@wrongstack/core 0.307.1 → 0.308.1

package/instructions/system.md

@@ -32,9 +32,18 @@ This parse is **internal reasoning**, not something you output. It keeps you anc
 ## Core principles
 
 1. **Read before you write.** Inspect the relevant files before proposing changes — assumptions about code you haven't read are bugs in waiting. When unsure about a file's current state, read it rather than guessing.
+<!--ws:if tool=codebase-skeleton-->
+   Inspect signatures, exports, and types with `codebase-skeleton` before a full file `read` to preserve context.
+<!--ws:end-->
+<!--ws:if tool=codebase-search-->
+   Search code symbols and concepts with `codebase-search` before broad `grep`/`glob`/`tree`.
+<!--ws:end-->
 <!--ws:if tool=codebase-incoming-calls-->
    When refactoring or tracing usages of a function/symbol, use `codebase-incoming-calls` instead of `grep` to find all callers instantly.
 <!--ws:end-->
+<!--ws:if tool=codebase-impact-analysis-->
+   Run `codebase-impact-analysis` before changing a public signature or type to gauge blast radius.
+<!--ws:end-->
 <!--ws:if tool=edit,write-->
 2. **Prefer surgical edits over rewrites.** Modify existing files with the live mutation tools; prefer a surgical edit over a full replacement.
 <!--ws:else-->
@@ -121,7 +130,7 @@ Parking records that a card needs something you do not have; it never sheds scop
 
 | Need | Tool | When |
 |---|---|---|
-| **Any actionable project work** | **`kanban`** | Mandatory durable execution record, from one atomic leaf to a multi-board programme |
+| **Substantial or multi-step project work** | **`kanban`** | Mandatory durable execution record, from one atomic leaf to a multi-board program |
 | Compact active-task view | `todo` | UI projection of real Kanban task ids; never a second task store |
 | Strategic explanation | `plan` | Optional roadmap linked to the board; execution remains in Kanban |
 | Cross-session reference | `task` | Optional external reference; the executable work remains in Kanban |
@@ -192,9 +201,12 @@ No task-tracking tool is registered in this request. Keep multi-step work visibl
 
 Your capabilities arrive as tool groups, each with a distinct purpose. The groups below are the ones registered for **this** request; a group whose tools are absent is omitted rather than described. The live provider tool definitions remain authoritative for exact names and parameters.
 
-<!--ws:if tool=read,edit,write,patch,replace,glob,grep,tree,diff,json,logs,codebase-search,codebase-incoming-calls,codebase-outgoing-calls,codebase-skeleton,codebase-repo-map,codebase-ast-replace,codebase-impact-analysis,codebase-invariant-check-->
+<!--ws:if tool=read,edit,write,patch,replace,glob,grep,tree,diff,json,logs,clarify,codebase-search,codebase-incoming-calls,codebase-outgoing-calls,codebase-skeleton,codebase-repo-map,codebase-ast-replace,codebase-impact-analysis,codebase-invariant-check-->
 ### Filesystem & Project insight
-{{tools:read,edit,write,patch,replace,glob,grep,tree,diff,json,logs,codebase-ast-replace,codebase-impact-analysis,codebase-invariant-check}}
+{{tools:read,edit,write,patch,replace,glob,grep,tree,diff,json,logs,clarify,codebase-ast-replace,codebase-impact-analysis,codebase-invariant-check}}
+<!--ws:if tool=clarify-->
+- `clarify` only when an architectural fork is truly irreversible or destructive with no obvious standard default. Otherwise, autonomously apply industry best practices, advance through next steps, and state decisions in your final response.
+<!--ws:end-->
 <!--ws:if tool=codebase-search-->
 - Prefer `codebase-search` before broad `grep`/`glob`/`tree` exploration for code understanding.
 <!--ws:else-->
@@ -234,10 +246,13 @@ Your capabilities arrive as tool groups, each with a distinct purpose. The group
 <!--ws:end-->
 <!--ws:end-->
 
-<!--ws:if tool=lint,format,typecheck,test,codebase-targeted-test,e2e_plan,language,language_info,language_package-->
+<!--ws:if tool=lint,format,typecheck,test,codebase-targeted-test,security-ast-scan,e2e_plan,language,language_info,language_package-->
 ### Code quality
-{{tools:lint,format,typecheck,test,codebase-targeted-test,e2e_plan,language,language_info,language_package}}
+{{tools:lint,format,typecheck,test,codebase-targeted-test,security-ast-scan,e2e_plan,language,language_info,language_package}}
 - Run the narrowest appropriate verification from the tools above before calling changed code complete.
+<!--ws:if tool=security-ast-scan-->
+- `security-ast-scan` to detect contract-based security and performance flaws (N+1 database queries, SQL injection, hardcoded secrets, prototype pollution, ReDoS, unsafe eval) on new or edited code.
+<!--ws:end-->
 <!--ws:if tool=codebase-targeted-test-->
 - `codebase-targeted-test` immediately after mutating a symbol or file — run only the covering suites.
 <!--ws:end-->
@@ -252,12 +267,15 @@ Your capabilities arrive as tool groups, each with a distinct purpose. The group
 <!--ws:end-->
 <!--ws:end-->
 
-<!--ws:if tool=bash,exec-->
+<!--ws:if tool=bash,exec,pwsh-->
 ### Execution
-{{tools:bash,exec}}
+{{tools:bash,exec,pwsh}}
 <!--ws:if tool=exec-->
 - `exec` is the safer shell tool — use it when the command is allowlisted (node, git, pnpm, tsc, etc.) and needs no pipes/redirection.
 <!--ws:end-->
+<!--ws:if tool=pwsh-->
+- `pwsh` to run PowerShell 7 commands on Windows in a stateless process with native paths (`C:\...`), `$env:VAR`, and core cmdlets. Pass `workdir` instead of `cd`.
+<!--ws:end-->
 <!--ws:if tool=bash-->
 - `bash` for everything else — pipes, redirection, full shell access.
 <!--ws:end-->
@@ -275,9 +293,9 @@ Your capabilities arrive as tool groups, each with a distinct purpose. The group
 <!--ws:end-->
 <!--ws:end-->
 
-<!--ws:if tool=remember,forget,memory_search,memory_graph,memory_update,memory_delete,pin_add,pin_remove,pin_list-->
+<!--ws:if tool=remember,forget,memory_search,memory_graph,memory_update,memory_delete,memory_candidates,memory_for_file,memory_for_path,pin_add,pin_remove,pin_list-->
 ### Memory & Knowledge
-{{tools:remember,forget,memory_search,memory_graph,memory_update,memory_delete,pin_add,pin_remove,pin_list}}
+{{tools:remember,forget,memory_search,memory_graph,memory_update,memory_delete,memory_candidates,memory_for_file,memory_for_path,pin_add,pin_remove,pin_list}}
 <!--ws:if tool=remember-->
 - Use **remember** for durable conventions, decisions, preferences, and important codebase facts — not for every transient detail.
 <!--ws:end-->
@@ -387,9 +405,9 @@ A worker that realizes its task will run long should mail the leader (type `stee
 - Automatically injected raw mail is visible for one model evaluation only. Preserve a concise conclusion/action when it matters later; otherwise absorb it and continue without quoting or restating it.
 <!--ws:end-->
 
-<!--ws:if tool=browser_open,browser_navigate,browser_snapshot,browser_click,browser_type,browser_screenshot,browser_evaluate-->
+<!--ws:if tool=browser_open,browser_navigate,browser_snapshot,browser_click,browser_type,browser_select,browser_press,browser_screenshot,browser_close,browser_evaluate-->
 ### Browser (E2E / UI testing)
-{{tools:browser_open,browser_navigate,browser_snapshot,browser_click,browser_type,browser_screenshot,browser_evaluate}}
+{{tools:browser_open,browser_navigate,browser_snapshot,browser_click,browser_type,browser_select,browser_press,browser_screenshot,browser_close,browser_evaluate}}
 <!--ws:if tool=browser_open-->
 - Use `browser_open` to launch an isolated Playwright session.
 <!--ws:end-->
@@ -399,6 +417,9 @@ A worker that realizes its task will run long should mail the leader (type `stee
 <!--ws:if tool=browser_screenshot-->
 - `browser_screenshot` for visual verification.
 <!--ws:end-->
+<!--ws:if tool=browser_select,browser_press,browser_close-->
+- `browser_select` / `browser_press` for form-like interactions; `browser_close` when the session is no longer needed.
+<!--ws:end-->
 <!--ws:end-->
 
 <!--ws:if tool=tool_search,tool_help,batch_tool_use,tool_use,set_working_dir,context_manager,mcp_control,mcp_use-->
@@ -749,6 +770,7 @@ Call live tools directly and let the permission flow decide — don't pre-announ
 - **Empty results are successes, not failures.** No matches / no lines / no output means the call worked and found nothing. Never repeat the identical call — interpret the result (empty read at offset = end of file; empty grep = no matches) and adjust.
 - **A denial is final.** If the user denies a tool call via the permission prompt, do not retry it and do not work around it with another tool. Acknowledge the denial and ask: "What would you like me to do instead?"
 - **Two failures in the same place means your model is wrong.** Stop iterating on the fix and re-read the source or the actual error — a third identical attempt is never the answer.
+- **Never expose or request secrets unnecessarily.** Refer to secrets by name or path, not by value, in logs, reports, and messages.
 <!--ws:if tool=context_manager-->
 - **Context filling up** → use `context_manager` proactively.
 <!--ws:else-->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/core",
-  "version": "0.307.1",
+  "version": "0.308.1",
   "license": "MIT",
   "description": "WrongStack core: kernel, types, defaults, and shared utilities for the WrongStack CLI agent.",
   "repository": {
@@ -181,8 +181,8 @@
   "wrongstackApiVersion": "0.1.10",
   "dependencies": {
     "zod": "4.4.3",
-    "@wrongstack/kanban": "0.307.1",
-    "@wrongstack/persistence": "0.307.1"
+    "@wrongstack/kanban": "0.308.1",
+    "@wrongstack/persistence": "0.308.1"
   },
   "devDependencies": {
     "@types/node": "^26.2.0",
@@ -198,6 +198,7 @@
     "build": "node ../../scripts/build-package.mjs",
     "build:prompts": "node scripts/build-prompts.mjs",
     "typecheck": "tsc --noEmit",
+    "test": "vitest run --root ../.. packages/core/tests",
     "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\""
   }
 }

package/skills/api-design/SKILL.md

@@ -4,7 +4,7 @@ description: |
   Use this skill when designing, reviewing, or refactoring REST APIs in WrongStack.
   Triggers: user says "API", "endpoint", "REST", "request", "response", "JSON",
   "HTTP", "status code", "pagination", "query params", "request body".
-version: 1.0.0
+version: 1.1.0
 required-capabilities: [filesystem.read]
 required-tools: []
 optional-capabilities: [filesystem.write, verification.run]
@@ -134,6 +134,31 @@ Body: { "status": "paused" }
 - **Session management**: Sessions are created/managed via the CLI, not a public REST API.
 - **MCP tools**: MCP servers expose tools, not REST endpoints — this skill is for any HTTP APIs WrongStack exposes.
 
+## Out of scope
+
+- **Don't design MCP tool surfaces here.** MCP servers expose tools, not REST endpoints. For tool registration, plugin contract, and tool description, see the `plugin-author` skill instead.
+- **Don't design WrongStack session management as a public API.** Sessions are created and managed through the CLI's internal tool wrappers, not a public REST surface. This skill is for the HTTP APIs WrongStack exposes outward.
+- **Don't ship inconsistent error shapes.** Every error uses `{ "error": { "code", "message", "details?" } }`. Variations break automation that depends on the shape.
+- **Don't put secrets in URLs.** `?apiKey=…` is a leak. Headers — `Authorization` and `X-API-Key` — are the only auth channels.
+- **Don't use offset pagination for large datasets.** Cursor-based only. Offset pagination breaks on insert/delete; gaps and duplicates follow.
+- **Don't return 200 for errors.** The status code is the contract; `200` with an error body lies about the outcome. Use the right code.
+- **Don't use singular nouns for collections.** `/sessions` not `/session`. The resource is the set; the item is `/sessions/:id`.
+- **Don't ship breaking changes without a `/v1/` prefix.** Versioning is a contract with the consumer; renames are breaking.
+- **Don't accept client-side validation as a substitute.** Validate on the server, return `400` with field-level errors. The client is an untrusted input source.
+
+## Before returning
+
+- [ ] Conventional HTTP status codes used; no `200` for errors
+- [ ] Error shape consistent: `{ "error": { "code", "message", "details? } }`
+- [ ] Plural nouns for resources; `/v1/` prefix for breaking-change endpoints
+- [ ] Cursor-based pagination for large datasets, not offset
+- [ ] Auth in headers (`Authorization: Bearer`, `X-API-Key`); no secrets in URLs
+- [ ] Server-side validation with `400` + field-level errors
+- [ ] Idempotency rules followed: `POST` creates, `PUT` replaces
+- [ ] `sdd` spec opened for non-trivial endpoints before coding
+- [ ] `security-scanner` run on the implementation
+- [ ] `<nextsteps>` mirrors the open follow-ups in priority order
+
 ## Skills in scope
 
 - `sdd` — for spec-driven API design with acceptance criteria

package/skills/audit-log/SKILL.md

@@ -4,7 +4,7 @@ description: |
   Use this skill when analyzing WrongStack session logs, event streams, or
   system traces to surface patterns, anomalies, or operational insights.
   Triggers: user says "audit", "session analysis", "log analysis", "usage patterns".
-version: 1.2.0
+version: 1.3.0
 required-capabilities: [filesystem.read, code.inspect]
 required-tools: [bash, exec, grep, read]
 ---
@@ -170,6 +170,27 @@ Investigate iterations 14–20 in the session log for the bash command timeout p
 - **Don't ignore cost trends** — growing costs indicate context bloat
 - **Don't ignore repeated failures** — same tool failing 5x = real issue
 
+## Out of scope
+
+- **Don't summarize sessions you didn't parse.** Cite the data: iteration, tool name, error message. Reports without counts and citations are guesses.
+- **Don't mix sessions without labeling.** Either analyze one session at a time, or aggregate with clear per-session breakdown. Combined-with-no-labels is fake coverage.
+- **Don't treat repeated failures as noise.** Same tool failing 5+ times is a real issue, not background. Report the concentration.
+- **Don't ignore cost trends.** A spike from $0.04/iter to $0.11/iter means context growth, not a model change. Cost trend is a leading indicator.
+- **Don't claim a cost cause you didn't verify.** "Probably the model is more expensive" is not analysis. State the iteration, the token count, the file reads, and the cause the data supports.
+- **Don't run live session mutations.** This skill is read-only over the JSONL stream. No state changes to sessions, no live editing of logs.
+- **Don't bypass session boundaries.** Each session's events stand on their own; cross-session analysis is a separate scope, not a free hand to mix.
+
+## Before returning
+
+- [ ] Parsed from the source JSONL, not from summaries or memory
+- [ ] One session analyzed at a time, or aggregate with explicit per-session labels
+- [ ] Every claim cites the data: iteration number, tool name, error message, cost figure
+- [ ] Repeated failures (same tool, 5+ times) called out, not folded into noise
+- [ ] Cost trend reported in context of iteration count, not in isolation
+- [ ] No session log mutated; read-only held
+- [ ] Summary counts match the findings listed; nothing padded
+- [ ] Anomalies named with a probable cause the data supports
+
 ## Skills in scope
 
 - `bug-hunter` — for turning audit findings into concrete bugs to fix

package/skills/auto-review/SKILL.md

@@ -6,7 +6,7 @@ description: |
   code change during a session.
   Triggers: user says "auto review", "otomatik review", "auto code review",
   "her değişiklikte review", "/auto-review".
-version: 2.0.0
+version: 2.1.0
 required-capabilities: [version-control.manage]
 required-tools: [git]
 optional-capabilities: [fleet.delegate, verification.run]
@@ -106,6 +106,26 @@ and `maxCascadeDepth` config values are compatibility-only and resolve to the
 passive policy. The user can inspect the mailbox and explicitly ask the leader
 to act later.
 
+## Out of scope
+
+- **Don't enable auto-review without `--director`.** The subagent pipeline requires Director mode; without it, review events silently skip. Verify the director is on before flipping the plugin.
+- **Don't start the plugin while a session is mid-flight without a clear contract.** Auto-review dispatches reviewers at trailing-quiet windows; the user has to know it's running.
+- **Don't read untracked files.** `??` files are never reviewed. If a reviewer needs a file, the workflow must have it staged or tracked first.
+- **Don't manually trigger a fix from a report.** Auto-review is passive — the report goes to the mailbox and notifies UIs. A follow-up fix is a separate user-initiated turn.
+- **Don't re-route the report to mailbox peers or the leader.** Runtime handles persistence and notification. Manual mailbox traffic from auto-review is double-handling.
+- **Don't tune `maxFilesPerBatch` above 15** without measuring cost. Larger batches cut parallelism gains and inflate single-review latency.
+- **Don't set the debounce below 5s.** Too-aggressive debounce starts reviews while the user is still mid-edit; they hit a reviewer they didn't ask for.
+
+## Before reporting
+
+- [ ] `--director` mode is on (auto-review requires it)
+- [ ] `enabled: true` is set in `config.extensions['wstack-auto-review']`
+- [ ] `git` is available in the session working directory
+- [ ] Only git-tracked files are reviewed; untracked files skipped
+- [ ] Reports go to the mailbox + `chimera.report_available` notification, not to peer mail
+- [ ] No mutating follow-up spawned from the report (passive completion)
+- [ ] Debounce and `maxFilesPerBatch` tuned for the workload, not at default
+
 ## Skills in scope
 
 - `chimera` — for the review output format and severity rules

package/skills/bug-hunter/SKILL.md

@@ -280,6 +280,14 @@ sizing and briefing rules before dispatching.
 
 ---
 
+## Out of scope
+
+- **Don't fix the bugs you find in default mode.** Standalone scans produce a report only. Apply fixes only when the user explicitly asks, or when the runtime dispatches you as a cascade agent behind chimera.
+- **Don't review code quality, design, or style.** Wrong file, wrong skill. Quality and design are `chimera`'s read-only lane; style is the linter's job. Hand off to `chimera` for read-only quality review, or to `refactor-planner` for multi-file restructuring.
+- **Don't run dependency audits or scan `node_modules`.** Supply chain and lockfile scanning are `security-scanner`'s lane. Hand off cleanly.
+- **Don't write tests for the bugs you find.** Test authoring is `testing`'s lane. State the failing test that would catch the bug; don't write it.
+- **Don't start a `multi-agent` fan-out on your own.** The leader decides when fan-out is the right tool. Report the size of the target; let the leader dispatch.
+
 ## Skills in scope
 
 - `security-scanner` — for hardcoded secrets and injection vectors

package/skills/chimera/SKILL.md

@@ -246,6 +246,15 @@ files you were never shown is worse than an honest gap.
 
 ---
 
+## Out of scope
+
+- **Don't mutate files.** This skill is strictly read-only. If the user wants fixes applied, hand the report to `bug-hunter` (cascade mode) or `security-scanner`. Never edit, write, format, rename, or delete.
+- **Don't review code style, formatting, naming, or lint findings.** Those are the linter's job and add noise without value. Quality and behavioral findings only.
+- **Don't re-litigate decisions the session already discussed.** If the session chose a tradeoff, the choice is final for this review. Cite "session discussed" in the fix line and move on.
+- **Don't expand scope to files outside the provided list.** The file list is the boundary. Pre-existing code in a changed file is fair game only when the change made it reachable, worse, or invalidated its assumptions — say so.
+- **Don't send mailbox messages to peers, the user, or broadcast.** Runtime handles persistence and notification. Mail to `to="leader"` with `audience="leaders"` is the only acceptable exception, and only when a blocker cannot wait.
+- **Don't trigger a re-review loop, fix agent, or mutating follow-up.** The report is terminal. Legacy `autoFix`/`cascadeOn`/`maxCascadeDepth` do not authorize a leader turn.
+
 ## Skills in scope
 
 - `bug-hunter` — for systematic bug detection patterns

package/skills/data-governance/SKILL.md

@@ -6,7 +6,7 @@ description: |
   WrongStack services and stores.
   Triggers: user says "data governance", "PII", "schema ownership", "retention policy", "data lineage", "migration safety".
 trigger: Use when designing or reviewing schema ownership, PII handling, retention, data lineage, access policy, or migration safety.
-version: 1.0.0
+version: 1.1.0
 required-capabilities: [filesystem.read]
 required-tools: []
 optional-capabilities: [code.inspect]
@@ -87,6 +87,30 @@ db.query('SELECT email FROM users WHERE ...'); // from a service that doesn't ow
 - **Don't ship destructive migrations without rollback** — every change is reversible until proven otherwise
 - **Don't treat "internal" as "not sensitive"** — internal data still needs access policy and retention
 
+## Out of scope
+
+- **Don't log restricted fields at any call site.** Redaction lives at the serialization boundary, not at each `logger.info(user)`. A single missed redaction is a PII leak.
+- **Don't share tables across services.** Cross-service reads against a table you don't own bypass the owning service's policy. Use the owning service's API.
+- **Don't ship destructive migrations without a rollback plan.** One-phase drops are not policy. Deprecate → drop across releases, with a documented rollback.
+- **Don't classify "internal" as "not sensitive".** Internal data still needs access policy and retention. The four classes are `public`, `internal`, `sensitive`, `restricted` — they each carry different obligations.
+- **Don't design retention ad hoc.** Every persisted entity has an explicit TTL or purge cadence, and an honored right-to-erase path. "Keep forever" is not a policy.
+- **Don't invent lineage in the application code.** Derived data records its source columns and versions in the schema, not in scattered comments. Lineage is queryable.
+- **Don't accept "two services writing the same table" as a stopgap.** Orphaned ownership is a finding, not a workaround. Pick an owner; migrate the other side to the API.
+- **Don't pass through the migration without a dry-run.** Phase 1 forward + Phase 1 rollback + verification are required before Phase 2 ships.
+
+## Before returning
+
+- [ ] Every persisted entity has exactly one owning service; cross-service access goes through that service's API
+- [ ] Every field classified as public / internal / sensitive / restricted
+- [ ] Restricted fields encrypted at rest; redacted at the serialization boundary
+- [ ] No restricted fields in logs, errors, or stack traces
+- [ ] Schema changes have forward migration + documented rollback
+- [ ] Destructive changes are two-phase: deprecate → drop across releases
+- [ ] Retention TTL/purge cadence explicit per entity; right-to-erase path verifiable
+- [ ] Derived data records source columns/versions; lineage queryable
+- [ ] Dry-run run on the migration before Phase 2 ships
+- [ ] `<nextsteps>` lists each open migration, classification gap, or retention fix
+
 ## Skills in scope
 
 - `security-scanner` — for encryption-at-rest, secret handling, and access-control review

package/skills/design-system/SKILL.md

@@ -15,7 +15,7 @@ description: |
   "make it look better", "clean up the layout", "it looks generic", "match our
   brand", "add dark mode". Trigger even when the user never says the word
   "design" — if the output has pixels, this skill runs first.
-version: 2.0.0
+version: 2.1.0
 required-capabilities: [filesystem.read, filesystem.write, documentation.author]
 required-tools: [design]
 optional-capabilities: [browser.interact]
@@ -291,6 +291,16 @@ made and re-litigating them wastes everyone's time.
 
 ---
 
+## Out of scope
+
+- **Don't ship unstyled framework defaults.** Default Tailwind, default shadcn, stock Bootstrap, or "I'll pick colors as I go" all produce forgettable UI with no source of truth. The Design Studio engine is the path; skipping it is a fail.
+- **Don't write UI before committing a kit.** Picking a kit is the first step. Code that exists before a kit has been committed is exactly the code that needs restyling, not patching.
+- **Don't hand-tune individual tokens to fix one-off screens.** Knobs (`radius`, `density`, `font`, `motion`) rescale the whole system coherently. A hand-edited radius leaves five scale steps untouched; the result reads as sloppy.
+- **Don't use framework palette colors directly.** `bg-blue-500`, `text-gray-700`, `dark:bg-slate-900` are not part of the kit and break dark mode. Use the semantic tokens the materialized file exposes.
+- **Don't override foundations.** Accessibility, responsiveness, reduced motion, and WCAG 2.2 AA are the floor. No kit or user override lowers them.
+- **Don't restyle shadcn primitives per-usage.** They inherit the kit once the theme file is imported. Restyle at the token level, not per screen.
+- **Don't deliver a UI without light + dark + every interactive state.** Default, hover, `:focus-visible`, active, disabled, loading, empty, error. A happy-path-only screen is an unfinished screen.
+
 ## Before saying you're done
 
 - Kit committed with the correct `stack`, and named to the user.
@@ -300,3 +310,11 @@ made and re-litigating them wastes everyone's time.
 - Interactive states and empty/loading/error states present.
 - Keyboard path works; focus rings visible.
 - `design {action:"verify"}` clean.
+
+## Skills in scope
+
+- `react-modern` — for React 19+ component patterns that consume the tokens
+- `typescript-strict` — for typing theme constants, `lightTheme` / `darkTheme` exports
+- `plugin-author` — when shipping a tool that emits design-system output
+- `output-standards` — for the `<nextsteps>` shape in design audit / verify reports
+- `sdd` — for spec-driven design system work that crosses packages

package/skills/docker-deploy/SKILL.md

@@ -5,7 +5,7 @@ description: |
   with Docker. Triggers: user says "docker", "container", "dockerfile",
   "image", "docker-compose", "deploy", "containerize", "registry",
   "multi-stage", "distroless".
-version: 1.0.0
+version: 1.1.0
 required-capabilities: [filesystem.read, filesystem.write, execution.shell]
 required-tools: []
 ---
@@ -149,6 +149,31 @@ trivy image --exit-code 1 --ignore-unfixed --severity HIGH,CRITICAL wrongstack:$
 - **Session storage**: Sessions are stored at `WRONGSTACK_SESSION_ROOT` — mount a volume for persistence.
 - **Config**: Config is at `WRONGSTACK_CONFIG_DIR` — mount for config persistence across restarts.
 
+## Out of scope
+
+- **Don't run as root in the container.** A non-root user is mandatory. A container compromise that lands root on the host is the failure this rule exists to prevent.
+- **Don't use `node:latest` or unversioned base images.** Pin to `node:22-alpine` (or current). Reproducibility starts at the base.
+- **Don't bake secrets into the image.** Pass via environment variables at runtime. A `RUN echo $API_KEY > /app/config.key` is a permanent secret in the image layer.
+- **Don't skip the `.dockerignore`.** Without it, `node_modules`, `dist`, `.git`, and `*.test.ts` end up in the image — bigger, slower, more attack surface.
+- **Don't tag production images `latest`.** Tag with the git SHA. `latest` is a moving target; production needs a specific commit.
+- **Don't ship without a `HEALTHCHECK`.** Orchestrators need a probe; an image without one can't be load-balanced cleanly.
+- **Don't skip image scanning.** `trivy image` or `docker scout` before push. Critical vulnerabilities are blocking.
+- **Don't mix build and runtime stages.** Multi-stage is the rule: build with dev deps, runtime with production deps only. A 1GB image is a build hygiene failure.
+- **Don't deploy without persistent volume mounts.** Sessions at `WRONGSTACK_SESSION_ROOT` and config at `WRONGSTACK_CONFIG_DIR` need volumes; container restarts lose data otherwise.
+
+## Before returning
+
+- [ ] Multi-stage build; runtime stage is production-deps only
+- [ ] Base image pinned to a specific tag (`node:22-alpine`, not `latest`)
+- [ ] Non-root user; `USER wrongstack` set before `ENTRYPOINT`
+- [ ] Secrets via env at runtime, not baked into the image
+- [ ] `.dockerignore` excludes `node_modules`, `dist`, `.git`, `*.test.ts`
+- [ ] Image tagged with git SHA, not `latest`
+- [ ] `HEALTHCHECK` directive points to the CLI's self-check command
+- [ ] `trivy image` or `docker scout` run before push; critical vulns blocked
+- [ ] Volumes mounted for `WRONGSTACK_SESSION_ROOT` and `WRONGSTACK_CONFIG_DIR`
+- [ ] Build runs from repo root with `pnpm build` before `docker build` (workspace order)
+
 ## Skills in scope
 
 - `security-scanner` — for scanning Dockerfiles and container configs for vulnerabilities

package/skills/git-flow/SKILL.md

@@ -4,7 +4,7 @@ description: |
   Use this skill when proposing, reviewing, or troubleshooting git commits,
   branches, pull requests, or merge strategies in a WrongStack project session.
   Triggers: user mentions "commit", "branch", "PR", "merge", "rebase", "stash", "diff".
-version: 1.2.0
+version: 1.3.0
 required-capabilities: [version-control.manage]
 required-tools: [test]
 ---
@@ -154,6 +154,31 @@ git rebase main && git merge --ff-only feature
 Open a PR at GitHub linking to issue #123 with the commit message describing the fix.
 ```
 
+## Out of scope
+
+- **Don't force-push shared branches.** `--force-with-lease` on your own branch is the cap; shared branches get a PR + merge, never a force.
+- **Don't commit lockfile changes with logic changes.** Separate commits, separate rollbacks. A lockfile muddied with a feature commit is impossible to bisect.
+- **Don't make "Update stuff" mega-commits.** One concern per commit. 15 packages in one commit is process for process's sake.
+- **Don't branch from branches.** Always branch from `main` or a stable release tag. Branching from a feature branch is git history debt.
+- **Don't write a "what" commit message.** "fix: fixed bug" tells the reader nothing. Subject ≤ 72 chars, imperative mood, body explains why.
+- **Don't `git reset --hard` with uncommitted work.** Stash first. A hard reset that loses work is the kind of incident a `git-flow` skill exists to prevent.
+- **Don't amend a pushed commit.** It rewrites shared history. Open a follow-up commit or revert.
+- **Don't leave WIP commits on `main`.** Use `git stash` or a feature branch, not a commit message like "WIP".
+- **Don't skip self-review.** Self-review the diff before requesting review. Sending a diff the author hasn't read wastes the reviewer's time.
+
+## Before returning
+
+- [ ] Branch is from `main` or a stable release tag, not from another feature branch
+- [ ] One concern per commit; lockfile changes isolated
+- [ ] Subject ≤ 72 chars, imperative, no trailing period; body explains why
+- [ ] Issue reference included (`Fix #123` or `Closes GH-456`)
+- [ ] Self-review done before requesting review
+- [ ] No `git push --force` to shared branches; `--force-with-lease` only on own branch
+- [ ] Branch deleted after merge (unless shared or releasing)
+- [ ] PR title follows commit format; body links the issue and lists changed files
+- [ ] No `WIP` or "Update stuff" commits in the history
+- [ ] `<nextsteps>` mirrors the recommended commit/PR actions
+
 ## Skills in scope
 
 - `refactor-planner` — when a refactor involves multiple git-managed changes

package/skills/mailbox-bridge/SKILL.md

@@ -8,7 +8,7 @@ description: |
   bridge". Starts a loopback HTTP façade over the same GlobalMailbox that
   WrongStack-internal agents already share, so any agent with curl or
   fetch can read, send, and acknowledge messages.
-version: 1.0.0
+version: 1.1.0
 required-capabilities: [execution.shell]
 required-tools: []
 optional-capabilities: [web.research]
@@ -342,6 +342,30 @@ is 15 s.
   audit trails of which external agent called which route are needed,
   the agent itself should log them client-side.
 
+## Out of scope
+
+- **Don't expose the bridge on `0.0.0.0` without a trusted reverse proxy.** Loopback binding makes "reach" require shell access on the host. LAN exposure without re-authentication and rate-limiting at the proxy is a trust leak.
+- **Don't log the bearer token.** The structured `mailbox_serve_started` event includes bind URL, port, project dir, and token path — never the token itself. Logging it once is a permanent compromise.
+- **Don't treat the bearer as identity-bound.** Every caller uses the same project token. The bridge does not separately authorize `steer`/control messages or prevent impersonation; the caller can claim any `from`, `type`, or `readerId`. Add an identity-aware trusted proxy before exposing beyond mutually trusted local clients.
+- **Don't expose the filesystem, shell, or non-mailbox tools through the bridge.** It is the mailbox surface only. If a caller needs more, they need a different bridge.
+- **Don't start the bridge for an external agent that already speaks MCP natively.** Use `wstack mcp serve` to expose WrongStack's full tool registry including the mailbox tool. Two bridges for the same purpose is operational debt.
+- **Don't run as a long-lived daemon for the caller.** The bridge is short-lived; spawn it for the duration of the caller's session and let it exit. `mbWithBootstrap()` is the pattern.
+- **Don't hardcode a token into prompts or committed code.** Read it from `.mailbox.token` or accept it from the environment; re-read after a 401.
+- **Don't send `control` messages through the bridge.** Control is a runtime-only surface; the bridge doesn't expose it, and the only legitimate override is `steer` via the `mailbox_manage` route, not through the bridge.
+
+## Before returning
+
+- [ ] `wstack mailbox serve` (or `mbWithBootstrap`) used; no parallel implementation
+- [ ] Bind address is `127.0.0.1` unless behind a reverse proxy that re-authenticates
+- [ ] Bearer token read from `.mailbox.token` or env, not hardcoded
+- [ ] Token not present in any log line, event, or error message
+- [ ] Body cap of 256 KB enforced; rate limit of 120/min/token enforced
+- [ ] `/healthz` reachable; no auth or rate limit on the health probe
+- [ ] Pair with `wrongstack-mailbox` skill for external-agent usage
+- [ ] Graceful shutdown handles SIGINT/SIGTERM, flushes the cache, unlinks the token
+- [ ] Mailbox health watchdog wired if running unattended
+- [ ] No `control` messages; `steer` only via the canonical `mailbox_manage` route
+
 ## Skills in scope
 
 - `prompt-engineering` — for the external-facing `wrongstack-mailbox`

package/skills/mnemosyne/SKILL.md

@@ -4,7 +4,7 @@ description: |
   Use when curating WrongStack SAGE memory: run deterministic hygiene and
   anchor verification first, then review contradictions, drift, and noise;
   file destructive outcomes as review proposals instead of deleting directly.
-version: 1.1.0
+version: 1.2.0
 required-capabilities: [memory.manage, memory.curate]
 required-tools: [cron_cancel, cron_schedule, mail_send, mailbox, memory_candidates, memory_delete, memory_hygiene, memory_search, memory_update, memory_verify, skill]
 ---
@@ -102,7 +102,7 @@ memory_candidates({
 })
 ```
 
-Never call `memory_delete`, never set `status: "deleted"`, and never set
+Never trigger `memory_delete`, never set `status: "deleted"`, and never set
 `status: "archived"` as part of an autonomous Mnemosyne cycle. The user owns
 the later `memory_candidates({ action: "resolve", ... })` decision.
 
@@ -149,6 +149,29 @@ tools are absent, run on demand instead.
 - Never advertise commands, config keys, background services, or tools that
   are not present in the live runtime.
 
+## Out of scope
+
+- **Don't delete or archive memories autonomously.** `memory_delete` and `status: "deleted"` / `"archived"` are not part of an autonomous Mnemosyne cycle. File `memory_candidates` proposals and let the user resolve.
+- **Don't re-author untouched memories to bump timestamps.** A memory that passes review stays as it is. Bumping timestamps corrupts recency signals and churns the store.
+- **Don't skip the deterministic pass.** Hygiene, anchor verification, and supersede/stale marking are run before any LLM analysis. The LLM is a bounded second pass over deterministic results, not a replacement.
+- **Don't infer absence from a missing search result.** A search miss is not proof a memory doesn't exist. Report what was searched; let deterministic checks carry the absence claim.
+- **Don't claim a successful broadcast or scheduled cycle that didn't run.** If the mailbox or cron tools are absent, say so. Never invent a successful delivery or a scheduled job.
+- **Don't describe cron as a persistent daemon.** Cron jobs belong to the live runtime; they must be inspected and cancelled through the cron tools. The skill is session-scoped.
+- **Don't bypass store protections with `force`.** Permanent and high-importance memories receive extra scrutiny. Bypassing protections is a bug, not a feature.
+- **Don't use it as a generic memory CRUD layer.** Mnemosyne is the curation workflow. Direct memory creation/update without going through the workflow is the wrong lane.
+
+## Before returning
+
+- [ ] `memory_hygiene({ verify: true })` ran first; counts captured
+- [ ] Non-zero `deleted` or `archived` counters treated as a bug and reported
+- [ ] Bounded semantic review searched related memories, not whole store
+- [ ] Direct updates only for non-terminal corrections (text, classification, confidence, `stale`, supersede/contradict links)
+- [ ] Deletion or archival recommendations filed as `memory_candidates` proposals, not applied
+- [ ] Every proposal includes a supported `reason`
+- [ ] Report contains trigger, counts, safe corrections, proposals, errors
+- [ ] Broadcast only when mailbox tools are registered and coordination is active
+- [ ] No claim of scheduled cycle or broadcast that didn't actually run
+
 ## Skills in Scope
 
 - `auto-review` — bounded background-review and reporting patterns.

package/skills/multi-agent/SKILL.md

@@ -351,6 +351,18 @@ session that dies halfway — and they let you synthesize as you go.
 
 ---
 
+## Out of scope
+
+- **Don't fan out a single atomic task.** One task is one agent. Subagent overhead exceeds the benefit below ~5 tool calls per subtask.
+- **Don't fan out work that needs shared mutable state.** Subagents share nothing — no memory, no session state, no variable scope. If two subtasks would read or write the same thing, they don't fan out.
+- **Don't fan out work with sequential dependencies.** Worker 2 needing worker 1's output means either chain it inside one agent, or use the fleet pattern with explicit hand-off. One-shot fan-out fails on dependencies.
+- **Don't write briefs by reference.** "Audit the file we discussed" — the worker has no idea. Include exact scope, the specific question, definition of done, return format, and boundaries.
+- **Don't dispatch workers one turn at a time.** Serialized fan-out throws away the only thing parallelism was for. Fire the whole batch in one turn.
+- **Don't ignore `budget_exhausted`.** Partial results are still results. Re-split and retry; never silently absorb a failure into a clean-looking report.
+- **Don't present partial coverage as complete.** A 7-of-10 fleet is a partial audit. Naming the missing three is the only way the user keeps trusting the report.
+- **Don't pick a role that doesn't match the task.** A `bug-hunter` writing docs or a `refactor-planner` running a security audit produces confident output shaped by the wrong priorities — worse than no output.
+- **Don't fan out "because the context is too big".** With 200K–1M windows, work that used to need splitting now fits. Fan out for wall-clock time and genuinely independent attention, not for size.
+
 ## Skills in scope
 
 - `bug-hunter` — parallel file audits

package/skills/node-modern/SKILL.md

@@ -4,7 +4,7 @@ description: |
   Use this skill when writing, reviewing, or refactoring Node.js >= 22
   TypeScript code in WrongStack. Triggers: ESM imports, fetch usage, AbortSignal,
   node: protocol, Web Streams, or any async patterns.
-version: 1.1.0
+version: 1.2.0
 required-capabilities: [filesystem.read, filesystem.write]
 required-tools: []
 optional-capabilities: [verification.run]
@@ -185,6 +185,33 @@ while (true) {
 }
 ```
 
+## Out of scope
+
+- **Don't use `require()`.** ESM only. `import { x } from './y.js'` with the `.js` extension, even in TS source.
+- **Don't use axios, node-fetch, or got.** Native fetch is sufficient. Third-party HTTP clients are an obsolete layer.
+- **Don't call fetch without `AbortSignal.timeout()`**. Every long-running operation needs a timeout. A request that hangs forever is a CI failure waiting to happen.
+- **Don't use `__dirname` directly in ESM.** ESM doesn't have it. `path.dirname(fileURLToPath(import.meta.url))` is the replacement.
+- **Don't mix callback `fs` with `await`.** Callback APIs don't return promises. Use `fs.promises.*` for `await`able access.
+- **Don't swallow `AbortError` silently.** An `AbortError` means a timeout or abort — it is signal, not success. Log it or handle it explicitly.
+- **Don't trust `process.cwd()` blindly.** It may not match the user's cwd. Accept `cwd` as a parameter and default sensibly.
+- **Don't use setTimeout for cancellable delays in new code.** `setTimeout(handler, ms, { signal })` (Node 22+) is the cancellable form.
+- **Don't write non-atomic file updates.** Use the write-temp + rename pattern. A crash mid-write leaves the file in an indeterminate state otherwise.
+- **Don't enable axios or got for "familiarity".** Node 22+ ships everything you need.
+
+## Before returning
+
+- [ ] ESM only; no `require()`, no `module.exports`
+- [ ] All relative imports use the `.js` extension
+- [ ] Built-in modules imported via the `node:` protocol (`node:fs/promises`, `node:http`, `node:path`)
+- [ ] fetch carries `AbortSignal.timeout()` for any operation that can wait
+- [ ] `__dirname` replaced with `path.dirname(fileURLToPath(import.meta.url))`
+- [ ] `fs.promises.*` for awaited file access; no callback `fs`
+- [ ] `AbortError` caught and handled explicitly, not swallowed
+- [ ] `cwd` accepted as parameter; `process.cwd()` is not a default
+- [ ] File writes atomic: `writeFile(tmp)` + `rename(tmp, target)`
+- [ ] `Promise.allSettled` for parallel tasks where partial failure is acceptable
+- [ ] `<nextsteps>` mirrors any open follow-up (timeout wiring, ESM migration, abort handling)
+
 ## Skills in scope
 
 - `typescript-strict` — strict TypeScript patterns