@vegastack/skills 0.1.0 → 0.3.0

package/skill-integrity.json

@@ -1,48 +1,77 @@
 {
-  "schemaVersion": 1,
-  "skill": "vegastack-arch-guardian",
-  "files": {
-    "SKILL.md": "8403b56f972ccbc5ee86a1fcbbe25334cb3d98d0307b117e85f79308cc094d15",
-    "agents/openai.yaml": "7c878993a58e718bc1e8e20abe22c6ef0dd6e63816df66b0f50333e68edcead2",
-    "assets/adr-template.md": "7a7138cfc7fe39427e60003b83eb41ea8586dc8a9e0d56e6d7dafda044e10ed8",
-    "assets/answers-example.json": "5eb2543f1c1d439b8cbb61e15d1634aac1ba92fdd907a1e8592c8a98d75abf56",
-    "assets/architecture-profile.json": "c9f776c5d17f8766d0c9b22723f567ac8e3821c4ea63add5d15877652ec98bdd",
-    "assets/architecture-profile.schema.json": "6593fdb8f5abb0425a42173dc4ce272331b4d364c12daa29444de88c2090d49b",
-    "assets/deployment-review-template.md": "e9be2feb153138d936f9ebd5763c3be10597cee639616f86cc082c498fd60cd2",
-    "assets/service-design-template.md": "670798e3bf26a76d593294ff60763e1a6a35866fa84ea74345406b05b4b0b61b",
-    "assets/threat-model-template.md": "ffcf22e3fc81c803d976ac6c41cbac4fb0f552d81653b89a5b587a46b59d9aed",
-    "references/architecture/agent-product.md": "3b8039ef9ca6aa30fc8781475e005d7bbb9d8d415705a6e8c79b4a602ee1ed5e",
-    "references/architecture/ai-cost.md": "2892d1ed68c19561fb4f38956bbbd7b573c6544f220e8cb88be0dc57bf757221",
-    "references/architecture/ai-data-boundaries.md": "d5b2e6486ac2662a9bab1e0469c5ff9dcc00ec56cf8d190dd025f62178dc97fa",
-    "references/architecture/ai-evals.md": "cfd81abac927292e6fb3dc2bf999754fc6f30a41184dafcf1060ac3a16f0cd30",
-    "references/architecture/connectors-sandbox.md": "5d410e4ec06463b6a51b941fdef768f22f8f62f132117d05a10d125822248621",
-    "references/architecture/data-memory.md": "3d2ccbcd90a00dddda7096877c874d4fa7b61b96e2e4061c3c82b40bd990cf19",
-    "references/architecture/delivery-operations.md": "2988ae173517faaaff325d39c2881f854663a0386f073475b479a66bb8c69008",
-    "references/architecture/durable-execution.md": "a26420ca9fac928597e09ad88aefa221034fef597113335537328e8c9c4df8ea",
-    "references/architecture/flutter.md": "434365ff03620b192444af2052f723fb2cb05ffe702894292aaeca72b19b3da0",
-    "references/architecture/foundation.md": "bd6eb424139e82f84a7787bd1f23e8206c78fd85e80d81a0f57796f55d8c8b6e",
-    "references/architecture/hosting-reliability.md": "10d9a3a82f688c1acd1a1c9a3fbcdcb516217ce446ea09b2fe326b0a8e93b015",
-    "references/architecture/identity-tenancy.md": "8c6acc3ec474072d92de59465d6d528c8ca247507ca158f492f405f63b863723",
-    "references/architecture/model-lifecycle.md": "061f79418e732cd32efca703f0a6f7c04132ddc8063b2719ce2e3af93efd575f",
-    "references/architecture/models-observability.md": "d81e0a8e26d9065f8e26b385a52fade1cf5cd9f82549e8586dd8396eabd0d203",
-    "references/architecture/realtime-channels.md": "a95738c431f3f4c8c42c153a0b940897bae8d679ed0c2dfced3cb1c4c9c67ca5",
-    "references/architecture/security-privacy.md": "68d00b7accf861664bf26acadd7e88af5bc64e78b04a4fe506932366945d39e5",
-    "references/architecture/topology-monorepo.md": "18763c997b924dbc915f49a69712cec95bf8a2e32c67901e12b515d90e698436",
-    "references/architecture/web.md": "7b1cf9f459de297c2eda6582ecf5af3727010b15cb31069ee5c424023c9109c4",
-    "references/control-catalog.json": "6d5135b4cc209bc9321e8946b6b8c46ddc04532dc4cfb798ed4d7eedbb12f64e",
-    "references/foundation-compatibility.json": "5f6c278e601f9221c55b049622da33c613ac274116d939dc479e800b09dbb7a5",
-    "references/golden-patterns.md": "0b00ece15e0ae20450d5c20409e7be34bab0d9b47c1614fb48cef780ca66605b",
-    "references/profile-governance.md": "14821377e0018072e3843da9d26001040c3b771b3ecf18052859ff77a967a97e",
-    "references/rule-model.json": "6429a29c3a106a9851f326dfc963483115a62a508a57772c586951f6726cf8e0",
-    "references/workflows.md": "e17858b8f41fddf47a40076e7add3fa7f10aa1dad87fb14f07fae108bc97d2de",
-    "refresh/REFRESH.md": "5f258f91e2deefcec2c403cff2b3241cdbdbb9e56f2af8b820789a34f0c030de",
-    "refresh/sources.json": "f5ada4bd5f9aab9697767b9ed1c35b44ec66603901e9192dda2c36a9f9e6f0f9",
-    "scripts/architecture-check.mjs": "37866fdfe4a6a5de3068144536ccfd8b1351c66793b57cf432ce1bf2444c52b4",
-    "scripts/lib.mjs": "ae0c8a324c960ba6af95054d0458e276d6122c835c3094500963078b2202c24b",
-    "scripts/profile-tool.mjs": "c79862b55935e2c472ea943c7365815a13b18c22d7783b9beee89b6b8cc1bb33",
-    "scripts/refresh-evidence.mjs": "04344be11367b1c60fb4ea2b56f50598c97394caae3227cd81560acb9411e85c",
-    "scripts/schema-validate.mjs": "329cca29ead284949107a5e0984588373522e9ef6624dffd18d4d207ef51fc99",
-    "scripts/validate-profile.mjs": "f823ce2a04b12f33e6c459e179453d988e5b7b1a888fbf00ad3ee36a18fa2ba7",
-    "scripts/verify-corpus.mjs": "d33d3f1717f988a45fe50477d5ad357a7c026abc75d3c1c23812d096b7dfe633"
+  "schemaVersion": 2,
+  "skills": {
+    "arch-guardian": {
+      "files": {
+        "SKILL.md": "46eb5d40506c3e7b2f9d15a3cbfa189acb690ba55e7af924d463e003ae8eeb70",
+        "agents/openai.yaml": "9553ddb318a4b7f0d610343f28fc8af636fc4b24832a00e818c3b824449b0a59",
+        "assets/adr-template.md": "db813ef4621a76e1101b3a19fc944de60a38591b423d9a9ad6c8f0b1db38120c",
+        "assets/answers-example.json": "eed87446717032c60015232674272689bd68a7c8f5f43ff166aeaa0f649b7a9f",
+        "assets/architecture-profile.json": "70d78d81f2c65f7aa37d9ea7b7a5f0518961037262ae2db6da8e6c1f24757ee8",
+        "assets/architecture-profile.schema.json": "bcf370b882ef6e605abf530c8245d599471e8aa54f0ef42fc99b5119550b8905",
+        "assets/deployment-review-template.md": "e9be2feb153138d936f9ebd5763c3be10597cee639616f86cc082c498fd60cd2",
+        "assets/service-design-template.md": "670798e3bf26a76d593294ff60763e1a6a35866fa84ea74345406b05b4b0b61b",
+        "assets/threat-model-template.md": "ffcf22e3fc81c803d976ac6c41cbac4fb0f552d81653b89a5b587a46b59d9aed",
+        "references/advisory-report.md": "bfc0dc8e985e33312ed0617705b359457eaea7b6056307e94ea293d167992dd4",
+        "references/architecture/agent-product.md": "3b8039ef9ca6aa30fc8781475e005d7bbb9d8d415705a6e8c79b4a602ee1ed5e",
+        "references/architecture/ai-cost.md": "9cb300e5718c15d5e6c29d22293b4ca80340e73d2b77267fbc529016c6262dd2",
+        "references/architecture/ai-data-boundaries.md": "0d756d0132d05e0e45dcd1b582e6c4bfe04a9043ab8df64d9a88fb086d8b29ff",
+        "references/architecture/ai-evals.md": "9b9698acd8b73c17ea301569b6c57bbdede304cfec7fa6f7d6d4af017a64fa6c",
+        "references/architecture/connectors-sandbox.md": "c12248cb0eddf51143e6f14c71541042d676b405bf274271bb69148c621ab41f",
+        "references/architecture/data-memory.md": "3d2ccbcd90a00dddda7096877c874d4fa7b61b96e2e4061c3c82b40bd990cf19",
+        "references/architecture/delivery-operations.md": "82fafe5f0f157f7a870ff6c9aad64564ab121ac049446318fcf9c1b7f4517f36",
+        "references/architecture/durable-execution.md": "4dd1c7d69e41fb0abf7f469c8eadd1695b15c502e0219108c76d8aea06f9ffe6",
+        "references/architecture/flutter.md": "f024292b89b4667c65993bba906fb16afd278824f205f0e39c96a58384c6f423",
+        "references/architecture/foundation.md": "19536e03fdbb8720e263600a298b11e980cf6c24a724f8692db83b04302b39f1",
+        "references/architecture/hosting-reliability.md": "c69b00a354d78e2a7b2845cddc0d8a642911bc009efefa141075d1d774756142",
+        "references/architecture/identity-tenancy.md": "5fb2e5d74ae24ad2efe3ba01c06b8fcc16ba1dce1b9c531b7d955352af38d4c2",
+        "references/architecture/model-lifecycle.md": "eacdeade0fa88caaca11de9a9e69f0db8a9ecfc8b472070afb7158f5e30f6ba2",
+        "references/architecture/models-observability.md": "5501655b71d85e9653e5a8c276e481e2765b2a0c67c5bc23759f869529278b94",
+        "references/architecture/realtime-channels.md": "a95738c431f3f4c8c42c153a0b940897bae8d679ed0c2dfced3cb1c4c9c67ca5",
+        "references/architecture/security-privacy.md": "28d8d1a6347df95807d274829b2fbbd852c07a74d52d7e0be18d208b559504ea",
+        "references/architecture/topology-monorepo.md": "fdad26c8eaa32b977139e6f70c90a3954332a1fa6dd6e8d98bc9fb7c5a613117",
+        "references/architecture/web.md": "560957d179f9372ff01e3e216fdc8ad1cbee290ac95f42094d04da4af08a4c0a",
+        "references/foundation-compatibility.json": "dfbf106631ebd229d683b18855e126cdc4684a252038123b25d002724571ac14",
+        "references/golden-patterns.md": "0b00ece15e0ae20450d5c20409e7be34bab0d9b47c1614fb48cef780ca66605b",
+        "references/profile-governance.md": "b3ed0b4580c73fa0340c33267707ee9515071ac2b64bdc3dd56b8c558431a0b3",
+        "references/rule-model.json": "b9d4d13d152eecbb73a5add12c8ab9bb050e0f1001495c90c8b801d029b56598",
+        "references/workflows.md": "f54c284d831e14da00886fd186bc711bb8598fca4f2fc309f6caa197835e79ae",
+        "refresh/REFRESH.md": "db15a4304d0a3d3ab7f53722d30fb76609f1823cb2dc998f1807f092e79e008a",
+        "refresh/sources.json": "d35735620325c45693c8eddb5de5e7e1867cae19554e118b45867f8984250950",
+        "scripts/lib.mjs": "4ef4910518134eea7f89b6e397e5871f66a416429c75f59bf37e0864e4cf7ca0",
+        "scripts/profile-tool.mjs": "c13230b1c6a7bce9b91fb8a6a7d6eb84e9ef8855bf8b2a544e7bbfdc38e94877",
+        "scripts/refresh-evidence.mjs": "4759cedd15470247df23485b4c8d258e7e8f22cbceaac60f7e63cb42159af779",
+        "scripts/schema-validate.mjs": "329cca29ead284949107a5e0984588373522e9ef6624dffd18d4d207ef51fc99",
+        "scripts/validate-profile.mjs": "0b1f6b6d9e21267fd1ac545fd47fe46d9ecddc6a2efe67c5518e0845719a2b4d",
+        "scripts/verify-corpus.mjs": "d752efb00145afeaa7d2e758e10c5c11670253c1387326a52d6dda7fc67cda1c"
+      }
+    },
+    "skill-maintainer": {
+      "files": {
+        "SKILL.md": "bbbf15a9900d9d2009ccfbe163cface9654c81a9a84777718348d97b30739aeb",
+        "agents/openai.yaml": "0b89d4e6416cf20b448f5322f3d7433cfde333d2b4a05b42ed53db3759701fb4",
+        "references/release-ops.md": "2bde6c55cbe7674678e14b915fc5ebe565413aeb25c3d51a86e195af53004d01",
+        "references/standards.md": "3646d0dd0560a87b333f70febf670b093c89b35111132cdb641b763bf184b02f",
+        "refresh/REFRESH.md": "a9a86a979ef720cf2f316c76f05db0fd9beef591401b95ceb475474fe40bc936",
+        "refresh/sources.json": "cf38cdf8123a50ea7ef2d1466a87faa648c12e5bc90d9ee9b6ae45632e7d0800"
+      }
+    },
+    "skillify": {
+      "files": {
+        "SKILL.md": "35a194eb6a1638153898b0f8e0f97f8384ab0e75d5a1ebb0f280464e23a01ac8",
+        "agents/openai.yaml": "df320cf32a8db06c213f7892844dab810b7e96cfbf32502d25185d4a4167ef87",
+        "assets/templates/README.md.template": "68230ada702ad39f5de1f35e838ba590d89ca19b23868d4499353db6034fcc2c",
+        "assets/templates/REFRESH.md.template": "eef8dddbe6da5437e44b0e0412ff89a5cc4d2e45db95c05aa4adaa1c40fb0819",
+        "assets/templates/SKILL.md.template": "7fafee929e9d4db8f2a773f7093603ec5bc9bfc5aee0e03127023fa5e5883bb9",
+        "assets/templates/openai.yaml.template": "2fbf488369825109d6cad4f17e7b729a40d9e3c43c7f01bc5dfa16361d59c086",
+        "assets/templates/skill.test.ts.template": "7b852def3575da1ec90f3786caba286a2b6981ed41cac3ed9900996ad8ef68e6",
+        "assets/templates/sources.json.template": "df665176a12b6a86c014cd719ee79f149854f79c544a4eff3b1755fe71f99a15",
+        "references/authoring.md": "1ee846b6e210b5cbb4db328c6218274caa42dc61cbddaf159c531daef41683fd",
+        "references/eval-playbook.md": "e810158fbb56c4422b5ee4b5f2f57329e0b7544aa9d22b0fcb3c9cd6d225befe",
+        "refresh/REFRESH.md": "ca7bdd7de656a8ebec779506beeec8637b6de9dca7a635041f6fcd3e9b9c4ee7",
+        "refresh/sources.json": "e554e80c72c16dc70587361804db9e0cf2716c128820b2612d5983a009b2b242",
+        "scripts/scaffold-skill.mjs": "1b5de288bcc2170dc24738dc939c960bb1b54b100a19614ff592a7ad1311d73f"
+      }
+    }
   }
 }

package/skill/vegastack-arch-guardian/SKILL.md

@@ -1,96 +0,0 @@
----
-name: vegastack-arch-guardian
-description: Architecture advisor for VegaStack projects. Use when designing a new service or feature, reviewing architecture or a risky change (auth, tenancy, agents, jobs, connectors, data lifecycle, hosting), deciding between architectural options, writing or validating an ADR or .vegastack/architecture.json profile, threat modeling, planning a migration, or checking dependency and source drift. Gives one scoped recommendation with an explicit verdict; activates only the capabilities a project has actually enabled. Covers web-only, Flutter, agentic and non-agentic, single- and multi-tenant, internal, public, platform-service, and shared-package projects.
----
-
-# VegaStack Architecture Guardian
-
-Act as the project's decisive senior architect. Apply only activated capabilities. Treat the foundation as an advisory recommendation: state `GUARDIAN VERDICT: REJECT` when warranted, while allowing a project owner to accept any scoped risk through a valid ADR. Never invent compliance or project facts.
-
-## Start every task
-
-1. Identify the actual decision, its scope, and how expensive it is to reverse.
-2. Inspect repository instructions and existing facts before asking questions. Keep read-only work read-only; never create a profile or artifact merely because it is absent.
-3. Separate **facts**, **constraints**, **assumptions**, **preferences**, and **accepted project decisions**. Distinguish current, target, and migration state.
-4. Ask at most three material questions at a time. If unanswered, proceed with bounded assumptions and the smallest architecture that meets stated requirements.
-5. Read only the directly relevant references below. Use committed profiles, designs, and ADRs as architecture memory; never rely on hidden chat state.
-6. Prioritize security/correctness, recovery, ownership, contracts, operability, delivery, then optional optimization. Make one primary recommendation, identify the rejected alternative, and surface irreversible or expensive choices first.
-7. Evidence labels (**OBSERVED**, **DOCUMENTED**, **REPRODUCED**, **INFERRED**, **RECOMMENDED**, **NOT VERIFIED**) are optional; reserve them for review and drift reports where provenance matters. A static sentinel or declared control is never a reproduced runtime test.
-
-Script invocations below write `<skill-dir>` as a placeholder: replace it with the absolute path of the directory containing this SKILL.md before running (no environment variable is set for you).
-
-## Answer at the right size
-
-- **Questions and explanations:** answer directly — the verdict (if one applies), the recommendation, and at most one material risk. No section headers, no full contract.
-- **Design reviews, ADRs, migration plans:** use the full response contract: (1) Verdict, (2) Recommended architecture/decision, (3) Why it fits, (4) Material assumptions, (5) Rejected alternative and reason, (6) Implementation/migration sequence, (7) Risks and required evidence, (8) Artifacts/ADRs to update.
-
-## Route progressively
-
-| Need | Read |
-|---|---|
-| operating model, project types, profiles, exceptions | [foundation](references/architecture/foundation.md), [profile and governance](references/profile-governance.md) |
-| greenfield, brownfield, migration, continuous work | [adaptive workflows](references/workflows.md) |
-| topology, deployables, packages, contracts | [topology and monorepo](references/architecture/topology-monorepo.md) |
-| web/Next/OpenAPI/cache | [web](references/architecture/web.md) |
-| Flutter/mobile | [Flutter](references/architecture/flutter.md) |
-| identity, organizations, tenancy, RLS | [identity and tenancy](references/architecture/identity-tenancy.md) |
-| agent product and durable execution/jobs | [agent product](references/architecture/agent-product.md), [durable execution](references/architecture/durable-execution.md) |
-| connectors, MCP, webhooks, sandbox, egress | [connectors and sandbox](references/architecture/connectors-sandbox.md) |
-| data, knowledge, memory, objects | [data and memory](references/architecture/data-memory.md) |
-| PII, prompt injection, output moderation | [AI data boundaries](references/architecture/ai-data-boundaries.md) |
-| evals, prompt/model regression gates | [AI evals](references/architecture/ai-evals.md) |
-| model pinning, deprecations, canary, backpressure | [model lifecycle](references/architecture/model-lifecycle.md) |
-| model spend, budgets, cost attribution | [AI cost](references/architecture/ai-cost.md) |
-| realtime, notifications, channels | [realtime and channels](references/architecture/realtime-channels.md) |
-| models, BYOK, telemetry, audit | [models and observability](references/architecture/models-observability.md) |
-| security, privacy, threat model | [security and privacy](references/architecture/security-privacy.md) |
-| hosting, Cloudflare/OpenNext, SLO/recovery | [hosting and reliability](references/architecture/hosting-reliability.md) |
-| delivery, migration, verification | [delivery and operations](references/architecture/delivery-operations.md) |
-| fragile boundary implementation | [golden patterns](references/golden-patterns.md) |
-
-Consult [refresh/sources.json](refresh/sources.json) only for affected unstable claims and [foundation compatibility](references/foundation-compatibility.json) for version adoption. Before advice that leans on a **critical** source (`critical: true` in the registry), check freshness: run `node <skill-dir>/scripts/refresh-evidence.mjs --topics <affected-topics>` when online, or treat the claim as `NOT VERIFIED` when offline and the registry snapshot is older than its `thresholdDays`. Source drift requests review; it never silently expires an ADR.
-
-## Execute the task-specific workflow
-
-- **Greenfield:** Follow the adaptive intake in [workflows](references/workflows.md). Recommend capability set, topology, ownership, boundaries, immediate/deferred decisions, risks, implementation order, and qualification. Offer scaffolding only after confirmation.
-- **Brownfield/review:** Inspect instructions, manifests/locks, deployables, packages, schemas/migrations, auth, APIs/clients, jobs/workflows, infra, ADRs, observability, and runbooks before interviewing. Derive an observed draft without mutation; compare current, intended, and target states; prefer controlled migration over rewrites.
-- **ADR/design/threat/deploy:** Use the relevant asset only after write authorization. Every action includes owner, risk, evidence, rollback/migration, and review trigger.
-- **Continuous work:** Load only affected references and checks. Do not force absent capabilities into scope.
-- **Source drift:** Follow [refresh/REFRESH.md](refresh/REFRESH.md). Refresh only affected topics; map changes to rules/capabilities and preserve unrelated fast paths.
-
-## Profiles, checks, and mutation safety
-
-The committed profile lives at `.vegastack/architecture.json` (legacy `.yaml`-named JSON is still discovered, with a deprecation notice). Inspect or draft without mutation:
-
-```sh
-node <skill-dir>/scripts/profile-tool.mjs inspect .
-node <skill-dir>/scripts/profile-tool.mjs scaffold answers.json --dir .
-```
-
-`inspect` prints a compact summary; add `--json` for the full draft. The answers format is documented by example in `<skill-dir>/assets/answers-example.json`.
-
-Write only after explicit authorization; writes are atomic, refuse symlinks, stay inside `--dir`, and require `--force` to replace differing content:
-
-```sh
-node <skill-dir>/scripts/profile-tool.mjs scaffold answers.json --dir . --write
-node <skill-dir>/scripts/profile-tool.mjs migrate-v2 .vegastack/architecture.yaml --dir .
-```
-
-Validate and review (prefer `--summary` in conversation; `--json` is for CI):
-
-```sh
-node <skill-dir>/scripts/validate-profile.mjs .vegastack/architecture.json
-node <skill-dir>/scripts/architecture-check.mjs . --summary
-```
-
-`architecture-check` exit codes: 0 = no FAIL findings, 1 = FAIL findings present, 2 = tool/usage error. A non-zero exit is a review result, not a crash. Paths can be excluded deliberately via a `.guardianignore` file (path prefixes, one per line). Symlinks, agent-skill trees, and generated/bundled files (very large or very long-line files) are skipped automatically and reported in one `NOT VERIFIED` finding.
-
-Interpret outcomes exactly: `PASS` satisfies the recommendation; `FAIL` violates it without a valid exception; `EXCEPTED` is active project-owner accepted risk and remains visibly noncompliant although CI may pass; `NOT VERIFIED` records reason, risk, owner, and next action. Invalid, expired, or mismatched exceptions fail. Continue to recommend rejection when accepted risk remains unsafe.
-
-## Guardrails
-
-- Product-owned enabled capabilities are the default. Shared/external management is rare and requires the complete declared contract in [profile and governance](references/profile-governance.md).
-- Challenge project proposals and foundation defaults when evidence warrants. Choose the smallest architecture meeting current requirements and measured objectives.
-- Never require SQL/RLS, Better Auth, Flutter, EVE, pg-boss, sandbox, connectors, enterprise identity, realtime, notifications, knowledge, or OpenBao when their activation condition is absent.
-- Never mutate a repository for an explanation or read-only review. Draft first and ask before writing.
-- Never create paid/cloud resources or claim live recovery, isolation, failover, credential-backed, or provider tests ran unless they actually ran.

package/skill/vegastack-arch-guardian/agents/openai.yaml

@@ -1,4 +0,0 @@
-interface:
-  display_name: "VegaStack Architecture Guardian"
-  short_description: "Design and guard adaptive VegaStack architecture"
-  default_prompt: "Use $vegastack-arch-guardian to make one scoped architecture recommendation for this project without assuming absent capabilities."

package/skill/vegastack-arch-guardian/assets/adr-template.md

@@ -1,40 +0,0 @@
-# ADR-NNN: Decision title
-
-- Status: proposed | accepted | superseded | rejected
-- Date: YYYY-MM-DD
-- Project-Owner: accountable person
-- Scope-Paths: comma-separated exact repository-relative paths
-- Rule-ID: canonical rule identifier or `none`
-- Control-IDs: comma-separated exact checker/manual control IDs, or `all` for a rule-level exception that omits the profile controls list
-- Exception-ID: profile exception ID or `none`
-- Foundation-Deviation-Acknowledged: true | false
-- Review-Date: YYYY-MM-DD | none
-- Review-Event: concrete event | none
-
-## Context and facts
-
-Separate observed facts, constraints, assumptions, preferences and prior accepted decisions. Identify current, target and migration states.
-
-## Decision and rationale
-
-State the primary decision, ownership, boundaries and why it fits. State the rejected alternative and reason.
-
-## Risks and accepted deviation
-
-Describe each risk, who accepts it, affected paths/tenants/data, and why the foundation recommendation remains unmet.
-
-## Compensating controls
-
-Map preventive, detective and recovery controls to each risk. Do not claim an untested control works.
-
-## Verification
-
-List static sentinels, declared controls, reproduced tests, and `NOT VERIFIED` environment behavior with reason, risk, owner and next action.
-
-## Rollback or migration
-
-Describe rollback, migration/exit behavior, compatibility window, irreversible steps and cleanup.
-
-## Review trigger
-
-Give an expiry date or concrete event. Missing, expired or malformed exception ADRs fail validation.

package/skill/vegastack-arch-guardian/assets/answers-example.json

@@ -1,20 +0,0 @@
-{
-  "profileStatus": "draft",
-  "project": { "name": "example-product", "kind": "saas-product", "lifecycle": "greenfield", "access": "authenticated", "tenancy": "multi-tenant-shared-schema" },
-  "environments": { "production": { "hosting": "cloudflare-opennext" }, "localDevelopment": { "trusted": true, "allowances": ["local-secrets"] } },
-  "capabilities": {
-    "webControlPlane": { "status": "enabled", "ownership": "owned", "versions": { "next": "16.3.0", "node": "24.18.0", "bun": "1.3.14", "openNext": "1.20.2", "betterAuth": "1.6.26" }, "placement": "open-next-worker", "sourceRoots": ["apps/web"], "controls": { "canonicalApi": "rest-openapi", "openapiGenerated": true, "secureCookies": true } },
-    "flutter": { "status": "disabled", "ownership": "not-applicable" },
-    "agents": { "status": "disabled", "ownership": "not-applicable" },
-    "jobs": { "status": "disabled", "ownership": "not-applicable" },
-    "sandbox": { "status": "disabled", "ownership": "not-applicable" },
-    "connectors": { "status": "disabled", "ownership": "not-applicable" },
-    "knowledge": { "status": "disabled", "ownership": "not-applicable" },
-    "modelRouting": { "status": "disabled", "ownership": "not-applicable" },
-    "enterpriseIdentity": { "status": "disabled", "ownership": "not-applicable" },
-    "realtime": { "status": "disabled", "ownership": "not-applicable" },
-    "notifications": { "status": "disabled", "ownership": "not-applicable" },
-    "secrets": { "status": "enabled", "ownership": "owned", "versions": { "openbao": "2.3.2" }, "placement": "external-service", "sourceRoots": ["infra/secrets"], "controls": { "provider": "openbao" } }
-  },
-  "exceptions": []
-}

package/skill/vegastack-arch-guardian/assets/architecture-profile.json

@@ -1,25 +0,0 @@
-{
-  "schemaVersion": 3,
-  "profileStatus": "draft",
-  "foundation": { "version": "0.3.0", "baseline": "vs-2026-08-07", "adoption": "supported" },
-  "project": { "name": "REQUIRED-CONFIRMED-PROJECT-NAME", "kind": "REQUIRED-CONFIRMED-PROJECT-KIND", "lifecycle": "REQUIRED-CONFIRMED-LIFECYCLE", "access": "REQUIRED-CONFIRMED-ACCESS", "tenancy": "REQUIRED-CONFIRMED-TENANCY" },
-  "environments": {
-    "production": { "hosting": "REQUIRED-CONFIRMED-PRODUCTION-TARGET" },
-    "localDevelopment": { "trusted": true, "allowances": [] }
-  },
-  "capabilities": {
-    "webControlPlane": { "status": "disabled", "ownership": "not-applicable" },
-    "flutter": { "status": "disabled", "ownership": "not-applicable" },
-    "agents": { "status": "disabled", "ownership": "not-applicable" },
-    "jobs": { "status": "disabled", "ownership": "not-applicable" },
-    "sandbox": { "status": "disabled", "ownership": "not-applicable" },
-    "connectors": { "status": "disabled", "ownership": "not-applicable" },
-    "knowledge": { "status": "disabled", "ownership": "not-applicable" },
-    "modelRouting": { "status": "disabled", "ownership": "not-applicable" },
-    "enterpriseIdentity": { "status": "disabled", "ownership": "not-applicable" },
-    "realtime": { "status": "disabled", "ownership": "not-applicable" },
-    "notifications": { "status": "disabled", "ownership": "not-applicable" },
-    "secrets": { "status": "disabled", "ownership": "not-applicable" }
-  },
-  "exceptions": []
-}

package/skill/vegastack-arch-guardian/assets/architecture-profile.schema.json

@@ -1,213 +0,0 @@
-{
-  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://raw.githubusercontent.com/vegastack/vegastack-skills/main/skills/vegastack-arch-guardian/assets/architecture-profile.schema.json",
-  "title": "VegaStack Architecture Profile v3",
-  "type": "object",
-  "additionalProperties": false,
-  "required": ["schemaVersion", "profileStatus", "foundation", "project", "environments", "capabilities", "exceptions"],
-  "$defs": {
-    "exactVersion": { "type": "string", "pattern": "^[0-9]+\\.[0-9]+(?:\\.[0-9]+)?(?:-[0-9A-Za-z.-]+)?(?:\\+[0-9A-Za-z.-]+)?$" },
-    "relativePath": { "type": "string", "minLength": 1, "pattern": "^(?!/)(?!.*(?:^|/)\\.\\.(?:/|$))(?!.*\\\\).+$" },
-    "nonEmptyStrings": { "type": "array", "minItems": 1, "uniqueItems": true, "items": { "type": "string", "minLength": 1 } },
-    "serviceContract": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["ownerService", "contract", "version", "tenantSecurityBoundary", "identityAudience", "dataResidency", "sloRecovery", "incidentOwner", "compatibility", "migrationExit"],
-      "properties": {
-        "ownerService": { "type": "string", "minLength": 1 },
-        "contract": { "type": "string", "minLength": 1 },
-        "version": { "$ref": "#/$defs/exactVersion" },
-        "tenantSecurityBoundary": { "type": "string", "minLength": 1 },
-        "identityAudience": { "type": "string", "minLength": 1 },
-        "dataResidency": { "type": "string", "minLength": 1 },
-        "sloRecovery": { "type": "string", "minLength": 1 },
-        "incidentOwner": { "type": "string", "minLength": 1 },
-        "compatibility": { "type": "string", "minLength": 1 },
-        "migrationExit": { "type": "string", "minLength": 1 }
-      }
-    },
-    "removal": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["durableData", "credentials", "queues", "contracts", "owner", "verification", "rollback"],
-      "properties": {
-        "durableData": { "type": "string", "minLength": 1 },
-        "credentials": { "type": "string", "minLength": 1 },
-        "queues": { "type": "string", "minLength": 1 },
-        "contracts": { "type": "string", "minLength": 1 },
-        "owner": { "type": "string", "minLength": 1 },
-        "verification": { "type": "string", "minLength": 1 },
-        "rollback": { "type": "string", "minLength": 1 }
-      }
-    },
-    "capability": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["status", "ownership"],
-      "properties": {
-        "status": { "enum": ["enabled", "disabled"] },
-        "ownership": { "enum": ["owned", "shared-managed", "external-managed", "not-applicable"] },
-        "versions": {
-          "type": "object",
-          "minProperties": 1,
-          "propertyNames": { "pattern": "^[A-Za-z][A-Za-z0-9]*$" },
-          "additionalProperties": { "$ref": "#/$defs/exactVersion" }
-        },
-        "placement": { "type": "string", "minLength": 1 },
-        "sourceRoots": { "type": "array", "minItems": 1, "uniqueItems": true, "items": { "$ref": "#/$defs/relativePath" } },
-        "contract": { "$ref": "#/$defs/serviceContract" },
-        "controls": { "type": "object", "additionalProperties": { "type": ["string", "boolean", "number", "array"], "items": { "type": "string" } } },
-        "transitionFrom": { "enum": ["enabled", "disabled"] },
-        "removal": { "$ref": "#/$defs/removal" }
-      },
-      "allOf": [
-        {
-          "if": { "properties": { "status": { "const": "enabled" } }, "required": ["status"] },
-          "then": { "required": ["versions", "placement"], "properties": { "ownership": { "enum": ["owned", "shared-managed", "external-managed"] } } }
-        },
-        {
-          "if": { "properties": { "status": { "const": "disabled" } }, "required": ["status"] },
-          "then": { "properties": { "ownership": { "const": "not-applicable" } } }
-        },
-        {
-          "if": { "properties": { "status": { "const": "enabled" }, "ownership": { "const": "owned" } }, "required": ["status", "ownership"] },
-          "then": { "required": ["sourceRoots"] }
-        },
-        {
-          "if": { "properties": { "ownership": { "enum": ["shared-managed", "external-managed"] } }, "required": ["ownership"] },
-          "then": { "required": ["contract"], "not": { "required": ["sourceRoots"] } }
-        },
-        {
-          "if": { "properties": { "status": { "const": "disabled" }, "transitionFrom": { "const": "enabled" } }, "required": ["status", "transitionFrom"] },
-          "then": { "required": ["removal"] }
-        }
-      ]
-    },
-    "exception": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["id", "ruleId", "paths", "adr", "projectOwner", "status", "verificationType", "rationale", "decision", "risks", "compensatingControls", "verification", "rollbackOrMigration", "review", "foundationDeviationAcknowledged"],
-      "properties": {
-        "id": { "type": "string", "pattern": "^EXC-[0-9]{3,}$" },
-        "ruleId": { "type": "string", "pattern": "^[A-Z]+-[0-9]{3}$" },
-        "controls": { "$ref": "#/$defs/nonEmptyStrings" },
-        "paths": { "type": "array", "minItems": 1, "uniqueItems": true, "items": { "$ref": "#/$defs/relativePath" } },
-        "adr": { "$ref": "#/$defs/relativePath" },
-        "projectOwner": { "type": "string", "minLength": 1 },
-        "status": { "enum": ["active", "withdrawn"] },
-        "verificationType": { "enum": ["static-sentinel", "manual-qualification"] },
-        "rationale": { "type": "string", "minLength": 1 },
-        "decision": { "type": "string", "minLength": 1 },
-        "risks": { "$ref": "#/$defs/nonEmptyStrings" },
-        "compensatingControls": { "$ref": "#/$defs/nonEmptyStrings" },
-        "verification": { "$ref": "#/$defs/nonEmptyStrings" },
-        "rollbackOrMigration": { "type": "string", "minLength": 1 },
-        "review": {
-          "oneOf": [
-            { "type": "object", "additionalProperties": false, "required": ["date"], "properties": { "date": { "type": "string", "format": "date" } } },
-            { "type": "object", "additionalProperties": false, "required": ["event"], "properties": { "event": { "type": "string", "minLength": 1 } } }
-          ]
-        },
-        "foundationDeviationAcknowledged": { "const": true }
-      }
-    }
-  },
-  "properties": {
-    "schemaVersion": { "const": 3 },
-    "profileStatus": { "enum": ["draft", "confirmed"] },
-    "foundation": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["version", "baseline", "adoption"],
-      "properties": {
-        "version": { "const": "0.3.0" },
-        "baseline": { "type": "string", "minLength": 1 },
-        "adoption": { "enum": ["supported", "candidate", "deprecated"] }
-      }
-    },
-    "project": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["name", "kind", "lifecycle", "access", "tenancy"],
-      "properties": {
-        "name": { "type": "string", "minLength": 1 },
-        "kind": { "enum": ["saas-product", "internal-product", "public-product", "platform-service", "shared-package"] },
-        "lifecycle": { "enum": ["greenfield", "brownfield", "migration", "maintenance"] },
-        "access": { "enum": ["public", "authenticated", "internal", "mixed"] },
-        "tenancy": { "enum": ["none", "single-tenant", "multi-tenant-shared-schema", "multi-tenant-isolated"] }
-      }
-    },
-    "environments": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["production", "localDevelopment"],
-      "properties": {
-        "production": {
-          "type": "object",
-          "additionalProperties": false,
-          "required": ["hosting"],
-          "properties": { "hosting": { "enum": ["self-hosted", "vercel", "cloudflare-opennext", "external", "none"] }, "region": { "type": "string", "minLength": 1 } }
-        },
-        "localDevelopment": {
-          "type": "object",
-          "additionalProperties": false,
-          "required": ["trusted", "allowances"],
-          "properties": { "trusted": { "const": true }, "allowances": { "type": "array", "uniqueItems": true, "items": { "enum": ["local-workflow-world", "local-secrets", "local-unsandboxed-code", "single-process"] } } }
-        }
-      }
-    },
-    "capabilities": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["webControlPlane", "flutter", "agents", "jobs", "sandbox", "connectors", "knowledge", "modelRouting", "enterpriseIdentity", "realtime", "notifications", "secrets"],
-      "properties": {
-        "webControlPlane": { "$ref": "#/$defs/capability" },
-        "flutter": { "$ref": "#/$defs/capability" },
-        "agents": { "$ref": "#/$defs/capability" },
-        "jobs": { "$ref": "#/$defs/capability" },
-        "sandbox": { "$ref": "#/$defs/capability" },
-        "connectors": { "$ref": "#/$defs/capability" },
-        "knowledge": { "$ref": "#/$defs/capability" },
-        "modelRouting": { "$ref": "#/$defs/capability" },
-        "enterpriseIdentity": { "$ref": "#/$defs/capability" },
-        "realtime": { "$ref": "#/$defs/capability" },
-        "notifications": { "$ref": "#/$defs/capability" },
-        "secrets": { "$ref": "#/$defs/capability" }
-      }
-    },
-    "data": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["classes"],
-      "properties": {
-        "classes": {
-          "type": "array",
-          "minItems": 1,
-          "items": {
-            "type": "object",
-            "additionalProperties": false,
-            "required": ["name"],
-            "properties": {
-              "name": { "enum": ["public", "internal", "confidential", "restricted"] },
-              "residency": { "type": "string", "minLength": 1 },
-              "retention": { "type": "string", "minLength": 1 },
-              "owner": { "type": "string", "minLength": 1 }
-            }
-          }
-        }
-      }
-    },
-    "objectives": {
-      "type": "object",
-      "additionalProperties": false,
-      "properties": {
-        "availability": { "type": "string", "minLength": 1 },
-        "latency": { "type": "string", "minLength": 1 },
-        "rpoMinutes": { "type": "number", "minimum": 0 },
-        "rtoMinutes": { "type": "number", "minimum": 0 }
-      },
-      "minProperties": 1
-    },
-    "exceptions": { "type": "array", "uniqueItems": true, "items": { "$ref": "#/$defs/exception" } }
-  }
-}

package/skill/vegastack-arch-guardian/references/architecture/foundation.md

@@ -1,33 +0,0 @@
-# Foundation
-
-## Operating model
-
-VegaStack projects may be SaaS, internal/public products, platform services or shared packages; single- or multi-tenant; web-only, Flutter-enabled, agentic or non-agentic. Activate only declared or observed capabilities. Resolve decisions in this order: security/correctness; recovery; ownership; contracts; operability; delivery; optional optimization.
-
-- **FOUND-001 — Confirmed profile.** For architecture conformance checks, a project **MUST** commit a confirmed v3 `.vegastack/architecture.json` containing only applicable, confirmed facts (legacy `.yaml`-named JSON is accepted with a deprecation notice). [invariant; activation: CI/profile work; verification: structural+semantic; waiver: project ADR]
-- **FOUND-002 — Project exceptions.** A project exception **MUST** use exact rule/control/path scope and a contained accepted ADR with project owner, rationale/decision, risks, controls, verification, rollback/migration, review date or event, and foundation-deviation acknowledgement. [invariant; activation: exception declared; verification: semantic+filesystem; waiver: project ADR]
-- **FOUND-003 — Honest outcomes.** The guardian **MUST NOT** represent accepted risk as safe or foundation-compliant: report `PASS`, `FAIL`, `EXCEPTED`, and `NOT VERIFIED` exactly, and keep a rejection recommendation when warranted. [invariant; activation: every decision/review; verification: output review; waiver: project ADR]
-- **FOUND-004 — Capability alignment.** Declared capability status, ownership, versions, placement, roots and contracts **MUST** match project intent and repository evidence; removal **MUST** clean durable data, credentials, queues and contracts. [invariant; activation: capability declared/observed/removed; verification: static+semantic+runtime; waiver: project ADR]
-
-Every project architecture rule is waivable by an active project-owner ADR. A valid ADR changes a matching violation to `EXCEPTED` and may allow CI success, but it never proves safety. Invalid, expired or mismatched exceptions fail. Foundation changes and project accepted risks remain distinct.
-
-Prefer reproduced behavior over prose and official primary sources over secondary material. Apply pinned claims to the pinned baseline; current documentation describes current capability. Source drift requests scoped review and does not automatically expire ADRs.
-
-## Ownership and portability
-
-Product-owned enabled capabilities are the default. Shared-managed and external-managed services are explicit exceptions to ownership, not compliance exceptions; require the complete service contract in the profile. A consumer of shared EVE or another shared service does not contain the provider's source roots.
-
-Use PostgreSQL, REST/OpenAPI, OCI, S3-compatible objects, OpenTelemetry, OAuth/OIDC and provider-neutral sandbox/model interfaces when their capabilities apply. Provider features must not become hidden correctness dependencies.
-
-The foundation excludes billing, pricing and Stripe. Usage, quota, capacity, token, sandbox and storage accounting remain applicable when those resources exist. Add optional infrastructure only after the trigger in its reference is met.
-
-## Enforcement
-
-| Class | Treatment |
-|---|---|
-| invariant / forbidden design | CI failure when detectable; otherwise manual qualification |
-| preferred default | warning with evidence-backed reason to vary |
-| permitted option | supported only inside declared activation and ownership boundaries |
-| valid project ADR | visible `EXCEPTED`; CI may pass; recommendation remains unmet |
-
-Choose the smallest design meeting current requirements and measured objectives. Challenge a foundation default when project evidence shows it does not fit; use an ADR to record the project decision.

package/skill/vegastack-arch-guardian/references/architecture/security-privacy.md

@@ -1,23 +0,0 @@
-# Security and privacy
-
-Apply threat scenarios to enabled/exposed services and capabilities. Absence of a capability is not a missing control; observed sensitive data, secrets or execution activates the relevant boundary.
-
-- **SEC-001 — Threat model.** Every enabled/exposed service and capability **MUST** model its applicable tenant crossing, confused deputy, prompt/tool injection, SSRF, credential theft, replay, support abuse, sandbox escape/exfiltration, supply-chain, resource exhaustion, and deletion-failure scenarios.
-- **SEC-002 — Secret custody.** When production secrets exist, workspace BYOK and connector tokens **MUST** persist only as encrypted ciphertext/reference; project-owned production secret/KMS functions, service identities, rotation, revocation, and audit **MUST** use OpenBao. Plaintext secrets in code, profiles, logs, telemetry, agents, or sandboxes are forbidden. [OPENBAO-DOCS]
-- **SEC-003 — Enforced authorization.** Prompts and model instructions **MUST NOT** be treated as security controls. Typed authorization, capabilities, EVE approval gates, database RLS, egress policy, quotas, and immutable audit enforce decisions.
-- **SEC-004 — Supply chain.** Builds **MUST** use reviewed locks, registry integrity, canonical tags/commits, isolated builders, vulnerability/license review, pinned image digests, SBOM, provenance, and signatures for release artifacts.
-- **SEC-005 — Abuse controls.** Systems **MUST** apply tenant/identity/IP/risk-class quotas, payload and output limits, anomaly detection, suspension/kill switches, appeal/restore paths, and immutable administrative audit.
-
-| Control objective | Required mechanism |
-|---|---|
-| tenant isolation | `TEN-001` through `TEN-004`, typed grants, negative tests |
-| least privilege | `AUTH-002`, `CONN-001`, short-lived service identities |
-| untrusted execution | `SBX-001` through `SBX-005` |
-| confidentiality | `SEC-002`, `MODEL-002`, `OBS-002`, encryption and redaction |
-| durable accountability | EVE checkpoints, AgentRun projection, `OBS-003` |
-| privacy lifecycle | `DATA-004`, export/deletion reconciliation, legal-hold scope |
-| recovery | qualified backups, PITR, restore and incident drills |
-
-Map evidence to applicable SOC 2 security/availability/confidentiality/privacy criteria and GDPR principles, lawful basis, data-subject rights, processor/subprocessor duties, breach response, transfers, and retention. This mapping supports control design; it is not a certification or legal conclusion.
-
-Threat and deployment reviews identify detection, containment, evidence preservation, recovery, communication, owner, and verification for every material scenario.