@raishin/vanguard-frontier-agentic 3.7.0 → 3.9.0

package/catalog/skills.json

@@ -19454,8 +19454,8 @@
     "version": "0.1.0"
   },
   {
-    "id": "terraform-maestro",
-    "name": "Terraform Maestro",
+    "id": "terraform-engine-compatibility",
+    "name": "terraform-engine-compatibility",
     "type": "skill",
     "provider": "terraform",
     "harnesses": [
@@ -19466,23 +19466,275 @@
       "kiro",
       "other"
     ],
-    "summary": "Route Terraform and IaC tasks to the right specialist from the cross-cloud IaC catalog. Classifies by domain (review, aws-iac, azure-iac, oci-iac, live-guard), dispatches single or parallel (max 4), and enforces live-guard gate for live apply, destroy, or stack mutations.",
-    "source_type": "adapted",
+    "summary": "Decide whether a version or engine change is safe to adopt, in what order, and with what rollback: Terraform core and provider major upgrades, deprecation exposure, and the Terraform-versus-OpenTofu engine decision treated as an evidence problem rather than an ideological one. Reads version constraints, lock files, deprecation notices, and release documentation only.",
+    "source_type": "original",
     "official_docs": [
-      "https://developer.hashicorp.com/terraform/docs",
-      "https://developer.hashicorp.com/terraform/language",
+      "https://developer.hashicorp.com/terraform/language/upgrade-guides",
+      "https://developer.hashicorp.com/terraform/language/v1-compatibility-promises",
+      "https://developer.hashicorp.com/terraform/language/files/dependency-lock",
+      "https://opentofu.org/docs/intro/migration/",
+      "https://opentofu.org/docs/intro/",
+      "https://opentofu.org/docs/intro/migration/multiple-configurations",
+      "https://developer.hashicorp.com/terraform/plugin/terraform-plugin-protocol"
+    ],
+    "security_notes": "Static review only — reads version constraints, `.terraform.lock.hcl`, provider deprecation notices, changelog and upgrade-guide excerpts, and configuration; never runs `init`, `init -upgrade`, `plan`, or `apply`, and never contacts a registry. Never requests or accepts credentials, tokens, or licence keys. Version-specific behaviour is asserted only from the relevant engine's own upgrade guidance for the exact version pair in question; a claim about a version whose guidance was not read is labelled unknown rather than inferred from an adjacent version.",
+    "last_verified": "2026-08-17",
+    "path": "skills/terraform/terraform-engine-compatibility",
+    "version": "0.1.0",
+    "author": "github: VincentChuWaiChow"
+  },
+  {
+    "id": "terraform-estate-reconciliation",
+    "name": "terraform-estate-reconciliation",
+    "type": "skill",
+    "provider": "terraform",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Make the record match reality without destroying anything: classify drift and decide whether to adopt, revert, or accept it; bring unmanaged brownfield infrastructure under management via import blocks; and carry resource address changes with `moved` and `removed` blocks so a refactor is not read as a destroy. Reads plans, source, and sanitized inventories only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://developer.hashicorp.com/terraform/language/import",
+      "https://developer.hashicorp.com/terraform/language/moved",
       "https://developer.hashicorp.com/terraform/cli/commands/plan",
+      "https://developer.hashicorp.com/terraform/language/meta-arguments/lifecycle",
+      "https://opentofu.org/docs/language/import/"
+    ],
+    "security_notes": "Advisory and read-only — reads plans (preferably `-refresh-only` and `-json`), Terraform/OpenTofu source, import blocks, and sanitized resource inventories; never runs `import`, `plan`, `apply`, `state mv`, or `state rm`, and never contacts a cloud API to enumerate resources. Never requests or accepts cloud credentials, tokens, unredacted state, account/subscription/tenant identifiers, or customer data. Resource inventories must arrive with identifiers redacted where they encode account or tenant structure. A claim about what exists in the live estate that is not visible in the supplied artifacts is labelled assumption, never confirmed.",
+    "last_verified": "2026-08-17",
+    "path": "skills/terraform/terraform-estate-reconciliation",
+    "version": "0.1.0",
+    "author": "github: VincentChuWaiChow"
+  },
+  {
+    "id": "terraform-execution-governance",
+    "name": "terraform-execution-governance",
+    "type": "skill",
+    "provider": "terraform",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Decide whether the path that executes a Terraform or OpenTofu change is trustworthy: which identity the runner assumes and how widely it is scoped, whether the reviewed plan is the plan that applies, how plan artifacts move between stages, and whether approval is a real gate or a formality. Reads pipeline definitions and runner configuration only.",
+    "source_type": "original",
+    "official_docs": [
       "https://developer.hashicorp.com/terraform/cli/commands/apply",
-      "https://registry.terraform.io/providers/hashicorp/aws/latest/docs",
-      "https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs",
-      "https://registry.terraform.io/providers/oracle/oci/latest/docs"
+      "https://developer.hashicorp.com/terraform/cli/commands/plan",
+      "https://developer.hashicorp.com/terraform/cloud-docs/workspaces/dynamic-provider-credentials",
+      "https://developer.hashicorp.com/terraform/cloud-docs/run/remote-operations",
+      "https://developer.hashicorp.com/terraform/cli/config/config-file"
     ],
-    "security_notes": "Live-guard gate is non-negotiable: never auto-dispatch live apply, destroy, or stack mutation agents without explicit human confirmation, blast-radius assessment, and rollback path. Terraform destroy is irreversible without state backup.",
-    "last_verified": "2026-04-30",
+    "security_notes": "Static review only — reads pipeline definitions, runner and workspace configuration, and sanitized role or trust-policy documents; never triggers a pipeline, runs `plan` or `apply`, or contacts a CI system, and never modifies a workflow. Never requests or accepts credentials, provider tokens, OIDC client secrets, private keys, unredacted state, saved plan binaries, or account/subscription/tenant identifiers — trust policies and role documents must arrive with identifiers redacted. A claim about what a runner is actually permitted to do that is not visible in the supplied configuration is labelled assumption, never confirmed.",
+    "last_verified": "2026-08-17",
+    "path": "skills/terraform/terraform-execution-governance",
+    "version": "0.1.0",
+    "author": "github: VincentChuWaiChow"
+  },
+  {
+    "id": "terraform-maestro",
+    "name": "terraform-maestro",
+    "type": "skill",
+    "provider": "terraform",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Classify a Terraform or OpenTofu task and route it to the narrowest advisory specialist on the IaC board, dispatching up to four in parallel only when the change genuinely spans that many domains. Never answers an IaC question itself, never executes a live operation, and never auto-dispatches a live-guard agent.",
+    "source_type": "original",
+    "official_docs": [
+      "https://developer.hashicorp.com/terraform/cli/commands/plan",
+      "https://opentofu.org/docs/cli/commands/"
+    ],
+    "security_notes": "Routing only. Never requests or relays cloud credentials, provider tokens, private keys, unredacted state, or account/subscription/tenant identifiers. Never executes apply, destroy, import, state mutation, or force-unlock, and never auto-dispatches a live-guard agent — every live path stops for written human confirmation with blast radius and rollback stated first.",
+    "last_verified": "2026-08-17",
     "path": "skills/terraform/terraform-maestro",
     "author": "github: VincentChuWaiChow",
     "version": "0.1.0"
   },
+  {
+    "id": "terraform-module-contract",
+    "name": "terraform-module-contract",
+    "type": "skill",
+    "provider": "terraform",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Review a Terraform or OpenTofu module as a reusable contract rather than as code: input surface and validation, output stability, versioning and breaking changes, composition boundaries, and whether a proposed one-off module should exist at all when a platform module already covers it. Reads source and sanitized variable files only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://developer.hashicorp.com/terraform/language/modules/develop",
+      "https://developer.hashicorp.com/terraform/language/values/variables",
+      "https://developer.hashicorp.com/terraform/language/checks",
+      "https://opentofu.org/docs/language/functions/"
+    ],
+    "security_notes": "Static review only — reads Terraform/OpenTofu source, module READMEs, and sanitized variable files; never runs `init`, `plan`, `apply`, or any state operation, never contacts a registry or live system, and never requests secrets, credentials, tokens, or customer data. A claim about the engine version, provider versions, or how a module behaves at apply time that is not visible in the supplied artifacts is labelled assumption, never confirmed.",
+    "last_verified": "2026-08-17",
+    "path": "skills/terraform/terraform-module-contract",
+    "version": "0.1.0",
+    "author": "github: VincentChuWaiChow"
+  },
+  {
+    "id": "terraform-plan-blast-radius",
+    "name": "terraform-plan-blast-radius",
+    "type": "skill",
+    "provider": "terraform",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Read a Terraform or OpenTofu plan and answer why the engine decided to replace or destroy anything, what the ordering means for availability, and whether the plan under review is the plan that will actually be applied. Engine-level plan mechanics across every cloud; reads plan output, source, and sanitized variable files only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://developer.hashicorp.com/terraform/cli/commands/plan",
+      "https://developer.hashicorp.com/terraform/language/meta-arguments/lifecycle",
+      "https://developer.hashicorp.com/terraform/language/resources/syntax",
+      "https://developer.hashicorp.com/terraform/cli/commands/apply",
+      "https://opentofu.org/docs/cli/commands/"
+    ],
+    "security_notes": "Static review only — reads plan output (preferably `-json`), Terraform/OpenTofu source, and sanitized variable files; never runs `plan`, `apply`, `destroy`, or any state operation and never contacts a live system. Saved plan files record sensitive values in cleartext, so this agent asks for redacted plan JSON and refuses raw plan binaries. Never requests or accepts cloud credentials, tokens, unredacted state, or account identifiers. A claim about what exists in the live account that is not visible in the supplied plan is labelled assumption, never confirmed.",
+    "last_verified": "2026-08-17",
+    "path": "skills/terraform/terraform-plan-blast-radius",
+    "version": "0.1.0",
+    "author": "github: VincentChuWaiChow"
+  },
+  {
+    "id": "terraform-policy-evidence",
+    "name": "terraform-policy-evidence",
+    "type": "skill",
+    "provider": "terraform",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Turn a Terraform or OpenTofu change into an auditable control decision: which control the change touches, whether the policy that enforces it evaluates the plan or only the source, whether an exception is scoped and expiring, and what evidence artifact an auditor could actually read. Reads plans, policy code, and control mappings only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://developer.hashicorp.com/terraform/cloud-docs/policy-enforcement",
+      "https://developer.hashicorp.com/terraform/cloud-docs/policy-enforcement/opa",
+      "https://developer.hashicorp.com/terraform/cloud-docs/policy-enforcement/sentinel",
+      "https://developer.hashicorp.com/terraform/language/checks",
+      "https://developer.hashicorp.com/terraform/cli/commands/plan",
+      "https://developer.hashicorp.com/terraform/cloud-docs/policy-enforcement/manage-policy-sets"
+    ],
+    "security_notes": "Advisory and read-only — reads plan output (preferably redacted `-json`), policy source, control mappings, and exception records; never runs policy engines, `plan`, or `apply`, never grants or records an exception itself, and never contacts a live system. Never requests or accepts credentials, tokens, unredacted state, audit-system write access, account/subscription/tenant identifiers, or customer data. Produces evidence for a human control owner to sign; it never signs, approves, or attests on their behalf, and a compliance conclusion not supported by a supplied artifact is labelled assumption, never confirmed.",
+    "last_verified": "2026-08-17",
+    "path": "skills/terraform/terraform-policy-evidence",
+    "version": "0.1.0",
+    "author": "github: VincentChuWaiChow"
+  },
+  {
+    "id": "terraform-state-reliability",
+    "name": "terraform-state-reliability",
+    "type": "skill",
+    "provider": "terraform",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Own the state file as a production asset: backend and locking configuration, backup and recovery posture, whether a proposed state surgery is justified and reversible, engine-specific state encryption, and the secrets that state records in the clear. Reads backend blocks, state metadata, and sanitized artifacts only — never mutates state.",
+    "source_type": "original",
+    "official_docs": [
+      "https://developer.hashicorp.com/terraform/language/state",
+      "https://developer.hashicorp.com/terraform/language/state/locking",
+      "https://developer.hashicorp.com/terraform/language/backend/s3",
+      "https://developer.hashicorp.com/terraform/cli/commands/state",
+      "https://developer.hashicorp.com/terraform/cli/commands/force-unlock",
+      "https://developer.hashicorp.com/terraform/language/state/sensitive-data",
+      "https://opentofu.org/docs/language/state/encryption/",
+      "https://developer.hashicorp.com/terraform/language/state/remote-state-data"
+    ],
+    "security_notes": "Advisory and read-only — reads `backend` and `cloud` blocks, state metadata, lock configuration, and sanitized artifacts; never runs `state mv`, `state rm`, `state push`, `import`, `taint`, or `force-unlock`, and never contacts a live backend. State records values in the clear even when the configuration marks them sensitive, so this agent never requests a raw state file: it asks for the backend block and `terraform state list` output instead. Never requests or accepts cloud credentials, tokens, encryption keys or passphrases, account identifiers, or customer data. A claim about the live backend, lock table, or bucket configuration not visible in the supplied artifacts is labelled assumption, never confirmed.",
+    "last_verified": "2026-08-17",
+    "path": "skills/terraform/terraform-state-reliability",
+    "version": "0.1.0",
+    "author": "github: VincentChuWaiChow"
+  },
+  {
+    "id": "terraform-supply-chain-integrity",
+    "name": "terraform-supply-chain-integrity",
+    "type": "skill",
+    "provider": "terraform",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Decide whether a Terraform or OpenTofu dependency may be trusted and whether the trust is actually enforced: provider source addresses and registry namespaces, `.terraform.lock.hcl` hash coverage across platforms, mirrors and network-restricted installation, and module source provenance. Reads dependency declarations, lock files, and CLI configuration only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://developer.hashicorp.com/terraform/language/files/dependency-lock",
+      "https://developer.hashicorp.com/terraform/cli/commands/providers/lock",
+      "https://developer.hashicorp.com/terraform/language/providers/requirements",
+      "https://developer.hashicorp.com/terraform/cli/config/config-file",
+      "https://developer.hashicorp.com/terraform/internals/provider-registry-protocol",
+      "https://opentofu.org/docs/language/providers/requirements/"
+    ],
+    "security_notes": "Static review only — reads `required_providers` blocks, module `source` addresses, `.terraform.lock.hcl`, and CLI configuration files; never runs `init`, `providers lock`, or any command that contacts a registry or mirror, and never downloads a provider. Never requests or accepts registry tokens, signing keys, credentials, or private registry URLs containing embedded secrets. A claim about what a registry currently serves, or about a checksum not present in the supplied lock file, is labelled assumption, never confirmed.",
+    "last_verified": "2026-08-17",
+    "path": "skills/terraform/terraform-supply-chain-integrity",
+    "version": "0.1.0",
+    "author": "github: VincentChuWaiChow"
+  },
+  {
+    "id": "terraform-verification-strategy",
+    "name": "terraform-verification-strategy",
+    "type": "skill",
+    "provider": "terraform",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Choose and sequence verification for a Terraform or OpenTofu change: what `validate`, a plan, `terraform test` with `command = plan`, mock providers, and a real-infrastructure test run each actually prove, and which of them is proportionate to the change's blast radius. Reusable procedure with no independent decision right — the owning agent issues the verdict.",
+    "source_type": "original",
+    "official_docs": [
+      "https://developer.hashicorp.com/terraform/language/tests",
+      "https://developer.hashicorp.com/terraform/cli/commands/plan",
+      "https://developer.hashicorp.com/terraform/language/checks",
+      "https://opentofu.org/docs/cli/commands/"
+    ],
+    "security_notes": "Procedure only — reads test files, module source, and plan output; never runs `validate`, `plan`, `test`, or `apply`, and never provisions infrastructure. Apply-mode tests create real infrastructure and are therefore recommended only against an isolated non-production account with its own credentials, never against an account holding production resources. Never requests or accepts credentials, tokens, unredacted state, or customer data.",
+    "last_verified": "2026-08-17",
+    "path": "skills/terraform/terraform-verification-strategy",
+    "version": "0.1.0",
+    "author": "github: VincentChuWaiChow"
+  },
   {
     "id": "test-coverage-quality-review",
     "name": "Test Coverage Quality Review",
@@ -19637,6 +19889,84 @@
     "version": "0.1.0",
     "author": "github: VincentChuWaiChow"
   },
+  {
+    "id": "typescript-async-contract-reliability",
+    "name": "typescript-async-contract-reliability",
+    "type": "skill",
+    "provider": "typescript",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of server-side TypeScript async reliability: floating and ignored promises, AbortSignal cancellation plumbing, unhandled-rejection posture and process-exit behavior, stream/async-iterable backpressure, concurrency bounds, cleanup, and typed error channels. Reads source and Node/lint configuration only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://typescript-eslint.io/packages/parser/",
+      "https://nodejs.org/api/process.html",
+      "https://nodejs.org/api/stream.html"
+    ],
+    "security_notes": "Static review only — reads TypeScript/JavaScript source, the declared Node version, and lint configuration; never runs, builds, deploys, or publishes the code, never contacts a live process or system, and never requests secrets, credentials, or customer data. A process-exit-behavior verdict made without a confirmed Node version is labelled inference, not confirmed.",
+    "last_verified": "2026-08-13",
+    "path": "skills/typescript/typescript-async-contract-reliability",
+    "version": "0.1.0",
+    "author": "github: VincentChuWaiChow"
+  },
+  {
+    "id": "typescript-build-graph-performance",
+    "name": "typescript-build-graph-performance",
+    "type": "skill",
+    "provider": "typescript",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review, from supplied measurement evidence only, of what in a TypeScript program graph costs measured build or editor time: project references, composite/incremental/.tsbuildinfo behavior, generated-code volume, pathological type instantiation, and duplicated checking across lint, test, and build. Reads measurement output and configuration only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://github.com/microsoft/TypeScript/wiki/Performance",
+      "https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/",
+      "https://www.typescriptlang.org/docs/handbook/project-references.html"
+    ],
+    "security_notes": "Static review of supplied measurement evidence only — reads `--diagnostics`/`--extendedDiagnostics` output, `--generateTrace` traces, `tsconfig.json` files, and package topology; never invokes the compiler, runs a build, or measures a live system, and never requests secrets, credentials, or customer data. Never prescribes a restructuring without a supplied measurement, and always records which compiler binary produced it.",
+    "last_verified": "2026-08-13",
+    "path": "skills/typescript/typescript-build-graph-performance",
+    "version": "0.1.0",
+    "author": "github: VincentChuWaiChow"
+  },
+  {
+    "id": "typescript-business-critical-automation-governance",
+    "name": "typescript-business-critical-automation-governance",
+    "type": "skill",
+    "provider": "typescript",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of whether a privileged TypeScript automation (backfill, migration, reconciliation script) may run and under what controls: dry-run coverage of the write path, technical and business idempotency, blast-radius bounds, checkpoint/resume, rollback and reconciliation evidence, audit trail, and a named inverse operation. Never executes anything; reads script source and declared credential scope by name only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://nodejs.org/api/typescript.html",
+      "https://nodejs.org/learn/typescript/run-natively",
+      "https://typescript-eslint.io/packages/parser/"
+    ],
+    "security_notes": "Static review only — reads script source, the run command, credential scope by name only (never a value), scheduler/CI configuration, an existing runbook, and the reconciliation method; never executes, deploys, or migrates anything, and never requests a credential value, secret, or connection string.",
+    "last_verified": "2026-08-13",
+    "path": "skills/typescript/typescript-business-critical-automation-governance",
+    "version": "0.1.0",
+    "author": "github: VincentChuWaiChow"
+  },
   {
     "id": "typescript-contracts-review",
     "name": "TypeScript Contracts Review",
@@ -19666,6 +19996,295 @@
     "version": "0.1.0",
     "author": "github: VincentChuWaiChow"
   },
+  {
+    "id": "typescript-engineering-economics",
+    "name": "typescript-engineering-economics",
+    "type": "skill",
+    "provider": "typescript",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static conversion of another specialist's supplied measurements into a funding decision: annual engineering-hours lost, CI compute cost, migration cost, break-even point, cost of postponement, and investment priority — with formulas, sensitivity, and every value labelled measured, supplied, or assumed. Never originates a measurement and is never dispatched first.",
+    "source_type": "original",
+    "official_docs": [
+      "https://github.com/microsoft/TypeScript/wiki/Performance",
+      "https://typescript-eslint.io/packages/parser/",
+      "https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/"
+    ],
+    "security_notes": "Static review only — reads user-supplied figures (CI durations, headcount and loaded cost, wait times, incident counts, ticket volume, migration-effort estimates) and the measurements handed off by other specialists; never originates a measurement itself, never contacts a live system, and never requests cost data beyond what the user volunteers. Never requests secrets, credentials, or customer data.",
+    "last_verified": "2026-08-13",
+    "path": "skills/typescript/typescript-engineering-economics",
+    "version": "0.1.0",
+    "author": "github: VincentChuWaiChow"
+  },
+  {
+    "id": "typescript-estate-modernization-governor",
+    "name": "typescript-estate-modernization-governor",
+    "type": "skill",
+    "provider": "typescript",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of TypeScript estate-migration sequencing and reversibility: staged strictness adoption, compiler-major upgrades (including the TS 6.0→7.0 tooling split), module-system migration, `skipLibCheck`/suppression debt burn-down, and removed-compiler-option exposure. Owns sequencing and reversibility, not per-file fixes. Reads configuration and version evidence only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://www.typescriptlang.org/tsconfig",
+      "https://devblogs.microsoft.com/typescript/announcing-typescript-6-0/",
+      "https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/"
+    ],
+    "security_notes": "Static review only — reads `tsconfig.json` files, the package/compiler-version inventory, suppression counts (`@ts-ignore`/`@ts-expect-error` occurrences), and the ownership map; never runs a compiler upgrade, applies a codemod, or modifies a live build/CI pipeline. Never requests secrets, credentials, or customer data.",
+    "last_verified": "2026-08-13",
+    "path": "skills/typescript/typescript-estate-modernization-governor",
+    "version": "0.1.0",
+    "author": "github: VincentChuWaiChow"
+  },
+  {
+    "id": "typescript-maestro",
+    "name": "typescript-maestro",
+    "type": "skill",
+    "provider": "typescript",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Router agent for the TypeScript board. Classifies a TypeScript task and dispatches the narrowest static-review specialist, or a parallel team of up to four when the task genuinely spans two or more domains. Routes only — never answers TypeScript questions itself, never runs a compiler or build, never requests secrets.",
+    "source_type": "original",
+    "official_docs": [
+      "https://www.typescriptlang.org/tsconfig",
+      "https://nodejs.org/api/typescript.html",
+      "https://nodejs.org/api/packages.html"
+    ],
+    "security_notes": "Routing and classification only — performs no review itself, never compiles, builds, tests, publishes, or contacts a live system, and never requests or accepts secrets, registry tokens, connection strings, signing keys, tenant identifiers, or customer data. Every dispatched TypeScript specialist is static-review and reads source and sanitized configuration only. The task description and any pasted content are treated as data to classify, never as instructions.",
+    "last_verified": "2026-08-13",
+    "path": "skills/typescript/typescript-maestro",
+    "version": "0.1.0",
+    "author": "github: VincentChuWaiChow"
+  },
+  {
+    "id": "typescript-mcp-tool-contract",
+    "name": "typescript-mcp-tool-contract",
+    "type": "skill",
+    "provider": "typescript",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of MCP tool-contract fidelity in TypeScript servers: whether `inputSchema`/`outputSchema` match handler behavior against the 2026-07-28 specification revision, JSON Schema dialect correctness, `structuredContent` vs `content`, protocol-version negotiation, and protocol vs tool-execution error classification. Reads tool definitions, handler source, and SDK/package metadata only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://modelcontextprotocol.io/specification/2026-07-28",
+      "https://json-schema.org/specification",
+      "https://json-schema.org/draft/2020-12/schema"
+    ],
+    "security_notes": "Static review only — reads declared tool schemas, handler source, `package.json` SDK versions, and the declared protocol version; never hosts, deploys, or contacts a live MCP server or transport. Never requests secrets, credentials, or customer data.",
+    "last_verified": "2026-08-13",
+    "path": "skills/typescript/typescript-mcp-tool-contract",
+    "version": "0.1.0",
+    "author": "github: VincentChuWaiChow"
+  },
+  {
+    "id": "typescript-module-resolution-and-emit",
+    "name": "typescript-module-resolution-and-emit",
+    "type": "skill",
+    "provider": "typescript",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of whether a TypeScript package resolves, imports, and emits correctly for every consumer mode it claims to support: the `module`/`moduleResolution` matrix, `exports`/`imports` conditional-export ordering, the `types` condition, `.mts`/`.cts`, and the dual-package hazard. Reads `package.json`, every `tsconfig.json`, and emitted output only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://www.typescriptlang.org/tsconfig",
+      "https://nodejs.org/api/packages.html",
+      "https://nodejs.org/api/modules.html",
+      "https://publint.dev/rules",
+      "https://arethetypeswrong.github.io"
+    ],
+    "security_notes": "Static review only — reads `package.json`, every `tsconfig.json`, emitted declaration/output files, and sanitized build configuration; never compiles, bundles, publishes, or contacts a live registry, and never requests secrets, credentials, or customer data. A resolution claim not confirmed by the compiler's actual `--showConfig` output or the emitted files is labelled assumption, never confirmed.",
+    "last_verified": "2026-08-13",
+    "path": "skills/typescript/typescript-module-resolution-and-emit",
+    "version": "0.1.0",
+    "author": "github: VincentChuWaiChow"
+  },
+  {
+    "id": "typescript-node-execution-compatibility",
+    "name": "typescript-node-execution-compatibility",
+    "type": "skill",
+    "provider": "typescript",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of whether TypeScript code actually runs on the target Node version and is type-checked somewhere: type-stripping limits and their runtime consequences, proof of a separate `tsc --noEmit` gate, runtime-unsupported syntax, import-extension requirements, and Node version/API gating. Reads source, the run command, CI configuration, and every `tsconfig.json` only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://nodejs.org/api/typescript.html",
+      "https://nodejs.org/learn/typescript/run-natively",
+      "https://github.com/nodejs/Release",
+      "https://nodejs.org/api/packages.html"
+    ],
+    "security_notes": "Static review only — reads source, the exact run command and flags, CI job definitions, every `tsconfig.json`, and the container entrypoint; never executes the code, never invokes Node or `tsc`, never contacts a live system, and never requests secrets, credentials, or customer data. A claim about a Node version not stated by the user is labelled assumption, never confirmed — the agent asks for the version rather than guessing.",
+    "last_verified": "2026-08-13",
+    "path": "skills/typescript/typescript-node-execution-compatibility",
+    "version": "0.1.0",
+    "author": "github: VincentChuWaiChow"
+  },
+  {
+    "id": "typescript-package-publication-integrity",
+    "name": "typescript-package-publication-integrity",
+    "type": "skill",
+    "provider": "typescript",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of npm package publication integrity: publish identity and authority (trusted publishing/OIDC versus long-lived tokens), provenance attestation, the release-automation trust path, tarball contents, and registry/scope configuration. Reads the publish workflow and sanitized package configuration only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.npmjs.com/generating-provenance-statements",
+      "https://publint.dev/rules",
+      "https://arethetypeswrong.github.io"
+    ],
+    "security_notes": "Static review only — reads the release-automation workflow definition, `.npmrc`/`publishConfig`, the packed file list (e.g. `npm pack --dry-run` output), and registry/scope settings; never runs `npm publish`, signs an artifact, rotates or issues a token, or contacts a live registry. Never requests secrets, registry tokens, signing keys, or customer data.",
+    "last_verified": "2026-08-13",
+    "path": "skills/typescript/typescript-package-publication-integrity",
+    "version": "0.1.0",
+    "author": "github: VincentChuWaiChow"
+  },
+  {
+    "id": "typescript-public-api-and-declaration-governance",
+    "name": "typescript-public-api-and-declaration-governance",
+    "type": "skill",
+    "provider": "typescript",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of a published TypeScript type surface: `.d.ts` correctness and emit strategy, public-versus-accidental exports, breaking-change classification and the semver decision, the consumer compilation matrix, and compile-time type-contract tests. Reads declarations, API reports, and configuration only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://www.typescriptlang.org/docs/handbook/modules/appendices/esm-cjs-interop.html",
+      "https://api-extractor.com/",
+      "https://vitest.dev/guide/testing-types"
+    ],
+    "security_notes": "Static review only — reads declaration files (`.d.ts`), API reports/rollups, `package.json`, consumer `tsconfig.json` files, and Vitest type-test source; never compiles, builds, runs, publishes, or executes the package, never contacts a live registry or consumer, and never requests secrets, credentials, registry tokens, or customer data. A breaking-change classification made without a supplied baseline surface is labelled inference, not confirmed.",
+    "last_verified": "2026-08-13",
+    "path": "skills/typescript/typescript-public-api-and-declaration-governance",
+    "version": "0.1.0",
+    "author": "github: VincentChuWaiChow"
+  },
+  {
+    "id": "typescript-runtime-boundary-contract",
+    "name": "typescript-runtime-boundary-contract",
+    "type": "skill",
+    "provider": "typescript",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of runtime trust-boundary handling in TypeScript: whether every value entering the program (HTTP, queue, environment/configuration, database reads, third-party SDKs, webhooks, `JSON.parse`, files, agent/tool calls) is parsed against a schema rather than merely asserted, `unknown`-first ingestion, one source of truth between a schema and its TypeScript type, and generated-type drift. Reads source and sanitized configuration/schema files only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://json-schema.org/specification",
+      "https://zod.dev",
+      "https://ajv.js.org/"
+    ],
+    "security_notes": "Static review only — reads TypeScript source, declared schemas, and sanitized configuration or lockfile snippets showing the installed validator and version; never compiles, builds, runs, or contacts a live system, and never requests secrets, credentials, connection strings, or customer data. A runtime-behavior or data-shape claim not confirmed by the visible schema or source is labelled assumption, never confirmed.",
+    "last_verified": "2026-08-13",
+    "path": "skills/typescript/typescript-runtime-boundary-contract",
+    "version": "0.1.0",
+    "author": "github: VincentChuWaiChow"
+  },
+  {
+    "id": "typescript-static-enforcement-policy",
+    "name": "typescript-static-enforcement-policy",
+    "type": "skill",
+    "provider": "typescript",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of what 'it passes' must mean for each TypeScript package and what proving it costs: strict-family flag policy and silent loosening, typed-lint rule selection and Project Service configuration, editor-versus-CI parity, and suppression policy. Reads tsconfig, lint, and CI job configuration only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://www.typescriptlang.org/tsconfig",
+      "https://devblogs.microsoft.com/typescript/announcing-typescript-6-0/",
+      "https://typescript-eslint.io/packages/parser/"
+    ],
+    "security_notes": "Static review only — reads every `tsconfig.json` and its effective (resolved) configuration, lint configuration, and CI job definitions; never runs the compiler, the linter, a build, or a test, never contacts a live CI system, and never requests secrets, credentials, or customer data. A configuration finding made without the effective (extends-resolved) file is labelled inference, not confirmed.",
+    "last_verified": "2026-08-13",
+    "path": "skills/typescript/typescript-static-enforcement-policy",
+    "version": "0.1.0",
+    "author": "github: VincentChuWaiChow"
+  },
+  {
+    "id": "typescript-type-soundness",
+    "name": "typescript-type-soundness",
+    "type": "skill",
+    "provider": "typescript",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of type-level soundness in shared or published TypeScript code: generic variance, conditional and mapped type correctness, type predicates that assert more than they check, unsound narrowing, `satisfies` versus an explicit annotation, branded and nominal modelling, and `unknown`-first discipline. Reads source and sanitized `tsconfig.json` only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://www.typescriptlang.org/tsconfig",
+      "https://devblogs.microsoft.com/typescript/announcing-typescript-6-0/",
+      "https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/"
+    ],
+    "security_notes": "Static review only — reads TypeScript/JavaScript source and sanitized `tsconfig.json`; never compiles, type-checks, builds, runs, publishes, or contacts a live system, and never requests secrets, credentials, tokens, or customer data. A claim about the installed compiler version or actual runtime behavior not shown in the supplied artifacts is labelled assumption, never confirmed.",
+    "last_verified": "2026-08-13",
+    "path": "skills/typescript/typescript-type-soundness",
+    "version": "0.1.0",
+    "author": "github: VincentChuWaiChow"
+  },
   {
     "id": "variance-analysis-advisor",
     "name": "Variance Analysis Advisor",