cfsa-antigravity 3.0.2 → 3.1.0

package/template/.codex/rules/tdd-contract-first.md

@@ -0,0 +1,67 @@
+---
+description: "{{CONTRACT_LIBRARY}} schema before implementation, failing test before code — Red Green Refactor every slice"
+trigger: always_on
+---
+
+# TDD & Contract-First Development
+
+> **The CFPA Order**: Contract (`{{CONTRACT_LIBRARY}}` schema) → Tests (failing) → Implementation (make them pass) → Never reverse this.
+
+## Contract-First: Schema Before Code
+
+Every data boundary gets a `{{CONTRACT_LIBRARY}}` schema **before** any implementation:
+
+| Scenario | Schema Required |
+|----------|----------------|
+| New API endpoint | Request/response schemas |
+| New DB model | Document/record schema |
+| New UI form | Form data schema |
+| New config | Configuration schema |
+| External integration | External data shape schema |
+
+### What Contract Tests Must Cover
+
+- ✅ Valid input accepted
+- ✅ Invalid input rejected with correct error
+- ✅ Edge cases (empty, null, boundary values)
+- ✅ Type coercion where applicable
+- ✅ Required vs optional fields
+
+## TDD: Tests ARE The Spec
+
+Every feature starts with a **failing test**:
+
+```
+Red → Green → Refactor
+```
+
+1. **Red**: Write a test that fails (proves the feature doesn't exist yet)
+2. **Green**: Write the minimum code to make it pass
+3. **Refactor**: Clean up without changing behavior
+
+### Five Test Levels
+
+| Level | What | When |
+|-------|------|------|
+| Contract | `{{CONTRACT_LIBRARY}}` schema validation | Every data boundary |
+| Permission | RBAC + ownership | Every protected resource |
+| Unit | Pure logic | Every function with logic |
+| Integration | Component interaction | Every API endpoint |
+| E2E | Full user flow | Every critical path |
+
+### Non-Negotiables
+
+- Tests pass before commit — **no exceptions**
+- Test file lives next to source: `foo.ts` → `foo.test.ts`
+- No `any` in test files — type your mocks
+- Coverage minimum: 80% lines, 90% branches on critical paths
+
+## What Gets Flagged
+
+| Pattern | Verdict |
+|---------|---------|
+| Implementation code written before schema | ❌ Rejected. Schema first. |
+| Tests written after implementation | ❌ Rejected. Red → Green → Refactor. |
+| `any` type in test file | ❌ Rejected. Type your mocks. |
+| Endpoint without contract validation test | ❌ Rejected. Add contract test. |
+| Schema → failing test → implementation → green | ✅ Correct. |

package/template/.codex/rules/vertical-slices.md

@@ -0,0 +1,83 @@
+---
+description: Features ship across all declared surfaces or they don't ship — no half-built slices
+trigger: always_on
+---
+
+# Vertical Slices
+
+## The Rule
+
+**A feature is not "done" until it works across all required surfaces.** No "backend done, frontend pending." No "user-facing works, admin can't manage it."
+
+## Surface Scope
+
+Every slice **must declare its surface scope** during `/plan-phase`. The surface scope defines which project surfaces (web, mobile, desktop, CLI, etc.) the slice targets. The 4-layer checklist applies **within each declared surface**, not globally across all surfaces.
+
+### Why Surface Scope Exists
+
+Multi-surface projects have features that are inherently single-surface:
+- A board-level component viewer is **desktop only** — forcing a web and mobile implementation violates the architecture
+- Push notifications are **mobile only** — there's no web surface for this feature
+- Some features launch **web-first** and port to desktop/mobile in later phases
+
+Surface scope prevents both failure modes:
+- ❌ **Under-scoping** — "backend done, frontend pending" within a declared surface
+- ❌ **Over-scoping** — forcing all surfaces when the architecture says otherwise
+
+### Surface Scope Rules
+
+1. **Every slice must declare its surface scope** during `/plan-phase`. No implicit scope — undeclared scope is rejected.
+2. **The 4-layer checklist applies within each declared surface.** A web-only slice must have all 4 layers complete for web. A desktop+mobile slice must have all 4 layers complete for both desktop and mobile.
+3. **Surface scope comes from the architecture**, not from convenience. If the architecture says a feature spans web and mobile, the slice must cover both (or be split into "web" and "mobile" slices with an explicit dependency).
+4. **Scope is locked at planning time.** Changing surface scope mid-implementation requires updating the phase plan — no silent scope reduction.
+
+### Web-First (or Surface-First) Strategy
+
+When a multi-surface feature launches on one surface first:
+- The first-surface slice is "done" when its 4 layers are complete within its declared scope
+- Ports to other surfaces are tracked as **separate dependent slices** in the phase plan
+- Each port slice has its own 4-layer checklist and its own surface scope declaration
+- Example: "User Profile — Web" (Phase 1) → "User Profile — Mobile" (Phase 2, depends on Web slice)
+
+## The Four Implementation Layers
+
+> **Note on terminology**: The layers below describe implementation completeness criteria — what every feature slice requires regardless of surface type. These are not the same as surface types (web/mobile/cli/etc.). For the mapping between surface types and how each implementation layer manifests on that surface, see `.codex/skills/prd-templates/references/surface-model.md`.
+
+| Surface | What It Is | Example |
+|---------|-----------|---------|
+| **User-Facing** | What the end user sees and interacts with | Dashboard, forms, data views |
+| **Admin** | Management interface for operators | User management, configuration |
+| **API** | Programmatic interface | REST/GraphQL endpoints |
+| **Data** | Database schemas, migrations, seed data | Tables, indexes, permissions |
+
+## What "Done" Looks Like
+
+A feature slice is complete when:
+
+- [ ] Surface scope declared in the phase plan (explicit list of target surfaces)
+- [ ] **For each declared surface:**
+  - [ ] Data layer: schema defined, permissions set, seed data exists
+  - [ ] API layer: endpoints exist, validated with {{CONTRACT_LIBRARY}}, tested
+  - [ ] User-facing: component renders, handles loading/error/empty states
+  - [ ] Admin: can create/read/update/delete the resource (if the feature has admin management)
+- [ ] Tests pass at all levels (contract, unit, integration, E2E)
+- [ ] Navigation: every new route is reachable from at least one navigation element
+- [ ] Auth gates: every route that requires auth has the auth gate implemented (not stubbed)
+- [ ] The feature is reachable from the app's entry point via normal user navigation
+- [ ] All declared surfaces complete — no partial surface delivery
+
+## What Gets Flagged
+
+| Pattern | Verdict |
+|---------|---------|
+| Slice with no declared surface scope | ❌ Rejected. Every slice must declare its surfaces during `/plan-phase`. |
+| "I'll add the admin panel later" | ❌ Rejected. Include admin CRUD in the slice (for features with admin management). |
+| "The API works, frontend next sprint" (within same surface) | ❌ Rejected. Ship them together or not at all. |
+| "Database is set up, just need endpoints" | ❌ Rejected. That's a layer, not a slice. |
+| Route without navigation link from existing UI | ❌ Rejected. Must be reachable. |
+| Auth-required route without auth gate | ❌ Rejected. Implement the gate. |
+| Desktop-only feature forced to have a web implementation | ❌ Rejected. Surface scope should match the architecture. |
+| Silently dropping a declared surface mid-implementation | ❌ Rejected. Update the phase plan or complete the surface. |
+| Web-first slice with all 4 layers complete for web, mobile tracked as separate slice | ✅ Correct. Surface-first strategy. |
+| Slice with declared scope and all layers complete within scope | ✅ Correct. |
+| All declared surfaces + tests + navigation + auth gates | ✅ Correct. |

package/template/.codex/skill-library/MANIFEST.md

@@ -0,0 +1,498 @@
+# Skill Library Manifest
+
+> This file maps tech stack decisions and project surface types to curated skills.
+> The `/bootstrap-agents` command reads this manifest to determine which skills to install.
+
+## How It Works
+
+1. A pipeline skill (e.g., `/create-prd`, `/iterate-plan`, `/add-feature`) makes a tech decision
+2. It calls `/bootstrap-agents` with the new stack key=value
+3. Bootstrap reads this manifest and finds matching skills
+4. Matching skills are copied from `.codex/skill-library/` → `.codex/skills/`
+5. Any `{{PLACEHOLDER}}`s inside the copied skills are filled with current values
+
+## Stack Triggers
+
+When a stack key matches a value pattern (case-insensitive), install the listed skills.
+
+### Databases
+
+| Stack Key | Value Pattern | Library Path | Installed As |
+|-----------|--------------|-------------|-------------|
+| `DATABASE` | `*surrealdb*` | `stack/databases/surrealdb-expert` | `surrealdb-expert` |
+| `DATABASE` | `*postgres*` OR `*pg*` | `stack/databases/postgresql` | `postgresql` |
+| `DATABASE` | `*supabase*` | `stack/databases/supabase` | `supabase` |
+| `DATABASE` | `*mongo*` | `stack/databases/mongodb` | `mongodb` |
+| `DATABASE` | `*redis*` | `stack/databases/redis` | `redis` |
+| `DATABASE_PRIMARY` | `*redis*` | `stack/databases/redis` | `redis` |
+| `DATABASE` | `*sqlite*` OR `*libsql*` OR `*turso*` | `stack/databases/sqlite` | `sqlite` |
+| `DATABASE_PRIMARY` | `*surrealdb*` | `stack/databases/surrealdb-expert` | `surrealdb-expert` |
+| `DATABASE_PRIMARY` | `*postgres*` OR `*pg*` | `stack/databases/postgresql` | `postgresql` |
+| `DATABASE_PRIMARY` | `*supabase*` | `stack/databases/supabase` | `supabase` |
+| `DATABASE_PRIMARY` | `*mongo*` | `stack/databases/mongodb` | `mongodb` |
+| `DATABASE_PRIMARY` | `*sqlite*` OR `*libsql*` OR `*turso*` | `stack/databases/sqlite` | `sqlite` |
+| `DATABASE_VECTOR` | `*qdrant*` | `stack/databases/qdrant` | `qdrant` |
+| `DATABASE_VECTOR` | `*pgvector*` | `stack/databases/pgvector` | `pgvector` |
+| `DATABASE_VECTOR` | `*pinecone*` | `stack/databases/pinecone` | `pinecone` |
+| `DATABASE_VECTOR` | `*weaviate*` | `stack/databases/weaviate` | `weaviate` |
+| `DATABASE_VECTOR` | `*lance*` OR `*lancedb*` | `stack/databases/lancedb` | `lancedb` |
+| `DATABASE_GRAPH` | `*neo4j*` | `stack/databases/neo4j` | `neo4j` |
+| `DATABASE_CACHE` | `*redis*` | `stack/databases/redis` | `redis` |
+| `DATABASE_TIMESERIES` | `*timescale*` | `stack/databases/timescaledb` | `timescaledb` |
+| `DATABASE_TIMESERIES` | `*influx*` | `stack/databases/influxdb` | `influxdb` |
+| `DATABASE` | `*spacetimedb*` OR `*stdb*` | `stack/databases/spacetimedb` | `spacetimedb` |
+| `DATABASE_PRIMARY` | `*spacetimedb*` OR `*stdb*` | `stack/databases/spacetimedb` | `spacetimedb` |
+| `DATABASE` | `*clickhouse*` | `stack/databases/clickhouse` | `clickhouse` |
+| `DATABASE_ANALYTICS` | `*clickhouse*` | `stack/databases/clickhouse` | `clickhouse` |
+
+> **Note on `DATABASE_CACHE` / Redis**: the existing `DATABASE` + `*redis*` row remains; the `DATABASE_CACHE` row adds a second matching path under the new sub-key. Both fire the same `redis` skill — the idempotency rule in step 7 of provision ensures it is only copied once.
+
+
+### Frameworks
+
+| Stack Key | Value Pattern | Library Path | Installed As |
+|-----------|--------------|-------------|-------------|
+| `FRONTEND_FRAMEWORK` | `*astro*` | `stack/frameworks/astro-framework` | `astro-framework` |
+| `FRONTEND_FRAMEWORK` | `*next*` | `stack/frameworks/nextjs` | `nextjs` |
+| `FRONTEND_FRAMEWORK` | `*svelte*` OR `*sveltekit*` | `stack/frameworks/sveltekit` | `sveltekit` |
+| `FRONTEND_FRAMEWORK` | `*svelte*` OR `*sveltekit*` | `stack/frameworks/svelte5` | `svelte5` |
+| `FRONTEND_FRAMEWORK` | `*nuxt*` | `stack/frameworks/nuxt` | `nuxt` |
+| `BACKEND_FRAMEWORK` | `*hono*` | `stack/frameworks/hono` | `hono` |
+| `BACKEND_FRAMEWORK` | `*fastapi*` | `stack/frameworks/fastapi` | `fastapi` |
+| `BACKEND_FRAMEWORK` | `*nest*` | `stack/frameworks/nestjs` | `nestjs` |
+
+> api-error-handling installs with every backend framework (any BACKEND_FRAMEWORK implies an API surface).
+
+| `BACKEND_FRAMEWORK` | `*hono*` | `surface/api/api-error-handling` | `api-error-handling` |
+| `BACKEND_FRAMEWORK` | `*fastapi*` | `surface/api/api-error-handling` | `api-error-handling` |
+| `BACKEND_FRAMEWORK` | `*nest*` | `surface/api/api-error-handling` | `api-error-handling` |
+| `DESKTOP_FRAMEWORK` | `*tauri*` | `stack/frameworks/tauri` | `tauri` |
+| `DESKTOP_FRAMEWORK` | `*electron*` | `stack/frameworks/electron` | `electron` |
+
+### API Layer
+
+| Stack Key | Value Pattern | Library Path | Installed As |
+|-----------|--------------|-------------|-------------|
+| `API_LAYER` | `*trpc*` | `stack/api/trpc` | `trpc` |
+| `API_LAYER` | `*graphql*` | `stack/api/graphql` | `graphql` |
+
+> **`{{API_DESIGN_SKILL}}` provision**: When `API_LAYER` is set, bootstrap fills `{{API_DESIGN_SKILL}}` with the matching API skill name (e.g., `trpc`, `graphql`). When `API_LAYER` is not set (REST is the default API style), `{{API_DESIGN_SKILL}}` defaults to `api-design-principles` (pre-installed). This replaces the former hardcoded `rest-api-design` reference.
+
+### ORM / Data Layer
+
+| Stack Key | Value Pattern | Library Path | Installed As |
+|-----------|--------------|-------------|-------------|
+| `ORM` | `*drizzle*` | `stack/orm/drizzle-orm` | `drizzle-orm` |
+| `ORM` | `*prisma*` | `stack/orm/prisma` | `prisma` |
+
+### CSS / UI
+
+| Stack Key | Value Pattern | Library Path | Installed As |
+|-----------|--------------|-------------|-------------|
+| `CSS_FRAMEWORK` | `*tailwind*` | `stack/css/tailwind-css-patterns` | `tailwind-css-patterns` |
+| `CSS_FRAMEWORK` | `*tailwind*` | `stack/css/tailwind-design-system` | `tailwind-design-system` |
+| `CSS_FRAMEWORK` | `*vanilla*` OR `*plain*` OR `*custom*` | `stack/css/vanilla-css` | `vanilla-css` |
+| `CSS_FRAMEWORK` | `*sass*` OR `*scss*` | `stack/css/sass-scss` | `sass-scss` |
+| `UI_LIBRARY` | `*shadcn*` | `stack/ui/shadcn-ui` | `shadcn-ui` |
+| `UI_LIBRARY` | `*react-flow*` OR `*xyflow*` | `stack/ui/react-flow` | `react-flow` |
+| `UI_LIBRARY` | `*svelte-flow*` OR `*svelteflow*` OR `*xyflow*` | `stack/ui/svelte-flow` | `svelte-flow` |
+| `FRONTEND_FRAMEWORK` | `*react*` | `stack/ui/react-best-practices` | `react-best-practices` |
+| `FRONTEND_FRAMEWORK` | `*react*` | `stack/ui/react-composition-patterns` | `react-composition-patterns` |
+| `DESIGN_DIRECTION` | `*` (any confirmed value) | Fills `{{PLACEHOLDER}}`s in `.codex/skills/brand-guidelines/SKILL.md` in-place | `brand-guidelines` (in-place fill, not copy) |
+| `DESIGN_DIRECTION` | `*cinematic*` OR `*immersive*` | `stack/3d/threejs-pro` | `threejs-pro` |
+
+Note: `DESIGN_DIRECTION` does not copy a skill from the library — it fills placeholders in the pre-placed `.codex/skills/brand-guidelines/SKILL.md` template. Exception: when the direction is `Cinematic/Immersive`, `threejs-pro` is also installed as a standard skill copy, since WebGL and Three.js capabilities will be required.
+
+### Authentication
+
+| Stack Key | Value Pattern | Library Path | Installed As |
+|-----------|--------------|-------------|-------------|
+| `AUTH_PROVIDER` | `*firebase*` | `stack/auth/firebase-auth` | `firebase-auth` |
+| `AUTH_PROVIDER` | `*authjs*` OR `*next-auth*` OR `*nextauth*` | `stack/auth/authjs` | `authjs` |
+| `AUTH_PROVIDER` | `*clerk*` | `stack/auth/clerk` | `clerk` |
+| `AUTH_PROVIDER` | `*supabase*` | `stack/auth/supabase-auth` | `supabase-auth` |
+| `AUTH_PROVIDER` | `*lucia*` | `stack/auth/lucia` | `lucia` |
+
+### Payments
+
+| Stack Key | Value Pattern | Library Path | Installed As |
+|-----------|--------------|-------------|-------------|
+| `PAYMENTS` | `*stripe*` | `stack/payments/stripe-integration` | `stripe-integration` |
+| `PAYMENTS` | `*lemon*` OR `*lemonsqueezy*` | `stack/payments/lemonsqueezy` | `lemonsqueezy` |
+
+### AI / ML
+
+| Stack Key | Value Pattern | Library Path | Installed As |
+|-----------|--------------|-------------|-------------|
+| `AI_SDK` | `*vercel*` OR `*ai-sdk*` | `stack/ai/ai-sdk` | `ai-sdk` |
+| `AI_SDK` | `*openai*` | `stack/ai/openai-sdk` | `openai-sdk` |
+| `AI_SDK` | `*langchain*` | `stack/ai/langchain` | `langchain` |
+| `AI_SDK` | `*ollama*` | `stack/ai/ollama` | `ollama` |
+
+### State Management
+
+| Stack Key | Value Pattern | Library Path | Installed As |
+|-----------|--------------|-------------|-------------|
+| `STATE_MANAGEMENT` | `*tanstack*` OR `*react-query*` | `stack/state/tanstack-query` | `tanstack-query` |
+| `STATE_MANAGEMENT` | `*zustand*` | `stack/state/zustand` | `zustand` |
+
+### Testing
+
+| Stack Key | Value Pattern | Library Path | Installed As |
+|-----------|--------------|-------------|-------------|
+| `E2E_TESTING` | `*playwright*` | `stack/testing/playwright` | `playwright` |
+| `UNIT_TESTING` | `*vitest*` | `stack/testing/vitest` | `vitest` |
+| `UNIT_TESTING` | `*testing-library*` OR `*rtl*` | `stack/testing/testing-library` | `testing-library` |
+| `UNIT_TESTING` | `*storybook*` | `stack/testing/storybook` | `storybook` |
+
+### Hosting / Deployment
+
+| Stack Key | Value Pattern | Library Path | Installed As |
+|-----------|--------------|-------------|-------------|
+| `HOSTING` | `*cloudflare*` | `stack/hosting/cloudflare` | `cloudflare` |
+| `HOSTING` | `*docker*` | `stack/hosting/docker-expert` | `docker-expert` |
+| `HOSTING` | `*vercel*` | `stack/hosting/vercel` | `vercel` |
+| `HOSTING` | `*aws*` | `stack/hosting/aws` | `aws` |
+
+### Monitoring / Analytics
+
+| Stack Key | Value Pattern | Library Path | Installed As |
+|-----------|--------------|-------------|-------------|
+| `MONITORING` | `*sentry*` | `stack/monitoring/sentry` | `sentry` |
+| `MONITORING` | `*posthog*` | `stack/monitoring/posthog` | `posthog` |
+| `ANALYTICS` | `*google*` | `stack/analytics/google-analytics` | `google-analytics` |
+
+### Observability
+
+| Stack Key | Value Pattern | Library Path | Installed As |
+|-----------|--------------|-------------|-------------|
+| `OBSERVABILITY` | `*opentelemetry*` OR `*otel*` | `stack/observability/opentelemetry` | `opentelemetry` |
+| `OBSERVABILITY` | `*distributed-tracing*` OR `*jaeger*` OR `*zipkin*` | `stack/observability/distributed-tracing` | `distributed-tracing` |
+| `OBSERVABILITY` | `*structured-logging*` OR `*pino*` OR `*winston*` | Pre-installed: `.codex/skills/logging-best-practices` | `logging-best-practices` (pre-installed) |
+| `OBSERVABILITY` | `*python*` | `stack/observability/python-observability` | `python-observability` |
+| `OBSERVABILITY` | `*datadog*` | `stack/observability/datadog` | `datadog` |
+| `OBSERVABILITY` | `*prometheus*` OR `*grafana*` | `stack/observability/prometheus-grafana` | `prometheus-grafana` |
+
+### Email
+
+| Stack Key | Value Pattern | Library Path | Installed As |
+|-----------|--------------|-------------|-------------|
+| `EMAIL` | `*resend*` | `stack/email/resend` | `resend` |
+
+### Queues / Background Jobs
+
+| Stack Key | Value Pattern | Library Path | Installed As |
+|-----------|--------------|-------------|-------------|
+| `QUEUE` | `*inngest*` | `stack/queue/inngest` | `inngest` |
+| `QUEUE` | `*bullmq*` OR `*bull*` | `stack/queue/bullmq` | `bullmq` |
+
+### Realtime
+
+| Stack Key | Value Pattern | Library Path | Installed As |
+|-----------|--------------|-------------|-------------|
+| `REALTIME` | `*socket*` OR `*socket.io*` | `stack/realtime/socketio` | `socketio` |
+
+### Search
+
+| Stack Key | Value Pattern | Library Path | Installed As |
+|-----------|--------------|-------------|-------------|
+| `SEARCH` | `*meilisearch*` | `stack/search/meilisearch` | `meilisearch` |
+| `SEARCH` | `*elasticsearch*` OR `*elastic*` OR `*opensearch*` | `stack/search/elasticsearch` | `elasticsearch` |
+| `SEARCH` | `*algolia*` | `stack/search/algolia` | `algolia` |
+| `SEARCH` | `*typesense*` | `stack/search/typesense` | `typesense` |
+
+### CMS
+
+| Stack Key | Value Pattern | Library Path | Installed As |
+|-----------|--------------|-------------|-------------|
+| `CMS` | `*payload*` | `stack/cms/payload-cms` | `payload-cms` |
+| `CMS` | `*wordpress*` OR `*wp*` | `stack/cms/wordpress` | `wordpress` |
+| `CMS` | `*shopify*` | `stack/cms/shopify` | `shopify` |
+
+### Storage
+
+| Stack Key | Value Pattern | Library Path | Installed As |
+|-----------|--------------|-------------|-------------|
+| `STORAGE` | `*s3*` OR `*aws*` | `stack/storage/aws-s3` | `aws-s3` |
+| `STORAGE` | `*r2*` OR `*cloudflare*` | `stack/storage/cloudflare-r2` | `cloudflare-r2` |
+| `STORAGE` | `*gcs*` OR `*google cloud storage*` | `stack/storage/gcs` | `gcs` |
+
+### CI/CD
+
+| Stack Key | Value Pattern | Library Path | Installed As |
+|-----------|--------------|-------------|-------------|
+| `CI_CD` | `*github*` | `stack/devops/github-actions` | `github-actions` |
+| `CI_CD` | `*github*` | `stack/devops/git-workflow` | `git-workflow` |
+| `CI_CD` | `*github*` | `stack/devops/git-advanced` | `git-advanced` |
+| `CI_CD` | `*terraform*` | `stack/devops/terraform` | `terraform` |
+| `CI_CD` | `*gitlab*` | `stack/devops/git-workflow` | `git-workflow` |
+| `CI_CD` | `*gitlab*` | `stack/devops/git-advanced` | `git-advanced` |
+| `CI_CD` | `*bitbucket*` | `stack/devops/git-workflow` | `git-workflow` |
+| `CI_CD` | `*bitbucket*` | `stack/devops/git-advanced` | `git-advanced` |
+
+### DevOps / Infrastructure
+
+| Stack Key | Value Pattern | Library Path | Installed As |
+|-----------|--------------|-------------|-------------|
+| `HOSTING` | `*kubernetes*` OR `*k8s*` | `stack/devops/kubernetes` | `kubernetes` |
+| `HOSTING` | `*nginx*` | `stack/devops/nginx` | `nginx` |
+
+### Mobile
+
+| Stack Key | Value Pattern | Library Path | Installed As |
+|-----------|--------------|-------------|-------------|
+| `MOBILE_FRAMEWORK` | `*expo*` OR `*react-native*` OR `*react native*` | `stack/mobile/react-native` | `react-native` |
+| `MOBILE_FRAMEWORK` | `*expo*` | `stack/mobile/expo-react-native` | `expo-react-native` |
+| `MOBILE_FRAMEWORK` | `*flutter*` | `stack/mobile/flutter` | `flutter` |
+| `MOBILE_FRAMEWORK` | `*swiftui*` OR `*swift*` | `stack/mobile/swiftui` | `swiftui` |
+| `MOBILE_FRAMEWORK` | `*kotlin*` OR `*compose*` OR `*jetpack*` | `stack/mobile/kotlin-compose` | `kotlin-compose` |
+
+### Languages
+
+| Stack Key | Value Pattern | Library Path | Installed As |
+|-----------|--------------|-------------|-------------|
+| `LANGUAGE` | `*typescript*` | `stack/languages/typescript-advanced-patterns` | `typescript-advanced-patterns` |
+| `LANGUAGE` | `*python*` | `stack/languages/python` | `python` |
+| `LANGUAGE` | `*rust*` | `stack/languages/rust` | `rust` |
+| `LANGUAGE` | `*go*` OR `*golang*` | `stack/languages/go` | `go` |
+| `LANGUAGE` | `*c++*` OR `*cpp*` OR `*c/c++*` | `stack/languages/c-cpp` | `c-cpp` |
+| `LANGUAGE` | `*java*` | `stack/languages/java` | `java` |
+| `LANGUAGE` | `*kotlin*` | `stack/languages/kotlin` | `kotlin` |
+| `LANGUAGE` | `*javascript*` OR `*vanilla js*` | `stack/languages/vanilla-javascript` | `vanilla-javascript` |
+| `LANGUAGE` | `*gdscript*` OR `*godot*` | `stack/languages/gdscript` | `gdscript` |
+| `LANGUAGE` | `*bash*` OR `*shell*` | `stack/languages/bash-scripting` | `bash-scripting` |
+
+### 3D
+
+| Stack Key | Value Pattern | Library Path | Installed As |
+|-----------|--------------|-------------|-------------|
+| `3D_FRAMEWORK` | `*three*` OR `*r3f*` | `stack/3d/threejs-pro` | `threejs-pro` |
+
+### Game Engines
+
+| Stack Key | Value Pattern | Library Path | Installed As |
+|-----------|--------------|-------------|-------------|
+| `GAME_ENGINE` | `*godot*` | `stack/gamedev/godot` | `godot` |
+| `GAME_ENGINE` | `*unity*` | `stack/gamedev/unity` | `unity` |
+
+### Security
+
+| Stack Key | Value Pattern | Library Path | Installed As |
+|-----------|--------------|-------------|-------------|
+| `SECURITY` | `*owasp*` OR `*web-security*` | `stack/security/owasp-web-security` | `owasp-web-security` |
+| `SECURITY` | `*crypto*` OR `*encryption*` | `stack/security/crypto-patterns` | `crypto-patterns` |
+| `SECURITY` | `*csp*` OR `*cors*` OR `*headers*` | `stack/security/csp-cors-headers` | `csp-cors-headers` |
+| `SECURITY` | `*dependency*` OR `*audit*` OR `*supply-chain*` | `stack/security/dependency-auditing` | `dependency-auditing` |
+| `SECURITY` | `*sanitiz*` OR `*validation*` OR `*input*` | `stack/security/input-sanitization` | `input-sanitization` |
+
+### Message Brokers
+
+| Stack Key | Value Pattern | Library Path | Installed As |
+|-----------|--------------|-------------|-------------|
+| `MESSAGE_BROKER` | `*kafka*` | `stack/messaging/kafka` | `kafka` |
+| `MESSAGE_BROKER` | `*rabbitmq*` OR `*rabbit*` | `stack/messaging/rabbitmq` | `rabbitmq` |
+| `MESSAGE_BROKER` | `*nats*` | `stack/messaging/nats` | `nats` |
+| `MESSAGE_BROKER` | `*sqs*` OR `*aws sqs*` | `stack/messaging/sqs` | `sqs` |
+
+### Notifications
+
+| Stack Key | Value Pattern | Library Path | Installed As |
+|-----------|--------------|-------------|-------------|
+| `NOTIFICATIONS` | `*twilio*` | `stack/notifications/twilio` | `twilio` |
+| `NOTIFICATIONS` | `*fcm*` OR `*firebase*` OR `*push*` | `stack/notifications/fcm` | `fcm` |
+| `NOTIFICATIONS` | `*sendgrid*` | `stack/notifications/sendgrid` | `sendgrid` |
+
+### Extensions
+
+| Stack Key | Value Pattern | Library Path | Installed As |
+|-----------|--------------|-------------|-------------|
+| `BROWSER_EXTENSION` | `*wxt*` | `stack/extensions/wxt` | `wxt` |
+| `BROWSER_EXTENSION` | `*plasmo*` | `stack/extensions/plasmo` | `plasmo` |
+| `BROWSER_EXTENSION` | `*chrome*` OR `*extension*` OR `*mv3*` | `stack/extensions/chrome-extension` | `chrome-extension` |
+| `VSCODE_EXTENSION` | `*vscode*` OR `*vs code*` OR `*vsce*` | `stack/extensions/vscode-extension` | `vscode-extension` |
+
+### Feature Flags
+
+| Stack Key | Value Pattern | Library Path | Installed As |
+|-----------|--------------|-------------|-------------|
+| `FEATURE_FLAGS` | `*launchdarkly*` | `stack/feature-flags/launchdarkly` | `launchdarkly` |
+| `FEATURE_FLAGS` | `*posthog*` | `stack/feature-flags/posthog-flags` | `posthog-flags` |
+| `FEATURE_FLAGS` | `*flagsmith*` | `stack/feature-flags/flagsmith` | `flagsmith` |
+
+---
+
+## Surface Triggers
+
+When the project includes a surface type, install the listed skills.
+
+### Web
+
+| Surface Type | Library Path | Installed As |
+|-------------|-------------|-------------|
+| `web` | `surface/web/frontend-design` | `frontend-design` |
+| `web` | `surface/web/seo-audit` | `seo-audit` |
+| `web` | `surface/web/ai-seo` | `ai-seo` |
+| `web` | `surface/web/schema-markup` | `schema-markup` |
+| `web` | `surface/web/programmatic-seo` | `programmatic-seo` |
+| `web` | `surface/web/analytics-tracking` | `analytics-tracking` |
+| `web` | `surface/web/page-cro` | `page-cro` |
+| `web` | `surface/web/web-performance-optimization` | `web-performance-optimization` |
+| `web` | `surface/web/i18n-localization` | `i18n-localization` |
+| `web` | `surface/web/accessibility-compliance` | `accessibility-compliance` |
+| `web` | `surface/web/form-handling-validation` | `form-handling-validation` |
+| `web` | `surface/web/authentication-ui-flows` | `authentication-ui-flows` |
+| `web` | `surface/web/dark-mode-theming` | `dark-mode-theming` |
+| `web` | `surface/web/offline-first-pwa` | `offline-first-pwa` |
+| `web` | `surface/web/web-scraping` | `web-scraping` |
+| `web` | `stack/security/owasp-web-security` | `owasp-web-security` |
+| `web` | `stack/security/csp-cors-headers` | `csp-cors-headers` |
+| `web` | `stack/security/input-sanitization` | `input-sanitization` |
+| `web` | `surface/web/design-reference-data` | `design-reference-data` |
+| `web` | `surface/web/frontend-verification` | `frontend-verification` |
+
+> **Note**: The `frontend-design` skill includes a **Premium Cinematic Tier** with WebGL, custom shaders, and Awwwards-level animation patterns. When `DESIGN_DIRECTION` is `Cinematic/Immersive`, `threejs-pro` is also auto-installed (see CSS/UI triggers above).
+
+### API
+
+| Surface Type | Library Path | Installed As |
+|-------------|-------------|-------------|
+| `api` | `surface/api/rate-limiting-abuse-protection` | `rate-limiting-abuse-protection` |
+| `api` | `surface/api/email-best-practices` | `email-best-practices` |
+| `api` | `surface/api/api-error-handling` | `api-error-handling` |
+| `api` | `surface/api/api-caching` | `api-caching` |
+| `api` | `surface/api/api-documentation-openapi` | `api-documentation-openapi` |
+| `api` | `surface/api/webhook-design` | `webhook-design` |
+| `api` | Pre-installed: `.codex/skills/api-design-principles` | `api-design-principles` (pre-installed) |
+| `api` | `surface/api/api-security-checklist` | `api-security-checklist` |
+| `api` | `stack/security/input-sanitization` | `input-sanitization` |
+
+### Mobile
+
+| Surface Type | Library Path | Installed As |
+|-------------|-------------|-------------|
+| `mobile` | `surface/mobile/mobile-responsive-patterns` | `mobile-responsive-patterns` |
+| `mobile` | `surface/mobile/mobile-offline-sync` | `mobile-offline-sync` |
+| `mobile` | `surface/mobile/push-notifications` | `push-notifications` |
+| `mobile` | `surface/mobile/app-store-submission` | `app-store-submission` |
+
+### Desktop
+
+| Surface Type | Library Path | Installed As |
+|-------------|-------------|-------------|
+| `desktop` | `surface/desktop/desktop-app-distribution` | `desktop-app-distribution` |
+| `desktop` | `surface/desktop/native-os-integration` | `native-os-integration` |
+| `desktop` | `surface/desktop/desktop-security-sandboxing` | `desktop-security-sandboxing` |
+| `desktop` | `surface/desktop/desktop-ux-conventions` | `desktop-ux-conventions` |
+
+### CLI
+
+| Surface Type | Library Path | Installed As |
+|-------------|-------------|-------------|
+| `cli` | `surface/cli/cli-ux-design` | `cli-ux-design` |
+| `cli` | `surface/cli/cli-configuration-management` | `cli-configuration-management` |
+| `cli` | `surface/cli/cli-shell-integration` | `cli-shell-integration` |
+| `cli` | `surface/cli/cli-error-diagnostics` | `cli-error-diagnostics` |
+
+### Extension
+
+| Surface Type | Library Path | Installed As |
+|-------------|-------------|-------------|
+| `extension` | `surface/extension/browser-extension-patterns` | `browser-extension-patterns` |
+| `extension` | `surface/extension/plugin-architecture-design` | `plugin-architecture-design` |
+| `extension` | `surface/extension/vscode-extension-development` | `vscode-extension-development` |
+
+---
+
+### All surfaces (universal)
+
+| Surface Type | Library Path | Installed As |
+|-------------|-------------|-------------|
+| `*` (any surface) | `stack/security/dependency-auditing` | `dependency-auditing` |
+
+> **Universal security baseline**: dependency auditing is provisioned for every project. The surface-specific security skills (owasp-web-security, csp-cors-headers, api-security-checklist) are provisioned only when their respective surfaces are confirmed.
+
+## Meta Skills (manual install only)
+
+These skills are NOT auto-installed. Install via `/find-skills` or manually copy from the library.
+
+| Library Path | Description |
+|-------------|-------------|
+| `meta/mcp-builder` | Building MCP servers |
+| `meta/tmux-processes` | Long-lived process management via tmux |
+| `meta/using-tmux-for-interactive-commands` | Interactive CLI tools via tmux |
+| Pre-installed: `.codex/skills/brand-guidelines` | Brand color and typography application (pre-installed) |
+| `meta/product-marketing-context` | Marketing context document generator — run first before any SEO or CRO skill |
+
+---
+
+## Claude Code Skills (manual install only)
+
+These skills are specific to Claude Code's plugin and agent system. Not applicable to Antigravity or other agents.
+
+| Library Path | Description |
+|-------------|-------------|
+| `meta/claude-code/hook-development` | Claude Code hook system (PreToolUse, PostToolUse, Stop, SessionStart) |
+| `meta/claude-code/plugin-structure` | Claude Code plugin architecture (.claude-plugin/plugin.json) |
+| `meta/claude-code/agent-development` | Claude Code agent frontmatter (model, color, triggering examples) |
+
+---
+
+## Extending the Library
+
+To add a new skill to the library:
+
+1. Create a directory under the appropriate category: `.codex/skill-library/[category]/[subcategory]/[skill-name]/SKILL.md`
+2. Add a row to the appropriate trigger table above
+3. Use `{{PLACEHOLDER}}`s for any values that should be filled by bootstrap
+4. Test by running `/bootstrap-agents` with a matching stack value
+
+### Stack Key Reference
+
+| Key | Description | Example Values |
+|-----|-------------|---------------|
+| `DATABASE` | Primary database | PostgreSQL, SurrealDB, Supabase, MongoDB, Redis, SQLite |
+| `DATABASE_PRIMARY` | Main relational/document/multi-model store | PostgreSQL, SurrealDB, Supabase, MongoDB, SQLite |
+| `DATABASE_VECTOR` | Semantic search, embeddings, similarity | Qdrant, pgvector, Pinecone, Weaviate |
+| `DATABASE_GRAPH` | Graph traversal, relationship queries | Neo4j |
+| `DATABASE_CACHE` | Caching layer | Redis |
+| `DATABASE_TIMESERIES` | Time-ordered data, metrics, IoT | TimescaleDB, InfluxDB |
+| `FRONTEND_FRAMEWORK` | Frontend framework | Next.js, Astro, SvelteKit, Nuxt, React |
+| `BACKEND_FRAMEWORK` | Backend framework | Hono, FastAPI, NestJS, Express |
+| `DESKTOP_FRAMEWORK` | Desktop app framework | Tauri, Electron |
+| `API_LAYER` | API layer pattern | tRPC, GraphQL |
+| `ORM` | Object-relational mapper | Drizzle, Prisma |
+| `CSS_FRAMEWORK` | CSS framework | Tailwind CSS, Vanilla CSS, SASS/SCSS |
+| `UI_LIBRARY` | UI component library | shadcn/ui, React Flow |
+| `AUTH_PROVIDER` | Authentication provider | Firebase, Auth.js, Clerk |
+| `PAYMENTS` | Payment processor | Stripe, Lemon Squeezy |
+| `AI_SDK` | AI/ML SDK | Vercel AI SDK, OpenAI, LangChain, Ollama |
+| `STATE_MANAGEMENT` | Client state management | TanStack Query, Zustand |
+| `E2E_TESTING` | End-to-end test framework | Playwright |
+| `UNIT_TESTING` | Unit test framework | Vitest, Testing Library, Storybook |
+| `HOSTING` | Hosting platform | Cloudflare, Vercel, AWS, Docker, Kubernetes, Nginx |
+| `MONITORING` | Error/analytics monitoring | Sentry, PostHog |
+| `OBSERVABILITY` | Observability stack | OpenTelemetry, Distributed Tracing, Structured Logging, Datadog, Prometheus/Grafana |
+| `ANALYTICS` | Web analytics | Google Analytics |
+| `EMAIL` | Email service | Resend |
+| `QUEUE` | Job queue | Inngest, BullMQ |
+| `REALTIME` | Realtime communication | Socket.io |
+| `SEARCH` | Search engine | Meilisearch, Algolia, Typesense, Elasticsearch |
+| `CMS` | Content management | Payload CMS, WordPress, Shopify |
+| `STORAGE` | File/object storage | AWS S3, Cloudflare R2, Google Cloud Storage |
+| `CI_CD` | CI/CD pipeline | GitHub Actions, Terraform |
+| `MOBILE_FRAMEWORK` | Mobile framework | Expo, React Native, Flutter, SwiftUI, Kotlin/Compose |
+| `LANGUAGE` | Programming language | TypeScript, Python, Rust, Go, C/C++, Java, Kotlin, JavaScript, GDScript, Bash |
+| `MESSAGE_BROKER` | Message broker/queue | Kafka, RabbitMQ, NATS, AWS SQS |
+| `NOTIFICATIONS` | Notification service | Twilio, FCM, SendGrid |
+| `BROWSER_EXTENSION` | Browser extension framework | WXT, Plasmo, Chrome Extension |
+| `VSCODE_EXTENSION` | VS Code extension | VS Code Extension |
+| `FEATURE_FLAGS` | Feature flag service | LaunchDarkly, PostHog, Flagsmith |
+| `DATABASE_ANALYTICS` | Analytics database | ClickHouse |
+| `3D_FRAMEWORK` | 3D rendering | Three.js, React Three Fiber |
+| `GAME_ENGINE` | Game engine | Godot, Unity |
+| `SECURITY` | Security focus area | OWASP, Crypto, CSP/CORS, Dependency Auditing, Input Sanitization |
+| `SECURITY_SKILLS` | Accumulated list of all provisioned security skills (comma-separated, auto-filled by bootstrap) | e.g., `owasp-web-security,csp-cors-headers,input-sanitization,dependency-auditing` |
+| `API_DESIGN_SKILL` | API design skill for the project's API style (auto-filled by bootstrap, defaults to `api-design-principles`) | `api-design-principles`, `trpc`, `graphql` |
+| `DESIGN_DIRECTION` | Confirmed visual design direction | Minimal/Functional, Editorial, Luxury/Refined, Playful/Expressive, Technical/Brutalist, Cinematic/Immersive, or Hybrid |
+| `CDN_ASSETS` | CDN provider for static assets (no skill provisioned — handled by `HOSTING_SKILL`) | Cloudflare, AWS CloudFront, Vercel Edge |
+| `BACKEND_RUNTIME` | Backend runtime environment (no skill provisioned — handled by `LANGUAGE_SKILL` and `BACKEND_FRAMEWORK_SKILL`) | Node.js, Bun, Deno, Python |