claude-code-arcane 1.0.0

package/skills/context-engine/references/anonymization-protocol.md

@@ -0,0 +1,173 @@
+# Anonymization Protocol
+
+Rules for stripping sensitive company data before any external API call, web search, or tool invocation that sends data outside the local environment.
+
+---
+
+## When This Protocol Applies
+
+**Trigger:** Any time company context or conversation content will leave the local session.
+
+Examples:
+- Web search that includes company specifics
+- External API call with company data in the payload
+- Any tool call where conversation content is part of the request
+
+**Does NOT apply to:**
+- Local file reads/writes (`~/.claude/company-context.md`)
+- In-session reasoning and analysis
+- Generating advice or documents that stay local
+
+---
+
+## Rule 1: Financial Figures → Relative Ranges
+
+Never send specific financial data externally.
+
+| Raw data | Anonymized version |
+|----------|-------------------|
+| "$2.4M ARR" | "early-stage ARR (sub-$5M)" |
+| "$180K MRR" | "growing MRR, Series A range" |
+| "14 months runway" | "runway is healthy for stage" |
+| "burn rate is $320K/month" | "burn rate is moderate for stage" |
+| "raised $8M Series A" | "Series A company" |
+| "customer LTV is $4,200" | "LTV is above industry average for segment" |
+| "CAC is $680" | "CAC is in a sustainable range" |
+
+**Rule:** No dollar amounts. No month counts for runway. Use stage-relative descriptors.
+
+---
+
+## Rule 2: Customer Names → Anonymized Labels
+
+Never send customer or client names externally.
+
+| Raw data | Anonymized version |
+|----------|-------------------|
+| "Acme Corp is our biggest customer" | "Customer A (largest account)" |
+| "we're working with NHS England" | "a large public-sector customer" |
+| "BMW, Volkswagen, and Stellantis" | "three major automotive OEMs" |
+| "10 enterprise customers including..." | "10 enterprise customers" |
+
+**Rule:** Use "Customer A/B/C" for named accounts, or describe by segment without naming.
+
+---
+
+## Rule 3: Revenue Figures → Percentage Changes or Stage Descriptors
+
+Revenue trajectory is safer than absolute numbers.
+
+| Raw data | Anonymized version |
+|----------|-------------------|
+| "growing from $1M to $2M ARR" | "2x revenue growth year-over-year" |
+| "revenue dropped from $500K to $430K" | "revenue declined ~15% in the period" |
+| "hit $10M ARR last quarter" | "crossed a significant ARR milestone" |
+| "doing $50K MRR" | "pre-Series A revenue, strong growth trajectory" |
+
+**Rule:** Percentages and directional signals (growing / declining / flat) are safe. Absolutes are not.
+
+---
+
+## Rule 4: Employee Names → Roles Only
+
+Never send individual names externally.
+
+| Raw data | Anonymized version |
+|----------|-------------------|
+| "Our CTO, Sarah Chen, is struggling" | "our CTO is struggling with the transition" |
+| "James is the best performer on the team" | "our strongest performer is in the engineering lead role" |
+| "we're about to let go of Michael" | "we're about to make a leadership change" |
+| "the founding team is me, Alex, and Priya" | "a three-person founding team" |
+
+**Exception:** Publicly known executives (CEO of a public company, named in press releases) can be referenced by name. If in doubt, use role.
+
+---
+
+## Rule 5: Investor Names → Generic Descriptors
+
+| Raw data | Anonymized version |
+|----------|-------------------|
+| "Sequoia led our round" | "a top-tier VC led our round" |
+| "our lead investor is pushing for an exit" | "pressure from investors toward exit" |
+| "Y Combinator alumni" | "accelerator alumni" |
+
+**Exception:** YC, Techstars, and similar well-known accelerators are commonly referenced and safe if the founder has publicly disclosed. When in doubt, omit.
+
+---
+
+## Rule 6: Location → Country or Region
+
+| Raw data | Anonymized version |
+|----------|-------------------|
+| "Berlin-based startup" | "European startup" |
+| "we're in San Francisco" | "US-based startup" |
+| "expanding to Munich and Vienna" | "expanding in the DACH region" |
+
+**Exception:** Location is less sensitive than financials. Use judgment — if it's on their website, it's fine.
+
+---
+
+## Anonymization Decision Tree
+
+```
+Before sending data externally:
+
+1. Does it include a specific dollar amount?
+   → YES: Replace with range or relative descriptor
+   
+2. Does it include a person's name?
+   → YES: Replace with role only (unless publicly known)
+   
+3. Does it include a company or customer name?
+   → YES: Replace with "Customer A" or segment descriptor
+   
+4. Does it include specific headcount or runway months?
+   → YES: Replace with range (1–10, 10–50) or "healthy/tight/critical"
+   
+5. Does it include proprietary data, roadmap, or unreleased product info?
+   → YES: Do not include. Reference only generically ("product expansion planned")
+   
+6. Is it publicly available information?
+   → YES: Safe to send as-is
+```
+
+---
+
+## Required vs Optional Anonymization
+
+### Required (always strip before external calls)
+- Revenue figures (absolute)
+- Burn rate (absolute)
+- Runway (specific months)
+- Customer names
+- Employee names
+- Investor names (unless public)
+- Funding amounts (unless public)
+
+### Optional (use judgment based on sensitivity)
+- Industry vertical (usually fine)
+- Company stage (usually fine)
+- Team size ranges (usually fine)
+- Geographic region (usually fine)
+- General challenge category (usually fine)
+
+---
+
+## What to Do If You're Unsure
+
+Default to stricter anonymization. The cost of over-anonymizing is slightly less useful external results. The cost of under-anonymizing is a privacy breach.
+
+When in doubt: **remove it**.
+
+---
+
+## Audit Log (Internal Only)
+
+When running external calls with company context, note internally:
+```
+[EXTERNAL CALL: {tool/API used}]
+[ANONYMIZED: {fields stripped}]
+[RETAINED: {fields kept and why}]
+```
+
+This is for internal reasoning only — never included in output to the founder.

package/skills/context-prime/SKILL.md

@@ -0,0 +1,25 @@
+---
+name: context-prime
+description: "Carga contexto completo del proyecto al inicio de la sesión: stack, estructura, git state, archivos clave. Mejora respuestas posteriores."
+category: "workflow"
+argument-hint: ""
+user-invocable: true
+allowed-tools: Read, Glob, Grep, Bash
+---
+
+Prime yourself with comprehensive project understanding before starting work:
+
+1. **Read project config** — package.json, tsconfig.json, pyproject.toml, go.mod, Cargo.toml, etc.
+2. **Read CLAUDE.md** — If it exists at root or .claude/ level
+3. **Scan directory structure** — `ls` the top-level and key directories (src/, lib/, app/, etc.)
+4. **Read key files** — Entry points, main config, router/routes, database schema
+5. **Check git state** — Current branch, recent commits, any uncommitted changes
+6. **Identify stack** — Framework, language version, package manager, test runner, linter
+7. **Summarize** — Give me a brief overview:
+   - What this project does
+   - Tech stack
+   - Key directories and their purpose
+   - Current git state
+   - Any issues or TODOs visible
+
+This helps you give better answers for the rest of our session.

package/skills/contract-and-proposal-writer/SKILL.md

@@ -0,0 +1,126 @@
+---
+name: contract-and-proposal-writer
+description: "Generate professional, jurisdiction-aware business documents: freelance contracts, project proposals, SOWs, NDAs, and MSAs. Covers US (Delaware), EU (GDPR), UK, and DACH jurisdictions with Markdown output and docx conversion."
+argument-hint: ""
+category: "business"
+user-invocable: true
+allowed-tools: Read, Glob, Grep, Bash, Write, Edit
+---
+
+# Contract & Proposal Writer
+
+Generate professional, jurisdiction-aware business documents: freelance contracts, project proposals, SOWs, NDAs, and MSAs. Outputs structured Markdown with docx conversion instructions.
+
+**Not a substitute for legal counsel.** Use these templates as strong starting points; review with an attorney for high-value or complex engagements.
+
+> **Note:** This skill may create or modify files in your project. It will ask before writing.
+
+## Core Capabilities
+
+- Freelance development contracts (fixed-price & hourly)
+- Project proposals with timeline/budget breakdown
+- Statements of Work (SOW) with deliverables matrix
+- NDAs (mutual & one-way)
+- Master Service Agreements (MSA)
+- Jurisdiction-specific clauses (US/EU/UK/DACH)
+- GDPR Data Processing Addenda (EU/DACH)
+
+## Key Clauses Reference
+
+| Clause | Options |
+|--------|---------|
+| Payment terms | Net-30, milestone-based, monthly retainer |
+| IP ownership | Work-for-hire (US), assignment (EU/UK), license-back |
+| Liability cap | 1x contract value (standard), 3x (high-risk) |
+| Termination | For cause (14-day cure), convenience (30/60/90-day notice) |
+| Confidentiality | 2-5 year term, perpetual for trade secrets |
+| Warranty | "As-is" disclaimer, limited 30/90-day fix warranty |
+| Dispute resolution | Arbitration (AAA/ICC), courts (jurisdiction-specific) |
+
+## When to Use
+
+- Starting a new client engagement and need a contract fast
+- Client asks for a proposal with pricing and timeline
+- Partnership or vendor relationship requiring an MSA
+- Protecting IP or confidential information with an NDA
+- EU/DACH project requiring GDPR-compliant data clauses
+
+## Workflow
+
+### 1. Gather Requirements
+
+Ask the user:
+
+    1. Document type? (contract / proposal / SOW / NDA / MSA)
+    2. Jurisdiction? (US-Delaware / EU / UK / DACH)
+    3. Engagement type? (fixed-price / hourly / retainer)
+    4. Parties? (names, roles, business addresses)
+    5. Scope summary? (1-3 sentences)
+    6. Total value or hourly rate?
+    7. Start date / end date or duration?
+    8. Special requirements? (IP assignment, white-label, subcontractors)
+
+### 2. Select Template
+
+| Type | Jurisdiction | Template |
+|------|-------------|----------|
+| Dev contract fixed | Any | Template A |
+| Consulting retainer | Any | Template B |
+| SaaS partnership | Any | Template C |
+| NDA mutual | US/EU/UK/DACH | NDA-M |
+| NDA one-way | US/EU/UK/DACH | NDA-OW |
+| SOW | Any | SOW base |
+
+### 3. Generate & Fill
+
+Fill all [BRACKETED] placeholders. Flag missing data as "REQUIRED".
+
+## Jurisdiction Notes
+
+### US (Delaware)
+- Governing law: State of Delaware
+- Work-for-hire doctrine applies (Copyright Act 101)
+- Arbitration: AAA Commercial Rules
+- Non-compete: enforceable with reasonable scope/time
+
+### EU (GDPR)
+- Must include Data Processing Addendum if handling personal data
+- IP assignment requires separate written deed in some member states
+- Arbitration: ICC or local chamber
+
+### UK (post-Brexit)
+- Governed by English law
+- IP: Patents Act 1977 / CDPA 1988
+- Arbitration: LCIA Rules
+- Data: UK GDPR (post-Brexit equivalent)
+
+### DACH (Germany / Austria / Switzerland)
+- BGB (Buergerliches Gesetzbuch) governs contracts
+- Written form requirement for certain clauses (para 126 BGB)
+- IP: Author always retains moral rights; must explicitly transfer Nutzungsrechte
+- Non-competes: max 2 years, compensation required (para 74 HGB)
+- Jurisdiction: German courts (Landgericht) or DIS arbitration
+- DSGVO (GDPR implementation) mandatory for personal data processing
+
+## Common Pitfalls
+
+1. **Missing IP assignment language** -- "work for hire" alone is insufficient in EU; need explicit assignment of Nutzungsrechte in DACH
+2. **Vague acceptance criteria** -- Always define what "accepted" means (written sign-off, X days to reject)
+3. **No change order process** -- Scope creep kills fixed-price projects; add a clause for out-of-scope work
+4. **Jurisdiction mismatch** -- Choosing Delaware law for a German-only project creates enforcement problems
+5. **Missing limitation of liability** -- Without a cap, one bug could mean unlimited damages
+6. **Oral amendments** -- Contracts modified verbally are hard to enforce; always require written amendments
+
+## Best Practices
+
+- Use **milestone payments** over net-30 for projects >$10K -- reduces cash flow risk
+- For EU/DACH: always check if a DPA is needed (any personal data = yes)
+- For DACH: include a **Schriftformklausel** (written form clause) explicitly
+- Add a **force majeure** clause for anything over 3 months
+- For retainers: define response time SLAs (e.g., 4h urgent / 24h normal)
+- Keep templates in version control; track changes with `git diff`
+- Review annually -- laws change, especially GDPR enforcement interpretations
+
+## Contract Templates
+
+> See references/contract-templates.md for full contract templates (fixed-price dev contract, consulting retainer, SaaS partnership, GDPR DPA) and docx conversion instructions.

package/skills/contract-and-proposal-writer/references/contract-templates.md

@@ -0,0 +1,276 @@
+# Contract Templates
+
+## Template A: Web Dev Fixed-Price Contract
+
+```markdown
+# SOFTWARE DEVELOPMENT AGREEMENT
+
+**Effective Date:** [DATE]
+**Client:** [CLIENT LEGAL NAME], [ADDRESS] ("Client")
+**Developer:** [YOUR LEGAL NAME / COMPANY], [ADDRESS] ("Developer")
+
+---
+
+## 1. SERVICES
+
+Developer agrees to design, develop, and deliver:
+
+**Project:** [PROJECT NAME]
+**Description:** [1-3 sentence scope]
+
+**Deliverables:**
+- [Deliverable 1] due [DATE]
+- [Deliverable 2] due [DATE]
+- [Deliverable 3] due [DATE]
+
+## 2. PAYMENT
+
+**Total Fee:** [CURRENCY] [AMOUNT]
+
+| Milestone | Amount | Due |
+|-----------|--------|-----|
+| Contract signing | 50% | Upon execution |
+| Beta delivery | 25% | [DATE] |
+| Final acceptance | 25% | Within 5 days of acceptance |
+
+Late payments accrue interest at 1.5% per month.
+Client has [10] business days to accept or reject deliverables in writing.
+
+## 3. INTELLECTUAL PROPERTY
+
+Upon receipt of full payment, Developer assigns all right, title, and interest in the
+Work Product to Client as a work made for hire (US) / by assignment of future copyright (EU/UK).
+
+Developer retains the right to display Work Product in portfolio unless Client
+requests confidentiality in writing within [30] days of delivery.
+
+Pre-existing IP (tools, libraries, frameworks) remains Developer's property.
+Developer grants Client a perpetual, royalty-free license to use pre-existing IP
+as embedded in the Work Product.
+
+## 4. CONFIDENTIALITY
+
+Each party keeps confidential all non-public information received from the other.
+This obligation survives termination for [3] years.
+
+## 5. WARRANTIES
+
+Developer warrants Work Product will substantially conform to specifications for
+[90] days post-delivery. Developer will fix material defects at no charge during
+this period. EXCEPT AS STATED, WORK PRODUCT IS PROVIDED "AS IS."
+
+## 6. LIABILITY
+
+Developer's total liability shall not exceed total fees paid under this Agreement.
+Neither party liable for indirect, incidental, or consequential damages.
+
+## 7. TERMINATION
+
+For Cause: Either party may terminate if the other materially breaches and fails
+to cure within [14] days of written notice.
+
+For Convenience: Client may terminate with [30] days written notice and pay for
+all work completed plus [10%] of remaining contract value.
+
+## 8. DISPUTE RESOLUTION
+
+US: Binding arbitration under AAA Commercial Rules, [CITY], Delaware law.
+EU/DACH: ICC / DIS arbitration, [CITY]. German / English law.
+UK: LCIA Rules, London. English law.
+
+## 9. GENERAL
+
+- Entire Agreement: Supersedes all prior discussions.
+- Amendments: Must be in writing, signed by both parties.
+- Independent Contractor: Developer is not an employee of Client.
+
+---
+
+CLIENT: _________________________ Date: _________
+[CLIENT NAME], [TITLE]
+
+DEVELOPER: _________________________ Date: _________
+[YOUR NAME], [TITLE]
+```
+
+## Template B: Monthly Consulting Retainer
+
+```markdown
+# CONSULTING RETAINER AGREEMENT
+
+**Effective Date:** [DATE]
+**Client:** [CLIENT LEGAL NAME] ("Client")
+**Consultant:** [YOUR NAME / COMPANY] ("Consultant")
+
+---
+
+## 1. SERVICES
+
+Consultant provides [DOMAIN, e.g., "CTO advisory and technical architecture"] services.
+
+**Monthly Hours:** Up to [X] hours/month
+**Rollover:** Unused hours [do / do not] roll over (max [X] hours banked)
+**Overflow Rate:** [CURRENCY] [RATE]/hr for hours exceeding retainer
+
+## 2. FEES
+
+**Monthly Retainer:** [CURRENCY] [AMOUNT], due on the 1st of each month.
+**Payment Method:** Bank transfer / Stripe / SEPA direct debit
+**Late Payment:** 2% monthly interest after [10]-day grace period.
+
+## 3. TERM AND TERMINATION
+
+**Initial Term:** [3] months starting [DATE]
+**Renewal:** Auto-renews monthly unless either party gives [30] days written notice.
+**Immediate termination:** For material breach uncured after [7] days notice.
+
+On termination, Consultant delivers all work in progress within [5] business days.
+
+## 4. INTELLECTUAL PROPERTY
+
+Work product created under this Agreement belongs to [Client / Consultant / jointly].
+Advisory output (recommendations, analyses) are Client property upon full payment.
+
+## 5. EXCLUSIVITY
+
+[OPTION A - Non-exclusive:]
+This Agreement is non-exclusive. Consultant may work with other clients.
+
+[OPTION B - Partial exclusivity:]
+Consultant will not work with direct competitors of Client during the term
+and [90] days thereafter.
+
+## 6. CONFIDENTIALITY AND DATA PROTECTION
+
+EU/DACH: If Consultant processes personal data on behalf of Client, the parties
+shall execute a Data Processing Agreement (DPA) per Art. 28 GDPR.
+
+## 7. LIABILITY
+
+Consultant's aggregate liability is capped at [3x] the fees paid in the [3] months
+preceding the claim.
+
+---
+
+Signatures as above.
+```
+
+## Template C: SaaS Partnership Agreement
+
+```markdown
+# SAAS PARTNERSHIP AGREEMENT
+
+**Effective Date:** [DATE]
+**Provider:** [NAME], [ADDRESS]
+**Partner:** [NAME], [ADDRESS]
+
+---
+
+## 1. PURPOSE
+
+Provider grants Partner [reseller / referral / white-label / integration] rights to
+Provider's [PRODUCT NAME] ("Software") subject to this Agreement.
+
+## 2. PARTNERSHIP TYPE
+
+[ ] Referral: Partner refers customers; earns [X%] of first-year ARR per referral.
+[ ] Reseller: Partner resells licenses; earns [X%] discount off list price.
+[ ] White-label: Partner rebrands Software; pays [AMOUNT]/month platform fee.
+[ ] Integration: Partner integrates Software via API; terms in Exhibit A.
+
+## 3. REVENUE SHARE
+
+| Tier | Monthly ARR Referred | Commission |
+|------|---------------------|------------|
+| Bronze | < $10,000 | [X]% |
+| Silver | $10,000-$50,000 | [X]% |
+| Gold | > $50,000 | [X]% |
+
+Payout: Net-30 after month close, minimum $[500] threshold.
+
+## 4. INTELLECTUAL PROPERTY
+
+Each party retains all IP in its own products. No implied licenses.
+Partner may use Provider's marks per Provider's Brand Guidelines (Exhibit B).
+
+## 5. DATA AND PRIVACY
+
+Each party is an independent data controller for its own customers.
+Joint processing requires a separate DPA (Exhibit C - EU/DACH projects).
+
+## 6. TERM
+
+Initial: [12] months. Renews annually unless [90]-day written notice given.
+Termination for Cause: [30]-day cure period for material breach.
+
+## 7. LIMITATION OF LIABILITY
+
+Each party's liability capped at [1x] fees paid/received in prior [12] months.
+Mutual indemnification for IP infringement claims from own products.
+
+---
+
+Signatures, exhibits, and governing law per applicable jurisdiction.
+```
+
+## GDPR Data Processing Addendum (EU/DACH Clause Block)
+
+```markdown
+## DATA PROCESSING ADDENDUM (Art. 28 GDPR)
+
+Controller: [CLIENT NAME]
+Processor: [CONTRACTOR NAME]
+
+### Subject Matter
+Processor processes personal data on behalf of Controller solely to perform services
+under the main Agreement.
+
+### Categories of Data Subjects
+[e.g., end users, employees, customers]
+
+### Categories of Personal Data
+[e.g., names, email addresses, usage data]
+
+### Processing Duration
+For the term of the main Agreement; deletion within [30] days of termination.
+
+### Processor Obligations
+- Process data only on Controller's documented instructions
+- Ensure persons authorized to process have committed to confidentiality
+- Implement technical and organizational measures per Art. 32 GDPR
+- Assist Controller with data subject rights requests
+- Not engage sub-processors without prior written consent
+- Delete or return all personal data upon termination
+
+### Sub-processors (current as of Effective Date)
+| Sub-processor | Location | Purpose |
+|--------------|----------|---------|
+| [AWS / GCP / Azure] | [Region] | Cloud hosting |
+| [Other] | [Location] | [Purpose] |
+
+### Cross-border Transfers
+Data transfers outside EEA covered by: [ ] SCCs  [ ] Adequacy Decision  [ ] BCRs
+```
+
+## DOCX Conversion
+
+```bash
+# Install pandoc
+brew install pandoc        # macOS
+apt install pandoc         # Ubuntu
+
+# Basic conversion
+pandoc contract.md -o contract.docx \
+  --reference-doc=reference.docx \
+  -V geometry:margin=1in
+
+# With numbered sections (legal style)
+pandoc contract.md -o contract.docx \
+  --number-sections \
+  -V documentclass=article \
+  -V fontsize=11pt
+
+# With custom company template
+pandoc contract.md -o contract.docx \
+  --reference-doc=company-template.docx
+```

package/skills/contract-testing/SKILL.md

@@ -0,0 +1,42 @@
+---
+name: contract-testing
+description: "Pact contract testing: generate consumer-driven contracts, verify providers, publish to broker, run can-i-deploy. Go/TS/RN."
+category: "testing"
+argument-hint: "[consumer|provider|setup]"
+user-invocable: true
+allowed-tools: Read, Glob, Grep, Bash, Write, Edit, Task
+---
+# Contract Testing (Pact)
+
+## Cuando usar / NO usar
+
+| Usar | NO usar |
+|------|---------|
+| Microservicios con consumer y provider evolucionando separado | APIs terceros (Stripe, Google) — usar recorded mocks |
+| Detectar breaking changes API antes de deploy | Validar logica e2e — Pact valida shape, no business logic |
+| Reemplazar parcialmente E2E tests costosos/flakey | Contratos asincronos triviales sin evolucion |
+| Integraciones internas: `alizia-web <-> alizia-api`, mobile <-> api | Un equipo controla ambos lados sin CI separado |
+
+## Concepto
+
+Consumer-driven contract testing: consumer describe lo que espera -> provider lo verifica. Cada lado testea contra el contrato, no contra el otro servicio real. Complementario a OpenAPI (docs) — Pact valida expectativas ejecutables.
+
+## Flujo
+
+1. Consumer escribe tests usando mock Pact server -> genera `pacts/<consumer>-<provider>.json`
+2. Publicar a **Pact Broker** (Docker self-host gratis, o PactFlow SaaS) con `--consumer-app-version=$GIT_SHA --branch=$GIT_BRANCH`
+3. Webhook broker -> dispara provider verify en CI
+4. Provider corre verification con StateHandlers para cada `given()` del consumer
+5. Resultado publicado al broker
+6. `can-i-deploy` gate bloquea deploys incompatibles
+
+> → Read references/implementation-details.md for consumer/provider setup, broker config, CI gate, and breaking change detection
+
+> → Read references/anti-patterns-and-checklist.md for anti-patterns and implementation checklist
+
+## Delegacion
+
+- `/scaffold-go` — provider Go scaffold
+- `/api-docs` — OpenAPI complementario
+- `/deploy-check` — integrar can-i-deploy
+- `/doc-rfc` — documentar decision de adoptar Pact

package/skills/contract-testing/references/anti-patterns-and-checklist.md

@@ -0,0 +1,28 @@
+# Contract Testing Anti-Patterns & Checklist
+
+## Anti-patterns
+
+- Hardcodear valores sin matchers — contratos fragiles
+- Pact como mock completo del backend — solo shape + happy path
+- Provider verify opcional en CI
+- Sin can-i-deploy gate
+- Broker sin tagging branch/version
+- Consumer testea TODOS los endpoints — solo los que realmente usa
+- Sin integration tests de flujos criticos (Pact no valida e2e)
+- OpenAPI como reemplazo de Pact
+- Pact contra APIs terceros
+- Provider states con estado compartido entre tests — flaky
+
+## Checklist
+
+- [ ] Consumer y provider nombres acordados
+- [ ] Broker corriendo (Docker o PactFlow)
+- [ ] Consumer: tests PactV3 con matchers (like, eachLike, term)
+- [ ] Consumer CI publica pacts con version+branch
+- [ ] Webhook broker -> provider CI verify al cambiar pact
+- [ ] Provider: StateHandlers para cada given()
+- [ ] Provider CI publica verification results
+- [ ] can-i-deploy gate en ambos workflows
+- [ ] Branch/version tagging configurado
+- [ ] Integration tests cubren flujos que Pact no valida
+- [ ] Terceros usan recorded mocks, NO Pact