@skill-graph/cli 0.5.6 → 0.5.8

package/marketplace/README.md

@@ -5,7 +5,7 @@ Do not edit generated files here by hand; run `node scripts/export-marketplace-s
 
 Canonical source repo: https://github.com/jacob-balslev/skill-graph
 Release target repo: jacob-balslev/skills
-Generated public skills: 140
+Generated public skills: 142
 
 Each skill under `skills/<name>/SKILL.md` is a plain Agent Skills-compatible export.
 Protocol fields are preserved as string values under `metadata`, with factual Skill Graph provenance.

package/marketplace/skills/a11y/SKILL.md

@@ -5,7 +5,7 @@ license: MIT
 compatibility: "Markdown, Git, any web stack"
 allowed-tools: Read Grep
 metadata:
-  metadata: "{\"schema_version\":6,\"version\":\"1.0.0\",\"type\":\"capability\",\"category\":\"quality\",\"domain\":\"quality/accessibility\",\"scope\":\"portable\",\"owner\":\"skill-graph-maintainer\",\"freshness\":\"2026-04-18\",\"drift_check\":\"{\\\\\\\"last_verified\\\\\\\":\\\\\\\"2026-04-18\\\\\\\"}\",\"eval_artifacts\":\"present\",\"eval_state\":\"passing\",\"routing_eval\":\"present\",\"stability\":\"experimental\",\"keywords\":\"[\\\\\\\"accessibility\\\\\\\",\\\\\\\"a11y\\\\\\\",\\\\\\\"keyboard navigation\\\\\\\",\\\\\\\"screen reader\\\\\\\",\\\\\\\"focus management\\\\\\\",\\\\\\\"keyboard not working\\\\\\\",\\\\\\\"tab order\\\\\\\",\\\\\\\"missing aria label\\\\\\\",\\\\\\\"screen reader says\\\\\\\",\\\\\\\"reduced motion\\\\\\\",\\\\\\\"high contrast\\\\\\\",\\\\\\\"semantic html\\\\\\\",\\\\\\\"form labels\\\\\\\",\\\\\\\"form fields\\\\\\\",\\\\\\\"aria-label\\\\\\\",\\\\\\\"assistive tech\\\\\\\",\\\\\\\"assistive technology\\\\\\\",\\\\\\\"accessible labels\\\\\\\",\\\\\\\"proper labels\\\\\\\"]\",\"triggers\":\"[\\\\\\\"a11y-skill\\\\\\\"]\",\"paths\":\"[\\\\\\\"**/*.{html,tsx,jsx,vue,svelte}\\\\\\\",\\\\\\\"**/*.css\\\\\\\",\\\\\\\"!**/*.test.{ts,tsx,js,jsx}\\\\\\\",\\\\\\\"!**/dist/**\\\\\\\",\\\\\\\"!**/node_modules/**\\\\\\\"]\",\"examples\":\"[\\\\\\\"this modal is keyboard-trapped — users can't Escape to close it\\\\\\\",\\\\\\\"screen reader doesn't announce when the form validation state changes\\\\\\\",\\\\\\\"add proper labels to these form fields so assistive tech can read them\\\\\\\",\\\\\\\"review this dropdown menu for arrow-key navigation and focus return\\\\\\\"]\",\"anti_examples\":\"[\\\\\\\"rewrite this error message at a 6th-grade reading level\\\\\\\",\\\\\\\"clean up this accessibility code without changing how it behaves\\\\\\\"]\",\"relations\":\"{\\\\\\\"boundary\\\\\\\":[{\\\\\\\"skill\\\\\\\":\\\\\\\"refactor\\\\\\\",\\\\\\\"reason\\\\\\\":\\\\\\\"refactor is behavior-preserving code modification; a11y is observable user-facing behavior\\\\\\\"},{\\\\\\\"skill\\\\\\\":\\\\\\\"diagnosis\\\\\\\",\\\\\\\"reason\\\\\\\":\\\\\\\"diagnosis classifies failure symptoms (Logic / Runtime / Performance / etc.) for triage; a11y owns assistive-tech behavior. The phrase 'rewrite this error message...' is a documentation/UX concern, not a diagnosis or a11y concern — diagnosis is named here so the router excludes it from a11y's positive scope.\\\\\\\"},{\\\\\\\"skill\\\\\\\":\\\\\\\"visual-design-foundations\\\\\\\",\\\\\\\"reason\\\\\\\":\\\\\\\"visual-design-foundations owns palette, typography, spacing, and visual craft; a11y owns whether the resulting interaction is perceivable, operable, understandable, and robust\\\\\\\"},{\\\\\\\"skill\\\\\\\":\\\\\\\"interaction-feedback\\\\\\\",\\\\\\\"reason\\\\\\\":\\\\\\\"interaction-feedback owns feedback-state staging; a11y owns whether those state changes are announced and operable\\\\\\\"}],\\\\\\\"related\\\\\\\":[\\\\\\\"interaction-patterns\\\\\\\",\\\\\\\"form-ux-architecture\\\\\\\",\\\\\\\"interaction-feedback\\\\\\\",\\\\\\\"design-system-architecture\\\\\\\"],\\\\\\\"verify_with\\\\\\\":[\\\\\\\"testing-strategy\\\\\\\"]}\",\"portability\":\"{\\\\\\\"readiness\\\\\\\":\\\\\\\"scripted\\\\\\\",\\\\\\\"targets\\\\\\\":[\\\\\\\"skill-md\\\\\\\"]}\",\"skill_graph_source_repo\":\"https://github.com/jacob-balslev/skill-graph\",\"skill_graph_protocol\":\"Skill Metadata Protocol v5\",\"skill_graph_project\":\"Skill Graph\",\"skill_graph_canonical_skill\":\"skills/a11y/SKILL.md\"}"
+  metadata: "{\"schema_version\":6,\"version\":\"1.0.0\",\"type\":\"capability\",\"category\":\"quality\",\"domain\":\"quality/accessibility\",\"scope\":\"portable\",\"owner\":\"skill-graph-maintainer\",\"freshness\":\"2026-04-18\",\"drift_check\":\"{\\\\\\\"last_verified\\\\\\\":\\\\\\\"2026-04-18\\\\\\\"}\",\"eval_artifacts\":\"present\",\"eval_state\":\"passing\",\"routing_eval\":\"present\",\"stability\":\"experimental\",\"keywords\":\"[\\\\\\\"accessibility\\\\\\\",\\\\\\\"a11y\\\\\\\",\\\\\\\"keyboard navigation\\\\\\\",\\\\\\\"screen reader\\\\\\\",\\\\\\\"focus management\\\\\\\",\\\\\\\"keyboard not working\\\\\\\",\\\\\\\"tab order\\\\\\\",\\\\\\\"missing aria label\\\\\\\",\\\\\\\"screen reader says\\\\\\\",\\\\\\\"reduced motion\\\\\\\",\\\\\\\"high contrast\\\\\\\",\\\\\\\"semantic html\\\\\\\",\\\\\\\"form labels\\\\\\\",\\\\\\\"form fields\\\\\\\",\\\\\\\"aria-label\\\\\\\",\\\\\\\"assistive tech\\\\\\\",\\\\\\\"assistive technology\\\\\\\",\\\\\\\"accessible labels\\\\\\\",\\\\\\\"proper labels\\\\\\\",\\\\\\\"keyboard trapped\\\\\\\",\\\\\\\"focus trap\\\\\\\",\\\\\\\"escape key not working\\\\\\\",\\\\\\\"modal keyboard trap\\\\\\\",\\\\\\\"dialog keyboard trap\\\\\\\"]\",\"triggers\":\"[\\\\\\\"a11y-skill\\\\\\\"]\",\"paths\":\"[\\\\\\\"**/*.{html,tsx,jsx,vue,svelte}\\\\\\\",\\\\\\\"**/*.css\\\\\\\",\\\\\\\"!**/*.test.{ts,tsx,js,jsx}\\\\\\\",\\\\\\\"!**/dist/**\\\\\\\",\\\\\\\"!**/node_modules/**\\\\\\\"]\",\"examples\":\"[\\\\\\\"this modal is keyboard-trapped — users can't Escape to close it\\\\\\\",\\\\\\\"screen reader doesn't announce when the form validation state changes\\\\\\\",\\\\\\\"add proper labels to these form fields so assistive tech can read them\\\\\\\",\\\\\\\"review this dropdown menu for arrow-key navigation and focus return\\\\\\\"]\",\"anti_examples\":\"[\\\\\\\"rewrite this error message at a 6th-grade reading level\\\\\\\",\\\\\\\"clean up this accessibility code without changing how it behaves\\\\\\\"]\",\"relations\":\"{\\\\\\\"boundary\\\\\\\":[{\\\\\\\"skill\\\\\\\":\\\\\\\"refactor\\\\\\\",\\\\\\\"reason\\\\\\\":\\\\\\\"refactor is behavior-preserving code modification; a11y is observable user-facing behavior\\\\\\\"},{\\\\\\\"skill\\\\\\\":\\\\\\\"diagnosis\\\\\\\",\\\\\\\"reason\\\\\\\":\\\\\\\"diagnosis classifies failure symptoms (Logic / Runtime / Performance / etc.) for triage; a11y owns assistive-tech behavior. The phrase 'rewrite this error message...' is a documentation/UX concern, not a diagnosis or a11y concern — diagnosis is named here so the router excludes it from a11y's positive scope.\\\\\\\"},{\\\\\\\"skill\\\\\\\":\\\\\\\"visual-design-foundations\\\\\\\",\\\\\\\"reason\\\\\\\":\\\\\\\"visual-design-foundations owns palette, typography, spacing, and visual craft; a11y owns whether the resulting interaction is perceivable, operable, understandable, and robust\\\\\\\"},{\\\\\\\"skill\\\\\\\":\\\\\\\"interaction-feedback\\\\\\\",\\\\\\\"reason\\\\\\\":\\\\\\\"interaction-feedback owns feedback-state staging; a11y owns whether those state changes are announced and operable\\\\\\\"},{\\\\\\\"skill\\\\\\\":\\\\\\\"best-practice\\\\\\\",\\\\\\\"reason\\\\\\\":\\\\\\\"best-practice owns generic code-quality cleanup and language/idiom hygiene; a11y owns assistive-tech behavior. Phrases like 'clean up this accessibility code without changing behavior' are best-practice refactor activities, not a11y semantic work — best-practice is named here so the router excludes it from a11y's positive scope.\\\\\\\"}],\\\\\\\"related\\\\\\\":[\\\\\\\"interaction-patterns\\\\\\\",\\\\\\\"form-ux-architecture\\\\\\\",\\\\\\\"interaction-feedback\\\\\\\",\\\\\\\"design-system-architecture\\\\\\\"],\\\\\\\"verify_with\\\\\\\":[\\\\\\\"testing-strategy\\\\\\\"]}\",\"portability\":\"{\\\\\\\"readiness\\\\\\\":\\\\\\\"scripted\\\\\\\",\\\\\\\"targets\\\\\\\":[\\\\\\\"skill-md\\\\\\\"]}\",\"skill_graph_source_repo\":\"https://github.com/jacob-balslev/skill-graph\",\"skill_graph_protocol\":\"Skill Metadata Protocol v5\",\"skill_graph_project\":\"Skill Graph\",\"skill_graph_canonical_skill\":\"skills/a11y/SKILL.md\"}"
   skill_graph_source_repo: "https://github.com/jacob-balslev/skill-graph"
   skill_graph_protocol: Skill Metadata Protocol v4
   skill_graph_project: Skill Graph

package/marketplace/skills/best-practice/SKILL.md

@@ -0,0 +1,211 @@
+---
+name: best-practice
+description: "Cross-cutting best practices enforcement across code, templates, skills, prompts, scripts, documentation, pages, and design. The enforcement layer that catches violations any specialist might miss. Do NOT use for deep code review methodology (use code-review), auth guard selection (use nextauth-patterns), SQL injection prevention (use security-scanning), PII masking (use gdpr-compliance), accessibility implementation depth (use a11y), or financial semantics (use code-logic)."
+license: MIT
+compatibility: "Applies to any web application codebase using TypeScript, React, and Next.js App Router. The cross-domain enforcement priorities (security, a11y, performance, design system, testing, DevOps, AI/LLM) are framework-agnostic; the Next.js section is specific to the App Router pattern."
+allowed-tools: Read Grep Bash
+metadata:
+  metadata: "{\"schema_version\":6,\"version\":\"1.2.0\",\"type\":\"capability\",\"category\":\"quality\",\"domain\":\"quality/cross-domain\",\"scope\":\"reference\",\"owner\":\"skill-graph-maintainer\",\"freshness\":\"2026-05-18\",\"drift_check\":\"{\\\\\\\"last_verified\\\\\\\":\\\\\\\"2026-05-18\\\\\\\",\\\\\\\"truth_source_hashes\\\\\\\":{}}\",\"eval_artifacts\":\"none\",\"eval_state\":\"unverified\",\"routing_eval\":\"absent\",\"stability\":\"stable\",\"keywords\":\"[\\\\\\\"best practice\\\\\\\",\\\\\\\"best practices\\\\\\\",\\\\\\\"code quality\\\\\\\",\\\\\\\"quality enforcement\\\\\\\",\\\\\\\"code review checklist\\\\\\\",\\\\\\\"OWASP\\\\\\\",\\\\\\\"WCAG\\\\\\\",\\\\\\\"Core Web Vitals\\\\\\\",\\\\\\\"SOLID principles\\\\\\\",\\\\\\\"clean code\\\\\\\",\\\\\\\"visual hierarchy\\\\\\\",\\\\\\\"typographic hierarchy\\\\\\\",\\\\\\\"color hierarchy\\\\\\\",\\\\\\\"UI composition\\\\\\\",\\\\\\\"cross-cutting concerns\\\\\\\",\\\\\\\"quality gate\\\\\\\",\\\\\\\"enforcement layer\\\\\\\"]\",\"examples\":\"[\\\\\\\"reviewing a pull request for correctness, security, and style\\\\\\\",\\\\\\\"creating a new React component and checking it against quality standards\\\\\\\",\\\\\\\"auditing an existing feature for WCAG compliance and performance regressions\\\\\\\",\\\\\\\"writing tests and verifying coverage shape (unit / integration / e2e pyramid)\\\\\\\",\\\\\\\"authoring a new skill and checking it has structured scope, evals, and examples\\\\\\\",\\\\\\\"adding a new Next.js Server Action and verifying it has Zod validation and auth check\\\\\\\"]\",\"anti_examples\":\"[\\\\\\\"reviewing PR feedback phrasing and comment classification (use code-review)\\\\\\\",\\\\\\\"choosing between requireAuth, requireOrgAuth, and withOrgAuth (use nextauth-patterns)\\\\\\\",\\\\\\\"implementing SQL injection prevention or webhook HMAC verification (use security-scanning)\\\\\\\",\\\\\\\"designing the APCA contrast ratio for a new color palette (use color-science)\\\\\\\",\\\\\\\"implementing the font loading strategy and vertical rhythm (use typography)\\\\\\\",\\\\\\\"deciding what quality means per artifact type — code vs skill vs prompt (use craft-doctrine)\\\\\\\"]\",\"relations\":\"{\\\\\\\"adjacent\\\\\\\":[\\\\\\\"code-review\\\\\\\",\\\\\\\"security-scanning\\\\\\\",\\\\\\\"a11y\\\\\\\",\\\\\\\"design-guide\\\\\\\",\\\\\\\"composition-theory\\\\\\\",\\\\\\\"color-science\\\\\\\",\\\\\\\"visual-design\\\\\\\",\\\\\\\"typography\\\\\\\",\\\\\\\"copywriting\\\\\\\",\\\\\\\"semantics\\\\\\\",\\\\\\\"ui-ux\\\\\\\",\\\\\\\"next-best-practices\\\\\\\"],\\\\\\\"boundary\\\\\\\":[],\\\\\\\"verify_with\\\\\\\":[\\\\\\\"code-review\\\\\\\",\\\\\\\"security-scanning\\\\\\\"]}\",\"grounding\":\"{\\\\\\\"domain_object\\\\\\\":\\\\\\\"Cross-cutting quality enforcement across 14 domains\\\\\\\",\\\\\\\"grounding_mode\\\\\\\":\\\\\\\"hybrid\\\\\\\",\\\\\\\"truth_sources\\\\\\\":[],\\\\\\\"failure_modes\\\\\\\":[\\\\\\\"specialist_boundary_gaps\\\\\\\",\\\\\\\"heading_hierarchy_violations\\\\\\\",\\\\\\\"hardcoded_values_bypass_token_system\\\\\\\",\\\\\\\"server_actions_treated_as_internal\\\\\\\",\\\\\\\"dead_tests_accumulate\\\\\\\"],\\\\\\\"evidence_priority\\\\\\\":\\\\\\\"general_knowledge_first\\\\\\\"}\",\"portability\":\"{\\\\\\\"readiness\\\\\\\":\\\\\\\"declared\\\\\\\",\\\\\\\"targets\\\\\\\":[\\\\\\\"skill-md\\\\\\\"]}\",\"lifecycle\":\"{\\\\\\\"stale_after_days\\\\\\\":180,\\\\\\\"review_cadence\\\\\\\":\\\\\\\"quarterly\\\\\\\"}\",\"skill_graph_source_repo\":\"https://github.com/jacob-balslev/skill-graph\",\"skill_graph_protocol\":\"Skill Metadata Protocol v6\",\"skill_graph_project\":\"Skill Graph\",\"skill_graph_canonical_skill\":\"skills/best-practice/SKILL.md\"}"
+  skill_graph_source_repo: "https://github.com/jacob-balslev/skill-graph"
+  skill_graph_protocol: Skill Metadata Protocol v4
+  skill_graph_project: Skill Graph
+  skill_graph_canonical_skill: skills/best-practice/SKILL.md
+---
+
+# Best Practice — Cross-Cutting Quality Enforcement
+
+## Domain Context
+
+**What is this skill?** Cross-cutting best practices enforcement across code, templates, skills, prompts, scripts, documentation, pages, and design. The enforcement layer that catches violations any specialist might miss.
+
+## Coverage
+
+Cross-cutting best practices enforcement across code, templates, skills, prompts, scripts, documentation, pages, and design. The sections below contain the detailed rules, examples, and boundaries for using this skill correctly.
+
+## Coverage (14 domains)
+
+Code quality (SOLID, strict TypeScript, DRY/KISS), documentation (ADRs, self-documenting names, TSDoc), security (OWASP Top 10:2025, secret management, input validation), accessibility (WCAG 2.2, semantic HTML, keyboard operability), performance (Core Web Vitals, code splitting, image optimization), design systems (token hierarchy, dark mode, composable APIs), testing (pyramid shape, behavior-not-implementation, coverage guardrails), DevOps (trunk-based development, progressive delivery, pipeline-as-code), AI/LLM skill design (RCCF structure, eval methodology, scope boundaries), Next.js App Router patterns (Server Components default, Server Action security, explicit caching), UX & UI composition (F-pattern for data surfaces, one L1 focal point per zone, density-first spacing), visual hierarchy (surface layering, card/banner depth, information density vs whitespace), typographic hierarchy (6-level heading contract, Minor Third scale, 4 canonical weights, h6 micro-labels), and color hierarchy (greyscale chrome, financial-only semantic color, triple encoding for colorblind safety).
+
+> **Authority:** Cross-domain quality gate. Does not override specialist skills — catches violations that fall between specialist boundaries. Defer to specialists for depth.
+> **Scope:** "Small focused changes" means scope discipline, NOT code reduction. See craft-doctrine for the enrichment principle.
+
+## Philosophy
+
+This skill exists because quality violations most often occur at the boundaries between specialist domains — a developer focuses on getting the TypeScript right but ships a `<div onClick>` instead of a `<button>`, or nails the component logic but hardcodes a hex color. No single specialist skill catches all of these; each covers its own depth. Without a cross-cutting enforcement layer, agents produce code that passes within any one domain but fails the "would a senior engineer approve this PR?" test. Observed failure modes that motivated this skill: SQL injection via string interpolation passing TypeScript strict mode, skipped test.skip entries accumulating into permanent dead tests, Server Actions treated as internal functions despite being public HTTP endpoints, and heading hierarchy violations slipping through because neither the a11y skill nor the design-guide skill owned the overlap zone. This skill is the net that catches what falls between specialist boundaries.
+
+---
+
+## Cross-Domain Synergy
+As the baseline enforcement layer, this skill connects:
+- **ui-ux & composition-theory**: Enforcing layout rules (one L1 focal point, F-pattern for data, density-first spacing).
+- **visual-design & design-guide**: Surface hierarchy, card depth, information density vs whitespace balance.
+- **typography & semantics**: Strict adherence to 6-level heading hierarchy, Minor Third scale, readable names.
+- **color-science**: Greyscale chrome enforcement, financial-only semantic color, triple encoding for colorblind safety.
+- **copywriting**: Validating copy inside PRs against the brand's calm-authority tone.
+
+## 1. Code Quality
+
+| Rule | Enforcement |
+|------|-------------|
+| Strict TypeScript | `"strict": true`, no `any`, no `@ts-ignore` without explanation |
+| SOLID principles | One responsibility per module, depend on abstractions |
+| DRY / KISS / YAGNI | No duplicate blocks >10 lines, no premature abstraction |
+| Explicit return types | Every exported function declares its return type |
+| Small focused changes | PRs touch one logical concern, <400 changed lines (excl. generated) |
+
+> Anti-patterns and checklist: `references/code-quality-checklist.md`. See semantics for naming rules, craft-doctrine for quality dimensions.
+
+## 2. Documentation
+
+| Rule | Enforcement |
+|------|-------------|
+| Self-documenting names | If a name needs a comment, rename it |
+| Comments explain WHY | Code explains what; comments explain intent, gotchas, business rules |
+| ADRs for decisions | `/sales-hub/docs/adr/` — Context, Decision, Alternatives, Consequences |
+| TSDoc on public APIs | `@param`, `@returns`, `@throws` on exported functions |
+| No stale TODOs | Every `// TODO` must reference a ticket: `// TODO(SH-1234)` |
+
+> See adr for ADR creation methodology. See doc-updater for the documentation update protocol.
+
+## 3. Security (OWASP Top 10:2025)
+
+| Priority | Rule | Check |
+|----------|------|-------|
+| A01 | Broken Access Control | Every endpoint verifies auth AND authz; default-deny |
+| A03 | Supply Chain | No high/critical CVEs; pin dependency versions |
+| A05 | Injection | Parameterized queries only; Zod validation on all input |
+| A10 | Exception Handling | No stack traces to clients; all errors caught server-side |
+| — | Secret management | No secrets in source; `.env*` in `.gitignore` |
+
+> Deep reference: `references/security-checklist.md`. See security-scanning for SQL injection prevention, CSRF, and webhook security details. See gdpr-compliance for PII masking, per-provider erasure handlers, and retention enforcement.
+
+## 4. Accessibility (WCAG 2.2)
+
+| Rule | Standard | Check |
+|------|----------|-------|
+| Semantic HTML first | WCAG 4.1.2 | `<button>` not `<div onClick>`, native `<dialog>`, `<nav>` |
+| Keyboard operable | WCAG 2.1.1 | All functionality via Tab/Enter/Space/Arrows; no traps |
+| Color contrast | WCAG 1.4.3 | 4.5:1 text, 3:1 UI components |
+| Target size | WCAG 2.5.8 | 24px WCAG minimum; **Sales Hub enforces 44x44px** |
+| Heading hierarchy | WCAG 1.3.1 | Sequential h1>h2>h3, no skipping, one h1 per page |
+
+> Deep reference: `references/accessibility-checklist.md`. See a11y for Sales Hub 44px targets, Axe-Core Playwright tests, focus-ring system, reduced-motion strategy, and live-region placement.
+
+## 5. Performance
+
+| Rule | Threshold | Check |
+|------|-----------|-------|
+| LCP | <2.5s | No lazy-load on above-fold images |
+| INP | <200ms | No main-thread tasks >50ms; defer non-critical JS |
+| CLS | <0.1 | Images have `width`/`height`; no layout shifts |
+| Bundle discipline | Monitor in CI | Dynamic `import()` for routes; no full-library imports |
+| Image optimization | AVIF/WebP | `next/image` with proper sizing; `loading="lazy"` below fold |
+
+> Deep reference: `references/performance-checklist.md`. See react-best-practices for 57 detailed performance optimization rules across 8 categories.
+
+## 6. Design System
+
+| Rule | Enforcement |
+|------|-------------|
+| Three-tier token hierarchy | Primitive > Semantic > Component; never use primitives in components |
+| No hardcoded values | All colors, spacing, typography via tokens — never raw hex or px |
+| Dark mode via CSS custom properties | `:root` light, `[data-theme="dark"]` overrides |
+| Composable component APIs | Variant props from tokens, not arbitrary style overrides |
+| No `!important` | Fix specificity, don't override it |
+
+> See design-guide for Sales Hub heading tokens, surface hierarchy, and financial display rules. See design-token-architecture for W3C DTCG format, naming conventions, and CVA patterns.
+
+## 7. Testing
+
+| Rule | Enforcement |
+|------|-------------|
+| Pyramid shape | Many unit, some integration, few E2E |
+| Test behavior, not implementation | Public interfaces and observable outcomes only |
+| Coverage guardrails | 70-80% line coverage; focus on logic and edge cases |
+| No dead tests | No `test.skip` / `xit` without linked ticket |
+| Co-located test files | `.test.ts` next to source `.ts` |
+
+> Deep reference: `references/testing-patterns.md`. See craft-doctrine for quality dimensions that define what "tested" means per artifact type.
+
+## 8. DevOps & CI/CD
+
+| Rule | Enforcement |
+|------|-------------|
+| Trunk-based development | Short-lived branches (<2 days); feature flags control visibility |
+| Pipeline as code | Build, lint, typecheck, test, security scan — all automated gates |
+| Feature flag lifecycle | Owner + expiration; remove within 30 days of GA |
+| No force operations | No `--force` push, no `--no-verify`, no `reset --hard` without cause |
+| Rollback strategy | Health checks + documented recovery path |
+
+## 9. AI/LLM Skill & Prompt Design
+
+| Rule | Enforcement |
+|------|-------------|
+| RCCF structure | Role, Context, Constraints, Format in every prompt |
+| Structured outputs | JSON schemas or Zod validation; never free-text parsing |
+| Few-shot examples | 2-3 examples for non-trivial tasks |
+| Eval coverage | Every skill has evals.json with 7+ scenarios |
+| Explicit scope boundaries | Define what skill does AND does not do |
+
+> See skill-scaffold for skill creation methodology. See craft-doctrine for skill content quality dimensions.
+
+## 10. Next.js App Router
+
+| Rule | Enforcement |
+|------|-------------|
+| Server Components default | `'use client'` is opt-in, pushed down the tree |
+| Server Actions = public API | Zod validation + auth check as first two operations |
+| Explicit caching | `revalidatePath` / `revalidateTag` after mutations |
+| Loading states | `loading.tsx` or Suspense boundaries for async routes |
+| No Pages Router patterns | No `getServerSideProps`, `getStaticProps`, `_app.tsx` |
+
+> Deep reference: `references/nextjs-patterns.md`. See nextauth-patterns for auth guard choice (requireAuth vs requireOrgAuth vs withOrgAuth) and 13 critical anti-patterns. See middleware-architecture for the request pipeline (CSRF, CSP, onboarding redirect).
+
+---
+
+## Cross-Domain Enforcement Priorities
+
+These rules appear across 3+ domains — **highest enforcement weight**:
+
+1. **Validate all input server-side** (Security + Next.js + Testing)
+2. **Never expose secrets or PII** (Security + DevOps + GDPR)
+3. **Semantic HTML over ARIA hacks** (Accessibility + Design System)
+4. **Automate quality gates in CI** (Code Quality + Testing + DevOps + Security)
+5. **Test behavior, not implementation** (Testing + Code Quality)
+6. **Token hierarchy, never hardcoded values** (Design System + Performance)
+7. **Server Components by default** (Next.js + Performance + Security)
+8. **Small, focused changes** (Code Quality + DevOps + AI/LLM)
+9. **Explicit caching strategy** (Next.js + Performance)
+10. **Structure over verbosity** (AI/LLM + Documentation)
+
+---
+
+## Verification
+
+- [ ] **Code:** No `any`, no lint suppressions without reason, explicit return types
+- [ ] **Docs:** Names are self-documenting, TODOs have tickets, ADRs for decisions
+- [ ] **Security:** Auth checked, input validated, no secrets in source
+- [ ] **A11y:** Semantic HTML, keyboard operable, contrast passing, targets 44px (Sales Hub)
+- [ ] **Perf:** No unnecessary client JS, images optimized, no layout shifts
+- [ ] **Design:** All values from tokens, no `!important`, dark mode works
+- [ ] **Tests:** New logic has tests, behavior-focused, no dead tests
+- [ ] **DevOps:** No force operations, feature flags have owners, pipeline passes
+- [ ] **AI/LLM:** Skills have evals, prompts have structure, scope is bounded
+- [ ] **Next.js:** Server Components default, Server Actions secured, caching explicit
+
+## Do NOT Use When
+
+| Instead of this skill | Use | Why |
+|---|---|---|
+| Deep code review methodology (feedback phrasing, review structure) | `code-review` | code-review owns the review process and feedback format |
+| Auth guard function selection (requireAuth vs requireOrgAuth) | `nextauth-patterns` | nextauth-patterns owns the auth boundary decision tree |
+| SQL injection prevention, CSRF, webhook signature verification | `security-scanning` | security-scanning owns automated security scanning depth |
+| PII masking, per-provider erasure handlers, retention enforcement | `gdpr-compliance` | gdpr-compliance owns GDPR-specific implementation |
+| 44px touch targets, focus-ring system, reduced-motion strategy | `a11y` | a11y owns Sales Hub accessibility implementation depth |
+| Financial calculation correctness (rounding, decimal precision) | `code-logic` | code-logic owns financial semantics and calculation rules |
+| Heading tokens, surface hierarchy, financial display rules | `design-guide` | design-guide is the authoritative design system contract |
+| L1 focal point rules, F-pattern layout, zone-based composition | `composition-theory` | composition-theory owns layout composition rules |
+| Font loading, OpenType features, vertical rhythm | `typography` | typography owns deep typographic engineering |
+| Token sync contract, APCA contrast math | `color-science` | color-science owns the color system rules |
+| SCSS architecture, BEM naming, design token integration | `scss-expert` | scss-expert owns CSS architecture patterns |
+| What "better" means per artifact type | `craft-doctrine` | craft-doctrine defines quality dimensions and the enrichment principle |

package/marketplace/skills/context-graph/SKILL.md

@@ -5,7 +5,7 @@ license: MIT
 compatibility: "Architecture-level skill. Applies to any agent-coding workspace that has more than one skill / doc-routing / memory artifact and any way to traverse them — Claude Code, OpenCode, Cursor, Aider, Continue, Copilot Workspace, or a custom harness. The four-graph model and the orphan / connectivity metrics are independent of the specific runtime."
 allowed-tools: Read Grep
 metadata:
-  metadata: "{\"schema_version\":6,\"version\":\"1.0.0\",\"type\":\"capability\",\"category\":\"agent\",\"domain\":\"agent/context\",\"scope\":\"portable\",\"owner\":\"skill-graph-maintainer\",\"freshness\":\"2026-05-06\",\"drift_check\":\"{\\\\\\\"last_verified\\\\\\\":\\\\\\\"2026-05-13\\\\\\\",\\\\\\\"truth_source_hashes\\\\\\\":{\\\\\\\"SKILL_GRAPH.md\\\\\\\":\\\\\\\"a63fc59a1d99933fc6bc5c4033f8be86ee2f5460f3b5d5ab232a3f77eff71c8f\\\\\\\",\\\\\\\"docs/PRIMER.md\\\\\\\":\\\\\\\"e6bd99468c224fe4c9606e147c5db94dff889feeb9ca5d80084480039c7e9296\\\\\\\",\\\\\\\"docs/concept-map.md\\\\\\\":\\\\\\\"053e5cf891d7abf7efb30c9014fd2365da7d13588ef6b55057520756a315dc8c\\\\\\\",\\\\\\\"docs/diagrams/starter-graph.mmd\\\\\\\":\\\\\\\"6aeaa417e08efbb6bb90b34f56c8df7f06dc608e3c8cd743d428da9fcfaf278c\\\\\\\",\\\\\\\"scripts/generate-manifest.js\\\\\\\":\\\\\\\"9d7bbbdae440fdb1763d61ffa7bda10c9efae92359d1c2139d0e971582d59e0e\\\\\\\",\\\\\\\"scripts/skill-overlap.js\\\\\\\":\\\\\\\"ed642cbc677cc76ec1321300b37d6752337b6b5541c7a9f558fd315d6f934e4b\\\\\\\"}}\",\"eval_artifacts\":\"planned\",\"eval_state\":\"unverified\",\"routing_eval\":\"absent\",\"stability\":\"experimental\",\"keywords\":\"[\\\\\\\"context graph architecture\\\\\\\",\\\\\\\"multi-graph context model\\\\\\\",\\\\\\\"skill knowledge graph\\\\\\\",\\\\\\\"document routing graph\\\\\\\",\\\\\\\"memory index graph\\\\\\\",\\\\\\\"script command registry graph\\\\\\\",\\\\\\\"cross-graph edges\\\\\\\",\\\\\\\"orphan detection skill graph\\\\\\\",\\\\\\\"graph connectivity metrics\\\\\\\",\\\\\\\"average node degree\\\\\\\",\\\\\\\"hub-and-spoke anti-pattern\\\\\\\",\\\\\\\"reciprocal relations\\\\\\\",\\\\\\\"bidirectional graph edges\\\\\\\",\\\\\\\"change propagation across graphs\\\\\\\",\\\\\\\"edge type taxonomy\\\\\\\",\\\\\\\"adjacent boundary verify_with\\\\\\\",\\\\\\\"deterministic graph synthesis\\\\\\\",\\\\\\\"bundle co-membership\\\\\\\"]\",\"examples\":\"[\\\\\\\"we have ~300 skills but the agent never finds half of them — what's the diagnostic frame?\\\\\\\",\\\\\\\"how do I measure whether our skill graph is actually navigable vs just present?\\\\\\\",\\\\\\\"I changed a webhook handler — what's the discipline for tracing the impact across docs, skills, memory, and scripts?\\\\\\\",\\\\\\\"we keep accumulating orphan skills and our connectivity drops every quarter — how do I make graph-health a deliberate gate?\\\\\\\",\\\\\\\"the agent is loading 15 skills per task and burning context — is the underlying graph too dense, too sparse, or wrong-shaped?\\\\\\\",\\\\\\\"design a deterministic recipe for synthesizing the skill graph from frontmatter without running an LLM\\\\\\\",\\\\\\\"what's the right cap on adjacent / boundary / verify_with relations per skill?\\\\\\\"]\",\"anti_examples\":\"[\\\\\\\"scaffold a new SKILL.md from a template\\\\\\\",\\\\\\\"validate that this single skill's frontmatter matches the schema\\\\\\\",\\\\\\\"decide which skill to inject for this query right now\\\\\\\",\\\\\\\"this skill says 'use orgQuery'; that one says 'never use orgQuery' — fix the conflict\\\\\\\",\\\\\\\"decide what should and shouldn't be in this agent's context window for this task\\\\\\\",\\\\\\\"review this AI-generated PR for correctness\\\\\\\"]\",\"relations\":\"{\\\\\\\"boundary\\\\\\\":[{\\\\\\\"skill\\\\\\\":\\\\\\\"skill-router\\\\\\\",\\\\\\\"reason\\\\\\\":\\\\\\\"skill-router is the per-query dispatch decision (which skill activates now); context-graph is the underlying graph the router traverses\\\\\\\"},{\\\\\\\"skill\\\\\\\":\\\\\\\"graph-audit\\\\\\\",\\\\\\\"reason\\\\\\\":\\\\\\\"graph-audit validates one skill's schema and relation-target existence; context-graph reasons about the topology of the whole graph (orphans, connectivity, edge cap discipline)\\\\\\\"},{\\\\\\\"skill\\\\\\\":\\\\\\\"skill-infrastructure\\\\\\\",\\\\\\\"reason\\\\\\\":\\\\\\\"skill-infrastructure owns the live skill library tooling (census, conflict detection, routing-gap reporting); context-graph owns the architectural model behind it\\\\\\\"},{\\\\\\\"skill\\\\\\\":\\\\\\\"skill-scaffold\\\\\\\",\\\\\\\"reason\\\\\\\":\\\\\\\"skill-scaffold authors a single SKILL.md; context-graph designs the graph that those authored skills participate in\\\\\\\"}],\\\\\\\"related\\\\\\\":[\\\\\\\"skill-router\\\\\\\",\\\\\\\"graph-audit\\\\\\\",\\\\\\\"skill-infrastructure\\\\\\\",\\\\\\\"skill-scaffold\\\\\\\"],\\\\\\\"verify_with\\\\\\\":[\\\\\\\"graph-audit\\\\\\\",\\\\\\\"skill-infrastructure\\\\\\\"]}\",\"grounding\":\"{\\\\\\\"domain_object\\\\\\\":\\\\\\\"Skill Graph library topology and context discovery model\\\\\\\",\\\\\\\"grounding_mode\\\\\\\":\\\\\\\"hybrid\\\\\\\",\\\\\\\"truth_sources\\\\\\\":[\\\\\\\"SKILL_GRAPH.md\\\\\\\",\\\\\\\"docs/PRIMER.md\\\\\\\",\\\\\\\"docs/concept-map.md\\\\\\\",\\\\\\\"docs/diagrams/starter-graph.mmd\\\\\\\",\\\\\\\"scripts/generate-manifest.js\\\\\\\",\\\\\\\"scripts/skill-overlap.js\\\\\\\"],\\\\\\\"failure_modes\\\\\\\":[\\\\\\\"inferred_edges_replace_authored_relations\\\\\\\",\\\\\\\"orphan_skills_remain_unreachable\\\\\\\",\\\\\\\"relation_caps_turn_into_hub_and_spoke_graph\\\\\\\",\\\\\\\"change_propagation_ignores_cross_graph_edges\\\\\\\"],\\\\\\\"evidence_priority\\\\\\\":\\\\\\\"repo_code_first\\\\\\\"}\",\"portability\":\"{\\\\\\\"readiness\\\\\\\":\\\\\\\"scripted\\\\\\\",\\\\\\\"targets\\\\\\\":[\\\\\\\"skill-md\\\\\\\"]}\",\"lifecycle\":\"{\\\\\\\"stale_after_days\\\\\\\":365,\\\\\\\"review_cadence\\\\\\\":\\\\\\\"quarterly\\\\\\\"}\",\"skill_graph_source_repo\":\"https://github.com/jacob-balslev/skill-graph\",\"skill_graph_protocol\":\"Skill Metadata Protocol v5\",\"skill_graph_project\":\"Skill Graph\",\"skill_graph_canonical_skill\":\"skills/context-graph/SKILL.md\",\"skill_graph_export_description\":\"shortened for Agent Skills 1024-character description limit; canonical source keeps the full routing contract\",\"skill_graph_canonical_description_length\":\"1597\"}"
+  metadata: "{\"schema_version\":6,\"version\":\"1.1.0\",\"type\":\"capability\",\"category\":\"agent\",\"domain\":\"agent/context\",\"scope\":\"portable\",\"owner\":\"skill-graph-maintainer\",\"freshness\":\"2026-05-18\",\"drift_check\":\"{\\\\\\\"last_verified\\\\\\\":\\\\\\\"2026-05-18\\\\\\\"}\",\"eval_artifacts\":\"planned\",\"eval_state\":\"unverified\",\"routing_eval\":\"absent\",\"comprehension_state\":\"present\",\"stability\":\"experimental\",\"keywords\":\"[\\\\\\\"context graph architecture\\\\\\\",\\\\\\\"multi-graph context model\\\\\\\",\\\\\\\"skill knowledge graph\\\\\\\",\\\\\\\"document routing graph\\\\\\\",\\\\\\\"memory index graph\\\\\\\",\\\\\\\"script command registry graph\\\\\\\",\\\\\\\"cross-graph edges\\\\\\\",\\\\\\\"orphan detection skill graph\\\\\\\",\\\\\\\"graph connectivity metrics\\\\\\\",\\\\\\\"average node degree\\\\\\\",\\\\\\\"hub-and-spoke anti-pattern\\\\\\\",\\\\\\\"reciprocal relations\\\\\\\",\\\\\\\"bidirectional graph edges\\\\\\\",\\\\\\\"change propagation across graphs\\\\\\\",\\\\\\\"edge type taxonomy\\\\\\\",\\\\\\\"adjacent boundary verify_with\\\\\\\",\\\\\\\"deterministic graph synthesis\\\\\\\",\\\\\\\"bundle co-membership\\\\\\\"]\",\"examples\":\"[\\\\\\\"we have ~300 skills but the agent never finds half of them — what's the diagnostic frame?\\\\\\\",\\\\\\\"how do I measure whether our skill graph is actually navigable vs just present?\\\\\\\",\\\\\\\"I changed a webhook handler — what's the discipline for tracing the impact across docs, skills, memory, and scripts?\\\\\\\",\\\\\\\"we keep accumulating orphan skills and our connectivity drops every quarter — how do I make graph-health a deliberate gate?\\\\\\\",\\\\\\\"the agent is loading 15 skills per task and burning context — is the underlying graph too dense, too sparse, or wrong-shaped?\\\\\\\",\\\\\\\"design a deterministic recipe for synthesizing the skill graph from frontmatter without running an LLM\\\\\\\",\\\\\\\"what's the right cap on adjacent / boundary / verify_with relations per skill?\\\\\\\"]\",\"anti_examples\":\"[\\\\\\\"scaffold a new SKILL.md from a template\\\\\\\",\\\\\\\"validate that this single skill's frontmatter matches the schema\\\\\\\",\\\\\\\"decide which skill to inject for this query right now\\\\\\\",\\\\\\\"this skill says 'use orgQuery'; that one says 'never use orgQuery' — fix the conflict\\\\\\\",\\\\\\\"decide what should and shouldn't be in this agent's context window for this task\\\\\\\",\\\\\\\"review this AI-generated PR for correctness\\\\\\\"]\",\"relations\":\"{\\\\\\\"boundary\\\\\\\":[{\\\\\\\"skill\\\\\\\":\\\\\\\"skill-router\\\\\\\",\\\\\\\"reason\\\\\\\":\\\\\\\"skill-router is the per-query dispatch decision (which skill activates now); context-graph is the underlying graph the router traverses\\\\\\\"},{\\\\\\\"skill\\\\\\\":\\\\\\\"graph-audit\\\\\\\",\\\\\\\"reason\\\\\\\":\\\\\\\"graph-audit validates one skill's schema and relation-target existence; context-graph reasons about the topology of the whole graph (orphans, connectivity, edge cap discipline)\\\\\\\"},{\\\\\\\"skill\\\\\\\":\\\\\\\"skill-infrastructure\\\\\\\",\\\\\\\"reason\\\\\\\":\\\\\\\"skill-infrastructure owns the live skill library tooling (census, conflict detection, routing-gap reporting); context-graph owns the architectural model behind it\\\\\\\"},{\\\\\\\"skill\\\\\\\":\\\\\\\"skill-scaffold\\\\\\\",\\\\\\\"reason\\\\\\\":\\\\\\\"skill-scaffold authors a single SKILL.md; context-graph designs the graph that those authored skills participate in\\\\\\\"}],\\\\\\\"related\\\\\\\":[\\\\\\\"skill-router\\\\\\\",\\\\\\\"graph-audit\\\\\\\",\\\\\\\"skill-infrastructure\\\\\\\",\\\\\\\"skill-scaffold\\\\\\\"],\\\\\\\"verify_with\\\\\\\":[\\\\\\\"graph-audit\\\\\\\",\\\\\\\"skill-infrastructure\\\\\\\"]}\",\"grounding\":\"{\\\\\\\"domain_object\\\\\\\":\\\\\\\"Agent workspace context topology and discovery model\\\\\\\",\\\\\\\"grounding_mode\\\\\\\":\\\\\\\"hybrid\\\\\\\",\\\\\\\"truth_sources\\\\\\\":[\\\\\\\"https://github.com/jacob-balslev/skill-graph/blob/main/SKILL_GRAPH.md\\\\\\\",\\\\\\\"https://github.com/jacob-balslev/skill-graph/blob/main/docs/PRIMER.md\\\\\\\",\\\\\\\"https://github.com/jacob-balslev/skill-graph/blob/main/docs/concept-map.md\\\\\\\",\\\\\\\"https://github.com/jacob-balslev/skill-graph/blob/main/docs/diagrams/starter-graph.mmd\\\\\\\",\\\\\\\"https://github.com/jacob-balslev/skill-graph/blob/main/scripts/generate-manifest.js\\\\\\\",\\\\\\\"https://github.com/jacob-balslev/skill-graph/blob/main/scripts/skill-overlap.js\\\\\\\"],\\\\\\\"failure_modes\\\\\\\":[\\\\\\\"inferred_edges_replace_authored_relations\\\\\\\",\\\\\\\"orphan_skills_remain_unreachable\\\\\\\",\\\\\\\"relation_caps_turn_into_hub_and_spoke_graph\\\\\\\",\\\\\\\"change_propagation_ignores_cross_graph_edges\\\\\\\"],\\\\\\\"evidence_priority\\\\\\\":\\\\\\\"repo_code_first\\\\\\\"}\",\"portability\":\"{\\\\\\\"readiness\\\\\\\":\\\\\\\"scripted\\\\\\\",\\\\\\\"targets\\\\\\\":[\\\\\\\"skill-md\\\\\\\"]}\",\"lifecycle\":\"{\\\\\\\"stale_after_days\\\\\\\":365,\\\\\\\"review_cadence\\\\\\\":\\\\\\\"quarterly\\\\\\\"}\",\"mental_model\":\"Context discovery is a graph problem: agents start from the current task, then traverse typed edges to find the skills, docs, memory records, scripts, and command surfaces that are relevant but not explicitly named. The useful primitives are nodes, typed edges, traversal roots, graph health metrics, and propagation paths. The core relationship is that a node's quality only matters if traversal can reach it; unreachable knowledge behaves like missing knowledge.\",\"purpose\":\"Prevents large agent workspaces from becoming flat piles of disconnected files. Without a context graph, agents over-rely on exact-name recall, load overly broad context, miss nearby safety or correctness skills, and let documentation or memory drift because change propagation has no visible route. This skill replaces ad hoc \\\\\\\"search until something looks relevant\\\\\\\" with explicit topology, health checks, and propagation discipline.\",\"boundary\":\"Distinct from skill routing, which decides what to load for one query; this skill designs the graph that routing traverses. Distinct from context-window budgeting, which decides how much selected material fits; this skill decides how material becomes discoverable. Distinct from single-skill audit, which validates one node; this skill evaluates library topology, edge discipline, orphan risk, and cross-graph propagation.\",\"analogy\":\"A context graph is a transit map for an agent workspace: individual stations can be excellent, but the system only works when routes connect them, transfer points are intentional, and isolated stops are visible enough to fix.\",\"misconception\":\"The common mistake is treating graph metadata as decoration: add a few \\\\\\\"related\\\\\\\" links, trust search to fill gaps, and assume more edges always means better discovery. That produces noisy hubs, one-way references, and isolated specialist skills. A useful graph is not the densest graph; it is the graph whose typed edges preserve routing meaning, keep important nodes reachable, and make change propagation auditable.\",\"concept\":\"{\\\\\\\"definition\\\\\\\":\\\\\\\"A context graph is the explicit topology that connects an agent workspace's skills, docs, memory records, scripts, and commands so agents can discover relevant context by traversal rather than exact-name recall.\\\\\\\",\\\\\\\"mental_model\\\\\\\":\\\\\\\"Agents start from a task as the traversal root, then follow typed edges to reachable nodes. Node quality and graph reachability are separate properties: a beautifully written skill that no route reaches behaves like absent knowledge. Healthy graph work therefore watches edge meaning, orphan rate, degree distribution, cluster boundaries, and cross-graph propagation paths together.\\\\\\\",\\\\\\\"purpose\\\\\\\":\\\\\\\"It solves the flat-library failure mode where useful knowledge exists but agents cannot find it unless the user names it directly. The replacement is explicit topology: authored relations, deterministic synthesis signals, health metrics, and propagation checks that make relevance discoverable and drift visible.\\\\\\\",\\\\\\\"boundary\\\\\\\":\\\\\\\"It is not per-query skill routing, context-window budgeting, or single-file metadata linting. Routing consumes the graph, budgeting trims selected context, and single-skill audit checks one node; context-graph work asks whether the whole workspace is navigable and whether changes propagate through the right edges.\\\\\\\",\\\\\\\"taxonomy\\\\\\\":\\\\\\\"Main graph families are skill knowledge graphs, document routing graphs, memory indexes, and script or command registries. Main edge concerns are typed meaning, reachability, reciprocity, degree caps, cross-graph propagation, and deterministic rebuild signals.\\\\\\\",\\\\\\\"analogy\\\\\\\":\\\\\\\"A context graph is a transit map for an agent workspace: individual stations can be excellent, but the system only works when routes connect them, transfer points are intentional, and isolated stops are visible enough to fix.\\\\\\\",\\\\\\\"misconception\\\\\\\":\\\\\\\"The trap is believing more links always improve discovery. Over-linking creates noisy hubs, under-linking creates orphans, and untyped links destroy routing meaning. The useful graph is the one whose edges preserve intent and make important context reachable.\\\\\\\"}\",\"skill_graph_source_repo\":\"https://github.com/jacob-balslev/skill-graph\",\"skill_graph_protocol\":\"Skill Metadata Protocol v5\",\"skill_graph_project\":\"Skill Graph\",\"skill_graph_canonical_skill\":\"skills/context-graph/SKILL.md\",\"skill_graph_export_description\":\"shortened for Agent Skills 1024-character description limit; canonical source keeps the full routing contract\",\"skill_graph_canonical_description_length\":\"1597\"}"
   skill_graph_source_repo: "https://github.com/jacob-balslev/skill-graph"
   skill_graph_protocol: Skill Metadata Protocol v4
   skill_graph_project: Skill Graph

package/marketplace/skills/debugging/SKILL.md

@@ -5,7 +5,7 @@ license: MIT
 compatibility: "Markdown, Git, any codebase"
 allowed-tools: Read Grep Bash
 metadata:
-  metadata: "{\"schema_version\":6,\"version\":\"1.0.0\",\"type\":\"workflow\",\"category\":\"engineering\",\"scope\":\"portable\",\"owner\":\"skill-graph-maintainer\",\"freshness\":\"2026-04-18\",\"drift_check\":\"{\\\\\\\"last_verified\\\\\\\":\\\\\\\"2026-04-18\\\\\\\"}\",\"eval_artifacts\":\"present\",\"eval_state\":\"passing\",\"routing_eval\":\"present\",\"stability\":\"experimental\",\"keywords\":\"[\\\\\\\"debugging\\\\\\\",\\\\\\\"reproduce failure\\\\\\\",\\\\\\\"reproduce bug\\\\\\\",\\\\\\\"failing test\\\\\\\",\\\\\\\"root cause\\\\\\\",\\\\\\\"symptom vs cause\\\\\\\",\\\\\\\"minimum reproduction\\\\\\\",\\\\\\\"bisect\\\\\\\",\\\\\\\"what caused it\\\\\\\",\\\\\\\"my tests are failing\\\\\\\",\\\\\\\"why is this broken\\\\\\\",\\\\\\\"it broke in production\\\\\\\",\\\\\\\"cannot reproduce\\\\\\\",\\\\\\\"test passes locally\\\\\\\",\\\\\\\"stack trace\\\\\\\",\\\\\\\"used to work\\\\\\\",\\\\\\\"worked yesterday\\\\\\\",\\\\\\\"what changed\\\\\\\",\\\\\\\"was working before\\\\\\\",\\\\\\\"agent stuck\\\\\\\",\\\\\\\"stuck in a loop\\\\\\\",\\\\\\\"stuck in loop\\\\\\\",\\\\\\\"blocking my commit\\\\\\\",\\\\\\\"blocking the build\\\\\\\",\\\\\\\"specific error\\\\\\\",\\\\\\\"specific failure\\\\\\\",\\\\\\\"diagnose failure\\\\\\\",\\\\\\\"error blocking\\\\\\\",\\\\\\\"broke the build\\\\\\\",\\\\\\\"broke build\\\\\\\"]\",\"triggers\":\"[\\\\\\\"debugging-skill\\\\\\\"]\",\"examples\":\"[\\\\\\\"my tests pass locally but fail in CI — why?\\\\\\\",\\\\\\\"this function used to work yesterday; what changed?\\\\\\\",\\\\\\\"reproduce this Stripe webhook failure from production logs\\\\\\\",\\\\\\\"I see the symptom but can't find the root cause of this nil panic\\\\\\\"]\",\"anti_examples\":\"[\\\\\\\"plan test coverage for a new feature\\\\\\\",\\\\\\\"document what this function does for future readers\\\\\\\",\\\\\\\"refactor this messy code while the test suite is green\\\\\\\"]\",\"relations\":\"{\\\\\\\"boundary\\\\\\\":[{\\\\\\\"skill\\\\\\\":\\\\\\\"testing-strategy\\\\\\\",\\\\\\\"reason\\\\\\\":\\\\\\\"testing-strategy plans what to test before a failure exists; debugging chases a specific observed failure\\\\\\\"},{\\\\\\\"skill\\\\\\\":\\\\\\\"refactor\\\\\\\",\\\\\\\"reason\\\\\\\":\\\\\\\"refactor is behavior-preserving code change with green tests; debugging is invoked because tests or behavior are NOT green\\\\\\\"}],\\\\\\\"verify_with\\\\\\\":[\\\\\\\"testing-strategy\\\\\\\"]}\",\"portability\":\"{\\\\\\\"readiness\\\\\\\":\\\\\\\"scripted\\\\\\\",\\\\\\\"targets\\\\\\\":[\\\\\\\"skill-md\\\\\\\"]}\",\"skill_graph_source_repo\":\"https://github.com/jacob-balslev/skill-graph\",\"skill_graph_protocol\":\"Skill Metadata Protocol v5\",\"skill_graph_project\":\"Skill Graph\",\"skill_graph_canonical_skill\":\"skills/debugging/SKILL.md\"}"
+  metadata: "{\"schema_version\":6,\"version\":\"1.0.0\",\"type\":\"workflow\",\"category\":\"engineering\",\"scope\":\"portable\",\"owner\":\"skill-graph-maintainer\",\"freshness\":\"2026-04-18\",\"drift_check\":\"{\\\\\\\"last_verified\\\\\\\":\\\\\\\"2026-04-18\\\\\\\"}\",\"eval_artifacts\":\"present\",\"eval_state\":\"passing\",\"routing_eval\":\"present\",\"stability\":\"experimental\",\"keywords\":\"[\\\\\\\"debugging\\\\\\\",\\\\\\\"reproduce failure\\\\\\\",\\\\\\\"reproduce bug\\\\\\\",\\\\\\\"failing test\\\\\\\",\\\\\\\"root cause\\\\\\\",\\\\\\\"symptom vs cause\\\\\\\",\\\\\\\"minimum reproduction\\\\\\\",\\\\\\\"bisect\\\\\\\",\\\\\\\"what caused it\\\\\\\",\\\\\\\"my tests are failing\\\\\\\",\\\\\\\"why is this broken\\\\\\\",\\\\\\\"it broke in production\\\\\\\",\\\\\\\"cannot reproduce\\\\\\\",\\\\\\\"test passes locally\\\\\\\",\\\\\\\"stack trace\\\\\\\",\\\\\\\"used to work\\\\\\\",\\\\\\\"worked yesterday\\\\\\\",\\\\\\\"what changed\\\\\\\",\\\\\\\"was working before\\\\\\\",\\\\\\\"agent stuck\\\\\\\",\\\\\\\"stuck in a loop\\\\\\\",\\\\\\\"stuck in loop\\\\\\\",\\\\\\\"blocking my commit\\\\\\\",\\\\\\\"blocking the build\\\\\\\",\\\\\\\"specific error\\\\\\\",\\\\\\\"specific failure\\\\\\\",\\\\\\\"diagnose failure\\\\\\\",\\\\\\\"error blocking\\\\\\\",\\\\\\\"broke the build\\\\\\\",\\\\\\\"broke build\\\\\\\"]\",\"triggers\":\"[\\\\\\\"debugging-skill\\\\\\\"]\",\"examples\":\"[\\\\\\\"my tests pass locally but fail in CI — why?\\\\\\\",\\\\\\\"this function used to work yesterday; what changed?\\\\\\\",\\\\\\\"reproduce this Stripe webhook failure from production logs\\\\\\\",\\\\\\\"I see the symptom but can't find the root cause of this nil panic\\\\\\\"]\",\"anti_examples\":\"[\\\\\\\"plan test coverage for a new feature\\\\\\\",\\\\\\\"document what this function does for future readers\\\\\\\",\\\\\\\"refactor this messy code while the test suite is green\\\\\\\"]\",\"relations\":\"{\\\\\\\"boundary\\\\\\\":[{\\\\\\\"skill\\\\\\\":\\\\\\\"testing-strategy\\\\\\\",\\\\\\\"reason\\\\\\\":\\\\\\\"testing-strategy plans what to test before a failure exists; debugging chases a specific observed failure\\\\\\\"},{\\\\\\\"skill\\\\\\\":\\\\\\\"refactor\\\\\\\",\\\\\\\"reason\\\\\\\":\\\\\\\"refactor is behavior-preserving code change with green tests; debugging is invoked because tests or behavior are NOT green\\\\\\\"},{\\\\\\\"skill\\\\\\\":\\\\\\\"generative-ui\\\\\\\",\\\\\\\"reason\\\\\\\":\\\\\\\"generative-ui owns the model-emits-typed-UI-spec pattern for writing documentation or explanatory content; debugging owns chasing observed runtime failures, not writing documentation about functions\\\\\\\"}],\\\\\\\"verify_with\\\\\\\":[\\\\\\\"testing-strategy\\\\\\\"]}\",\"portability\":\"{\\\\\\\"readiness\\\\\\\":\\\\\\\"scripted\\\\\\\",\\\\\\\"targets\\\\\\\":[\\\\\\\"skill-md\\\\\\\"]}\",\"skill_graph_source_repo\":\"https://github.com/jacob-balslev/skill-graph\",\"skill_graph_protocol\":\"Skill Metadata Protocol v5\",\"skill_graph_project\":\"Skill Graph\",\"skill_graph_canonical_skill\":\"skills/debugging/SKILL.md\"}"
   skill_graph_source_repo: "https://github.com/jacob-balslev/skill-graph"
   skill_graph_protocol: Skill Metadata Protocol v4
   skill_graph_project: Skill Graph

package/marketplace/skills/graph-audit/SKILL.md

@@ -5,7 +5,9 @@ license: MIT
 compatibility: "Markdown, JSON Schema, Node.js"
 allowed-tools: Read Grep Bash
 metadata:
-  metadata: "{\"schema_version\":6,\"version\":\"1.0.0\",\"type\":\"capability\",\"category\":\"quality\",\"domain\":\"quality/audit\",\"scope\":\"codebase\",\"owner\":\"skill-graph-maintainer\",\"freshness\":\"2026-04-18\",\"drift_check\":\"{\\\\\\\"last_verified\\\\\\\":\\\\\\\"2026-05-13\\\\\\\",\\\\\\\"truth_source_hashes\\\\\\\":{\\\\\\\"schemas/skill.schema.json\\\\\\\":\\\\\\\"370a021a129cba5b54cd15daaaa934fbb172df306dc0095608ea4a5607fe2526\\\\\\\",\\\\\\\"schemas/manifest.schema.json\\\\\\\":\\\\\\\"b5181764e0b645d01a8b6918c78463e53a2f28669a6883365c3a1d132323c066\\\\\\\",\\\\\\\"docs/skill-metadata-protocol.md\\\\\\\":\\\\\\\"bce8933a4f4f6386e36e618f2de97f0f6feb864a4c1aaeec225291110e7f8a76\\\\\\\",\\\\\\\"scripts/skill-lint.js\\\\\\\":\\\\\\\"3a78f75f8921542b91dc619cd41bde29bf379de3c16bdcf3653c854ecbe9fa29\\\\\\\",\\\\\\\"scripts/lib/alias-contract.js\\\\\\\":\\\\\\\"ab7b4f15c13caf1ff1f3205e285415b086f7b6cbc3fcfaba982a590cc56b49cd\\\\\\\",\\\\\\\"scripts/check-protocol-consistency.js\\\\\\\":\\\\\\\"0ff39406d36e7a9e51c176f657f4f426d8bd5a3fe6411d28b9e9a93dc7d89f29\\\\\\\",\\\\\\\"scripts/generate-manifest.js\\\\\\\":\\\\\\\"9d7bbbdae440fdb1763d61ffa7bda10c9efae92359d1c2139d0e971582d59e0e\\\\\\\",\\\\\\\"examples/evals/graph-audit.json\\\\\\\":\\\\\\\"8edab7bc057c65c8fd43f6ca17863c7a12ea831f6eb2158f1b2fde2ba03ad4b2\\\\\\\"}}\",\"eval_artifacts\":\"present\",\"eval_state\":\"passing\",\"routing_eval\":\"present\",\"stability\":\"experimental\",\"keywords\":\"[\\\\\\\"skill audit\\\\\\\",\\\\\\\"manifest audit\\\\\\\",\\\\\\\"schema validation\\\\\\\",\\\\\\\"skill consistency\\\\\\\",\\\\\\\"graph audit\\\\\\\",\\\\\\\"metadata check\\\\\\\",\\\\\\\"skill frontmatter check\\\\\\\",\\\\\\\"broken relation\\\\\\\",\\\\\\\"skill drift\\\\\\\",\\\\\\\"audit my skills\\\\\\\"]\",\"triggers\":\"[\\\\\\\"graph-audit\\\\\\\"]\",\"paths\":\"[\\\\\\\"skills/**/SKILL.md\\\\\\\",\\\\\\\"schemas/*.json\\\\\\\",\\\\\\\"examples/skills.manifest.sample.json\\\\\\\"]\",\"examples\":\"[\\\\\\\"audit all skills for schema conformance and broken relation targets\\\\\\\",\\\\\\\"the manifest sample drifted from the generator — find the mismatch\\\\\\\",\\\\\\\"check that every `scope: codebase` skill has a populated grounding block\\\\\\\",\\\\\\\"which skills declare a relations target that doesn't exist in the library?\\\\\\\"]\",\"anti_examples\":\"[\\\\\\\"diagnose why the @/components import cycle broke the build\\\\\\\",\\\\\\\"my agent is stuck in a loop — what's wrong?\\\\\\\",\\\\\\\"write a reference doc explaining what the lint-checker pipeline does\\\\\\\"]\",\"relations\":\"{\\\\\\\"boundary\\\\\\\":[{\\\\\\\"skill\\\\\\\":\\\\\\\"refactor\\\\\\\",\\\\\\\"reason\\\\\\\":\\\\\\\"refactor changes skill body structure; graph-audit is read-only metadata verification\\\\\\\"},{\\\\\\\"skill\\\\\\\":\\\\\\\"debugging\\\\\\\",\\\\\\\"reason\\\\\\\":\\\\\\\"debugging chases a specific runtime failure; graph-audit is bulk static verification of every skill\\\\\\\"}],\\\\\\\"verify_with\\\\\\\":[\\\\\\\"testing-strategy\\\\\\\"]}\",\"grounding\":\"{\\\\\\\"domain_object\\\\\\\":\\\\\\\"Skill Metadata Protocol and Skill Graph manifest consistency\\\\\\\",\\\\\\\"grounding_mode\\\\\\\":\\\\\\\"repo_specific\\\\\\\",\\\\\\\"truth_sources\\\\\\\":[\\\\\\\"schemas/skill.schema.json\\\\\\\",\\\\\\\"schemas/manifest.schema.json\\\\\\\",\\\\\\\"docs/skill-metadata-protocol.md\\\\\\\",\\\\\\\"scripts/skill-lint.js\\\\\\\",\\\\\\\"scripts/lib/alias-contract.js\\\\\\\",\\\\\\\"scripts/check-protocol-consistency.js\\\\\\\",\\\\\\\"scripts/generate-manifest.js\\\\\\\",\\\\\\\"examples/evals/graph-audit.json\\\\\\\"],\\\\\\\"failure_modes\\\\\\\":[\\\\\\\"schema_drift\\\\\\\",\\\\\\\"manifest_sample_out_of_sync\\\\\\\",\\\\\\\"broken_relation_targets\\\\\\\",\\\\\\\"eval_artifacts_mismatch\\\\\\\",\\\\\\\"name_directory_mismatch\\\\\\\"],\\\\\\\"evidence_priority\\\\\\\":\\\\\\\"repo_code_first\\\\\\\"}\",\"skill_graph_source_repo\":\"https://github.com/jacob-balslev/skill-graph\",\"skill_graph_protocol\":\"Skill Metadata Protocol v5\",\"skill_graph_project\":\"Skill Graph\",\"skill_graph_canonical_skill\":\"skills/graph-audit/SKILL.md\"}"
+  grounding: "{\"domain_object\":\"Skill Metadata Protocol and Skill Graph manifest consistency\",\"grounding_mode\":\"repo_specific\",\"truth_sources\":[\"schemas/skill.schema.json\",\"schemas/manifest.schema.json\",\"docs/skill-metadata-protocol.md\",\"scripts/skill-lint.js\",\"scripts/lib/alias-contract.js\",\"scripts/check-protocol-consistency.js\",\"scripts/generate-manifest.js\",\"examples/evals/graph-audit.json\"],\"failure_modes\":[\"schema_drift\",\"manifest_sample_out_of_sync\",\"broken_relation_targets\",\"eval_artifacts_mismatch\",\"name_directory_mismatch\"],\"evidence_priority\":\"repo_code_first\"}"
+  drift_check: "{\"last_verified\":\"2026-05-18\",\"truth_source_hashes\":{\"schemas/skill.schema.json\":\"f9fc4fc8f61999c18d5c1c534f9642101b0ee7173f261e28f9470aeb03b68e5b\",\"schemas/manifest.schema.json\":\"94f2e990cc81b7a9aa26ea9855de1dbe1535a127feb5e5c74629c9e1dad2ee1a\",\"docs/skill-metadata-protocol.md\":\"300bbdaf87754298ca19e581b587d2fac901ab57b8c4c75d33e11bebc24a5fe4\",\"scripts/skill-lint.js\":\"e5de8a822b88172079263c8316b173e688b71498c9ed6a8a54dd0fba6aa9fd66\",\"scripts/lib/alias-contract.js\":\"d2a9831fef1ab06d2ea37b9d41e000d8b3a9a327357b62063ad00102cd2763cf\",\"scripts/check-protocol-consistency.js\":\"22f1f747b6b578e83ae371ac3f9af4b6906d94529f383d1785ed3303b4c5a008\",\"scripts/generate-manifest.js\":\"ec4ad89e21e44c272676846377679f59a272c193f0b0d448a7b6d881b0b9effc\",\"examples/evals/graph-audit.json\":\"4fc0fa157b363c9d5675112bfe860ed48a599d05c41720b387aa2d8798eab5a3\"}}"
+  metadata: "{\"schema_version\":6,\"version\":\"1.0.0\",\"type\":\"capability\",\"category\":\"quality\",\"domain\":\"quality/audit\",\"scope\":\"codebase\",\"owner\":\"skill-graph-maintainer\",\"freshness\":\"2026-04-18\",\"drift_check\":\"{\\\\\\\"last_verified\\\\\\\":\\\\\\\"2026-05-13\\\\\\\",\\\\\\\"truth_source_hashes\\\\\\\":{\\\\\\\"schemas/skill.schema.json\\\\\\\":\\\\\\\"370a021a129cba5b54cd15daaaa934fbb172df306dc0095608ea4a5607fe2526\\\\\\\",\\\\\\\"schemas/manifest.schema.json\\\\\\\":\\\\\\\"b5181764e0b645d01a8b6918c78463e53a2f28669a6883365c3a1d132323c066\\\\\\\",\\\\\\\"docs/skill-metadata-protocol.md\\\\\\\":\\\\\\\"bce8933a4f4f6386e36e618f2de97f0f6feb864a4c1aaeec225291110e7f8a76\\\\\\\",\\\\\\\"scripts/skill-lint.js\\\\\\\":\\\\\\\"3a78f75f8921542b91dc619cd41bde29bf379de3c16bdcf3653c854ecbe9fa29\\\\\\\",\\\\\\\"scripts/lib/alias-contract.js\\\\\\\":\\\\\\\"ab7b4f15c13caf1ff1f3205e285415b086f7b6cbc3fcfaba982a590cc56b49cd\\\\\\\",\\\\\\\"scripts/check-protocol-consistency.js\\\\\\\":\\\\\\\"0ff39406d36e7a9e51c176f657f4f426d8bd5a3fe6411d28b9e9a93dc7d89f29\\\\\\\",\\\\\\\"scripts/generate-manifest.js\\\\\\\":\\\\\\\"9d7bbbdae440fdb1763d61ffa7bda10c9efae92359d1c2139d0e971582d59e0e\\\\\\\",\\\\\\\"examples/evals/graph-audit.json\\\\\\\":\\\\\\\"8edab7bc057c65c8fd43f6ca17863c7a12ea831f6eb2158f1b2fde2ba03ad4b2\\\\\\\"}}\",\"eval_artifacts\":\"present\",\"eval_state\":\"passing\",\"routing_eval\":\"present\",\"stability\":\"experimental\",\"keywords\":\"[\\\\\\\"skill audit\\\\\\\",\\\\\\\"manifest audit\\\\\\\",\\\\\\\"schema validation\\\\\\\",\\\\\\\"skill consistency\\\\\\\",\\\\\\\"graph audit\\\\\\\",\\\\\\\"metadata check\\\\\\\",\\\\\\\"skill frontmatter check\\\\\\\",\\\\\\\"broken relation\\\\\\\",\\\\\\\"skill drift\\\\\\\",\\\\\\\"audit my skills\\\\\\\"]\",\"triggers\":\"[\\\\\\\"graph-audit\\\\\\\"]\",\"paths\":\"[\\\\\\\"skills/**/SKILL.md\\\\\\\",\\\\\\\"schemas/*.json\\\\\\\",\\\\\\\"examples/skills.manifest.sample.json\\\\\\\"]\",\"examples\":\"[\\\\\\\"audit all skills for schema conformance and broken relation targets\\\\\\\",\\\\\\\"the manifest sample drifted from the generator — find the mismatch\\\\\\\",\\\\\\\"check that every `scope: codebase` skill has a populated grounding block\\\\\\\",\\\\\\\"which skills declare a relations target that doesn't exist in the library?\\\\\\\"]\",\"anti_examples\":\"[\\\\\\\"diagnose why the @/components import cycle broke the build\\\\\\\",\\\\\\\"my agent is stuck in a loop — what's wrong?\\\\\\\",\\\\\\\"write a reference doc explaining what the lint-checker pipeline does\\\\\\\"]\",\"relations\":\"{\\\\\\\"boundary\\\\\\\":[{\\\\\\\"skill\\\\\\\":\\\\\\\"refactor\\\\\\\",\\\\\\\"reason\\\\\\\":\\\\\\\"refactor changes skill body structure; graph-audit is read-only metadata verification\\\\\\\"},{\\\\\\\"skill\\\\\\\":\\\\\\\"debugging\\\\\\\",\\\\\\\"reason\\\\\\\":\\\\\\\"debugging chases a specific runtime failure; graph-audit is bulk static verification of every skill\\\\\\\"},{\\\\\\\"skill\\\\\\\":\\\\\\\"eval-driven-development\\\\\\\",\\\\\\\"reason\\\\\\\":\\\\\\\"eval-driven-development owns LLM eval iteration discipline and writing reference documentation; graph-audit is read-only static verification of skill metadata schemas — writing an explanatory doc about a pipeline is documentation work, not a schema audit\\\\\\\"}],\\\\\\\"verify_with\\\\\\\":[\\\\\\\"testing-strategy\\\\\\\"]}\",\"grounding\":\"{\\\\\\\"domain_object\\\\\\\":\\\\\\\"Skill Metadata Protocol and Skill Graph manifest consistency\\\\\\\",\\\\\\\"grounding_mode\\\\\\\":\\\\\\\"repo_specific\\\\\\\",\\\\\\\"truth_sources\\\\\\\":[\\\\\\\"schemas/skill.schema.json\\\\\\\",\\\\\\\"schemas/manifest.schema.json\\\\\\\",\\\\\\\"docs/skill-metadata-protocol.md\\\\\\\",\\\\\\\"scripts/skill-lint.js\\\\\\\",\\\\\\\"scripts/lib/alias-contract.js\\\\\\\",\\\\\\\"scripts/check-protocol-consistency.js\\\\\\\",\\\\\\\"scripts/generate-manifest.js\\\\\\\",\\\\\\\"examples/evals/graph-audit.json\\\\\\\"],\\\\\\\"failure_modes\\\\\\\":[\\\\\\\"schema_drift\\\\\\\",\\\\\\\"manifest_sample_out_of_sync\\\\\\\",\\\\\\\"broken_relation_targets\\\\\\\",\\\\\\\"eval_artifacts_mismatch\\\\\\\",\\\\\\\"name_directory_mismatch\\\\\\\"],\\\\\\\"evidence_priority\\\\\\\":\\\\\\\"repo_code_first\\\\\\\"}\",\"skill_graph_source_repo\":\"https://github.com/jacob-balslev/skill-graph\",\"skill_graph_protocol\":\"Skill Metadata Protocol v5\",\"skill_graph_project\":\"Skill Graph\",\"skill_graph_canonical_skill\":\"skills/graph-audit/SKILL.md\"}"
   skill_graph_source_repo: "https://github.com/jacob-balslev/skill-graph"
   skill_graph_protocol: Skill Metadata Protocol v4
   skill_graph_project: Skill Graph