@rune-kit/rune 2.2.1 → 2.2.2

package/docs/SKILL-DEPTH-AUDIT.md

@@ -0,0 +1,191 @@
+# Skill Depth Audit
+
+> Living document. Updated each cycle when skills are enriched.
+> Last audit: 2026-03-08 | Audited by: Claude Opus 4.6
+
+## Depth Scale
+
+| Score | Definition | Characteristics |
+|-------|-----------|-----------------|
+| **5** | Exemplary | Embedded frameworks, multiple mental models, edge cases explicit, anti-patterns enumerated, worked examples, error recovery deep |
+| **4** | Comprehensive | Clear workflow, good error handling, frameworks present but <3 worked examples, all gates enforced |
+| **3** | Solid | Single workflow flow, frameworks named but not demonstrated, happy path covered, gaps on edge cases |
+| **2** | Thin | Instructions present but generic, minimal framework depth, no examples |
+| **1** | Skeleton | Placeholder, just routing instructions |
+
+## Context Cost Comparison
+
+Understanding why skill depth matters — comparing execution with vs without skill knowledge:
+
+| Scenario | Without Skill (Research Mode) | With Deep Skill (Inject Mode) |
+|----------|-------------------------------|-------------------------------|
+| **Debug a bug** | ~8-15 tool calls: grep → read → hypothesize → grep → read → test → fix → test | ~4-6 tool calls: hypothesis cycle (max 3), evidence-first, escalate at fix #3 |
+| **Write tests** | Writes tests after code, misses edge cases, no coverage gate | TDD Iron Law: test first → red → green → refactor, anti-rationalization table blocks shortcuts |
+| **Security review** | Generic OWASP checklist from training data, misses framework-specific patterns | Framework-specific regex patterns, config drift detection, 3-layer defense model |
+| **Plan a feature** | Vague steps like "implement auth", no function signatures | Bite-sized phases, function signatures required, dependency ordering, risk per phase |
+| **Refactor legacy** | Big bang rewrite attempt, breaks everything | Strangler Fig / Branch by Abstraction, 1 module/session, characterization tests first |
+
+**Key insight**: A deep skill doesn't just tell Claude WHAT to do — it gives Claude the MENTAL MODEL of an expert. Research mode gives answers; skill mode gives judgment.
+
+### Token Economics
+
+| | Research Mode | Skill Inject Mode |
+|--|---------------|-------------------|
+| **Context cost** | 0 tokens upfront, but 2000-8000 tokens per research cycle (WebSearch, WebFetch, Read docs) | 150-400 tokens upfront (SKILL.md loaded), 0 research tokens |
+| **Tool calls** | 8-20 per task (search, read, verify, retry) | 3-8 per task (direct execution) |
+| **Accuracy** | Variable — depends on search quality, training data freshness | High — curated knowledge, verified patterns |
+| **Speed** | Slow — research → synthesize → attempt → verify → retry | Fast — framework → execute → verify |
+| **Consistency** | Low — different approach each session | High — same framework, same quality bar |
+
+**Bottom line**: A 200-line SKILL.md (~300 tokens) saves 5000-15000 tokens of research per invocation. ROI is massive for frequently-used skills.
+
+## Enrichment Sources Registry
+
+External repos analyzed for knowledge extraction. Track what was extracted and where it went.
+
+| Source | URL | Analyzed | Skills Extracted To |
+|--------|-----|----------|---------------------|
+| CloudAI-X/threejs-skills | github.com/CloudAI-X/threejs-skills | 2026-03-08 | (no extraction — domain-specific 3D skills, not applicable to core workflow skills) |
+| mrgoonie/claudekit-skills | github.com/mrgoonie/claudekit-skills | 2026-03-08 | debug, fix, brainstorm, problem-solver, docs-seeker (5 skills enriched) |
+
+## Enrichment Framework
+
+### Extraction Process (per external source)
+
+```
+1. SCAN    — Read source skill, identify unique knowledge
+2. FILTER  — Remove: verbose filler, obvious instructions, things Claude already knows
+3. EXTRACT — Pull: frameworks, mental models, decision trees, anti-patterns, gotchas
+4. MAP     — Match extracted knowledge → target Rune skill(s)
+5. INJECT  — Add to Rune skill preserving: mesh contracts, progressive disclosure, context budget
+6. VERIFY  — Skill still works in mesh, SKILL.md stays under ~350 lines
+```
+
+### What to Extract (High Value)
+
+- **Decision trees**: "When X, choose Y because Z" — not just "do Y"
+- **Anti-patterns with WHY**: "Don't do X because it causes Y in production"
+- **Framework sequences**: Step 1 → Step 2 → Step 3 with clear entry/exit criteria
+- **Gotchas**: Things that look right but break subtly
+- **Domain heuristics**: Expert shortcuts that skip unnecessary work
+
+### What NOT to Extract (Low Value / Harmful)
+
+- Generic instructions Claude already knows ("use git", "write tests")
+- Verbose explanations that inflate context without adding judgment
+- Framework-specific API docs (use docs-seeker/context7 at runtime instead)
+- Patterns that conflict with Rune's mesh delegation model
+
+### Context Budget Rule
+
+Each SKILL.md should stay **150-350 lines** (~200-500 tokens when loaded).
+If enrichment pushes beyond 350 lines → use progressive disclosure:
+- Core instructions: always loaded (~150 lines)
+- Deep reference: in `references/` subfolder, loaded on demand
+
+---
+
+## L0 Router (1 skill)
+
+| Skill | Lines | Depth | Has | Missing | Enrich From |
+|-------|-------|-------|-----|---------|-------------|
+| skill-router | — | 4 | Routing table, adaptive overrides, model selection | Decision examples for ambiguous routing | — |
+
+## L1 Orchestrators (4 skills)
+
+| Skill | Lines | Depth | Has | Missing | Enrich From |
+|-------|-------|-------|-----|---------|-------------|
+| **cook** | 504 | ⭐5 | 8-phase TDD, fast-mode detection, phase skip, re-plan, autonomous loop, HARD-GATEs | — (exemplary) | — |
+| **team** | 397 | ⭐5 | Lite/full mode auto-detect, dependency ordering, merge conflict resolution, integrity check | — | — |
+| **launch** | 330 | 4.5 | Artifact readiness, 5-phase pipeline, platform auto-detect, watchdog integration | Rollback strategy detail | — |
+| **rescue** | 434 | 4.5 | Multi-session state, surgery queue, Strangler Fig/Branch by Abstraction, 3-fix escalation | Coupled module detection heuristics | — |
+
+## L2 Workflow Hubs (23 skills)
+
+| Skill | Lines | Depth | Has | Missing | Enrich From |
+|-------|-------|-------|-----|---------|-------------|
+| **plan** | 238 | ⭐5 | HARD-GATE vague steps, bite-sized decomposition, function signatures, risk assessment | — | — |
+| **debug** | ~220 | ⭐5+ | 2-3 hypothesis cycle, evidence-first, backward tracing (5-step), multi-component instrumentation, red flags thinking patterns, 3-fix escalation | — (enriched 2026-03-08) | — |
+| **test** | 271 | ⭐5 | RED/GREEN/REFACTOR, TDD Iron Law, anti-rationalization table (6 excuses), async fixtures | Language-specific test patterns beyond Python | CK: verification-before-completion |
+| **review** | 354 | ⭐5 | Framework-specific checks (React/Node/Python/Go/Rust), AI UI detection, WCAG 2.2 | — | CK: code-review checklist |
+| **skill-forge** | 317 | ⭐5 | Baseline test before writing, anti-rationalization, pressure scenarios | — | — |
+| **scout** | 232 | 4.5 | ADOPT/EXTEND/COMPOSE/BUILD matrix, codebase map, convention detection | Read vs Grep prioritization heuristics | — |
+| **brainstorm** | ~210 | 4.5 | 2-3 approaches, 7 frameworks (SCAMPER/First Principles/6 Hats/Crazy 8s + Collision-Zone/Inversion/Scale Game) | Worked examples | — |
+| **fix** | ~200 | 4.5 | Evidence gate, 3-fix limit, YAGNI, immutability, post-fix hardening (4-layer defense-in-depth) | — (enriched 2026-03-08) | — |
+| **sentinel** | 320 | 4 | Secret regex patterns, OWASP patterns, framework checks, config protection | CVE severity scoring algorithm | — |
+| **preflight** | 231 | 4 | Spec compliance, logic review (null-deref/missing-await/off-by-one), regression risk | Impact estimation methodology | — |
+| **design** | 420 | 4 | 10 product categories, typography/color tokens, platform overrides (iOS/Android), anti-patterns | More CSS implementation examples | TJS: dense example format |
+| **db** | 256 | 4 | Breaking change detection, migration per ORM, index analysis, parameterization scan | Data migration strategies (not just schema) | — |
+| **onboard** | 295 | 4 | CLAUDE.md template, .rune/ init, DEVELOPER-GUIDE.md, L4 pack suggestions | Merge algorithm for existing CLAUDE.md | — |
+| **deploy** | 174 | 4 | Platform auto-detect (Vercel/Netlify/Fly/Docker), pre-deploy gates, watchdog setup | Rollback playbook | — |
+| **perf** | 297 | 4 | N+1, sync-in-async, memory leaks, bundle bloat, Lighthouse gates, Core Web Vitals | More framework-specific perf patterns | — |
+| **autopsy** | 200 | 4 | 6-dimension health scoring, git archaeology, hotspots, dead code detection | Worked example of health score calculation | — |
+| **safeguard** | 188 | 4 | Characterization tests, boundary markers, config freeze, git tag rollback | Characterization test writing patterns | — |
+| **surgeon** | 203 | 4 | Strangler Fig/Branch by Abstraction/Expand-Migrate-Contract/Extract & Simplify, blast radius | Pattern selection decision tree | — |
+| **audit** | 466 | 3.5 | 8-phase structure, framework checks, health score table, mesh analytics | Worked examples, mesh analytics specifics | — |
+| **incident** | 234 | 3.5 | P1/P2/P3 severity, containment strategies, watchdog verification, timeline | Containment strategy decision rules | — |
+| **review-intake** | 222 | 3.5 | ABSORB/COMPREHEND/VERIFY/EVALUATE/RESPOND, trust levels, pushback framework | "Restate in own words" template | — |
+| **logic-guardian** | 240 | 3.5 | Logic manifest schema, pre-edit gate, post-edit validation, co-change groups | Auto-detection of logic-heavy files | — |
+| **marketing** | 178 | 3 | Scout integration, trend-scout context, asset generation, video planning | Copy templates (hero, CTA, testimonial) | — |
+
+## L3 Utilities (21 skills)
+
+| Skill | Lines | Depth | Has | Missing | Enrich From |
+|-------|-------|-------|-----|---------|-------------|
+| **problem-solver** | ~230 | ⭐5+ | 10 frameworks: 5 Whys, Fishbone, First Principles, SCAMPER, Impact Matrix + Collision-Zone, Inversion, Meta-Pattern, Simplification Cascades, Scale Game | — (enriched 2026-03-08) | — |
+| **sequential-thinking** | 175 | ⭐5 | Dependency mapping, constraint resolution, ordered evaluation, running state | — | — |
+| **hallucination-guard** | 204 | ⭐5 | Import extraction, registry check, edit distance for typosquatting, slopsquatting | — | — |
+| **completion-gate** | 151 | ⭐5 | Claim extraction, evidence matching, verdict table, stale evidence detection | — | — |
+| **constraint-check** | 165 | ⭐5 | HARD-GATE audit, temporal checks, violation classification | — | — |
+| **integrity-check** | 169 | ⭐5 | Zero-width Unicode, HTML comments, base64, prompt injection patterns | — | — |
+| **session-bridge** | 269 | ⭐5 | Save/Load dual mode, integrity verification, adversarial defense | — | — |
+| **research** | 122 | 4 | Query→Search→DeepDive→Synthesize→Report, confidence scoring | Source authority weighting algorithm | — |
+| **docs-seeker** | ~175 | 4.5 | Context7 MCP → llms.txt discovery (URL patterns, topic params) → WebSearch → repomix fallback, parallel agent distribution | — (enriched 2026-03-08) | — |
+| **trend-scout** | 145 | 4 | Scope→Search→Competitor→Sentiment→Report, query patterns | — | — |
+| **verification** | 201 | 4 | 5-language support, Evidence-Before-Claims HARD-GATE, TodoWrite integration | — | — |
+| **sast** | 190 | 4 | 6-language tool commands, semgrep integration, severity normalization | — | — |
+| **context-engine** | 176 | 4 | GREEN/YELLOW/ORANGE/RED thresholds, large-file adjustment | Worked example of compaction decision | — |
+| **journal** | 185 | 4 | ADR template, RESCUE-STATE, module-status, dependency graph | Session lifecycle example | — |
+| **worktree** | 140 | 4 | Git worktree lifecycle, rune/* branch naming, safety rules | — | — |
+| **watchdog** | 166 | 4 | HTTP checks, response time analysis, error detection, smoke test | Baseline comparison methodology | — |
+| **scope-guard** | 150 | 4 | Plan→Diff→Classify, IN_SCOPE/OUT_OF_SCOPE rules, test exception | — | — |
+| **browser-pilot** | 165 | 4 | Playwright MCP, 20-interaction limit, try-finally cleanup | — | — |
+| **asset-creator** | 157 | 4 | SVG/HTML/CSS output, dark/light variants, design token integration | — | — |
+| **video-creator** | 201 | 4 | Script structure, storyboard, shot list, platform constraints | — | — |
+| **dependency-doctor** | 235 | 4 | 6 package managers, health score formula, breaking change awareness | — | — |
+
+## Enrichment Backlog
+
+Priority ordered by: frequency of use × gap size × available source quality.
+
+| # | Target Skill | Gap | Source | Expected Impact | Status |
+|---|-------------|-----|--------|-----------------|--------|
+| 1 | debug | Backward tracing, multi-component instrumentation, red flags | CK: root-cause-tracing, systematic-debugging | High — most used skill | ✅ Done 2026-03-08 |
+| 2 | brainstorm | 3 breakthrough frameworks (Collision-Zone, Inversion, Scale Game) | CK: collision-zone-thinking, inversion-exercise, scale-game | High — ideation quality | ✅ Done 2026-03-08 |
+| 3 | problem-solver | 5 additional reasoning frameworks | CK: all 5 problem-solving sub-skills | Medium — already depth 5 | ✅ Done 2026-03-08 |
+| 4 | fix | Post-fix hardening (4-layer defense-in-depth) | CK: defense-in-depth | Medium — common confusion point | ✅ Done 2026-03-08 |
+| 5 | docs-seeker | llms.txt discovery, repomix, parallel agents | CK: docs-seeker | Medium — modern docs pattern | ✅ Done 2026-03-08 |
+| 6 | marketing | Copy templates (hero, features, CTA) | CK: aesthetic, general copywriting | Medium — currently most shallow L2 |
+| 7 | surgeon | Pattern selection decision tree | CK: (none — Rune-original) | Medium — needs internal development |
+| 8 | design | Dense CSS implementation examples | TJS: example density format | Low — already 420 lines |
+| 9 | incident | Containment strategy decision rules | CK: (none) | Low — less frequent use |
+| 10 | launch | Rollback playbook | CK: (none) | Low — less frequent use |
+
+Legend: CK = claudekit-skills, TJS = threejs-skills
+
+## Cycle Log
+
+Track enrichment history per skill.
+
+| Date | Skill | Source | What Added | Depth Before → After |
+|------|-------|--------|------------|---------------------|
+| 2026-03-08 | debug | CK: root-cause-tracing, systematic-debugging | Backward tracing technique (5-step), multi-component boundary instrumentation, red flags thinking patterns, 2 new constraints | ⭐5 → ⭐5+ |
+| 2026-03-08 | fix | CK: defense-in-depth | Post-fix hardening step (4-layer validation: Entry→Business→Environment→Debug), 2 new sharp edges | 4 → 4.5 |
+| 2026-03-08 | brainstorm | CK: collision-zone, inversion, scale-game | 3 breakthrough frameworks added to framework section + evaluation step | 4 → 4.5 |
+| 2026-03-08 | problem-solver | CK: collision-zone, inversion, meta-pattern, simplification-cascades, scale-game | 5 new frameworks in selection table + Step 3 execution details + 3 new sharp edges | ⭐5 → ⭐5+ |
+| 2026-03-08 | docs-seeker | CK: docs-seeker (llms.txt) | llms.txt discovery (context7 URL patterns, topic params), repomix fallback, parallel agent distribution, new sharp edge | 4 → 4.5 |
+| 2026-03-08 | test | — | Assessed — already depth 5, CK verification-before-completion covered by completion-gate | ⭐5 (no change) |
+
+---
+
+*This document is the single source of truth for skill depth tracking across sessions.*

package/docs/SKILL-TEMPLATE.md

@@ -0,0 +1,72 @@
+---
+name: skill-name
+description: One-line description of what this skill does and when to use it.
+metadata:
+  author: runedev
+  version: "0.1.0"
+  layer: L1|L2|L3
+  model: haiku|sonnet|opus
+  group: orchestrator|creation|development|quality|delivery|rescue|knowledge|reasoning|validation|state|monitoring|media|deps
+---
+
+# skill-name
+
+## Purpose
+
+One paragraph describing the skill's role in the Rune ecosystem.
+
+## Triggers
+
+- `/rune <command>` — manual invocation
+- Auto-trigger conditions (file patterns, error types, etc.)
+
+## Calls (outbound connections)
+
+- `skill-name` (L2|L3): condition when this skill calls it
+
+## Called By (inbound connections)
+
+- `skill-name` (L1|L2): condition when called
+
+## Workflow
+
+Step-by-step execution flow.
+
+## Output Format
+
+```
+Structured output that calling skills can consume.
+```
+
+## Constraints
+
+3-7 MUST/MUST NOT rules specific to this skill.
+Every constraint should block a specific failure mode or rationalization.
+
+Format:
+1. MUST [required behavior] — [why]
+2. MUST NOT [forbidden behavior] — [consequence]
+
+## Mesh Gates (L1/L2 only)
+
+| Gate | Requires | If Missing |
+|------|----------|------------|
+| [Gate Name] | [What must exist before proceeding] | [Action to take] |
+
+## Sharp Edges
+
+Known failure modes for this skill. Check these before declaring done.
+
+| Failure Mode | Severity | Mitigation |
+|---|---|---|
+| [what goes wrong] | CRITICAL/HIGH/MEDIUM/LOW | [how to avoid it] |
+
+## Done When
+
+- [condition 1 — specific, verifiable]
+- [condition 2]
+- [condition 3 — structured report emitted]
+
+## Cost Profile
+
+Estimated token usage per invocation.

package/docs/TRADE-MATRIX.md

@@ -0,0 +1,327 @@
+# Trade Logic Matrix
+
+> Complete skill-to-skill delegation map for Rune's 49-skill mesh.
+> Generated from all SKILL.md `Calls` / `Called By` sections + ARCHITECTURE.md cross-hub mesh.
+
+## Legend
+
+| Symbol | Meaning |
+|--------|---------|
+| `->` | Calls (outbound) |
+| `<-` | Called by (inbound) |
+| `<>` | Bidirectional |
+| `-` | No connection |
+| `*` | Conditional (only in specific phases/contexts) |
+
+---
+
+## Matrix 1: L1 Orchestrators -> L2 Hubs
+
+Which L2 hubs each L1 orchestrator delegates to.
+
+| L2 Hub | cook | team | launch | rescue |
+|--------|------|------|--------|--------|
+| plan | -> | -> | - | -> |
+| scout | -> | -> | - | - |
+| brainstorm | -> | - | - | - |
+| design | ->* | - | - | - |
+| skill-forge | ->* | - | - | - |
+| debug | -> | - | - | - |
+| fix | -> | - | - | - |
+| test | -> | - | -> | - |
+| review | -> | - | - | -> |
+| review-intake | ->* | - | - | - |
+| sentinel | -> | - | - | - |
+| preflight | -> | - | - | - |
+| onboard | ->* | - | - | -> |
+| db | ->* | - | - | - |
+| perf | ->* | - | - | - |
+| logic-guardian | ->* | -> | - | - |
+| incident | - | - | -> | - |
+| audit | ->* | - | -> | - |
+| deploy | - | - | -> | - |
+| marketing | - | - | -> | - |
+| autopsy | - | - | - | -> |
+| safeguard | - | - | - | -> |
+| surgeon | - | - | - | -> |
+
+**Notes:**
+- `cook` touches 17/22 L2 hubs (broadest reach)
+- `team` only calls plan + scout directly; delegates real work to cook/launch/rescue instances
+- `launch` focuses on delivery chain: test -> audit -> deploy -> marketing -> incident
+- `rescue` focuses on recovery chain: autopsy -> safeguard -> surgeon
+
+### L1 -> L1 (Meta-Orchestration)
+
+Only `team` can call other L1s:
+
+| Target | team |
+|--------|------|
+| cook | -> (parallel instances) |
+| launch | -> (deployment phase) |
+| rescue | -> (legacy modules) |
+
+---
+
+## Matrix 2: L2 <-> L2 Cross-Hub Mesh
+
+Skill-to-skill connections between L2 hubs. Read as ROW calls COLUMN.
+
+### Creation Group
+
+| | plan | scout | brainstorm | design | skill-forge |
+|---|---|---|---|---|---|
+| **plan** | - | -> | <> | - | <- |
+| **scout** | - | - | - | - | - |
+| **brainstorm** | <> | - | - | - | - |
+| **design** | - | -> | - | - | - |
+| **skill-forge** | -> | -> | - | - | - |
+
+### Development Group
+
+| | debug | fix | test | review | db |
+|---|---|---|---|---|---|
+| **debug** | - | -> | - | - | - |
+| **fix** | <> | - | -> | -> | - |
+| **test** | -> | - | - | - | - |
+| **review** | - | -> | -> | - | - |
+| **db** | - | - | - | - | - |
+
+### Quality Group
+
+| | sentinel | preflight | onboard | audit | perf | review-intake | logic-guardian |
+|---|---|---|---|---|---|---|---|
+| **sentinel** | - | - | - | - | - | - | - |
+| **preflight** | -> | - | - | - | - | - | - |
+| **onboard** | - | - | - | - | - | - | - |
+| **audit** | -> | - | - | - | -> | - | - |
+| **perf** | - | - | - | - | - | - | - |
+| **review-intake** | -> | - | - | - | - | - | - |
+| **logic-guardian** | - | - | - | - | - | - | - |
+
+### Delivery Group
+
+| | deploy | marketing | incident |
+|---|---|---|---|
+| **deploy** | - | - | -> |
+| **marketing** | - | - | - |
+| **incident** | - | - | - |
+
+### Rescue Group
+
+| | autopsy | safeguard | surgeon |
+|---|---|---|---|
+| **autopsy** | - | - | - |
+| **safeguard** | - | - | <- |
+| **surgeon** | - | -> | - |
+
+### Cross-Group Connections
+
+These connections span across L2 groups:
+
+| From | To | Direction | Context |
+|------|-----|-----------|---------|
+| plan | scout | -> | Scan before planning |
+| debug | scout | -> | Find related code |
+| review | scout | -> | More context needed |
+| review | sentinel | -> | Security patterns in diff |
+| review | design | -> | UI anti-pattern detected |
+| review | perf | -> | Performance patterns in diff |
+| review | review-intake | -> | External feedback received |
+| review | sast | -> | Security deep analysis |
+| review-intake | fix | -> | Apply verified changes |
+| review-intake | test | -> | Reviewer-found edge cases |
+| review-intake | sentinel | -> | Reviewer flagged security |
+| deploy | test | -> | Pre-deploy verification |
+| deploy | db | -> | Migration safety check |
+| deploy | perf | -> | Pre-deploy perf check |
+| deploy | sentinel | -> | Security gate |
+| audit | scout | -> | Discovery phase |
+| audit | db | -> | Database health dimension |
+| audit | autopsy | -> | Complexity/health phase |
+| incident | autopsy | -> | Root cause after containment |
+| incident | sentinel | -> | Security dimension check |
+| perf | design | -> | Accessibility BLOCK |
+| design | scout | -> | Detect platform/tokens |
+| marketing | scout | -> | Analyze assets |
+| onboard | autopsy | -> | Codebase health scan |
+| surgeon | debug | -> | Diagnose before surgery |
+| surgeon | fix | -> | Apply surgical changes |
+| surgeon | test | -> | Verify after surgery |
+| surgeon | review | -> | Self-review complex refactor |
+| safeguard | test | -> | Create safety net tests |
+| test | debug | -> | Unexpected failure triage |
+| logic-guardian | scout | -> | Scan project for logic files |
+| fix | logic-guardian | -> | Pre-edit gate on manifested files |
+| surgeon | logic-guardian | -> | Pre-refactor on logic modules |
+| review | logic-guardian | -> | Check if diff removes manifested logic |
+
+---
+
+## Matrix 3: L1/L2 -> L3 Utility Usage
+
+Which L3 utilities each L1/L2 skill consumes. Read as: ROW uses COLUMN.
+
+### Validation Utilities
+
+| Caller | verification | hallucination-guard | completion-gate | constraint-check | sast | integrity-check |
+|--------|---|---|---|---|---|---|
+| **cook** (L1) | x | x | x | x | x* | - |
+| **team** (L1) | - | - | x | x | - | x |
+| **launch** (L1) | - | - | - | - | - | - |
+| **rescue** (L1) | - | - | - | - | - | - |
+| fix | x | x | - | - | - | - |
+| test | x | - | - | - | - | - |
+| deploy | x | - | - | - | - | - |
+| sentinel | x | - | - | - | x | x |
+| preflight | - | x | - | - | - | - |
+| review | - | x | - | - | x | - |
+| review-intake | - | x | - | - | - | - |
+| db | x | x | - | - | - | - |
+| perf | x | - | - | - | - | - |
+| safeguard | x | - | - | - | - | - |
+| skill-forge | x | x | - | - | - | - |
+| audit | - | - | - | x | x | - |
+| logic-guardian | x | x | - | - | - | - |
+
+### Knowledge Utilities
+
+| Caller | research | docs-seeker | trend-scout |
+|--------|----------|-------------|-------------|
+| plan | x | - | - |
+| brainstorm | x | - | x |
+| debug | - | x | - |
+| fix | - | x | - |
+| review | - | x | - |
+| marketing | x | - | x |
+| autopsy | x | - | x |
+
+### Reasoning Utilities
+
+| Caller | problem-solver | sequential-thinking |
+|--------|----------------|---------------------|
+| plan | - | x |
+| brainstorm | x | x |
+| debug | x | x |
+
+### State Utilities
+
+| Caller | journal | session-bridge | context-engine | worktree |
+|--------|---------|----------------|----------------|----------|
+| **cook** (L1) | x | x | - | x* |
+| **team** (L1) | - | - | - | x |
+| **rescue** (L1) | - | x | - | - |
+| surgeon | x | - | - | - |
+| autopsy | x | - | - | - |
+| deploy | x | - | - | - |
+| audit | x | - | - | - |
+| incident | x | - | - | - |
+| skill-forge | x | - | - | - |
+| logic-guardian | x | x | - | - |
+
+### Monitoring & Media Utilities
+
+| Caller | watchdog | scope-guard | browser-pilot | asset-creator | video-creator | dependency-doctor |
+|--------|----------|-------------|---------------|---------------|---------------|-------------------|
+| **launch** (L1) | x | - | x | - | x | - |
+| **rescue** (L1) | - | - | - | - | - | x |
+| deploy | x | - | x | - | - | - |
+| incident | x | - | - | - | - | - |
+| test | - | - | x | - | - | - |
+| debug | - | - | x | - | - | - |
+| marketing | - | - | x | x | x | - |
+| perf | - | - | x | - | - | - |
+| design | - | - | - | x | - | - |
+| audit | - | - | - | - | - | x |
+
+---
+
+## Matrix 4: L3 -> L3 Exceptions
+
+Documented L3-to-L3 coordination (exceptions to "L3 calls nothing" rule):
+
+| From | To | Reason |
+|------|-----|--------|
+| hallucination-guard | research | Verify package existence on npm/pypi |
+| context-engine | session-bridge | Save state before context compaction |
+| session-bridge | integrity-check | Verify .rune/ file integrity before loading |
+
+---
+
+## Connectivity Stats
+
+### Most Connected Skills (Total In + Out)
+
+| Rank | Skill | Layer | Outbound | Inbound | Total | Role |
+|------|-------|-------|----------|---------|-------|------|
+| 1 | cook | L1 | 22 | 2 | 24 | Universal orchestrator |
+| 2 | scout | L2 | 0 | 18 | 18 | Universal scanner (read-only) |
+| 3 | review | L2 | 11 | 5 | 16 | Quality hub |
+| 4 | deploy | L2 | 10 | 2 | 12 | Delivery orchestrator |
+| 5 | verification | L3 | 0 | 9 | 9 | Build/test runner |
+| 6 | audit | L2 | 9 | 3 | 12 | Health assessor |
+| 7 | journal | L3 | 0 | 8 | 8 | State recorder |
+| 8 | sentinel | L2 | 4 | 5 | 9 | Security gate |
+| 9 | fix | L2 | 7 | 5 | 12 | Code changer |
+| 10 | logic-guardian | L2 | 5 | 5 | 10 | Logic preservation gate |
+| 11 | surgeon | L2 | 7 | 1 | 8 | Refactoring specialist |
+
+### Isolated Skills (0 outbound L2 connections)
+
+| Skill | Layer | Note |
+|-------|-------|------|
+| scout | L2 | Pure scanner — only uses Glob/Grep/Read |
+| db | L2 | Only calls L3 utilities |
+| perf | L2 | Calls L3 + design (cross-group) |
+| incident | L2 | Calls L3 + autopsy/sentinel |
+| marketing | L2 | Calls L3 + scout |
+| onboard | L2 | Calls scout + autopsy |
+
+### Critical Chains
+
+```
+Feature:    cook -> plan -> scout -> (codebase)
+                 -> test -> fix -> verification
+                 -> review -> sentinel -> sast
+                 -> preflight -> sentinel
+                 -> completion-gate
+
+Launch:     launch -> test -> verification
+                   -> audit -> sentinel + autopsy + perf
+                   -> deploy -> watchdog
+                   -> marketing -> asset-creator
+
+Rescue:     rescue -> autopsy -> scout -> (codebase)
+                   -> safeguard -> test
+                   -> surgeon -> fix -> verification
+
+Incident:   incident -> watchdog -> (health check)
+                     -> autopsy -> journal
+                     -> sentinel -> sast
+
+Debug-Fix:  debug <> fix -> test -> verification
+                         -> review -> sentinel
+```
+
+---
+
+## L4 Extension Pack Routing
+
+L4 packs are activated contextually, not via direct skill calls. They supplement L1/L2 workflows.
+
+| Pack | Activated By | Can Call (L3) |
+|------|-------------|---------------|
+| @rune/ui | cook (Phase 1.5), design | scout, verification, asset-creator |
+| @rune/backend | cook (Phase 1.5) | scout, verification |
+| @rune/devops | cook, deploy | scout, verification |
+| @rune/mobile | cook (Phase 1.5) | scout, verification |
+| @rune/security | cook, sentinel, review | scout, verification, sast |
+| @rune/trading | cook (Phase 1.5) | scout, verification |
+| @rune/saas | cook (Phase 1.5) | scout, verification |
+| @rune/ecommerce | cook (Phase 1.5) | scout, verification |
+| @rune/ai-ml | cook (Phase 1.5) | scout, verification |
+| @rune/gamedev | cook (Phase 1.5) | scout, verification |
+| @rune/content | cook (Phase 1.5) | scout, verification |
+| @rune/analytics | cook (Phase 1.5) | scout, verification |
+
+**L4 constraints:** Cannot call L1 or L2. Cannot call other L4 packs.

package/docs/VERSIONING.md

@@ -0,0 +1,91 @@
+# Versioning Policy
+
+> **H2 Document** — Semver policy for Rune core and L4 extension packs.
+
+---
+
+## Core Plugin Versioning
+
+The Rune plugin uses semantic versioning (`MAJOR.MINOR.PATCH`):
+
+| Version | When to bump | Example |
+|---------|-------------|---------|
+| **PATCH** (`1.0.N`) | Bug fixes, content corrections in SKILL.md | Fixing a wrong command in `verification`, correcting a Sharp Edge |
+| **MINOR** (`1.N.0`) | New features, new connections, new sections added | Adding a new `## Done When` condition, new mesh connection |
+| **MAJOR** (`N.0.0`) | Breaking change to skill interface or output contract | Renaming a skill, changing output format structure, removing a section |
+
+**Current version:** `1.0.0` (H1 complete — 40 skills, full mesh, all constraints)
+
+---
+
+## What Counts as a Breaking Change?
+
+A breaking change is any modification that would cause a **calling skill to fail or produce incorrect output** without code changes on its end.
+
+### Breaking (MAJOR bump required)
+- Renaming a skill (e.g., `sentinel` → `security-guard`)
+- Changing the structure of `## Output Format` in a way callers depend on
+- Removing a section that callers parse (e.g., removing `## Calls`)
+- Changing skill layer assignment (L2 → L3 changes invocation context)
+- Removing an existing connection from `## Calls` or `## Called By`
+
+### Non-breaking (MINOR or PATCH)
+- Adding new skills (MINOR)
+- Adding new connections (MINOR)
+- Adding `## Sharp Edges`, `## Done When`, or documentation content (PATCH)
+- Fixing incorrect commands or examples (PATCH)
+- Clarifying constraint wording without changing behavior (PATCH)
+- Updating `## Cost Profile` estimates (PATCH)
+
+---
+
+## Skill API Stability Contract
+
+Each skill's **stable API** consists of:
+1. Skill name (used in `## Calls` references across the mesh)
+2. `## Output Format` structure (the contract for calling skills)
+3. Layer assignment (L1/L2/L3)
+4. Required input parameters (documented in `## Executable Steps`)
+
+Everything else (Sharp Edges, Done When, Cost Profile, wording improvements) is non-API and can change freely.
+
+---
+
+## L4 Extension Pack Versioning
+
+L4 packs version independently of the core. Each `PACK.md` has its own `metadata.version`.
+
+L4 packs start at `0.1.0` (experimental). When stable:
+- `1.0.0` = skill interface is locked, callers can rely on output format
+- Minor bumps = new skills added to pack (additive, non-breaking)
+- Major bumps = skill renamed, removed, or output format changed
+
+**L4 packs MUST NOT change their mesh connection interface (how they connect to L1-L3 core) in a patch release.** Connection changes are at minimum a minor version bump.
+
+---
+
+## Version in SKILL.md Frontmatter
+
+Every `SKILL.md` has a `metadata.version` field:
+
+```yaml
+metadata:
+  version: "0.2.0"
+```
+
+This tracks the individual skill's version, independent of the plugin version. Use it to:
+- Track which skills have been updated in a release
+- Help users identify if their cached version is outdated
+- Signal to CI that a skill's contract changed
+
+**Convention:** When the plugin bumps MAJOR, all skill versions bump to match (e.g., all skills go to `1.0.0`). For MINOR/PATCH, only the modified skills bump.
+
+---
+
+## Changelog
+
+| Version | Date | Summary |
+|---------|------|---------|
+| `0.1.0` | 2026-01-15 | Initial release — 36 core skills (Waves 0-4) |
+| `0.2.0` | 2026-02-10 | Add perf, db, incident, design skills. Behavioral constraints. HARD-GATE pattern. |
+| `1.0.0` | 2026-02-25 | H1 complete — 40 skills, Sharp Edges + Done When on all skills, 0 broken mesh connections |