call pushes as report-required | After report callback |
 
 ```swift
 import PushKit
@@ -207,6 +229,21 @@ final class PushManager: NSObject, PKPushRegistryDelegate {
         sendTokenToServer(token)
     }
 
+    @available(iOS 26.4, *)
+    func pushRegistry(
+        _ registry: PKPushRegistry,
+        didReceiveIncomingVoIPPushWith payload: PKPushPayload,
+        metadata: PKVoIPPushMetadata,
+        withCompletionHandler completion: @escaping @Sendable () -> Void
+    ) {
+        guard metadata.mustReport else {
+            completion()
+            return
+        }
+        handleIncomingVoIPPush(payload, completion: completion)
+    }
+
+    // Keep the older callback for iOS 26.0-26.3 and older deployment targets.
     func pushRegistry(
         _ registry: PKPushRegistry,
         didReceiveIncomingPushWith payload: PKPushPayload,
@@ -218,6 +255,13 @@ final class PushManager: NSObject, PKPushRegistryDelegate {
             return
         }
 
+        handleIncomingVoIPPush(payload, completion: completion)
+    }
+
+    private func handleIncomingVoIPPush(
+        _ payload: PKPushPayload,
+        completion: @escaping () -> Void
+    ) {
         let callUUID = UUID()
         let handle = payload.dictionaryPayload["handle"] as? String ?? "Unknown"
 
@@ -237,10 +281,18 @@ final class PushManager: NSObject, PKPushRegistryDelegate {
 }
 ```
 
+Server-side VoIP pushes should use a short lifetime: set `apns-expiration` to
+`0` or only a few seconds. After the initial push wakes the app, send hangups
+and call-detail changes over the app-server connection instead of sending more
+VoIP pushes.
+
 ## Audio Session Coordination
 
 CallKit manages audio session activation/deactivation. Configure your audio
 session when CallKit tells you to, not before.
+Review answers should name both sides: start media only in
+`provider(_:didActivate:)`, and stop/tear down media in
+`provider(_:didDeactivate:)` or reset paths.
 
 ```swift
 extension CallManager {
@@ -269,9 +321,14 @@ extension CallManager {
 }
 ```
 
-## Call Directory Extension
+## Call Directory Extension and Manager
 
-Create a Call Directory extension to provide caller ID and call blocking.
+Use Call Directory for preloaded caller ID/blocking, not per-call API lookup.
+The extension loads sorted bulk data in `beginRequest(with:)`; the main app uses
+`CXCallDirectoryManager` to check enabled status, open Call Blocking &
+Identification settings when disabled, and reload after data changes. Store
+`CXCallDirectoryPhoneNumber` as country code plus digits in ascending order
+(for example `18005551234`), not a formatted string.
 
 ```swift
 import CallKit
@@ -291,7 +348,7 @@ final class CallDirectoryHandler: CXCallDirectoryProvider {
     private func addAllEntries(
         to context: CXCallDirectoryExtensionContext
     ) {
-        // Phone numbers must be in ascending order (E.164 format as Int64)
+        // Country code + digits, sorted in ascending order
         let blockedNumbers: [CXCallDirectoryPhoneNumber] = [
             18005551234, 18005555678
         ]
@@ -315,138 +372,113 @@ final class CallDirectoryHandler: CXCallDirectoryProvider {
 }
 ```
 
-Reload the extension from the main app after data changes:
+### Main-App Manager: Status, Settings, Reload
 
 ```swift
-CXCallDirectoryManager.sharedInstance.reloadExtension(
-    withIdentifier: "com.example.app.CallDirectory"
-) { error in
-    if let error { print("Reload failed: \(error)") }
+let manager = CXCallDirectoryManager.sharedInstance
+manager.getEnabledStatusForExtension(withIdentifier: extensionID) { status, _ in
+    guard status == .enabled else {
+        manager.openSettings { _ in } // Call Blocking & Identification
+        return
+    }
+    manager.reloadExtension(withIdentifier: extensionID) { _ in }
 }
 ```
 
+Check `getEnabledStatusForExtension(...)` before assuming the extension is
+active, use `openSettings(...)` for Call Blocking & Identification when
+disabled, and call `reloadExtension(...)` after data changes. Route APNs
+auth-key rotation and normal remote-notification setup to push-notifications.
+
 ## Common Mistakes
 
-### DON'T: Fail to report a call on VoIP push receipt
+### DON'T: Fail to report a required call on VoIP push receipt
 
-If your PushKit delegate receives a VoIP push but does not call
-`reportNewIncomingCall(with:update:completion:)`, iOS terminates your app and
-may stop delivering pushes entirely.
+Follow the PushKit report rules above: iOS 13 SDK+ apps must report
+report-required VoIP call pushes before completion, and on iOS 26.4+
+`PKVoIPPushMetadata.mustReport` identifies which pushes are required. Missing a
+required report can terminate the app; repeated failures may stop VoIP delivery.
 
-```swift
-// WRONG -- no call reported
-func pushRegistry(
-    _ registry: PKPushRegistry,
-    didReceiveIncomingPushWith payload: PKPushPayload,
-    for type: PKPushType,
-    completion: @escaping () -> Void
-) {
-    // Just process data, no call reported
-    processPayload(payload)
-    completion()
-}
+Do not treat a required VoIP push as a data-only notification. Report the call
+to CallKit and call the PushKit completion handler from the report completion.
 
-// CORRECT -- always report a call
-func pushRegistry(
-    _ registry: PKPushRegistry,
-    didReceiveIncomingPushWith payload: PKPushPayload,
-    for type: PKPushType,
-    completion: @escaping () -> Void
-) {
-    let uuid = UUID()
-    provider.reportNewIncomingCall(
-        with: uuid, update: makeUpdate(from: payload)
-    ) { _ in completion() }
-}
-```
+### DON'T: Fulfill answer before the call is connected
+
+When the user answers before your app has established the server/media
+connection, leave the `CXAnswerCallAction` pending while connecting. Fulfill it
+after the call is ready; if connection fails, fail the action and report the
+call ended with `.failed`.
 
 ### DON'T: Start audio before CallKit activates the session
 
 Starting your audio engine before `provider(_:didActivate:)` causes silence
 or immediate deactivation. CallKit manages session priority with the system.
 
-```swift
-// WRONG
-func provider(_ provider: CXProvider, perform action: CXAnswerCallAction) {
-    startAudioEngine()  // Too early -- session not active yet
-    action.fulfill()
-}
+Prepare audio in the answer/start action if needed, then start media only from
+`provider(_:didActivate:)`.
 
-// CORRECT
-func provider(_ provider: CXProvider, perform action: CXAnswerCallAction) {
-    prepareAudioEngine()  // Prepare, but do not start
-    action.fulfill()
-}
+For iOS 26 call translation, set `CXProviderConfiguration.supportsAudioTranslation`
+when your service supports it and handle `CXSetTranslatingCallAction`. If a
+person mutes during a translated call, mute app input with
+`CXSetMutedCallAction`; do not deactivate upstream audio that translated audio
+depends on.
 
-func provider(_ provider: CXProvider, didActivate audioSession: AVAudioSession) {
-    startAudioEngine()  // Now it's safe
-}
-```
+For encrypted VoIP metadata, use `CXProvider.reportNewIncomingVoIPPushPayload`
+only from a notification service extension when the server cannot determine
+whether encrypted content is a VoIP call or other data. That path requires the
+`com.apple.developer.usernotifications.filtering` entitlement; otherwise send a
+normal PushKit VoIP push.
 
 ### DON'T: Forget to call action.fulfill() or action.fail()
 
 Failing to fulfill or fail an action leaves the call in a limbo state and
 triggers the timeout handler.
 
-```swift
-// WRONG
-func provider(_ provider: CXProvider, perform action: CXAnswerCallAction) {
-    connectToServer()
-    // Forgot action.fulfill()
-}
-
-// CORRECT
-func provider(_ provider: CXProvider, perform action: CXAnswerCallAction) {
-    connectToServer()
-    action.fulfill()
-}
-```
+Every provider action path must eventually call `fulfill()` or `fail()`,
+including network-error and cancellation paths.
 
 ### DON'T: Ignore push token refresh
 
 The VoIP push token can change at any time. If your server has a stale token,
 pushes silently fail and incoming calls never arrive.
 
-```swift
-// WRONG -- only send token once at first registration
-func pushRegistry(
-    _ registry: PKPushRegistry,
-    didUpdate pushCredentials: PKPushCredentials,
-    for type: PKPushType
-) {
-    // Token saved locally but never updated on server
-}
+Send the token to your server every time `didUpdate pushCredentials` fires,
+not just during first-run onboarding.
 
-// CORRECT -- always update server
-func pushRegistry(
-    _ registry: PKPushRegistry,
-    didUpdate pushCredentials: PKPushCredentials,
-    for type: PKPushType
-) {
-    let token = pushCredentials.token.map { String(format: "%02x", $0) }.joined()
-    sendTokenToServer(token)  // Always send to server
-}
-```
+### DON'T: Use Call Directory for per-call lookup
+
+Call Directory extensions provide preloaded caller ID and blocking data. They
+cannot ask a web service for the incoming caller during call presentation.
+Fetch or generate the dataset ahead of time, reload the extension, and add
+entries in sorted sequential order.
 
 ## Review Checklist
 
 - [ ] VoIP background mode enabled in capabilities
 - [ ] Single `CXProvider` instance created at app launch and retained
 - [ ] `CXProviderDelegate` set before reporting any calls
-- [ ] Every VoIP push results in a `reportNewIncomingCall` call
+- [ ] iOS 26.4+ PushKit path reports when `mustReport` is true and may skip when false
+- [ ] iOS 13 SDK+ PushKit VoIP call pushes report to CallKit before completion
+- [ ] VoIP APNs requests use `apns-expiration` of `0` or only a few seconds
+- [ ] Hangups and detail updates use the app-server connection after the initial push
 - [ ] `action.fulfill()` or `action.fail()` called for every provider delegate action
+- [ ] `CXAnswerCallAction` fulfilled only after the call server/media connection is ready
 - [ ] Audio engine started only after `provider(_:didActivate:)` callback
 - [ ] Audio engine stopped in `provider(_:didDeactivate:)` callback
 - [ ] Audio session category set to `.playAndRecord` with `.voiceChat` mode
 - [ ] VoIP push token sent to server on every `didUpdate pushCredentials` callback
 - [ ] `PKPushRegistry` created at every app launch (not lazily)
-- [ ] Call Directory phone numbers added in ascending E.164 order
+- [ ] Call Directory data is preloaded, not fetched per incoming call
+- [ ] `CXCallDirectoryPhoneNumber` documented as country calling code + digits
+- [ ] `CXCallDirectoryManager` names status check, reload, and settings-opening APIs
 - [ ] `CXCallUpdate` populated with `localizedCallerName` and `remoteHandle`
 - [ ] Outgoing calls report `startedConnectingAt` and `connectedAt` timestamps
+- [ ] iOS 26 call translation keeps upstream audio active during mute
+- [ ] Encrypted metadata filtering mentions the notification service extension entitlement
 
 ## References
 
-- Extended patterns (hold, mute, group calls, delegate lifecycle): `references/callkit-patterns.md`
+- Extended patterns (hold, mute, group calls, delegate lifecycle): [references/callkit-patterns.md](references/callkit-patterns.md)
 - [CallKit framework](https://sosumi.ai/documentation/callkit)
 - [CXProvider](https://sosumi.ai/documentation/callkit/cxprovider)
 - [CXCallController](https://sosumi.ai/documentation/callkit/cxcallcontroller)
@@ -456,6 +488,11 @@ func pushRegistry(
 - [CXProviderDelegate](https://sosumi.ai/documentation/callkit/cxproviderdelegate)
 - [PKPushRegistry](https://sosumi.ai/documentation/pushkit/pkpushregistry)
 - [PKPushRegistryDelegate](https://sosumi.ai/documentation/pushkit/pkpushregistrydelegate)
+- [PKVoIPPushMetadata](https://sosumi.ai/documentation/pushkit/pkvoippushmetadata)
 - [CXCallDirectoryProvider](https://sosumi.ai/documentation/callkit/cxcalldirectoryprovider)
+- [CXCallDirectoryPhoneNumber](https://sosumi.ai/documentation/callkit/cxcalldirectoryphonenumber)
+- [CXCallDirectoryManager](https://sosumi.ai/documentation/callkit/cxcalldirectorymanager)
+- [CXSetTranslatingCallAction](https://sosumi.ai/documentation/callkit/cxsettranslatingcallaction)
+- [reportNewIncomingVoIPPushPayload(_:completion:)](https://sosumi.ai/documentation/callkit/cxprovider/reportnewincomingvoippushpayload(_:completion:))
 - [Making and receiving VoIP calls](https://sosumi.ai/documentation/callkit/making-and-receiving-voip-calls)
 - [Responding to VoIP Notifications from PushKit](https://sosumi.ai/documentation/pushkit/responding-to-voip-notifications-from-pushkit)

package/pipeline/skills/shared/external/callkit-voip/evals/evals.json

@@ -0,0 +1,47 @@
+{
+  "skill_name": "callkit",
+  "evals": [
+    {
+      "id": 0,
+      "prompt": "I'm updating an iOS 26 VoIP app for the latest PushKit behavior. Sketch the PushKit + CallKit incoming-call path for iOS 26.4 and earlier iOS 26.x, including when I can ignore a VoIP push, when I must report to CallKit, and the APNs server settings that matter.",
+      "expected_output": "A source-grounded CallKit/PushKit implementation outline that prefers the iOS 26.4 metadata delegate, respects mustReport, keeps the older delegate as fallback, reports required calls before PushKit completion, and notes short VoIP push expiration.",
+      "files": [],
+      "expectations": [
+        "Uses the iOS 26.4+ PKPushRegistryDelegate method with PKVoIPPushMetadata when available.",
+        "Checks PKVoIPPushMetadata.mustReport and explains that false means the app is not required to report the push to CallKit or LiveCommunicationKit.",
+        "Keeps the older pushRegistry(_:didReceiveIncomingPushWith:for:completion:) path for iOS 26.0-26.3 or older deployment targets.",
+        "Reports required VoIP call pushes with CXProvider.reportNewIncomingCall before completing PushKit handling.",
+        "Mentions that apps built with the iOS 13 SDK or later must use CallKit for PushKit VoIP calls and repeated report failures can stop VoIP push delivery.",
+        "Recommends apns-expiration 0 or only a few seconds for VoIP push requests."
+      ]
+    },
+    {
+      "id": 1,
+      "prompt": "Review this CallKit plan for mistakes: when the user taps Answer, call action.fulfill() right away and then connect WebRTC; start the audio engine before provider(_:didActivate:); send another VoIP push if the caller hangs up; for encrypted payloads, always use CXProvider.reportNewIncomingVoIPPushPayload from a notification service extension.",
+      "expected_output": "A correction-focused review that defers answer fulfillment until connection succeeds, waits for CallKit audio activation, uses the app-server connection after the initial push, and limits reportNewIncomingVoIPPushPayload to Apple's documented encrypted-metadata case.",
+      "files": [],
+      "expectations": [
+        "Explains that CXAnswerCallAction should be fulfilled after the server/media connection is established and failed or ended if connection fails.",
+        "States that the audio engine should start only after provider(_:didActivate:) and should stop on provider(_:didDeactivate:).",
+        "Routes hangups and call-detail updates over the existing app-server connection after the initial VoIP push instead of sending more VoIP pushes.",
+        "Limits CXProvider.reportNewIncomingVoIPPushPayload to notification service extensions that decrypt payloads when the server cannot tell whether content is a VoIP call or other data.",
+        "Mentions that reportNewIncomingVoIPPushPayload requires the com.apple.developer.usernotifications.filtering entitlement.",
+        "Does not turn the answer into a generic APNs notification permission or rich-notification guide."
+      ]
+    },
+    {
+      "id": 2,
+      "prompt": "I need caller ID and call blocking for a spam filter, plus iOS 26 call translation and normal APNs auth-key rotation. Can the Call Directory extension look up each caller from my API as calls arrive? What belongs in CallKit and what should move to another skill?",
+      "expected_output": "A boundary-aware answer that keeps Call Directory and CallKit call-translation behavior in scope, rejects per-call lookup, uses sorted country-code phone numbers and settings/status APIs, and routes generic APNs auth-key rotation to push notification guidance.",
+      "files": [],
+      "expectations": [
+        "States that Call Directory extensions load bulk caller ID/blocking data in beginRequest(with:) and are not invoked for per-call web lookups.",
+        "Represents CXCallDirectoryPhoneNumber as country code followed by digits and requires sorted or sequential entries.",
+        "Mentions checking extension status and opening Call Blocking & Identification settings with CXCallDirectoryManager when needed.",
+        "Covers iOS 26 call translation with supportsAudioTranslation and CXSetTranslatingCallAction at a concise CallKit level.",
+        "Warns not to deactivate upstream audio on mute while call translation is active.",
+        "Routes generic APNs auth-key rotation or normal remote-notification registration to push-notifications guidance instead of expanding CallKit scope."
+      ]
+    }
+  ]
+}

package/pipeline/skills/shared/external/callkit-voip/references/callkit-patterns.md

@@ -1,6 +1,6 @@
 # CallKit + PushKit Extended Patterns
 
-Overflow reference for the `callkit-voip` skill. Contains advanced patterns that exceed the main skill file's scope.
+Overflow reference for the `callkit` skill. Contains advanced patterns that exceed the main skill file's scope.
 
 ## Contents
 
@@ -8,7 +8,7 @@ Overflow reference for the `callkit-voip` skill. Contains advanced patterns that
 - [Hold and Mute Actions](#hold-and-mute-actions)
 - [Multiple Concurrent Calls](#multiple-concurrent-calls)
 - [Call State Tracking](#call-state-tracking)
-- [End-to-End Encrypted VoIP Push Handling](#end-to-end-encrypted-voip-push-handling)
+- [Encrypted VoIP Push Filtering](#encrypted-voip-push-filtering)
 - [Call Directory Incremental Updates](#call-directory-incremental-updates)
 - [Testing VoIP Locally](#testing-voip-locally)
 
@@ -165,6 +165,8 @@ extension VoIPCallManager: CXProviderDelegate {
     ) {
         Task { @MainActor in
             activeCalls[action.callUUID]?.isMuted = action.isMuted
+            // If call translation is active, mute app input without deactivating
+            // upstream audio that translated audio may need.
             setMicrophoneMuted(action.isMuted)
             action.fulfill()
         }
@@ -176,9 +178,19 @@ extension VoIPCallManager: CXProviderDelegate {
     ) {
         Task { @MainActor in
             configureAudioSession()
-            connectToServer(callUUID: action.callUUID)
-            activeCalls[action.callUUID]?.isConnected = true
-            action.fulfill()
+            connectToServer(callUUID: action.callUUID) { success in
+                if success {
+                    activeCalls[action.callUUID]?.isConnected = true
+                    action.fulfill()
+                } else {
+                    provider.reportCall(
+                        with: action.callUUID,
+                        endedAt: Date(),
+                        reason: .failed
+                    )
+                    action.fail()
+                }
+            }
         }
     }
 
@@ -294,10 +306,13 @@ final class CallStateObserver: NSObject, CXCallObserverDelegate {
 }
 ```
 
-## End-to-End Encrypted VoIP Push Handling
+## Encrypted VoIP Push Filtering
 
-For end-to-end encrypted calls where the push payload is encrypted, use a
-notification service extension with `CXProvider.reportNewIncomingVoIPPushPayload`:
+Use a notification service extension with
+`CXProvider.reportNewIncomingVoIPPushPayload` only when server-side metadata
+encryption means the server cannot determine whether the outgoing notification
+is a VoIP call request or some other data. If the server knows the content is
+a VoIP call, send a normal PushKit VoIP push instead.
 
 ```swift
 import UserNotifications
@@ -367,6 +382,10 @@ private func addOrRemoveIncrementalEntries(
 }
 ```
 
+Call Directory data is bulk data. The system calls `beginRequest(with:)` when
+loading the extension, not for each individual incoming call, so keep web
+lookups and dataset sync in the containing app before reloading the extension.
+
 ## Testing VoIP Locally
 
 ### Simulating VoIP Pushes

package/pipeline/skills/shared/external/ci-cd-pipelines/SKILL.md

@@ -1,4 +1,5 @@
 ---
+name: ci-cd-pipelines
 description: "CI/CD pipelines: GitHub Actions workflows, Docker multi-stage builds, environment management, secret management, deployment strategies"
 tags: [ci-cd, github-actions, docker, deployment, devops, backend]
 version: "2025.1"
@@ -289,7 +290,7 @@ CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]
 ## Environment Management
 
 ```yaml
-# .github/workflows/deploy.yml — environment protection rules
+# .github/workflows/deploy.yml  -  environment protection rules
 # Configure in GitHub Settings > Environments:
 # - staging: auto-deploy on main push
 # - production: require manual approval + 2 reviewers
@@ -302,19 +303,19 @@ jobs:
 ```
 
 ```bash
-# .env.example (committed — template only)
+# .env.example (committed  -  template only)
 DATABASE_URL=postgresql://user:pass@localhost:5432/mydb
 REDIS_URL=redis://localhost:6379
 API_KEY=your-api-key-here
 JWT_SECRET=your-jwt-secret-here
 
-# .env.local (gitignored — local development)
+# .env.local (gitignored  -  local development)
 # .env.staging (managed via CI secrets)
 # .env.production (managed via CI secrets)
 ```
 
 ```typescript
-// config.ts — typed environment configuration
+// config.ts  -  typed environment configuration
 import { z } from 'zod';
 
 const EnvSchema = z.object({
@@ -356,7 +357,7 @@ env:
   API_KEY: "sk-hardcoded-secret-123"  # FORBIDDEN
 
 # NEVER echo secrets in logs:
-- run: echo ${{ secrets.API_KEY }}  # FORBIDDEN — visible in logs
+- run: echo ${{ secrets.API_KEY }}  # FORBIDDEN  -  visible in logs
 
 # Safe pattern:
 - run: |
@@ -442,7 +443,7 @@ async function handleRequest(req: Request) {
 ## Don'ts
 
 - Do not hardcode secrets in workflow files, Dockerfiles, or source code
-- Do not use `latest` tags for Docker base images — pin specific versions
+- Do not use `latest` tags for Docker base images  -  pin specific versions
 - Do not skip tests for "quick" deployments
 - Do not deploy directly to production without staging verification
 - Do not store `.env` files in version control

package/pipeline/skills/shared/external/clean-code/SKILL.md

@@ -11,7 +11,7 @@ date_added: "2026-02-27"
 This skill embodies the principles of "Clean Code" by Robert C. Martin (Uncle Bob). Use it to transform "code that works" into "code that is clean."
 
 ## 🧠 Core Philosophy
-> "Code is clean if it can be read, and enhanced by a developer other than its original author." — Grady Booch
+> "Code is clean if it can be read, and enhanced by a developer other than its original author."  -  Grady Booch
 
 ## When to Use
 Use this skill when:
@@ -37,7 +37,7 @@ Use this skill when:
 - **No Side Effects**: Functions shouldn't secretly change global state.
 
 ## 3. Comments
-- **Don't Comment Bad Code—Rewrite It**: Most comments are a sign of failure to express ourselves in code.
+- **Don't Comment Bad Code - Rewrite It**: Most comments are a sign of failure to express ourselves in code.
 - **Explain Yourself in Code**: 
   ```python
   # Check if employee is eligible for full benefits