@pratikpsl/agent-skills 1.3.0 → 1.4.0

package/README.md

@@ -113,7 +113,7 @@ Options:
 | `dotnet` | `templates/dotnet/` | .NET/C# skills, architecture & developer agents (`architect.md`, `developer.md`), memory |
 | `python` | `templates/python/` | Python skills (PEP 8, uv, typing, testing, performance), architecture & developer agents (`architect.md`, `developer.md`) |
 | `react` | `templates/react/` | React & TypeScript skills, frontend testing, developer agent (`developer.md`) |
-| `rust` | `templates/rust/` | Rust skills (ownership, best-practices, testing, performance), architecture & developer agents (`architect.md`, `developer.md`) |
+| `rust` | `templates/rust/` | Rust skills (standards, ownership, testing, performance), architecture & developer agents (`architect.md`, `developer.md`) |
 | `default` | `templates/default/` | Compact single-file agent instructions without AgentSkills folder |
 
 ---

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@pratikpsl/agent-skills",
   "type": "module",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "description": "CLI to scaffold and manage AI agent skills across projects — like shadcn/ui, but for Cursor, Claude, Codex, Copilot, Antigravity, and more",
   "bin": {
     "agent-skills": "dist/bin/agent-skills.js"

package/templates/default/instructions.md

@@ -34,9 +34,10 @@ minimizing the diff, following the project's own architecture and conventions.
 - Maximum 2 levels of nesting; prefer early returns to flatten control flow.
 
 ## Definition of Done
-- Builds cleanly without any errors.
+- Lint, types, and the framework build are clean.
+- Tests are added or run only when the user asks, and they pass when run.
 - No debug code, dead code, unused imports, or temporary files left behind.
-- Changes are minimal, focused, covered by tests, and easy to review.
+- Changes are minimal, focused, and easy to review.
 
 ## Agent Memory
 - Read `AgentSkills/memory/index.md` at the start of every task (create if missing); load only relevant domain lessons.

package/templates/dotnet/AgentSkills/skills/dotnet-standards/SKILL.md

@@ -0,0 +1,68 @@
+---
+name: dotnet-standards
+description: >
+  Load on every C# or .NET change. AI agents use this when writing, reviewing,
+  refactoring, or optimizing C# for standards and implementation: project
+  conventions, CQRS, EF Core, DI lifetimes, async, logging, validation, and maintainability.
+compatibility: Requires the .NET SDK declared by the repository (Directory.Build.props, default net10.0). Build with dotnet build.
+---
+
+# C# and .NET Standards
+
+AI agents load this file on every C# or .NET edit, with shared principles and standards. Apply these rules while writing.
+
+## Repository Defaults & Structure
+- Follow target framework and language versions in `Directory.Build.props` (default `net10.0`, `LangVersion` `latest`).
+- Add XML documentation comments for public and shared API surfaces.
+- Organize code by feature or domain slices. Place controllers, handlers, validators, repositories, and DTOs in that slice.
+- Prefer clear, direct code over speculative patterns (YAGNI).
+
+## CQRS & Architecture
+- **Commands**: Mutate state. Return void, an identifier, or a minimal result.
+- **Queries**: Read state only.
+- **Thin endpoints**: Validate transport concerns and dispatch to a handler.
+- **Domain logic**: Keep rules in domain entities or domain services.
+- **Immutability**: Use `record` for commands, queries, and DTOs. Mark classes `sealed` unless inheritance is designed.
+- **Interfaces**: Define an interface for a boundary that needs a test double, more than one implementation, or an out-of-process call.
+
+## Dependency Injection & Lifetimes
+- Use constructor injection or a primary constructor for required dependencies.
+- Register the narrowest lifetime: `Singleton` for stateless thread-safe services, `Scoped` for a request and for `DbContext`, `Transient` for a lightweight stateless operation.
+- Do not resolve services from `IServiceProvider`, and do not add static global state.
+
+## Async & I/O
+- Use `async`/`await` for I/O, database, network, and file work.
+- Do not block with `.Result`, `.Wait()`, or `.GetAwaiter().GetResult()`.
+- Accept and pass `CancellationToken` through handlers, EF Core, and outbound HTTP.
+- `async void` only for a top-level event handler.
+
+## EF Core & Data Access
+- Avoid N+1 queries with a projection, `.Include()`, or a separate query.
+- Use `.AsNoTracking()` for a read-only query.
+- Select the columns the caller needs. Do not load a full tracked entity for a DTO.
+- Paginate, filter, and sort on the server.
+- Prefer `AnyAsync()` to test existence. Use `ExecuteUpdateAsync` and `ExecuteDeleteAsync` for bulk changes.
+
+## Logging, HTTP, validation
+- Log with a message template and named properties. Do not log secrets, passwords, connection strings, or PII.
+- Propagate the correlation id. Do not log inside a tight loop.
+- Use `IHttpClientFactory`, an explicit timeout, and the caller's `CancellationToken`. Retry transient failures with a bounded backoff.
+- Validate inbound payloads with FluentValidation or data annotations. Do not concatenate user input into SQL, a shell command, or a file path.
+
+## Review Checklist
+- [ ] Read-only EF Core queries use `.AsNoTracking()`. No N+1 queries.
+- [ ] Callers receive a DTO projection, not a tracked entity graph.
+- [ ] Async methods take a `CancellationToken` and do not block.
+- [ ] `DbContext` is `Scoped`.
+- [ ] Logs are structured and contain no secrets.
+- [ ] Input is validated at the boundary.
+- [ ] `dotnet build` is clean.
+
+## Verify
+After C# edits, run the framework build and fix what it reports:
+
+```bash
+dotnet build
+```
+
+Add or run tests only when the user asks. Then load `csharp-xunit` and run `dotnet test`.

package/templates/dotnet/AgentSkills/skills/index.md

@@ -8,7 +8,7 @@ Consult this index to load only the skills relevant to the current task.
 | standards | AgentSkills/skills/standards/SKILL.md | Code quality, 50-line limits, shallow nesting, clean signatures |
 | security | AgentSkills/skills/security/SKILL.md | Input validation, secrets handling, safe queries, least privilege |
 | review | AgentSkills/skills/review/SKILL.md | Code review framework, five review dimensions, verification rules |
-| dotnet-best-practices | AgentSkills/skills/dotnet-best-practices/SKILL.md | C# idioms, CQRS, EF Core, DI lifetimes, async/await, logging |
+| dotnet-standards | AgentSkills/skills/dotnet-standards/SKILL.md | Load on every C# or .NET change. CQRS, EF Core, DI, async, logging |
 | dotnet-api | AgentSkills/skills/dotnet-api/SKILL.md | RESTful API design, HTTP methods, pagination, OpenAPI/Swagger |
 | csharp-xunit | AgentSkills/skills/csharp-xunit/SKILL.md | xUnit testing, AAA pattern, Facts vs Theories, mocking, assertions |
 | performance | AgentSkills/skills/performance/SKILL.md | Span/ReadOnlySpan, ValueTask, EF Core query tuning, memory pooling |

package/templates/python/AgentSkills/skills/index.md

@@ -8,7 +8,6 @@ Consult this index to load only the skills relevant to the current task.
 | standards | AgentSkills/skills/standards/SKILL.md | Code quality, 50-line limits, shallow nesting, clean signatures |
 | security | AgentSkills/skills/security/SKILL.md | Input validation, secrets handling, safe queries, least privilege |
 | review | AgentSkills/skills/review/SKILL.md | Code review framework, five review dimensions, verification rules |
-| python-best-practices | AgentSkills/skills/python-best-practices/SKILL.md | PEP 8 conventions, uv project setup, ruff, async patterns, logging |
-| python-typing | AgentSkills/skills/python-typing/SKILL.md | Strict static typing, mypy/pyright, pydantic models, Protocol, TypeVar |
+| python-standards | AgentSkills/skills/python-standards/SKILL.md | Load on every Python change. PEP 8, typing, uv, ruff, async, logging |
 | testing | AgentSkills/skills/testing/SKILL.md | pytest, pytest-asyncio, hypothesis property testing, fixtures, mocks |
 | performance | AgentSkills/skills/performance/SKILL.md | cProfile/memray, generators, asyncio concurrency, connection pooling |

package/templates/python/AgentSkills/skills/python-standards/SKILL.md

@@ -0,0 +1,72 @@
+---
+name: python-standards
+description: >
+  Load on every Python change. AI agents use this when writing, reviewing,
+  refactoring, or optimizing Python for standards, typing, and implementation:
+  PEP 8, uv, ruff, mypy or pyright, pydantic, Protocol, TypeVar, Literal,
+  TypedDict, async I/O, errors, logging, and maintainability.
+compatibility: Requires Python 3.11+ and uv. Lint and types use ruff and mypy, or pyright when the project already uses it. pydantic for models that cross a boundary.
+---
+
+# Python Standards
+
+AI agents load this file on every Python edit, with shared principles and standards. Apply these rules while writing.
+
+## Naming (PEP 8)
+- Modules, packages, functions, variables: `snake_case`
+- Classes: `PascalCase`. Constants: `UPPER_SNAKE_CASE`. Non-public: `_prefix`
+- Use dunder names only for language protocols
+
+## Project
+- Manage the project with `uv` (`uv add`, `uv sync`, `uv run`). Do not `pip install` into the global environment.
+- Put project metadata and tool config in `pyproject.toml`. Commit `uv.lock`.
+
+## Types
+- First statement of every module: `from __future__ import annotations`
+- Annotate every parameter, return, and class attribute. Write `-> None` when a function returns nothing.
+- Do not use `Any`. Use `object`, a bounded `TypeVar`, or `Literal` for a closed set of values.
+- Prefer `Protocol` for injectable behavior. Use `type` aliases on 3.12+, otherwise `TypeAlias`.
+- `TypedDict` for an external dict shape. `pydantic.BaseModel` for data that crosses a layer. `ConfigDict(frozen=True)` for value objects.
+- Validate at the outer boundary (API, CLI, queue), then pass models inward.
+- Enable strict checking. Minimum ruff selection is `E`, `F`, `I`, `UP`, `ANN`.
+
+```toml
+[tool.mypy]
+strict = true
+
+[tool.ruff.lint]
+select = ["E", "F", "I", "UP", "ANN"]
+```
+
+If the repository already uses pyright, keep pyright on strict mode instead of adding mypy.
+
+## Async, errors, logging
+- Use `async`/`await` for I/O. Inside `async def`, do not call `time.sleep`, sync `open`, or a sync client.
+- Run independent tasks in `asyncio.TaskGroup`. Re-raise `asyncio.CancelledError`.
+- Domain errors subclass one project base. Catch the narrowest type. Do not use a bare `except`.
+- Use `contextlib.suppress` only for an error the caller intends to ignore.
+- Log with `structlog` or JSON `logging`. No `print` on a production path.
+- Bind request and user ids on the request logger. Never log secrets, tokens, or PII.
+
+## Review Checklist
+- [ ] Names follow PEP 8.
+- [ ] `uv` manages dependencies. `pyproject.toml` and `uv.lock` are current.
+- [ ] Every signature is annotated. No unexplained `Any`.
+- [ ] Boundary data is a pydantic model. External dicts use `TypedDict`.
+- [ ] Async functions do no blocking I/O. `CancelledError` is re-raised.
+- [ ] Exceptions are narrow. Logs are structured and contain no secrets.
+- [ ] `ruff` and the type checker are clean.
+
+## Verify
+After Python edits, run lint, types, and the framework build. Fix what they report:
+
+```bash
+uv run ruff check
+uv run ruff format --check
+uv run mypy
+uv build
+```
+
+Use `uv run pyright` instead of mypy when that is the repository checker. When `pyproject.toml` has no build backend, run `uv run python -m compileall` on the source tree instead of `uv build`.
+
+Add or run tests only when the user asks. Then load the `testing` skill and run `uv run pytest`.

package/templates/react/AgentSkills/skills/index.md

@@ -8,6 +8,6 @@ Consult this index to load only the skills relevant to the current task.
 | standards | AgentSkills/skills/standards/SKILL.md | Code quality, 50-line limits, shallow nesting, clean signatures |
 | security | AgentSkills/skills/security/SKILL.md | Input validation, secrets handling, safe queries, least privilege |
 | review | AgentSkills/skills/review/SKILL.md | Code review framework, five review dimensions, verification rules |
-| react-typescript | AgentSkills/skills/react-typescript/SKILL.md | React & TypeScript props typing, custom hooks, discriminated unions |
+| react-typescript | AgentSkills/skills/react-typescript/SKILL.md | Load on every React, TypeScript, or JavaScript change. Strict types, props, hooks |
 | testing | AgentSkills/skills/testing/SKILL.md | Vitest & React Testing Library, user-event, test coverage |
 | performance | AgentSkills/skills/performance/SKILL.md | Render optimization, lazy loading, state colocation, memoization |

package/templates/react/AgentSkills/skills/react-typescript/SKILL.md

@@ -1,22 +1,44 @@
 ---
 name: react-typescript
-description: React & TypeScript component typing, custom hook design, and type-safe state modeling.
+description: >
+  Load on every React, TypeScript, or JavaScript change. AI agents use this
+  when writing, reviewing, or refactoring React, TypeScript, and JavaScript:
+  strict types, component props, discriminated unions, custom hooks, and forms.
+compatibility: Requires TypeScript with strict enabled and React 18 or newer. Typecheck with tsc --noEmit and lint with the project's ESLint.
 ---
 
-# React & TypeScript Guidance
+# React and TypeScript Standards
 
-## Type Design & Component Contracts
-- Define strict prop interfaces; avoid `any` or loose `Record<string, unknown>`.
-- Use discriminated unions for distinct component states (e.g., `{ status: 'loading' } | { status: 'success'; data: T } | { status: 'error'; error: Error }`).
-- Explicitly type event handlers and custom hook return values (use `as const` for tuple returns).
+AI agents load this file on every React, TypeScript, or JavaScript edit, with shared principles and standards. Apply these rules while writing.
 
-## Custom Hook Guidelines
-- Encapsulate reusable stateful logic into focused custom hooks prefixed with `use`.
-- Keep hook parameter signatures clean (maximum 4 arguments; use options objects for complex configurations).
-- Pass `AbortSignal` to asynchronous functions initiated inside hooks for safe cancellation.
-- Return only stable handlers, derived state, and minimal state setters required by callers.
+## TypeScript
+- Keep `strict` enabled. Do not use `any`. Use `unknown` and narrow it.
+- Export the props type and the return type of every public component and hook.
 
-## Form & Input Patterns
-- Prefer controlled inputs for dynamic form validation; use native form actions where appropriate.
-- Bind labels to inputs using `htmlFor` and `id` generated via `useId` for SSR safety.
-- Handle disabled, aria-invalid, and error message associations (`aria-describedby`) for robust UX.
+## Component Contracts
+- Type props with an interface or type alias. Avoid a loose `Record<string, unknown>`.
+- Model states that differ in shape as a discriminated union (`{ status: "loading" } | { status: "success"; data: T } | { status: "error"; error: Error }`).
+- Type event handlers. For a hook tuple return, use `as const`.
+
+## Custom Hooks
+- Put reusable state in a hook named `useSomething`.
+- Keep the parameter list to four. Pass an options object past that.
+- Pass an `AbortSignal` into async work started by the hook.
+- Return stable handlers, derived state, and only the setters the caller needs.
+
+## Forms
+- Use a controlled input when validation is dynamic. Use a native form action when the platform covers it.
+- Bind each label with `htmlFor` and an `id` from `useId`.
+- Wire `aria-invalid` and `aria-describedby` to the error message.
+
+## Review Checklist
+- [ ] `strict` is on. New code has no `any`.
+- [ ] States with different shapes use a discriminated union.
+- [ ] Hooks start with `use`, stay within four parameters, and return stable values.
+- [ ] Async work in a hook accepts an `AbortSignal`.
+- [ ] Inputs have labels, and errors are referenced with `aria-describedby`.
+
+## Verify
+After TypeScript, JavaScript, or React edits, run the project's typecheck, ESLint, and framework build. Fix what they report.
+
+Add or run tests only when the user asks. Then load the `testing` skill and run the project's test script.

package/templates/rust/AgentSkills/skills/index.md

@@ -8,7 +8,6 @@ Consult this index to load only the skills relevant to the current task.
 | standards | AgentSkills/skills/standards/SKILL.md | Code quality, 50-line limits, shallow nesting, clean signatures |
 | security | AgentSkills/skills/security/SKILL.md | Input validation, secrets handling, safe queries, least privilege |
 | review | AgentSkills/skills/review/SKILL.md | Code review framework, five review dimensions, verification rules |
-| rust-best-practices | AgentSkills/skills/rust-best-practices/SKILL.md | API guidelines, cargo clippy/fmt, thiserror/anyhow, tracing logging |
-| rust-ownership | AgentSkills/skills/rust-ownership/SKILL.md | Ownership, borrowing, lifetimes, Arc/Mutex, Send+Sync safety |
+| rust-standards | AgentSkills/skills/rust-standards/SKILL.md | Load on every Rust change. Ownership, clippy, thiserror, tracing |
 | testing | AgentSkills/skills/testing/SKILL.md | cargo test, tokio::test, proptest property testing, mockall |
 | performance | AgentSkills/skills/performance/SKILL.md | criterion benchmarking, zero-copy parsing, allocation reduction |

package/templates/rust/AgentSkills/skills/rust-standards/SKILL.md

@@ -0,0 +1,52 @@
+---
+name: rust-standards
+description: >
+  Load on every Rust change. AI agents use this when writing, reviewing,
+  refactoring, or optimizing Rust for standards, ownership, and implementation:
+  API naming, rustfmt, clippy, thiserror, anyhow, tracing, Cargo layout,
+  borrowing, lifetimes, Arc/Mutex, and Send + Sync.
+compatibility: Requires a stable Rust toolchain and Cargo. Format and lint use rustfmt and clippy. thiserror for library errors, anyhow for applications, tracing for logs.
+---
+
+# Rust Standards
+
+AI agents load this file on every Rust edit, with shared principles and standards. Apply these rules while writing.
+
+## Naming
+- Types and traits: `PascalCase`. Functions, methods, variables, modules: `snake_case`.
+- Constants and statics: `UPPER_SNAKE_CASE`. Lifetimes: a short lowercase name (`'a`).
+- Library crate names: `snake_case`. Package names in `Cargo.toml`: `kebab-case`.
+- Document public items with `///`.
+
+## Ownership
+- One owner at a time. Many shared borrows (`&T`) or one mutable borrow (`&mut T`), never both.
+- Add a lifetime only when elision cannot see it. Prefer owned `String` and `Vec` in public APIs.
+- `Arc<Mutex<T>>` for shared mutable state. `Arc<RwLock<T>>` when reads dominate. Drop the guard before `.await`.
+- Prefer a channel when the work is producer and consumer. No `Rc` or `Cell` across threads.
+- Do not `clone()` to silence the borrow checker. Restructure the ownership.
+
+## Errors, logging, dependencies
+- Libraries: `thiserror`. Applications: `anyhow` with `context`.
+- No `unwrap()` or `expect()` on a production path. Return `Result` and use `?`. Reserve `panic!` for a programmer bug.
+- Log with `tracing`. Attach fields with `#[tracing::instrument]`. No `println!` in production. Never log secrets.
+- Add a crate only when the standard library does not cover the job. Dev-only crates go in `[dev-dependencies]`.
+- Set `default-features = false` when the crate supports it.
+
+## Review Checklist
+- [ ] `cargo fmt --check` and `cargo clippy -- -D warnings` are clean.
+- [ ] No `unwrap()`, `expect()`, or borrow-checker `clone()` in production code.
+- [ ] Lifetimes appear only where elision fails. Guards drop before `.await`.
+- [ ] Library errors use `thiserror`. Application errors use `anyhow`.
+- [ ] `tracing` is used. Logs contain no secrets. Public items have `///` docs.
+- [ ] `cargo audit` reports no known vulnerabilities.
+
+## Verify
+After Rust edits, run format, clippy, and the framework build. Fix what they report:
+
+```bash
+cargo fmt --check
+cargo clippy -- -D warnings
+cargo build
+```
+
+Add or run tests only when the user asks. Then load the `testing` skill and run `cargo test`.

package/templates/shared/AgentSkills/OPERATING.md

@@ -5,11 +5,11 @@
 2. **Role & Skill Discovery**: Consult `AgentSkills/skills/index.md` to identify and load task-specific skills from `AgentSkills/skills/` (including `AgentSkills/skills/review/SKILL.md`). Load relevant role guidance from `AgentSkills/agents/` (`architect.md`, `reviewer.md`, `developer.md`).
 3. **Pre-flight Inspection**: Inspect current codebase patterns, dependencies, and baseline build/test state.
 4. **Surgical Implementation**: Apply the minimal change required; adhere strictly to DRY, KISS, and YAGNI.
-5. **Verification**: Run the project's build and test commands (e.g. `npm test`, `dotnet test`, `cargo test`, `uv run pytest`, or project test suite) to verify happy paths and edge cases per `AgentSkills/skills/review/SKILL.md`.
+5. **Verification**: Run the language skill's lint, type feedback, and framework build, and fix what they report. Add or run tests only when the user asks. Follow `AgentSkills/skills/review/SKILL.md`.
 6. **Learning Loop**: If a mistake was made and corrected or a durable rule discovered, record a concise lesson in `AgentSkills/memory/lessons/<domain>.md` and update `index.md`.
 
 ## Completion Checklist
-- [ ] Project builds cleanly with zero errors or warnings.
-- [ ] Automated tests pass and cover failure paths and edge cases.
+- [ ] Lint, types, and the framework build are clean.
+- [ ] Tests were added or run only because the user asked. They pass when run.
 - [ ] No dead code, debug logging, unused imports, or temporary files remain.
 - [ ] Relevant documentation or memory lessons updated if applicable.

package/templates/shared/AgentSkills/agents/reviewer.md

@@ -14,10 +14,9 @@ Universal review guidance for AI agents and human reviewers across all stacks. S
 - **Review**: Adhere strictly to `AgentSkills/skills/review/SKILL.md`.
 
 ## Verification & Automated Checks
-- [ ] **Clean Build**
-- [ ] **Zero Lint Errors**
-- [ ] **Tests Pass**
-- [ ] **Test Robustness**
+- [ ] **Lint, types, and framework build**
+- [ ] **Tests** added or run only when the user asks
+- [ ] **Test Robustness** when the user asked for tests
 
 ## Standards & Skill Compliance
 - [ ] **Principles**: `AgentSkills/skills/principles/SKILL.md`

package/templates/shared/AgentSkills/skills/principles/SKILL.md

@@ -27,5 +27,5 @@ Bug fix = root cause, not symptom. A bug report names a symptom. Grep every call
 - **Think Before Coding**: Thoroughly understand requirements. If ambiguous, ask before guessing.
 - **Surgical Changes**: Make the smallest change that satisfies the request; touch only what is explicitly required.
 - **Simplicity First (KISS / YAGNI)**: Favor simple, clear, maintainable solutions over clever abstractions. Do not add unrequested features.
-- **Zero-Error Builds**: Every change must compile cleanly and pass existing and newly added tests.
+- **Build**: Run the language framework build and fix what it reports before finishing. Add or run tests only when the user asks.
 - **Standards, Security & Review**: Adhere strictly to `AgentSkills/skills/standards/SKILL.md`, `AgentSkills/skills/security/SKILL.md`, and `AgentSkills/skills/review/SKILL.md`.

package/templates/shared/AgentSkills/skills/review/SKILL.md

@@ -15,9 +15,8 @@ Universal review framework and verification standards for AI agents and human re
 5. **Performance**: Avoid N+1 queries, unbounded loops, blocking operations in async flows, and redundant re-computations.
 
 ## Verification & Automated Checks
-- [ ] **Clean Build**: Project builds cleanly with zero errors or warnings.
-- [ ] **Zero Lint Errors**: Code adheres to project formatting and static analysis rules.
-- [ ] **Tests Pass**: Run test suite; all existing and newly added tests must pass.
+- [ ] **Lint, types, and build**: Formatting, static checks, and the language framework build are clean.
+- [ ] **Tests**: Add or run tests only when the user asks. When run, they pass.
 - [ ] **Test Robustness**: Tests must cover failure paths, edge cases, and boundary conditions, not just happy paths.
 
 ## Review Output Format

package/templates/shared/entry-points/instructions.md

@@ -17,12 +17,13 @@ minimizing the diff, following the project's own architecture, standards, and co
 - **Think Before Coding**: Thoroughly understand requirements. If ambiguous, ask before guessing.
 - **Surgical Changes**: Make the smallest change that satisfies the request; touch only what is explicitly required.
 - **Simplicity First (KISS / YAGNI)**: Favor simple, clear, maintainable solutions over clever abstractions. Do not add unrequested features.
-- **Zero-Error Builds**: Every change must compile cleanly and pass existing and newly added tests.
+- **Build**: Run the language framework build and fix what it reports before finishing. Add or run tests only when the user asks.
 
 ## Definition of Done
-- Builds cleanly without any errors.
+- Lint, types, and the framework build are clean.
+- Tests are added or run only when the user asks, and they pass when run.
 - No debug code, dead code, unused imports, or temporary files left behind.
-- Changes are minimal, focused, covered by tests, and easy to review.
+- Changes are minimal, focused, and easy to review.
 
 ## Agent & Contributor Memory
 - Read `AgentSkills/memory/index.md` at the start of every task (create if missing); load only relevant domain lessons.

package/templates/dotnet/AgentSkills/skills/dotnet-best-practices/SKILL.md

@@ -1,79 +0,0 @@
----
-name: dotnet-best-practices
-description: >
-  Load when writing, reviewing, refactoring, or optimizing .NET/C# code.
-  Covers project conventions, CQRS, EF Core, async, testing, performance,
-  logging, security, and maintainability.
----
-
-# .NET/C# Best Practices
-
-Use this skill to keep .NET/C# changes simple, maintainable, testable, and aligned with repository conventions.
-
-## Repository Defaults & Structure
-- Follow target framework and language versions in `Directory.Build.props` (default `net10.0`, `LangVersion` `latest`).
-- Add XML documentation comments for public/shared API surfaces.
-- Organize code by feature or domain slices; place controllers, handlers, validators, repositories, and DTOs predictably.
-- Prefer clear, direct code over complex or speculative patterns (YAGNI).
-
-## CQRS & Architecture
-- **Commands**: Mutate state; return void, an identifier, or a minimal result.
-- **Queries**: Read state only; never mutate data.
-- **Thin Endpoints**: Keep controllers and minimal API endpoints thin; validate transport concerns and dispatch via mediator handlers.
-- **Domain Logic**: Encapsulate domain rules in domain entities or domain services, never in transport handlers.
-- **Immutability**: Use `record` for commands, queries, and DTOs; mark classes `sealed` unless inheritance is intentionally designed.
-- **Interfaces**: Define interfaces for boundaries requiring testing, multiple implementations, or out-of-process integration.
-
-## Dependency Injection & Lifetimes
-- Use constructor injection or primary constructors for required dependencies.
-- Register services with the narrowest appropriate lifetime:
-  - `Singleton`: Stateless, thread-safe services.
-  - `Scoped`: Request-bound services and EF Core `DbContext`.
-  - `Transient`: Lightweight, stateless operations.
-- Avoid resolving services manually via `IServiceProvider` or introducing static global state.
-
-## Async & I/O
-- Use `async`/`await` for all I/O, database, network, and file operations.
-- Never block async code using `.Result`, `.Wait()`, or `.GetAwaiter().GetResult()`.
-- Accept and propagate `CancellationToken` through all handler, EF Core, and outbound HTTP calls.
-- Avoid `async void` except for top-level event handlers.
-
-## EF Core & Data Access
-- Avoid N+1 queries by using explicit projections, `.Include()`, or separate optimized queries.
-- Use `.AsNoTracking()` for all read-only queries.
-- Select only needed columns into DTOs instead of loading full tracked entities.
-- Implement server-side pagination, filtering, and sorting; never filter unbounded sets in memory.
-- Prefer `AnyAsync()` over `CountAsync()` when testing for existence.
-- Use `ExecuteUpdateAsync` and `ExecuteDeleteAsync` for bulk operations where appropriate.
-
-## Logging & Observability
-- Use structured logging with message templates and named properties (`LogInformation("Order {OrderId} processed", id)`).
-- Avoid logging inside tight loops or hot execution paths.
-- Propagate correlation/request IDs across service and HTTP boundaries.
-- Never log secrets, passwords, connection strings, or sensitive personal data (PII).
-
-## HTTP & Resilient Integration
-- Use `IHttpClientFactory` for outbound HTTP calls.
-- Set explicit timeouts and pass cancellation tokens to all HTTP calls.
-- Use bounded retries with exponential backoff for transient failures; avoid unbounded retry storms.
-- Batch outbound requests rather than making external calls inside tight loops.
-
-## Security & Validation
-- Validate all incoming request payloads using FluentValidation or Data Annotations.
-- Never concatenate raw user input into SQL queries, shell commands, or file paths.
-- Follow the principle of least privilege for database connections and external service credentials.
-
-## Testing Standards
-- Use xUnit for unit and integration testing.
-- Structure tests using Arrange-Act-Assert (AAA).
-- Test happy paths, edge cases, validation failures, and cancellation flows.
-- Keep tests isolated, deterministic, and idempotent.
-
-## Review Checklist
-- [ ] No N+1 queries; read-only EF Core queries use `.AsNoTracking()`.
-- [ ] DTO projections used; no full entity graphs exposed to callers.
-- [ ] Async methods propagate `CancellationToken` without blocking.
-- [ ] DI lifetimes correctly configured (`Scoped` for DbContext).
-- [ ] Structured logging used without leaking sensitive data or secrets.
-- [ ] Input validation applied at boundaries.
-- [ ] Tests pass and cover edge cases.

package/templates/python/AgentSkills/skills/python-best-practices/SKILL.md

@@ -1,59 +0,0 @@
----
-name: python-best-practices
-description: >
-  Load when writing, reviewing, refactoring, or optimizing Python code.
-  Covers PEP conventions, uv project management, async patterns, error handling,
-  structured logging, and maintainability.
----
-
-# Python Best Practices
-
-## Naming Conventions (PEP 8)
-- **Modules & packages**: `snake_case` (`user_service.py`, `auth/`)
-- **Functions & variables**: `snake_case` (`get_user`, `is_valid`)
-- **Classes**: `PascalCase` (`UserService`, `OrderRepository`)
-- **Constants**: `UPPER_SNAKE_CASE` (`MAX_RETRIES`, `DEFAULT_TIMEOUT`)
-- **Private members**: single underscore prefix (`_internal_helper`)
-- **Dunder methods**: reserved for Python protocols (`__init__`, `__repr__`)
-
-## Project Setup with uv
-```bash
-uv init my-project          # scaffold pyproject.toml, src layout
-uv add fastapi pydantic      # add runtime dependencies
-uv add --dev pytest mypy ruff  # add dev dependencies
-uv sync                      # install from uv.lock
-uv run pytest                # run commands in the managed venv
-```
-- Always use `uv`; never run bare `pip install` against the global environment.
-- Declare all metadata in `pyproject.toml` (`[project]`, `[build-system]`, tool configs).
-
-## Code Quality & Formatting
-- Use `ruff` for linting and formatting (replaces `flake8`, `isort`, `black`).
-- Enable `ruff` rules `E`, `F`, `I`, `UP`, `ANN` at minimum in `pyproject.toml`.
-- Run `mypy --strict` in CI; no type errors are acceptable in production code.
-
-## Async & I/O
-- Use `async`/`await` for all I/O-bound operations (HTTP, database, file, queue).
-- Never call blocking functions (`time.sleep`, `open()`, sync DB calls) inside an async context; use their async equivalents.
-- Use `asyncio.TaskGroup` (Python 3.11+) for structured concurrent tasks.
-- Propagate `asyncio.CancelledError`; never catch it without re-raising.
-
-## Error Handling
-- Define domain-specific exception classes inheriting from a project base (`AppError`).
-- Catch the narrowest exception type possible; never use bare `except:` or `except Exception:` without logging and re-raising.
-- Use `contextlib.suppress` only for explicitly expected, recoverable errors.
-
-## Logging
-- Use structured logging (`structlog` or `logging` with a JSON formatter) — never `print()` in production code.
-- Bind contextual fields (request IDs, user IDs) to the logger at request scope.
-- Never log secrets, tokens, passwords, or PII.
-
-## Review Checklist
-- [ ] All names follow PEP 8 conventions.
-- [ ] `uv` used for dependency management; `pyproject.toml` up to date.
-- [ ] No bare `pip install` or unpinned dependencies.
-- [ ] `ruff` passes with zero errors.
-- [ ] `mypy --strict` passes with zero errors.
-- [ ] No blocking calls inside `async` functions.
-- [ ] Structured logging used; no `print()` statements remain.
-- [ ] Narrow exception handling; no silent swallowing of errors.

package/templates/python/AgentSkills/skills/python-typing/SKILL.md

@@ -1,42 +0,0 @@
----
-name: python-typing
-description: >
-  Load when writing or reviewing Python code. Covers strict static typing with mypy/pyright,
-  pydantic data models, Protocol, TypeVar, Literal, and TypedDict patterns.
----
-
-# Python Static Typing
-
-## Module Setup
-- Add `from __future__ import annotations` as the first import in every module to enable postponed evaluation of annotations (PEP 563).
-- Enable strict mode in `pyproject.toml`:
-  ```toml
-  [tool.mypy]
-  strict = true
-  warn_return_any = true
-  disallow_untyped_defs = true
-  ```
-
-## Function & Variable Annotations
-- Annotate every function parameter, return type, and class attribute without exception.
-- Use `None` as an explicit return type for functions that return nothing; never omit the annotation.
-- Avoid `Any` — use `object` for truly unknown types, or narrow with generics and `TypeVar`.
-
-## Type Constructs
-- **`TypeAlias`**: Use `type Alias = ...` (Python 3.12+) or `TypeAlias` from `typing` for readable compound types.
-- **`Protocol`**: Prefer structural subtyping (`Protocol`) over ABCs for dependency injection and testability.
-- **`TypeVar` / `ParamSpec`**: Use for generic functions and decorators; constrain with `bound=` where applicable.
-- **`Literal`**: Use `Literal["value"]` to narrow string/int constants in type signatures.
-- **`TypedDict`**: Use for dict shapes at external boundaries (JSON, config); prefer `pydantic.BaseModel` for mutable internal models.
-
-## Pydantic Models
-- Define all data contracts as `pydantic.BaseModel` subclasses; never pass raw `dict` across layer boundaries.
-- Use `model_config = ConfigDict(frozen=True)` for immutable value objects.
-- Validate external inputs at the outermost boundary (API, CLI, queue consumer) before passing into application logic.
-
-## Review Checklist
-- [ ] `from __future__ import annotations` present in every module.
-- [ ] No `Any` without a documented justification comment.
-- [ ] All function signatures fully annotated (parameters + return).
-- [ ] Pydantic models used at all data boundaries.
-- [ ] `mypy --strict` passes with zero errors.

package/templates/rust/AgentSkills/skills/rust-best-practices/SKILL.md

@@ -1,48 +0,0 @@
----
-name: rust-best-practices
-description: >
-  Load when writing, reviewing, refactoring, or optimizing Rust code.
-  Covers naming conventions, clippy/rustfmt enforcement, error handling with
-  thiserror/anyhow, structured logging with tracing, and Cargo workspace layout.
----
-
-# Rust Best Practices
-
-## Naming Conventions (Rust API Guidelines)
-- **Types & Traits**: `PascalCase` (`UserRepository`, `Deserialize`)
-- **Functions, methods, variables, modules**: `snake_case` (`get_user`, `user_service`)
-- **Constants & statics**: `UPPER_SNAKE_CASE` (`MAX_CONNECTIONS`, `DEFAULT_TIMEOUT`)
-- **Lifetime parameters**: short lowercase single letters (`'a`, `'db`)
-- **Crates**: `snake_case` for library crates, `kebab-case` in `Cargo.toml` names
-
-## Tooling Discipline
-- **Format**: `cargo fmt` — enforce in CI with `cargo fmt --check`.
-- **Lint**: `cargo clippy -- -D warnings` — all warnings are errors in CI; suppress individually only with a comment explaining the justification.
-- **Audit**: `cargo audit` — run in CI to catch known vulnerabilities in dependencies.
-- **Build**: `cargo check` for fast feedback; `cargo build --release` for benchmarks and deployment.
-
-## Error Handling
-- Use `thiserror` to define typed, domain-specific errors for library crates.
-- Use `anyhow` for application-level error aggregation and context chaining (`context()`, `with_context()`).
-- Never use `unwrap()` or `expect()` in production paths; propagate with `?`.
-- Return `Result<T, E>` from all fallible functions; reserve `panic!` for truly unrecoverable programmer errors.
-
-## Logging & Observability
-- Use `tracing` for structured, async-aware logging: `tracing::info!`, `tracing::error!`, `tracing::instrument`.
-- Attach contextual fields with `#[tracing::instrument(fields(user_id = %id))]`.
-- Initialize the subscriber once at the application entry point (`tracing_subscriber::fmt::init()`).
-- Never log secrets, tokens, passwords, or sensitive personal data.
-
-## Dependency Management
-- Minimize external dependencies; evaluate the maintenance status and license before adding a new crate.
-- Add dev-only dependencies under `[dev-dependencies]` in `Cargo.toml`.
-- Use feature flags to keep the dependency graph lean (`default-features = false`).
-
-## Review Checklist
-- [ ] `cargo fmt --check` passes.
-- [ ] `cargo clippy -- -D warnings` passes with zero warnings.
-- [ ] No `unwrap()` / `expect()` in non-test production code.
-- [ ] `thiserror` used for library errors; `anyhow` for application errors.
-- [ ] Structured `tracing` logging used; no `println!` in production.
-- [ ] `cargo audit` passes; no known vulnerabilities.
-- [ ] All public API items documented with `///` doc comments.

package/templates/rust/AgentSkills/skills/rust-ownership/SKILL.md

@@ -1,40 +0,0 @@
----
-name: rust-ownership
-description: >
-  Load when writing or reviewing Rust code. Covers ownership, borrowing, lifetimes,
-  shared-state concurrency with Arc/Mutex, and Send + Sync safety.
----
-
-# Rust Ownership & Borrowing
-
-## Core Rules
-- A value has exactly one owner at a time; ownership transfers on move.
-- Borrow immutably (`&T`) as many times as needed, or mutably (`&mut T`) exactly once — never both simultaneously.
-- References must never outlive the value they point to; the compiler enforces this via lifetimes.
-
-## Lifetime Annotations
-- Add explicit lifetime annotations (`'a`) only when the compiler cannot infer them — let elision work first.
-- For structs that hold references, annotate struct lifetime parameters and bound them on the relevant fields.
-- Prefer owned types (`String`, `Vec<T>`) over references in public APIs to avoid lifetime propagation into callers.
-
-## Shared State
-- Use `Arc<Mutex<T>>` for shared mutable state across threads; use `Arc<RwLock<T>>` when reads dominate.
-- Lock mutexes for the shortest scope possible; never hold a lock across an `.await` point.
-- Prefer message-passing (`tokio::sync::mpsc`, `std::sync::mpsc`) over shared state when tasks are naturally producer/consumer.
-
-## Send & Sync
-- Ensure types shared across thread boundaries implement `Send + Sync`; the compiler enforces this.
-- Avoid `Rc<T>` and `Cell<T>` in async or multi-threaded contexts; use `Arc` and `Mutex` instead.
-- Use `#[derive(Clone)]` sparingly on types that are expensive to clone; document where clones occur.
-
-## Common Pitfalls
-- Never use `unwrap()` or `expect()` in production paths — propagate errors with `?` instead.
-- Avoid `clone()` as a workaround for borrow-checker conflicts; restructure ownership or use a reference instead.
-- Do not hold a `MutexGuard` across an `await` point — drop it explicitly before awaiting.
-
-## Review Checklist
-- [ ] No `unwrap()` / `expect()` in non-test production code.
-- [ ] No `clone()` used to paper over borrow-checker issues.
-- [ ] Explicit lifetime annotations present only where elision fails.
-- [ ] `Mutex` guards released before any `.await` points.
-- [ ] `Arc<Mutex<T>>` used for all cross-thread mutable state.