@raishin/vanguard-frontier-agentic 2.2.0 → 2.5.0

package/skills/dotnet/dotnet-testing-quality-review/references/workflow-and-output.md

@@ -0,0 +1,142 @@
+# Workflow and Output Contract
+
+## Workflow
+
+### Step 1 — Collect inputs
+
+Ask the user to provide one or more of the following as sanitized test source (no secrets, no connection strings, no tokens, no tenant identifiers, no customer data — replace with placeholders):
+- The test classes and fixtures under review (xUnit, NUnit, or MSTest).
+- The mock or fake setups (Moq, NSubstitute, FakeItEasy) used by those tests.
+- The integration-test harness: `WebApplicationFactory` setup, Testcontainers configuration, or shared database fixtures.
+- The coverage configuration (`coverlet` settings, `.runsettings`, `ExcludeFromCodeCoverage` usage) and any coverage gate.
+- The solution file or the CI test command, to confirm which test projects actually run.
+
+If the solution file or CI test command is not provided, suite-inclusion findings are stated as `assumption (source absent)` — say so and ask for them.
+
+### Step 2 — Assertion-quality audit
+
+Confirm each test actually asserts behavior.
+
+- A test method with no assertion — no `Assert.*`, no FluentAssertions `Should`, no `mock.Verify`, no `[ExpectedException]` / `Assert.Throws` — → HIGH. It proves nothing and inflates coverage.
+- A test that asserts only a mock's own configured return (set up `mock.Setup(x => x.Get).Returns(v)` then asserts the result equals `v`, with the real code stubbed away) → HIGH tautological test: it passes regardless of the system under test.
+- A test whose only assertion is `Assert.True(true)` or equivalent → HIGH.
+
+### Step 3 — Mocking audit
+
+Review what is mocked and what is verified.
+
+- Mocking a type the team owns that carries real logic (a domain service, a calculator, a mapper) instead of exercising it → MEDIUM over-mocking: the test verifies a stub.
+- Assertions made only against `mock.Verify(...)` with no assertion on the system's observable output, where output assertions are possible → HIGH (mock-only assertion).
+- Recommend mocking only true external boundaries (clock, network, third-party SDK) and exercising owned logic for real.
+
+### Step 4 — Coverage-gate audit
+
+Review whether the coverage number reflects tested behavior.
+
+- A coverage gate that counts generated code, migrations, or `[ExcludeFromCodeCoverage]`-marked code toward the percentage, or excludes whole assemblies to lift the number → HIGH coverage theater.
+- No coverage gate at all, where the team treats a coverage number as a quality signal → HIGH.
+- Recommend a gate scoped to hand-written production code, with exclusions justified and visible.
+
+### Step 5 — Isolation audit
+
+Review whether tests are independent.
+
+- Integration tests sharing a mutable database with no per-test isolation (no transaction rollback, no respawn/reset, no fresh container per test class) → HIGH: tests pollute each other and pass or fail by run order.
+- Tests sharing static or singleton mutable state across test classes → HIGH.
+- Tests dependent on execution order, or on data left by a prior test → HIGH flaky pattern.
+- `Thread.Sleep`-based waits in async or integration tests → MEDIUM flaky pattern; recommend deterministic waits.
+
+### Step 6 — Suite-inclusion audit
+
+Confirm every test project runs on the CI test gate.
+
+- A test project present in the repo but not referenced by the solution's test run or the CI test command → HIGH: those tests never execute on the merge gate and the coverage they claim is fictional.
+- Recommend including every test project in the CI test run, or removing it.
+
+### Step 7 — Negative- and security-test audit
+
+Review whether the dangerous paths are tested.
+
+- Only happy-path tests, with no tests for unauthorized (401), forbidden (403), invalid-input (400), not-found (404), or concurrency-conflict paths → HIGH: defects hide in the paths nobody asserts.
+- No tests asserting that an unauthenticated or under-privileged caller is rejected on protected endpoints → HIGH security-test gap.
+- Recommend explicit negative tests for each guarded path.
+
+### Step 8 — Brittleness audit
+
+- Tests asserting on private fields, internal structure, or exact log strings → MEDIUM: they break on safe refactors and train the team to ignore red.
+- Recommend asserting observable behavior through the public surface.
+
+### Step 9 — Produce the output
+
+Format findings using the Output contract section below.
+
+---
+
+## Evidence checklist
+
+Before writing findings, confirm which inputs were actually provided:
+- [ ] Test classes and fixtures
+- [ ] Mock / fake setups
+- [ ] Integration-test harness (WebApplicationFactory, Testcontainers, DB fixtures)
+- [ ] Coverage configuration and gate
+- [ ] Solution file or CI test command
+
+Each unchecked item downgrades the related findings to `inference (partial source)` or `assumption (source absent)`.
+
+---
+
+## Findings rubric
+
+| Severity | Criteria |
+|----------|----------|
+| critical | Reserved for a confirmed false-confidence pattern that demonstrably ships a known defect class with no test coverage and an explicitly disabled or excluded gate. |
+| high | Assertion-free tests; tautological mock-only tests; coverage theater or no coverage gate; shared-mutable-state integration tests; test projects excluded from the CI run; missing negative and security tests. |
+| medium | Over-mocking owned logic; brittle tests on internal structure; `Thread.Sleep`-based waits. |
+| low | Minor naming, organization, or readability issues in otherwise sound tests. |
+
+Every finding carries an evidence-basis label: `confirmed (test source provided)`, `inference (partial source)`, `assumption (source absent)`, or `unknown`.
+
+---
+
+## Output contract
+
+Return findings in this structure:
+
+```
+## Verdict
+<pass | pass-with-conditions | block>
+
+## Evidence level
+<full test source provided | partial source | documentation-based | inference>
+
+## Findings
+
+### CRITICAL
+- [C1] <finding> — <evidence basis> — <description> — <remediation>
+
+### HIGH
+- [H1] <finding> — <evidence basis> — <description> — <remediation>
+
+### MEDIUM
+- [M1] <finding> — <evidence basis> — <description> — <remediation>
+
+### LOW
+- [L1] <finding> — <evidence basis> — <description> — <remediation>
+
+## Safe next actions
+1. <action>
+2. <action>
+
+## Open questions
+- <question requiring user clarification>
+```
+
+---
+
+## Security notes
+
+- Never request or accept secrets, connection strings, tokens, tenant identifiers, or customer data. Ask for test source with placeholders.
+- This is a static review: never run the test suite, a coverage tool, or a test container; never contact live systems.
+- An assertion-free or tautological test is the highest-impact finding possible — the suite looks green and verifies nothing. Lead with it.
+- A test project excluded from the CI run is invisible lost coverage; treat it as HIGH and tell the user the claimed coverage is fictional until the project runs on the gate.
+- Never recommend raising coverage with assertion-free tests; never recommend `[Skip]`/`[Ignore]`/`[Fact(Skip=...)]` on a failing test, or disabling a failing gate, as the fix — that converts a known problem into an invisible one.

package/skills/finops/focus-spec-normalizer/references/focus-columns.md

@@ -41,14 +41,14 @@ All columns below are part of the FOCUS v1.2 specification. Required columns mus
 
 | Column | Type | Required when | Description |
 |---|---|---|---|
-| `AvailabilityZone` | String | Resource is zonal | Provider zone identifier within a region. | 
+| `AvailabilityZone` | String | Resource is zonal | Provider zone identifier within a region. |
 | `CommitmentDiscountCategory` | String (enum) | PricingCategory = Committed | Category of the commitment discount: `Spend` or `Usage`. |
 | `CommitmentDiscountId` | String | PricingCategory = Committed | Identifier of the commitment discount instrument. |
 | `CommitmentDiscountName` | String | PricingCategory = Committed | Display name of the commitment discount instrument. |
 | `CommitmentDiscountType` | String | PricingCategory = Committed | Commitment type label (e.g., `Reserved Instance`, `Savings Plan`, `Committed Use Discount`). |
 | `ContractedCost` | Decimal | Contracted price differs from list | Cost at the contracted unit price before discounts. |
 | `ContractedUnitPrice` | Decimal | Contracted price differs from list | Contracted unit price. |
-| `ResourceId` | String | Resource is identifiable | Provider resource identifier. | 
+| `ResourceId` | String | Resource is identifiable | Provider resource identifier. |
 | `ResourceName` | String | Resource has a display name | Display name of the resource. |
 | `ResourceType` | String | Resource type is classifiable | Provider-specific resource type classification. |
 | `SkuPriceId` | String | Provider publishes SKU price IDs | Provider-specific identifier for the unit price of this charge. |

package/skills/gcp/gcp-alloydb-ai-developer/SKILL.md

@@ -19,7 +19,7 @@ AlloyDB AI is a collection of features built into AlloyDB for PostgreSQL that en
 
 1. **Vector search with pgvector** — store and query embeddings using `<=>`, `<->`, `<#>` operators; HNSW and IVFFlat index types
 2. **Hybrid search** — combine pgvector cosine similarity with full-text search (tsvector/tsquery) for more relevant retrieval
-3. **AI SQL functions** — `google_ml.predict_row()`, `google_ml.embedding()`, `ai.generate_text()`, `ai.classify()`, `ai.score()` — invoke AI models from SQL without leaving the database
+3. **AI SQL functions** — `google_ml.predict_row`, `google_ml.embedding`, `ai.generate_text`, `ai.classify`, `ai.score` — invoke AI models from SQL without leaving the database
 4. **Model endpoint management** — register Vertex AI model endpoints or Gemini models as AlloyDB model resources; control access via IAM
 5. **AlloyDB Omni** — run AlloyDB (including AlloyDB AI) on-premises or at the edge in a container
 

package/skills/gcp/gcp-gemini-api-developer/SKILL.md

@@ -51,7 +51,7 @@ export GOOGLE_GENAI_USE_VERTEXAI=true
 
 ```python
 from google import genai
-client = genai.Client()  # picks up env vars automatically
+client = genai.Client  # picks up env vars automatically
 response = client.models.generate_content(
     model="gemini-3-flash-preview",
     contents="Explain transformer architecture"
@@ -84,7 +84,7 @@ Load only when needed:
 - `gemini-3.1-pro-preview` ≠ `gemini-3-pro-preview` — the latter does NOT exist; use the correct model IDs.
 - Context caching (`CachedContent`) reduces cost for repeated large contexts (system prompts, documents) — recommend it proactively for production workloads with stable large contexts.
 - For production, consult docs for stable model version aliases rather than using `-preview` models.
-- Batch prediction (`BatchJob`) is for async large-dataset inference — use it instead of looping `generate_content()` for bulk processing.
+- Batch prediction (`BatchJob`) is for async large-dataset inference — use it instead of looping `generate_content` for bulk processing.
 
 ## Official Docs
 

package/skills/hr/hr-risk-triage-review/metadata.json

@@ -2,8 +2,15 @@
   "id": "hr-risk-triage-review",
   "name": "HR Risk Triage Review",
   "type": "skill",
-  "provider": "generic",
-  "harnesses": ["codex", "claude-code", "cursor", "gemini", "kiro", "other"],
+  "provider": "hr",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
   "summary": "Adversarial HR and employment-risk triage discipline for terminations, discipline, accommodations, wage/hour, discrimination, harassment, retaliation, layoffs, and HR policy exceptions — surfaces risks, evidence gaps, and escalation paths for employment counsel. Does not give legal or HR advice.",
   "source_type": "original",
   "official_docs": [

package/skills/legal/legal-counsel-review/metadata.json

@@ -2,8 +2,15 @@
   "id": "legal-counsel-review",
   "name": "Legal Counsel Review",
   "type": "skill",
-  "provider": "generic",
-  "harnesses": ["codex", "claude-code", "cursor", "gemini", "kiro", "other"],
+  "provider": "legal",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
   "summary": "Adversarial legal-risk review discipline for contracts, privacy, regulatory, litigation, compliance, and policy-exception questions — surfaces risks, evidence gaps, decision options, and escalation paths for qualified counsel. Does not give legal advice.",
   "source_type": "original",
   "official_docs": [

package/skills/nvidia/nvidia-model-promotion-gatekeeper/SKILL.md

@@ -6,7 +6,7 @@ allowed-tools: Read Grep Glob Bash(cosign verify --certificate-identity=* --cert
 # --certificate-identity=* and --certificate-oidc-issuer=* because the exact
 # NVIDIA GitHub Actions identity URL (issuer) and signer identity vary per
 # NIM image family and release pipeline. Runtime enforcement is LOAD-BEARING:
-# the evaluate() function in tests/validate-nvidia-promotion-gatekeeper.py
+# the evaluate function in tests/validate-nvidia-promotion-gatekeeper.py
 # compares the identity/issuer returned by cosign against operator-supplied
 # expected_signer_identity and expected_oidc_issuer inputs; a mismatch adds
 # wrong_identity / wrong_issuer to verdict_reasons and blocks promotion.

package/skills/nvidia/nvidia-model-promotion-gatekeeper/references/allowlist-commands.md

@@ -40,5 +40,5 @@ Scans the candidate image and the current-prod digest. The gatekeeper computes t
 - `kubectl apply` — would mutate cluster state. The gatekeeper is read-only.
 - `cosign sign` / `cosign sign-blob` — signing is the **operator's** action after they accept the verdict, not the agent's.
 - `curl`, `wget`, `git push` — out of allowlist; egress is via cosign/crane/oras only so the egress hosts are knowable up front.
-- Any command containing `|`, `;`, `&`, `$()`, backticks, or redirections — argv allowlist enforcement at the harness layer rejects shell metacharacters.
+- Any command containing `|`, `;`, `&`, `$`, backticks, or redirections — argv allowlist enforcement at the harness layer rejects shell metacharacters.
 - Any registry prefix other than `nvcr.io/` — explicit `block` verdict, recorded reason `unknown_registry`.

package/skills/oci/oci-compute-platform-operator/SKILL.md

@@ -92,8 +92,6 @@ machine-local paths. Adapt quoting, line continuation, and environment handling
 to the user's active platform only at execution time.
 
 
-
-
 ## References
 
 Load these only when needed, following progressive disclosure:

package/skills/oci/oci-cost-finops-analyst/SKILL.md

@@ -90,8 +90,6 @@ machine-local paths. Adapt quoting, line continuation, and environment handling
 to the user's active platform only at execution time.
 
 
-
-
 ## References
 
 Load these only when needed, following progressive disclosure:

package/skills/oci/oci-database-platform-dba/SKILL.md

@@ -91,8 +91,6 @@ machine-local paths. Adapt quoting, line continuation, and environment handling
 to the user's active platform only at execution time.
 
 
-
-
 ## References
 
 Load these only when needed, following progressive disclosure:

package/skills/oci/oci-devops-container-platform-engineer/SKILL.md

@@ -91,8 +91,6 @@ machine-local paths. Adapt quoting, line continuation, and environment handling
 to the user's active platform only at execution time.
 
 
-
-
 ## References
 
 Load these only when needed, following progressive disclosure:

package/skills/oci/oci-identity-access-governor/SKILL.md

@@ -92,8 +92,6 @@ machine-local paths. Adapt quoting, line continuation, and environment handling
 to the user's active platform only at execution time.
 
 
-
-
 ## References
 
 Load these only when needed, following progressive disclosure:

package/skills/oci/oci-multi-cloud-architect/SKILL.md

@@ -109,8 +109,6 @@ machine-local paths. Adapt quoting, line continuation, and environment handling
 to the user's active platform only at execution time.
 
 
-
-
 ## References
 
 Load these only when needed, following progressive disclosure:

package/skills/oci/oci-network-architect/SKILL.md

@@ -92,8 +92,6 @@ machine-local paths. Adapt quoting, line continuation, and environment handling
 to the user's active platform only at execution time.
 
 
-
-
 ## References
 
 Load these only when needed, following progressive disclosure:

package/skills/oci/oci-observability-incident-responder/SKILL.md

@@ -87,8 +87,6 @@ machine-local paths. Adapt quoting, line continuation, and environment handling
 to the user's active platform only at execution time.
 
 
-
-
 ## References
 
 Load these only when needed, following progressive disclosure:

package/skills/oci/oci-security-compliance-reviewer/SKILL.md

@@ -90,8 +90,6 @@ machine-local paths. Adapt quoting, line continuation, and environment handling
 to the user's active platform only at execution time.
 
 
-
-
 ## References
 
 Load these only when needed, following progressive disclosure:

package/skills/oci/oci-solution-architect/SKILL.md

@@ -106,8 +106,6 @@ machine-local paths. Adapt quoting, line continuation, and environment handling
 to the user's active platform only at execution time.
 
 
-
-
 ## References
 
 Load these only when needed, following progressive disclosure:
@@ -229,7 +227,7 @@ oci monitoring alarm list --compartment-id <compartment_id> --all
 3.
 
 ## Open questions
-- 
+-
 ```
 
 ## Red Flags

package/skills/oci/oci-storage-backup-steward/SKILL.md

@@ -86,8 +86,6 @@ machine-local paths. Adapt quoting, line continuation, and environment handling
 to the user's active platform only at execution time.
 
 
-
-
 ## References
 
 Load these only when needed, following progressive disclosure:

package/skills/prometheus/prometheus-alerting-cardinality-review/SKILL.md

@@ -33,7 +33,7 @@ Load these only when needed:
 ## Response minimum
 Return, at minimum:
 - Cardinality risk assessment (label audit findings)
-- Alert expression correctness findings (for: duration, absent() misuse, MWMB posture)
+- Alert expression correctness findings (for: duration, absent misuse, MWMB posture)
 - AlertManager routing and inhibition findings
 - Scrape config security findings
 - Retention and remote_write findings

package/skills/prometheus/prometheus-alerting-cardinality-review/references/workflow-and-output.md

@@ -21,7 +21,7 @@ Check for:
 - Labels sourced from high-cardinality application dimensions:
   - `user_id`, `request_id`, `session_id`, `transaction_id`, `trace_id`
   - `url_path`, `uri`, `endpoint` (unless aggressively normalized)
-  - `pod` or `container` labels used as primary grouping in `sum by()` without aggregation
+  - `pod` or `container` labels used as primary grouping in `sum by` without aggregation
 - Use of `__` internal labels in user-facing metric names
 
 Example cardinality risk:
@@ -43,7 +43,7 @@ Note the `prometheus_tsdb_head_series` threshold: above 5 million series, TSDB m
 Check whether recording rules exist for:
 - SLO error-rate expressions that appear in alerting rules
 - High-cardinality aggregation queries used in Grafana dashboards
-- Any `rate()` or `increase()` expression over a window longer than 5 minutes that is queried at sub-minute dashboard refresh
+- Any `rate` or `increase` expression over a window longer than 5 minutes that is queried at sub-minute dashboard refresh
 
 Flag absence of recording rules for any expression that appears more than once across rules files as MEDIUM.
 
@@ -76,9 +76,9 @@ For every `alert:` rule, check:
   for: 5m
 ```
 
-**4b. `absent()` usage**
+**4b. `absent` usage**
 - `absent(some_metric)` fires if `some_metric` was never scraped — review whether the metric is always expected to exist
-- If the metric only appears when the condition is active (e.g., an error counter), `absent()` fires in the absence of errors, which is a false positive
+- If the metric only appears when the condition is active (e.g., an error counter), `absent` fires in the absence of errors, which is a false positive
 
 **4c. SLO alerting pattern**
 - MWMB (multi-window multi-burn-rate) is the Google SRE-recommended SLO alerting pattern

package/skills/qa/ci-test-pipeline-review/references/workflow-and-output.md

@@ -59,7 +59,7 @@ steps:
 
 - No upload of test results (JUnit XML) and failure artifacts (traces, screenshots, videos, logs) → HIGH. A CI-only failure is then undebuggable; engineers re-run blindly hoping for green.
 - Artifacts uploaded only on success, or retention too short to investigate → MEDIUM.
-- Recommended: upload JUnit XML always, and traces/screenshots/logs `if: failure()`.
+- Recommended: upload JUnit XML always, and traces/screenshots/logs `if: failure`.
 
 ### Step 7 — Quarantine-lane audit
 

package/skills/qa/llm-ai-pipeline-test-review/references/workflow-and-output.md

@@ -114,7 +114,7 @@ For pipelines that include LLM agents, confirm the eval measures agent behavior,
 # missing TaskCompletionMetric
 
 # Correct — both agent metrics present
-tool_correctness = ToolCorrectnessMetric()
+tool_correctness = ToolCorrectnessMetric
 task_completion = TaskCompletionMetric(threshold=0.8)
 agent_test_case = LLMTestCase(
     input=user_request,

package/skills/qa/playwright-e2e-suite-review/SKILL.md

@@ -16,17 +16,17 @@ metadata:
 This skill reviews a Playwright end-to-end test suite for the defects that destroy CI trust at scale: flakiness, brittle selectors, broken test isolation, and unreliable CI configuration. A flaky E2E suite is worse than no suite — engineers learn to re-run failures instead of reading them, real regressions ship behind a green-after-retry checkmark, and the suite stops gating anything. The review catches hard waits, manual non-retrying assertions, implementation-coupled selectors, shared mutable state across tests, and retry/sharding misconfiguration before they erode confidence in the deploy pipeline.
 
 ## Lean operating rules
-- Treat any use of `page.waitForTimeout()` / `waitForTimeout` in a spec (not a debugging branch) as HIGH — fixed sleeps are the single largest source of Playwright flakiness; they either race the app or pad every run.
-- Treat manual non-retrying assertions (`expect(await locator.isVisible()).toBe(true)`, `expect(await locator.textContent()).toBe(...)`) as HIGH — they snapshot a single instant and lose Playwright's auto-retry; use web-first assertions (`await expect(locator).toBeVisible()`).
+- Treat any use of `page.waitForTimeout` / `waitForTimeout` in a spec (not a debugging branch) as HIGH — fixed sleeps are the single largest source of Playwright flakiness; they either race the app or pad every run.
+- Treat manual non-retrying assertions (`expect(await locator.isVisible).toBe(true)`, `expect(await locator.textContent).toBe(...)`) as HIGH — they snapshot a single instant and lose Playwright's auto-retry; use web-first assertions (`await expect(locator).toBeVisible`).
 - Treat selectors bound to implementation detail — deep CSS chains, nth-child indexes, generated/hashed class names, raw XPath — as HIGH for brittleness; prefer role-, label-, text-, or `data-testid`-based locators.
-- Treat tests that depend on ordering or share mutable state (module-level variables mutated across `test()` blocks, a record created in test A read in test B) as HIGH — they break under parallelism, sharding, and `--shuffle`, and produce non-reproducible failures.
+- Treat tests that depend on ordering or share mutable state (module-level variables mutated across `test` blocks, a record created in test A read in test B) as HIGH — they break under parallelism, sharding, and `--shuffle`, and produce non-reproducible failures.
 - Treat `retries` set greater than 0 in CI with no flaky-test surfacing (no trace-on-retry, no flaky reporter, no quarantine) as HIGH — retries then silently mask real flakiness instead of buying time to fix it.
 - Treat `trace`/`screenshot`/`video` all disabled in the CI project as HIGH — a CI-only failure with no trace is undebuggable and forces blind re-runs.
 - Treat absolute waits on network (`waitForLoadState('networkidle')`) used as a general synchronization crutch as MEDIUM — it is fragile under analytics/polling; wait on the specific element or response instead.
 - Treat shared `storageState` / auth fixtures mutated by tests, or login performed inside every test instead of via a setup project, as MEDIUM — slow and a cross-test contamination risk.
 - Treat a single un-sharded CI job for a large suite, or `fullyParallel: false` without a stated reason, as MEDIUM — wall-clock time blocks every deploy.
 - Treat `expect` timeouts or global `timeout` raised well above default to make a suite "pass" as MEDIUM — masks a real slow path or race.
-- Do not recommend deleting or `.skip()`-ing a flaky test as the fix without a root-cause category and a quarantine/tracking path.
+- Do not recommend deleting or `.skip`-ing a flaky test as the fix without a root-cause category and a quarantine/tracking path.
 - Label every finding with evidence basis: spec/config text provided, documentation-based, or inference from absent configuration.
 
 ## References

package/skills/qa/playwright-e2e-suite-review/references/workflow-and-output.md

@@ -26,20 +26,20 @@ await page.click('#submit');
 `waitForTimeout` is for debugging only. It either fires before the app is ready (flake) or pads every run (slow). Replace with an action or web-first assertion that auto-waits:
 ```ts
 // CORRECT — auto-waits for the element to be actionable
-await page.getByRole('button', { name: 'Submit' }).click();
+await page.getByRole('button', { name: 'Submit' }).click;
 ```
 
 **2b. Manual non-retrying assertions**
 ```ts
 // HIGH — snapshots one instant, no auto-retry
-expect(await page.getByText('welcome').isVisible()).toBe(true);
+expect(await page.getByText('welcome').isVisible).toBe(true);
 ```
 Web-first assertions retry until the condition holds or the timeout expires:
 ```ts
 // CORRECT
-await expect(page.getByText('welcome')).toBeVisible();
+await expect(page.getByText('welcome')).toBeVisible;
 ```
-Flag any `expect(await ...)` wrapping `isVisible()`, `textContent()`, `innerText()`, `count()`, `getAttribute()` as HIGH.
+Flag any `expect(await ...)` wrapping `isVisible`, `textContent`, `innerText`, `count`, `getAttribute` as HIGH.
 
 **2c. Network-idle as a synchronization crutch**
 ```ts
@@ -48,9 +48,9 @@ await page.waitForLoadState('networkidle');
 ```
 `networkidle` is discouraged for general synchronization. Wait on the specific signal instead:
 ```ts
-await expect(page.getByRole('heading', { name: 'Dashboard' })).toBeVisible();
+await expect(page.getByRole('heading', { name: 'Dashboard' })).toBeVisible;
 // or
-await page.waitForResponse(r => r.url().includes('/api/orders') && r.ok());
+await page.waitForResponse(r => r.url.includes('/api/orders') && r.ok);
 ```
 
 ### Step 3 — Selector brittleness audit
@@ -64,7 +64,7 @@ Review the locator strategy in every spec and page object.
 | deep CSS chain (`div > div:nth-child(3) .btn`) | HIGH | breaks on any layout change |
 | hashed/generated class (`.css-1a2b3c`, `.MuiBox-root`) | HIGH | regenerated on every build |
 | raw XPath (`//div[2]/span`) | HIGH | brittle, hard to read |
-| `nth()` / index-based selection on dynamic lists | MEDIUM | breaks when list order or length changes |
+| `nth` / index-based selection on dynamic lists | MEDIUM | breaks when list order or length changes |
 
 Flag each HIGH locator with the spec file and the recommended role/label/test-id replacement.
 
@@ -73,17 +73,17 @@ Flag each HIGH locator with the spec file and the recommended role/label/test-id
 Verify each test is independent and order-free.
 
 Check for:
-- Module-level mutable variables written by one `test()` and read by another → HIGH
+- Module-level mutable variables written by one `test` and read by another → HIGH
 - A test that creates a record (user, order) consumed by a later test → HIGH (breaks under sharding and `--shuffle`)
-- `test.describe.serial()` used to paper over a shared-state dependency rather than for a genuine sequential flow → HIGH
+- `test.describe.serial` used to paper over a shared-state dependency rather than for a genuine sequential flow → HIGH
 - `beforeAll` performing mutable setup that tests then modify without reset → MEDIUM
 - Shared `storageState` file written to by tests → MEDIUM (cross-test auth contamination)
 
 ```ts
 // HIGH — test B depends on test A's side effect
 let createdOrderId;
-test('creates order', async () => { createdOrderId = await createOrder(); });
-test('views order', async () => { await page.goto(`/orders/${createdOrderId}`); });
+test('creates order', async  => { createdOrderId = await createOrder; });
+test('views order', async  => { await page.goto(`/orders/${createdOrderId}`); });
 
 // CORRECT — each test owns its data via a fixture
 test('views order', async ({ orderFixture }) => {
@@ -172,5 +172,5 @@ Return findings in this structure:
 
 - Never request or accept live application URLs with embedded credentials, bearer tokens, real `storageState.json`, or `.env` contents. Ask for sanitized snippets.
 - This is a static review: do not run `npx playwright test`, launch browsers, or contact the application under test.
-- Do not recommend `.skip()` or deleting a flaky test as the fix — every flaky test needs a root-cause category (race, hard wait, shared state, brittle selector) and a quarantine/tracking path so it is fixed, not buried.
+- Do not recommend `.skip` or deleting a flaky test as the fix — every flaky test needs a root-cause category (race, hard wait, shared state, brittle selector) and a quarantine/tracking path so it is fixed, not buried.
 - Do not recommend raising timeouts or adding retries to make a suite "go green" — both mask defects the review exists to surface.

package/skills/qa/plc-control-logic-safety-review/references/workflow-and-output.md

@@ -142,7 +142,7 @@ Flag any timer pattern that increments a counter every scan and compares to a li
 ScanCounter := ScanCounter + 1;
 IF ScanCounter >= 500 THEN  (* intended: 500 scans * assumed 10ms = 5s *)
     ScanCounter := 0;
-    TimeoutAction();
+    TimeoutAction;
 END_IF;
 ```
 
@@ -152,7 +152,7 @@ Correct pattern:
 (* Real-time timer — deterministic regardless of scan load *)
 DelayTimer(IN := TriggerCondition, PT := T#5s);
 IF DelayTimer.Q THEN
-    TimeoutAction();
+    TimeoutAction;
 END_IF;
 ```
 

package/skills/qa/test-coverage-quality-review/SKILL.md

@@ -18,7 +18,7 @@ This skill reviews a test suite for whether its tests would actually catch a reg
 ## Lean operating rules
 - Treat a test with no assertion — it calls the code, no error is thrown, the test passes — as HIGH. Line coverage counts it; it verifies nothing.
 - Treat tautological assertions (`expect(true).toBe(true)`, `expect(result).toBe(result)`, snapshot tests auto-updated on every change without review) as HIGH — they cannot fail when behavior changes.
-- Treat assertions that only check shape, not value (`expect(result).toBeDefined()`, `expect(res.status).toBeTruthy()`, `expect(arr.length).toBeGreaterThan(0)`) where an exact value is knowable as MEDIUM — they pass for wrong values.
+- Treat assertions that only check shape, not value (`expect(result).toBeDefined`, `expect(res.status).toBeTruthy`, `expect(arr.length).toBeGreaterThan(0)`) where an exact value is knowable as MEDIUM — they pass for wrong values.
 - Treat tests that assert the mock was called but never assert the result computed from it as HIGH — they test the wiring, not the behavior.
 - Treat over-mocked unit tests where every collaborator is mocked and the assertions only restate the mock setup as HIGH — the test is a mirror of itself and proves nothing about integration.
 - Treat the absence of error-path, empty-input, and boundary tests for code that has those branches as HIGH — the happy path inflates the coverage number while real failure modes are untested.

package/skills/qa/test-coverage-quality-review/references/workflow-and-output.md

@@ -18,12 +18,12 @@ For every test, confirm it makes at least one assertion that can fail.
 
 ```js
 // HIGH — no assertion; passes as long as nothing throws
-test('processes the order', async () => {
+test('processes the order', async  => {
   await processOrder(sampleOrder);
 });
 
 // CORRECT — asserts the observable outcome
-test('processes the order', async () => {
+test('processes the order', async  => {
   const result = await processOrder(sampleOrder);
   expect(result.status).toBe('confirmed');
   expect(result.total).toBe(149.97);
@@ -38,7 +38,7 @@ Grade each assertion.
 | Assertion pattern | Grade | Note |
 |---|---|---|
 | exact value (`toBe(149.97)`, `toEqual({...})`) | strong | fails on any wrong value |
-| `toBeDefined()`, `not.toBeNull()`, `toBeTruthy()` | weak (MEDIUM) | passes for wrong values; use when an exact value is unknowable only |
+| `toBeDefined`, `not.toBeNull`, `toBeTruthy` | weak (MEDIUM) | passes for wrong values; use when an exact value is unknowable only |
 | `toBeGreaterThan(0)`, `length > 0` | weak (MEDIUM) | passes for `[wrong, wrong]` |
 | `expect(true).toBe(true)`, `expect(x).toBe(x)` | tautological (HIGH) | cannot fail |
 | auto-updated snapshot of logic output | weak (MEDIUM) | detects change, not correctness |
@@ -52,9 +52,9 @@ Review tests that use mocks, stubs, or spies.
 **4a. Call-assertion-only**
 ```js
 // HIGH — asserts the mock was called, never the behavior
-test('sends the email', async () => {
+test('sends the email', async  => {
   await notifyUser(user);
-  expect(emailService.send).toHaveBeenCalled();
+  expect(emailService.send).toHaveBeenCalled;
 });
 ```
 This verifies wiring, not outcome. It should also assert *what* was sent and the result the caller depends on.
@@ -62,9 +62,9 @@ This verifies wiring, not outcome. It should also assert *what* was sent and the
 **4b. Over-mocking**
 ```js
 // HIGH — every collaborator mocked; assertions restate the setup
-const repo = { find: jest.fn().mockReturnValue({ id: 1, price: 10 }) };
-const tax = { calc: jest.fn().mockReturnValue(2) };
-test('total', () => {
+const repo = { find: jest.fn.mockReturnValue({ id: 1, price: 10 }) };
+const tax = { calc: jest.fn.mockReturnValue(2) };
+test('total',  => {
   const t = new Cart(repo, tax).total(1);
   expect(t).toBe(12); // 10 + 2 — but both came from mocks
 });

package/skills/qa/test-flakiness-triage/SKILL.md

@@ -21,7 +21,7 @@ This skill triages flaky tests — tests that pass and fail without a code chang
 - Treat "re-run until green" CI configuration (automatic unlimited retries, `|| true`, retry-the-whole-job) with no flaky tracking as HIGH — it converts flakiness from visible to invisible and unbounded.
 - Treat a flaky test "fixed" only by adding a sleep, raising a timeout, or adding a retry as HIGH — the root cause is still present and will resurface.
 - Treat tests sharing a mutable fixture, database row, file, or port without per-test isolation as HIGH for interdependence flakiness.
-- Treat assertions on wall-clock time, `Date.now()`, timezone, or locale without injection/freezing as HIGH for environment coupling.
+- Treat assertions on wall-clock time, `Date.now`, timezone, or locale without injection/freezing as HIGH for environment coupling.
 - Treat un-mocked calls to third-party services in a unit or component test as HIGH — network and rate limits make them flaky by construction.
 - Treat a quarantine with no expiry, no owner, and no tracking issue as MEDIUM — quarantine is a holding cell, not a graveyard; without an exit it becomes permanent coverage loss.
 - Treat the absence of any flaky-detection mechanism (no rerun-diff, no flaky reporter, no quarantine list) as MEDIUM — flakiness is then discovered only by frustrated engineers.

package/skills/qa/test-flakiness-triage/references/workflow-and-output.md

@@ -21,7 +21,7 @@ Place every flaky test into exactly one **primary** category. Note secondary con
 |---|---|---|
 | Async / timing race | fails under load or on slower CI runners; passes locally; "element not found", "undefined" | wait on a deterministic signal, not a sleep; await the actual condition |
 | Test interdependence | fails only in a specific order; passes when run alone; passes with `--shuffle` off | per-test fixtures; isolate DB rows / files / state; remove cross-test writes |
-| Environment coupling | fails at certain times of day, in CI timezone, or on a different locale | inject and freeze the clock; pin timezone and locale; no real `Date.now()` in assertions |
+| Environment coupling | fails at certain times of day, in CI timezone, or on a different locale | inject and freeze the clock; pin timezone and locale; no real `Date.now` in assertions |
 | Non-deterministic data | fails when random/seeded data hits an edge; date-dependent assertions | seed RNG; use fixed fixtures; freeze "today" |
 | Resource contention | fails under parallelism; port/DB/file conflicts; "address in use", deadlock | unique ports/schemas per worker; bound parallelism; isolate resources |
 | External dependency | fails on third-party outage, rate limit, or latency; un-mocked network | mock at the boundary in unit/component tests; contract-test the integration separately |