@softspark/ai-toolkit 2.8.0 → 2.9.0

package/AGENTS.md

@@ -449,68 +449,68 @@ Skills are invocable commands or auto-loaded knowledge sources:
 - **a11y-validate**: Validate code against accessibility standards: WCAG 2.1 Level AA, EN 301 549, and the European Accessibility Act (EAA / Directive EU 2019/882). Covers semantics, text alternatives, keyboard/focus, color/contrast, forms, media, ARIA, motion, mobile, and EAA documentation requirements. Framework-aware (React/Next/Nuxt/Astro/Gatsby/SvelteKit/Remix/Angular/Vue/React Native/Flutter/static HTML).
 - **agent-creator**: Creates new specialized agents with frontmatter, tool selection, and delegation guidance
 - **analyze**: Analyze code quality, complexity, and patterns
-- **api-patterns**: Loaded when user asks about REST API design or GraphQL patterns
-- **app-builder**: Loaded when user asks to scaffold or build a full-stack app
+- **api-patterns**: REST and GraphQL API design patterns: resource naming, versioning, pagination, error contracts, idempotency, HATEOAS, OpenAPI. Triggers: API design, REST, GraphQL, endpoint, route, OpenAPI, Swagger, pagination, rate limit, versioning, idempotency key. Load when designing or reviewing any HTTP API surface.
+- **app-builder**: Full-stack app scaffolding with stack-selection matrix: Next.js, React+Vite, Nuxt, Astro, FastAPI, Django, Laravel, React Native, Flutter, Unity. Triggers: scaffold, bootstrap, new project, starter template, build app, landing page, dashboard, API, mobile app, CLI, e-commerce, game. Load when user wants to start a new project from scratch.
 - **architecture-audit**: Explore codebase organically for architectural friction, discover shallow modules, and propose module-deepening refactors as GitHub issue RFCs using parallel sub-agent interface designs. Use when user wants to improve architecture, find shallow modules, deepen modules, or reduce coupling. Codex-adapted: uses native subagents and plan tracking.
-- **architecture-decision**: Loaded when user asks about architecture decisions or architecture note writing
+- **architecture-decision**: Architecture decision making via trade-off analysis in RFC/RFD/ADR format: context, constraints, 3+ options, comparison, recommendation. Triggers: architecture decision, ADR, RFC, RFD, trade-offs, options comparison, design choice, pick between, should we use, evaluate approach. Load when weighing 2+ architectural options or writing decision records.
 - **biz-scan**: Scan codebase for business opportunities and KPIs
 - **brand-voice**: Loaded when writing documentation, content, README, or user-facing text. Prevents generic LLM rhetoric and enforces direct, technical voice.
 - **briefing**: Generate executive daily briefing across all agents
 - **build**: Build the project with auto-detected toolchain
 - **chaos**: Inject controlled faults for resilience testing
 - **ci**: Detect and run CI pipeline with status reporting
-- **ci-cd-patterns**: Loaded when user asks about CI/CD pipelines or deployment automation
-- **clean-code**: Loaded when user asks about clean code, naming, or code quality
+- **ci-cd-patterns**: CI/CD pipeline and deployment automation: GitHub Actions, GitLab CI, Jenkins, build stages, caching, artifact promotion, blue-green, canary, rollback gates. Triggers: CI, CD, pipeline, GitHub Actions, workflow YAML, deploy automation, release, artifact, rollout, canary, blue-green. Load when designing or fixing a build/release pipeline.
+- **clean-code**: Code quality principles: meaningful names, single responsibility, DRY, small functions, clear intent, guard clauses, refactoring rules. Triggers: clean code, naming, refactor for clarity, code smell, SRP, DRY, long function, god class, magic number, dead code. Load when reviewing or writing any production code.
 - **command-creator**: Creates new Claude Code slash commands with frontmatter, workflow guidance, and validation
 - **commit**: Create Conventional Commits with pre-commit validation
 - **content-moderation-patterns**: Loaded when user builds content moderation, safety filters, or policy enforcement with Claude. Covers pre-filter vs LLM-classify, category design, confidence thresholds, and human-in-the-loop.
 - **council**: 4-perspective decision evaluation for architecture choices. Use when user wants multi-angle analysis, needs to decide between alternatives, or mentions 'council', 'evaluate decision', 'pros cons'. Codex-adapted: uses native subagents and plan tracking.
-- **csharp-patterns**: Loaded when user asks about C# or .NET development patterns
+- **csharp-patterns**: C# and .NET development patterns: LINQ, async/await, dependency injection, records, nullable reference types, ASP.NET Core minimal APIs, EF Core, MediatR. Triggers: C#, .NET, dotnet, ASP.NET, EF Core, LINQ, IServiceCollection, record type, async C#, nullable reference types. Load when writing or reviewing C#/.NET code.
 - **cve-scan**: Scan project dependencies for known CVEs using native audit tools (npm, pip, composer, cargo, go, bundler, dart)
-- **database-patterns**: Loaded when user asks about database schema or query optimization
+- **database-patterns**: Database schema design and query optimization: normalization, indexing strategies, joins, N+1, transactions, isolation levels, partitioning, EXPLAIN plans. Triggers: schema, table design, index, slow query, N+1, PostgreSQL, MySQL, SQL Server, SQL, EXPLAIN, query plan, transaction, deadlock. Load when designing tables or tuning queries.
 - **debug**: Debug errors and trace root causes systematically
-- **debugging-tactics**: Loaded when user is debugging an issue or needs root cause analysis
+- **debugging-tactics**: Root-cause debugging with 4-phase method: investigation, hypothesis, validation, fix. No fix without RCA. Triggers: bug, error, exception, stack trace, not working, intermittent, flaky, crash, regression, fails sometimes, why is X happening, broken after. Load when user reports a bug or asks to investigate failing code.
 - **deploy**: Deploy with pre-flight checks and health verification
 - **design-an-interface**: Generate multiple radically different interface designs using parallel sub-agents, then compare on simplicity, depth, and correctness. Based on 'Design It Twice' from Ousterhout. Use when user wants to design an API, explore interface options, compare module shapes, or mentions 'design it twice'. Codex-adapted: uses native subagents and plan tracking.
-- **design-engineering**: Loaded when user asks about UI animations or CSS design craft
-- **docker-devops**: Loaded when user asks about Docker, containers, or DevOps patterns
+- **design-engineering**: UI craftsmanship (Emil Kowalski school): animation frequency rules, easing curves, micro-interactions, state polish, invisible-details philosophy. Triggers: animation, transition, ease-out, ease-in-out, motion, micro-interaction, hover state, loading state, UI polish, design detail, spring curve, delightful UX. Load when building or reviewing interactive UI.
+- **docker-devops**: Docker, containers, Kubernetes, and DevOps patterns: Dockerfile best practices, multi-stage builds, compose, k8s manifests, Helm charts, service mesh, image hardening. Triggers: Docker, Dockerfile, container, image, Kubernetes, k8s, compose, Helm, registry, layer caching, service mesh, pod, deployment yaml. Load when writing or fixing container/orchestration configs.
 - **docs**: Generate and update README, API docs, and architecture notes
-- **documentation-standards**: Loaded when creating or updating KB documents, architecture notes, SOPs, or any file in kb/ directory
-- **ecommerce-patterns**: Loaded when user asks about e-commerce or shopping cart features
+- **documentation-standards**: KB document conventions: YAML frontmatter (7 required fields), 5-category taxonomy (reference/howto/procedures/troubleshooting/best-practices), directory-category matching, validate.sh CI rules. Triggers: kb/, KB document, architecture note, SOP, runbook, howto, frontmatter, knowledge base entry, documentation standard. Load when creating or editing any file under kb/.
+- **ecommerce-patterns**: E-commerce domain patterns: cart, checkout flow, payment providers (Stripe/Adyen), order state machine, inventory, promotions, tax, B2B vs B2C. Triggers: cart, checkout, product, SKU, inventory, payment, Stripe, Shopify, Medusa, Magento, order status, promotion, tax calculation, coupon, refund. Load when working on any e-commerce feature.
 - **evaluate**: Evaluate skill quality and RAG retrieval accuracy
 - **evolve**: Evolve agent definitions via meta-architect
 - **explain**: Explain code, architecture, or concepts with diagrams
 - **explore**: Explore codebase structure, stack, and architecture
 - **fix**: Auto-fix lint errors, type issues, and simple bugs
-- **flutter-patterns**: Loaded when user asks about Flutter or Dart development patterns
-- **git-mastery**: Loaded when user asks about advanced Git workflows or history rewriting
+- **flutter-patterns**: Flutter and Dart development patterns: widget composition, state management (Riverpod/Bloc/Provider), navigation, async, platform channels, performance. Triggers: Flutter, Dart, widget, StatefulWidget, Riverpod, Bloc, Provider, pubspec, Navigator, platform channel, hot reload, StatelessWidget. Load when writing or reviewing Flutter code.
+- **git-mastery**: Advanced Git workflows: interactive rebase, bisect, reflog, cherry-pick, worktrees, history rewriting, submodules, large-file migration (LFS/filter-repo). Triggers: git rebase, bisect, cherry-pick, reflog, force push, history rewrite, detached HEAD, merge conflict, worktree, squash, fixup, submodule. Load when user needs non-trivial Git operations.
 - **grill-me**: Stress-test a plan or design through relentless Socratic questioning, walking down each decision branch until reaching shared understanding. Use when user wants to stress-test a plan, get grilled, validate assumptions, or mentions 'grill me'. Codex-adapted: uses native subagents and plan tracking.
 - **health**: Report service and infrastructure health status
 - **hipaa-validate**: Validate code against HIPAA policy: PHI exposure, missing audit logging, unencrypted transmission/storage, access control gaps, temp file exposure, and missing BAA references
-- **hive-mind**: Loaded when orchestrating multi-agent swarms or consensus workflows
+- **hive-mind**: Multi-agent swarm coordination: consensus voting with confidence scores, output aggregation, file ownership, targeted vs broadcast messaging, map-reduce workflows. Triggers: swarm, hive mind, multi-agent, consensus, parallel agents, team of agents, aggregate results, agent voting, distributed agents. Load when orchestrating 3+ agents working in parallel.
 - **hook-creator**: Creates new Claude Code hooks with guided workflow, strict conventions, and validation
 - **index**: Index codebase into the knowledge base
 - **instinct-review**: Review and manage learned instincts from past sessions
 - **introspect**: Agent self-debugging and recovery. Use when stuck in loops, making repeated errors, or quality degrades. Triggers: introspect, self-debug, stuck, loop, why failing.
-- **java-patterns**: Loaded when user asks about Java development patterns
+- **java-patterns**: Java development patterns: Spring Boot, CompletableFuture, records, sealed types, streams, JPA/Hibernate, Maven/Gradle, virtual threads (Loom). Triggers: Java, Spring, Spring Boot, JPA, Hibernate, Maven, Gradle, CompletableFuture, record type, sealed class, virtual thread. Load when writing or reviewing Java code.
 - **json-mode-patterns**: Loaded when user needs structured JSON output from Claude. Covers tool-use-as-JSON-mode, schema design, parsing, partial recovery, and validation.
-- **kotlin-patterns**: Loaded when user asks about Kotlin development patterns
+- **kotlin-patterns**: Kotlin development patterns: coroutines, Flow, sealed classes, data classes, extension functions, null safety, Ktor, Jetpack Compose, KMP. Triggers: Kotlin, coroutine, Flow, suspend, Ktor, Android Kotlin, Jetpack Compose, sealed class, data class, KMP, kotlinx. Load when writing or reviewing Kotlin code.
 - **lint**: Lint code with auto-detected tools and fix suggestions
 - **mcp-builder**: Build production-grade MCP (Model Context Protocol) servers from scratch using the 4-phase methodology: research, implement, test, evaluate. Use when creating new MCP integrations for external APIs, databases, or internal services.
-- **mcp-patterns**: Loaded when user asks about MCP servers or tool protocol design
+- **mcp-patterns**: MCP (Model Context Protocol) server design: tool schemas, resource patterns, transport selection (stdio/SSE), client configuration, error handling, capability negotiation. Triggers: MCP, Model Context Protocol, MCP server, MCP tool, MCP resource, JSON-RPC, stdio transport, SSE transport, Claude Desktop config, Cursor MCP. Load when building or integrating MCP servers.
 - **mem-search**: Search past coding sessions using natural language. Finds relevant observations, decisions, and context from previous work.
 - **migrate**: Run database migrations with backup verification
-- **migration-patterns**: Loaded when user asks about database migrations or zero-downtime deploys
+- **migration-patterns**: Zero-downtime database migration patterns: expand-contract, double-write, backfill, blue-green schema changes, feature flags, rollback safety, online DDL. Triggers: migration, schema change, zero-downtime, expand-contract, double-write, backfill, ALTER TABLE, column rename, safe deploy, online DDL. Load when planning non-trivial DB schema changes.
 - **model-routing-patterns**: Loaded when user builds multi-model pipelines (Haiku/Sonnet/Opus). Covers cost-optimized routing, escalation, sub-agent delegation, and fallback chains.
 - **night-watch**: Run autonomous maintenance and dependency updates
-- **observability-patterns**: Loaded when user asks about logging, metrics, or tracing patterns
+- **observability-patterns**: Observability: structured logging, metrics (RED/USE/four golden signals), distributed tracing (OpenTelemetry), correlation IDs, log aggregation, SLO/SLI. Triggers: logging, log level, metrics, Prometheus, Grafana, OpenTelemetry, trace, span, structured log, observability, monitoring, SLO, SLI, alerting. Load when adding or reviewing logs, metrics, or traces.
 - **onboard**: Generate project onboarding materials
 - **orchestrate**: Coordinate multiple specialized agents in parallel Codex-adapted: uses native subagents and plan tracking.
 - **panic**: Emergency stabilization via system-governor agent
-- **performance-profiling**: Loaded when user asks about performance profiling or optimization
+- **performance-profiling**: Performance measurement and optimization: four golden signals (latency/traffic/errors/saturation), p50/p95/p99, baseline-change-measure loop, flame graphs, load testing. Triggers: performance, slow, latency, p99, flame graph, profile, bottleneck, optimization, load test, benchmark, CPU profiling, memory leak. Load when diagnosing or optimizing slow code or services.
 - **persona**: Switch engineering persona at runtime: backend-lead, frontend-lead, devops-eng, junior-dev
 - **plan**: Plan implementation with tasks and success criteria
-- **plan-writing**: Loaded when user asks to write an implementation plan or pre-mortem
+- **plan-writing**: Implementation plan and pre-mortem drafting: phase breakdown, success criteria, risks, rollback plan, acceptance tests, estimated effort. Triggers: implementation plan, pre-mortem, phased plan, project plan, task breakdown, success criteria, rollback strategy, risk register. Load when user asks to write a plan or pre-mortem document.
 - **plugin-creator**: Creates experimental opt-in plugin packs with manifests, conventions, and optional module scaffolding for Claude and Codex runtimes
 - **pr**: Create pull requests with pre-flight validation
 - **prd-to-issues**: Break a PRD into independently-grabbable GitHub issues using vertical slices with HITL/AFK tagging and dependency ordering. Use when user wants to convert a PRD to issues, create tickets, or break down a PRD into work items.
@@ -518,29 +518,29 @@ Skills are invocable commands or auto-loaded knowledge sources:
 - **predict**: Predict regressions and impact before changes land
 - **prompt-caching-patterns**: Loaded when user builds with Anthropic API and needs to cut cost or latency via prompt caching. Covers TTL, cache breakpoints, stacking, invalidation, and measuring hit rate.
 - **qa-session**: Interactive QA session where user reports bugs conversationally and agent files GitHub issues with domain language. Explores codebase in background for context. Use when user wants to report bugs, do QA, file issues conversationally, or mentions QA session. Codex-adapted: uses native subagents and plan tracking.
-- **rag-patterns**: Loaded when user asks about RAG systems, embeddings, or vector search
+- **rag-patterns**: RAG architecture: embeddings, chunking strategies, hybrid search (BM25 + vector), reranking, CRAG/self-correcting, multi-hop reasoning, evaluation metrics. Triggers: RAG, embedding, vector search, pgvector, Qdrant, Pinecone, Weaviate, chunking, reranker, retrieval, hybrid search, semantic search, knowledge base, cosine similarity. Load when building or tuning RAG systems.
 - **refactor**: Refactor code for quality and maintainability
 - **refactor-plan**: Create a detailed refactor plan with tiny commits via user interview, then file as a GitHub issue RFC. Use when user wants to plan a refactor, create a refactoring RFC, or break a refactor into safe incremental steps. Codex-adapted: uses native subagents and plan tracking.
 - **repeat**: Run a prompt or slash command on a recurring interval until task complete or limits reached. Use when user wants to set up a recurring task, poll for status, or run something repeatedly on an interval. Codex-adapted: uses native subagents and plan tracking.
-- **research-mastery**: Loaded when user asks to research, verify, or synthesize information
+- **research-mastery**: Hierarchical information retrieval following strict order: KB first (smart_query/crag_search), then MCP/Context7, then web search, then LLM knowledge as last resort. Triggers: research, find information, verify fact, synthesize sources, fact-check, cross-reference, multi-source, cite sources, investigate topic. Load when any task requires external or cross-source knowledge.
 - **review**: Review code for quality, security, and correctness
 - **rollback**: Roll back a deployment safely with verification
-- **ruby-patterns**: Loaded when user asks about Ruby development patterns
-- **rust-patterns**: Loaded when user asks about Rust development patterns
+- **ruby-patterns**: Ruby and Rails development patterns: blocks, metaprogramming, ActiveRecord, Sidekiq, RSpec, Sorbet/RBS, Hanami, Roda, Rack middleware. Triggers: Ruby, Rails, ActiveRecord, Sidekiq, RSpec, gem, Gemfile, bundler, rake, Hanami, Sorbet. Load when writing or reviewing Ruby code.
+- **rust-patterns**: Rust development patterns: ownership, borrowing, lifetimes, async (Tokio), error handling (Result/anyhow/thiserror), traits, macros, zero-cost abstractions, unsafe boundaries. Triggers: Rust, borrow checker, lifetime, Tokio, async Rust, cargo, trait, impl, Result, unsafe, lifetime annotation, clippy. Load when writing or reviewing Rust code.
 - **search**: Search the knowledge base with semantic and hybrid modes
-- **security-patterns**: Loaded when user asks about security, OWASP, or auth patterns
+- **security-patterns**: Application security: OWASP Top 10, authN/authZ, input validation, secrets management, TLS, CSRF/XSS/SQLi, session handling, JWT, rate limiting, CSP. Triggers: security, OWASP, auth, JWT, CSRF, XSS, SQL injection, secrets, encryption, TLS, authentication, authorization, CSP, CORS, password hashing. Load when touching auth code, handling user input, or doing security review.
 - **seo-validate**: Validate code against SEO best practices: W3C semantics, meta/OG tags, Schema.org, hreflang, Core Web Vitals (LCP/INP/CLS), resource hints, GEO, SPA/SSG/CSR crawlability, technical SEO, accessibility-for-SEO. Supports React/Next/Nuxt/Astro/Gatsby/SvelteKit/Remix/Angular/Vue/static HTML.
 - **skill-audit**: Scan skills and agents for security risks: dangerous patterns, secrets, excessive permissions
 - **skill-creator**: Create new skills from templates with guided workflow
 - **subagent-development**: Execute implementation plans using fresh subagents per task with two-stage review: spec compliance first, then code quality. Use when executing plans with independent tasks. Codex-adapted: uses native subagents and plan tracking.
 - **swarm**: Execute tasks via Map-Reduce, Consensus, or Relay swarms Codex-adapted: uses native subagents and plan tracking.
-- **swift-patterns**: Loaded when user asks about Swift or iOS development patterns
+- **swift-patterns**: Swift and iOS development patterns: SwiftUI, Combine, async/await, property wrappers, actors, Swift Package Manager, Core Data, UIKit interop, @MainActor. Triggers: Swift, SwiftUI, Combine, iOS, Xcode, actor, property wrapper, Core Data, SPM, UIKit, @MainActor, @State, @Binding. Load when writing or reviewing Swift code.
 - **tdd**: Test-driven development with red-green-refactor loop and vertical slices. Use when user wants TDD, test-first development, red-green-refactor, or building features with tests driving the implementation. Codex-adapted: uses native subagents and plan tracking.
 - **teams**: Launch pre-configured Agent Teams for common workflows Codex-adapted: uses native subagents and plan tracking.
 - **test**: Run tests with coverage analysis and reporting
-- **testing-patterns**: Loaded when user asks about testing strategy, fixtures, or mocking
+- **testing-patterns**: Testing strategy and craft: pyramid vs trophy, unit/integration/e2e split, fixtures, mocks vs fakes vs stubs, AAA pattern, flaky test diagnosis, coverage goals, property-based testing. Triggers: test, testing strategy, fixture, mock, stub, AAA, unit test, integration test, e2e, Playwright, Cypress, flaky, coverage, TDD, test pyramid. Load when writing, reviewing, or designing test suites.
 - **triage-issue**: Triage a bug by deeply exploring the codebase for root cause, then create a GitHub issue with a TDD-based fix plan. Mostly hands-off — minimal user interaction. Use when user reports a bug, wants to investigate an issue, mentions triage, or wants a fix plan. Codex-adapted: uses native subagents and plan tracking.
-- **typescript-patterns**: Loaded when user asks about TypeScript patterns or type safety
+- **typescript-patterns**: TypeScript type safety patterns: strict mode, generics, conditional types, template literals, discriminated unions, branded types, Zod, satisfies operator, const assertions. Triggers: TypeScript, TS, generics, conditional type, utility type, strict, Zod, satisfies, discriminated union, type safety, type narrowing, template literal type. Load when writing or reviewing TypeScript code.
 - **ubiquitous-language**: Extract a DDD-style ubiquitous language glossary from the conversation, flagging ambiguities and proposing canonical terms. Saves to UBIQUITOUS_LANGUAGE.md. Use when user wants to define domain terms, build a glossary, harden terminology, or mentions DDD or domain model.
 - **verification-before-completion**: Loaded when agent is about to claim work is complete, fixed, or passing — requires running verification commands and confirming output before making any success claims. Evidence before assertions, always.
 - **workflow**: Start and manage autonomous agent workflows Codex-adapted: uses native subagents and plan tracking.

package/CHANGELOG.md

@@ -7,7 +7,16 @@ Versioning follows [Semantic Versioning](https://semver.org/).
 
 ---
 
-## v2.8.0 — Security Hardening & GHAS Integration (2026-04-18)
+## v2.9.0 — Skill Routability & Description Lint (2026-04-19)
+
+### Changed
+- **30 knowledge-skill descriptions rewritten** — every skill with `user-invocable: false` used the `"Loaded when user asks about X"` shape, which carries no action verb and no concrete trigger keywords. Per [Anthropic skill docs](https://code.claude.com/docs/en/skills.md), Claude Code auto-routes skills using only the `description:` field (+ optional `when_to_use:`), so weak descriptions silently lowered hit rate. Rewritten with the pattern `[capability]. Triggers: [keywords]. Load when [...]`. Affected skills: `api-patterns`, `app-builder`, `architecture-decision`, `ci-cd-patterns`, `clean-code`, `csharp-patterns`, `database-patterns`, `debugging-tactics`, `design-engineering`, `docker-devops`, `documentation-standards`, `ecommerce-patterns`, `flutter-patterns`, `git-mastery`, `hive-mind`, `java-patterns`, `kotlin-patterns`, `mcp-patterns`, `migration-patterns`, `observability-patterns`, `performance-profiling`, `plan-writing`, `rag-patterns`, `research-mastery`, `ruby-patterns`, `rust-patterns`, `security-patterns`, `swift-patterns`, `testing-patterns`, `typescript-patterns`.
+
+### Added
+- **`scripts/audit_skills.py` description-quality lint (`check_description`)** — new WARN rules that prevent the `"Loaded when user asks about/to ..."` anti-pattern from returning. Enforces three limits on auto-loadable skills: `description + when_to_use ≤ 1536 chars` (Anthropic truncation limit), knowledge-skill description ≥ 80 chars, and a regex block on the historical weak-opening patterns. Task skills (`disable-model-invocation: true`) are skipped — their description is a menu label, not a routing signal.
+- **Regenerated `AGENTS.md`, `llms.txt`, `llms-full.txt`, `GEMINI.md`, `.github/copilot-instructions.md`** — machine-readable catalogs now carry the new descriptions. External clients (Cursor, Windsurf, Copilot, Gemini CLI, Codex) get the same routing signal as Claude Code.
+
+
 
 ### Added
 - **`scripts/audit_skills.py --sarif`** — emits SARIF 2.1.0 JSON compatible with GitHub Advanced Security Code Scanning. Severity maps HIGH→error / WARN→warning / INFO→note. Enables the GitHub Security tab to ingest audit findings directly.

package/README.md

@@ -10,12 +10,11 @@
 
 ---
 
-## What's New in v2.8.0
+## What's New in v2.9.0
 
-- **SARIF + permissions audit** — `audit_skills.py --sarif` emits SARIF 2.1.0 for GitHub Advanced Security Code Scanning; `--permissions` prints per-skill tool usage (e.g. "50 skills use Bash") and flags broad Bash+Write+Edit access.
-- **Signed npm provenance** — the publish workflow now runs with `--provenance`; published tarballs carry a cryptographic build-origin attestation verifiable via `npm audit signatures`.
-- **Checksum-pinned URL sources** — `sources.json` now persists `sha256` of every URL-sourced rule/hook and warns on upstream content change. `AI_TOOLKIT_STRICT_PIN=1` turns mismatches into a hard CI failure.
-- **Security hardening** — `tarfile.extract` uses `filter="data"` on Python 3.12+; `session-start.sh` sanitises `VERSION_MSG` before `osascript`/`powershell.exe`; install-time `subprocess.run` calls now time out at 120 s.
+- **Skill routability fix** — 30 knowledge skills (`user-invocable: false`) had weak `"Loaded when user asks about X"` descriptions that silently lowered auto-loading hit rate. Rewritten with the Anthropic-docs-aligned shape `[capability]. Triggers: [keywords]. Load when [...]`.
+- **Description-quality lint** — `audit_skills.py` now enforces `description + when_to_use ≤ 1536 chars` (Anthropic limit), knowledge-skill descriptions ≥ 80 chars, and blocks the old anti-pattern from returning. CI fails on regression.
+- **Catalogs regenerated** — `AGENTS.md`, `llms.txt`, `llms-full.txt`, `GEMINI.md`, and `.github/copilot-instructions.md` now carry the improved routing signals for Cursor, Windsurf, Copilot, Gemini CLI, and Codex.
 
 See [CHANGELOG.md](CHANGELOG.md) for full history.
 

package/app/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ai-toolkit",
   "description": "Professional-grade Claude Code toolkit with persona presets, skill security auditor, expanded lifecycle hooks, experimental opt-in plugin packs, benchmark harvesting, and multi-tool support.",
-  "version": "2.8.0",
+  "version": "2.9.0",
   "author": {
     "name": "SoftSpark",
     "url": "https://github.com/softspark"

package/app/skills/api-patterns/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: api-patterns
-description: "Loaded when user asks about REST API design or GraphQL patterns"
+description: "REST and GraphQL API design patterns: resource naming, versioning, pagination, error contracts, idempotency, HATEOAS, OpenAPI. Triggers: API design, REST, GraphQL, endpoint, route, OpenAPI, Swagger, pagination, rate limit, versioning, idempotency key. Load when designing or reviewing any HTTP API surface."
 effort: medium
 user-invocable: false
 allowed-tools: Read

package/app/skills/app-builder/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: app-builder
-description: "Loaded when user asks to scaffold or build a full-stack app"
+description: "Full-stack app scaffolding with stack-selection matrix: Next.js, React+Vite, Nuxt, Astro, FastAPI, Django, Laravel, React Native, Flutter, Unity. Triggers: scaffold, bootstrap, new project, starter template, build app, landing page, dashboard, API, mobile app, CLI, e-commerce, game. Load when user wants to start a new project from scratch."
 effort: medium
 user-invocable: false
 allowed-tools: Read

package/app/skills/architecture-decision/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: architecture-decision
-description: "Loaded when user asks about architecture decisions or architecture note writing"
+description: "Architecture decision making via trade-off analysis in RFC/RFD/ADR format: context, constraints, 3+ options, comparison, recommendation. Triggers: architecture decision, ADR, RFC, RFD, trade-offs, options comparison, design choice, pick between, should we use, evaluate approach. Load when weighing 2+ architectural options or writing decision records."
 effort: medium
 user-invocable: false
 allowed-tools: Read, Write

package/app/skills/ci-cd-patterns/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: ci-cd-patterns
-description: "Loaded when user asks about CI/CD pipelines or deployment automation"
+description: "CI/CD pipeline and deployment automation: GitHub Actions, GitLab CI, Jenkins, build stages, caching, artifact promotion, blue-green, canary, rollback gates. Triggers: CI, CD, pipeline, GitHub Actions, workflow YAML, deploy automation, release, artifact, rollout, canary, blue-green. Load when designing or fixing a build/release pipeline."
 effort: medium
 user-invocable: false
 allowed-tools: Read

package/app/skills/clean-code/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: clean-code
-description: "Loaded when user asks about clean code, naming, or code quality"
+description: "Code quality principles: meaningful names, single responsibility, DRY, small functions, clear intent, guard clauses, refactoring rules. Triggers: clean code, naming, refactor for clarity, code smell, SRP, DRY, long function, god class, magic number, dead code. Load when reviewing or writing any production code."
 effort: medium
 user-invocable: false
 allowed-tools: Read

package/app/skills/csharp-patterns/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: csharp-patterns
-description: "Loaded when user asks about C# or .NET development patterns"
+description: "C# and .NET development patterns: LINQ, async/await, dependency injection, records, nullable reference types, ASP.NET Core minimal APIs, EF Core, MediatR. Triggers: C#, .NET, dotnet, ASP.NET, EF Core, LINQ, IServiceCollection, record type, async C#, nullable reference types. Load when writing or reviewing C#/.NET code."
 effort: medium
 user-invocable: false
 allowed-tools: Read

package/app/skills/database-patterns/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: database-patterns
-description: "Loaded when user asks about database schema or query optimization"
+description: "Database schema design and query optimization: normalization, indexing strategies, joins, N+1, transactions, isolation levels, partitioning, EXPLAIN plans. Triggers: schema, table design, index, slow query, N+1, PostgreSQL, MySQL, SQL Server, SQL, EXPLAIN, query plan, transaction, deadlock. Load when designing tables or tuning queries."
 effort: medium
 user-invocable: false
 allowed-tools: Read

package/app/skills/debugging-tactics/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: debugging-tactics
-description: "Loaded when user is debugging an issue or needs root cause analysis"
+description: "Root-cause debugging with 4-phase method: investigation, hypothesis, validation, fix. No fix without RCA. Triggers: bug, error, exception, stack trace, not working, intermittent, flaky, crash, regression, fails sometimes, why is X happening, broken after. Load when user reports a bug or asks to investigate failing code."
 effort: medium
 user-invocable: false
 allowed-tools: Grep, Read

package/app/skills/design-engineering/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: design-engineering
-description: "Loaded when user asks about UI animations or CSS design craft"
+description: "UI craftsmanship (Emil Kowalski school): animation frequency rules, easing curves, micro-interactions, state polish, invisible-details philosophy. Triggers: animation, transition, ease-out, ease-in-out, motion, micro-interaction, hover state, loading state, UI polish, design detail, spring curve, delightful UX. Load when building or reviewing interactive UI."
 effort: medium
 user-invocable: false
 allowed-tools: Read

package/app/skills/docker-devops/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: docker-devops
-description: "Loaded when user asks about Docker, containers, or DevOps patterns"
+description: "Docker, containers, Kubernetes, and DevOps patterns: Dockerfile best practices, multi-stage builds, compose, k8s manifests, Helm charts, service mesh, image hardening. Triggers: Docker, Dockerfile, container, image, Kubernetes, k8s, compose, Helm, registry, layer caching, service mesh, pod, deployment yaml. Load when writing or fixing container/orchestration configs."
 effort: medium
 user-invocable: false
 allowed-tools: Read

package/app/skills/documentation-standards/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: documentation-standards
-description: "Loaded when creating or updating KB documents, architecture notes, SOPs, or any file in kb/ directory"
+description: "KB document conventions: YAML frontmatter (7 required fields), 5-category taxonomy (reference/howto/procedures/troubleshooting/best-practices), directory-category matching, validate.sh CI rules. Triggers: kb/, KB document, architecture note, SOP, runbook, howto, frontmatter, knowledge base entry, documentation standard. Load when creating or editing any file under kb/."
 effort: medium
 user-invocable: false
 allowed-tools: Read

package/app/skills/ecommerce-patterns/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: ecommerce-patterns
-description: "Loaded when user asks about e-commerce or shopping cart features"
+description: "E-commerce domain patterns: cart, checkout flow, payment providers (Stripe/Adyen), order state machine, inventory, promotions, tax, B2B vs B2C. Triggers: cart, checkout, product, SKU, inventory, payment, Stripe, Shopify, Medusa, Magento, order status, promotion, tax calculation, coupon, refund. Load when working on any e-commerce feature."
 effort: medium
 user-invocable: false
 allowed-tools: Read

package/app/skills/flutter-patterns/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: flutter-patterns
-description: "Loaded when user asks about Flutter or Dart development patterns"
+description: "Flutter and Dart development patterns: widget composition, state management (Riverpod/Bloc/Provider), navigation, async, platform channels, performance. Triggers: Flutter, Dart, widget, StatefulWidget, Riverpod, Bloc, Provider, pubspec, Navigator, platform channel, hot reload, StatelessWidget. Load when writing or reviewing Flutter code."
 effort: medium
 user-invocable: false
 allowed-tools: Read

package/app/skills/git-mastery/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: git-mastery
-description: "Loaded when user asks about advanced Git workflows or history rewriting"
+description: "Advanced Git workflows: interactive rebase, bisect, reflog, cherry-pick, worktrees, history rewriting, submodules, large-file migration (LFS/filter-repo). Triggers: git rebase, bisect, cherry-pick, reflog, force push, history rewrite, detached HEAD, merge conflict, worktree, squash, fixup, submodule. Load when user needs non-trivial Git operations."
 effort: medium
 user-invocable: false
 allowed-tools: Read, Grep, Glob

package/app/skills/hive-mind/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: hive-mind
-description: "Loaded when orchestrating multi-agent swarms or consensus workflows"
+description: "Multi-agent swarm coordination: consensus voting with confidence scores, output aggregation, file ownership, targeted vs broadcast messaging, map-reduce workflows. Triggers: swarm, hive mind, multi-agent, consensus, parallel agents, team of agents, aggregate results, agent voting, distributed agents. Load when orchestrating 3+ agents working in parallel."
 effort: medium
 user-invocable: false
 allowed-tools: Read

package/app/skills/java-patterns/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: java-patterns
-description: "Loaded when user asks about Java development patterns"
+description: "Java development patterns: Spring Boot, CompletableFuture, records, sealed types, streams, JPA/Hibernate, Maven/Gradle, virtual threads (Loom). Triggers: Java, Spring, Spring Boot, JPA, Hibernate, Maven, Gradle, CompletableFuture, record type, sealed class, virtual thread. Load when writing or reviewing Java code."
 effort: medium
 user-invocable: false
 allowed-tools: Read

package/app/skills/kotlin-patterns/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: kotlin-patterns
-description: "Loaded when user asks about Kotlin development patterns"
+description: "Kotlin development patterns: coroutines, Flow, sealed classes, data classes, extension functions, null safety, Ktor, Jetpack Compose, KMP. Triggers: Kotlin, coroutine, Flow, suspend, Ktor, Android Kotlin, Jetpack Compose, sealed class, data class, KMP, kotlinx. Load when writing or reviewing Kotlin code."
 effort: medium
 user-invocable: false
 allowed-tools: Read

package/app/skills/mcp-patterns/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: mcp-patterns
-description: "Loaded when user asks about MCP servers or tool protocol design"
+description: "MCP (Model Context Protocol) server design: tool schemas, resource patterns, transport selection (stdio/SSE), client configuration, error handling, capability negotiation. Triggers: MCP, Model Context Protocol, MCP server, MCP tool, MCP resource, JSON-RPC, stdio transport, SSE transport, Claude Desktop config, Cursor MCP. Load when building or integrating MCP servers."
 effort: medium
 user-invocable: false
 allowed-tools: Read

package/app/skills/migration-patterns/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: migration-patterns
-description: "Loaded when user asks about database migrations or zero-downtime deploys"
+description: "Zero-downtime database migration patterns: expand-contract, double-write, backfill, blue-green schema changes, feature flags, rollback safety, online DDL. Triggers: migration, schema change, zero-downtime, expand-contract, double-write, backfill, ALTER TABLE, column rename, safe deploy, online DDL. Load when planning non-trivial DB schema changes."
 effort: medium
 user-invocable: false
 allowed-tools: Read

package/app/skills/observability-patterns/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: observability-patterns
-description: "Loaded when user asks about logging, metrics, or tracing patterns"
+description: "Observability: structured logging, metrics (RED/USE/four golden signals), distributed tracing (OpenTelemetry), correlation IDs, log aggregation, SLO/SLI. Triggers: logging, log level, metrics, Prometheus, Grafana, OpenTelemetry, trace, span, structured log, observability, monitoring, SLO, SLI, alerting. Load when adding or reviewing logs, metrics, or traces."
 effort: medium
 user-invocable: false
 allowed-tools: Read

package/app/skills/performance-profiling/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: performance-profiling
-description: "Loaded when user asks about performance profiling or optimization"
+description: "Performance measurement and optimization: four golden signals (latency/traffic/errors/saturation), p50/p95/p99, baseline-change-measure loop, flame graphs, load testing. Triggers: performance, slow, latency, p99, flame graph, profile, bottleneck, optimization, load test, benchmark, CPU profiling, memory leak. Load when diagnosing or optimizing slow code or services."
 effort: medium
 allowed-tools: Read, Grep
 user-invocable: false

package/app/skills/plan-writing/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: plan-writing
-description: "Loaded when user asks to write an implementation plan or pre-mortem"
+description: "Implementation plan and pre-mortem drafting: phase breakdown, success criteria, risks, rollback plan, acceptance tests, estimated effort. Triggers: implementation plan, pre-mortem, phased plan, project plan, task breakdown, success criteria, rollback strategy, risk register. Load when user asks to write a plan or pre-mortem document."
 effort: medium
 user-invocable: false
 allowed-tools: Read

package/app/skills/rag-patterns/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: rag-patterns
-description: "Loaded when user asks about RAG systems, embeddings, or vector search"
+description: "RAG architecture: embeddings, chunking strategies, hybrid search (BM25 + vector), reranking, CRAG/self-correcting, multi-hop reasoning, evaluation metrics. Triggers: RAG, embedding, vector search, pgvector, Qdrant, Pinecone, Weaviate, chunking, reranker, retrieval, hybrid search, semantic search, knowledge base, cosine similarity. Load when building or tuning RAG systems."
 effort: medium
 user-invocable: false
 allowed-tools: Read

package/app/skills/research-mastery/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: research-mastery
-description: "Loaded when user asks to research, verify, or synthesize information"
+description: "Hierarchical information retrieval following strict order: KB first (smart_query/crag_search), then MCP/Context7, then web search, then LLM knowledge as last resort. Triggers: research, find information, verify fact, synthesize sources, fact-check, cross-reference, multi-source, cite sources, investigate topic. Load when any task requires external or cross-source knowledge."
 effort: medium
 user-invocable: false
 allowed-tools: Read

package/app/skills/ruby-patterns/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: ruby-patterns
-description: "Loaded when user asks about Ruby development patterns"
+description: "Ruby and Rails development patterns: blocks, metaprogramming, ActiveRecord, Sidekiq, RSpec, Sorbet/RBS, Hanami, Roda, Rack middleware. Triggers: Ruby, Rails, ActiveRecord, Sidekiq, RSpec, gem, Gemfile, bundler, rake, Hanami, Sorbet. Load when writing or reviewing Ruby code."
 effort: medium
 user-invocable: false
 allowed-tools: Read

package/app/skills/rust-patterns/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: rust-patterns
-description: "Loaded when user asks about Rust development patterns"
+description: "Rust development patterns: ownership, borrowing, lifetimes, async (Tokio), error handling (Result/anyhow/thiserror), traits, macros, zero-cost abstractions, unsafe boundaries. Triggers: Rust, borrow checker, lifetime, Tokio, async Rust, cargo, trait, impl, Result, unsafe, lifetime annotation, clippy. Load when writing or reviewing Rust code."
 effort: medium
 user-invocable: false
 allowed-tools: Read

package/app/skills/security-patterns/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: security-patterns
-description: "Loaded when user asks about security, OWASP, or auth patterns"
+description: "Application security: OWASP Top 10, authN/authZ, input validation, secrets management, TLS, CSRF/XSS/SQLi, session handling, JWT, rate limiting, CSP. Triggers: security, OWASP, auth, JWT, CSRF, XSS, SQL injection, secrets, encryption, TLS, authentication, authorization, CSP, CORS, password hashing. Load when touching auth code, handling user input, or doing security review."
 effort: medium
 user-invocable: false
 allowed-tools: Read

package/app/skills/swift-patterns/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: swift-patterns
-description: "Loaded when user asks about Swift or iOS development patterns"
+description: "Swift and iOS development patterns: SwiftUI, Combine, async/await, property wrappers, actors, Swift Package Manager, Core Data, UIKit interop, @MainActor. Triggers: Swift, SwiftUI, Combine, iOS, Xcode, actor, property wrapper, Core Data, SPM, UIKit, @MainActor, @State, @Binding. Load when writing or reviewing Swift code."
 effort: medium
 user-invocable: false
 allowed-tools: Read

package/app/skills/testing-patterns/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: testing-patterns
-description: "Loaded when user asks about testing strategy, fixtures, or mocking"
+description: "Testing strategy and craft: pyramid vs trophy, unit/integration/e2e split, fixtures, mocks vs fakes vs stubs, AAA pattern, flaky test diagnosis, coverage goals, property-based testing. Triggers: test, testing strategy, fixture, mock, stub, AAA, unit test, integration test, e2e, Playwright, Cypress, flaky, coverage, TDD, test pyramid. Load when writing, reviewing, or designing test suites."
 effort: medium
 user-invocable: false
 allowed-tools: Read

package/app/skills/typescript-patterns/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: typescript-patterns
-description: "Loaded when user asks about TypeScript patterns or type safety"
+description: "TypeScript type safety patterns: strict mode, generics, conditional types, template literals, discriminated unions, branded types, Zod, satisfies operator, const assertions. Triggers: TypeScript, TS, generics, conditional type, utility type, strict, Zod, satisfies, discriminated union, type safety, type narrowing, template literal type. Load when writing or reviewing TypeScript code."
 effort: medium
 user-invocable: false
 allowed-tools: Read