@vegastack/skills 0.5.0 → 0.6.0

package/skill/architect/refresh/REFRESH.md

@@ -0,0 +1,29 @@
+# Freshness contract — architect
+
+Most of this skill is durable taste and recorded decisions; it does not go stale on its
+own. Exactly one file decays with the platform landscape: `references/pinned-facts.md`
+(plus the version claims embedded in `references/stack.md` and `references/mobile.md`).
+
+## Mechanism
+
+1. **Weekly scheduled agent (primary).** A scheduled Claude Code/Codex job re-verifies
+   each pinned fact against its stated source URL and opens ONE pull request quoting
+   evidence for anything that changed (fact text, version, date, source). The diffing
+   judgment lives in the agent run, not in maintained scripts. The PR is human-reviewed —
+   never auto-merged.
+2. **Refresh-on-use (safety net, written into SKILL.md).** When a recommendation leans on
+   a pinned fact older than 60 days, the consuming agent re-verifies that one fact first
+   and says so. Never bulk-refresh in-session.
+3. **Registry baseline (`sources.json`).** The repo-shared refresh runner
+   (`tooling/refresh/refresh-evidence.mjs`) keeps checksum baselines for the critical
+   source pages so CI can detect upstream drift deterministically between weekly runs.
+
+## Rules
+
+- Critical sources (Hyperdrive supported versions, Better Auth docs, eve/Workflow SDK
+  deploy constraints) get `critical: true` — drift there warrants a prompt PR, not a
+  batch.
+- Every edited fact keeps the pattern: fact → why it changes a decision → source URL →
+  verified date. The file carries one blanket verified-date for facts checked together;
+  a fact re-verified alone gets its own inline date, superseding the blanket one.
+- A fact that stops being decision-changing is deleted, not kept for completeness.

package/skill/architect/refresh/sources.json

@@ -0,0 +1,244 @@
+{
+  "schemaVersion": 1,
+  "policy": {
+    "criticalTopics": [
+      "hyperdrive-postgres",
+      "better-auth",
+      "eve-deploy"
+    ],
+    "defaultChecksumScope": "html-text-v1",
+    "offline": "Use cached metadata only; fail closed when a critical entry is missing or older than thresholdDays.",
+    "drift": "Any drift requires reading the changed page and a human-reviewed PR updating references/pinned-facts.md (and version claims in references/stack.md / references/mobile.md); never auto-apply.",
+    "copyright": "Store claim metadata, URLs, hashes, and concise excerpts only; never archive third-party documentation corpora.",
+    "cadence": "weekly scheduled-agent refresh; thresholdDays must be >= 14 (2x cadence) so a single missed run never breaches a threshold"
+  },
+  "sources": [
+    {
+      "id": "CF-HYPERDRIVE-VERSIONS",
+      "service": "Cloudflare Hyperdrive supported databases",
+      "kind": "official-docs",
+      "stability": "vendor-docs",
+      "thresholdDays": 14,
+      "critical": true,
+      "urls": {
+        "primary": "https://developers.cloudflare.com/hyperdrive/reference/supported-databases-and-features/"
+      },
+      "versionDetection": {
+        "type": "manual-review"
+      },
+      "topics": [
+        "hyperdrive-postgres"
+      ],
+      "affected": [
+        "references/pinned-facts.md",
+        "references/stack.md",
+        "references/data.md"
+      ],
+      "checksum": "fda2870b95deffce48dca7f3df3707325b1bc4a2d58a17708ee9220bfba5eba1",
+      "retrievedAt": "2026-08-12T14:33:11.062Z"
+    },
+    {
+      "id": "CF-R2-PRICING",
+      "service": "Cloudflare R2 pricing",
+      "kind": "official-docs",
+      "stability": "vendor-docs",
+      "thresholdDays": 30,
+      "critical": false,
+      "urls": {
+        "primary": "https://developers.cloudflare.com/r2/pricing/"
+      },
+      "versionDetection": {
+        "type": "manual-review"
+      },
+      "topics": [
+        "r2-economics"
+      ],
+      "affected": [
+        "references/pinned-facts.md",
+        "references/stack.md"
+      ],
+      "checksum": "bd5e8d26f7bbf2f92182ad4ac1a59ae9b1d90695120062adaf54c281bd88e81f",
+      "retrievedAt": "2026-08-12T14:33:11.062Z"
+    },
+    {
+      "id": "CF-WORKFLOWS-PRICING",
+      "service": "Cloudflare Workflows limits and pricing",
+      "kind": "official-docs",
+      "stability": "vendor-docs",
+      "thresholdDays": 30,
+      "critical": false,
+      "urls": {
+        "primary": "https://developers.cloudflare.com/workflows/reference/limits/"
+      },
+      "versionDetection": {
+        "type": "manual-review"
+      },
+      "topics": [
+        "workflows"
+      ],
+      "affected": [
+        "references/pinned-facts.md",
+        "references/ai-agents.md"
+      ],
+      "checksum": "64e10ca4ced4edc042d12a9a24f2e165ea71cb9481c30ac5f067f2f6c9218cda",
+      "retrievedAt": "2026-08-12T14:33:11.062Z"
+    },
+    {
+      "id": "BETTER-AUTH-DOCS",
+      "service": "Better Auth documentation",
+      "kind": "official-docs",
+      "stability": "vendor-docs",
+      "thresholdDays": 14,
+      "critical": true,
+      "urls": {
+        "primary": "https://better-auth.com/docs/plugins/organization"
+      },
+      "versionDetection": {
+        "type": "npm",
+        "package": "better-auth"
+      },
+      "topics": [
+        "better-auth"
+      ],
+      "affected": [
+        "references/pinned-facts.md",
+        "references/security.md",
+        "references/stack.md"
+      ],
+      "currentVersion": "1.6.27",
+      "versionCheckedAt": "2026-08-12T14:33:11.062Z",
+      "checksum": "30edf1b6658a473a00005153a3eafc07de5c3decd6b8f09fc6c32f3a21c4db1c",
+      "retrievedAt": "2026-08-12T14:33:11.062Z"
+    },
+    {
+      "id": "EVE-DOCS",
+      "service": "Vercel eve agent framework",
+      "kind": "official-docs",
+      "stability": "beta",
+      "thresholdDays": 14,
+      "critical": true,
+      "urls": {
+        "primary": "https://vercel.com/docs/eve"
+      },
+      "versionDetection": {
+        "type": "npm",
+        "package": "eve"
+      },
+      "topics": [
+        "eve-deploy"
+      ],
+      "affected": [
+        "references/pinned-facts.md",
+        "references/ai-agents.md",
+        "references/stack.md"
+      ],
+      "currentVersion": "0.33.2",
+      "versionCheckedAt": "2026-08-12T14:33:11.062Z",
+      "checksum": "a777f9da0cb3966a9c7cc06a3c12be34b2928800b370e966e8b6e0f5a5622915",
+      "retrievedAt": "2026-08-12T14:33:11.062Z"
+    },
+    {
+      "id": "WORKFLOW-SDK-POSTGRES",
+      "service": "Workflow SDK Postgres world deployment constraints",
+      "kind": "official-docs",
+      "stability": "vendor-docs",
+      "thresholdDays": 14,
+      "critical": true,
+      "urls": {
+        "primary": "https://workflow-sdk.dev/worlds/postgres"
+      },
+      "versionDetection": {
+        "type": "npm",
+        "package": "@workflow/world-postgres"
+      },
+      "topics": [
+        "eve-deploy"
+      ],
+      "affected": [
+        "references/pinned-facts.md",
+        "references/ai-agents.md"
+      ],
+      "currentVersion": "4.3.3",
+      "versionCheckedAt": "2026-08-12T14:33:11.062Z",
+      "checksum": "3eca56b5ec9668638d4e00b290c157383dfe8ceaaa334de13bb6244b32fa6839",
+      "retrievedAt": "2026-08-12T14:33:11.062Z"
+    },
+    {
+      "id": "NEXTJS-BLOG",
+      "service": "Next.js release blog",
+      "kind": "official-docs",
+      "stability": "vendor-docs",
+      "thresholdDays": 30,
+      "critical": false,
+      "urls": {
+        "primary": "https://nextjs.org/blog"
+      },
+      "versionDetection": {
+        "type": "npm",
+        "package": "next"
+      },
+      "topics": [
+        "nextjs"
+      ],
+      "affected": [
+        "references/pinned-facts.md",
+        "references/web.md",
+        "references/stack.md"
+      ],
+      "currentVersion": "16.3.0",
+      "versionCheckedAt": "2026-08-12T14:33:11.062Z",
+      "checksum": "9d5d2503e2e8aa7ed1c3f0cb972c78e64b2e3aae5f3ad264bb0a79bd179708f0",
+      "retrievedAt": "2026-08-12T14:33:11.062Z"
+    },
+    {
+      "id": "PG-BOSS-NPM",
+      "service": "pg-boss job queue",
+      "kind": "package-registry",
+      "stability": "stable",
+      "thresholdDays": 30,
+      "critical": false,
+      "urls": {
+        "primary": "https://registry.npmjs.org/pg-boss/latest"
+      },
+      "versionDetection": {
+        "type": "npm",
+        "package": "pg-boss"
+      },
+      "topics": [
+        "jobs"
+      ],
+      "affected": [
+        "references/pinned-facts.md",
+        "references/ai-agents.md"
+      ],
+      "currentVersion": "12.27.0",
+      "versionCheckedAt": "2026-08-12T14:33:11.062Z",
+      "checksumScope": "http-body",
+      "checksum": "abf4bc2795e2df03181a21dfd29c7b9234c933a9dcafa72b4583d590cad609da",
+      "retrievedAt": "2026-08-12T14:33:41.513Z"
+    },
+    {
+      "id": "FLUTTER-RELEASES",
+      "service": "Flutter release notes",
+      "kind": "official-docs",
+      "stability": "vendor-docs",
+      "thresholdDays": 30,
+      "critical": false,
+      "urls": {
+        "primary": "https://docs.flutter.dev/release/release-notes"
+      },
+      "versionDetection": {
+        "type": "manual-review"
+      },
+      "topics": [
+        "flutter"
+      ],
+      "affected": [
+        "references/pinned-facts.md",
+        "references/mobile.md"
+      ],
+      "checksum": "94f9df6f67615ee05d826995f9709309c5453d0d8e4be11232ca5d463929ed2b",
+      "retrievedAt": "2026-08-12T14:33:11.062Z"
+    }
+  ]
+}

package/skill/skill-maintainer/references/release-ops.md

@@ -4,26 +4,22 @@ Condensed operational playbook. The authoritative policies live at the repo root
 
 ## Semver for skill content
 
-Consumers depend on rule IDs and rule strength, not an API surface.
+Content is advisory prose and decision tables — no rule IDs, no machine-extracted rule format.
 
 | Bump | Content change |
 |---|---|
-| MAJOR | Removing or renaming a rule ID (IDs are stable and permanent — never renumber or reuse). Changing a `MUST`/`MUST NOT` so it permits something previously forbidden. Removing or renaming a skill. |
-| MINOR | New rules or rule IDs. New references or reference sections. New skill. Loosening ceremony without weakening a `MUST`. Tightening a `SHOULD` to a `MUST`. |
-| PATCH | Factual refreshes: version pins, vendor mechanism names, URLs, registry checksums. Typos and non-normative wording. Test/fixture-only changes. |
+| MAJOR | Removing or renaming a skill. A breaking change to a per-project profile format (e.g. `.vegastack/arch.md`) that invalidates existing committed profiles. |
+| MINOR | New reference file or reference section. New or changed recorded decision (e.g. a new "use/not/why" row, a new red line). New skill. |
+| PATCH | Factual refreshes: pinned-fact updates, version pins, vendor mechanism names, URLs, registry checksums. Wording clarifications that don't change the recorded decision. Test/fixture-only changes. |
 
 Installer/CLI changes follow ordinary semver on the same package version; a release takes the highest bump either side requires.
 
-## Two version identities — never conflate
+## One version identity
 
-| Identity | Lives in | Governs |
-|---|---|---|
-| Package version | `packages/cli/package.json` (changesets) | npm releases of installer + content snapshot |
-| Foundation version | profile schema const, `profile-tool.mjs` default, `foundation-compatibility.json` | the profile/schema contract deployed `.vegastack/architecture` profiles validate against |
-
-- Bumping the **package** (even MAJOR) must never invalidate a deployed profile — profiles bind to the foundation version.
-- Bumping the **foundation** version is a content-contract event: it requires a compatibility entry describing how existing baselines are treated, and at minimum a MINOR package release.
-- Each identity has one source of truth; never introduce additional copies of either number.
+There is a single source of truth: the **package version** (`packages/cli/package.json`,
+changesets-managed) — the npm release identity for the installer and every bundled skill's
+content snapshot. No skill tracks a separate content-contract version, and no per-project
+profile carries a schema version to validate against.
 
 ## Release flow (tag-driven)
 
@@ -44,7 +40,7 @@ Contributors do not bump versions in PRs; releases are maintainer-driven.
 
 ## Rename a skill
 
-Derived from the stable-ID logic in content-versioning (skill names are consumer-facing identifiers like rule IDs):
+Skill names are consumer-facing identifiers — treat a rename as a stable-ID break:
 
 1. Rename the directory and the frontmatter `name` in the same commit — they must always stay equal.
 2. Update every wiring point in the same PR: the packaging allowlist in `packages/cli/scripts/sync-skill.mjs`, the root README skills table row, and any cross-skill or docs links.
@@ -60,4 +56,4 @@ Derived from the stable-ID logic in content-versioning (skill names are consumer
 
 ## Refresh branches
 
-Branches named `refresh/**` are reserved for the automated freshness loop and are CI-restricted to `skills/*/refresh/` and `skills/*/references/foundation-compatibility.json`. Human content changes go on normal branches. Never hand-edit checksums/versions/timestamps anywhere — CI re-fetches claimed baselines, so hand-edited values cannot merge.
+Branches named `refresh/**` are reserved for the automated freshness loop and are CI-restricted to `skills/*/refresh/`. Human content changes go on normal branches. Never hand-edit checksums/versions/timestamps anywhere — CI re-fetches claimed baselines, so hand-edited values cannot merge.

package/skill/skill-maintainer/refresh/REFRESH.md

@@ -10,13 +10,13 @@ Instructions for the scheduled refresh agent (and any human running a manual ref
 
 ## How to refresh
 
-The deterministic runner is repo-shared and hosted in arch-guardian for now. Run from the repo root:
+The deterministic runner is repo-shared, hosted at `tooling/refresh/`. Run from the repo root:
 
 1. **Deterministic pass first** (no LLM judgment):
-   `node skills/arch-guardian/scripts/refresh-evidence.mjs --registry skills/skill-maintainer/refresh/sources.json`
+   `node tooling/refresh/refresh-evidence.mjs --registry skills/skill-maintainer/refresh/sources.json`
    drift/stale/unavailable results are the work-list. Exit 1 with a critical entry means fail-closed: the run must not be silently skipped. All four sources here are critical.
 2. **Accept verified changes** in the same code path:
-   `node skills/arch-guardian/scripts/refresh-evidence.mjs --registry skills/skill-maintainer/refresh/sources.json --accept-baselines`
+   `node tooling/refresh/refresh-evidence.mjs --registry skills/skill-maintainer/refresh/sources.json --accept-baselines`
    This writes registry, cache, and drift report together — never hand-edit checksums, versions, or timestamps; they must always come from a run. Baselines are runner-seeded; when a new source is added or a verified change is accepted, this accept-baselines invocation is the only sanctioned way to update them.
 3. **Semantic verification** for every source the deterministic pass flagged: read the changed page (fetch the registry URL), decide whether any `<!-- source: X -->` marked sentence in `references/standards.md` (or the mirrored SKILL.md hard-limits row) is now wrong, and propose the minimal edit. Unlike version-pin registries, checksum drift here is presumed meaningful until a human reads the diff — these pages define the standards themselves. Editorial churn may be accepted silently only after that read.
 4. **One standing refresh PR**, branch `refresh/weekly`, force-updated on every run (never stacked duplicates; the weekly workflow .github/workflows/refresh.yml maintains it). PR body lists: each changed source, old→new checksum, links to the evidence, and which marked sentences changed and why. A maintainer review is mandatory before merge.

package/skill-integrity.json

@@ -1,58 +1,34 @@
 {
   "schemaVersion": 2,
   "skills": {
-    "arch-guardian": {
+    "architect": {
       "files": {
-        "SKILL.md": "46eb5d40506c3e7b2f9d15a3cbfa189acb690ba55e7af924d463e003ae8eeb70",
-        "agents/openai.yaml": "9553ddb318a4b7f0d610343f28fc8af636fc4b24832a00e818c3b824449b0a59",
-        "assets/adr-template.md": "db813ef4621a76e1101b3a19fc944de60a38591b423d9a9ad6c8f0b1db38120c",
-        "assets/answers-example.json": "eed87446717032c60015232674272689bd68a7c8f5f43ff166aeaa0f649b7a9f",
-        "assets/architecture-profile.json": "70d78d81f2c65f7aa37d9ea7b7a5f0518961037262ae2db6da8e6c1f24757ee8",
-        "assets/architecture-profile.schema.json": "bcf370b882ef6e605abf530c8245d599471e8aa54f0ef42fc99b5119550b8905",
-        "assets/deployment-review-template.md": "e9be2feb153138d936f9ebd5763c3be10597cee639616f86cc082c498fd60cd2",
-        "assets/service-design-template.md": "670798e3bf26a76d593294ff60763e1a6a35866fa84ea74345406b05b4b0b61b",
-        "assets/threat-model-template.md": "ffcf22e3fc81c803d976ac6c41cbac4fb0f552d81653b89a5b587a46b59d9aed",
-        "references/advisory-report.md": "bfc0dc8e985e33312ed0617705b359457eaea7b6056307e94ea293d167992dd4",
-        "references/architecture/agent-product.md": "3b8039ef9ca6aa30fc8781475e005d7bbb9d8d415705a6e8c79b4a602ee1ed5e",
-        "references/architecture/ai-cost.md": "9cb300e5718c15d5e6c29d22293b4ca80340e73d2b77267fbc529016c6262dd2",
-        "references/architecture/ai-data-boundaries.md": "0d756d0132d05e0e45dcd1b582e6c4bfe04a9043ab8df64d9a88fb086d8b29ff",
-        "references/architecture/ai-evals.md": "9b9698acd8b73c17ea301569b6c57bbdede304cfec7fa6f7d6d4af017a64fa6c",
-        "references/architecture/connectors-sandbox.md": "c12248cb0eddf51143e6f14c71541042d676b405bf274271bb69148c621ab41f",
-        "references/architecture/data-memory.md": "3d2ccbcd90a00dddda7096877c874d4fa7b61b96e2e4061c3c82b40bd990cf19",
-        "references/architecture/delivery-operations.md": "82fafe5f0f157f7a870ff6c9aad64564ab121ac049446318fcf9c1b7f4517f36",
-        "references/architecture/durable-execution.md": "4dd1c7d69e41fb0abf7f469c8eadd1695b15c502e0219108c76d8aea06f9ffe6",
-        "references/architecture/flutter.md": "f024292b89b4667c65993bba906fb16afd278824f205f0e39c96a58384c6f423",
-        "references/architecture/foundation.md": "19536e03fdbb8720e263600a298b11e980cf6c24a724f8692db83b04302b39f1",
-        "references/architecture/hosting-reliability.md": "c69b00a354d78e2a7b2845cddc0d8a642911bc009efefa141075d1d774756142",
-        "references/architecture/identity-tenancy.md": "5fb2e5d74ae24ad2efe3ba01c06b8fcc16ba1dce1b9c531b7d955352af38d4c2",
-        "references/architecture/model-lifecycle.md": "eacdeade0fa88caaca11de9a9e69f0db8a9ecfc8b472070afb7158f5e30f6ba2",
-        "references/architecture/models-observability.md": "5501655b71d85e9653e5a8c276e481e2765b2a0c67c5bc23759f869529278b94",
-        "references/architecture/realtime-channels.md": "a95738c431f3f4c8c42c153a0b940897bae8d679ed0c2dfced3cb1c4c9c67ca5",
-        "references/architecture/security-privacy.md": "28d8d1a6347df95807d274829b2fbbd852c07a74d52d7e0be18d208b559504ea",
-        "references/architecture/topology-monorepo.md": "fdad26c8eaa32b977139e6f70c90a3954332a1fa6dd6e8d98bc9fb7c5a613117",
-        "references/architecture/web.md": "560957d179f9372ff01e3e216fdc8ad1cbee290ac95f42094d04da4af08a4c0a",
-        "references/foundation-compatibility.json": "dfbf106631ebd229d683b18855e126cdc4684a252038123b25d002724571ac14",
-        "references/golden-patterns.md": "0b00ece15e0ae20450d5c20409e7be34bab0d9b47c1614fb48cef780ca66605b",
-        "references/profile-governance.md": "b3ed0b4580c73fa0340c33267707ee9515071ac2b64bdc3dd56b8c558431a0b3",
-        "references/rule-model.json": "b9d4d13d152eecbb73a5add12c8ab9bb050e0f1001495c90c8b801d029b56598",
-        "references/workflows.md": "f54c284d831e14da00886fd186bc711bb8598fca4f2fc309f6caa197835e79ae",
-        "refresh/REFRESH.md": "db15a4304d0a3d3ab7f53722d30fb76609f1823cb2dc998f1807f092e79e008a",
-        "refresh/sources.json": "d35735620325c45693c8eddb5de5e7e1867cae19554e118b45867f8984250950",
-        "scripts/lib.mjs": "4ef4910518134eea7f89b6e397e5871f66a416429c75f59bf37e0864e4cf7ca0",
-        "scripts/profile-tool.mjs": "c13230b1c6a7bce9b91fb8a6a7d6eb84e9ef8855bf8b2a544e7bbfdc38e94877",
-        "scripts/refresh-evidence.mjs": "4759cedd15470247df23485b4c8d258e7e8f22cbceaac60f7e63cb42159af779",
-        "scripts/schema-validate.mjs": "329cca29ead284949107a5e0984588373522e9ef6624dffd18d4d207ef51fc99",
-        "scripts/validate-profile.mjs": "0b1f6b6d9e21267fd1ac545fd47fe46d9ecddc6a2efe67c5518e0845719a2b4d",
-        "scripts/verify-corpus.mjs": "d752efb00145afeaa7d2e758e10c5c11670253c1387326a52d6dda7fc67cda1c"
+        "SKILL.md": "70327518548075edd58f140710273df6dba6bd49327252a085b6881aae2f6663",
+        "agents/openai.yaml": "5bee46acf49a8c01856eec2a51a57aad95257c064302fca7f5e952016054b4e0",
+        "assets/adr-template.md": "72c84eebf90a7de8a6fc79c5165bada2683b38e86ccb1e3936e305f71be67d91",
+        "assets/arch-template.md": "a3dbfbd8b8f115e5cf3a922f26571ca469e0f4962d924e88bd9d8fd280b75d89",
+        "references/advisory.md": "ecba7d92cbf4dee9a6c9b7e0cb86f863748435be9fde4c0c8f493bcbc8e48249",
+        "references/ai-agents.md": "f39af3e8e6ea111157225c2786b428d66c944546898b08e45f12069633cf007e",
+        "references/data.md": "6c0384b53b66c914e39b4ca5f146cb50f1b91ca3ca5106e43b5cc2ce17bc59d5",
+        "references/infra.md": "cd56381da2d59fb2362fc162246269116cba92f796d0847cbac03e478b600add",
+        "references/mobile.md": "19932670613c064c979cf6d675c94213d3b12a5382d6fff4eacd58cb8b2a609c",
+        "references/pinned-facts.md": "07212409f708bd00ed69c77e98c61303ed1718514d907eb135c4c8ffe081196e",
+        "references/principles.md": "1d33c9f2912c04341c50398e30482c348d98a22ea218b06eca47b7aa247685b1",
+        "references/project-profile.md": "f3455643044260405ac47cdbeef5238e87a8ff9fbb285ce256a2aca9be9ff522",
+        "references/security.md": "4be060806c63c8c56559c293a818af581c2d7aec29f1830b57570dfda3c69d4a",
+        "references/stack.md": "b3aea9bb500b14c5bdb7576252e0af3be012d8c1f849d812c446e82ca2192af4",
+        "references/web.md": "df296df0a3c4fbbeda47f49ac96b4f0e9f4c5bba5dd68a428a3e390abd7f2261",
+        "refresh/REFRESH.md": "cdf7a06dd70f4b9483aa7a1db8c5e6c8e0a1f1724be22031d1aba1f609d69e22",
+        "refresh/sources.json": "38cf2a3fb13b5b4f3eec59d40d4faa4e5edcc0aecb66fbdd031aeefb92fecc01"
       }
     },
     "skill-maintainer": {
       "files": {
         "SKILL.md": "bbbf15a9900d9d2009ccfbe163cface9654c81a9a84777718348d97b30739aeb",
         "agents/openai.yaml": "0b89d4e6416cf20b448f5322f3d7433cfde333d2b4a05b42ed53db3759701fb4",
-        "references/release-ops.md": "2bde6c55cbe7674678e14b915fc5ebe565413aeb25c3d51a86e195af53004d01",
+        "references/release-ops.md": "a32c6dd6fff7b5c44d3d6dbcb32d7f3eb14f1ca61db85c0b31de032727952c3d",
         "references/standards.md": "3646d0dd0560a87b333f70febf670b093c89b35111132cdb641b763bf184b02f",
-        "refresh/REFRESH.md": "a9a86a979ef720cf2f316c76f05db0fd9beef591401b95ceb475474fe40bc936",
+        "refresh/REFRESH.md": "badbf807de2b2b38a7acb77d4e5a82ec7677afa1cb97abef34c429a81b855508",
         "refresh/sources.json": "cf38cdf8123a50ea7ef2d1466a87faa648c12e5bc90d9ee9b6ae45632e7d0800"
       }
     },

package/skill/arch-guardian/SKILL.md

@@ -1,84 +0,0 @@
----
-name: arch-guardian
-description: Architecture advisor for VegaStack projects. Use when designing a new service or feature, reviewing architecture or a risky change (auth, tenancy, agents, jobs, connectors, data lifecycle, hosting), deciding between architectural options, writing an ADR or a .vegastack/architecture.json profile, threat modeling, planning a migration, or checking dependency and source drift. Advises contextually by declared tier (prototype, production, enterprise) and enabled capabilities; recommends the smallest architecture that meets the requirement and produces evidence-backed advisory reports, never CI gates. Covers web-only, Flutter, agentic and non-agentic, single- and multi-tenant, internal, client, and package projects.
----
-
-# VegaStack Architecture Guardian
-
-Act as the project's senior architecture advisor. Apply only enabled capabilities at the declared tier. Recommend; never gate. Never invent compliance or project facts. There is no exception machinery: a team that departs from a recommendation records the decision, and you keep reporting it honestly as accepted risk.
-
-## Start every task
-
-1. Identify the actual decision, its scope, and how expensive it is to reverse.
-2. Read the profile (`.vegastack/architecture.json`) and repository evidence before asking questions. Keep read-only work read-only; never create a profile or artifact merely because it is absent.
-3. Note the **tier** (`prototype` | `production` | `enterprise`) — it decides which concerns apply. If no profile exists, ask for the tier (or state the assumed one) before recommending.
-4. Separate facts, constraints, assumptions, preferences, and recorded team decisions. Distinguish current, target, and migration state.
-5. Ask at most three material questions at a time. If unanswered, proceed with bounded assumptions and the smallest architecture that meets stated requirements — every proposed moving service names the trigger that justifies it.
-6. Read only the directly relevant references below. Use the committed profile, designs, and ADRs as architecture memory; never rely on hidden chat state.
-7. Prioritize security/correctness, recovery, ownership, contracts, operability, delivery, then optional optimization. Make one primary recommendation and identify the rejected alternative.
-
-Script invocations below write `<skill-dir>` as a placeholder: replace it with the absolute path of the directory containing this SKILL.md before running (no environment variable is set for you).
-
-## Answer at the right size
-
-- **Questions and explanations:** answer directly — the recommendation and at most one material risk. No section headers, no report.
-- **Design reviews, ADRs, migration plans:** use the [advisory report contract](references/advisory-report.md): per-area grades (`sound`/`attention`/`at-risk`), severity-ranked findings (`critical`/`production-gate`/`enterprise-gate`/`consider`), each with cited evidence and its principle ID, plus questions and not-verified items. No finding without evidence; detection is never a claim of absence.
-
-## Route progressively
-
-| Need | Read |
-|---|---|
-| operating model, tiers, minimum viable architecture, profiles | [foundation](references/architecture/foundation.md), [profile and governance](references/profile-governance.md) |
-| greenfield, brownfield, review, migration workflows | [adaptive workflows](references/workflows.md) |
-| review output format and evidence recipes | [advisory report](references/advisory-report.md) |
-| topology, deployables, packages, contracts | [topology and monorepo](references/architecture/topology-monorepo.md) |
-| web/Next/OpenAPI/cache | [web](references/architecture/web.md) |
-| Flutter/mobile | [Flutter](references/architecture/flutter.md) |
-| identity, organizations, tenancy, RLS | [identity and tenancy](references/architecture/identity-tenancy.md) |
-| agent product and durable execution/jobs | [agent product](references/architecture/agent-product.md), [durable execution](references/architecture/durable-execution.md) |
-| connectors, MCP, webhooks, sandbox, egress | [connectors and sandbox](references/architecture/connectors-sandbox.md) |
-| data, knowledge, memory, objects | [data and memory](references/architecture/data-memory.md) |
-| PII, prompt injection, output moderation | [AI data boundaries](references/architecture/ai-data-boundaries.md) |
-| evals, prompt/model regression gates | [AI evals](references/architecture/ai-evals.md) |
-| model pinning, deprecations, canary, backpressure | [model lifecycle](references/architecture/model-lifecycle.md) |
-| model spend, budgets, cost attribution | [AI cost](references/architecture/ai-cost.md) |
-| realtime, notifications, channels | [realtime and channels](references/architecture/realtime-channels.md) |
-| models, BYOK, telemetry, audit | [models and observability](references/architecture/models-observability.md) |
-| security, privacy, secrets, threat model | [security and privacy](references/architecture/security-privacy.md) |
-| hosting, Cloudflare/OpenNext, SLO/recovery | [hosting and reliability](references/architecture/hosting-reliability.md) |
-| delivery, migration, verification | [delivery and operations](references/architecture/delivery-operations.md) |
-| fragile boundary implementation | [golden patterns](references/golden-patterns.md) |
-
-For current detail beyond a pinned claim, [refresh/sources.json](refresh/sources.json) is also the research index: fetch the affected source's `llms` or `docsIndex` URL (or use an available docs MCP). For design reviews and recommendations that lean on a **critical** source (`critical: true`), check freshness — `node <skill-dir>/scripts/refresh-evidence.mjs --topics <affected-topics>` when online, or report the claim as not verified when offline past its `thresholdDays`. Plain questions answer from the shipped snapshot with a one-line staleness caveat. Consult [foundation compatibility](references/foundation-compatibility.json) for version baselines.
-
-## Execute the task-specific workflow
-
-- **Greenfield:** Follow the adaptive intake in [workflows](references/workflows.md): interview (tier first), recommend one capability set and topology sized by minimum viable architecture, name immediate/deferred decisions and triggers, and offer a slim profile draft after confirmation.
-- **Brownfield/review:** Inspect instructions, manifests/locks, deployables, schemas/migrations, auth, APIs, jobs, infra, ADRs, and runbooks before interviewing. Produce an advisory report; prefer controlled migration over rewrites.
-- **ADR/design/threat/deploy:** Use the relevant asset only after write authorization; an ADR is a decision record, never a waiver.
-- **Continuous work:** Load only affected references. Do not force absent capabilities or higher-tier concerns into scope.
-- **Source drift:** Follow [refresh/REFRESH.md](refresh/REFRESH.md). Refresh only affected topics.
-
-## Profiles and mutation safety
-
-The committed profile lives at `.vegastack/architecture.json` (schema v4, ~12 lines; legacy names are discovered with a deprecation notice). Inspect or draft without mutation:
-
-```sh
-node <skill-dir>/scripts/profile-tool.mjs inspect .
-node <skill-dir>/scripts/profile-tool.mjs scaffold answers.json --dir .
-node <skill-dir>/scripts/profile-tool.mjs migrate .vegastack/architecture.json --dir .   # v3 -> v4 draft
-```
-
-`inspect` prints a compact summary; `--json` for the full draft. The answers format is documented by example in `<skill-dir>/assets/answers-example.json`. Write only after explicit authorization; writes are atomic, refuse symlinks, stay inside `--dir`, and require `--force` to replace differing content (`--write` to apply). Validate with:
-
-```sh
-node <skill-dir>/scripts/validate-profile.mjs .vegastack/architecture.json
-```
-
-## Guardrails
-
-- Tiers gate concerns, never tools. Never require a tool when only the invariant matters: the mechanism (platform secret store vs OpenBao, cron vs pg-boss, in-process loop vs EVE at prototype) is chosen by named triggers and recorded per project.
-- Never require SQL/RLS, Better Auth, Flutter, EVE, pg-boss, sandbox, connectors, enterprise identity, realtime, notifications, or knowledge when their activation condition is absent — and never surface enterprise-tier concerns as defects to a prototype/production project; report them as that tier's gate.
-- Challenge proposals and defaults when evidence warrants. Choose the smallest architecture meeting current requirements and measured objectives.
-- Never mutate a repository for an explanation or read-only review. Draft first and ask before writing.
-- Never create paid/cloud resources or claim live recovery, isolation, failover, credential-backed, or provider tests ran unless they actually ran.

package/skill/arch-guardian/agents/openai.yaml

@@ -1,4 +0,0 @@
-interface:
-  display_name: "VegaStack Architecture Guardian"
-  short_description: "Tier-aware architecture advisor for VegaStack projects"
-  default_prompt: "Use $arch-guardian to make one scoped architecture recommendation for this project at its declared tier, without assuming absent capabilities or requiring tools whose triggers are unmet."

package/skill/arch-guardian/assets/adr-template.md

@@ -1,25 +0,0 @@
-# ADR-NNN: Decision title
-
-An ADR is an optional decision record for consequential architecture choices — including deliberate departures from a guardian recommendation. Nothing gates on it; it exists so future readers know the decision was deliberate, who owns it, and when to revisit it.
-
-- Status: proposed | accepted | superseded | rejected
-- Date: YYYY-MM-DD
-- Owner: accountable person
-- Related-Principles: canonical rule IDs this decision touches, or `none`
-- Revisit: YYYY-MM-DD or a concrete event, or `none`
-
-## Context and facts
-
-Separate observed facts, constraints, assumptions, preferences and prior accepted decisions. Identify current, target and migration states.
-
-## Decision and rationale
-
-State the primary decision, ownership, boundaries and why it fits. State the rejected alternative and the reason — including, for any new moving service, the trigger that justifies it.
-
-## Risks
-
-Describe each accepted risk, who accepts it, and what is affected. If this departs from a guardian recommendation, say so plainly; the guardian will keep reporting it as accepted risk in reviews.
-
-## Verification and rollback
-
-What evidence supports the decision (label unverified claims honestly), how it would be rolled back or migrated away from, and any irreversible steps.

package/skill/arch-guardian/assets/answers-example.json

@@ -1,10 +0,0 @@
-{
-  "project": { "name": "example-product", "kind": "saas", "tier": "production", "tenancy": "multi-tenant-shared-schema" },
-  "hosting": "cloudflare-opennext",
-  "capabilities": ["web", "jobs"],
-  "notes": [
-    "Better Auth is the identity library",
-    "PostgreSQL is the system of record; RLS forced on tenant tables",
-    "Secrets live in the platform's managed secret store (trigger review before enterprise tier)"
-  ]
-}

package/skill/arch-guardian/assets/architecture-profile.json

@@ -1,13 +0,0 @@
-{
-  "schemaVersion": 4,
-  "foundationVersion": "0.4.0",
-  "project": {
-    "name": "REQUIRED-CONFIRMED-PROJECT-NAME",
-    "kind": "REQUIRED-CONFIRMED-KIND",
-    "tier": "REQUIRED-CONFIRMED-TIER",
-    "tenancy": "REQUIRED-CONFIRMED-TENANCY"
-  },
-  "hosting": "REQUIRED-CONFIRMED-HOSTING",
-  "capabilities": [],
-  "notes": []
-}

package/skill/arch-guardian/assets/architecture-profile.schema.json

@@ -1,31 +0,0 @@
-{
-  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://raw.githubusercontent.com/vegastack/vegastack-skills/main/skills/arch-guardian/assets/architecture-profile.schema.json",
-  "title": "VegaStack Architecture Profile v4",
-  "description": "Slim advisor memory: confirmed project facts, the declared tier, and the enabled capability list. Versions are read from lockfiles and manifests at advice time, never duplicated here.",
-  "type": "object",
-  "additionalProperties": false,
-  "required": ["schemaVersion", "project", "hosting", "capabilities"],
-  "properties": {
-    "schemaVersion": { "const": 4 },
-    "foundationVersion": { "type": "string", "minLength": 1 },
-    "project": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["name", "kind", "tier", "tenancy"],
-      "properties": {
-        "name": { "type": "string", "minLength": 1 },
-        "kind": { "enum": ["saas", "internal-tool", "client-site", "api", "package"] },
-        "tier": { "enum": ["prototype", "production", "enterprise"] },
-        "tenancy": { "enum": ["none", "single-tenant", "multi-tenant-shared-schema", "multi-tenant-isolated"] }
-      }
-    },
-    "hosting": { "enum": ["self-hosted", "vercel", "cloudflare-opennext", "external", "none"] },
-    "capabilities": {
-      "type": "array",
-      "uniqueItems": true,
-      "items": { "enum": ["web", "flutter", "agents", "jobs", "sandbox", "connectors", "knowledge", "models", "realtime", "notifications", "enterprise-identity"] }
-    },
-    "notes": { "type": "array", "items": { "type": "string", "minLength": 1 } }
-  }
-}

package/skill/arch-guardian/assets/deployment-review-template.md

@@ -1,24 +0,0 @@
-# Deployment review: release/profile
-
-Delete checklist items for absent capabilities; absence is not a failed control.
-
-## Artifact identity
-
-- Commit:
-- OCI/image/package digests:
-- SBOM/provenance/signatures:
-- Database migration:
-- Architecture profile digest:
-
-## Placement
-
-Verify each enabled owned deployable and each shared/external contract against the selected profile. For Cloudflare/OpenNext, verify owned EVE/jobs stay in external long-running Node/OCI placement.
-
-## Safety gates
-
-- [ ] Backward-compatible API/events and expand/contract migration
-- [ ] Applicable runtime/protocol families are exact and atomically qualified
-- [ ] Applicable tenancy/authz paths are cache-safe and negatively tested
-- [ ] Applicable sandbox/connector/secret boundaries are qualified
-- [ ] Applicable backup/restore evidence is within confirmed RPO/RTO
-- [ ] Rollout, health, rollback, and incident ownership are explicit