@softspark/ai-toolkit 1.1.0 → 1.2.1

package/CHANGELOG.md

@@ -7,6 +7,44 @@ Versioning follows [Semantic Versioning](https://semver.org/).
 
 ---
 
+## [1.2.1] - 2026-04-03
+
+### Changed
+- **README.md** — added full documentation for all v1.2.0 features:
+  - `/persona` runtime switching with usage examples
+  - `audit_skills.py` CI pipeline integration with `--json` and `--ci` flags
+  - Skill Security Auditing section (severity levels, detection patterns)
+  - Persona Presets section (table with focus areas and key skills per role)
+  - Smart compaction description in hooks table
+  - Fixed section numbering (was duplicated at 4, skipped 10)
+- **CLAUDE.md** — added CRITICAL note: documentation/count accuracy is non-negotiable, must run validate + audit before every commit
+- **skills-catalog.md** — fixed stale frontmatter (was 85 skills/v1.0.0, now 87 skills/v1.2.1)
+- Version bump: 1.2.0 → 1.2.1 (package.json, plugin.json)
+
+[1.2.1]: https://github.com/softspark/ai-toolkit/releases/tag/v1.2.1
+
+---
+
+## [1.2.0] - 2026-04-03
+
+### Added
+- **`/skill-audit` skill** — security scanner for skills and agents: detects dangerous code patterns (`eval`, `exec`, `os.system`), hardcoded secrets (AWS keys, GitHub PATs, private keys), overly permissive `allowed-tools`, and missing safety constraints. Supports `--fix` for auto-remediation of safe issues. CI-ready (non-zero exit on HIGH findings).
+- **Persona presets** (`--persona` flag) — 4 engineering personas: `backend-lead`, `frontend-lead`, `devops-eng`, `junior-dev`. Each injects role-specific communication style, preferred skills, and code review priorities into CLAUDE.md. Usage: `ai-toolkit install --persona backend-lead`.
+- **`/persona` runtime switching** — new hybrid skill to switch persona at runtime without re-install. Usage: `/persona backend-lead`, `/persona --list`, `/persona --clear`. Session-scoped.
+- **Augment editor support** — `scripts/generate_augment.py` generates `.augment/rules/ai-toolkit.md` with proper frontmatter (`type: always_apply`). Registered in global install.
+- **`scripts/audit_skills.py`** — deterministic Python scanner for CI pipelines. Scans skills/agents for dangerous patterns, secrets, permission issues. JSON output (`--json`), non-zero exit on HIGH (`--ci`). Found 4 real HIGH findings in our own toolkit.
+
+### Changed
+- **Smart compaction** (`pre-compact.sh`) — enhanced with prioritized context preservation: instincts (with confidence scores) > session context > git state (branch, dirty files, last commit) > key decisions. Replaces flat output with structured sections.
+- Editor count: 8 → 9 (added Augment)
+- Skill count: 85 → 87 (added `skill-audit`, `persona`)
+- Task skill count: 27 → 28 (`skill-audit`)
+- Hybrid skill count: 27 → 28 (`persona`)
+
+[1.2.0]: https://github.com/softspark/ai-toolkit/releases/tag/v1.2.0
+
+---
+
 ## [1.1.0] - 2026-04-02
 
 ### Added

package/README.md

@@ -1,10 +1,10 @@
 # ai-toolkit
 
-> Professional-grade AI coding toolkit with multi-platform support. Machine-enforced safety, 85 skills, 47 agents, expanded lifecycle hooks, experimental opt-in plugin packs, and benchmark tooling — works with Claude, Cursor, Windsurf, Copilot, Gemini, Cline, Roo Code, and Aider, ready in 60 seconds.
+> Professional-grade AI coding toolkit with multi-platform support. Machine-enforced safety, 87 skills, 47 agents, expanded lifecycle hooks, persona presets, experimental opt-in plugin packs, and benchmark tooling — works with Claude, Cursor, Windsurf, Copilot, Gemini, Cline, Roo Code, Aider, and Augment, ready in 60 seconds.
 
 [![CI](https://github.com/softspark/ai-toolkit/actions/workflows/ci.yml/badge.svg)](https://github.com/softspark/ai-toolkit/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
-[![Skills](https://img.shields.io/badge/skills-85-brightgreen)](app/skills/)
+[![Skills](https://img.shields.io/badge/skills-87-brightgreen)](app/skills/)
 [![Agents](https://img.shields.io/badge/agents-47-blue)](app/agents/)
 [![Tests](https://img.shields.io/badge/tests-310%20passing-success)](tests/)
 
@@ -21,7 +21,7 @@ ai-toolkit install
 npx @softspark/ai-toolkit install
 ```
 
-**That's it.** Claude Code picks up 85 skills, 47 agents, quality hooks, and the safety constitution automatically.
+**That's it.** Claude Code picks up 87 skills, 47 agents, quality hooks, and the safety constitution automatically.
 
 ### Update
 
@@ -59,6 +59,27 @@ ai-toolkit install --profile standard   # full install (default)
 ai-toolkit install --profile strict     # full install + git hooks even without --local
 ```
 
+### Persona Presets
+
+Personas adjust communication style, preferred skills, and code review priorities per engineering role.
+
+**Install-time (persistent — injected into CLAUDE.md):**
+
+```bash
+ai-toolkit install --persona backend-lead    # system design, API stability, data integrity
+ai-toolkit install --persona frontend-lead   # component architecture, a11y, Core Web Vitals
+ai-toolkit install --persona devops-eng      # infra-as-code, CI/CD, rollback safety
+ai-toolkit install --persona junior-dev      # step-by-step explanations, learning focus
+```
+
+**Runtime (session-scoped — no reinstall needed):**
+
+```bash
+/persona backend-lead     # activate for this session
+/persona --list           # show available personas
+/persona --clear          # reset to default
+```
+
 ### Selective Install / Update
 
 ```bash
@@ -111,8 +132,8 @@ Replaces all symlinks with real files, inlines rules into CLAUDE.md, copies cons
 
 | Component | Count | Description |
 |-----------|-------|-------------|
-| `skills/` (task) | 27 | Slash commands: `/commit`, `/build`, `/deploy`, `/test`, ... |
-| `skills/` (hybrid) | 27 | Slash commands with agent knowledge base |
+| `skills/` (task) | 28 | Slash commands: `/commit`, `/build`, `/deploy`, `/test`, `/skill-audit`, ... |
+| `skills/` (hybrid) | 28 | Slash commands with agent knowledge base |
 | `skills/` (knowledge) | 31 | Domain knowledge auto-loaded by agents |
 | `agents/` | 47 | Specialized agents across 10 categories |
 | `hooks/` | 15 global + 5 skill-scoped | Quality gates, path safety, CLAUDE.md enforcement, notifications, prompt governance, subagent lifecycle, session-end handoff, usage tracking |
@@ -134,7 +155,7 @@ ai-toolkit/
 │   │   ├── backend-specialist.md
 │   │   ├── security-architect.md
 │   │   └── ... (44 more)
-│   ├── skills/          # 85 skills (task / hybrid / knowledge)
+│   ├── skills/          # 87 skills (task / hybrid / knowledge)
 │   │   ├── commit/      # /commit slash command
 │   │   ├── review/      # /review slash command
 │   │   ├── clean-code/  # knowledge skill (auto-loaded)
@@ -192,6 +213,7 @@ ai-toolkit/
 | `/command-creator` | Scaffold a new slash command with frontmatter and workflow guidance | high |
 | `/agent-creator` | Scaffold a new specialized agent with tools and trigger guidance | high |
 | `/plugin-creator` | Scaffold an experimental plugin pack with manifest and optional modules | high |
+| `/skill-audit` | Scan skills/agents for security risks: dangerous patterns, secrets, permissions | medium |
 | `/analyze` | Code quality, complexity, and pattern analysis | medium |
 | `/fix` | Auto-fix lint/type errors | low |
 | `/build` | Build with issue detection | low |
@@ -212,6 +234,7 @@ ai-toolkit/
 | `/subagent-development` | Execute plans with 2-stage review (spec + quality) per task | high |
 | `/repeat` | Autonomous loop with safety controls (Ralph Wiggum pattern) | medium |
 | `/mem-search` | Search past coding sessions via natural language (memory-pack) | medium |
+| `/persona` | Switch engineering persona at runtime (session-scoped) | low |
 
 ### `/workflow` Types
 
@@ -264,7 +287,7 @@ Hook logic lives in `app/hooks/*.sh` — not inline JSON one-liners. Scripts are
 | TaskCompleted | `quality-gate.sh` | Block task completion on lint/type errors |
 | SubagentStart | `subagent-start.sh` | Narrow-scope reminder for spawned subagents |
 | SubagentStop | `subagent-stop.sh` | Completion checklist for subagent handoff |
-| PreCompact | `pre-compact.sh` | Preserve context and instincts before compaction |
+| PreCompact | `pre-compact.sh` | Smart compaction: prioritized context (instincts > tasks > git state > decisions) |
 | SessionEnd | `session-end.sh` | Persist a session-end handoff note |
 | TeammateIdle | *(inline)* | Completeness reminder |
 
@@ -278,7 +301,29 @@ Hook logic lives in `app/hooks/*.sh` — not inline JSON one-liners. Scripts are
 | `/migrate` | Pre | Backup verification |
 | `/rollback` | Post | State verification |
 
-### 3. Effort-Based Model Budgeting
+### 3. Skill Security Auditing
+
+Scan all skills and agents for security risks — both interactively and in CI:
+
+```bash
+# Interactive (Claude provides remediation suggestions)
+/skill-audit
+
+# Deterministic Python scanner for CI pipelines
+python3 scripts/audit_skills.py           # human-readable report
+python3 scripts/audit_skills.py --json    # machine-readable JSON
+python3 scripts/audit_skills.py --ci      # exit 1 on any HIGH finding
+```
+
+**What it detects:**
+- Dangerous code: `eval()`, `exec()`, `subprocess(shell=True)`, `pickle.loads`
+- Hardcoded secrets: AWS keys, GitHub PATs, private keys, API tokens
+- Permission issues: knowledge skills with Bash, missing `allowed-tools`
+- Bash risks: `curl | bash`, `chmod 777`, unquoted variables
+
+**Severity levels:** HIGH (blocks CI), WARN (should fix), INFO (review)
+
+### 4. Effort-Based Model Budgeting
 
 Every skill declares an effort level used for model token budgeting:
 - `low` — lint, build, fix (fast, cheap)
@@ -286,7 +331,7 @@ Every skill declares an effort level used for model token budgeting:
 - `high` — review, plan, refactor, docs
 - `max` — orchestrate, swarm, workflow
 
-### 4. Multi-Language Quality Gates
+### 5. Multi-Language Quality Gates
 
 The `Stop` hook runs after every response across 5 languages:
 
@@ -298,7 +343,7 @@ The `Stop` hook runs after every response across 5 languages:
 | Dart | dart analyze | dart analyze |
 | Go | go vet | go vet |
 
-### 5. Iron Law Enforcement
+### 6. Iron Law Enforcement
 
 Three skills enforce non-negotiable quality gates with anti-rationalization tables:
 
@@ -308,7 +353,7 @@ Three skills enforce non-negotiable quality gates with anti-rationalization tabl
 | `debugging-tactics` | `NO FIXES WITHOUT ROOT CAUSE INVESTIGATION FIRST` | 4-phase debugging: root cause → pattern → hypothesis → fix. 3+ failed fixes → question architecture. |
 | `verification-before-completion` | `NO COMPLETION CLAIMS WITHOUT FRESH VERIFICATION EVIDENCE` | Gate function: IDENTIFY → RUN → READ → VERIFY → CLAIM. "Should work now" is not evidence. |
 
-### 6. Two-Stage Review (`/subagent-development`)
+### 7. Two-Stage Review (`/subagent-development`)
 
 Per-task review pipeline inspired by [obra/superpowers](https://github.com/obra/superpowers):
 
@@ -321,7 +366,7 @@ Implementer → Spec Compliance Review → Code Quality Review → Next Task
 - Quality reviewer checks: SOLID, naming, error handling, tests, security
 - Prompt templates included: `reference/implementer-prompt.md`, `spec-reviewer-prompt.md`, `code-quality-reviewer-prompt.md`
 
-### 7. Ralph Wiggum Loop (`/repeat`)
+### 8. Ralph Wiggum Loop (`/repeat`)
 
 Autonomous agent loop with safety controls:
 
@@ -340,7 +385,7 @@ Autonomous agent loop with safety controls:
 
 Constitution Article I, Section 4 enforces these limits.
 
-### 8. Visual Brainstorming Companion
+### 9. Visual Brainstorming Companion
 
 Optional browser-based companion for `/write-a-prd` and `/design-an-interface`:
 
@@ -349,7 +394,7 @@ Optional browser-based companion for `/write-a-prd` and `/design-an-interface`:
 - Per-question routing: mockups/diagrams → browser, text/conceptual → terminal
 - Consent-based: offered once as its own message, never forced
 
-### 9. Persistent Memory (`memory-pack` plugin)
+### 10. Persistent Memory (`memory-pack` plugin)
 
 SQLite-based session memory (opt-in plugin pack):
 
@@ -363,7 +408,20 @@ SQLite-based session memory (opt-in plugin pack):
 
 
 
-### 11. KB Integration Protocol
+### 11. Persona Presets
+
+4 engineering personas that adjust Claude's communication style per role:
+
+| Persona | Focus | Key Skills |
+|---------|-------|------------|
+| `backend-lead` | System design, scalability, data integrity | `/workflow backend-feature`, `/tdd` |
+| `frontend-lead` | Component architecture, a11y, Core Web Vitals | `/design-an-interface`, `/review` |
+| `devops-eng` | IaC, CI/CD, blast radius, rollback safety | `/workflow infrastructure-change`, `/deploy` |
+| `junior-dev` | Step-by-step explanations, learning focus | `/explain`, `/explore`, `/debug` |
+
+Persistent via `--persona` at install time, or session-scoped via `/persona` runtime command.
+
+### 12. KB Integration Protocol
 
 Agents follow a research-before-action protocol enforced via rules:
 1. `smart_query()` or `hybrid_search_kb()` before any technical answer
@@ -563,6 +621,7 @@ Usage: ai-toolkit <command> [options]
 | `cline-rules` | Generate `.clinerules` in current dir |
 | `roo-modes` | Generate `.roomodes` in current dir |
 | `aider-conf` | Generate `.aider.conf.yml` in current dir |
+| `augment-rules` | Generate `.augment/rules/ai-toolkit.md` in current dir |
 | `agents-md` | Regenerate `AGENTS.md` from agent definitions |
 | `llms-txt` | Generate `llms.txt` and `llms-full.txt` |
 | `generate-all` | Generate all platform configs at once |
@@ -574,6 +633,7 @@ Usage: ai-toolkit <command> [options]
 ai-toolkit install --only agents,hooks   # apply only listed components
 ai-toolkit install --skip hooks          # skip listed components
 ai-toolkit install --profile minimal     # profile preset: minimal | standard | strict
+ai-toolkit install --persona backend-lead # persona preset: backend-lead | frontend-lead | devops-eng | junior-dev
 ai-toolkit install --local               # also set up project-local configs (CLAUDE.md, settings, constitution, Copilot, Cline, Roo, Aider, Git Hooks, MCP Defaults)
 ai-toolkit update --local                # re-apply + refresh project-local configs
 ai-toolkit install --list                # dry-run: show what would be applied

package/app/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ai-toolkit",
-  "description": "Professional-grade Claude Code toolkit: 81 skills, 47 agents, expanded lifecycle hooks, experimental opt-in plugin packs, benchmark harvesting, and multi-tool support.",
-  "version": "1.0.0",
+  "description": "Professional-grade Claude Code toolkit: 87 skills, 47 agents, persona presets, skill security auditor, expanded lifecycle hooks, experimental opt-in plugin packs, benchmark harvesting, and multi-tool support.",
+  "version": "1.2.1",
   "author": {
     "name": "SoftSpark",
     "url": "https://github.com/softspark"

package/app/ARCHITECTURE.md

@@ -7,7 +7,7 @@ Universal multi-agent system for software development. Works across all reposito
 | Component | Count |
 |-----------|-------|
 | Agents | 47 |
-| Skills | 85 |
+| Skills | 87 |
 | Hooks | 12 events / 15 entries (SessionStart, Notification, PreToolUse ×2, UserPromptSubmit ×2, PostToolUse, Stop ×2, TaskCompleted, TeammateIdle, SubagentStart, SubagentStop, PreCompact, SessionEnd) |
 
 ---
@@ -103,9 +103,9 @@ Universal multi-agent system for software development. Works across all reposito
 
 ---
 
-## Skills (85)
+## Skills (87)
 
-### Task Skills (27)
+### Task Skills (28)
 | Skill | Slash Command | Purpose |
 |-------|---------------|---------|
 | `commit` | `/commit` | Create well-structured git commits (Conventional Commits) |
@@ -135,8 +135,9 @@ Universal multi-agent system for software development. Works across all reposito
 | `agent-creator` | `/agent-creator` | Create new specialized agents with tools and trigger guidance |
 | `plugin-creator` | `/plugin-creator` | Create experimental opt-in plugin packs with manifests, conventions, and optional modules |
 | `prd-to-issues` | `/prd-to-issues` | Break PRD into GitHub issues with vertical slices and HITL/AFK tagging |
+| `skill-audit` | `/skill-audit` | Scan skills and agents for security risks, dangerous patterns, secrets |
 
-### Hybrid Skills (27)
+### Hybrid Skills (28)
 | Skill | Slash Command | Purpose |
 |-------|---------------|---------|
 | `explore` | `/explore` | Codebase exploration and tech stack discovery |
@@ -166,6 +167,7 @@ Universal multi-agent system for software development. Works across all reposito
 | `subagent-development` | `/subagent-development` | Execute plans with 2-stage review (spec + quality) per task |
 | `repeat` | `/repeat` | Autonomous loop with safety controls (Ralph Wiggum pattern) |
 | `mem-search` | `/mem-search` | Search past coding sessions via natural language (memory-pack) |
+| `persona` | `/persona` | Switch engineering persona at runtime (backend-lead, frontend-lead, devops-eng, junior-dev) |
 
 ### Knowledge Skills - Development (15)
 | Skill | Purpose |
@@ -255,7 +257,7 @@ Phase 2: IMPLEMENTATION
 ├── ARCHITECTURE.md      # This file
 ├── agents/              # Agent definitions (47)
 ├── hooks.json           # Quality gate hooks (multi-language)
-├── skills/              # All skills: task, hybrid, knowledge (85)
+├── skills/              # All skills: task, hybrid, knowledge (87)
 ├── output-styles/       # System prompt output style overrides (e.g. golden-rules)
 ├── constitution.md      # Immutable safety rules (5 articles)
 └── settings.local.json  # Local settings + Agent Teams config

package/app/hooks/pre-compact.sh

@@ -3,29 +3,63 @@
 #
 # Fires on: PreCompact
 # Outputs key context markers so they survive the compaction boundary.
+# Priority order: rules > instincts > tasks > session context > git state.
 # Skipped when TOOLKIT_HOOK_PROFILE=minimal.
 
 # shellcheck source=_profile-check.sh
 source "$(dirname "$0")/_profile-check.sh"
 
-# 1. Remind Claude to reload project rules after compaction
+# ---------------------------------------------------------------------------
+# 1. Mandatory reload reminder (highest priority — always survives)
+# ---------------------------------------------------------------------------
 echo "IMPORTANT: Context was compacted. Re-read CLAUDE.md files and active tasks before continuing."
 
-# 2. Preserve active task summary if available
-if [ -f ".claude/session-context.md" ]; then
-    echo "=== Pre-Compaction Context ==="
-    cat ".claude/session-context.md"
-    echo "=============================="
-fi
-
-# 3. Preserve active instincts
+# ---------------------------------------------------------------------------
+# 2. Active instincts (high priority — behavioral rules)
+# ---------------------------------------------------------------------------
 INSTINCTS_DIR=".claude/instincts"
 if [ -d "$INSTINCTS_DIR" ] && ls "$INSTINCTS_DIR"/*.md >/dev/null 2>&1; then
     echo "=== Active Instincts ==="
     for f in "$INSTINCTS_DIR"/*.md; do
-        echo "- $(head -1 "$f")"
+        # Extract pattern name and confidence from first two lines
+        name=$(head -1 "$f" | sed 's/^# Pattern: //')
+        confidence=$(grep -m1 'Confidence:' "$f" | awk '{print $2}')
+        echo "- [${confidence:-?}] $name"
     done
     echo "========================"
 fi
 
+# ---------------------------------------------------------------------------
+# 3. Current task state (medium priority — what we're doing)
+# ---------------------------------------------------------------------------
+if [ -f ".claude/session-context.md" ]; then
+    echo "=== Session Context ==="
+    cat ".claude/session-context.md"
+    echo "======================="
+fi
+
+# ---------------------------------------------------------------------------
+# 4. Git working state (low priority — quick orientation)
+# ---------------------------------------------------------------------------
+if command -v git >/dev/null 2>&1 && git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+    BRANCH=$(git branch --show-current 2>/dev/null)
+    DIRTY=$(git status --porcelain 2>/dev/null | wc -l | tr -d ' ')
+    LAST_COMMIT=$(git log -1 --oneline 2>/dev/null)
+    echo "=== Git State ==="
+    echo "Branch: ${BRANCH:-detached}"
+    echo "Uncommitted changes: ${DIRTY}"
+    echo "Last commit: ${LAST_COMMIT}"
+    echo "================="
+fi
+
+# ---------------------------------------------------------------------------
+# 5. Key decisions file (if user has been noting decisions this session)
+# ---------------------------------------------------------------------------
+if [ -f ".claude/decisions.md" ]; then
+    echo "=== Key Decisions This Session ==="
+    # Only show last 10 lines to keep token budget tight
+    tail -10 ".claude/decisions.md"
+    echo "=================================="
+fi
+
 exit 0

package/app/personas/backend-lead.md

@@ -0,0 +1,27 @@
+# Persona: Backend Lead
+
+## Communication Style
+- Focus on system design, scalability, and data flow
+- Explain trade-offs between consistency and availability
+- Default to production-readiness over prototyping speed
+- Warn about N+1 queries, missing indexes, unhandled edge cases
+
+## Preferred Skills
+- `/workflow backend-feature` for new features
+- `/workflow api-design` for API work
+- `/workflow database-evolution` for schema changes
+- `/tdd` for all business logic
+- `/review` with security focus
+
+## Code Review Priorities
+1. Data integrity and transaction safety
+2. API contract stability (breaking changes)
+3. Error handling and observability
+4. Performance under load
+5. Test coverage for edge cases
+
+## Stack Assumptions
+- Assume production database with migrations (never raw DDL)
+- Prefer explicit over implicit (no magic, no ORMs hiding queries)
+- Always consider backwards compatibility for API changes
+- Log structured JSON, not print statements

package/app/personas/devops-eng.md

@@ -0,0 +1,27 @@
+# Persona: DevOps Engineer
+
+## Communication Style
+- Focus on infrastructure, CI/CD, reliability, observability
+- Think in terms of blast radius and rollback strategies
+- Default to immutable infrastructure and declarative configs
+- Warn about missing health checks, no retry logic, hardcoded configs
+
+## Preferred Skills
+- `/workflow infrastructure-change` for infra work
+- `/workflow application-deploy` for deployments
+- `/workflow incident-response` for incidents
+- `/review` with security and infra focus
+- `/deploy` and `/rollback` for release management
+
+## Code Review Priorities
+1. Secrets management (no hardcoded values)
+2. Idempotency and rollback safety
+3. Health checks and readiness probes
+4. Resource limits and scaling policies
+5. Logging, metrics, and alerting coverage
+
+## Stack Assumptions
+- Everything as code (Terraform, Ansible, Dockerfiles)
+- CI/CD pipeline exists and must pass before deploy
+- Multi-environment (dev/staging/prod) parity
+- Prefer managed services over self-hosted

package/app/personas/frontend-lead.md

@@ -0,0 +1,26 @@
+# Persona: Frontend Lead
+
+## Communication Style
+- Focus on component architecture, state management, UX
+- Think in terms of user journeys and interaction patterns
+- Prioritize accessibility (a11y) and responsive design
+- Warn about bundle size, unnecessary re-renders, layout shifts
+
+## Preferred Skills
+- `/workflow frontend-feature` for new features
+- `/design-an-interface` for component design
+- `/review` with UX and a11y focus
+- `/tdd` for component and integration tests
+
+## Code Review Priorities
+1. Accessibility (WCAG 2.1 AA minimum)
+2. Component reusability and composition
+3. State management simplicity
+4. Performance (Core Web Vitals)
+5. Responsive behavior across breakpoints
+
+## Stack Assumptions
+- Component-based architecture (React, Vue, or similar)
+- Design tokens / CSS variables for theming
+- Prefer server components where possible
+- Images: always lazy-load, always provide dimensions

package/app/personas/junior-dev.md

@@ -0,0 +1,28 @@
+# Persona: Junior Developer
+
+## Communication Style
+- Explain concepts step by step, don't assume deep knowledge
+- Link patterns to fundamentals (SOLID, DRY, KISS)
+- Show examples before abstractions
+- Suggest learning resources when introducing new concepts
+- Use `/explain` liberally before making changes
+
+## Preferred Skills
+- `/explain` for understanding code before changing it
+- `/explore` to map unfamiliar codebases
+- `/debug` with detailed root cause explanation
+- `/tdd` to build testing habits early
+- `/plan` before any non-trivial change
+
+## Code Review Priorities
+1. Correctness and readability
+2. Naming clarity
+3. Test coverage for the happy path
+4. Consistent style with the rest of the codebase
+5. Documentation of non-obvious decisions
+
+## Learning Approach
+- Prefer small, focused PRs over large changes
+- Always run tests before committing
+- Ask "why does this work?" not just "does this work?"
+- Read existing code before writing new code

package/app/rules/claude-toolkit-rules.md

@@ -1,6 +1,6 @@
 # Claude Toolkit
 
-Shared AI development toolkit — 85 skills, 47 agents, lifecycle hooks, safety constitution.
+Shared AI development toolkit — 87 skills, 47 agents, lifecycle hooks, safety constitution.
 
 ## Skill Tiers
 

package/app/skills/api-patterns/SKILL.md

@@ -3,6 +3,7 @@ name: api-patterns
 description: "Loaded when user asks about REST API design or GraphQL patterns"
 effort: medium
 user-invocable: false
+allowed-tools: Read
 ---
 
 # API Patterns Skill

package/app/skills/app-builder/SKILL.md

@@ -3,6 +3,7 @@ name: app-builder
 description: "Loaded when user asks to scaffold or build a full-stack app"
 effort: medium
 user-invocable: false
+allowed-tools: Read
 ---
 
 # App Builder Skill

package/app/skills/ci-cd-patterns/SKILL.md

@@ -3,6 +3,7 @@ name: ci-cd-patterns
 description: "Loaded when user asks about CI/CD pipelines or deployment automation"
 effort: medium
 user-invocable: false
+allowed-tools: Read
 ---
 
 # CI/CD Patterns

package/app/skills/clean-code/SKILL.md

@@ -3,6 +3,7 @@ name: clean-code
 description: "Loaded when user asks about clean code, naming, or code quality"
 effort: medium
 user-invocable: false
+allowed-tools: Read
 ---
 
 # Clean Code Skill

package/app/skills/csharp-patterns/SKILL.md

@@ -3,6 +3,7 @@ name: csharp-patterns
 description: "Loaded when user asks about C# or .NET development patterns"
 effort: medium
 user-invocable: false
+allowed-tools: Read
 ---
 
 # C# / .NET Patterns

package/app/skills/database-patterns/SKILL.md

@@ -3,6 +3,7 @@ name: database-patterns
 description: "Loaded when user asks about database schema or query optimization"
 effort: medium
 user-invocable: false
+allowed-tools: Read
 ---
 
 # Database Patterns Skill

package/app/skills/debugging-tactics/SKILL.md

@@ -3,7 +3,7 @@ name: debugging-tactics
 description: "Loaded when user is debugging an issue or needs root cause analysis"
 effort: medium
 user-invocable: false
-allowed-tools: Bash, Grep, Read
+allowed-tools: Grep, Read
 ---
 
 # Debugging Tactics Skill

package/app/skills/design-engineering/SKILL.md

@@ -3,6 +3,7 @@ name: design-engineering
 description: "Loaded when user asks about UI animations or CSS design craft"
 effort: medium
 user-invocable: false
+allowed-tools: Read
 ---
 
 # Design Engineering Skill

package/app/skills/docker-devops/SKILL.md

@@ -3,6 +3,7 @@ name: docker-devops
 description: "Loaded when user asks about Docker, containers, or DevOps patterns"
 effort: medium
 user-invocable: false
+allowed-tools: Read
 ---
 
 # Docker & DevOps Skill

package/app/skills/documentation-standards/SKILL.md

@@ -3,6 +3,7 @@ name: documentation-standards
 description: "Loaded when creating or updating KB documents, architecture notes, SOPs, or any file in kb/ directory"
 effort: medium
 user-invocable: false
+allowed-tools: Read
 ---
 
 # Documentation Standards

package/app/skills/ecommerce-patterns/SKILL.md

@@ -3,6 +3,7 @@ name: ecommerce-patterns
 description: "Loaded when user asks about e-commerce or shopping cart features"
 effort: medium
 user-invocable: false
+allowed-tools: Read
 ---
 
 # E-commerce Patterns Skill

package/app/skills/flutter-patterns/SKILL.md

@@ -3,6 +3,7 @@ name: flutter-patterns
 description: "Loaded when user asks about Flutter or Dart development patterns"
 effort: medium
 user-invocable: false
+allowed-tools: Read
 ---
 
 # Flutter Patterns Skill

package/app/skills/git-mastery/SKILL.md

@@ -3,7 +3,7 @@ name: git-mastery
 description: "Loaded when user asks about advanced Git workflows or history rewriting"
 effort: medium
 user-invocable: false
-allowed-tools: Bash
+allowed-tools: Read, Grep, Glob
 ---
 
 # Git Mastery Skill

package/app/skills/hive-mind/SKILL.md

@@ -3,6 +3,7 @@ name: hive-mind
 description: "Loaded when orchestrating multi-agent swarms or consensus workflows"
 effort: medium
 user-invocable: false
+allowed-tools: Read
 ---
 
 # Hive Mind Skill

package/app/skills/java-patterns/SKILL.md

@@ -3,6 +3,7 @@ name: java-patterns
 description: "Loaded when user asks about Java development patterns"
 effort: medium
 user-invocable: false
+allowed-tools: Read
 ---
 
 # Java Patterns Skill