@wrongstack/core 0.250.0 → 0.256.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/core",
-  "version": "0.250.0",
+  "version": "0.256.0",
   "license": "MIT",
   "description": "WrongStack core: kernel, types, defaults, and shared utilities for the WrongStack CLI agent.",
   "repository": {
@@ -97,7 +97,7 @@
   ],
   "wrongstackApiVersion": "0.1.10",
   "devDependencies": {
-    "@types/node": "^25.9.2",
+    "@types/node": "^25.9.3",
     "tsup": "^8.5.1",
     "typescript": "^6.0.3"
   },

package/skills/api-design/SKILL.md

@@ -137,3 +137,4 @@ Body: { "status": "paused" }
 - `typescript-strict` — for type-safe request/response types
 - `security-scanner` — for scanning API implementations for injection, auth, and secrets
 - `testing` — for writing integration tests against API endpoints
+- `output-standards` — for standardized `<next_steps>` formatting

package/skills/api-design/SKILL.save.md

@@ -0,0 +1,26 @@
+# API Design — WrongStack (Compact)
+
+Designs and reviews REST APIs for WrongStack services. JSON over HTTPS, conventional HTTP status codes, cursor-based pagination.
+
+## Rules
+
+1. Use conventional HTTP status codes: 200 (ok), 201 (created), 400 (bad request), 401 (unauthorized), 403 (forbidden), 404 (not found), 500 (server error).
+2. Always return consistent error shape: `{ "error": { "code": "ERROR_CODE", "message": "Human readable" } }`.
+3. Use plural nouns for resource names: `/sessions` not `/session`.
+4. Pagination: cursor-based for large datasets, not offset-based.
+5. Request validation: validate on server, return 400 with field-level errors.
+6. Idempotency: POST to /resources creates; PUT to /resources/:id replaces.
+7. No secrets in URLs — put auth in headers, not query params.
+8. Versioning: prefix with `/v1/` when breaking changes are inevitable.
+
+## Error codes
+
+| Code | HTTP | When |
+|------|------|------|
+| VALIDATION_ERROR | 400 | Request invalid |
+| UNAUTHORIZED | 401 | Missing/invalid auth |
+| FORBIDDEN | 403 | No permission |
+| NOT_FOUND | 404 | Resource missing |
+| CONFLICT | 409 | Duplicate |
+| RATE_LIMITED | 429 | Too many requests |
+| INTERNAL_ERROR | 500 | Server failure |

package/skills/audit-log/SKILL.md

@@ -4,7 +4,7 @@ description: |
   Use this skill when analyzing WrongStack session logs, event streams, or
   system traces to surface patterns, anomalies, or operational insights.
   Triggers: user says "audit", "session analysis", "log analysis", "usage patterns".
-version: 1.1.0
+version: 1.2.0
 ---
 
 # Audit Log Agent — WrongStack
@@ -152,6 +152,12 @@ When reading a session file:
 ### Cost Trend
 - Iteration 1-10: avg $0.04/iteration
 - Iteration 11-20: avg $0.11/iteration (context growth)
+
+<next_steps>
+1. Investigate bash failures — command timeout pattern in iterations 14-20
+2. Review tool call count in iteration 14 — 50+ tool calls suggests loop
+3. Run `pnpm test` to verify fixes for identified issues
+</next_steps>
 ```
 
 ## Anti-patterns
@@ -166,4 +172,5 @@ When reading a session file:
 
 - `bug-hunter` — for turning audit findings into concrete bugs to fix
 - `refactor-planner` — for addressing systemic issues found in logs
-- `security-scanner` — for security-adjacent findings (leaked keys, injection patterns in logs)
+- `security-scanner` — for security-adjacent findings (leaked keys, injection patterns in logs)
+- `output-standards` — for standardized `<next_steps>` formatting

package/skills/audit-log/SKILL.save.md

@@ -0,0 +1,22 @@
+# Audit Log Agent — WrongStack (Compact)
+
+Analyzes session logs, event streams, and system traces to surface patterns, anomalies, and actionable insights.
+
+## Rules
+
+1. Always parse from the source JSONL — never summarize what you didn't read.
+2. Analyze one session at a time, or aggregate with clear labeling.
+3. Cite specific data in reports: iteration numbers, tool names, error messages.
+4. Flag repeated failures (same tool, 5+ times) as a real issue.
+5. Report cost trends in context of iteration count.
+
+## What to look for
+
+- **Tool usage**: 100+ calls to same tool = possible loop. Same tool failing 5x+ = bug.
+- **Cost**: Tokens/iteration trending up = context bloat. Sudden 3x increase = large file reads.
+- **Context**: >50 tool calls per iteration = unfocused. Compaction 3x+ = too much context.
+- **Errors**: All errors in one tool = command timeout pattern. Same error 47x = systemic.
+
+## Session file structure
+
+JSONL with events: iteration_start, tool_call, tool_result, error, compaction, cost, iteration_end.

package/skills/bug-hunter/SKILL.md

@@ -4,7 +4,7 @@ description: |
   Use this skill when scanning source code for bugs, anti-patterns, code smells,
   or quality issues in a WrongStack project. Triggers: user says "bug", "bug hunt",
   "scan for issues", "find problems", "anti-pattern", "code smell", "static analysis".
-version: 1.1.0
+version: 1.2.0
 ---
 
 # Bug Hunter — WrongStack
@@ -125,10 +125,18 @@ const data: any = response.json();
 | Low      | 3 |
 
 Total: 16 findings in 12 files
+
+<next_steps>
+1. [SHELL-INJ] `tools/shell.ts:42` — replace exec() with execFile()
+2. [SECRET] `lib/config.ts:8` — move API key to environment variable
+3. [MEMORY] `tools/pool.ts:89` — add cleanup in component unmount
+4. [TYPE] `core/agent.ts:103` — replace `as any` with proper type
+</next_steps>
 ```
 
 ## Skills in scope
 
 - `security-scanner` — for hardcoded secrets and injection vectors
 - `refactor-planner` — for fixing findings across multiple files
-- `typescript-strict` — for type-safety related findings
+- `typescript-strict` — for TypeScript type safety rules
+- `output-standards` — for standardized `<next_steps>` formatting

package/skills/bug-hunter/SKILL.save.md

@@ -0,0 +1,33 @@
+# Bug Hunter — WrongStack (Compact)
+
+Scans code for bugs and code smells. Outputs a prioritized hit list with file:line references.
+
+## Rules
+
+1. Always include `file:line` in every finding — no line reference = can't be fixed.
+2. Never scan `node_modules`.
+3. Don't report style issues as bugs — those are lint findings.
+4. If >30% of findings are noise, note the false positive rate.
+5. Sort output: critical > high > medium > low.
+6. Don't flag deprecated APIs without severity.
+
+## Severity levels
+
+| Level | Meaning | Action |
+|-------|---------|--------|
+| **Critical** | Security breach, data loss, crash | Fix immediately |
+| **High** | Logic bug, race condition, memory leak | Fix before release |
+| **Medium** | Error handling gap, type unsafety | Fix soon |
+| **Low** | Style, minor code smell | Consider fixing |
+
+## Key patterns to find
+
+| Pattern | Severity |
+|---------|----------|
+| Uncaught promise `.then(` without `.catch` | high |
+| Hardcoded secret `[A-Za-z0-9/+=]{40}` | critical |
+| unsafe any `: any` or `as any` | medium |
+| innerHTML assignment | high |
+| Missing await | high |
+| SQL concatenation `"SELECT * FROM " + table` | critical |
+| Shell injection `exec(\`cmd ${input}\`)` | critical |

package/skills/chimera/SKILL.md

@@ -1,11 +1,10 @@
 ---
 name: chimera
 description: |
-  Use this skill when performing a post-session code quality review of files
-  changed during an AI coding session. Activated automatically by the chimera
-  plugin after each session completes.
-  Triggers: post-session review, chimera agent, session-end code check.
-version: 1.0.0
+  Use this skill for post-session code quality review of files changed during
+  a WrongStack session. Triggers: user says "review", "code review", "quality check",
+  "post-session review", "chimeric review".
+version: 1.2.0
 ---
 
 # Chimera — Post-Session Code Guardian
@@ -33,19 +32,7 @@ issues the session agent may have missed.
 6. **One finding per line.** Each finding must have: severity, file:line, and a
    one-sentence fix.
 
-## What to look for
-
-| Category | Examples | Severity |
-|----------|----------|----------|
-| **Logic bugs** | Off-by-one, inverted condition, null deref without guard | Critical / High |
-| **Type safety** | `as any`, missing return type on export, `!` assertion | Medium |
-| **Error handling** | Missing try/catch on async, swallowed errors | High |
-| **Security** | Hardcoded secret, shell injection, innerHTML XSS | Critical |
-| **Resource leaks** | Event listener not removed, file handle not closed | Medium |
-| **Test gaps** | New logic without corresponding test | Medium |
-| **API design** | Wrong status code, missing validation, secrets in URL | High |
-
-## Report format
+## Output format
 
 Write your report as a single message appended to the chat. Use this structure:
 
@@ -68,6 +55,12 @@ Write your report as a single message appended to the chat. Use this structure:
 - Files reviewed: N
 - Findings: C critical, H high, M medium
 - Clean files: N
+
+<next_steps>
+1. [CRITICAL] `path/file.ts:42` — add null guard for `user`
+2. [HIGH] `path/config.ts:8` — move API key to environment variable
+3. [MEDIUM] `path/helper.ts:15` — replace `as any` with `as unknown as T`
+</next_steps>
 ```
 
 If you find **nothing** worth flagging: write a single line.
@@ -103,3 +96,4 @@ likely missed, not decisions it explicitly made.
 - `typescript-strict` — for TypeScript type safety rules
 - `api-design` — for API design review patterns
 - `testing` — for test coverage assessment
+- `output-standards` — for standardized `<next_steps>` formatting

package/skills/chimera/SKILL.save.md

@@ -0,0 +1,26 @@
+# Chimera — Post-Session Code Guardian (Compact)
+
+Post-session code quality agent. Reviews files changed during the session.
+
+## Rules
+
+1. Only review changed files.
+2. Read before judging — always read the file before flagging.
+3. Be surgical — flag real bugs, not style preferences.
+4. No re-litigation — don't re-raise issues already discussed.
+5. Severity-ranked: Critical > High > Medium > Low.
+6. One finding per line: severity, file:line, one-sentence fix.
+
+## Output format
+
+```
+## 🦂 Chimera Review
+
+### Critical (N)
+1. [BUG] path/file.ts:42 — null deref on user.name
+   → Add guard: if (!user) throw new NotFoundError()
+
+### Summary
+- Files reviewed: N
+- Clean files: N
+```

package/skills/docker-deploy/SKILL.md

@@ -153,3 +153,4 @@ trivy image --exit-code 1 --ignore-unfixed --severity HIGH,CRITICAL wrongstack:$
 - `git-flow` — for tagging releases and managing Docker image versions
 - `node-modern` — for Node.js-specific containerization patterns
 - `observability` — for logging and tracing in containerized environments
+- `output-standards` — for standardized `<next_steps>` formatting

package/skills/docker-deploy/SKILL.save.md

@@ -0,0 +1,23 @@
+# Docker Deploy — WrongStack (Compact)
+
+Containerizes and deploys WrongStack with Docker.
+
+## Rules
+
+1. Multi-stage build: build stage + runtime stage (production deps only).
+2. Use `node:*` base image with pinned version — not `node:latest`.
+3. Never run as root in the container — use a non-root user.
+4. Pass secrets via environment variables, not baked into the image.
+5. Tag images with git SHA: `wrongstack:$GIT_SHA`.
+6. Scan images for vulnerabilities: `trivy image` or `docker scout` before push.
+7. Use `.dockerignore` to exclude `node_modules`, `dist`, `.git`, `*.test.ts`.
+
+## Key best practices
+
+| Practice | Why |
+|----------|-----|
+| Pin base image version | Reproducibility |
+| Multi-stage build | 1GB → ~150MB |
+| Non-root user | Security: container compromise ≠ host root |
+| `.dockerignore` | Smaller image, faster builds |
+| No `latest` tag | You always know which SHA |

package/skills/git-flow/SKILL.md

@@ -4,7 +4,7 @@ description: |
   Use this skill when proposing, reviewing, or troubleshooting git commits,
   branches, pull requests, or merge strategies in a WrongStack project session.
   Triggers: user mentions "commit", "branch", "PR", "merge", "rebase", "stash", "diff".
-version: 1.1.0
+version: 1.2.0
 ---
 
 # Git Workflow — WrongStack
@@ -132,8 +132,29 @@ git rebase main && git merge --ff-only feature
 - **Committing lockfile with logic changes**: Keep them separate for easier rollbacks
 - **Branching from branches**: Always branch from `main` or a stable release tag
 
+## Output format
+
+```
+## Git Workflow Report — <task>
+
+### Changes Summary
+[What files changed, how many commits, what the impact is]
+
+### Recommended Actions
+1. Create branch `feature-name` from `main`
+2. Commit changes with conventional commit format
+3. Open PR with description linking to issue
+
+<next_steps>
+1. `git checkout -b fix/session-leak` from `main`
+2. Commit with: `fix: correct race condition in token refresh`
+3. Open PR with description linking to issue #123
+</next_steps>
+```
+
 ## Skills in scope
 
 - `refactor-planner` — when a refactor involves multiple git-managed changes
 - `multi-agent` — for fleet-wide version audits across packages
-- `bug-hunter` — for spotting bugs at commit time before they reach main
+- `bug-hunter` — for spotting bugs at commit time before they reach main
+- `output-standards` — for standardized `<next_steps>` formatting

package/skills/git-flow/SKILL.save.md

@@ -0,0 +1,25 @@
+# Git Workflow — WrongStack (Compact)
+
+Guides commit messages, branch hygiene, PR strategy, and merge decisions. WrongStack uses pnpm workspaces.
+
+## Rules
+
+1. One concern per commit — never mix logic changes with lockfile updates.
+2. Never force-push shared branches — use `--force-with-lease` on own branches only.
+3. Always branch from `main` or a stable release tag.
+4. Small, frequent commits with clear messages beat large, vague ones.
+5. Rebase onto `main` before PR when safe for cleaner history.
+6. Delete branches after merge unless shared or releasing.
+
+## Commit format
+
+`type: short description` — types: `fix`, `feat`, `docs`, `refactor`, `test`, `chore`, `perf`, `ci`
+
+- Subject ≤ 72 chars, imperative mood, no trailing period.
+- Body: explain **why**, not what (the diff shows what).
+- Reference issues: `Fix #123` or `Closes GH-456`.
+
+## Branch strategy
+
+- One topic per branch: `feat/login`, `fix/session-leak`, `refactor/auth-layer`
+- Delete after merge, rebase onto main before PR

package/skills/multi-agent/SKILL.md

@@ -4,7 +4,7 @@ description: |
   Use this skill when a task would benefit from parallel execution across
   multiple AI agents, or when orchestrating leader/worker patterns in WrongStack.
   Triggers: user says "fan out", "parallel", "delegate", "subagent", "fleet", "coordinator".
-version: 1.1.0
+version: 1.2.0
 ---
 
 # Multi-Agent Coordination — WrongStack
@@ -113,6 +113,26 @@ For each worker result:
   - Present as unified report
 ```
 
+## Leader output format
+
+When a leader synthesizes results from subagents:
+
+```
+## Synthesis Report — <task>
+
+### Summary
+[Unified summary of all findings]
+
+### Unified Next Steps
+[Deduplicated and prioritized action items]
+
+<next_steps>
+1. [Priority] Action item 1 — file:line reference
+2. [Priority] Action item 2 — file:line reference
+3. [Priority] Action item 3 — file:line reference
+</next_steps>
+```
+
 ## Anti-patterns
 
 - **Over-delegation**: Firing 50 subagents in one turn — model context explodes, nothing gets done
@@ -131,6 +151,7 @@ Subagents share **nothing** — no memory, no session state, no variable scope.
 - `security-scanner` — parallel security scans
 - `refactor-planner` — parallel module analysis
 - `audit-log` — aggregating multiple session analyses
+- `output-standards` — for standardized `<next_steps>` formatting
 
 ---
 
@@ -184,4 +205,4 @@ collab_debug(["packages/**/src/**/*.ts"])
 
 ### For large codebases
 
-Run **package-by-package** or **module-by-module** sessions. Target only the area under review, not the whole repo.
+Run **package-by-package** or **module-by-module** sessions. Target only the area under review, not the whole repo.

package/skills/multi-agent/SKILL.save.md

@@ -0,0 +1,26 @@
+# Multi-Agent Coordination — WrongStack (Compact)
+
+Coordinates parallel AI agent execution for tasks that benefit from fanning out.
+
+## Rules
+
+1. Subagents share nothing — no memory, no session state.
+2. Leader must aggregate results.
+3. Narrow task scope per subagent — broad tasks exhaust budget.
+4. Role must match task — don't use bug-hunter to write docs.
+5. Check `stopReason`: end_turn (clean), budget_exhausted (retry), error (surface), aborted (don't retry).
+6. Don't fan out single atomic tasks under 5 tool calls.
+
+## When to fan out
+
+✅ Good: "Audit 50 files" — one subagent per 5-10 files. "Run tests in 12 packages" — parallel.
+❌ Avoid: Single atomic task under 5 calls. Tasks requiring shared state.
+
+## Roles
+
+| Role | Responsibility |
+|------|---------------|
+| **Leader** | Coordinates, delegates, synthesizes |
+| **Worker** | Executes a narrow subtask |
+| **Reviewer** | Validates worker output |
+| **Architect** | Design decisions when workers hit ambiguity |

package/skills/node-modern/SKILL.md

@@ -186,4 +186,5 @@ while (true) {
 - `typescript-strict` — strict TypeScript patterns
 - `react-modern` — React Server Components with Node.js
 - `bug-hunter` — catching async/await bugs, unhandled rejections
-- `sdd` — for setting up new Node.js features with a spec first
+- `sdd` — for setting up new Node.js features with a spec first
+- `output-standards` — for standardized `<next_steps>` formatting

package/skills/node-modern/SKILL.save.md

@@ -0,0 +1,21 @@
+# Modern Node.js (>= 22) — WrongStack (Compact)
+
+Node.js >= 22 patterns: ESM-only, native fetch with AbortSignal, Web Streams.
+
+## Rules
+
+1. Always use ESM (`import` with `.js` extension) — never `require()`.
+2. Always use `node:` protocol for built-in modules.
+3. Always use `AbortSignal.timeout()` for long-running operations.
+4. Never use axios, node-fetch, or got — native fetch is sufficient.
+5. Always handle `ENOENT` on file reads — use try/catch or `access` first.
+6. Use `Promise.allSettled` when partial failure is acceptable.
+
+## Key patterns
+
+- **ESM**: `import * as fs from 'node:fs/promises'`, `import { helper } from './helper.js'`
+- **fetch**: `const res = await fetch(url, { signal: AbortSignal.timeout(5000) })`
+- **Atomic write**: write to `.tmp`, then `rename(tmp, target)`
+- **Parallel**: `const results = await Promise.allSettled(tasks.map(t => t.run()))`
+- **Streams**: `response.body.getReader()` with `TextDecoder`
+- **AbortSignal**: Combine signals with `AbortSignal.any([userSignal, timeoutSignal])`

package/skills/observability/SKILL.md

@@ -132,3 +132,4 @@ Every log should include:
 - `bug-hunter` — for finding bugs via error trace patterns
 - `security-scanner` — for ensuring no secrets leak into logs
 - `node-modern` — for async tracing patterns with AbortSignal
+- `output-standards` — for standardized `<next_steps>` formatting

package/skills/observability/SKILL.save.md

@@ -0,0 +1,34 @@
+# Observability — WrongStack (Compact)
+
+Instruments WrongStack code with structured logs, traces, and metrics.
+
+## Rules
+
+1. Log at the right level: DEBUG (dev), INFO (normal), WARN (recoverable), ERROR (needs attention).
+2. Structured logs only — JSON to stdout, not plain text to files.
+3. Every significant event needs a `traceId`.
+4. Never log secrets, tokens, or PII — redact before logging.
+5. Logs must answer: what happened, what context, what was the outcome.
+
+## Log schema
+
+```json
+{
+  "level": "info|warn|error",
+  "traceId": "uuid",
+  "event": "event_name",
+  "timestamp": "ISO8601",
+  "duration_ms": 12,
+  "outcome": "success|failure|timeout"
+}
+```
+
+## Metrics
+
+| Metric | Type | Why |
+|--------|------|-----|
+| `tool.executions` | Counter | How often each tool runs |
+| `tool.duration_ms` | Histogram | Latency per tool |
+| `session.iterations` | Gauge | Active iterations |
+| `error.count` | Counter | Errors by type |
+| `context.tokens` | Gauge | Context size |

package/skills/output-standards/SKILL.md

@@ -0,0 +1,133 @@
+---
+name: output-standards
+description: |
+  Use this skill when defining or enforcing output formatting standards for agent
+  responses in WrongStack. Triggers: user says "next steps format", "output standard",
+  "response format", "final message format", "standardize next steps".
+version: 1.0.0
+---
+
+# Output Standards — WrongStack
+
+Standardizes the format of agent output, particularly the `next_steps` section
+in final messages. This ensures system-level parsing and automation can reliably
+extract structured data from agent responses.
+
+## Rules
+
+1. **Every final message MUST include `<next_steps>` tag** — no exceptions for completed tasks.
+2. **Tags must be properly closed** — `<next_steps>...</next_steps>` with exact tag names.
+3. **No markdown inside tags** — plain text only, one action per line.
+4. **Use imperative mood** — "Fix X", "Run Y", not "Fixed X" or "Running Y".
+5. **Be specific** — mention file paths, tool names, or exact commands.
+6. **Keep concise** — max 5 items unless the task genuinely requires more.
+
+## Output Format
+
+Every agent's final message MUST end with this structure:
+
+```
+[... task results ...]
+
+<next_steps>
+1. First actionable next step — imperative, specific
+2. Second actionable next step
+3. Third actionable next step (if needed)
+</next_steps>
+```
+
+### Format Requirements
+
+| Element | Rule | Example |
+|---------|------|---------|
+| Opening tag | `<next_steps>` on its own line | `<next_steps>` |
+| Numbered items | `1. ` prefix, one per line | `1. Fix auth bug in core/session.ts` |
+| Closing tag | `</next_steps>` on its own line | `</next_steps>` |
+| Blank line before | Optional but recommended | Improves readability |
+| Blank line after | Not required | — |
+
+### ✅ Correct Examples
+
+```
+Task completed successfully.
+
+<next_steps>
+1. Fix shell injection in packages/cli/src/slash-commands/dev.ts:15
+2. Replace Math.random() with randomUUID() in 4 files
+3. Run pnpm run typecheck to verify fixes
+</next_steps>
+```
+
+```
+Analysis finished. Found 3 critical issues.
+
+<next_steps>
+1. [CRITICAL] packages/cli/src/slash-commands/dev.ts:15 — exec() → execFile()
+2. [HIGH] packages/core/src/session-registry.ts:145 — remove ! assertion
+3. [HIGH] packages/core/src/session-registry.ts:169 — remove ! assertion
+</next_steps>
+```
+
+### ❌ Incorrect Examples
+
+```
+Task done. Next steps: 1) fix bug 2) run tests
+
+# ❌ No tags — not parseable
+```
+
+```
+<next_steps>
+- Fix the bug in auth.ts  # ❌ Dash, not number
+- Run tests
+</next_steps>
+
+# ❌ Wrong bullet character
+```
+
+```
+<next_steps>
+1. **Fix the bug** — use execFile instead  # ❌ Markdown inside tags
+2. Run `pnpm test`
+</next_steps>
+
+# ❌ Markdown formatting not allowed inside tags
+```
+
+```
+Next steps:
+1. Fix auth.ts
+
+# ❌ Missing opening/closing tags
+```
+
+## Subagent Requirements
+
+When a **leader agent** synthesizes output from **subagents**, the leader MUST:
+
+1. Aggregate all subagent `next_steps` into a unified `<next_steps>` section
+2. Remove duplicates (dedupe by file path + action)
+3. Re-prioritize if needed (critical > high > medium > low)
+4. Keep the unified list within the 5-item guideline, but no hard cap
+
+When a **subagent** completes its task, it MUST:
+
+1. Include its own `<next_steps>` section in the final message
+2. Report what it found/achieved, not what the leader should do
+3. Leader will aggregate and decide on overall next steps
+
+## Anti-patterns
+
+- **Don't use markdown inside `<next_steps>`** — plain text only
+- **Don't skip the tag** — even if next steps are obvious, include them
+- **Don't use dashes or asterisks** — use `1.`, `2.`, `3.` numbering
+- **Don't be vague** — "fix bugs" is useless, "fix auth/session.ts:42" is actionable
+- **Don't exceed 5 items without reason** — if >5, it's probably not a single task
+
+## Skills in scope
+
+- `bug-hunter` — inherits output-standards for bug reports
+- `security-scanner` — inherits output-standards for security findings
+- `refactor-planner` — inherits output-standards for refactoring plans
+- `architect` — inherits output-standards for architecture analysis
+- `tech-stack` — inherits output-standards for dependency reports

package/skills/output-standards/SKILL.save.md

@@ -0,0 +1,21 @@
+# Output Standards — WrongStack (Compact)
+
+Standardizes the format of agent output, particularly the `<next_steps>` section in final messages.
+
+## Rules
+
+1. Every final message MUST include `<next_steps>` tag — no exceptions.
+2. Tags must be properly closed — `<next_steps>...</next_steps>`.
+3. No markdown inside tags — plain text only, one action per line.
+4. Use imperative mood — "Fix X", not "Fixed X".
+5. Be specific — mention file paths, tool names, or exact commands.
+6. Keep concise — max 5 items unless the task genuinely requires more.
+
+## Format
+
+```
+<next_steps>
+1. [Priority] Action item with file:line reference
+2. [Priority] Second action item
+</next_steps>
+```

package/skills/prompt-engineering/SKILL.md

@@ -133,4 +133,5 @@ See `skill-creator` skill for the format. Key points:
 
 - `skill-creator` — for creating new skills (primary — prompt-engineering feeds into skill creation)
 - `typescript-strict` — for TypeScript-specific prompt typing
-- `react-modern` — for React component prompt conventions
+- `react-modern` — for React component prompt conventions
+- `output-standards` — for standardized `<next_steps>` formatting