@wrongstack/core 0.300.0 → 0.301.0

package/skills/research-web/SKILL.md

@@ -9,6 +9,9 @@ description: |
   "latest", "what's new in", "breaking changes", "find current",
   "web research", "search the web", "look up".
 version: 1.0.0
+required-capabilities: [web.research]
+required-tools: [context_manager, delegate, fetch, search]
+optional-capabilities: [runtime.admin]
 ---
 
 # Research Web — WrongStack

package/skills/sdd/SKILL.md

@@ -5,6 +5,8 @@ description: |
   in WrongStack. Triggers: user says "/sdd", "spec", "specification", "task graph",
   "SDD", "acceptance criteria", or starts a new feature.
 version: 2.1.0
+required-capabilities: [work.plan, filesystem.write]
+required-tools: []
 ---
 
 # Spec-Driven Development — WrongStack
@@ -132,4 +134,4 @@ Stage shown in real-time. Pause stops after current iteration completes.
 - `refactor-planner` — when the spec reveals a multi-file refactor
 - `bug-hunter` — when a bugfix spec needs a root cause analysis section
 - `multi-agent` — for executing parallel task groups
-- `output-standards` — for standardized `<nextsteps>` formatting
+- `output-standards` — for standardized `<nextsteps>` formatting

package/skills/security-scanner/SKILL.md

@@ -5,6 +5,9 @@ description: |
   in WrongStack. Triggers: user says "security", "vulnerability", "CVE", "secret",
   "injection", "XSS", "SQL injection", "audit security", "supply chain".
 version: 1.2.0
+required-capabilities: [filesystem.read, code.inspect]
+required-tools: []
+optional-capabilities: [dependencies.manage]
 ---
 
 # Security Scanner — WrongStack

package/skills/skill-creator/SKILL.md

@@ -4,6 +4,8 @@ description: |
   Use this skill when the user wants to create a new AI skill in WrongStack.
   Triggers: user says "create a skill", "new skill", "add a skill", "skill definition".
 version: 1.2.0
+required-capabilities: [filesystem.write, runtime.admin]
+required-tools: [bash, skill]
 ---
 
 # Skill Creator — WrongStack

package/skills/tech-stack/SKILL.md

@@ -5,6 +5,9 @@ description: |
   or evaluating third-party libraries in WrongStack. Triggers: user says "dependency",
   "package version", "outdated", "npm audit", "deprecated package", "tech stack".
 version: 1.2.0
+required-capabilities: [dependencies.manage]
+required-tools: []
+optional-capabilities: [web.research]
 ---
 
 # Tech Stack Validator — WrongStack (Language-Agnostic)

package/skills/testing/SKILL.md

@@ -5,6 +5,9 @@ description: |
   Triggers: user says "test", "unit test", "integration test", "e2e", "mock",
   "vitest", "coverage", "assert", "expect", "test strategy", "write tests".
 version: 1.0.0
+required-capabilities: [filesystem.read, verification.run]
+required-tools: []
+optional-capabilities: [execution.shell]
 ---
 
 # Testing — WrongStack
@@ -157,7 +160,7 @@ coverageThreshold: {
 
 ## WrongStack-specific test notes
 
-- **Subpath exports**: Some packages use `exports` field in `package.json` — tests must use the public entry point, not `dist/`.
+- **Subpath exports**: Some packages define an `exports` field in `package.json` — tests must use the public entry point, not `dist/`.
 - **AbortSignal**: Any test involving timeouts must use `AbortSignal.timeout()` not `setTimeout`.
 - **pnpm workspaces**: Run `pnpm test` in the package root, or `pnpm -r test` for all packages.
 - **Vitest config**: Each package has its own `vitest.config.ts`.

package/skills/typescript-strict/SKILL.md

@@ -5,6 +5,9 @@ description: |
   in WrongStack. Triggers: user mentions "TypeScript", "strict", "type error",
   "type safety", "narrowing", "branded type", "discriminated union", "noUncheckedIndexedAccess".
 version: 1.1.0
+required-capabilities: [filesystem.read, filesystem.write]
+required-tools: []
+optional-capabilities: [verification.run]
 ---
 
 # TypeScript Strict Mode — WrongStack
@@ -237,4 +240,4 @@ console.log(name!.toUpperCase());
 - `node-modern` — for TypeScript + ESM patterns
 - `react-modern` — for React + TypeScript patterns
 - `bug-hunter` — for type-related bugs like unsafe casts
-- `output-standards` — for standardized `<nextsteps>` formatting
+- `output-standards` — for standardized `<nextsteps>` formatting

package/skills/wrongstack-kanban/SKILL.md

@@ -10,6 +10,8 @@ triggers:
   - user says "kanban", "board", "task dispatch", "kanban queue"
   - working with the kanban tool or kanban_queue
   - managing project work through boards
+required-capabilities: [work.plan]
+required-tools: [kanban, kanban_queue]
 ---
 
 # WrongStack Kanban — Deterministic Enforcement Skill
@@ -67,12 +69,13 @@ The lifecycle guard enforces these mechanically. Do not attempt to bypass them.
    order, and creation time — not randomly. Do not attempt to influence dispatch
    order by shuffling tasks or boards.
 
-2. **Claim before working.** Call `kanban_queue` or `claim_task` before starting
+2. **Claim before working.** Call `kanban_queue`, or call `kanban` with the
+   `claim_task` action, before starting
    work. Working on an unclaimed card means another agent may also be working on
    it.
 
-3. **Heartbeat or lose the lease.** If you hold a lease, you must call
-   `heartbeat_assignment` before it expires. Expired leases are recovered by the
+3. **Heartbeat or lose the lease.** If you hold a lease, you must call `kanban`
+   with the `heartbeat_assignment` action before it expires. Expired leases are recovered by the
    system and the task is reassigned.
 
 4. **Fence your writes.** Include `expectedLeaseId` in every `mark_assignment`

package/skills/wrongstack-mailbox/SKILL.md

@@ -9,6 +9,9 @@ description: |
   fleet", "tell the wrongstack agents", "is anyone online in
   wrongstack", or "register me with wrongstack".
 version: 1.0.0
+required-capabilities: []
+required-tools: [mailbox]
+optional-capabilities: [mcp.dynamic, web.research]
 ---
 
 # WrongStack Mailbox Client
@@ -658,7 +661,7 @@ await mb('/mailbox/send', {
   credential. If you must print the URL, redact the token (`[REDACTED]`).
 - **Don't reply to a broadcast with another broadcast.** Replies should
   target the original sender via `to: <their-id>`, with `replyTo` set.
-- **Don't use `control` messages.** They go through a different path in
+- **Avoid `control` messages.** They go through a different path in
   the WrongStack agent loop and will likely be dropped on the floor by
   the recipient.
 

package/skills/wrongstack-mailbox-mcp/SKILL.md

@@ -1,6 +1,8 @@
 ---
 name: wrongstack-mailbox-mcp
 description: Coordinate with WrongStack agents through the project-scoped Mailbox MCP server. Use when an external coding agent needs to inspect unread or incomplete messages, query conversation history, discover online agents, send direct/reply/broadcast/steer messages, acknowledge outcomes, maintain its presence, soft-delete or restore messages, watch for changes, or perform explicitly authorized Mailbox administration without reading Mailbox files or SQLite directly.
+required-capabilities: [mcp.dynamic]
+required-tools: [mcp_use]
 ---
 
 # WrongStack Mailbox MCP
@@ -34,11 +36,11 @@ heartbeat identity to `--actor`; tool arguments cannot impersonate another actor
 
 ## Coordinate
 
-1. Call `mailbox_manage` with `register_self`. Include a stable name and role when known.
-2. Call `mailbox_read` with `unread`, then `query`. Prefer `unreadBy` plus `incompleteOnly` when
+1. Call `mcp_use` for the remote `mailbox_manage` operation with `register_self`. Include a stable name and role when known.
+2. Call `mcp_use` for the remote `mailbox_read` operation with `unread`, then `query`. Prefer `unreadBy` plus `incompleteOnly` when
    looking for actionable work.
-3. Use `mailbox_read` with `online_agents` before routing a time-sensitive direct message.
-4. Use `mailbox_manage` with `send`. Set an explicit recipient and message type:
+3. Call `mcp_use` for remote `mailbox_read` with `online_agents` before routing a time-sensitive direct message.
+4. Call `mcp_use` for remote `mailbox_manage` with `send`. Set an explicit recipient and message type:
    - `ask` for a blocking question;
    - `assign` for delegated work;
    - `steer` for changed direction;
@@ -46,17 +48,17 @@ heartbeat identity to `--actor`; tool arguments cannot impersonate another actor
    - `result` for a completed outcome;
    - `broadcast` only when every relevant agent should receive it.
 5. Set `replyTo` when continuing a thread. Do not create an unrelated message that loses context.
-6. Use `ack` or `ack_many` after reading or completing messages. Record a truthful outcome when
+6. Call `mcp_use` for the remote `ack` or `ack_many` operation after reading or completing messages. Record a truthful outcome when
    marking work completed.
 7. Send `heartbeat_self` during long work and `deregister_self` on a clean shutdown.
 
-Runtime-only `control` messages are deliberately unavailable. Use `steer` for normal external
+Runtime-only `control` messages are deliberately unavailable. Call `mcp_use` for the remote `steer` operation for normal external
 direction; never bypass the restriction through another channel.
 
 ## Observe changes
 
-Call `mailbox_watch` with an optional event type and timeout no greater than 25 seconds. Treat the
-result as a wake-up hint. After every event or timeout, reconcile with `mailbox_read`; watch events
+Call `mcp_use` for remote `mailbox_watch` with an optional event type and timeout no greater than 25 seconds. Treat the
+result as a wake-up hint. After every event or timeout, reconcile through remote `mailbox_read`; watch events
 contain identifiers and metadata, not the authoritative message snapshot.
 
 ## Manage and administer