@webpresso/agent-kit 0.21.0

package/skills/frontend-design/LICENSE.txt

@@ -0,0 +1,177 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS

package/skills/frontend-design/SKILL.md

@@ -0,0 +1,189 @@
+---
+type: skill
+slug: frontend-design
+title: frontend-design
+status: active
+scope: repo
+applies_to: [agents]
+related: []
+created: '2026-05-07'
+last_reviewed: '2026-05-07'
+name: frontend-design
+description: Create distinctive, production-grade frontend interfaces with high design quality. Use this skill when the user asks to build web components, pages, artifacts, posters, or applications (examples include websites, landing pages, dashboards, React components, HTML/CSS layouts, or when styling/beautifying any web UI). Generates creative, polished code and UI design that avoids generic AI aesthetics.
+license: Apache-2.0
+upstream: 
+  source: https://github.com/anthropics/skills/tree/main/skills/frontend-design
+  last_synced: "2026-05-28"
+---
+
+This skill guides creation of distinctive, production-grade frontend interfaces that avoid generic "AI slop" aesthetics. Implement real working code with exceptional attention to aesthetic details and creative choices.
+
+The user provides frontend requirements: a component, page, application, or interface to build. They may include context about the purpose, audience, or technical constraints.
+
+## Design Thinking
+
+Before coding, understand the context and commit to a BOLD aesthetic direction:
+
+- **Purpose**: What problem does this interface solve? Who uses it?
+- **Tone**: Pick an extreme: brutally minimal, maximalist chaos, retro-futuristic, organic/natural, luxury/refined, playful/toy-like, editorial/magazine, brutalist/raw, art deco/geometric, soft/pastel, industrial/utilitarian, etc. There are so many flavors to choose from. Use these for inspiration but design one that is true to the aesthetic direction.
+- **Constraints**: Technical requirements (framework, performance, accessibility).
+- **Differentiation**: What makes this UNFORGETTABLE? What's the one thing someone will remember?
+
+**CRITICAL**: Choose a clear conceptual direction and execute it with precision. Bold maximalism and refined minimalism both work - the key is intentionality, not intensity.
+
+Then implement working code (HTML/CSS/JS, React, Vue, etc.) that is:
+
+- Production-grade and functional
+- Visually striking and memorable
+- Cohesive with a clear aesthetic point-of-view
+- Meticulously refined in every detail
+
+## Frontend Aesthetics Guidelines
+
+Focus on:
+
+- **Typography**: Choose fonts that are beautiful, unique, and interesting. Avoid generic fonts like Arial and Inter; opt instead for distinctive choices that elevate the frontend's aesthetics; unexpected, characterful font choices. Pair a distinctive display font with a refined body font.
+- **Color & Theme**: Commit to a cohesive aesthetic. Use CSS variables for consistency. Dominant colors with sharp accents outperform timid, evenly-distributed palettes.
+- **Motion**: Use animations for effects and micro-interactions. Prioritize CSS-only solutions for HTML. Use Motion library for React when available. Focus on high-impact moments: one well-orchestrated page load with staggered reveals (animation-delay) creates more delight than scattered micro-interactions. Use scroll-triggering and hover states that surprise.
+- **Spatial Composition**: Unexpected layouts. Asymmetry. Overlap. Diagonal flow. Grid-breaking elements. Generous negative space OR controlled density.
+- **Backgrounds & Visual Details**: Create atmosphere and depth rather than defaulting to solid colors. Add contextual effects and textures that match the overall aesthetic. Apply creative forms like gradient meshes, noise textures, geometric patterns, layered transparencies, dramatic shadows, decorative borders, custom cursors, and grain overlays.
+
+NEVER use generic AI-generated aesthetics like overused font families (Inter, Roboto, Arial, system fonts), cliched color schemes (particularly purple gradients on white backgrounds), predictable layouts and component patterns, and cookie-cutter design that lacks context-specific character.
+
+Interpret creatively and make unexpected choices that feel genuinely designed for the context. No design should be the same. Vary between light and dark themes, different fonts, different aesthetics. NEVER converge on common choices (Space Grotesk, for example) across generations.
+
+**IMPORTANT**: Match implementation complexity to the aesthetic vision. Maximalist designs need elaborate code with extensive animations and effects. Minimalist or refined designs need restraint, precision, and careful attention to spacing, typography, and subtle details. Elegance comes from executing the vision well.
+
+Remember: Claude is capable of extraordinary creative work. Don't hold back, show what can truly be created when thinking outside the box and committing fully to a distinctive vision.
+
+## Project Integration
+
+When building components in a typed monorepo, prefer generated code for data fetching and shared packages for UI primitives.
+
+### Generated Code for Data Fetching
+
+Many projects use code-generators (GraphQL codegen, OpenAPI generators, or schema-engine variants) to produce typed hooks, fragments, and query-key utilities. Prefer generated hooks over writing custom queries:
+
+```typescript
+// Example: generated GraphQL hooks (TanStack Query-based)
+import { useGetProjectsListQuery } from '~/generated/graphql/hooks/default'
+import { useGetOrganizationsListQuery } from '~/generated/graphql/hooks/organization'
+
+// Types generated from schema/entity definitions
+import type { Organization, Project } from '~/generated/types'
+
+// Reusable fragments and query-key utilities
+import type { ProjectsListFragment } from '~/generated/graphql'
+import { listQueryKeyBase } from '~/generated/query-keys'
+```
+
+**Fragment Composition Pattern**: Entities can define reusable fragments that generators compose into typed hooks. Prefer entity-specific hooks (e.g., `useGetProjectsListQuery`) over hand-rolled queries.
+
+**GraphQL Client**: Always pass the client instance to generated hooks:
+
+```typescript
+import { client } from '~/lib/graphql-client'
+
+const { data, isLoading, error } = useGetProjectsListQuery(
+  client,
+  { where: { org_id: { _eq: orgId } } },
+  { enabled: !!orgId },
+)
+```
+
+### Monorepo Component Imports
+
+Typical shared-package import patterns:
+
+```typescript
+// Shared UI primitives
+import { Button, Card, Modal } from '@myorg/ui'
+
+// Route error boundaries
+import { RouteErrorBoundary } from '@myorg/ui'
+
+// Database schemas (for backend/integration tests)
+import * as schema from '~/generated/drizzle/schemas'
+
+// Test utilities (integration testing only)
+import { createIntegrationContext } from '@myorg/test-utils'
+import { projectsFactory } from '~/generated/factories'
+```
+
+**Cross-Package Reference**: See the `monorepo-navigation` skill for your project's package structure and import patterns.
+
+## React Router v7 Patterns
+
+For React Router v7 projects, follow these data loading patterns:
+
+### Data Loading via Loaders
+
+For route-level data that must be available on render, use loaders (NOT TanStack Query):
+
+```typescript
+import type { Route } from '../+types/home'
+
+export function loader({ request }: Route.LoaderArgs) {
+  const url = new URL(request.url)
+  const cookieSource = request.headers.get('cookie')
+
+  return {
+    hasPlatformSession: hasPlatformSessionCookie(cookieSource),
+    features: getEnvironmentFeatures(),
+  }
+}
+
+export default function Home() {
+  const { hasPlatformSession, features } = useLoaderData<typeof loader>()
+  // Loader data is immediately available, no loading states needed
+}
+```
+
+**When to use loaders**: Initial route data, authentication checks, feature flags, URL parsing. Loaders run server-side (or during prerendering) and block navigation until complete.
+
+### Client-Side Mutations
+
+For mutations and dynamic client-side data, use generated mutation hooks:
+
+```typescript
+import { useCreateProjectMutation } from '~/generated/graphql/hooks/default'
+import { client } from '~/lib/graphql-client'
+
+function CreateProjectForm() {
+  const mutation = useCreateProjectMutation(client)
+
+  const handleSubmit = async (formData: ProjectInput) => {
+    await mutation.mutateAsync({ input: formData })
+  }
+}
+```
+
+### Navigation Patterns
+
+```typescript
+import { useNavigate, useParams } from 'react-router'
+
+function ProjectDetail() {
+  const navigate = useNavigate()
+  const { projectSlug, orgSlug } = useParams<{ projectSlug: string; orgSlug: string }>()
+
+  // Navigate programmatically
+  const goToSettings = () => {
+    navigate(`/organizations/${orgSlug}/projects/${projectSlug}/settings`)
+  }
+}
+```
+
+**Error Boundaries**: Always export an `ErrorBoundary` for routes:
+
+```typescript
+export function ErrorBoundary({ error }: Route.ErrorBoundaryProps) {
+  return <RouteErrorBoundary error={error} />
+}
+```
+
+## Development Workflow
+
+Use your project's task runner (e.g., `just`, `make`, `nx`, `turbo`, or npm scripts) for repository operations rather than calling package managers directly. Refer to your project's `AGENTS.md` or top-level docs for the canonical commands.
+
+**Long-Running Commands**: Full-repo `qa`, `test`, and `build` tasks often take several minutes. Run them once at start, use scoped commands for iteration, then run once at end for final verification.

package/skills/hooks-doctor/SKILL.md

@@ -0,0 +1,77 @@
+---
+type: skill
+slug: hooks-doctor
+title: Hooks Doctor
+status: active
+scope: repo
+applies_to: [agents]
+related: []
+created: '2026-05-07'
+last_reviewed: '2026-05-07'
+name: hooks-doctor
+description: Verify the webpresso plugin hooks installation is healthy. Run after install, when hooks seem broken, or when debugging plugin integration issues. Triggers on `/webpresso:hooks-doctor`, "doctor", "verify hooks", "check plugin", "hooks broken", "plugin not working", "wp hooks doctor".
+argument-hint: '[--skip-mcp]'
+allowed-tools:
+  - Bash
+---
+
+# Hooks Doctor
+
+Verify the webpresso plugin hooks installation is healthy. Run this first when:
+- A hook seems not to be firing
+- The plugin was just installed or updated
+- Claude Code can't find expected tools
+- Any plugin integration issue arises
+
+## Running the Check
+
+Run the doctor command directly:
+
+```
+wp hooks doctor
+```
+
+Or skip the MCP server check (for CI environments):
+
+```
+wp hooks doctor --skip-mcp
+```
+
+## Interpreting Results
+
+Each check prints `[x]` (pass) or `[ ]` (fail) with a detail line:
+
+```
+[x] pretool-guard
+[x] post-tool (lint-after-edit)
+[x] stop (qa-changed-files)
+[x] guard-switch
+[x] sessionstart
+[x] test-quality-check
+[x] plugin.json integrity
+[x] MCP server liveness: MCP server already running (sentinel found)
+```
+
+## Failure Remediation
+
+| Check | Likely Cause | Fix |
+|-------|-------------|-----|
+| `pretool-guard` / `post-tool` / etc. — not found | `pnpm build` not run after install | `pnpm build` |
+| `pretool-guard` / etc. — not executable | `chmod +x` not persisted | Re-run `pnpm prepare` or `pnpm build` which runs `chmod-bins` |
+| `plugin.json integrity` — missing | `.claude-plugin/plugin.json` absent | Reinstall plugin: `claude plugin install webpresso@webpresso --scope user` |
+| `MCP server liveness` — timeout | MCP server cold-start too slow | Wait and retry, or run `wp hooks doctor --skip-mcp` |
+| Any check — not found at `dist/esm/...` | Build artifacts missing | Run `pnpm build` in the webpresso repo |
+
+After fixing, re-run `wp hooks doctor` to confirm.
+
+## How It Works
+
+The doctor runs five categories of checks:
+
+1. **Bin existence** — each hook binary exists at the expected `dist/esm/hooks/...` path
+2. **Executable bit** — bins have execute permission (skipped on Windows)
+3. **stdin response** — interactive hooks (`pretool-guard`, `guard-switch`, `sessionstart`) respond to `{}` input with valid JSON and exit 0; fire-and-forget hooks (`lint-after-edit`, `qa-changed-files`) exit 0
+4. **plugin.json integrity** — manifest exists, has required fields, and all referenced bins exist on disk
+5. **MCP server liveness** — spawns the MCP server and sends a `tools/list` JSON-RPC request; times out at 5s (soft-fail — warning only, does not fail the overall check)
+
+If `isMcpReady()` detects a live MCP sentinel, the MCP check fast-passes without spawning.

package/skills/logging-best-practices/SKILL.md

@@ -0,0 +1,145 @@
+---
+type: skill
+slug: logging-best-practices
+title: Logging Best Practices Skill
+status: active
+scope: repo
+applies_to: [agents]
+related: []
+created: '2026-05-07'
+last_reviewed: '2026-05-07'
+name: logging-best-practices
+description: Logging best practices focused on wide events (canonical log lines) for powerful debugging and analytics
+license: MIT
+metadata: 
+  author: boristane
+  version: '1.0.0'
+upstream:
+  source: https://github.com/boristane/agent-skills/tree/main/skills/logging-best-practices
+  last_synced: "2026-05-28"
+---
+
+# Logging Best Practices Skill
+
+Version: 1.0.0
+
+## Purpose
+
+This skill provides guidelines for implementing effective logging in applications. It focuses on **wide events** (also called canonical log lines) - a pattern where you emit a single, context-rich event per request per service, enabling powerful debugging and analytics.
+
+## When to Apply
+
+Apply these guidelines when:
+
+- Writing or reviewing logging code
+- Adding console.log, logger.info, or similar
+- Designing logging strategy for new services
+- Setting up logging infrastructure
+
+## Core Principles
+
+### 1. Wide Events (CRITICAL)
+
+Emit **one context-rich event per request per service**. Instead of scattering log lines throughout your handler, consolidate everything into a single structured event emitted at request completion.
+
+```typescript
+const wideEvent: Record<string, unknown> = {
+  method: 'POST',
+  path: '/checkout',
+  requestId: c.get('requestId'),
+  timestamp: new Date().toISOString(),
+}
+
+try {
+  const user = await getUser(c.get('userId'))
+  wideEvent.user = { id: user.id, subscription: user.subscription }
+
+  const cart = await getCart(user.id)
+  wideEvent.cart = { total_cents: cart.total, item_count: cart.items.length }
+
+  wideEvent.status_code = 200
+  wideEvent.outcome = 'success'
+  return c.json({ success: true })
+} catch (error) {
+  wideEvent.status_code = 500
+  wideEvent.outcome = 'error'
+  wideEvent.error = { message: error.message, type: error.name }
+  throw error
+} finally {
+  wideEvent.duration_ms = Date.now() - startTime
+  logger.info(wideEvent)
+}
+```
+
+### 2. High Cardinality & Dimensionality (CRITICAL)
+
+Include fields with high cardinality (user IDs, request IDs - millions of unique values) and high dimensionality (many fields per event). This enables querying by specific users and answering questions you haven't anticipated yet.
+
+### 3. Business Context (CRITICAL)
+
+Always include business context: user subscription tier, cart value, feature flags, account age. The goal is to know "a premium customer couldn't complete a $2,499 purchase" not just "checkout failed."
+
+### 4. Environment Characteristics (CRITICAL)
+
+Include environment and deployment info in every event: commit hash, service version, region, instance ID. This enables correlating issues with deployments and identifying region-specific problems.
+
+### 5. Single Logger (HIGH)
+
+Use one logger instance configured at startup and import it everywhere. This ensures consistent formatting and automatic environment context.
+
+### 6. Middleware Pattern (HIGH)
+
+Use middleware to handle wide event infrastructure (timing, status, environment, emission). Handlers should only add business context.
+
+### 7. Structure & Consistency (HIGH)
+
+- Use JSON format consistently
+- Maintain consistent field names across services
+- Simplify to two log levels: `info` and `error`
+- Never log unstructured strings
+
+## Anti-Patterns to Avoid
+
+1. **Scattered logs**: Multiple console.log() calls per request
+2. **Multiple loggers**: Different logger instances in different files
+3. **Missing environment context**: No commit hash or deployment info
+4. **Missing business context**: Logging technical details without user/business data
+5. **Unstructured strings**: `console.log('something happened')` instead of structured data
+6. **Inconsistent schemas**: Different field names across services
+
+## Guidelines
+
+### Wide Events (`rules/wide-events.md`)
+
+- Emit one wide event per service hop
+- Include all relevant context
+- Connect events with request ID
+- Emit at request completion in finally block
+
+### Context (`rules/context.md`)
+
+- Support high cardinality fields (user_id, request_id)
+- Include high dimensionality (many fields)
+- Always include business context
+- Always include environment characteristics (commit_hash, version, region)
+
+### Structure (`rules/structure.md`)
+
+- Use a single logger throughout the codebase
+- Use middleware for consistent wide events
+- Use JSON format
+- Maintain consistent schema
+- Simplify to info and error levels
+- Never log unstructured strings
+
+### Common Pitfalls (`rules/pitfalls.md`)
+
+- Avoid multiple log lines per request
+- Design for unknown unknowns
+- Always propagate request IDs across services
+
+References:
+
+- [Logging Sucks](https://loggingsucks.com)
+- [Observability Wide Events 101](https://boristane.com/blog/observability-wide-events-101/)
+- [Stripe - Canonical Log Lines](https://stripe.com/blog/canonical-log-lines)

package/skills/lore-protocol/SKILL.md

@@ -0,0 +1,93 @@
+---
+type: skill
+slug: lore-protocol
+title: lore-protocol
+status: active
+scope: repo
+applies_to: [agents]
+related: []
+created: '2026-05-07'
+last_reviewed: '2026-05-07'
+name: lore-protocol
+description: Enforce Lore commit-message trailers using `wp audit commit-message`, including setup guidance for lore-enabled commit hooks and the required trailer protocol.
+---
+
+# lore-protocol
+
+Enforce Lore commit-message trailers using `wp audit commit-message`.
+
+Lore is a lightweight protocol for embedding decision context directly into
+commit messages — constraints, rejected alternatives, confidence, and
+forward-looking directives — so future engineers understand *why* a change
+was made, not just *what* changed.
+
+## Quick start
+
+```bash
+# Validate a commit message file (hard-fail mode — exits non-zero on violations)
+wp audit commit-message --message-file .git/COMMIT_EDITMSG --require-lore
+
+# Soft-warn mode — emits warnings but always exits 0 (adoption ramp)
+wp audit commit-message --message-file .git/COMMIT_EDITMSG --lore-warn
+
+# Opt in per-commit by adding [lore] to the subject line:
+# feat(auth): prevent silent session drops [lore]
+```
+
+## Install the commit-msg hook
+
+```bash
+wp setup --with lore-commits
+```
+
+This writes `.husky/commit-msg` containing:
+
+```sh
+#!/bin/sh
+wp audit commit-message --require-lore --message-file "$1"
+```
+
+## Trailer format
+
+```
+<intent line: why the change was made, not what changed>
+
+<body: narrative context — constraints, approach rationale>
+
+Constraint: <external constraint that shaped the decision>
+Rejected: <alternative considered> | <reason for rejection>
+Confidence: <low|medium|high>
+Scope-risk: <narrow|moderate|broad>
+Directive: <forward-looking warning for future modifiers>
+Tested: <what was verified>
+Not-tested: <known gaps in verification>
+```
+
+## Required trailers (for `--require-lore` or `[lore]` subject tag)
+
+| Trailer | Required | Allowed values |
+|---------|----------|---------------|
+| `Confidence:` | yes | `low`, `medium`, `high` |
+| `Constraint:` or `Rejected:` or `Directive:` | at least one | free text |
+| `Scope-risk:` | optional | `narrow`, `moderate`, `broad` |
+| `Reversibility:` | optional | `clean`, `messy`, `irreversible` |
+| `Tested:` | optional | free text |
+| `Not-tested:` | optional | free text |
+| `Related:` | optional | free text |
+
+## Example commit
+
+```
+Prevent silent session drops during long-running operations
+
+The auth service returns inconsistent status codes on token
+expiry, so the interceptor catches all 4xx responses.
+
+Constraint: Auth service does not support token introspection
+Rejected: Extend token TTL to 24h | security policy violation
+Confidence: high
+Scope-risk: narrow
+Directive: Error handling is broad — do not narrow without verifying upstream behavior
+Tested: Single expired token refresh (unit)
+Not-tested: Auth service cold-start > 500ms behavior
+```