@raishin/vanguard-frontier-agentic 3.3.0 → 3.5.0

package/catalog/skills.json

@@ -9727,6 +9727,410 @@
     "author": "github: Raishin",
     "version": "0.1.0"
   },
+  {
+    "id": "java-application-server-exit",
+    "name": "java-application-server-exit",
+    "type": "skill",
+    "provider": "java",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Board-legible replatform-vs-renew exit call for a proprietary Java app-server and Oracle-JDK estate: synthesizes specialist findings (JDK lifecycle, jakarta debt, EJB/JAX-WS/SOAP, container-readiness) and user costs into per-component modernize/rehost/replatform/retire decisions plus a wave plan; refuses payback without supplied costs. Reads reports and sanitized costs only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://www.oracle.com/middleware/weblogic/",
+      "https://www.ibm.com/support/pages/lifecycle",
+      "https://access.redhat.com/support/policy/updates/jboss_notes",
+      "https://jakarta.ee/about/faq/"
+    ],
+    "security_notes": "Static review only — reads inventory exports, specialist agent reports, sanitized configuration, and user-supplied cost figures; never builds, runs, invokes a JDK, or contacts a live application server, license-management system, or vendor account. Never requests or embeds licence pricing, subscription tiers, contract terms, or customer/tenant headcount — those are user-supplied inputs only, never assumed or hardcoded.",
+    "last_verified": "2026-07-17",
+    "path": "skills/java/java-application-server-exit",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "java-concurrency-and-virtual-thread",
+    "name": "java-concurrency-and-virtual-thread",
+    "type": "skill",
+    "provider": "java",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of virtual-thread adoption correctness at scale: pooling/capping anti-patterns, a VT migration that strips a downstream resource bound without re-imposing a Semaphore, JDK-version-gated carrier pinning (JEP 444 vs JEP 491), ThreadLocal cost at scale, StructuredTaskScope preview status, and classic executor/visibility hygiene. Reads source and sanitized configuration only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://openjdk.org/jeps/444",
+      "https://openjdk.org/jeps/491",
+      "https://openjdk.org/jeps/0",
+      "https://docs.oracle.com/en/java/javase/"
+    ],
+    "security_notes": "Static review only — reads Java source (Thread.ofVirtual/newVirtualThreadPerTaskExecutor call sites, ExecutorService construction, synchronized blocks, ThreadLocal usage) and sanitized configuration (pool-size properties, rate-limiter config, any JFR/trace text the user pastes as plain text); never runs a build, invokes a JDK, attaches a profiler or JFR recorder, or opens a live thread dump/DB/broker connection. Never requests connection strings, credentials, tenant identifiers, or customer data.",
+    "last_verified": "2026-07-17",
+    "path": "skills/java/java-concurrency-and-virtual-thread",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "java-container-and-kubernetes-readiness",
+    "name": "java-container-and-kubernetes-readiness",
+    "type": "skill",
+    "provider": "java",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Statically reviews JVM-in-container ergonomics for Kubernetes workloads — heap-to-limit sizing and off-heap headroom, ActiveProcessorCount vs CPU limits, and GC-pause-vs-probe-timeout interaction that a generic pod-spec review misses. Reads source and sanitized configuration only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.oracle.com/en/java/javase/21/gctuning/index.html",
+      "https://docs.oracle.com/en/java/javase/",
+      "https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/",
+      "https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/"
+    ],
+    "security_notes": "Static review of source, Dockerfiles, JVM flags/env, GC logs, and sanitized Kubernetes manifests or Helm values only; never opens a JDK, runs or profiles the workload, or reads live /proc or cgroup filesystem state. Never requests or accepts connection strings, credentials, tenant identifiers, cluster kubeconfigs, or customer data — ask for sanitized excerpts with placeholders.",
+    "last_verified": "2026-07-17",
+    "path": "skills/java/java-container-and-kubernetes-readiness",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "java-database-migration-safety",
+    "name": "java-database-migration-safety",
+    "type": "skill",
+    "provider": "java",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of Flyway/Liquibase migration PRs for rolling/blue-green deploy safety — immutable applied-migration discipline, expand-contract phasing for drops/renames, destructive DDL landing in the same release that stops using it, long-locking DDL on large tables, and out-of-order/non-idempotent migration hazards. Reads migration files and sanitized schema/config only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://flywaydb.org/documentation/",
+      "https://flywaydb.org/documentation/concepts/migrations",
+      "https://docs.liquibase.com/",
+      "https://docs.liquibase.com/concepts/changelogs/home.html"
+    ],
+    "security_notes": "Static review only — reads migration scripts (Flyway versioned/repeatable SQL or Java migrations) or Liquibase changelogs (XML/YAML/JSON/SQL), sanitized DDL/schema snapshots, and the application source that reads or writes the affected columns; never opens a database connection, runs a migration, or queries live schema state. Never requests connection strings, database credentials, tenant identifiers, or customer data — ask for migration files and schema snapshots with placeholders.",
+    "last_verified": "2026-07-17",
+    "path": "skills/java/java-database-migration-safety",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "java-deserialization-and-parser-security",
+    "name": "Java Deserialization and Parser Security Review",
+    "type": "skill",
+    "provider": "java",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of untrusted-deserialization and parser RCE surface on the JVM — Java native ObjectInputStream gadget chains, SnakeYAML bare Constructor, Jackson polymorphic default typing without a validator, and XML external-entity (XXE) exposure. Reads source and sanitized configuration only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://owasp.org/www-community/vulnerabilities/Deserialization_of_untrusted_data",
+      "https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html",
+      "https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html",
+      "https://github.com/FasterXML/jackson-databind/wiki/JacksonPolymorphicDeserialization"
+    ],
+    "security_notes": "Static review only — reads source, deserialization/parsing call sites, and sanitized configuration; never executes code, deserializes a payload, or contacts a live system. Never requests secrets, tokens, or customer data.",
+    "last_verified": "2026-07-17",
+    "path": "skills/java/java-deserialization-and-parser-security",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "java-framework-production-readiness",
+    "name": "java-framework-production-readiness",
+    "type": "skill",
+    "provider": "java",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review issuing a single ship / do-not-ship production-readiness verdict for a Spring Boot, Quarkus, or Micronaut service against a framework-specific checklist (config, health/liveness/readiness, graceful shutdown, jakarta namespace + JDK floor, build-time DI/AOT safety, config validation, BOM alignment). Reads source and sanitized configuration only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.spring.io/spring-boot/",
+      "https://quarkus.io/guides/",
+      "https://docs.micronaut.io/latest/guide/",
+      "https://jakarta.ee/specifications/"
+    ],
+    "security_notes": "Static review only — reads build files (pom.xml/build.gradle), application.properties/application.yml and profile variants, source annotations, and CI/Dockerfile config; never builds, runs, invokes a JDK, opens a database/broker connection, or contacts a live health endpoint. Never requests live secret values, connection strings, credentials, tenant identifiers, or customer data — ask for sanitized files with values redacted/placeholdered. Framework EOL/support-window facts are fail-closed: cited from the companion skill's verified reference or marked unknown, never asserted from memory.",
+    "last_verified": "2026-07-17",
+    "path": "skills/java/java-framework-production-readiness",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "java-jdk-lifecycle-and-upgrade",
+    "name": "Java JDK Lifecycle and Upgrade Review",
+    "type": "skill",
+    "provider": "java",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of a Java estate's JDK lifecycle and upgrade posture — vendor/version identification, support and license-boundary exposure (cited from verified reference data, never memory), language/API upgrade blockers, and a phased, evidence-gated upgrade path. Reads build files and source only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://www.oracle.com/java/technologies/java-se-support-roadmap.html",
+      "https://openjdk.org/projects/jdk/",
+      "https://adoptium.net/support/",
+      "https://docs.oracle.com/en/java/javase/"
+    ],
+    "security_notes": "Static review only — reads build files, toolchain/CI config, Dockerfile base images, and source; never runs a build, invokes a JDK, or contacts a live system. Never requests license keys, account identifiers, or contract/pricing data. Vendor lifecycle dates are cited from the verified reference (primary source = the vendor roadmap), never asserted from memory.",
+    "last_verified": "2026-07-17",
+    "path": "skills/java/java-jdk-lifecycle-and-upgrade",
+    "version": "0.2.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "java-jpa-hibernate-performance",
+    "name": "Java JPA/Hibernate Performance Review",
+    "type": "skill",
+    "provider": "java",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of JPA/Hibernate data access for fetch-strategy correctness and reliability — N+1 exposure, JOIN FETCH vs @EntityGraph vs @BatchSize vs DTO projection, LazyInitializationException and open-in-view misuse, pagination-with-fetch cartesian products, and HikariCP pool sizing. Reads source and mapping only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.jboss.org/hibernate/orm/current/userguide/html_single/Hibernate_User_Guide.html",
+      "https://jakarta.ee/specifications/persistence/",
+      "https://docs.spring.io/spring-data/jpa/reference/",
+      "https://github.com/brettwooldridge/HikariCP/wiki/About-Pool-Sizing"
+    ],
+    "security_notes": "Static review only — reads entity classes, mappings, repository/query code, and sanitized configuration; never opens a database connection, runs a query, or executes migrations. Never requests connection strings, database credentials, tenant identifiers, or customer data.",
+    "last_verified": "2026-07-17",
+    "path": "skills/java/java-jpa-hibernate-performance",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "java-jvm-performance-and-gc",
+    "name": "java-jvm-performance-and-gc",
+    "type": "skill",
+    "provider": "java",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of proposed JVM GC/performance changes for evidence — collector selection (G1/ZGC/Generational ZGC/Shenandoah/Parallel), allocation pressure, heap-sizing flags, and OOM/leak triage from user-supplied GC logs, JFR, and heap-dump analysis output. Refuses GC-switch recommendations without pause-time evidence. Reads source and sanitized configuration only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.oracle.com/en/java/javase/",
+      "https://openjdk.org/jeps/248",
+      "https://openjdk.org/jeps/439",
+      "https://openjdk.org/projects/shenandoah/"
+    ],
+    "security_notes": "Static review only — reads Java/Kotlin source, JVM startup-flag configuration (launch scripts, Dockerfiles, systemd units, K8s manifests), and user-supplied GC logs, JFR recordings, and heap-dump analysis output (dominator-tree/leak-suspects text, not a raw .hprof binary). Never opens a live process, attaches a profiler or debugger, invokes a JDK tool against a running JVM, or requests/opens a live heap dump. Never requests credentials, connection strings, tenant identifiers, or customer data — ask for sanitized excerpts with placeholders.",
+    "last_verified": "2026-07-17",
+    "path": "skills/java/java-jvm-performance-and-gc",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "java-kafka-reliability",
+    "name": "Java Kafka Reliability Review",
+    "type": "skill",
+    "provider": "java",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Statically reviews whether a Kafka pipeline delivers the semantics it claims — idempotence-vs-exactly-once conflation, exactly-once wiring, at-least-once with(out) idempotent consumers, commit ordering, in-flight ordering, consumer lag as the SLA signal, rebalance stalls, DLQ/retry design, and acks/min.insync.replicas durability. Reads source and sanitized configuration only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://kafka.apache.org/documentation/",
+      "https://kafka.apache.org/documentation/#semantics",
+      "https://docs.spring.io/spring-kafka/reference/"
+    ],
+    "security_notes": "Static review only — reads producer/consumer code, Kafka client configuration (acks, enable.idempotence, transactional.id, isolation.level, max.poll.* settings), topic durability settings, and sanitized application config; never opens a broker connection, produces/consumes a live message, creates/alters/deletes a topic, or runs a consumer group against a live cluster. Never requests broker bootstrap credentials, SASL/mTLS secrets, tenant identifiers, or customer data — ask for source and config with placeholders.",
+    "last_verified": "2026-07-17",
+    "path": "skills/java/java-kafka-reliability",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "java-maestro",
+    "name": "Java Maestro",
+    "type": "skill",
+    "provider": "java",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Java Maestro routing skill. Classifies a Java/JVM task and dispatches the narrowest static-review specialist from the Java board, or a parallel team of up to four for multi-domain tasks. Routes only — never answers Java questions, never runs code, never requests secrets.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.oracle.com/en/java/",
+      "https://spring.io/projects/spring-boot",
+      "https://jakarta.ee/specifications/"
+    ],
+    "security_notes": "Routing only — performs no review, never runs code, never requests secrets, connection strings, tokens, keystores, tenant identifiers, or customer data. Every dispatched Java specialist is static-review.",
+    "last_verified": "2026-07-17",
+    "path": "skills/java/java-maestro",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "java-resilience-pattern",
+    "name": "java-resilience-pattern",
+    "type": "skill",
+    "provider": "java",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of resilience4j + Spring composition correctness on a Java code path — decorator/aspect order, non-idempotent-write retry safety, TimeLimiter/timeout budgets, Bulkhead isolation, RateLimiter, and fallback correctness. Reads source and sanitized configuration only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://resilience4j.readme.io/docs/getting-started",
+      "https://resilience4j.readme.io/docs/getting-started-3",
+      "https://resilience4j.readme.io/docs/circuitbreaker",
+      "https://resilience4j.readme.io/docs/retry",
+      "https://github.com/resilience4j/resilience4j"
+    ],
+    "security_notes": "Static review only — reads Java/Kotlin source, resilience4j annotations and Decorators functional-chaining code, and sanitized resilience4j.* application.yml/properties configuration; never builds, runs, invokes a JDK, opens a database/broker connection, or calls a live circuit-breaker, metrics, or actuator endpoint. Never requests credentials, connection strings, tenant identifiers, or customer data.",
+    "last_verified": "2026-07-17",
+    "path": "skills/java/java-resilience-pattern",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "java-spring-security",
+    "name": "java-spring-security",
+    "type": "skill",
+    "provider": "java",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of Spring Security 6 filter-chain authorization posture and Spring Boot Actuator exposure — SecurityFilterChain matcher ordering, authorizeHttpRequests precedence, method-security (@PreAuthorize/@PostAuthorize) interaction, AuthorizationManager fail-closed behavior, CSRF on state-changing endpoints, and actuator endpoint exposure. Reads source and sanitized configuration only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.spring.io/spring-security/reference/",
+      "https://docs.spring.io/spring-boot/reference/actuator/",
+      "https://spring.io/projects/spring-security"
+    ],
+    "security_notes": "Static review only — reads Java/Kotlin source, SecurityFilterChain bean definitions, and sanitized application.yml/properties; never builds, runs, or invokes a JDK, never opens a live HTTP/DB/broker connection, and never authenticates against a running application or calls a live /actuator endpoint. Never requests secrets, credentials, tokens, or customer data. This agent owns the Spring Security filter-chain and endpoint-exposure verdict for the board; it references but does not own untrusted-deserialization/parser RCE findings.",
+    "last_verified": "2026-07-17",
+    "path": "skills/java/java-spring-security",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "java-test-architecture",
+    "name": "java-test-architecture",
+    "type": "skill",
+    "provider": "java",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of JVM test suite architecture and non-flakiness — JUnit 5 lifecycle/isolation, Testcontainers discipline (singleton reuse vs per-test, Wait strategies vs sleep), ArchUnit rules with FreezingArchRule, and test-quality smells via AssertJ/Mockito. Absorbs JVM flaky-test triage. Reads source and sanitized config only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://junit.org/junit5/docs/current/user-guide/",
+      "https://java.testcontainers.org/",
+      "https://www.archunit.org/userguide/html/000_Index.html",
+      "https://assertj.github.io/doc/",
+      "https://site.mockito.org/"
+    ],
+    "security_notes": "Static review only — reads JUnit 5 test source, Testcontainers module usage, ArchUnit rule definitions, and sanitized build/test configuration (pom.xml/build.gradle test blocks, junit-platform.properties, ~/.testcontainers.properties excerpts); never invokes a JDK, runs mvn/gradle test, starts a JUnit runner, opens a Docker/Testcontainers daemon connection, hits a database or broker, or contacts any live system. Never requests connection strings, database credentials, tenant identifiers, or customer data — ask for source with placeholders.",
+    "last_verified": "2026-07-17",
+    "path": "skills/java/java-test-architecture",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "java-transaction-and-consistency",
+    "name": "java-transaction-and-consistency",
+    "type": "skill",
+    "provider": "java",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Statically reviews Spring @Transactional boundary correctness — propagation, isolation, readOnly, rollbackFor, proxy self-invocation, and boundary width — plus cross-resource consistency, flagging the save()-then-send() dual-write anti-pattern, missing outbox/relay, and post-commit side effects that skip TransactionSynchronization or REQUIRES_NEW. Reads source and sanitized configuration only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.spring.io/spring-framework/reference/data-access/transaction.html",
+      "https://jakarta.ee/specifications/transactions/",
+      "https://microservices.io/patterns/data/transactional-outbox.html",
+      "https://microservices.io/patterns/data/saga.html"
+    ],
+    "security_notes": "Static review only — reads Spring @Transactional-annotated classes, service/repository call graphs, and sanitized transaction-manager/datasource/broker configuration; never opens a database or broker connection, starts or commits a transaction, or executes code. Never requests connection strings, credentials, tenant identifiers, or customer data; ask for source with placeholders.",
+    "last_verified": "2026-07-17",
+    "path": "skills/java/java-transaction-and-consistency",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
   {
     "id": "javascript-runtime-async-review",
     "name": "JavaScript Runtime & Async Correctness Review",
@@ -9756,6 +10160,437 @@
     "version": "0.1.0",
     "author": "github: Raishin"
   },
+  {
+    "id": "kotlin-android-architecture",
+    "name": "kotlin-android-architecture",
+    "type": "skill",
+    "provider": "kotlin",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of Android app architecture correctness: ViewModel lifecycle and scoping across configuration changes, SavedStateHandle persistence across process death, lifecycle-aware Flow collection, and unidirectional data flow with a single source of truth. Reads source only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://developer.android.com/topic/architecture",
+      "https://developer.android.com/topic/libraries/architecture/viewmodel",
+      "https://developer.android.com/topic/libraries/architecture/saving-states",
+      "https://developer.android.com/topic/libraries/architecture/coroutines"
+    ],
+    "security_notes": "Static review only — reads Kotlin/Compose source, ViewModel and lifecycle declarations, and sanitized configuration; never builds, runs, or instruments an app on a device, and never observes actual configuration-change or process-death behavior at runtime. Claims about actual on-device lifecycle timing are flagged as needing on-device verification. Never requests secrets, credentials, or customer data.",
+    "last_verified": "2026-07-21",
+    "path": "skills/kotlin/kotlin-android-architecture",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "kotlin-android-performance-reliability",
+    "name": "kotlin-android-performance-reliability",
+    "type": "skill",
+    "provider": "kotlin",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of measured Android runtime performance and reliability evidence: cold/warm startup via StartupTimingMetric and CompilationMode, frame jank via FrameTimingMetric/JankStats, Baseline Profile coverage, ANR root causes, and Macrobenchmark regression-gating thresholds. Reads benchmark reports and source only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://developer.android.com/topic/performance/benchmarking/macrobenchmark-overview",
+      "https://developer.android.com/topic/performance/baselineprofiles/overview",
+      "https://developer.android.com/topic/performance/vitals/anr",
+      "https://developer.android.com/topic/performance/jankstats"
+    ],
+    "security_notes": "Static review only — reads Macrobenchmark/JankStats reports, Baseline Profile rules, and Kotlin/Gradle source; never runs a benchmark, builds an APK, or instruments a device itself, and never asserts a performance number that isn't backed by a supplied report. Any performance or reliability claim without a supplied benchmark artifact is flagged as unknown rather than asserted. Never requests secrets, credentials, or customer data.",
+    "last_verified": "2026-07-21",
+    "path": "skills/kotlin/kotlin-android-performance-reliability",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "kotlin-android-security-privacy",
+    "name": "kotlin-android-security-privacy",
+    "type": "skill",
+    "provider": "kotlin",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "MASVS-aligned static review of Android app security and privacy posture: exported components and intent surfaces, deep-link/App Links validation, WebView exposure, cleartext-traffic and network-security-config, local storage and secrets, backup exposure, runtime-permission minimization, and PII in logs. Reads manifest, source, and sanitized config only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://mas.owasp.org/MASVS/",
+      "https://developer.android.com/privacy-and-security/security-tips",
+      "https://developer.android.com/training/articles/security-config",
+      "https://developer.android.com/guide/topics/manifest/manifest-intro"
+    ],
+    "security_notes": "Static review only — reads AndroidManifest.xml, Kotlin/Java source, Gradle config, and sanitized resource files; never builds, installs, runs, or instruments an app, never opens a live connection, and never handles real secrets or user data. Findings about runtime behavior (what an installed app actually exposes) are flagged as needing on-device verification. Never requests keystores, signing keys, credentials, or customer data.",
+    "last_verified": "2026-07-21",
+    "path": "skills/kotlin/kotlin-android-security-privacy",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "kotlin-backend-production-readiness",
+    "name": "kotlin-backend-production-readiness",
+    "type": "skill",
+    "provider": "kotlin",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of production readiness for Ktor servers and the Kotlin-on-Spring coroutine surface: server lifecycle/monitoring events, Netty/CIO graceful-shutdown configuration, StatusPages typed error mapping, resource cleanup on shutdown, and correctly routing the coroutine-context-loss hazard behind suspend WebFlux handlers. Reads source and sanitized config only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://ktor.io/docs/server-events.html",
+      "https://ktor.io/docs/server-lifecycle.html",
+      "https://docs.spring.io/spring-framework/reference/languages/kotlin/coroutines.html",
+      "https://ktor.io/docs/server-status-pages.html"
+    ],
+    "security_notes": "Static review only — reads Ktor/Spring Kotlin source, routing/plugin configuration, and sanitized YAML/config; never builds, runs, deploys, or opens a live connection to a server, and never observes actual shutdown/startup timing. A readiness claim that depends on runtime behavior (actual drain time, real health-check response) is flagged as needing verification against a running instance rather than asserted. Never requests secrets, credentials, or customer data.",
+    "last_verified": "2026-07-21",
+    "path": "skills/kotlin/kotlin-backend-production-readiness",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "kotlin-compose-ui-quality-accessibility",
+    "name": "kotlin-compose-ui-quality-accessibility",
+    "type": "skill",
+    "provider": "kotlin",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of Jetpack Compose UI correctness and accessibility: recomposition stability (@Stable/@Immutable, unstable parameters), correct side-effect API usage, remember/derivedStateOf scoping, state hoisting, and mandatory semantics/contentDescription and touch-target accessibility. Reads source only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://developer.android.com/develop/ui/compose/performance/stability",
+      "https://developer.android.com/develop/ui/compose/side-effects",
+      "https://developer.android.com/develop/ui/compose/accessibility",
+      "https://developer.android.com/develop/ui/compose/state"
+    ],
+    "security_notes": "Static review only — reads Compose source and sanitized resources; never builds, runs, or renders the UI, never captures a live Layout Inspector or recomposition-count trace, and never invokes a device or emulator. Claims about actual measured recomposition counts or frame timing are flagged as needing profiler/Macrobenchmark verification rather than asserted. Never requests secrets, credentials, or customer data.",
+    "last_verified": "2026-07-21",
+    "path": "skills/kotlin/kotlin-compose-ui-quality-accessibility",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "kotlin-coroutines-flow-reliability",
+    "name": "kotlin-coroutines-flow-reliability",
+    "type": "skill",
+    "provider": "kotlin",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of Kotlin coroutine and Flow reliability: structured concurrency and cancellation cooperation, dispatcher selection and blocking calls, cold Flow vs hot StateFlow/SharedFlow semantics, backpressure, and context propagation across suspension — including the coroutine-aware persistence and telemetry/MDC/security-context hazards. Reads source only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://kotlinlang.org/docs/coroutines-guide.html",
+      "https://kotlinlang.org/docs/flow.html",
+      "https://kotlinlang.org/docs/coroutine-context-and-dispatchers.html",
+      "https://kotlin.github.io/kotlinx.coroutines/"
+    ],
+    "security_notes": "Static review only — reads Kotlin source and sanitized configuration; never builds, runs, or invokes a JVM/Android runtime, never opens a live connection, and never executes coroutine code to observe timing. Runtime-ordering and race claims that cannot be confirmed from source are flagged as needing verification rather than asserted. Never requests secrets, credentials, or customer data.",
+    "last_verified": "2026-07-21",
+    "path": "skills/kotlin/kotlin-coroutines-flow-reliability",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "kotlin-estate-modernization-governor",
+    "name": "kotlin-estate-modernization-governor",
+    "type": "skill",
+    "provider": "kotlin",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of Java-to-Kotlin migration strategy: strangler-fig module-by-module vs file-by-file sequencing, the mixed Java/Kotlin interop-boundary null-safety debt, reversibility of each migration step, when a module should not migrate, and J2K converter-output governance. Reads module and dependency inventories only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://kotlinlang.org/docs/mixing-java-kotlin-intellij.html",
+      "https://kotlinlang.org/docs/java-interop.html",
+      "https://kotlinlang.org/docs/comparison-to-java.html",
+      "https://developer.android.com/kotlin/add-kotlin"
+    ],
+    "security_notes": "Static review only — reads module inventories, dependency graphs, sanitized source diffs, and J2K converter output; never builds, runs, or executes the actual migration (invoking the converter, merging, deploying), never opens a live connection, and never requests real credentials. Claims about a module's actual runtime churn, ownership, or business justification are flagged as needing confirmation from the owning team rather than asserted from the artifacts alone. Never requests secrets, credentials, or customer data.",
+    "last_verified": "2026-07-21",
+    "path": "skills/kotlin/kotlin-estate-modernization-governor",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "kotlin-gradle-build-engineering",
+    "name": "kotlin-gradle-build-engineering",
+    "type": "skill",
+    "provider": "kotlin",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of Gradle build-graph quality and CI throughput for Kotlin/KMP projects: configuration-cache and build-cache correctness, task-graph/configuration-avoidance, kapt vs KSP annotation processing, and convention-plugin centralization. Reads Gradle build files and build-scan evidence only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.gradle.org/current/userguide/configuration_cache.html",
+      "https://docs.gradle.org/current/userguide/build_cache.html",
+      "https://kotlinlang.org/docs/ksp-overview.html",
+      "https://docs.gradle.org/current/userguide/sharing_build_logic_between_subprojects.html"
+    ],
+    "security_notes": "Static review only — reads Gradle build files, convention-plugin sources, and sanitized build-scan/cache-hit evidence; never invokes Gradle, runs a build, or reads a live build-cache node. Throughput claims (cache-hit rate, build-time improvement) that are not backed by build-scan evidence are flagged as needing measurement rather than asserted. Never requests secrets, credentials, or customer data.",
+    "last_verified": "2026-07-21",
+    "path": "skills/kotlin/kotlin-gradle-build-engineering",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "kotlin-kmp-boundary-interop",
+    "name": "kotlin-kmp-boundary-interop",
+    "type": "skill",
+    "provider": "kotlin",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of Kotlin Multiplatform source-set architecture, expect/actual design, platform-API-leakage prevention, cross-target dependency compatibility, Swift/Objective-C interop, and Kotlin/Native runtime concerns including the new memory manager and freezing deprecation. Reads source and build config only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://kotlinlang.org/docs/native-memory-manager.html",
+      "https://kotlinlang.org/docs/multiplatform-expect-actual.html",
+      "https://kotlinlang.org/docs/native-objc-interop.html",
+      "https://www.jetbrains.com/help/kotlin-multiplatform-dev/multiplatform-hierarchy.html"
+    ],
+    "security_notes": "Static review only — reads Kotlin Multiplatform source, Gradle source-set configuration, and sanitized build files; never builds, compiles, or runs a target (JVM/Native/JS/Wasm), never invokes Xcode or an iOS toolchain, and never executes generated Swift/Objective-C bridging code. Claims about a specific Kotlin/Gradle version's behavior that aren't confirmed by the supplied build files are flagged as assumption. Never requests secrets, credentials, or customer data.",
+    "last_verified": "2026-07-21",
+    "path": "skills/kotlin/kotlin-kmp-boundary-interop",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "kotlin-kmp-portfolio-decision",
+    "name": "kotlin-kmp-portfolio-decision",
+    "type": "skill",
+    "provider": "kotlin",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Decides whether a product and org should adopt Kotlin Multiplatform at all, and how much to share, weighing team topology, roadmap alignment, platform differentiation, hiring/skills, lifecycle cost, and reversibility. Must be able to recommend against KMP; never designs the implementation.",
+    "source_type": "original",
+    "official_docs": [
+      "https://kotlinlang.org/docs/multiplatform.html",
+      "https://www.jetbrains.com/help/kotlin-multiplatform-dev/multiplatform-discover-project.html",
+      "https://kotlinlang.org/docs/multiplatform-expect-actual.html",
+      "https://kotlinlang.org/docs/multiplatform-connect-to-apis.html"
+    ],
+    "security_notes": "Static analysis only — reasons from user-supplied product, team, and codebase context; never runs, builds, or migrates code, and never has access to real org data beyond what the user provides in the conversation. Claims about team capacity, roadmap timelines, or business priority that aren't confirmed by the user are flagged as assumption. Never requests secrets, credentials, or customer data.",
+    "last_verified": "2026-07-21",
+    "path": "skills/kotlin/kotlin-kmp-portfolio-decision",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "kotlin-language-api-correctness",
+    "name": "kotlin-language-api-correctness",
+    "type": "skill",
+    "provider": "kotlin",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of Kotlin language-level correctness: nullability and Java-interop platform types, inline functions with reified generics past JVM erasure, @JvmInline value-class boxing, statically-dispatched extension functions vs member precedence, and lateinit use-before-init hazards. Reads source only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://kotlinlang.org/docs/null-safety.html",
+      "https://kotlinlang.org/docs/java-interop.html",
+      "https://kotlinlang.org/docs/inline-functions.html",
+      "https://kotlinlang.org/docs/inline-classes.html"
+    ],
+    "security_notes": "Static review only — reads Kotlin source and sanitized Java-interop signatures; never compiles, runs, or executes code to observe an actual NullPointerException, boxing allocation, or dispatch outcome. A runtime-behavior claim not confirmed by the visible source is flagged as needing verification rather than asserted. Never requests secrets, credentials, or customer data.",
+    "last_verified": "2026-07-21",
+    "path": "skills/kotlin/kotlin-language-api-correctness",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "kotlin-library-api-abi-governance",
+    "name": "kotlin-library-api-abi-governance",
+    "type": "skill",
+    "provider": "kotlin",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of Kotlin library public-API evolution and binary/source compatibility for libraries consumed by both Kotlin and Java: binary-compatibility-validator .api snapshots and apiCheck gating, Explicit API mode, @JvmOverloads/@JvmStatic/@JvmName surface shaping, and ABI-sensitive data-class and inline-function changes. Reads source and build config only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://kotlinlang.org/docs/whatsnew1420.html",
+      "https://github.com/Kotlin/binary-compatibility-validator",
+      "https://kotlinlang.org/docs/whatsnew14.html#explicit-api-mode-for-library-authors",
+      "https://kotlinlang.org/docs/java-to-kotlin-interop.html"
+    ],
+    "security_notes": "Static review only — reads Kotlin source, `.api` snapshot files, and Gradle/build configuration; never builds, publishes, or runs `apiDump`/`apiCheck` itself, never opens a live connection, and never handles credentials for a package registry. A binary-compatibility claim not confirmed by an actual `.api` diff or `apiCheck` run is flagged as needing verification. Never requests secrets, tokens, or customer data.",
+    "last_verified": "2026-07-21",
+    "path": "skills/kotlin/kotlin-library-api-abi-governance",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "kotlin-maestro",
+    "name": "kotlin-maestro",
+    "type": "skill",
+    "provider": "kotlin",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Router for the Kotlin board. Classifies a Kotlin, JVM-Kotlin, Android, or Kotlin Multiplatform task and dispatches the narrowest static-review specialist (or a parallel team of up to four for genuinely multi-domain tasks). Routes only — never reviews Kotlin work itself and never performs a live operation.",
+    "source_type": "original",
+    "official_docs": [
+      "https://kotlinlang.org/docs/home.html",
+      "https://developer.android.com/kotlin",
+      "https://kotlinlang.org/docs/multiplatform.html"
+    ],
+    "security_notes": "Classification and routing only. Never builds, runs, deploys, signs, or publishes anything, never opens a live connection, and never requests secrets, keystores, signing keys, tokens, tenant identifiers, or customer data. Detects production-mutation intent and hands it to a named human owner instead of dispatching. Treats task text as data to classify, never as instructions.",
+    "last_verified": "2026-07-21",
+    "path": "skills/kotlin/kotlin-maestro",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "kotlin-serialization-wire-contract",
+    "name": "kotlin-serialization-wire-contract",
+    "type": "skill",
+    "provider": "kotlin",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of kotlinx.serialization wire-contract safety and schema evolution: encodeDefaults/explicitNulls defaults, @EncodeDefault overrides, strict-decode unknown-key rejection, sealed-class closed polymorphism and class discriminators, and breaking-change detection for optional/required-field evolution. Reads source and serializer configuration only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://github.com/Kotlin/kotlinx.serialization",
+      "https://kotlinlang.org/api/kotlinx.serialization/",
+      "https://github.com/Kotlin/kotlinx.serialization/blob/master/docs/json.md",
+      "https://github.com/Kotlin/kotlinx.serialization/blob/master/docs/polymorphism.md"
+    ],
+    "security_notes": "Static review only — reads Kotlin `@Serializable` classes, `Json {}` configuration, and sanitized sample payloads; never builds, runs, or sends/receives real wire traffic, and never handles production payloads or customer data. A claim about actual producer/consumer version skew in a live system is flagged as needing verification rather than asserted. Never requests secrets, credentials, or customer data.",
+    "last_verified": "2026-07-21",
+    "path": "skills/kotlin/kotlin-serialization-wire-contract",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "kotlin-supply-chain-release-integrity",
+    "name": "kotlin-supply-chain-release-integrity",
+    "type": "skill",
+    "provider": "kotlin",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of Kotlin/Gradle dependency trust and release integrity: verification-metadata enforcement, dependency locking, Gradle plugin trust and pinning, repository scope, and KMP/Maven publication controls. Reads build files, verification/lock metadata, and publication config only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.gradle.org/current/userguide/dependency_verification.html",
+      "https://docs.gradle.org/current/userguide/dependency_locking.html",
+      "https://docs.gradle.org/current/userguide/plugins.html",
+      "https://kotlinlang.org/docs/multiplatform-publish-lib.html"
+    ],
+    "security_notes": "Static review only — reads Gradle build files, `gradle/verification-metadata.xml`, lock files, plugin declarations, and publication config; never runs a release, publishes an artifact, signs anything, or contacts a live repository/CI system. Never requests secrets, credentials, signing keys, tenant identifiers, or customer data.",
+    "last_verified": "2026-07-21",
+    "path": "skills/kotlin/kotlin-supply-chain-release-integrity",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "kotlin-test-architecture",
+    "name": "kotlin-test-architecture",
+    "type": "skill",
+    "provider": "kotlin",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of Kotlin coroutine/Flow/Compose/Android/KMP test architecture and determinism: runTest virtual-time usage, test-dispatcher choice and advance discipline, Dispatchers.setMain/resetMain hygiene, Turbine Flow testing, and Compose/Robolectric-vs-instrumented boundary choice. Reads test source and build config only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://kotlinlang.org/api/kotlinx.coroutines/kotlinx-coroutines-test/",
+      "https://github.com/cashapp/turbine",
+      "https://developer.android.com/develop/ui/compose/testing",
+      "https://developer.android.com/training/testing/local-tests"
+    ],
+    "security_notes": "Static review only — reads Kotlin/Android test source, Gradle test configuration, and sanitized CI logs; never runs the test suite, invokes a device/emulator, or opens a live connection. A claim that a specific flake is caused by real-time dependence rather than another factor is flagged as needing reproduction to confirm. Never requests secrets, credentials, or customer data.",
+    "last_verified": "2026-07-21",
+    "path": "skills/kotlin/kotlin-test-architecture",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
   {
     "id": "kubecost-chargeback-allocation-review",
     "name": "Kubecost Chargeback and Allocation Review",