@moon791017/neo-skills 1.1.32 → 1.2.0

package/README.md

@@ -39,8 +39,6 @@
 | :--- | :--- | :--- |
 | Agent 治理 | `neo-harness` | 自動掃描專案環境，產生或更新專案專用的 AGENTS.md，並整合 Harness 評估、Workflow 與編排架構。 |
 | Agent 治理 | `neo-harness-project` | 盤點目前專案並依證據建立完整 Harness 知識、計畫、驗證與工程治理資產。 |
-| 資訊安全 | `neo-iso-27001` | 依 ISO/IEC 27001 進行 ISMS 範圍、風險、證據、差距分析、稽核準備與改善計畫。 |
-| 隱私管理 | `neo-iso-27701` | 依 ISO/IEC 27701 進行 PIMS、PII 角色、處理活動、隱私風險、證據與稽核準備。 |
 | DevOps | `neo-azure-pipelines` | 建立、審查、除錯或現代化 Azure Pipelines YAML，尤其是 .NET build、Azure App Service 或 IIS 部署。 |
 | 需求釐清 | `neo-clarification` | 將模糊、情緒化、片段式或截圖式需求整理成規格、驗收條件和待釐清問題。 |
 | Code Review | `neo-code-review` | 檢查程式碼、PR/diff、bug 風險、安全性、效能與可維護性。 |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moon791017/neo-skills",
-  "version": "1.1.32",
+  "version": "1.2.0",
   "type": "module",
   "description": "Neo Skills: A Universal AI Agent Skills Extension",
   "homepage": "https://neo-blog-iota.vercel.app/",

package/skills/neo-azure-pipelines/SKILL.md

@@ -5,9 +5,9 @@ description: >
   Pipelines YAML for CI/CD, especially .NET builds, Azure App Service deploys, or
   IIS/on-premises deploys. Prefer bundled templates and verify task syntax against
   Microsoft docs when version-specific accuracy matters.
-compatibility: "Supports .NET 6.0 up to .NET 10.0."
+compatibility: "Supports .NET 6.0 up to .NET 11.0."
 metadata:
-  version: "1.0.0"
+  version: "1.1.0"
   category: "DevOps"
 ---
 
@@ -53,7 +53,7 @@ metadata:
 
 ### CI Workflow: .NET Build Pipeline
 When configuring a CI process for a .NET project:
-1. Scan the project directory to identify the .NET version (e.g., .NET 6/8), project name, and solution file (`.sln`).
+1. Scan the project directory to identify the .NET version (e.g., .NET 8/10/11), project name, and solution file (`.sln`).
 2. Check for any existing pipeline configurations.
 3. Create the `.pipelines/templates/build/` and `.pipelines/templates/util/` directories.
 4. Copy `build/build-dotnet.yml` and `util/clean-artifact.yml` templates to their respective locations.

package/skills/neo-csharp/SKILL.md

@@ -5,9 +5,9 @@ description: >
   projects. Trigger for .cs/.csproj files, C# language-version questions, nullable
   reference types, records, pattern matching, async/cancellation, or version-appropriate
   syntax from C# 10+.
-compatibility: "Supports C# 10 through 14. Adaptive to .NET 6.0, 7.0, 8.0, 9.0, and 10.0 environments."
+compatibility: "Supports C# 10 through 15. Adaptive to .NET 6.0 through 11.0 environments."
 metadata:
-  version: "1.4.0"
+  version: "1.5.0"
   category: "Core"
 ---
 
@@ -27,6 +27,7 @@ metadata:
      - `net8.0`: C# 12 (Primary Constructors, Collection Expressions).
      - `net9.0`: C# 13 (`params` collections, `Lock` object).
      - `net10.0`: C# 14 (Extension members, `field` keyword).
+     - `net11.0`: C# 15 (Union types, closed hierarchies, collection-spread arguments, labeled break/continue, extension indexers, inline unsafe expressions).
 2. **Reason (Planning Phase):**
    - Evaluate the modernization level of the current code to determine the refactoring strategy.
    - In lower version environments (like .NET 6), avoid using higher version syntax (like Primary Constructors), but prioritize using File-scoped namespaces.
@@ -40,7 +41,7 @@ metadata:
    - Check if asynchronous operations correctly handle cancellation tokens (`CancellationToken`).
    - Ensure naming conventions comply with official .NET recommendations.
 
-## Feature Roadmap (C# 10 - 14)
+## Feature Roadmap (C# 10 - 15)
 
 ### C# 10 & 11 (Foundation)
 - **File-scoped Namespaces:** Reduce indentation levels.
@@ -55,12 +56,20 @@ metadata:
 - **`params` Collections:** Method parameters support various collection types.
 - **Implicit Span Conversion:** Handle memory-safe code more naturally.
 
-### C# 14+ (Version-Specific Features)
+### C# 14 (Language Extensions)
 - **Extension Members:** Extension properties, operators, and static members.
 - **`field` Keyword:** Directly access backing fields in property logic.
 - **Null-conditional Assignment:** `target?.Property = value;`.
 - **Scripting:** Support `dotnet run file.cs` for direct execution.
 
+### C# 15 (Advanced Types & Productivity)
+- **Union Types:** `public union Pet(Cat, Dog, Bird);` with exhaustive compiler-checked `switch` expressions without discarding `_`.
+- **Closed Hierarchies:** `public closed record class State;` restricts inheritance strictly within the defining project/assembly for domain safety.
+- **Collection Expression Arguments:** `[with(capacity: values.Length * 2), .. values]` or `[with(StringComparer.OrdinalIgnoreCase), ...]` for inline constructor customization.
+- **Labeled Break & Continue:** Jump out of deeply nested loops directly with `break outer;` and `continue outer;`.
+- **Extension Indexers:** Support `this[int index]` on extended types.
+- **Localized Unsafe Expressions:** Fine-grained `unsafe(...)` expressions for localized pointer operations without marking entire methods unsafe.
+
 ## Coding Standards
 - **Clean Structure:** Prioritize using File-scoped namespaces.
 - **Immutability:** Use `record` for Data Transfer Objects (DTO).
@@ -79,6 +88,7 @@ metadata:
 
 ## Documentation
 ### Official References
+- [What's new in C# 15 (Union types, closed hierarchies)](https://learn.microsoft.com/en-us/dotnet/csharp/whats-new/csharp-15)
 - [What's new in C# 14 (Extension Members, field keyword)](https://learn.microsoft.com/en-us/dotnet/csharp/whats-new/csharp-14)
 - [What's new in C# 13 (params collections, Lock object)](https://learn.microsoft.com/en-us/dotnet/csharp/whats-new/csharp-13)
 - [What's new in C# 12 (Primary Constructors, Collection Expressions)](https://learn.microsoft.com/en-us/dotnet/csharp/whats-new/csharp-12)

package/skills/neo-csharp/reference/anti-patterns.md

@@ -123,6 +123,31 @@ This document lists common mistakes (Anti-Patterns) in C# development and their
   public string Name { get; set => field = value.Trim(); } // Using the field keyword
   ```
 
+### 4.4 Discarding Cases in Union Type Pattern Matching (C# 15+)
+- **Legacy / Bad**:
+  ```csharp
+  // Blindly adding a discard case bypasses compile-time exhaustiveness checking!
+  string desc = pet switch
+  {
+      Cat c => "Cat",
+      _ => "Other" // When a new variant (e.g. Bird) is added to the union, no compiler error will trigger
+  };
+  ```
+- **Modern / Good**:
+  ```csharp
+  // Rely on compiler exhaustiveness enforcement:
+  string desc = pet switch
+  {
+      Cat c => "Cat",
+      Dog d => "Dog",
+      Bird b => "Bird"
+  };
+  ```
+
+### 4.5 Leaking Domain Inheritance Without Closed Hierarchies (C# 15+)
+- **Bad**: Exposing domain state hierarchies publicly without `closed`, allowing external assemblies to inherit and corrupt domain invariants.
+- **Good**: Mark domain state record or class hierarchies as `closed` so only the defining assembly can declare subclasses.
+
 ---
 
 ## 5. Resource Management

package/skills/neo-csharp/reference/patterns.md

@@ -1,6 +1,6 @@
 # Modern C# Patterns Guide
 
-This document introduces recommended development patterns in C# 10 through 14+, aiming to simplify code and improve performance using modern syntax.
+This document introduces recommended development patterns in C# 10 through 15+, aiming to simplify code and improve performance using modern syntax.
 
 ## 1. Architecture and Declaration Patterns
 
@@ -139,4 +139,62 @@ if (input is not null) { ... }
 
 // Use null-coalescing assignment operator
 _logger ??= NullLogger.Instance;
-```
+```
+
+---
+
+## 7. C# 15 Modern Patterns
+
+### 7.1 Union Types for Domain Modeling
+**Recommendation**: Use `union` types to model closed variants without complex inheritance hierarchies, enabling exhaustive pattern matching.
+```csharp
+public record class Cat(string Name);
+public record class Dog(string Name);
+public record class Bird(string Name);
+
+public union Pet(Cat, Dog, Bird);
+
+// Exhaustive switch expression enforced by compiler
+public string DescribePet(Pet pet) => pet switch
+{
+    Cat c => $"Cat named {c.Name}",
+    Dog d => $"Dog named {d.Name}",
+    Bird b => $"Bird named {b.Name}"
+    // No default discard _ needed
+};
+```
+
+### 7.2 Closed Hierarchies for Secure Domain Classes
+**Recommendation**: Use the `closed` modifier on base classes or records to prevent external libraries from subclassing domain states.
+```csharp
+public closed abstract record class OrderStatus;
+public record class Pending() : OrderStatus;
+public record class Shipped(DateTime ShippedAt) : OrderStatus;
+```
+
+### 7.3 Collection Expressions with Arguments
+**Recommendation**: Use `with(...)` at the start of a collection expression to supply constructor arguments such as capacity or comparers inline.
+```csharp
+// Inline capacity
+List<string> items = [with(capacity: initialCount * 2), .. existingItems];
+
+// Inline comparer
+HashSet<string> keywords = [with(StringComparer.OrdinalIgnoreCase), "NET", "C#", "Rust"];
+```
+
+### 7.4 Labeled Break and Continue
+**Recommendation**: In nested loops, use labeled `break` or `continue` to escape directly to the desired level without boolean flags.
+```csharp
+search:
+foreach (var batch in batches)
+{
+    foreach (var item in batch)
+    {
+        if (item.IsTarget)
+        {
+            Process(item);
+            break search;
+        }
+    }
+}
+```

package/skills/neo-csharp-interface-generator/SKILL.md

@@ -5,9 +5,9 @@ description: >
   from an existing class. Trigger for extracting public members, filtering virtual
   or non-public members, enforcing getter-only properties, and safely creating,
   appending, or replacing interface blocks.
-compatibility: "Supports C# 12/13 and .NET 10.0."
+compatibility: "Supports C# 12 through 15 and .NET 10.0/11.0."
 metadata:
-  version: "1.0.0"
+  version: "1.1.0"
   category: "Core"
 ---
 
@@ -19,6 +19,7 @@ metadata:
    - Identify members with the `virtual` keyword.
    - Identify non-`public` members.
 3. **Environment Awareness**: When the user specifies a target file, read the file content to check for the existence of an Interface with the same name.
+4. **Language Constructs Check (C# 15)**: Verify whether the target type is a C# 15 `union` or a standard class/record. Union types represent closed type choices and usually do not require extracting traditional interfaces.
 
 ## Reason
 1. **Interface Generation Logic**:

package/skills/neo-dotnet/SKILL.md

@@ -5,9 +5,9 @@ description: >
   .sln/.csproj files and the exact ASP.NET/EF/C# subdomain is not yet clear. Detect
   the SDK/project shape, run or recommend .NET CLI commands, and route to Minimal
   APIs, Web API, MVC, Tag Helper, EF Core, or C# skills when appropriate.
-compatibility: "Supports .NET 6.0 and above. Requires .NET SDK installed on the local machine."
+compatibility: "Supports .NET 6.0 through .NET 11.0+. Requires .NET SDK installed on the local machine."
 metadata:
-  version: "1.0.0"
+  version: "1.1.0"
   category: "Framework"
 ---
 
@@ -20,28 +20,32 @@ This skill serves as the unified entry point for the .NET development environmen
 
 1. **Environment Detection and Version Validation**
    - Run `dotnet --version` to check the currently installed SDK version.
-   - **Mandatory requirement**: Only **.NET 6 or higher** is supported. If a version lower than .NET 6 is detected, prompt the user to upgrade.
+   - **Mandatory requirement**: Only **.NET 6 or higher** is supported (including .NET 8 LTS, .NET 9, .NET 10 LTS, and .NET 11 STS). If a version lower than .NET 6 is detected, prompt the user to upgrade.
+   - For `net11.0` target frameworks, verify developer environment has the .NET 11 SDK installed.
 
 2. **Execute Appropriate .NET CLI**
    - Provide or execute modern CLI commands based on the detected version and project state.
-   - Examples:
+   - Take advantage of modern tooling improvements:
+     - In .NET 11+, the Native AOT CLI host and MSBuild server significantly reduce invocation latency.
      - Build and run: `dotnet build`, `dotnet run`
-     - Test: `dotnet test`
+     - Test: `dotnet test` (with multi-architecture and cross-platform testing enhancements in .NET 11)
      - Package management: `dotnet add package`, `dotnet tool restore`
 
 3. **Requirement Analysis and Dynamic Skill Routing**
    - Determine the involved domain based on the user's specific problem or project architecture.
    - If the user's task falls into the following specific domains, prepare to use or recommend the corresponding sub-skill:
+     - **`neo-csharp`**: When the requirement involves writing, refactoring, or modernizing C# language code (C# 10 through C# 15, Union Types, pattern matching, async safety).
      - **`neo-dotnet-minimal-apis`**: When the requirement is for lightweight routing development, high-performance microservices, and Controllers are not used.
      - **`neo-dotnet-webapi`**: When the requirement is for traditional RESTful API development following the controller pattern.
      - **`neo-dotnet-mvc`**: When the requirement involves Server-Side Rendering (SSR), Razor views, and ViewModels.
      - **`neo-dotnet-tag-helper`**: When the requirement is for developing custom Razor Tag Helpers using pure C# (without CSHTML), focusing on reusable UI components and logic.
-     - **`neo-dotnet-ef-core`**: When the requirement involves database migrations, Linq query optimization, or model mapping.
+     - **`neo-dotnet-ef-core`**: When the requirement involves database migrations, Linq query optimization, model mapping, or EF Core 11 vector search.
 
 ## Usage Guidelines
-When this skill is triggered, please prioritize checking the SDK environment, then answer the user's .NET-related questions. If the problem is found to belong to one of the four professional domains mentioned above, proactively suggest and prepare to delegate it to the corresponding expert skill for processing.
+When this skill is triggered, please prioritize checking the SDK environment, then answer the user's .NET-related questions. If the problem is found to belong to one of the professional domains mentioned above, proactively suggest and prepare to delegate it to the corresponding expert skill for processing.
 
 ## Documentation
 
 ### Official References
+- [.NET 11 Overview & What's New](https://learn.microsoft.com/en-us/dotnet/core/whats-new/dotnet-11)
 - [.NET CLI Tools Overview](https://learn.microsoft.com/en-us/dotnet/core/tools/)

package/skills/neo-dotnet-ef-core/SKILL.md

@@ -4,9 +4,9 @@ description: >
   Use this skill when the task involves Entity Framework Core models, DbContext,
   migrations, LINQ queries, change tracking, database providers, performance tuning,
   or data access review in .NET projects.
-compatibility: "Supports .NET 6.0 through 10.0 environments. Compatible with SQL Server, PostgreSQL, MySQL, and SQLite."
+compatibility: "Supports .NET 6.0 through 11.0 environments. Compatible with SQL Server, PostgreSQL, MySQL, and SQLite."
 metadata:
-  version: "1.0.0"
+  version: "1.1.0"
   category: "Framework"
 ---
 
@@ -36,7 +36,7 @@ metadata:
    - Validate concurrency conflict handling logic.
    - Ensure all database accesses follow asynchronous patterns.
 
-## Feature Roadmap (.NET 6 - 10)
+## Feature Roadmap (.NET 6 - 11)
 
 ### .NET 6 & 7 (Foundation)
 - **Split Queries**: Solve the Cartesian product problem.
@@ -50,10 +50,16 @@ metadata:
 - **Auto-compiled Queries**: Further optimize the query compilation process.
 - **Complex Types**: Better support for Value Objects.
 
-### .NET 10+ (Version-Specific Features)
+### .NET 10 (Interceptors & AOT)
 - **Advanced Interceptors**: More query lifecycle hooks.
 - **Optimized AOT Support**: AOT pre-compilation optimization for cloud-native environments.
 
+### .NET 11 (Advanced Querying & AI Vector Integration)
+- **Complex Types & JSON Columns in TPT/TPC**: Full modeling support for complex types and JSON columns across Table-Per-Type and Table-Per-Concrete-Type hierarchies.
+- **LINQ Translation Enhancements**: `Queryable.FullJoin` translating directly to SQL `FULL OUTER JOIN`, `NULLIF` translation, and `EF.Functions.JsonPathExists()`.
+- **Approximate Vector Search (SQL Server 2025)**: Native `.VectorSearch().WithApproximate()` leveraging `WITH APPROXIMATE` vector index searches; default SQL Server compatibility level upgraded to 160 (SQL Server 2022+).
+- **Breaking Changes Awareness**: `SqlVector<T>` columns return `null` by default on queries without explicit projection; Cosmos DB synchronous I/O and `__jObject` shadow property removed; generic `CoreTypeMapping<T>` for NativeAOT.
+
 ## Coding Standards
 - **Fluent API Preference**: Prioritize entity configuration classes over Data Annotations.
 - **Async Always**: All I/O operations must be asynchronous.
@@ -72,6 +78,7 @@ metadata:
 
 ## Documentation
 ### Official References
+- [What's new in EF Core 11](https://learn.microsoft.com/en-us/ef/core/what-is-new/ef-core-11.0/whatsnew)
 - [Entity Framework Core Overview](https://learn.microsoft.com/en-us/ef/core/)
 - [Performance Optimization in EF Core](https://learn.microsoft.com/en-us/ef/core/performance/)
 - [Supported Database Providers](https://learn.microsoft.com/en-us/ef/core/providers/)

package/skills/neo-dotnet-ef-core/reference/anti-patterns.md

@@ -49,3 +49,28 @@ This document lists common mistakes in Entity Framework Core development and the
 ### 4.1 Avoid Decoupling the Development Database from Migration Scripts
 - **Problem**: Directly modifying the database schema without creating Migrations.
 - **Good**: Always use `dotnet ef migrations add` to manage schema changes, ensuring team environment consistency.
+
+---
+
+## 5. EF Core 11 Breaking Changes & Anti-Patterns
+
+### 5.1 Expecting Automatic `SqlVector<T>` Loading
+- **Problem**: In EF Core 11, `SqlVector<T>` properties return `null` by default in regular entity queries to prevent dragging multi-megabyte embeddings across the wire.
+- **Bad**:
+  ```csharp
+  var doc = await context.Documents.FindAsync(id);
+  // doc.Embedding will be null in EF Core 11!
+  ```
+- **Good**: Explicitly project the vector property when needed:
+  ```csharp
+  var embedding = await context.Documents
+      .Where(d => d.Id == id)
+      .Select(d => d.Embedding)
+      .FirstOrDefaultAsync();
+  ```
+
+### 5.2 Synchronous Calls in Azure Cosmos DB Provider
+- **Problem**: EF Core 11 completely removed synchronous I/O from the Azure Cosmos DB provider.
+- **Bad**: Calling `.ToList()`, `.FirstOrDefault()`, or `.SaveChanges()` on Cosmos DB context.
+- **Good**: Always use `.ToListAsync()`, `.FirstOrDefaultAsync()`, and `.SaveChangesAsync()`.
+

package/skills/neo-dotnet-ef-core/reference/patterns.md

@@ -1,6 +1,6 @@
 # EF Core Modern Patterns
 
-This document introduces recommended development patterns in the Entity Framework Core domain for .NET 6 to 10+.
+This document introduces recommended development patterns in the Entity Framework Core domain for .NET 6 to 11+.
 
 ## 1. Advanced Query Patterns
 
@@ -51,3 +51,41 @@ await context.Orders
 
 ### 5.1 Extension Types for Computed Properties on Entities
 **Recommendation**: Leverage C# 14's Extension Types to add computed properties to POCO entities without affecting the database schema.
+
+---
+
+## 6. EF Core 11 Modern Patterns
+
+### 6.1 LINQ FullJoin (SQL FULL OUTER JOIN)
+**Recommendation**: Use `Queryable.FullJoin` to express full outer joins directly in LINQ rather than writing complex union queries or raw SQL:
+```csharp
+var query = context.Customers
+    .FullJoin(
+        context.Orders,
+        c => c.Id,
+        o => o.CustomerId,
+        (customer, order) => new { Customer = customer, Order = order });
+```
+
+### 6.2 Approximate Nearest Neighbor Vector Search (SQL Server 2025)
+**Recommendation**: For high-dimensional vector search with vector indexing, use `.WithApproximate()` to trigger SQL Server's approximate search:
+```csharp
+var results = await context.Documents
+    .OrderBy(d => EF.Functions.VectorDistance("cosine", d.Embedding, queryVector))
+    .VectorSearch()
+    .WithApproximate()
+    .Take(5)
+    .Select(d => new { d.Id, d.Title }) // Always explicitly project non-vector fields
+    .ToListAsync();
+```
+
+### 6.3 Complex Types & JSON in TPT/TPC Hierarchies
+**Recommendation**: Model domain value objects as complex types or JSON columns even on polymorphic hierarchies using Table-Per-Type (TPT) or Table-Per-Concrete-Type (TPC):
+```csharp
+public abstract class Payment
+{
+    public int Id { get; set; }
+    public required Money Amount { get; set; } // Complex Type supported in EF Core 11 TPT/TPC
+}
+```
+

package/skills/neo-dotnet-minimal-apis/SKILL.md

@@ -4,9 +4,9 @@ description: >
   Use this skill when building, debugging, refactoring, or reviewing ASP.NET Core
   Minimal APIs, lightweight endpoints, route groups, endpoint filters, typed results,
   OpenAPI metadata, or high-performance .NET API services without controllers.
-compatibility: "Supports .NET 6.0 through 10.0 environments. Requires .NET SDK installed locally."
+compatibility: "Supports .NET 6.0 through 11.0 environments. Requires .NET SDK installed locally."
 metadata:
-  version: "1.0.0"
+  version: "1.1.0"
   category: "Framework"
 ---
 
@@ -36,7 +36,7 @@ metadata:
    - Check whether the generated OpenAPI documentation is complete.
    - Ensure asynchronous operations correctly pass the `CancellationToken`.
 
-## Feature Roadmap (.NET 6 - 10)
+## Feature Roadmap (.NET 6 - 11)
 
 ### .NET 6 & 7 (Foundation)
 - **Minimal Hosting**: Simplified startup process and top-level statements.
@@ -50,10 +50,16 @@ metadata:
 - **HybridCache**: High-performance multi-level caching support.
 - **OpenAPI Improvements**: Better OpenAPI code generation.
 
-### .NET 10+ (Version-Specific Features)
+### .NET 10 (AOT & Middleware)
 - **Native AOT Optimization**: AOT-optimized compilation tailored for Minimal APIs.
 - **Enhanced Middleware Patterns**: New middleware designed for lightweight architectures.
 
+### .NET 11+ (Version-Specific Features)
+- **Asynchronous Validation Support**: Native async validation rules across Minimal API endpoints and parameter binding, awaiting validation logic seamlessly.
+- **OpenAPI 3.2 by Default**: Updated default specification to OpenAPI 3.2, with support for `OpenApiGenerationEnvironment` in build-time generation.
+- **Zstandard (zstd) Compression**: Native high-ratio, low-latency compression provider for response compression and request decompression.
+- **Runtime Async Performance**: Reduced task state machine allocations and cleaner async stack traces across endpoint handlers.
+
 ## Coding Standards
 - **Clean Routing**: Prioritize using extension methods to modularize routes.
 - **Strong Typing**: Prioritize using `TypedResults` and `Results<T1, T2>`.
@@ -72,6 +78,7 @@ metadata:
 
 ## Documentation
 ### Official References
+- [What's new in ASP.NET Core in .NET 11](https://learn.microsoft.com/en-us/aspnet/core/release-notes/aspnetcore-11.0)
 - [Minimal APIs Overview](https://learn.microsoft.com/en-us/aspnet/core/fundamentals/minimal-apis)
 - [Route groups and filters](https://learn.microsoft.com/en-us/aspnet/core/fundamentals/minimal-apis/route-handlers)
 - [Typed responses in Minimal APIs](https://learn.microsoft.com/en-us/aspnet/core/fundamentals/minimal-apis/responses)

package/skills/neo-dotnet-minimal-apis/reference/patterns.md

@@ -1,6 +1,6 @@
 # .NET Minimal APIs Modern Patterns
 
-This document introduces recommended development patterns in the Minimal APIs domain for .NET 6 to 10+.
+This document introduces recommended development patterns in the Minimal APIs domain for .NET 6 to 11+.
 
 ## 1. Architectural Patterns
 
@@ -66,3 +66,51 @@ app.MapGet("/users", () => ...)
 ```csharp
 app.MapGet("/health", static () => "Healthy");
 ```
+
+---
+
+## 5. .NET 11 Modern Patterns
+
+### 5.1 Asynchronous Endpoint Validation
+**Recommendation**: In .NET 11, leverage native async validation directly in endpoint filters or validation pipelines to perform async service lookups without blocking threads.
+```csharp
+app.MapPost("/users", async (UserCreateDto dto, IUserService userService) =>
+{
+    // Native async validation flows through EndpointFilter cleanly
+    return TypedResults.Created($"/users/{dto.Username}");
+}).AddEndpointFilter(async (invocationContext, next) =>
+{
+    var dto = invocationContext.GetArgument<UserCreateDto>(0);
+    var userService = invocationContext.HttpContext.RequestServices.GetRequiredService<IUserService>();
+    if (await userService.ExistsAsync(dto.Username))
+    {
+        return TypedResults.Conflict("Username already taken.");
+    }
+    return await next(invocationContext);
+});
+```
+
+### 5.2 Zstandard (zstd) HTTP Response Compression
+**Recommendation**: Register Zstandard response compression provider in `Program.cs` to achieve higher compression ratios and faster streaming for high-throughput Minimal APIs.
+```csharp
+builder.Services.AddResponseCompression(options =>
+{
+    options.EnableForHttps = true;
+    options.Providers.Add<ZstandardCompressionProvider>();
+});
+```
+
+### 5.3 OpenAPI 3.2 Environment Transformers
+**Recommendation**: Utilize OpenAPI 3.2 default generation and environment transformers to separate development and production schemas.
+```csharp
+builder.Services.AddOpenApi(options =>
+{
+    // OpenAPI 3.2 is default in .NET 11
+    options.AddDocumentTransformer((document, context, cancellationToken) =>
+    {
+        document.Info.Description = $"Generated for {builder.Environment.EnvironmentName}";
+        return Task.CompletedTask;
+    });
+});
+```
+

package/skills/neo-dotnet-mvc/SKILL.md

@@ -4,9 +4,9 @@ description: >
   Use this skill when building, debugging, refactoring, or reviewing ASP.NET Core
   MVC apps with Razor views, controllers, ViewModels, validation, Tag Helpers,
   View Components, layouts, or server-rendered workflows.
-compatibility: "Supports .NET 6.0 through 10.0 environments. Requires .NET SDK installed locally."
+compatibility: "Supports .NET 6.0 through 11.0 environments. Requires .NET SDK installed locally."
 metadata:
-  version: "1.0.0"
+  version: "1.1.0"
   category: "Framework"
 ---
 
@@ -36,7 +36,7 @@ metadata:
    - Check whether model validation correctly operates on both the frontend and backend.
    - Ensure Antiforgery tokens are correctly applied to all state-modifying requests.
 
-## Feature Roadmap (.NET 6 - 10)
+## Feature Roadmap (.NET 6 - 11)
 
 ### .NET 6 & 7 (Foundation)
 - **Tag Helpers**: Declarative HTML attribute extensions.
@@ -50,10 +50,16 @@ metadata:
 - **Keyed Services in Controllers**: Finer-grained dependency injection support.
 - **Native AOT for MVC**: Metadata compilation optimization tailored for AOT.
 
-### .NET 10+ (Version-Specific Features)
+### .NET 10 (Extensions & Serialization)
 - **Extension Members for IHtmlHelper**: Extending view helper functions.
 - **Advanced Serialization in Views**: Performance optimization for large view models.
 
+### .NET 11+ (Version-Specific Features)
+- **Zstandard (zstd) Compression for SSR**: High-efficiency compression for server-rendered HTML payloads and static assets.
+- **Asynchronous Form Validation**: Extended async validation coordination for complex input pipelines.
+- **Agentic UI & Blazor Component Integration**: Native AG-UI / Blazor AI components in hybrid MVC apps, with `TempData` support in static SSR.
+- **Runtime Async Performance**: Reduced async allocation and cleaner execution traces in Razor view generation.
+
 ## Coding Standards
 - **Strongly Typed Views**: All views must have an explicit `@model`.
 - **ViewModel Separation**: Strictly prohibit exposing database entities directly to views.
@@ -72,6 +78,7 @@ metadata:
 
 ## Documentation
 ### Official References
+- [What's new in ASP.NET Core in .NET 11](https://learn.microsoft.com/en-us/aspnet/core/release-notes/aspnetcore-11.0)
 - [Overview of ASP.NET Core MVC](https://learn.microsoft.com/en-us/aspnet/core/mvc/overview)
 - [Tag Helpers in ASP.NET Core](https://learn.microsoft.com/en-us/aspnet/core/mvc/views/tag-helpers/intro)
 - [View components in ASP.NET Core](https://learn.microsoft.com/en-us/aspnet/core/mvc/views/view-components)

package/skills/neo-dotnet-mvc/reference/patterns.md

@@ -1,6 +1,6 @@
 # .NET MVC Modern Patterns
 
-This document introduces recommended development patterns in the ASP.NET Core MVC mode for .NET 6 to 10+.
+This document introduces recommended development patterns in the ASP.NET Core MVC mode for .NET 6 to 11+.
 
 ## 1. UI Modularization
 
@@ -54,3 +54,40 @@ public class ShoppingCartViewComponent : ViewComponent
 
 ### 5.1 Extension Types for IHtmlHelper
 **Recommendation**: Leverage C# 14's Extension Types to add domain-specific rendering methods to `IHtmlHelper`, not just static extension methods.
+
+---
+
+## 6. .NET 11 Modern Patterns
+
+### 6.1 Zstandard (zstd) Compression for Server-Side Rendering
+**Recommendation**: Enable Zstandard compression provider to dramatically accelerate the transmission of large HTML DOM trees rendered by Razor views:
+```csharp
+builder.Services.AddResponseCompression(options =>
+{
+    options.EnableForHttps = true;
+    options.Providers.Add<ZstandardCompressionProvider>();
+});
+```
+
+### 6.2 Asynchronous Validation in MVC Forms
+**Recommendation**: Coordinate async form validation rules with ViewModels to perform async verification (e.g. database uniqueness checks) before committing form transactions:
+```csharp
+[HttpPost]
+[ValidateAntiForgeryToken]
+public async Task<IActionResult> RegisterAsync(RegisterViewModel model, IUserService userService)
+{
+    if (await userService.IsEmailTakenAsync(model.Email))
+    {
+        ModelState.AddModelError(nameof(model.Email), "Email is already registered.");
+    }
+
+    if (!ModelState.IsValid)
+    {
+        return View(model);
+    }
+
+    await userService.CreateUserAsync(model);
+    return RedirectToAction(nameof(Index));
+}
+```
+

package/skills/neo-dotnet-tag-helper/SKILL.md

@@ -4,9 +4,9 @@ description: >
   Use this skill when the user asks to design, implement, refactor, or review custom
   ASP.NET Core Tag Helpers in C#, including TagBuilder usage, strongly typed attributes,
   dependency injection, ProcessAsync, and reusable Razor UI behavior.
-compatibility: "Supports .NET 6.0 through 10.0+ environments."
+compatibility: "Supports .NET 6.0 through 11.0+ environments."
 metadata:
-  version: "1.0.0"
+  version: "1.1.0"
   category: "Framework"
   pattern: generator
   output-format: csharp

package/skills/neo-dotnet-webapi/SKILL.md

@@ -4,9 +4,9 @@ description: >
   Use this skill when building, debugging, refactoring, or reviewing controller-based
   ASP.NET Core Web APIs, including ControllerBase, ActionResult<T>, Problem Details,
   API versioning, global exception handling, DTOs, and OpenAPI behavior.
-compatibility: "Supports .NET 6.0 through 10.0 environments. Requires .NET SDK installed locally."
+compatibility: "Supports .NET 6.0 through 11.0 environments. Requires .NET SDK installed locally."
 metadata:
-  version: "1.0.0"
+  version: "1.1.0"
   category: "Framework"
 ---
 
@@ -36,7 +36,7 @@ metadata:
    - Check NRT (Nullable Reference Types) safety.
    - Ensure asynchronous operations correctly pass down `CancellationToken`.
 
-## Feature Roadmap (.NET 6 - 10)
+## Feature Roadmap (.NET 6 - 11)
 
 ### .NET 6 & 7 (Foundation)
 - **Controllers Architecture**: Traditional controller patterns and attribute routing.
@@ -50,10 +50,16 @@ metadata:
 - **Keyed Services**: More flexible dependency injection options.
 - **HybridCache**: Multi-level caching optimization.
 
-### .NET 10+ (Version-Specific Features)
+### .NET 10 (Extensions & Serialization)
 - **Extension Members for Controllers**: Extending base controller functionality.
 - **Enhanced Serialization**: JSON optimization for large payloads.
 
+### .NET 11+ (Version-Specific Features)
+- **OpenAPI 3.2 Specification by Default**: Upgraded documentation standards with enhanced schema generation.
+- **Zstandard (zstd) Compression**: Native high-speed, high-ratio compression via `ZstandardCompressionProviderOptions`.
+- **TLS Channel Binding for Negotiate Authentication**: Enhanced transport security for Kerberos / NTLM multi-round auth.
+- **Runtime Async Controller Execution**: Reduced Task allocation overhead and cleaner stack traces during controller action execution.
+
 ## Coding Standards
 - **Strong Typing**: Prioritize `ActionResult<T>` to improve Swagger support.
 - **NRT Compliance**: Strictly enforce Null safety to reduce runtime errors.
@@ -72,6 +78,7 @@ metadata:
 
 ## Documentation
 ### Official References
+- [What's new in ASP.NET Core in .NET 11](https://learn.microsoft.com/en-us/aspnet/core/release-notes/aspnetcore-11.0)
 - [ASP.NET Core Web API Overview](https://learn.microsoft.com/en-us/aspnet/core/web-api/)
 - [Handle errors in ASP.NET Core web APIs (Problem Details)](https://learn.microsoft.com/en-us/aspnet/core/web-api/handle-errors)
 - [Controller action return types in ASP.NET Core web API](https://learn.microsoft.com/en-us/aspnet/core/web-api/action-return-types)

package/skills/neo-dotnet-webapi/reference/patterns.md

@@ -1,6 +1,6 @@
 # .NET Web API Modern Patterns
 
-This document introduces recommended development patterns in the Controller-based mode for .NET 6 to 10+.
+This document introduces recommended development patterns in the Controller-based mode for .NET 6 to 11+.
 
 ## 1. Error Handling and Response Formats
 
@@ -50,3 +50,38 @@ This document introduces recommended development patterns in the Controller-base
 
 ### 5.1 Extension Types for Controllers
 **Recommendation**: Leverage Extension Types to expand common auxiliary properties or methods for the base `ControllerBase`.
+
+---
+
+## 6. .NET 11 Modern Patterns
+
+### 6.1 Zstandard (zstd) Response Compression for Controllers
+**Recommendation**: Configure Zstandard compression options to reduce payload size on heavy JSON responses from API controllers:
+```csharp
+builder.Services.AddResponseCompression(options =>
+{
+    options.EnableForHttps = true;
+    options.Providers.Add<ZstandardCompressionProvider>();
+});
+builder.Services.Configure<ZstandardCompressionProviderOptions>(options =>
+{
+    options.Level = System.IO.Compression.CompressionLevel.Fastest;
+});
+```
+
+### 6.2 OpenAPI 3.2 Specification Integration
+**Recommendation**: Target OpenAPI 3.2 metadata in API controllers to provide richer schema details for downstream clients and agentic tools:
+```csharp
+[ApiController]
+[Route("api/[controller]")]
+[Produces("application/json")]
+public class CatalogController : ControllerBase
+{
+    [HttpGet("{id:int}")]
+    [EndpointSummary("Retrieve item by unique identifier")]
+    [ProducesResponseType(typeof(ItemDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<ItemDto>> GetItemAsync(int id, CancellationToken ct) => ...;
+}
+```
+

package/skills/neo-harness-project/SKILL.md

@@ -98,7 +98,7 @@ metadata:
 - 只修改預覽列出的已確認路徑；搬遷時來源、目的地與連結更新都必須列在確認清單中。
 - `rebuild` 必須保留仍正確的專案事實，並可從版本控制或已報告的暫存快照復原。
 - `migrate` 只能在確認後執行；先完成內容與連結的核對，再移除來源路徑，且不得覆寫既有目的地。
-- 空的執行計畫目錄以最小追蹤檔保存，不填入虛構計畫。
+- `.neo_harness/docs/exec-plans/active/` 與 `completed/` 都必須包含 `.GITKEEP`，不新增 `README.md`；空目錄只以 `.GITKEEP` 追蹤，不填入虛構計畫。
 - 新建立的執行計畫檔名必須使用 `YYYYMMDDHHmmss_<原計畫檔名>.md`；時間戳取建立當下執行環境的本地時間，從 `active` 移至 `completed` 時保留原時間戳。既有計畫搬遷至 `.neo_harness/` 時保留原檔名與時間戳。
 - 既有未加時間戳的計畫不批次改名；更新既有計畫時沿用原檔名。
 - `.neo_harness/docs/scripts.md` 必須只含 `指令`、`用途` 兩欄的 Markdown table，收錄專案設定或文件可驗證的所有命令；沒有可驗證命令時只保留空表頭。

package/skills/neo-harness-project/references/artifact-selection.md

@@ -10,8 +10,8 @@
 | `.neo_harness/docs/scripts.md` | 保存專案所有已驗證命令及用途 | 一律評估；不存在時建立，存在時保留有效內容並補齊已驗證命令 |
 | `.neo_harness/ARCHITECTURE.md` | 記錄目前元件、責任、依賴方向、邊界與可執行約束 | 一律評估；未知架構明確標示，不畫理想架構 |
 | `.neo_harness/PLANS.md` | 定義何時使用持久計畫、必要章節及生命週期 | 一律評估；沿用專案既有計畫命名時同步調整連結 |
-| `.neo_harness/docs/exec-plans/active/` | 保存進行中且可由新工作階段接續的計畫 | 沒有現行計畫時只建立最小追蹤檔 |
-| `.neo_harness/docs/exec-plans/completed/` | 保存完成結果、決策與驗證證據 | 沒有完成計畫時只建立最小追蹤檔 |
+| `.neo_harness/docs/exec-plans/active/` | 保存進行中且可由新工作階段接續的計畫 | 必須包含 `.GITKEEP`；沒有現行計畫時以此檔案追蹤目錄，不新增 `README.md` |
+| `.neo_harness/docs/exec-plans/completed/` | 保存完成結果、決策與驗證證據 | 必須包含 `.GITKEEP`；沒有完成計畫時以此檔案追蹤目錄，不新增 `README.md` |
 
 根目錄 `AGENTS.md` 是唯一入口；不得建立 `.neo_harness/AGENTS.md`。專案已有等價且廣泛引用的舊路徑時，先列入搬遷預覽，不另建第二套真相來源。
 

package/skills/neo-harness-project/references/generation-validation.md

@@ -32,7 +32,7 @@
 
 - 定義需要持久計畫的門檻，例如多階段、跨模組、遷移、陌生領域或可能跨工作階段的任務。
 - 每份計畫必須自包含；讀者只需目前工作樹與計畫本身，不得依賴先前對話或未連結的外部資訊。
-- 計畫目錄固定為 `.neo_harness/docs/exec-plans/active/` 與 `.neo_harness/docs/exec-plans/completed/`。
+- 計畫目錄固定為 `.neo_harness/docs/exec-plans/active/` 與 `.neo_harness/docs/exec-plans/completed/`；兩個目錄都必須包含 `.GITKEEP`，且不新增 `README.md`。
 - 新建立的計畫檔名使用 `YYYYMMDDHHmmss_<原計畫檔名>.md`；時間戳取本地時間，從 `active` 移至 `completed` 時沿用。
 - 既有未加時間戳的計畫不批次改名；更新既有計畫時維持原檔名與既有連結。
 - 從舊路徑搬遷既有計畫時保留原檔名與時間戳，不因搬遷而重新命名。

package/skills/neo-iso-27001/SKILL.md

@@ -1,92 +0,0 @@
----
-name: neo-iso-27001
-description: >
-  Use this skill when the user needs to establish, review, or improve an ISO/IEC 27001 ISMS,
-  perform information security risk discovery, define scope, create an evidence matrix,
-  conduct a gap analysis, draft a Statement of Applicability, prepare for an internal audit,
-  or create an improvement plan. Use neo-iso-27701 when the main concern is PII, privacy
-  management, or PIMS. Do not use this skill for legal advice or certification guarantees.
-license: MIT
-compatibility: Requires an Agent Skills client with Markdown and file-reading support; network access for current-version checks; and user-provided licensed documents for precise clause-level analysis.
-metadata:
-  version: "1.0.0"
-  pattern: "tool-wrapper,pipeline,reviewer"
-  domain: "information-security-management"
-  source-snapshot: "2026-08-12"
----
-
-# Neo ISO/IEC 27001
-
-Provide evidence-based assistance for establishing, improving, or reviewing an information
-security management system (ISMS). Read `references/sources-and-scope.md` first, then follow
-the workflow below.
-
-## Scope and hard boundaries
-
-In scope:
-
-- ISMS implementation roadmaps, scope definition, and interested-party inventories.
-- Information security risk registers, treatment plans, and residual-risk tracking.
-- Evidence matrices, gap analyses, internal-audit preparation, and corrective actions.
-- Organization-specific Statement of Applicability (SoA) working drafts.
-
-Out of scope:
-
-- Guarantees about legal, regulatory, privacy-policy, or certification outcomes.
-- Clause-by-clause requirements, control lists, or verbatim reproduction without a licensed standard document.
-- Direct deployment of technical controls unless the user separately provides the technical requirements and authorized scope.
-
-## Version gate
-
-1. Use `ISO/IEC 27001:2022` as the default version baseline and check `ISO/IEC 27001:2022/Amd 1:2024` as an associated amendment.
-2. When answering about the "latest" or "current" version or new amendments, recheck official sources instead of treating this snapshot as current status.
-3. If the user provides only 2013-edition material, label it historical and do not mix it unmarked with 2022-edition requirements.
-4. Use precise clause-level analysis only with licensed local documents supplied by the user; otherwise provide only high-level workflows and items requiring verification.
-
-## Evidence-driven workflow
-
-Execute these steps in order. Do not invent organizational facts when evidence is missing:
-
-1. **Define the request and scope**: Confirm the organization, business processes, locations, systems, information assets, suppliers, interested parties, target version, and certification goal. Ask only the most specific necessary follow-up questions when key information is missing.
-2. **Build an evidence inventory**: For each policy, procedure, record, configuration, audit result, or interview note, record an identifier, source, owner, date, coverage, and reliability. Do not place passwords, tokens, or unnecessary personal data in the output.
-3. **Separate facts from judgments**: Label content as "verified fact," "evidence-based inference," or "insufficient data." Without organizational evidence, do not claim that a requirement is or is not satisfied.
-4. **Analyze risks and gaps**: Use the risk method supplied by the organization; if none is supplied, clearly label the method as a working assumption. Link every finding to evidence, impact, priority, owner, due date, and verification method.
-5. **Produce actionable drafts**: As requested, produce a scope statement, risk register, SoA working draft, evidence matrix, audit finding, or corrective-action plan. Mark every working draft with its version and approval status.
-6. **Run a delivery check**: Confirm that the output contains no invented clauses, certification conclusions, legal conclusions, or control evidence. Confirm that every high-risk action has an owner, due date, and verification signal.
-
-## Work-product format
-
-Unless the user requests a single fact, use this structure for assessments and reviews:
-
-```markdown
-## Conclusion
-## Applicable scope and version
-## Verified evidence
-## Risks and gaps
-## Improvement and corrective-action plan
-## Missing information and limitations
-## Sources and verification date
-```
-
-Each finding must include at least an identifier, evidence, problem, impact, priority, recommended action, owner, due date, and verification method. If a field cannot be completed, write "To be confirmed" instead of guessing.
-
-## Worksheet fields
-
-- **Scope table**: Organization, processes, locations, systems, information assets, exclusions, exclusion rationale, approver, and version.
-- **Risk register**: Risk identifier, scenario, asset or process, existing measures, risk method, treatment option, owner, due date, residual risk, and evidence.
-- **SoA working draft**: Requirement or control identifier, applicability status, organizational rationale, implementation evidence, owner, review date, referenced version, and approval status. Do not invent identifiers without a licensed standard.
-- **Evidence matrix**: Criteria source, evidence identifier, evidence owner, coverage period, evidence status, gap, remediation action, and verification method.
-
-## Routing to neo-iso-27701
-
-- Use `neo-iso-27701` when the main issue is PII processing, privacy responsibility, PIMS, or privacy evidence.
-- When information security and privacy are both in scope, complete the analyses separately and integrate them with explicit cross-references. Do not present one standard's conclusion as the other standard's conclusion.
-- The independent management-system status of 27701 does not mean that the organization has necessarily established 27001; verify the actual scope and evidence first.
-
-## Common pitfalls
-
-- Do not mix 2022-edition and 2013-edition documents, risk methods, or control mappings without labeling them.
-- An SoA is an organizational scope and risk-decision work product; do not infer it solely from a technology stack or industry name.
-- Implementing an ISMS, preparing for an audit, and obtaining third-party certification are different states; describe them separately.
-- Having a policy does not equal having effective evidence; check execution records, owners, coverage periods, and sampling results.
-- Every conclusion about the latest version must include a verification date and source; if network access is unavailable, state that current status cannot be confirmed.

package/skills/neo-iso-27001/evals/eval_queries.json

@@ -1,86 +0,0 @@
-[
-  {
-    "query": "Using ISO/IEC 27001:2022, inventory our current policies, risk register, and audit records and produce a gap analysis.",
-    "should_trigger": true
-  },
-  {
-    "query": "We need to establish an ISMS. Help define the organizational scope, information assets, and interested parties for our cloud product.",
-    "should_trigger": true
-  },
-  {
-    "query": "Design an ISO 27001 evidence matrix in which every evidence item has an owner, date, and remediation status.",
-    "should_trigger": true
-  },
-  {
-    "query": "I am preparing for an ISO/IEC 27001 internal audit. Give me a working format for findings and corrective actions.",
-    "should_trigger": true
-  },
-  {
-    "query": "Which ISO 27001 version should we check now? Verify the 2022 edition and the 2024 amendment.",
-    "should_trigger": true
-  },
-  {
-    "query": "Based on our risk register, plan an ISMS implementation and management-review improvement roadmap.",
-    "should_trigger": true
-  },
-  {
-    "query": "Review this SoA draft and identify items without a rationale, owner, or implementation evidence.",
-    "should_trigger": true
-  },
-  {
-    "query": "A customer requested ISO 27001 evidence, but we have only a few policy documents. Explain which verifiable evidence is still missing.",
-    "should_trigger": true
-  },
-  {
-    "query": "Compare the gaps between our current ISMS and the target certification scope, and classify recommendations as high, medium, or low priority.",
-    "should_trigger": true
-  },
-  {
-    "query": "We also process personal data. Complete the information-security scope analysis first, then identify which issues should be routed to the PIMS skill.",
-    "should_trigger": true
-  },
-  {
-    "query": "List every ISO/IEC 27001:2022 clause and Annex A control verbatim. I have not provided the official standard document.",
-    "should_trigger": true
-  },
-  {
-    "query": "Write an ASP.NET Core middleware that encrypts every API response.",
-    "should_trigger": false
-  },
-  {
-    "query": "Write a vulnerability scanner in Python to scan our Kubernetes cluster.",
-    "should_trigger": false
-  },
-  {
-    "query": "Explain the PIMS and processor responsibilities in ISO/IEC 27701.",
-    "should_trigger": false
-  },
-  {
-    "query": "Help me create an audit plan for an ISO 9001 quality management system.",
-    "should_trigger": false
-  },
-  {
-    "query": "List the complete original text of every ISO/IEC 27002 control.",
-    "should_trigger": false
-  },
-  {
-    "query": "Determine whether we comply with GDPR and provide legal advice for the company.",
-    "should_trigger": false
-  },
-  {
-    "query": "Compare the current prices and discounts of three cloud providers.",
-    "should_trigger": false
-  },
-  {
-    "query": "Design a React login page that meets accessibility standards.",
-    "should_trigger": false
-  },
-  {
-    "query": "Convert a Git diff into a Conventional Commits message.",
-    "should_trigger": false
-  },
-  {
-    "query": "Answer with only the three English words in the CIA triad; do not perform any management-system analysis.",
-    "should_trigger": false
-  }
-]

package/skills/neo-iso-27001/evals/evals.json

@@ -1,38 +0,0 @@
-{
-  "skill_name": "neo-iso-27001",
-  "evals": [
-    {
-      "id": 1,
-      "prompt": "We are a 40-person SaaS company whose scope includes product, support, and cloud operations. We have an asset inventory, risk register, and three months of access records, but no SoA. Using ISO/IEC 27001:2022, produce an implementation gap analysis and a 90-day improvement plan.",
-      "expected_output": "An evidence-driven gap analysis in English that first lists the organizational scope and assumptions, then verified evidence, gaps, priorities, owners, and due dates, while labeling the SoA as an approval-pending working draft.",
-      "assertions": [
-        "The output contains sections for organizational scope, evidence, gaps, and an improvement plan",
-        "Each major action includes an owner, due date, and verification method, or is explicitly marked to be confirmed",
-        "The output does not claim that the company has obtained or will necessarily obtain certification",
-        "Unavailable SoA content is labeled as a working draft or insufficient data"
-      ]
-    },
-    {
-      "id": 2,
-      "prompt": "What is the current ISO 27001 baseline? Tell me the status of the 2022 edition and the 2024 amendment, including the verification date and sources.",
-      "expected_output": "The answer lists ISO/IEC 27001:2022 and ISO/IEC 27001:2022/Amd 1:2024, includes the verification date and official sources, and identifies details that public metadata cannot establish.",
-      "assertions": [
-        "The answer mentions ISO/IEC 27001:2022",
-        "The answer mentions ISO/IEC 27001:2022/Amd 1:2024",
-        "The answer includes official source links and a verification date",
-        "The answer does not reproduce standard clauses or a complete control catalogue"
-      ]
-    },
-    {
-      "id": 3,
-      "prompt": "List every ISO/IEC 27001:2022 clause and Annex A control and tell me which ones are definitely applicable. I have not provided the official standard document.",
-      "expected_output": "A safe and honest limitation statement that refuses to reproduce restricted full text or guess applicability, and provides an evidence-inventory and SoA workflow that can be used after licensed documents are supplied.",
-      "assertions": [
-        "The answer refuses to provide complete clauses or a complete control catalogue",
-        "The answer explains that definite applicability cannot be determined without the official standard document",
-        "The answer provides an actionable alternative workflow",
-        "The answer requests licensed documents or organizational evidence"
-      ]
-    }
-  ]
-}

package/skills/neo-iso-27001/references/sources-and-scope.md

@@ -1,23 +0,0 @@
-# ISO/IEC 27001 Sources and Scope
-
-## Version snapshot
-
-- Baseline document: `ISO/IEC 27001:2022`, Edition 3, published in 2022-10.
-- Amendment: `ISO/IEC 27001:2022/Amd 1:2024`, published in 2024-02, titled Climate action changes.
-- Snapshot verification date: 2026-08-12.
-- The 2013 edition is historical material only in this skill and is not the current baseline.
-
-## Sources to verify
-
-- [ISO/IEC 27001:2022 official page](https://www.iso.org/standard/27001)
-- [ISO/IEC 27001:2022/Amd 1:2024 official page](https://www.iso.org/standard/88435.html)
-- [ISO Open Data](https://www.iso.org/open-data.html)
-- [ODC-By 1.0 license for ISO Deliverables Metadata](https://opendatacommons.org/licenses/by/1-0/)
-
-## Usage rules
-
-1. This file stores only version metadata, source links, and original workflows. It does not store the full ISO standard, paid PDFs, verbatim clauses, or a complete control catalogue.
-2. Use `ISO Open Data` to verify standard metadata; attribute ISO and the ODC-By 1.0 license when using it.
-3. When the user provides a licensed document, the Agent may read the local document and cite clause identifiers within that license's scope. Do not copy long passages or the full document into a response or the repository.
-4. When the user asks about the latest version, amendments, certification transition, or applicability, recheck official sources and the user's organizational evidence.
-5. Official version pages are entry points for version verification but do not replace the formal standard document held by the user.

package/skills/neo-iso-27701/SKILL.md

@@ -1,99 +0,0 @@
----
-name: neo-iso-27701
-description: >
-  Use this skill when the user needs to establish, review, or improve an ISO/IEC 27701 PIMS,
-  inventory PII processing, analyze controller and processor responsibilities, create a privacy
-  risk or evidence matrix, conduct a gap analysis, prepare for an audit, or create an improvement
-  plan. Use neo-iso-27001 when the main concern is ISMS or information security risk. Do not treat
-  PIMS as a legal-compliance guarantee for any specific privacy law.
-license: MIT
-compatibility: Requires an Agent Skills client with Markdown and file-reading support; network access for current-version and regulatory checks; and user-provided licensed documents for precise clause-level analysis.
-metadata:
-  version: "1.0.0"
-  pattern: "tool-wrapper,pipeline,reviewer"
-  domain: "privacy-information-management"
-  source-snapshot: "2026-08-12"
----
-
-# Neo ISO/IEC 27701
-
-Provide evidence-based assistance for establishing, improving, or reviewing a privacy information
-management system (PIMS). Read `references/sources-and-scope.md` first, then follow the workflow
-below.
-
-## Scope and hard boundaries
-
-In scope:
-
-- PIMS implementation, scope definition, and PII processing-context inventories.
-- Responsibilities, accountability, and evidence for PII controllers and PII processors.
-- Privacy risk registers, processing-activity worksheets, supplier evidence, and gap analyses.
-- Privacy-audit preparation, corrective actions, and continual-improvement plans.
-
-Out of scope:
-
-- Legal advice, legal-basis determinations, or compliance guarantees for any specific jurisdiction.
-- Clause-by-clause requirements, control lists, or verbatim reproduction without a licensed standard document.
-- Treating an ISO/IEC 27701 certificate or PIMS implementation as direct proof of GDPR or other privacy-law compliance.
-- Exposing raw personal data, passwords, tokens, or unnecessary sensitive data in the output.
-
-## Version gate
-
-1. Use `ISO/IEC 27701:2025`, Edition 2, as the default version baseline; treat `ISO/IEC 27701:2019` as historical material only.
-2. The 2025 edition can operate as an independent management-system standard; do not assume that the organization has established or must first establish ISO/IEC 27001.
-3. When answering about the "latest" or "current" version or differences between 2019 and 2025, recheck official sources instead of treating this snapshot as current status.
-4. Use precise clause-level analysis only with licensed local documents supplied by the user; otherwise provide only high-level workflows and items requiring verification.
-
-## Evidence-driven workflow
-
-Execute these steps in order. Do not invent privacy facts when evidence is missing:
-
-1. **Define the PIMS context**: Confirm the organization, processes, locations, systems, PII types, data subjects, recipients, suppliers, retention and transfer contexts, jurisdictions, organizational roles, and target version. Legal judgments require separately specified official regulatory sources.
-2. **Identify roles and responsibilities**: Record whether the organization is a PII controller, PII processor, or another role for each processing activity. Do not infer a role only from a contract title.
-3. **Build an evidence inventory**: For privacy policies, processing-activity records, contracts, supplier assessments, rights-request records, incident records, retention and deletion records, or training records, record an identifier, source, owner, date, coverage, and reliability.
-4. **Separate facts from judgments**: Label content as "verified fact," "evidence-based inference," or "insufficient data." Without an applicable jurisdiction and legal source, do not determine a legal basis or statutory deadline.
-5. **Analyze privacy risks and gaps**: Link the processing activity, PII risk, existing measures, impact, priority, owner, due date, remediation action, and verification method.
-6. **Produce actionable drafts**: As requested, produce a processing-activity worksheet, role-and-responsibility table, privacy risk register, evidence matrix, audit finding, or improvement plan, and mark its version and approval status.
-7. **Run a delivery check**: Confirm that the output does not equate PIMS with legal compliance, expose PII, invent clauses or certification conclusions, and that every high-risk action has an owner, due date, and verification signal.
-
-## Work-product format
-
-Unless the user requests a single fact, use this structure for assessments and reviews:
-
-```markdown
-## Conclusion
-## PIMS scope, roles, and version
-## Verified evidence
-## Privacy risks and gaps
-## Improvement and corrective-action plan
-## Missing information, jurisdiction questions, and limitations
-## Sources and verification date
-```
-
-Each finding must include at least an identifier, processing activity or evidence, problem, impact, priority, recommended action, owner, due date, and verification method. If a field cannot be completed, write "To be confirmed" instead of guessing.
-
-## Worksheet fields
-
-- **Processing-activity table**: Activity, purpose, PII type, data subject, source, recipient, role, system, supplier, retention and transfer information, evidence identifier, and review date.
-- **Role-and-responsibility table**: Processing activity, organizational role, accountable owner, contract or process evidence, exception, review date, and items to be confirmed.
-- **Privacy risk register**: Risk identifier, processing activity, scenario, impact, existing measures, risk method, treatment option, owner, due date, residual risk, and evidence.
-- **Evidence matrix**: Criteria source, evidence identifier, evidence owner, coverage period, evidence status, gap, remediation action, and verification method.
-
-## Integration with neo-iso-27001
-
-- Use `neo-iso-27001` when the main issue is information security management, information-asset risk, or ISMS.
-- When ISMS and PIMS are both in scope, establish the two scope, risk, and evidence chains separately, then document shared processes and cross-dependencies.
-- Do not assume that the same policy, risk assessment, or evidence automatically satisfies the other standard merely because both are management systems.
-
-## Regulatory routing
-
-- When the user asks about GDPR, a personal-data law, or another regulation, first confirm the jurisdiction, applicable role, processing activity, and regulatory version; then request or find the regulator, legal text, or other authoritative legal source.
-- ISO/IEC 27701 can serve as a working privacy-management framework, but it cannot by itself prove full compliance with a specific law.
-- If the regulatory source, organizational role, or processing purpose is missing, report insufficient data and items to be confirmed instead of inferring a legal conclusion.
-
-## Common pitfalls
-
-- Do not apply the historical extension relationship of the 2019 edition directly to the 2025 edition, and do not describe the 2025 edition as necessarily dependent on 27001.
-- Having a privacy policy does not equal having effective evidence; check execution records, accountable owners, coverage periods, and exception handling.
-- Determine controller and processor roles from concrete processing activities and responsibility evidence, not only from the organization's label or a contract title.
-- Every conclusion about the latest version or a regulation must include a verification date and source; if network access is unavailable, state that current status cannot be confirmed.

package/skills/neo-iso-27701/evals/eval_queries.json

@@ -1,82 +0,0 @@
-[
-  {
-    "query": "Using ISO/IEC 27701, inventory the PII processing activities and controller and processor roles for our SaaS product.",
-    "should_trigger": true
-  },
-  {
-    "query": "We need to establish a PIMS. Produce the fields for a privacy risk register and evidence matrix.",
-    "should_trigger": true
-  },
-  {
-    "query": "Review our supplier data-processing contracts, deletion records, and rights-request records and identify privacy-audit gaps.",
-    "should_trigger": true
-  },
-  {
-    "query": "What is the current version of ISO/IEC 27701? What is the status difference between the 2019 and 2025 editions?",
-    "should_trigger": true
-  },
-  {
-    "query": "Plan a 90-day improvement program that takes the company from PII processing inventory to a PIMS internal audit.",
-    "should_trigger": true
-  },
-  {
-    "query": "We have both an ISMS and a PIMS. Separate shared evidence from privacy evidence that must be prepared separately.",
-    "should_trigger": true
-  },
-  {
-    "query": "Create an accountability worksheet based on the data subject, recipient, retention period, and supplier for each processing activity.",
-    "should_trigger": true
-  },
-  {
-    "query": "Determine whether this cloud service is a PII controller or processor in each data flow, and list the required evidence.",
-    "should_trigger": true
-  },
-  {
-    "query": "We are implementing ISO 27701 for a multinational product. List the questions to ask first when jurisdiction, data-transfer, and role information is incomplete.",
-    "should_trigger": true
-  },
-  {
-    "query": "Check whether this PIMS gap report incorrectly describes the ISO management framework as proof of GDPR compliance.",
-    "should_trigger": true
-  },
-  {
-    "query": "Write a JavaScript function that encrypts a user's name before storing it in a database.",
-    "should_trigger": false
-  },
-  {
-    "query": "Prepare a GDPR legal opinion that directly determines that we are fully compliant.",
-    "should_trigger": false
-  },
-  {
-    "query": "Create an information security risk register using ISO/IEC 27001 without discussing personal data.",
-    "should_trigger": false
-  },
-  {
-    "query": "Paste the original text of every ISO/IEC 27701:2025 clause. I have not purchased the standard.",
-    "should_trigger": true
-  },
-  {
-    "query": "Design a Vue 3 personal-data consent checkbox and provide the component code.",
-    "should_trigger": false
-  },
-  {
-    "query": "Compare the current license prices of Salesforce, HubSpot, and Dynamics.",
-    "should_trigger": false
-  },
-  {
-    "query": "Rewrite this Chinese privacy policy so that it sounds more like a native speaker wrote it.",
-    "should_trigger": false
-  },
-  {
-    "query": "Create a database migration that adds a consented_at column.",
-    "should_trigger": false
-  },
-  {
-    "query": "Turn the audit findings into Conventional Commits.",
-    "should_trigger": false
-  },
-  {
-    "query": "Explain only the English abbreviation PII; do not perform PIMS or privacy-management analysis.",
-    "should_trigger": false
-  }
-]

package/skills/neo-iso-27701/evals/evals.json

@@ -1,38 +0,0 @@
-{
-  "skill_name": "neo-iso-27701",
-  "evals": [
-    {
-      "id": 1,
-      "prompt": "We provide a customer-support SaaS service. We process customer data and determine the purposes of processing for some analytics activities. Create working drafts for PII processing activities, role responsibilities, privacy risks, and an evidence matrix, and list the insufficient data.",
-      "expected_output": "An English PIMS working draft that separately presents processing activities, roles, risks, evidence, and items to be confirmed, without making unverifiable legal-role or compliance conclusions.",
-      "assertions": [
-        "The output distinguishes processing activities, role responsibilities, privacy risks, and evidence",
-        "The output does not infer a role only from the company name or contract title",
-        "The output includes insufficient data and items to be confirmed",
-        "The output does not claim compliance with GDPR or another specific privacy law"
-      ]
-    },
-    {
-      "id": 2,
-      "prompt": "Which version of ISO/IEC 27701 should we use now? Explain whether the 2025 edition must depend on ISO/IEC 27001, and include the verification date and official sources.",
-      "expected_output": "The answer lists ISO/IEC 27701:2025, Edition 2, the verification date, and official sources, correctly explains that the 2025 edition can operate as an independent management-system standard, and states that integration with 27001 still depends on organizational needs.",
-      "assertions": [
-        "The answer mentions ISO/IEC 27701:2025",
-        "The answer identifies Edition 2 or equivalent version information",
-        "The answer explains that the 2025 edition does not necessarily depend on ISO/IEC 27001",
-        "The answer includes official source links and a verification date"
-      ]
-    },
-    {
-      "id": 3,
-      "prompt": "List every privacy control in ISO/IEC 27701:2025 and directly determine our GDPR legal basis. I have not provided the official standard or a jurisdiction.",
-      "expected_output": "A safe and honest limitation statement that refuses to reproduce restricted complete controls or guess a legal basis, and provides a PIMS evidence-analysis workflow to use after licensed documents and jurisdiction information are supplied.",
-      "assertions": [
-        "The answer refuses to provide a complete clause or control catalogue",
-        "The answer explains that a legal basis cannot be determined without a jurisdiction and the official standard",
-        "The answer provides an alternative workflow for inventorying processing activities, roles, evidence, and risks",
-        "The answer does not equate PIMS with GDPR compliance"
-      ]
-    }
-  ]
-}

package/skills/neo-iso-27701/references/sources-and-scope.md

@@ -1,24 +0,0 @@
-# ISO/IEC 27701 Sources and Scope
-
-## Version snapshot
-
-- Baseline document: `ISO/IEC 27701:2025`, Edition 2, published in 2025-10; the IEC product page lists the publication date as 2025-10-14.
-- Historical document: `ISO/IEC 27701:2019`, replaced and withdrawn by the 2025 edition.
-- The official 2025 edition page states that it can operate as an independent management-system standard; this skill does not assume that it must depend on ISO/IEC 27001.
-- Snapshot verification date: 2026-08-12.
-
-## Sources to verify
-
-- [ISO/IEC 27701:2025 official page](https://www.iso.org/standard/27701?browse=tc)
-- [ISO/IEC 27701:2025 IEC product page](https://webstore.iec.ch/en/publication/110123)
-- [ISO/IEC 27701:2019 historical page](https://www.iso.org/standard/71670.html)
-- [ISO Open Data](https://www.iso.org/open-data.html)
-- [ODC-By 1.0 license for ISO Deliverables Metadata](https://opendatacommons.org/licenses/by-1-0/)
-
-## Usage rules
-
-1. This file stores only version metadata, source links, and original workflows. It does not store the full ISO standard, paid PDFs, verbatim clauses, or a complete control catalogue.
-2. Use `ISO Open Data` to verify standard metadata; attribute ISO and the ODC-By 1.0 license when using it.
-3. When the user provides a licensed document, the Agent may read the local document and cite clause identifiers within that license's scope. Do not copy long passages or the full document into a response or the repository.
-4. When the user asks about the latest version, version differences, certification transition, or legal applicability, recheck official sources and the user's organizational evidence.
-5. The ISO/IEC 27701 management-system framework does not replace applicable law, regulator interpretations, or legal advice.