@opengroundplan/core 0.1.1

package/catalog/sources/agent-tooling.yaml

@@ -0,0 +1,1180 @@
+# Groundplan template source catalog — category: agent-tooling
+#
+# Research date: 2026-07-19
+#
+# SCOPE
+# -----
+# Open-source collections of AI agent skills, slash-commands, hooks, subagents, MCP servers,
+# AGENTS.md exemplars, editor-rule collections, and spec-driven workflow kits — assessed for
+# whether their content can be adapted into Groundplan's registry.
+#
+# PROVENANCE / VERIFICATION NOTES
+# --------------------------------
+# Every repo below was resolved through GET https://api.github.com/repos/{owner}/{repo}.
+# `stars` = stargazers_count, `lastCommit` = pushed_at (date part), `maintained` folds in
+# `archived` plus a 6-month recency cutoff (2026-01-19). All 45 entries resolved; no entry
+# below is an unverified guess.
+#
+# Where the API returned `license.spdx_id: "NOASSERTION"` or `null`, the actual LICENSE text was
+# read from raw.githubusercontent.com before classifying. That step changed the answer six times
+# and is the single most important part of this file:
+#
+#   * hesreallyhim/awesome-claude-code (50k stars, THE canonical Claude Code list) is
+#     CC-BY-NC-ND-4.0. NonCommercial AND NoDerivatives. -> excluded. Cannot be vendored,
+#     cannot be adapted, cannot ship in a commercial tool. Its LICENSE says so explicitly and
+#     invites contact for modified use. Do not let its ubiquity imply permission.
+#   * anthropics/skills (162k stars) has NO repo-level LICENSE file. The README claims Apache-2.0
+#     for most skills, but no Apache LICENSE file exists at the repo root, at spec/, at skills/,
+#     or in the sampled skill dirs. Meanwhile skills/pdf/LICENSE.txt is explicitly
+#     source-available and says users "may not ... reproduce or copy these materials".
+#     -> excluded at repo level. Read it, never vendor it.
+#   * modelcontextprotocol/{servers,registry,typescript-sdk} report NOASSERTION because their
+#     LICENSE opens with a transition notice: the project is relicensing MIT -> Apache-2.0, and
+#     un-consented contributions REMAIN MIT. Both arms are permissive, so -> vendorable, but the
+#     file is a dual-license notice, not plain Apache-2.0. Attribute accordingly.
+#   * bmad-code-org/BMAD-METHOD reports NOASSERTION only because its MIT text has a contributor
+#     -attribution paragraph spliced in above the grant. It is MIT. -> vendorable.
+#   * brennercruvinel/CCPlugins returned an empty body from /repos on three separate attempts at
+#     different points in the rate-limit window. Its fields come from other PRIMARY GitHub
+#     sources: raw LICENSE (MIT), the repo page (2.7k stars, not archived), and
+#     commits/main.atom (2025-10-07). Reconcile against /repos on a later pass.
+#
+# The recurring failure mode in this ecosystem is the unlicensed mega-list. Six popular
+# collections — travisvn/awesome-claude-skills (14k), ComposioHQ/awesome-claude-skills (68k),
+# contains-studio/agents (12k), qdhenry/Claude-Command-Suite, appcypher/awesome-mcp-servers,
+# disler/claude-code-hooks-mastery — ship no LICENSE file at all. Absence of a license is
+# all-rights-reserved, not public domain. They are listed here as `excluded` deliberately, so a
+# later pass does not rediscover them and assume nobody checked.
+#
+# TOOL-AGNOSTIC vs VENDOR-LOCKED: see the `portability` field on each entry.
+# agnostic | claude-only | copilot-only | cursor-only | mcp-protocol
+# Groundplan compiles outward to 14 tools, so `agnostic` and `mcp-protocol` sources are worth
+# multiples of a claude-only source of the same star count.
+
+category: agent-tooling
+
+sources:
+  # ---------------------------------------------------------------- standards & specs
+
+  - name: agentskills/agentskills
+    url: https://github.com/agentskills/agentskills
+    stars: 23184
+    spdx: Apache-2.0
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-07-10"
+    category: skill-spec
+    portability: agnostic
+    whatToBorrow: >-
+      The normative Agent Skills specification — docs/specification.mdx. This is the single most
+      load-bearing document for Groundplan's skill layer, and it is Apache-2.0, unlike Anthropic's
+      own skills repo. Borrow the frontmatter contract verbatim: only `name` and `description` are
+      required; `name` is max 64 chars, lowercase/digits/hyphen only, no leading or trailing
+      hyphen, and MUST equal the parent directory name; `description` is max 1024 chars and
+      non-empty. Critically, spec-compliant runtimes MUST ignore unrecognized frontmatter keys —
+      that forward-compat rule is what lets Groundplan emit tool-specific keys into the same
+      SKILL.md without breaking other runtimes. Optional `license` and `metadata` (free-form
+      key-value) fields give us somewhere legitimate to stamp provenance on every emitted skill.
+    whatToAvoid: >-
+      The spec is deliberately minimal — it standardizes the envelope, not the content. It says
+      nothing about tool permissions, model selection, or invocation triggers, so do not expect it
+      to resolve those; each of the 14 targets still needs its own mapping layer.
+    proposedRegistryItems:
+      - skill-frontmatter-schema
+      - skill-name-validator
+      - skill-scaffold
+      - skill-lint
+
+  - name: anthropics/skills
+    url: https://github.com/anthropics/skills
+    stars: 162394
+    spdx: NONE
+    licenseClass: excluded
+    maintained: true
+    lastCommit: "2026-07-17"
+    category: skill-collection
+    portability: agnostic
+    # Excluded on the hard rule: no repo-level LICENSE. See header for the full trace.
+    whatToBorrow: >-
+      Nothing may be copied. Read-only value: spec/agent-skills-spec.md is the reference copy of
+      the same spec published Apache-2.0 at agentskills/agentskills — take the spec from there
+      instead. template/SKILL.md confirms the minimal authored shape is a three-key frontmatter
+      (name, description) plus free-form markdown body, which is a fact about the format, not
+      copyrightable expression.
+    whatToAvoid: >-
+      Do not vendor any file. The README's "most skills are Apache 2.0" claim is not backed by an
+      Apache LICENSE file anywhere we could find, and skills/docx, skills/pdf, skills/pptx and
+      skills/xlsx carry an explicit source-available LICENSE.txt forbidding extraction, copying,
+      and retention outside Anthropic's services. Treat the whole repo as all-rights-reserved
+      until Anthropic adds a root LICENSE.
+    proposedRegistryItems: []
+
+  - name: agentsmd/agents.md
+    url: https://github.com/agentsmd/agents.md
+    stars: 23086
+    spdx: MIT
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-03-12"
+    category: agents-md
+    portability: agnostic
+    whatToBorrow: >-
+      The AGENTS.md format definition and its worked examples from README.md. The value is the
+      conventions, not the prose: a single root AGENTS.md, nested AGENTS.md files in subdirectories
+      where the nearest-ancestor file wins, and the canonical section set (setup commands, test
+      instructions, code style, PR/commit conventions). Groundplan should emit exactly this
+      section set as its lowest-common-denominator target, because it is the one artifact all 14
+      tools read natively.
+    whatToAvoid: >-
+      The repo is mostly a Next.js marketing site for agents.md; do not mistake site source for
+      spec content. The format is intentionally unstructured markdown with no schema and no
+      validator, so do not build a strict parser against it — treat AGENTS.md as generated output,
+      never as a source of truth to round-trip.
+    proposedRegistryItems:
+      - agents-md-base
+      - agents-md-setup-commands
+      - agents-md-test-instructions
+      - agents-md-code-style
+      - agents-md-pr-conventions
+      - agents-md-nested-scoping
+
+  # ---------------------------------------------------------------- skill collections
+
+  - name: obra/superpowers
+    url: https://github.com/obra/superpowers
+    stars: 257066
+    spdx: MIT
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-07-17"
+    category: skill-collection
+    portability: agnostic
+    whatToBorrow: >-
+      The highest-value vendorable skills collection found, and one of very few that already ships
+      per-harness installers for Claude Code, Codex CLI, Cursor, OpenCode, Antigravity, Factory
+      Droid, Copilot CLI, Kimi Code and Pi — evidence the same skill body survives translation to
+      ~9 targets. Borrow skills/writing-skills/SKILL.md, which is the repo's own meta-guide to
+      authoring skills and the best short statement of the genre we found. Borrow the workflow
+      decomposition itself: brainstorming -> design -> implementation-plan -> red/green TDD ->
+      finishing-a-development-branch, where the last skill verifies tests then offers
+      merge/PR/keep/discard and cleans up the worktree. The .claude-plugin/plugin.json manifest is
+      a compact model for how a bundle declares its own contents.
+    whatToAvoid: >-
+      Heavily opinionated methodology — strict TDD, YAGNI, DRY — that is presented as
+      non-negotiable; ship it as an opt-in profile, never as Groundplan's default. Skills assume a
+      git-worktree-per-task workflow that will confuse users on trunk-based or non-git setups.
+      Some content is commercial funnel (hiring notices, Prime Radiant links, telemetry section);
+      strip before vendoring.
+    proposedRegistryItems:
+      - skill-writing-skills
+      - workflow-brainstorming
+      - workflow-design-doc
+      - workflow-implementation-plan
+      - workflow-tdd-red-green
+      - workflow-finish-branch
+      - plugin-manifest-json
+
+  - name: obra/superpowers-skills
+    url: https://github.com/obra/superpowers-skills
+    stars: 727
+    spdx: MIT
+    licenseClass: vendorable
+    maintained: false
+    lastCommit: "2025-10-14"
+    category: skill-collection
+    portability: agnostic
+    # ARCHIVED. Content folded back into obra/superpowers; kept for license-clean provenance only.
+    whatToBorrow: >-
+      Only useful as a frozen, MIT-clean snapshot of community skills at the point the community
+      -editable fork was retired. If a skill you want from obra/superpowers has murky contribution
+      history, the same file here is a cleaner attribution anchor.
+    whatToAvoid: >-
+      Archived and read-only since 2025-10-14 — nine months stale against a fast-moving format.
+      Never treat as a live upstream; anything here is superseded by obra/superpowers.
+    proposedRegistryItems: []
+
+  - name: obra/superpowers-marketplace
+    url: https://github.com/obra/superpowers-marketplace
+    stars: 1162
+    spdx: MIT
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-07-02"
+    category: plugin-marketplace
+    portability: claude-only
+    whatToBorrow: >-
+      A minimal, readable implementation of the plugin-marketplace manifest — the index format that
+      maps plugin ids to source repos and versions. Worth borrowing as the shape of Groundplan's
+      own registry index if we ever publish one for consumption by Claude Code's
+      `/plugin marketplace add`.
+    whatToAvoid: >-
+      The marketplace manifest format is Claude-Code-specific and has no analogue in the other 13
+      targets; it belongs in an adapter, not the core registry schema. Thin repo — the manifest is
+      most of it.
+    proposedRegistryItems:
+      - marketplace-manifest
+
+  - name: mgechev/skills-best-practices
+    url: https://github.com/mgechev/skills-best-practices
+    stars: 2125
+    spdx: NONE
+    licenseClass: excluded
+    maintained: true
+    lastCommit: "2026-06-22"
+    category: skill-authoring
+    portability: agnostic
+    whatToBorrow: >-
+      Nothing copyable. Read-only: its thesis — write skills that keep the context window lean and
+      validate them with an LLM rather than by eye — is a technique worth reimplementing from
+      scratch as a Groundplan skill-lint rule. The idea is not the expression.
+    whatToAvoid: >-
+      No LICENSE file at main. Do not vendor text, checklists, or rule wording from it.
+    proposedRegistryItems: []
+
+  - name: travisvn/awesome-claude-skills
+    url: https://github.com/travisvn/awesome-claude-skills
+    stars: 14186
+    spdx: NONE
+    licenseClass: excluded
+    maintained: true
+    lastCommit: "2026-04-28"
+    category: skill-directory
+    portability: claude-only
+    whatToBorrow: >-
+      Nothing. Usable only as a discovery index — follow its outbound links to the underlying
+      skill repos and license-check each one independently at its own source.
+    whatToAvoid: >-
+      No LICENSE file at main or master. A curated list is a compilation and its selection and
+      arrangement are protected; do not copy the list structure or entry descriptions.
+    proposedRegistryItems: []
+
+  - name: ComposioHQ/awesome-claude-skills
+    url: https://github.com/ComposioHQ/awesome-claude-skills
+    stars: 68043
+    spdx: NONE
+    licenseClass: excluded
+    maintained: true
+    lastCommit: "2026-05-22"
+    category: skill-directory
+    portability: claude-only
+    whatToBorrow: >-
+      Nothing. Discovery only, same as travisvn — chase the links, license-check at the source.
+    whatToAvoid: >-
+      No LICENSE file despite 68k stars, and it is corporate-maintained, which makes silent
+      relicensing or takedown more likely, not less. Do not vendor.
+    proposedRegistryItems: []
+
+  # ---------------------------------------------------------------- curated meta-lists
+
+  - name: hesreallyhim/awesome-claude-code
+    url: https://github.com/hesreallyhim/awesome-claude-code
+    stars: 50333
+    spdx: CC-BY-NC-ND-4.0
+    licenseClass: excluded
+    maintained: true
+    lastCommit: "2026-07-18"
+    category: meta-directory
+    portability: claude-only
+    # The most-cited list in the ecosystem and the most legally restrictive. Read the header.
+    whatToBorrow: >-
+      Nothing may be copied or adapted. Read-only: it is the best single map of what exists, and
+      its category taxonomy (skills / subagents / slash-commands / hooks / status lines / tooling /
+      plugins) is a reasonable sanity check that Groundplan's own registry categories are not
+      missing an artifact type. Use it to find repos, then evaluate those repos at their source.
+    whatToAvoid: >-
+      CC-BY-NC-ND-4.0 is a double disqualifier: NonCommercial forbids use in a commercial tool, and
+      NoDerivatives forbids adaptation even with attribution. The LICENSE states the terms were
+      chosen deliberately to prevent appropriation and asks that you contact the maintainer for
+      modified use. Do not vendor entries, descriptions, or the list's structure. If Groundplan
+      wants this content, that is an email, not a git clone.
+    proposedRegistryItems: []
+
+  - name: ccplugins/awesome-claude-code-plugins
+    url: https://github.com/ccplugins/awesome-claude-code-plugins
+    stars: 882
+    spdx: Apache-2.0
+    licenseClass: vendorable
+    maintained: false
+    lastCommit: "2025-10-14"
+    category: meta-directory
+    portability: claude-only
+    whatToBorrow: >-
+      The rare permissively-licensed curated list in this space, which makes it the one directory
+      whose taxonomy we can actually copy. Its framing — a plugin is a bundle that may contain
+      slash commands, subagents, MCP servers, and hooks together — is exactly Groundplan's
+      composite-item model and is worth mirroring in the registry schema.
+    whatToAvoid: >-
+      Nine months stale in an ecosystem that reorganized around Agent Skills in the interim; a
+      large share of its links are likely dead or superseded. Verify every entry before use.
+    proposedRegistryItems:
+      - plugin-bundle-schema
+
+  # ---------------------------------------------------------------- subagents
+
+  - name: wshobson/agents
+    url: https://github.com/wshobson/agents
+    stars: 38023
+    spdx: MIT
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-07-18"
+    category: subagent-collection
+    portability: agnostic
+    # The single most directly relevant source in this file — it already solves our core problem.
+    whatToBorrow: >-
+      This repo IS a one-source-of-truth-to-many-harnesses compiler, which is Groundplan's exact
+      architecture, already load-bearing at 203 agents / 175 skills / 94 plugins. Steal the design
+      wholesale. `plugins/` is the single source; each harness gets a generated, idiomatic output
+      tree: Claude Code reads native marketplace.json + plugins/; Codex gets
+      .agents/plugins/marketplace.json plus plugins/*/.codex-plugin/plugin.json; Cursor gets
+      .cursor-plugin/ + .cursor/rules/; OpenCode gets .opencode/{agents,commands,skills}/; Gemini
+      CLI gets TOML commands; Copilot gets .copilot/{agents,skills,commands}/. Read
+      docs/harnesses.md — it is a published cross-harness capability matrix and records the exact
+      deltas we will hit, including Codex's 8 KB per-skill cap, commands having to be downgraded to
+      skills on harnesses with no command concept, OpenCode deriving a `permission:` block from a
+      `tools:` allowlist, and OpenCode-specific skill-name restrictions. docs/authoring.md is a
+      portable-content style guide for writing one body that survives all targets.
+      docs/agent-skills.md covers progressive disclosure. The per-plugin layout
+      (plugins/<name>/.claude-plugin/plugin.json + agents/ + commands/ + skills/) is a clean
+      composite-bundle shape. `make garden` runs drift, dead-link and size-cap detection — that is
+      the CI gate Groundplan needs. plugin-eval scores and certifies skill quality
+      (`plugin-eval score <path> --depth quick`, `plugin-eval certify <path>`).
+    whatToAvoid: >-
+      Enormous surface area; do not vendor all 203 agents — most are thin persona wrappers whose
+      value does not survive the copy. The three-tier model-assignment convention (tier 2 =
+      "inherit") is Claude-pricing-shaped and should not leak into the schema. Some generated
+      harness trees are gitignored rather than committed (.codex/skills/, .codex/agents/), so the
+      repo alone does not show every output. Bundles an external memory integration (Pensyve) that
+      is out of scope.
+    proposedRegistryItems:
+      - harness-capability-matrix
+      - portable-authoring-guide
+      - skill-progressive-disclosure
+      - adapter-claude-code
+      - adapter-codex-cli
+      - adapter-cursor
+      - adapter-opencode
+      - adapter-gemini-cli
+      - adapter-copilot
+      - skill-size-cap-check
+      - registry-drift-check
+      - dead-link-check
+      - skill-quality-score
+      - agent-code-reviewer
+      - agent-security-auditor
+
+  - name: VoltAgent/awesome-claude-code-subagents
+    url: https://github.com/VoltAgent/awesome-claude-code-subagents
+    stars: 23474
+    spdx: MIT
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-07-10"
+    category: subagent-collection
+    portability: claude-only
+    whatToBorrow: >-
+      154 MIT-licensed subagent definitions filed under a stable numbered taxonomy —
+      categories/01-core-development/ through categories/09-meta-orchestration/ — where each agent
+      is one self-contained markdown file. Concretely useful individual files:
+      categories/01-core-development/api-designer.md, backend-developer.md, frontend-developer.md,
+      graphql-architect.md, microservices-architect.md, websocket-engineer.md. The numbered-category
+      directory convention is a better registry key scheme than flat names because it makes
+      ordering and grouping intrinsic to the path. install-agents.sh shows a no-clone install via a
+      single curl'd script, and categories/09-meta-orchestration/agent-installer.md is a neat
+      trick: an agent whose job is installing other agents.
+    whatToAvoid: >-
+      Definitions target Claude Code's .claude/agents/ frontmatter directly and will need
+      remapping for every other harness. Quality is uneven across 154 files — several are long
+      persona prose with little operational instruction. README carries sponsor banners and Discord
+      CTAs; strip before vendoring.
+    proposedRegistryItems:
+      - agent-api-designer
+      - agent-backend-developer
+      - agent-frontend-developer
+      - agent-graphql-architect
+      - agent-microservices-architect
+      - agent-websocket-engineer
+      - agent-category-taxonomy
+      - agent-installer
+
+  - name: 0xfurai/claude-code-subagents
+    url: https://github.com/0xfurai/claude-code-subagents
+    stars: 961
+    spdx: MIT
+    licenseClass: vendorable
+    maintained: false
+    lastCommit: "2025-10-15"
+    category: subagent-collection
+    portability: claude-only
+    whatToBorrow: >-
+      100+ narrowly-scoped, one-domain-per-agent definitions. Its useful contribution is
+      granularity: agents are scoped to a single language or library rather than a job title, which
+      makes them far easier to auto-select and far less likely to overlap than persona agents.
+      Worth mining for the scoping convention more than for the files.
+    whatToAvoid: >-
+      Nine months stale. Heavy overlap with wshobson/agents and VoltAgent — dedupe hard, and prefer
+      the maintained sources when the same agent exists in two places.
+    proposedRegistryItems:
+      - agent-single-domain-scoping
+
+  - name: lst97/claude-code-sub-agents
+    url: https://github.com/lst97/claude-code-sub-agents
+    stars: 1619
+    spdx: MIT
+    licenseClass: vendorable
+    maintained: false
+    lastCommit: "2025-08-15"
+    category: subagent-collection
+    portability: claude-only
+    whatToBorrow: >-
+      A coherent full-stack-oriented agent set assembled for one person's real workflow, which
+      makes its inter-agent handoffs more considered than the big scraped collections. Useful as a
+      worked example of a small, opinionated agent team rather than a catalog.
+    whatToAvoid: >-
+      Nearly a year stale and explicitly described as "for personal use" — no stability or breadth
+      guarantees. Low marginal value over wshobson/agents.
+    proposedRegistryItems: []
+
+  - name: contains-studio/agents
+    url: https://github.com/contains-studio/agents
+    stars: 12399
+    spdx: NONE
+    licenseClass: excluded
+    maintained: false
+    lastCommit: "2025-07-28"
+    category: subagent-collection
+    portability: claude-only
+    whatToBorrow: >-
+      Nothing. Listed so a later pass does not rediscover a popular repo and assume it is usable.
+    whatToAvoid: >-
+      No LICENSE file, and effectively abandoned — last push 2025-07-28, roughly a year stale.
+      All-rights-reserved. Do not vendor despite the 12k stars.
+    proposedRegistryItems: []
+
+  # ---------------------------------------------------------------- slash commands
+
+  - name: wshobson/commands
+    url: https://github.com/wshobson/commands
+    stars: 2573
+    spdx: MIT
+    licenseClass: vendorable
+    maintained: false
+    lastCommit: "2025-10-12"
+    category: command-collection
+    portability: claude-only
+    whatToBorrow: >-
+      57 MIT command definitions split into a genuinely useful two-tier taxonomy: tools/ (42
+      single-purpose commands) versus workflows/ (15 multi-agent orchestrations). That
+      tool-vs-workflow distinction is the cleanest articulation of command granularity we found and
+      should go straight into Groundplan's registry schema. Named commands worth adapting from
+      workflows/: feature-development, tdd-cycle, smart-fix, performance-optimization,
+      workflow-automate. From tools/: security-scan, api-scaffold, error-trace, compliance-check,
+      data-pipeline, slo-implement. The directory-prefix invocation convention
+      (/workflows:feature-development, /tools:security-scan) maps namespaces onto directories with
+      no extra metadata, and the README documents the flatten-to-remove-prefixes fallback.
+    whatToAvoid: >-
+      The repo's own README now points users to wshobson/agents as the modern replacement and calls
+      this the legacy pattern — treat it as a content quarry, not a live dependency. Nine months
+      stale. Commands assume Claude Code's ~/.claude/commands/ layout and $ARGUMENTS semantics.
+    proposedRegistryItems:
+      - command-tool-vs-workflow-taxonomy
+      - command-namespace-by-directory
+      - cmd-feature-development
+      - cmd-tdd-cycle
+      - cmd-smart-fix
+      - cmd-performance-optimization
+      - cmd-security-scan
+      - cmd-api-scaffold
+      - cmd-error-trace
+      - cmd-compliance-check
+      - cmd-slo-implement
+
+  - name: brennercruvinel/CCPlugins
+    url: https://github.com/brennercruvinel/CCPlugins
+    stars: 2700
+    spdx: MIT
+    licenseClass: vendorable
+    maintained: false
+    lastCommit: "2025-10-07"
+    category: command-collection
+    portability: claude-only
+    # stars/archived from the repo page, lastCommit from commits/main.atom — /repos returned empty.
+    whatToBorrow: >-
+      A flat commands/ directory of professional-workflow slash commands plus, more usefully, a
+      complete install/uninstall story in four scripts — install.py, install.sh, uninstall.py,
+      uninstall.sh. Clean uninstall is the part almost every collection in this file skips, and
+      Groundplan needs it: a scaffolding tool that cannot cleanly remove what it added is a
+      one-way door. Borrow the symmetric install/uninstall contract.
+    whatToAvoid: >-
+      Explicitly pinned to Claude Code CLI docs v2025.08.01 and last touched 2025-10-07; README
+      admits a V2 rewrite is pending because of upstream changes. Command bodies may reference
+      deprecated CLI behavior — validate each against current docs before shipping.
+    proposedRegistryItems:
+      - installer-symmetric-uninstall
+
+  - name: qdhenry/Claude-Command-Suite
+    url: https://github.com/qdhenry/Claude-Command-Suite
+    stars: 1314
+    spdx: NONE
+    licenseClass: excluded
+    maintained: true
+    lastCommit: "2026-03-01"
+    category: command-collection
+    portability: claude-only
+    whatToBorrow: >-
+      Nothing copyable. Read-only observation: it bundles 216+ commands, 54 agents and 12 skills in
+      one repo under a /namespace:command-name convention, which corroborates the
+      directory-as-namespace pattern already borrowable from the MIT-licensed wshobson/commands.
+      Take the pattern from there instead.
+    whatToAvoid: >-
+      No LICENSE file at main or master. Frequently recommended in blog posts and search results as
+      if it were freely reusable; it is not.
+    proposedRegistryItems: []
+
+  - name: Pimzino/claude-code-spec-workflow
+    url: https://github.com/Pimzino/claude-code-spec-workflow
+    stars: 3798
+    spdx: MIT
+    licenseClass: vendorable
+    maintained: false
+    lastCommit: "2025-09-07"
+    category: workflow-kit
+    portability: claude-only
+    whatToBorrow: >-
+      An MIT implementation of the requirements -> design -> tasks -> implementation spec chain as
+      installable slash commands, with document state persisted to disk between phases. Useful as
+      the small, vendorable counterweight to github/spec-kit: same idea, far less machinery, and
+      easy to read end to end when deciding how much of spec-kit's architecture Groundplan actually
+      needs.
+    whatToAvoid: >-
+      Ten months stale. Claude-Code-only command format. Overlaps github/spec-kit, which is far
+      better maintained and equally MIT — prefer spec-kit unless you specifically want the minimal
+      version.
+    proposedRegistryItems:
+      - workflow-spec-requirements
+      - workflow-spec-design
+      - workflow-spec-tasks
+
+  # ---------------------------------------------------------------- hooks & guardrails
+
+  - name: karanb192/claude-code-hooks
+    url: https://github.com/karanb192/claude-code-hooks
+    stars: 449
+    spdx: MIT
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-07-18"
+    category: hook-collection
+    portability: claude-only
+    # Best vendorable hook source found: MIT, actively pushed, 1165 passing tests.
+    whatToBorrow: >-
+      Real, tested, MIT hook scripts with named files rather than blog-post snippets. PreToolUse:
+      hook-scripts/pre-tool-use/block-dangerous-commands.js (rm -rf ~, fork bombs, curl|sh),
+      protect-secrets.js (blocks reading/modifying/exfiltrating sensitive files across
+      Read|Edit|Write|Bash), git-safety.js (branch-aware guardrails plus destructive gh CLI
+      protection), and protect-tests.js — which blocks the specific "fake green" failure mode where
+      an agent deletes, renames away, or skip/xfail-disables a failing test. PostToolUse:
+      auto-stage.js and format-code.js (ruff for Python, prettier for JS/TS/HTML/JSON/MD/YAML).
+      Session: session-logger.js, notable for registering PostToolUse with "async": true so logging
+      never blocks the agent, serializing concurrent writes with a file lock, and doing best-effort
+      secret redaction on captured bash commands. hook-scripts/utils/event-logger.py exists purely
+      to dump event payloads so you can discover a hook event's real schema before writing against
+      it — Groundplan should ship an equivalent. The async-PostToolUse pattern is the key
+      performance lesson: recorders must not sit in the critical path.
+    whatToAvoid: >-
+      Hook event names, the matcher syntax, and the settings.json wiring are Claude-Code-specific;
+      the guard LOGIC is portable but the registration layer is not, so split them in the registry.
+      Scripts assume node on PATH and that ruff/prettier are installed. The gamified plugins
+      (bounty-board, nerf-receipts, dead-end-registry) are fun but are not core scaffolding.
+    proposedRegistryItems:
+      - hook-block-dangerous-commands
+      - hook-protect-secrets
+      - hook-git-safety
+      - hook-protect-tests
+      - hook-auto-stage
+      - hook-format-code
+      - hook-session-logger
+      - hook-event-payload-logger
+      - hook-async-posttooluse-pattern
+
+  - name: ithiria894/awesome-claude-code-hooks
+    url: https://github.com/ithiria894/awesome-claude-code-hooks
+    stars: 18
+    spdx: CC0-1.0
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-03-24"
+    category: hook-directory
+    portability: claude-only
+    # 18 stars, but CC0 — public domain. Rare and legally the cleanest list in this file.
+    whatToBorrow: >-
+      The only hook directory we found that is both curated and CC0, so its taxonomy can be copied
+      outright. Its category set is a ready-made spine for Groundplan's hook registry: Security and
+      Prompt Injection, Safety and Protection, Monitoring and Observability, Code Quality Gates,
+      Context and Memory, Model Routing and Cost, Session Management, File Organization,
+      Notification and Alerts, Voice and Sound, Git Integration, Hook SDKs and Frameworks. Entries
+      are unusually rigorous for an awesome list — each names the file the hook lives in and the
+      event it triggers on. It also surfaces a genuinely important portability finding via
+      gstack: hooks declared in SKILL.md frontmatter are ENFORCED in Claude Code but degrade to
+      advisory prose in generated Codex skill docs. That asymmetry must be encoded in Groundplan's
+      capability matrix or we will silently ship unenforced guardrails.
+    whatToAvoid: >-
+      18 stars and one maintainer — low bus factor. It is an index of links, so the hooks it points
+      at carry their own licenses; CC0 covers the list, not the linked code. License-check each
+      target repo separately.
+    proposedRegistryItems:
+      - hook-category-taxonomy
+      - hook-enforcement-vs-advisory-matrix
+      - hook-prompt-injection-guard
+      - hook-lint-gate
+      - hook-model-routing-cost
+      - hook-memory-injection
+
+  - name: mafiaguy/claude-security-guardrails
+    url: https://github.com/mafiaguy/claude-security-guardrails
+    stars: 2
+    spdx: MIT
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-02-19"
+    category: hook-collection
+    portability: claude-only
+    # 2 stars. Included only because the threat list is concrete and the license is clean.
+    whatToBorrow: >-
+      The enumerated block-list is the borrowable asset, not the implementation: rm -rf, force
+      pushes, leaked API keys, SQL injection, eval(), and ~30 further risky patterns, wired through
+      PreToolUse and PostToolUse. Use it as a checklist to test Groundplan's own guard rules
+      against for coverage gaps.
+    whatToAvoid: >-
+      Two stars means essentially zero external review — read every line before adopting any of it,
+      and do not present it as a hardened security control. The bundled React monitoring dashboard
+      is scope creep for a scaffolding tool. Prefer karanb192/claude-code-hooks, which covers much
+      of the same ground with a real test suite.
+    proposedRegistryItems:
+      - hook-secret-scan
+      - hook-block-force-push
+      - hook-dangerous-pattern-list
+
+  - name: disler/claude-code-hooks-mastery
+    url: https://github.com/disler/claude-code-hooks-mastery
+    stars: 3834
+    spdx: NONE
+    licenseClass: excluded
+    maintained: true
+    lastCommit: "2026-03-04"
+    category: hook-collection
+    portability: claude-only
+    whatToBorrow: >-
+      Nothing copyable, and this one hurts — it is the de facto teaching reference for the full
+      hook lifecycle and is cited everywhere. Read it to understand which events exist and how
+      exit codes and JSON output control flow, then implement independently. Take vendorable hook
+      code from karanb192/claude-code-hooks instead.
+    whatToAvoid: >-
+      No LICENSE file at main or master despite 3.8k stars and constant citation as a template.
+      Its ubiquity in tutorials makes accidental copying likely — flag it explicitly in
+      contributor guidance.
+    proposedRegistryItems: []
+
+  - name: disler/claude-code-hooks-multi-agent-observability
+    url: https://github.com/disler/claude-code-hooks-multi-agent-observability
+    stars: 1494
+    spdx: NONE
+    licenseClass: excluded
+    maintained: true
+    lastCommit: "2026-02-08"
+    category: hook-collection
+    portability: claude-only
+    whatToBorrow: >-
+      Nothing copyable. Read-only: it is the clearest demonstration that hooks are a viable
+      telemetry bus for multi-agent runs — every lifecycle event streamed to a collector and
+      rendered live. If Groundplan wants observability hooks, this shows the shape; build it fresh.
+    whatToAvoid: >-
+      No LICENSE file. Also architecturally heavy (server plus client dashboard) relative to
+      anything a scaffolding tool should emit by default.
+    proposedRegistryItems: []
+
+  # ---------------------------------------------------------------- MCP
+
+  - name: modelcontextprotocol/servers
+    url: https://github.com/modelcontextprotocol/servers
+    stars: 88611
+    spdx: Apache-2.0
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-07-10"
+    category: mcp-servers
+    portability: mcp-protocol
+    # API says NOASSERTION; LICENSE is an MIT -> Apache-2.0 transition notice. Both arms permissive.
+    whatToBorrow: >-
+      The canonical reference servers maintained by the MCP steering group — the authoritative
+      implementations of the servers Groundplan should offer by default (filesystem, git, fetch,
+      memory, sequential thinking, time). Borrow their tool-definition style: narrow tool surfaces,
+      explicit JSON Schema per tool, and path-scoping via allowed-directory arguments rather than
+      ambient trust. README.md also carries the community-server index, which is the least
+      link-rotted MCP directory available because it sits next to the spec.
+    whatToAvoid: >-
+      Read the LICENSE preamble before attributing: the project is mid-relicense, and contributions
+      whose authors have not consented REMAIN MIT rather than Apache-2.0. Attribute per-file, not
+      per-repo. Several once-reference servers have been retired or moved to archive — confirm a
+      server is still live before wiring it into a default config.
+    proposedRegistryItems:
+      - mcp-filesystem
+      - mcp-git
+      - mcp-fetch
+      - mcp-memory
+      - mcp-sequential-thinking
+      - mcp-time
+      - mcp-server-config-base
+
+  - name: modelcontextprotocol/registry
+    url: https://github.com/modelcontextprotocol/registry
+    stars: 7044
+    spdx: Apache-2.0
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-07-15"
+    category: mcp-registry
+    portability: mcp-protocol
+    whatToBorrow: >-
+      The official registry's server-metadata schema — how an MCP server declares its identity,
+      package/runtime, transport, and configuration inputs. If Groundplan emits MCP config for 14
+      tools, resolving servers against this schema rather than hand-maintained per-tool JSON is the
+      difference between one source of truth and fourteen. Its publish/validate flow is also the
+      best available model for how Groundplan would submit or consume registry entries.
+    whatToAvoid: >-
+      Young and still moving; treat the schema as versioned and pin to a release rather than main.
+      Same MIT/Apache transition caveat in the LICENSE as the other MCP repos. It is registry
+      infrastructure, not servers — do not expect runnable tools here.
+    proposedRegistryItems:
+      - mcp-registry-schema
+      - mcp-server-resolver
+
+  - name: modelcontextprotocol/typescript-sdk
+    url: https://github.com/modelcontextprotocol/typescript-sdk
+    stars: 12884
+    spdx: Apache-2.0
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-07-18"
+    category: mcp-sdk
+    portability: mcp-protocol
+    whatToBorrow: >-
+      The SDK Groundplan's own templates should scaffold against for any TypeScript MCP server, and
+      the reference for MCP prompts and resources — the two primitives most collections ignore in
+      favor of tools. MCP prompts are the closest thing to a protocol-native, vendor-neutral
+      slash-command, which makes them strategically important for a registry compiling to 14 tools.
+      Borrow the server-bootstrap shape (server construction, transport selection, tool/prompt
+      registration) as the skeleton of an mcp-server template.
+    whatToAvoid: >-
+      Transport APIs have churned across versions (stdio vs SSE vs streamable HTTP); pin the SDK
+      version in any emitted template or the scaffold will break under users. Same MIT/Apache
+      transition notice.
+    proposedRegistryItems:
+      - mcp-server-template-ts
+      - mcp-prompts-primitive
+      - mcp-resources-primitive
+
+  - name: modelcontextprotocol/python-sdk
+    url: https://github.com/modelcontextprotocol/python-sdk
+    stars: 23650
+    spdx: MIT
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-07-17"
+    category: mcp-sdk
+    portability: mcp-protocol
+    whatToBorrow: >-
+      The Python counterpart, and cleanly MIT with no transition caveat. Its FastMCP-style
+      decorator API turns a plain function plus type hints into a schema-complete tool, which is
+      the lowest-ceremony MCP server template we can offer Python users. Borrow that as the Python
+      mcp-server scaffold.
+    whatToAvoid: >-
+      The high-level decorator API and the low-level server API coexist and are easy to mix
+      incorrectly; pick one for the template and say why. Pin the version — the API has moved.
+    proposedRegistryItems:
+      - mcp-server-template-python
+
+  - name: github/github-mcp-server
+    url: https://github.com/github/github-mcp-server
+    stars: 31532
+    spdx: MIT
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-07-18"
+    category: mcp-server
+    portability: mcp-protocol
+    whatToBorrow: >-
+      GitHub's own first-party server and the one every default MCP config should include. Its
+      standout borrowable idea is toolset gating — the ability to enable only subsets (repos,
+      issues, pull requests, actions, code security) instead of exposing the entire API surface at
+      once. That directly addresses tool-count context bloat, which is the main practical failure
+      of shipping many MCP servers by default, and Groundplan should expose the same
+      enable-a-subset control in emitted configs. Read-only mode is the right default for a
+      scaffolded config.
+    whatToAvoid: >-
+      Requires a PAT or GitHub App credential — emitted config must reference an env var and must
+      never inline a token. The full toolset is large enough to crowd a context window on its own;
+      never emit it ungated.
+    proposedRegistryItems:
+      - mcp-github
+      - mcp-toolset-gating
+      - mcp-readonly-default
+
+  - name: microsoft/playwright-mcp
+    url: https://github.com/microsoft/playwright-mcp
+    stars: 35238
+    spdx: Apache-2.0
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-07-15"
+    category: mcp-server
+    portability: mcp-protocol
+    whatToBorrow: >-
+      The browser-automation server, and the best worked argument for structured over visual
+      context: it drives pages via the accessibility tree rather than screenshots, so it works with
+      any model and costs a fraction of the tokens. Include it in any template that scaffolds a web
+      app with E2E tests. Its config surface — headless toggle, browser channel, isolated profile,
+      allowed origins — is a good model for how a Groundplan-emitted server config should expose
+      exactly the knobs that matter and no more.
+    whatToAvoid: >-
+      Pulls a full browser download; do not put it in a minimal or CI-default profile without
+      flagging the footprint. Origin allow-listing must be set deliberately — an unrestricted
+      browser tool is a real exfiltration path when combined with prompt injection.
+    proposedRegistryItems:
+      - mcp-playwright
+      - mcp-origin-allowlist
+
+  - name: crystaldba/postgres-mcp
+    url: https://github.com/crystaldba/postgres-mcp
+    stars: 3081
+    spdx: MIT
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-01-22"
+    category: mcp-server
+    portability: mcp-protocol
+    whatToBorrow: >-
+      The strongest Postgres MCP server now that the reference one is retired, and the right
+      default for any template scaffolding Postgres. Two things to borrow beyond the server itself:
+      its explicit access-control model with a genuine restricted/read-only mode, which is the
+      pattern every database MCP config Groundplan emits should default to; and its analysis
+      surface — index tuning, EXPLAIN-plan review with hypothetical indexes, and health checks for
+      index bloat, connection utilization, buffer cache, vacuum health, sequence limits and
+      replication lag. It also supports both stdio and SSE transports, useful as a two-transport
+      config example.
+    whatToAvoid: >-
+      Six months since last push — the slowest-moving MCP entry here; re-verify before making it a
+      default. Unrestricted mode allows arbitrary SQL and must never be the scaffolded default.
+      The tuning features are Postgres-specific and do not generalize to other databases.
+    proposedRegistryItems:
+      - mcp-postgres
+      - mcp-db-readonly-mode
+
+  - name: cyanheads/git-mcp-server
+    url: https://github.com/cyanheads/git-mcp-server
+    stars: 228
+    spdx: Apache-2.0
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-07-03"
+    category: mcp-server
+    portability: mcp-protocol
+    whatToBorrow: >-
+      A maintained, permissively-licensed standalone git MCP server covering the full porcelain
+      surface (status, diff, branch, commit, stash, tags, remotes) — useful as the git option in an
+      emitted config when the reference server's status is uncertain. Low star count, but the
+      license is clean and the push cadence is current.
+    whatToAvoid: >-
+      228 stars means limited external review; audit before making it a default. Write-capable git
+      tools let an agent rewrite history — scope to read-only in scaffolded configs unless the user
+      opts in explicitly.
+    proposedRegistryItems:
+      - mcp-git-standalone
+
+  - name: punkpeye/awesome-mcp-servers
+    url: https://github.com/punkpeye/awesome-mcp-servers
+    stars: 90934
+    spdx: MIT
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-07-13"
+    category: mcp-directory
+    portability: mcp-protocol
+    whatToBorrow: >-
+      The largest MCP directory that is also MIT, which makes it the one whose categorization we
+      can legally reuse. Borrow its category axis and its per-entry legend marking transport
+      (stdio/SSE), implementation language, and platform support — those are exactly the facets
+      Groundplan needs to filter servers per target tool, and reproducing them costs nothing.
+    whatToAvoid: >-
+      Scale over selectivity: inclusion signals existence, not quality or maintenance. Never
+      promote an entry to a Groundplan default on the strength of its listing here — re-verify
+      license, activity and archived status at each server's own repo.
+    proposedRegistryItems:
+      - mcp-directory-index
+      - mcp-transport-facets
+
+  - name: wong2/awesome-mcp-servers
+    url: https://github.com/wong2/awesome-mcp-servers
+    stars: 4214
+    spdx: MIT
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-07-13"
+    category: mcp-directory
+    portability: mcp-protocol
+    whatToBorrow: >-
+      A deliberately smaller, more curated MIT list. Its value relative to punkpeye is precision:
+      use the intersection of the two as a quality signal when picking which servers earn a place
+      in a default profile.
+    whatToAvoid: >-
+      Substantially narrower coverage; do not use it alone for discovery. Same caveat that listing
+      is not endorsement.
+    proposedRegistryItems: []
+
+  - name: TensorBlock/awesome-mcp-servers
+    url: https://github.com/TensorBlock/awesome-mcp-servers
+    stars: 788
+    spdx: MIT
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-07-18"
+    category: mcp-directory
+    portability: mcp-protocol
+    whatToBorrow: >-
+      Breadth at machine scale — it indexes roughly 7.7k unique server links, far more than any
+      hand-curated list, and it is MIT. Useful specifically as a coverage check: if Groundplan
+      believes no MCP server exists for some capability, query this before concluding that.
+    whatToAvoid: >-
+      Machine-assembled and effectively unfiltered; signal-to-noise is poor and dead links are
+      common. Never a source of defaults — only of candidates.
+    proposedRegistryItems: []
+
+  - name: appcypher/awesome-mcp-servers
+    url: https://github.com/appcypher/awesome-mcp-servers
+    stars: 5697
+    spdx: NONE
+    licenseClass: excluded
+    maintained: true
+    lastCommit: "2026-05-06"
+    category: mcp-directory
+    portability: mcp-protocol
+    whatToBorrow: >-
+      Nothing. Two MIT-licensed alternatives (punkpeye, wong2) cover the same ground with better
+      coverage, so there is no reason to take the risk here.
+    whatToAvoid: >-
+      No LICENSE file at main or master. Do not copy entries or categorization.
+    proposedRegistryItems: []
+
+  # ---------------------------------------------------------------- AGENTS.md exemplars
+
+  - name: github/spec-kit
+    url: https://github.com/github/spec-kit
+    stars: 122114
+    spdx: MIT
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-07-17"
+    category: workflow-kit
+    portability: agnostic
+    # Its AGENTS.md is simultaneously the best exemplar and a blueprint for our adapter layer.
+    whatToBorrow: >-
+      Two distinct assets. First, the spec-driven workflow itself — /specify -> /plan -> /tasks —
+      as the reference implementation of turning a spec into an executable agent workflow. Second,
+      and more valuable to us, AGENTS.md is the best AGENTS.md we found: rather than generic
+      house style, it documents the repo's own integration architecture and is written to be acted
+      on. It specifies how to add support for a new coding agent as a numbered procedure (choose a
+      base class, create the subpackage, register it, define context-file behavior, test install
+      and uninstall, optional overrides), and it enumerates the three command file formats the tool
+      must emit — Markdown, TOML and YAML — plus argument-passing patterns. That is precisely
+      Groundplan's 14-target problem already solved once in public. Also borrow the per-integration
+      config keys (`folder` + `commands_subdir`, e.g. .kilocode/workflows/) as the minimal
+      description of where a tool's artifacts land, and the managed-section delimiter convention
+      for editing a user's existing context file without clobbering their content. The Copilot
+      integration is the model for a target that needs several artifact kinds at once (.agent.md
+      commands, companion .prompt.md files, a .vscode/settings.json merge, and an optional skills
+      mode emitting speckit-<name>/SKILL.md under .github/skills/).
+    whatToAvoid: >-
+      Heavyweight — a Python CLI with a class hierarchy per integration; adopt the architecture, not
+      the implementation. The workflow imposes real ceremony that is overkill for small changes.
+      Extensions self-seed context-file paths from a bundled agent-context-defaults.json rather
+      than consulting the CLI registry, which is a deliberate decoupling but does mean
+      agent-to-context-file knowledge is duplicated — do not copy that split without deciding it is
+      what you want.
+    proposedRegistryItems:
+      - agents-md-exemplar-spec-kit
+      - workflow-specify
+      - workflow-plan
+      - workflow-tasks
+      - adapter-integration-contract
+      - command-format-markdown
+      - command-format-toml
+      - command-format-yaml
+      - context-file-managed-section
+      - adapter-install-uninstall-test
+
+  - name: openai/openai-agents-python
+    url: https://github.com/openai/openai-agents-python
+    stars: 27995
+    spdx: MIT
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-07-18"
+    category: agents-md
+    portability: agnostic
+    whatToBorrow: >-
+      A root AGENTS.md on a large, genuinely active production library — the useful kind of
+      exemplar, because it is maintained under real contribution pressure rather than written once
+      for show. Borrow the concrete-commands-over-prose discipline: exact setup, lint, and test
+      invocations an agent can run unmodified, which is what separates an AGENTS.md that changes
+      agent behavior from one that reads like a style guide.
+    whatToAvoid: >-
+      Content is specific to a Python SDK's toolchain; borrow the shape and the specificity, not
+      the commands. The rest of the repo is an agents framework and is out of scope for the
+      registry.
+    proposedRegistryItems:
+      - agents-md-exemplar-python-lib
+
+  # ---------------------------------------------------------------- editor rules
+
+  - name: github/awesome-copilot
+    url: https://github.com/github/awesome-copilot
+    stars: 36746
+    spdx: MIT
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-07-18"
+    category: rules-collection
+    portability: copilot-only
+    whatToBorrow: >-
+      GitHub's own MIT-licensed collection, and the single best source for the Copilot target.
+      Structurally it has already converged on the same four artifact types Groundplan emits —
+      Agents, Instructions, Skills, and Plugins (bundles of agents and skills) — documented in
+      docs/README.agents.md, docs/README.instructions.md, docs/README.skills.md and
+      docs/README.plugins.md. The most borrowable mechanism is instruction scoping by file pattern:
+      files under .github/instructions/ carry an `applyTo` glob so a rule activates only for the
+      files it concerns, instead of every rule loading into every request. That is a real answer to
+      context bloat and Groundplan should support an applyTo-equivalent in its rule schema and
+      degrade it gracefully on targets without one. cookbook/ holds copy-paste-ready API recipes,
+      and the repo has its own AGENTS.md.
+    whatToAvoid: >-
+      The applyTo mechanism, .github/copilot-instructions.md, chat modes, and the plugin format are
+      Copilot-specific — they belong behind the Copilot adapter. Very large and fast-moving; pin a
+      commit if you vendor. Trademark restrictions apply to GitHub and Copilot branding even though
+      the code is MIT.
+    proposedRegistryItems:
+      - adapter-copilot-instructions
+      - rule-applyto-glob-scoping
+      - copilot-agent-profile
+      - copilot-skill
+      - copilot-plugin-bundle
+
+  - name: PatrickJS/awesome-cursorrules
+    url: https://github.com/PatrickJS/awesome-cursorrules
+    stars: 40355
+    spdx: CC0-1.0
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-05-30"
+    category: rules-collection
+    portability: cursor-only
+    # CC0 — public domain dedication. The most permissive large collection in this file.
+    whatToBorrow: >-
+      Hundreds of per-stack rule files released into the public domain, so they can be vendored,
+      edited, and relicensed with no attribution obligation whatsoever. This is the cheapest way to
+      populate Groundplan's per-stack rule layer across React, Next.js, TypeScript, Python, Go,
+      Tailwind and the rest. The repo has moved to Cursor's .mdc Project Rules format, which is
+      worth borrowing conceptually: rule frontmatter carries a glob and a description, giving
+      Cursor the same selective-activation idea as Copilot's applyTo — strong evidence that
+      pattern-scoped rules are the converged design and should be first-class in our schema.
+    whatToAvoid: >-
+      Rule quality is wildly uneven and much of it is stack-version-specific advice that ages badly
+      — curate hard and date-stamp what you vendor. .mdc frontmatter is Cursor-specific and must be
+      stripped or remapped for other targets. Legacy single-file .cursorrules content is deprecated
+      upstream; do not emit it for new projects.
+    proposedRegistryItems:
+      - adapter-cursor-mdc
+      - rule-glob-scoping
+      - rules-per-stack-pack
+      - rule-react
+      - rule-nextjs
+      - rule-typescript
+      - rule-python
+      - rule-tailwind
+
+  - name: sanjeed5/awesome-cursor-rules-mdc
+    url: https://github.com/sanjeed5/awesome-cursor-rules-mdc
+    stars: 3553
+    spdx: CC0-1.0
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-05-19"
+    category: rules-collection
+    portability: cursor-only
+    whatToBorrow: >-
+      CC0 rules already authored natively in the .mdc format rather than converted from legacy
+      .cursorrules, so the frontmatter is consistent and machine-parseable across the whole set.
+      That consistency makes it the better bulk-import source of the two Cursor collections even
+      though it is smaller — a uniform corpus is worth more to an importer than a larger ragged one.
+    whatToAvoid: >-
+      Heavy overlap with PatrickJS/awesome-cursorrules; dedupe by target technology and keep one.
+      Generated at scale, so entries carry less human review than the star count implies.
+    proposedRegistryItems:
+      - rules-mdc-bulk-import
+
+  - name: steipete/agent-rules
+    url: https://github.com/steipete/agent-rules
+    stars: 5691
+    spdx: MIT
+    licenseClass: vendorable
+    maintained: false
+    lastCommit: "2026-05-03"
+    category: rules-collection
+    portability: agnostic
+    # ARCHIVED 2026 — vendorable, but frozen. Take what you want now; nothing more is coming.
+    whatToBorrow: >-
+      Its premise is the one that matters most to us: the same rule file should work across Claude
+      Code and Cursor rather than being authored twice. That cross-tool framing is rarer than it
+      should be, and it makes this the most portable rules source here despite being archived.
+      Borrow the shared-rule-body-plus-thin-adapter split directly.
+    whatToAvoid: >-
+      Archived — no fixes, no updates, no issue triage. Predates the Agent Skills standard, so its
+      packaging is dated even where the rule content holds up. Treat as a frozen quarry.
+    proposedRegistryItems:
+      - rule-portable-body
+      - rules-cross-tool-mapping
+
+  # ---------------------------------------------------------------- workflow methodology
+
+  - name: bmad-code-org/BMAD-METHOD
+    url: https://github.com/bmad-code-org/BMAD-METHOD
+    stars: 50775
+    spdx: MIT
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-07-18"
+    category: workflow-kit
+    portability: agnostic
+    # API reports NOASSERTION only because a contributor-attribution note is spliced into the MIT text.
+    whatToBorrow: >-
+      A large, MIT, actively-developed multi-agent methodology with a defined role set — Analyst,
+      PM, Architect, Scrum Master, Developer, QA — and, more usefully, explicit handoff artifacts
+      between them (brief -> PRD -> architecture -> sharded stories -> implementation). The sharded
+      -story pattern is the borrowable core: decompose a plan into self-contained story files that
+      each carry enough embedded context for a fresh agent session to execute without re-reading
+      the whole plan. That is a direct, practical answer to context-window limits on long tasks and
+      it is not tied to any vendor. Its installer targets many agent tools, which corroborates the
+      multi-target adapter design.
+    whatToAvoid: >-
+      Very heavy process — the full ceremony is disproportionate for small projects and will read
+      as bureaucracy if scaffolded by default; ship as an opt-in profile. Rapid, sometimes breaking
+      version churn across major releases. Expansion packs reach well beyond software into
+      unrelated domains and are out of scope.
+    proposedRegistryItems:
+      - workflow-bmad-roles
+      - workflow-prd-to-architecture
+      - workflow-sharded-stories
+      - agent-analyst
+      - agent-product-manager
+      - agent-architect
+      - agent-scrum-master
+      - agent-qa-reviewer