claude-code-arcane 1.0.0

package/skills/asset-audit/SKILL.md

@@ -0,0 +1,95 @@
+---
+name: asset-audit
+description: "Audits game assets for compliance with naming conventions, file size budgets, format standards, and pipeline requirements. Identifies orphaned assets, missing references, and standard violations."
+category: "gamedev"
+argument-hint: "[category|all]"
+user-invocable: true
+allowed-tools: Read, Glob, Grep
+# Read-only diagnostic skill — no specialist agent delegation needed
+---
+
+## Phase 1: Read Standards
+
+Read the art bible or asset standards from the relevant design docs and the CLAUDE.md naming conventions.
+
+---
+
+## Phase 2: Scan Asset Directories
+
+Scan the target asset directory using Glob:
+
+- `assets/art/**/*` for art assets
+- `assets/audio/**/*` for audio assets
+- `assets/vfx/**/*` for VFX assets
+- `assets/shaders/**/*` for shaders
+- `assets/data/**/*` for data files
+
+---
+
+## Phase 3: Run Compliance Checks
+
+**Naming conventions:**
+- Art: `[category]_[name]_[variant]_[size].[ext]`
+- Audio: `[category]_[context]_[name]_[variant].[ext]`
+- All files must be lowercase with underscores
+
+**File standards:**
+- Textures: Power-of-two dimensions, correct format (PNG for UI, compressed for 3D), within size budget
+- Audio: Correct sample rate, format (OGG for SFX, OGG/MP3 for music), within duration limits
+- Data: Valid JSON/YAML, schema-compliant
+
+**Orphaned assets:** Search code for references to each asset file. Flag any with no references.
+
+**Missing assets:** Search code for asset references and verify the files exist.
+
+---
+
+## Phase 4: Output Audit Report
+
+```markdown
+# Asset Audit Report -- [Category] -- [Date]
+
+## Summary
+- **Total assets scanned**: [N]
+- **Naming violations**: [N]
+- **Size violations**: [N]
+- **Format violations**: [N]
+- **Orphaned assets**: [N]
+- **Missing assets**: [N]
+- **Overall health**: [CLEAN / MINOR ISSUES / NEEDS ATTENTION]
+
+## Naming Violations
+| File | Expected Pattern | Issue |
+|------|-----------------|-------|
+
+## Size Violations
+| File | Budget | Actual | Overage |
+|------|--------|--------|---------|
+
+## Format Violations
+| File | Expected Format | Actual Format |
+|------|----------------|---------------|
+
+## Orphaned Assets (no code references found)
+| File | Last Modified | Size | Recommendation |
+|------|-------------|------|---------------|
+
+## Missing Assets (referenced but not found)
+| Reference Location | Expected Path |
+|-------------------|---------------|
+
+## Recommendations
+[Prioritized list of fixes]
+
+## Verdict: [COMPLIANT / WARNINGS / NON-COMPLIANT]
+```
+
+This skill is read-only — it produces a report but does not write files.
+
+---
+
+## Phase 5: Next Steps
+
+- Fix naming violations using the patterns defined in CLAUDE.md.
+- Delete confirmed orphaned assets after manual review.
+- Run `/content-audit` to cross-check asset counts against GDD-specified requirements.

package/skills/asset-spec/SKILL.md

@@ -0,0 +1,72 @@
+---
+name: asset-spec
+description: "Generate per-asset visual specs: description, AI prompts, dimensions, format, naming, art bible anchors. Produces spec files and updates manifest."
+category: "gamedev"
+argument-hint: "[system:<name>|level:<name>|character:<name>]"
+user-invocable: true
+allowed-tools: Read, Glob, Grep, Write, Edit
+---
+# asset-spec — Per-Asset Visual Specifications
+
+Genera specs visuales por asset con prompts para AI generation, ancladas al art bible.
+
+## Cuándo usar
+
+- Después de art bible y GDD/level design aprobados, antes de producción
+- Para cualquier batch de assets que necesite specs consistentes
+
+## Requisito
+
+Art bible debe existir (`design/art/art-bible.md` o equivalente). Sin art bible → "Correr `/art-bible` primero."
+
+---
+
+## Phase 1: Contexto
+
+Leer antes de preguntar nada:
+- **Art bible**: Visual Identity, Color System, Shape Language, Asset Standards (sección 8)
+- **Source doc** según target type:
+  - `system:` → GDD del sistema (sección Visual/Audio Requirements)
+  - `level:` → Level design doc (art requirements, asset list)
+  - `character:` → Character profile (visual description, rol)
+- **Manifest existente** (`design/assets/asset-manifest.md`) → evitar duplicados
+- **Specs existentes** → detectar assets compartidos reutilizables
+
+---
+
+## Phase 2: Identificar assets
+
+Extraer de source doc todo asset mencionado o implícito:
+
+| Categoría | Qué buscar |
+|-----------|-----------|
+| **Sprite / 2D** | Character sprites, UI icons, tile sheets |
+| **VFX / Particles** | Hit effects, ambient particles, screen effects |
+| **Environment** | Props, tiles, backgrounds, skyboxes |
+| **UI** | HUD elements, menu art, fonts custom |
+| **Audio** | SFX, music, ambient (descripción only, no generation prompt) |
+| **3D** | Meshes, materials (si aplica) |
+
+Presentar lista agrupada al usuario. **No avanzar sin confirmación** de la lista.
+
+### Assets compartidos
+
+Antes de specear, verificar si ya existe spec para un asset equivalente en otro contexto. Si existe → referenciar el ASSET-ID existente en lugar de duplicar.
+
+---
+
+## Phase 3: Generar specs
+
+> → Read references/spec-output-format.md for [formato de spec por asset, campos requeridos y asset IDs]
+
+---
+
+## Phase 4: Escribir
+
+Después de aprobación:
+1. Spec file → `design/assets/specs/[target-name]-assets.md`
+2. Actualizar/crear `design/assets/asset-manifest.md` con tabla de progress (Total/Needed/In Progress/Done)
+
+---
+
+> → Read references/anti-patterns-checklist.md for [anti-patterns y checklist de validación]

package/skills/asset-spec/references/anti-patterns-checklist.md

@@ -0,0 +1,19 @@
+# Anti-patterns
+
+- Specs sin anclar al art bible — inconsistencia visual garantizada
+- Duplicar assets que ya tienen spec en otro contexto
+- Generation prompts genéricos ("a sword") sin style keywords ni color anchors
+- Visual descriptions vagas ("looks cool") en lugar de específicas ("angular silhouette, Threat Blue glow, 3-frame pulse animation")
+- Dimensiones inventadas que no matchean los tiers del Art Bible §8
+
+# Checklist
+
+```markdown
+- [ ] Art bible leído, §8 Asset Standards identificados
+- [ ] Source doc leído, assets explícitos e implícitos extraídos
+- [ ] Lista de assets confirmada por usuario
+- [ ] Assets compartidos detectados (no duplicar)
+- [ ] Cada spec con: dimensions, format, naming, visual description, art bible anchors
+- [ ] Generation prompts con style keywords y negative prompts
+- [ ] Asset IDs secuenciales, manifest actualizado
+```

package/skills/asset-spec/references/spec-output-format.md

@@ -0,0 +1,34 @@
+# Asset Spec Output Format
+
+For each asset, produce:
+
+```markdown
+## ASSET-[NNN] — [Nombre]
+
+| Campo | Valor |
+|-------|-------|
+| Category | [Sprite / VFX / Environment / UI / Audio / 3D] |
+| Dimensions | [ej: 256x256px, 4-frame sprite sheet] |
+| Format | [PNG / SVG / WAV / etc.] |
+| Naming | [ej: vfx_frost_hit_01.png] |
+| Polycount | [si 3D — ej: <800 tris] |
+| Texture Res | [ej: 512px — Art Bible §8 Tier 2] |
+
+**Visual Description:**
+[2-3 oraciones. Suficientemente específico para que dos artistas produzcan resultados consistentes.]
+
+**Art Bible Anchors:**
+- §3 Shape Language: [regla aplicada]
+- §4 Color System: [rol del color — ej: "Threat Blue per semantic rules"]
+
+**Generation Prompt:**
+[Prompt ready-to-use para AI (Midjourney/SD style). Incluir: style keywords, composición, paleta, lighting, negative prompts.]
+
+**Status:** Needed
+```
+
+For audio: descripción del carácter sónico en lugar de generation prompt.
+
+## Asset IDs
+
+Secuenciales a nivel proyecto (no por contexto). Leer manifest para encontrar el último ID asignado. Si no hay manifest → empezar en ASSET-001.

package/skills/async-ops/SKILL.md

@@ -0,0 +1,59 @@
+---
+name: async-ops
+description: "Webhook handling and background job scheduling for backend services"
+category: "backend"
+argument-hint: "[webhooks|jobs|queues|full]"
+user-invocable: true
+allowed-tools: ["Read", "Edit", "Write", "Bash", "Glob", "Grep"]
+---
+# async-ops — Webhooks & Background Job Scheduling
+
+Stack: Fastify + Prisma + PostgreSQL + Redis + BullMQ + Zod + TypeScript.
+
+## INBOUND WEBHOOKS (Receiving)
+
+**Flow:** receive -> verify signature -> deduplicate -> enqueue -> respond 200 (< 2s). All processing async via queue.
+
+**Signature:** use provider SDK when available. Custom: HMAC-SHA256 over `timestamp.body`. Require raw body access (verify before parsing). Always include timestamp in signed material.
+
+**Anti-replay:** reject if timestamp differs from server time by > 5 minutes.
+
+**Idempotency:** Redis SETNX with event ID as key, 7-day TTL. If exists, return 200 `already_processed`.
+
+### Inbound Checklist
+- [ ] Signature verified (HMAC-SHA256 or provider SDK)
+- [ ] Timestamp anti-replay (< 5 min drift)
+- [ ] Idempotency by event ID (Redis SETNX + TTL)
+- [ ] Enqueue + fast 200 — processing async
+- [ ] Structured log with event_id and trace_id
+- [ ] Secret rotation plan documented
+
+## OUTBOUND WEBHOOKS (Sending)
+
+Transactional outbox pattern + HMAC signature + exponential backoff retry + DLQ.
+
+> → Read references/outbound-webhooks.md for outbox pattern, payload format, retry schedule, subscriber management y SSRF prevention
+
+## JOB SCHEDULING & QUEUES
+
+BullMQ + Redis default. Queues separated by criticality. Jobs idempotent with timeout.
+
+> → Read references/job-scheduling.md for queue technology selection, job design principles, retry, scheduling, concurrency y graceful shutdown
+
+## SHARED PATTERNS
+
+**Idempotency:** unique event/job ID as dedup key (Redis SETNX or BullMQ jobId). Pass idempotency keys to external providers. Check entity state before side effects.
+
+**Dead Letter Handling:** store in DLQ table / BullMQ failed set. Alert on growth. Dashboard for inspection + replay. 30-day retention. Auto-disable sustained failures.
+
+**Observability:** metrics for `webhook_{inbound,outbound}_total`, `webhook_{outbox_pending,dlq_depth}`, `job_{enqueued,completed}_total`, `job_duration_seconds`, `queue_depth{state}`. Propagate `traceId` in payloads. Structured logs with event_id, job_id, queue.
+
+**Alerts:** rising queue/outbox depth (throughput insufficient), DLQ growth > N/min (systemic), subscriber failure > 5% (endpoint down), failed jobs/min > threshold (page on-call).
+
+## ANTI-PATTERNS
+
+> → Read references/anti-patterns.md for lista completa (14 items)
+
+## Checklist
+
+> → Read references/checklist.md for checklist completo (8 items)

package/skills/async-ops/references/anti-patterns.md

@@ -0,0 +1,16 @@
+# Anti-patterns — Async Ops
+
+- No idempotency (double-charge/send)
+- Sync webhook processing before 200 (timeout cascades)
+- No signature verification (forgery)
+- Signing body without timestamp (replay)
+- Unbounded retries without DLQ (flood on recovery)
+- Retries without jitter (thundering herd)
+- No outbox (events lost between commit and enqueue)
+- Single queue for all types (starvation)
+- Cron on all pods without lock (N executions)
+- No graceful shutdown (lost jobs)
+- Secrets/PII in payloads
+- Missing correlation IDs
+- `removeOnComplete: true` on important jobs
+- Giant payloads in Redis

package/skills/async-ops/references/checklist.md

@@ -0,0 +1,10 @@
+# Review Checklist — Async Ops
+
+- [ ] Inbound: signature verified, anti-replay, idempotent, async processing
+- [ ] Outbound: outbox pattern, HMAC signature, retry schedule, DLQ
+- [ ] Subscriber URLs validated for SSRF
+- [ ] Queues separated by criticality; jobs idempotent with timeout
+- [ ] Retry + backoff + jitter; rate limiter on workers calling external APIs
+- [ ] Graceful shutdown; DLQ with alerts and replay
+- [ ] Metrics exported; correlation ID propagated through all chains
+- [ ] No secrets/PII in payloads; Bull Board behind auth

package/skills/async-ops/references/job-scheduling.md

@@ -0,0 +1,37 @@
+# Job Scheduling & Queues
+
+## Queue Technology
+
+| Tool | When |
+|------|------|
+| **BullMQ + Redis** | **Default** — mature, Bull Board UI, scheduler, rate limiter |
+| **pg-boss + PostgreSQL** | No Redis dependency, everything in Postgres |
+| **k8s CronJob** | Simple scheduled scripts, no app logic needed |
+| **Temporal** | Complex multi-step durable workflows |
+
+## Queue Separation
+
+`critical` (auth, payments — low latency), `default` (user-facing), `bulk` (imports, reports — long timeout). Separate worker pods per critical queue to prevent starvation.
+
+## Job Design Principles
+
+- **Idempotent**: use jobId for dedup, check state before acting
+- **Timeout**: set per-job; long jobs checkpoint progress
+- **Small payload**: store IDs not data (> 1MB degrades Redis)
+- **No secrets in payload**: read from vault/env by reference
+
+## Retry
+
+5 attempts default, exponential backoff (30s base), +/-25% jitter. Retry on network/5xx/timeout. No retry on 4xx/validation -> DLQ.
+
+## Scheduling
+
+Cron recurring (`upsertJobScheduler`), delayed one-shot (`delay` option), event-driven (enqueue on domain event), dependent flows (`FlowProducer`).
+
+## Concurrency
+
+Set worker `concurrency` per queue. Per-entity lock (Redis SETNX) for one-at-a-time. Worker-level `limiter` for downstream protection.
+
+## Graceful Shutdown
+
+Handle SIGTERM, stop accepting jobs, wait for in-flight. Set k8s `terminationGracePeriodSeconds` (e.g., 60s).

package/skills/async-ops/references/outbound-webhooks.md

@@ -0,0 +1,19 @@
+# Outbound Webhooks (Sending)
+
+**Architecture:** event -> transactional outbox (DB row, same transaction as business op) -> delivery worker -> HTTP POST with HMAC -> subscriber. Failure: exponential backoff -> DLQ.
+
+**Outbox pattern:** write event to outbox table in same DB transaction as business operation. Guarantees no events lost. Worker polls pending rows.
+
+**Payload:** include `id`, `type`, `version`, `createdAt`, `data`. Minimize PII. Version schema for backward compatibility.
+
+**Signature headers:** Event-Id, Event-Type, Timestamp, Signature (`sha256=...`). Sign `timestamp.body` (not body alone).
+
+## Retry
+
+Immediate, +1m, +5m, +30m, +2h, +12h, +24h -> DLQ. All +/-25% jitter. Retry on: timeout/5xx/network. DLQ immediately on: 410, 400, sustained 401/403.
+
+## Subscriber Management
+
+Per-subscriber secret (>= 256 bits, encrypted at-rest), event filtering by glob (`course.*`), auto-disable after 100+ consecutive failures. Dashboard: deliveries, payload inspection, replay, secret rotation.
+
+**SSRF prevention:** HTTPS only, reject private IPs (127.x, 10.x, 192.168.x, 169.254.x, ::1), re-validate after DNS resolution.

package/skills/atlassian-admin/SKILL.md

@@ -0,0 +1,121 @@
+---
+name: atlassian-admin
+description: "Atlassian Administrator for managing Jira, Confluence, Bitbucket users, permissions, security, integrations, SSO, and org-wide governance."
+argument-hint: ""
+category: "agile"
+user-invocable: true
+allowed-tools: Read, Glob, Grep, Bash
+---
+
+# Atlassian Administrator Expert
+
+## Workflows
+
+### User Provisioning
+1. Create user account: `admin.atlassian.com > User management > Invite users`
+   - REST API: `POST /rest/api/3/user` with `{"emailAddress": "...", "displayName": "...","products": [...]}`
+2. Add to appropriate groups: `admin.atlassian.com > User management > Groups > [group] > Add members`
+3. Assign product access (Jira, Confluence) via `admin.atlassian.com > Products > [product] > Access`
+4. Configure default permissions per group scheme
+5. Send welcome email with onboarding info
+6. **NOTIFY**: Relevant team leads of new member
+7. **VERIFY**: Confirm user appears active and can log in
+
+### User Deprovisioning
+1. **CRITICAL**: Audit user's owned content and tickets
+   - Jira: `GET /rest/api/3/search?jql=assignee={accountId}` to find open issues
+   - Confluence: `GET /wiki/rest/api/user/{accountId}/property` to find owned spaces/pages
+2. Reassign ownership of: Jira projects, Confluence spaces, open issues, filters and dashboards
+3. Remove from all groups and revoke product access
+4. Deactivate account: `admin.atlassian.com > User management > [user] > Deactivate`
+5. **VERIFY**: Confirm `GET /rest/api/3/user?accountId={accountId}` returns `"active": false`
+6. Document deprovisioning in audit log
+
+### Group Management
+1. Create groups: `admin.atlassian.com > User management > Groups > Create group`
+   - Structure by: Teams (engineering, product, sales), Roles (admins, users, viewers), Projects
+2. Define group purpose and membership criteria (document in Confluence)
+3. Assign default permissions per group
+4. **VERIFY**: Confirm group members via `GET /rest/api/3/group/member?groupName={name}`
+5. Regular review and cleanup (quarterly)
+
+### Permission Scheme Design
+
+> See references/security-hardening-guide.md for detailed permission schemes and SSO configuration.
+
+**Jira Permission Schemes** (`Jira Settings > Issues > Permission Schemes`):
+- **Public Project**: All users can view, members can edit
+- **Team Project**: Team members full access, stakeholders view
+- **Restricted Project**: Named individuals only
+
+**Confluence Permission Schemes** (`Confluence Admin > Space permissions`):
+- **Public Space**: All users view, space members edit
+- **Team Space**: Team-specific access
+- **Restricted Space**: Named individuals and groups
+
+**Best Practices**: Use groups not individual permissions, principle of least privilege, regular permission audits.
+
+### Marketplace App Management
+1. Evaluate app need and security at `marketplace.atlassian.com`
+2. Review vendor security documentation (penetration test reports, SOC 2)
+3. Test app in sandbox environment
+4. Install app: `admin.atlassian.com > Products > [product] > Apps > Find new apps`
+5. Configure app settings per vendor documentation
+6. **VERIFY**: Confirm app appears in `GET /rest/plugins/1.0/` and health check passes
+
+## Global Configuration
+
+> See references/user-provisioning-checklist.md for SSO, integration setup, and system performance details.
+
+### Jira Global Settings (`Jira Settings > Issues`)
+- **Issue Types**: Create and manage org-wide issue types; define issue type schemes
+- **Workflows**: Create global workflow templates; manage workflow schemes
+- **Custom Fields**: Create org-wide custom fields; manage field configurations and context
+- **Notification Schemes**: Configure default notification rules; manage email templates
+
+### Confluence Global Settings (`Confluence Admin`)
+- **Blueprints & Templates**: Create org-wide templates at `Configuration > Global Templates and Blueprints`
+- **Themes & Appearance**: Configure org branding at `Configuration > Themes`
+- **Macros**: Enable/disable macros at `Configuration > Macro usage`
+
+### Security Settings (`admin.atlassian.com > Security`)
+- Password policies, session timeout, API token management
+- Data residency configuration
+- Audit logs: enable comprehensive logging, retain per policy (minimum 7 years for SOC 2/GDPR)
+
+## Governance & Policies
+
+### Access Governance
+- Quarterly review of all user access
+- Limit org admins to 2-3 individuals; audit admin actions monthly
+- Require MFA for all admins: `Security > Authentication policies > Require 2FA`
+
+### Naming Conventions
+- **Jira**: Project keys 3-4 uppercase letters; issue types Title Case; custom fields prefixed
+- **Confluence**: Spaces use Team/Project prefix; pages descriptive; labels lowercase, hyphen-separated
+
+### Change Management
+- **Major Changes**: Announce 2 weeks in advance; test in sandbox; create rollback plan; post-implementation review
+- **Minor Changes**: Announce 48 hours in advance; document in change log
+
+## Disaster Recovery
+
+**Backup Strategy**: Daily automated backups; weekly manual verification; 30-day retention; offsite storage.
+**Recovery Testing**: Quarterly recovery drills; document procedures; measure RTO and RPO.
+
+**Incident Severity Levels**: P1 Critical (15 min response), P2 High (1 hour), P3 Medium (4 hours), P4 Low (24 hours).
+
+## Metrics & Reporting
+
+- **System Health**: Active users, storage utilization, API rate limits, response times
+- **Usage Analytics**: Most active projects/spaces, content creation trends, search patterns
+- **Compliance Metrics**: Access review completion, security audit findings, failed login attempts
+
+## Handoff Protocols
+
+| Partner | Sends TO | Receives FROM |
+|---------|----------|---------------|
+| **Jira Expert** | Global workflows, custom fields, permission schemes | Project-specific config needs |
+| **Confluence Expert** | Global templates, space permission schemes, blueprints | Space-specific needs |
+| **Senior PM** | Usage analytics, capacity planning, compliance status | Strategic planning input |
+| **Scrum Master** | Team access, board config options, integrations | Workflow needs |

package/skills/atlassian-admin/assets/permission_scheme_template.json

@@ -0,0 +1,173 @@
+{
+  "permissionScheme": {
+    "name": "Standard Project Permission Scheme",
+    "description": "Default permission scheme for standard projects. Assigns permissions based on project roles.",
+    "version": "1.0",
+    "lastUpdated": "YYYY-MM-DD",
+    "owner": "IT Admin Team"
+  },
+  "roles": {
+    "projectAdmin": {
+      "description": "Full project administration including configuration and user management",
+      "typicalGroups": ["project-leads", "engineering-managers"]
+    },
+    "developer": {
+      "description": "Create and manage issues, transitions, and attachments",
+      "typicalGroups": ["dept-engineering", "dept-product"]
+    },
+    "user": {
+      "description": "View issues, add comments, and create basic issues",
+      "typicalGroups": ["org-all-employees"]
+    },
+    "viewer": {
+      "description": "Read-only access to project issues and boards",
+      "typicalGroups": ["stakeholders", "external-contractors"]
+    }
+  },
+  "permissions": {
+    "project": {
+      "ADMINISTER_PROJECTS": {
+        "description": "Manage project settings, roles, and permissions",
+        "grantedTo": ["projectAdmin"]
+      },
+      "BROWSE_PROJECTS": {
+        "description": "View the project and its issues",
+        "grantedTo": ["projectAdmin", "developer", "user", "viewer"]
+      },
+      "VIEW_DEV_TOOLS": {
+        "description": "View development panel (commits, branches, PRs)",
+        "grantedTo": ["projectAdmin", "developer"]
+      },
+      "VIEW_READONLY_WORKFLOW": {
+        "description": "View read-only workflow",
+        "grantedTo": ["projectAdmin", "developer", "user", "viewer"]
+      }
+    },
+    "issues": {
+      "CREATE_ISSUES": {
+        "description": "Create new issues in the project",
+        "grantedTo": ["projectAdmin", "developer", "user"]
+      },
+      "EDIT_ISSUES": {
+        "description": "Edit issue fields",
+        "grantedTo": ["projectAdmin", "developer"]
+      },
+      "DELETE_ISSUES": {
+        "description": "Delete issues permanently",
+        "grantedTo": ["projectAdmin"]
+      },
+      "ASSIGN_ISSUES": {
+        "description": "Assign issues to team members",
+        "grantedTo": ["projectAdmin", "developer"]
+      },
+      "ASSIGNABLE_USER": {
+        "description": "Be assigned to issues",
+        "grantedTo": ["projectAdmin", "developer"]
+      },
+      "CLOSE_ISSUES": {
+        "description": "Close/resolve issues",
+        "grantedTo": ["projectAdmin", "developer"]
+      },
+      "RESOLVE_ISSUES": {
+        "description": "Set issue resolution",
+        "grantedTo": ["projectAdmin", "developer"]
+      },
+      "TRANSITION_ISSUES": {
+        "description": "Transition issues through workflow",
+        "grantedTo": ["projectAdmin", "developer", "user"]
+      },
+      "LINK_ISSUES": {
+        "description": "Create and remove issue links",
+        "grantedTo": ["projectAdmin", "developer"]
+      },
+      "MOVE_ISSUES": {
+        "description": "Move issues between projects",
+        "grantedTo": ["projectAdmin"]
+      },
+      "SCHEDULE_ISSUES": {
+        "description": "Set due dates on issues",
+        "grantedTo": ["projectAdmin", "developer"]
+      },
+      "SET_ISSUE_SECURITY": {
+        "description": "Set security level on issues",
+        "grantedTo": ["projectAdmin"]
+      }
+    },
+    "comments": {
+      "ADD_COMMENTS": {
+        "description": "Add comments to issues",
+        "grantedTo": ["projectAdmin", "developer", "user"]
+      },
+      "EDIT_ALL_COMMENTS": {
+        "description": "Edit any comment",
+        "grantedTo": ["projectAdmin"]
+      },
+      "EDIT_OWN_COMMENTS": {
+        "description": "Edit own comments",
+        "grantedTo": ["projectAdmin", "developer", "user"]
+      },
+      "DELETE_ALL_COMMENTS": {
+        "description": "Delete any comment",
+        "grantedTo": ["projectAdmin"]
+      },
+      "DELETE_OWN_COMMENTS": {
+        "description": "Delete own comments",
+        "grantedTo": ["projectAdmin", "developer", "user"]
+      }
+    },
+    "attachments": {
+      "CREATE_ATTACHMENTS": {
+        "description": "Attach files to issues",
+        "grantedTo": ["projectAdmin", "developer", "user"]
+      },
+      "DELETE_ALL_ATTACHMENTS": {
+        "description": "Delete any attachment",
+        "grantedTo": ["projectAdmin"]
+      },
+      "DELETE_OWN_ATTACHMENTS": {
+        "description": "Delete own attachments",
+        "grantedTo": ["projectAdmin", "developer", "user"]
+      }
+    },
+    "worklogs": {
+      "WORK_ON_ISSUES": {
+        "description": "Log work on issues",
+        "grantedTo": ["projectAdmin", "developer"]
+      },
+      "EDIT_ALL_WORKLOGS": {
+        "description": "Edit any worklog",
+        "grantedTo": ["projectAdmin"]
+      },
+      "EDIT_OWN_WORKLOGS": {
+        "description": "Edit own worklogs",
+        "grantedTo": ["projectAdmin", "developer"]
+      },
+      "DELETE_ALL_WORKLOGS": {
+        "description": "Delete any worklog",
+        "grantedTo": ["projectAdmin"]
+      },
+      "DELETE_OWN_WORKLOGS": {
+        "description": "Delete own worklogs",
+        "grantedTo": ["projectAdmin", "developer"]
+      }
+    }
+  },
+  "projectMappings": [
+    {
+      "projectKey": "EXAMPLE",
+      "projectName": "Example Project",
+      "scheme": "Standard Project Permission Scheme",
+      "roleAssignments": {
+        "projectAdmin": ["project-leads"],
+        "developer": ["team-example-devs"],
+        "user": ["org-all-employees"],
+        "viewer": ["stakeholders-example"]
+      }
+    }
+  ],
+  "notes": {
+    "usage": "Copy this template and customize role assignments per project. Use group names that match your Atlassian groups.",
+    "review": "Review permission scheme assignments quarterly as part of access review.",
+    "changes": "Any changes to permission schemes should be documented and approved by IT Admin."
+  }
+}