contextos-agents 2.0.0-beta.3 → 2.1.0

package/.agents/generated/gemini/skills/engineering-workflow/SKILL.md

@@ -42,7 +42,7 @@ Inspired by [addyosmani/agent-skills](https://github.com/addyosmani/agent-skills
 
 ---
 
-### Phase 1: DEFINE — /spec
+### Phase 1: DEFINE - /spec
 
 **Auto-activates → `[ROLE: Product Manager]`**
 
@@ -76,8 +76,8 @@ Before writing the spec, if there is ambiguity, high blast radius, or multiple a
 ### Technical Approach
 [Read the relevant code. Understand what changes where.]
 Files affected:
-- `src/X.js` — [what changes]
-- `src/Y.js` — [what changes]
+- `src/X.js` - [what changes]
+- `src/Y.js` - [what changes]
 
 ### Acceptance Criteria
 - [ ] Given [context], when [action], then [result]
@@ -90,7 +90,7 @@ Files affected:
 
 ---
 
-### Phase 2: PLAN — /plan
+### Phase 2: PLAN - /plan
 
 **Auto-activates → `[ROLE: Architect]`**
 
@@ -108,7 +108,7 @@ Organize tasks as **Thin Vertical Slices** rather than horizontal layers:
 - Each task must be **completable in < 2 hours** of focused work.
 - Each task must be **independently testable**.
 - Tasks must be **ordered by dependency** (blocking tasks first).
-- Each task gets a **test requirement** — no task without a test.
+- Each task gets a **test requirement** - no task without a test.
 
 #### Plan Template
 
@@ -133,13 +133,13 @@ Organize tasks as **Thin Vertical Slices** rather than horizontal layers:
 - [Risk 1]: [Mitigation]
 - [Risk 2]: [Mitigation]
 
-### STOP — Awaiting Approval
+### STOP - Awaiting Approval
 Do not proceed to BUILD until this plan is approved.
 ```
 
 ---
 
-### Phase 3: BUILD — /build
+### Phase 3: BUILD - /build
 
 **Auto-activates → `[ROLE: Senior Developer]`**
 
@@ -147,12 +147,12 @@ Implement one task at a time. Commit after each task.
 
 #### Build Rules
 
-1. **One task per commit** — atomic, descriptive commit messages.
-2. **Write the test FIRST** (TDD — red-green-refactor).
-3. **No dead code** — if it's not tested, it's not shipped.
-4. **No TODOs in committed code** — resolve or create a tracked issue.
-5. **Read before writing** — understand the surrounding code before changing it.
-6. **Limit the blast radius** — modify ONLY the files explicitly listed in the current task's plan. Do NOT rewrite adjacent components, hooks, or utilities unless strictly required AND approved.
+1. **One task per commit** - atomic, descriptive commit messages.
+2. **Write the test FIRST** (TDD - red-green-refactor).
+3. **No dead code** - if it's not tested, it's not shipped.
+4. **No TODOs in committed code** - resolve or create a tracked issue.
+5. **Read before writing** - understand the surrounding code before changing it.
+6. **Limit the blast radius** - modify ONLY the files explicitly listed in the current task's plan. Do NOT rewrite adjacent components, hooks, or utilities unless strictly required AND approved.
 
 #### Commit Message Format
 
@@ -169,7 +169,7 @@ Types: `feat`, `fix`, `refactor`, `test`, `docs`, `chore`
 
 ---
 
-### Phase 4: VERIFY — /test
+### Phase 4: VERIFY - /test
 
 **Auto-activates → `[ROLE: QA Lead]`**
 
@@ -190,7 +190,7 @@ Tests are proof, not an afterthought.
 
 For complex React components, prioritize testing _user behavior_ over internal state:
 
-- Use **React Testing Library** (`userEvent`, `screen.getByRole`) — test what the user sees.
+- Use **React Testing Library** (`userEvent`, `screen.getByRole`) - test what the user sees.
 - Use **Playwright** for critical user flows (login, checkout, form submit).
 - Do NOT test implementation details (internal state, private methods, component structure).
 - Focus on: "When user clicks X, does Y appear?" not "Does `useState` hold the right value?"
@@ -217,7 +217,7 @@ Before moving to Review, verify:
 
 ---
 
-### Phase 5: REVIEW — /review
+### Phase 5: REVIEW - /review
 
 **Auto-activates → `[ROLE: Staff Engineer]` + `[ROLE: Senior Designer]` for UI tasks**
 
@@ -237,7 +237,7 @@ Inspired by [obra/superpowers](https://github.com/obra/superpowers):
 
 ---
 
-### Phase 5.5: SIMPLIFY — /simplify
+### Phase 5.5: SIMPLIFY - /simplify
 
 **Auto-activates → `[ROLE: Staff Engineer]` (Ponytail Mindset)**
 
@@ -250,7 +250,7 @@ Before merging, ruthlessly simplify:
 
 ---
 
-### Phase 6: SHIP — /ship
+### Phase 6: SHIP - /ship
 
 **Auto-activates → `[ROLE: Release Engineer]`**
 
@@ -264,8 +264,7 @@ Only ship when all gates are green.
 - [ ] Docs updated (README, API docs, changelogs)
 - [ ] Breaking changes documented
 - [ ] Rollback plan exists
-- [ ] Vercel Preview Deployment is successful and manually verified
-- [ ] Core Web Vitals pass in preview (LCP < 2.5s, CLS < 0.1, INP < 200ms)
+- [ ] Preview / staging deployment verified (if applicable, e.g. Vercel Preview and Core Web Vitals for frontend deployments)
 
 #### Operational Self-Improvement
 
@@ -308,6 +307,7 @@ export async function POST(req) {
 - [ ] Implementation plan broken down into vertical tasks < 2 hours each.
 - [ ] Tests written before implementation (TDD/BDD).
 - [ ] Code reviewed against correctness, security, performance, and design gates.
+- [ ] Staged security and quality check passes (`contextos scan --staged --enforce`).
 - [ ] Simplification ladder executed before shipping.
 
 ---
@@ -334,10 +334,10 @@ export async function POST(req) {
 
 When completing a task or workflow, you must explicitly report your final status as the last part of your output:
 
-- **DONE** — completed with evidence.
-- **DONE_WITH_CONCERNS** — completed, but list concerns.
-- **BLOCKED** — cannot proceed; state blocker and what was tried.
-- **NEEDS_CONTEXT** — missing info; state exactly what is needed.
+- **DONE** - completed with evidence.
+- **DONE_WITH_CONCERNS** - completed, but list concerns.
+- **BLOCKED** - cannot proceed; state blocker and what was tried.
+- **NEEDS_CONTEXT** - missing info; state exactly what is needed.
 
 
 <!-- Source: EXAMPLES.md -->

package/.agents/generated/gemini/skills/gemini-precision/SKILL.md

@@ -48,6 +48,7 @@ Activate whenever:
   1. Run the project validator or compiler (`node .agents/ctx.js validate`, `tsc --noEmit`, etc.).
   2. Run unit and integration tests (`npm test`, `pytest`, etc.).
   3. Run linter and formatting checks (`npm run lint:md`, `eslint`, etc.).
+  4. Run staged security and quality scanner (`contextos scan --staged --enforce`).
 - If a test or validation fails, do not guess: read the exact error trace, fix the root cause, and re-run until green.
 
 ### 4. Surgical Blast Radius Containment
@@ -83,7 +84,7 @@ Activate whenever:
 **Eliminate the "black box" by narrating technical decisions.**
 
 - Avoid executing long, silent chains of tool calls without user visibility.
-- Provide a concise 1–2 sentence transparent status update before key operations:
+- Provide a concise 1-2 sentence transparent status update before key operations:
   - State what was inspected or verified from the code.
   - State the architectural decision made and the immediate next action.
 - Keep narration crisp and actionable without excessive verbosity.
@@ -169,3 +170,106 @@ export async function updateUser(id, data, session) {
 - Enforces the 7-rung ladder of `ponytail-mindset`.
 - Acts as the baseline behavioral guardrail across all Gemini and Antigravity operations.
 
+
+<!-- Source: EXAMPLES.md -->
+
+# gemini-precision Examples - Anti-patterns vs ContextOS Standard
+
+## Example 1: Read-Before-Write Invariant (Zero Assumptions)
+
+### Anti-pattern: Hallucinated Import and Signature
+
+```typescript
+// BAD: Assuming the module exists and export is a default function
+import hashPassword from 'src/utils/crypto';
+const hash = hashPassword(password);
+```
+
+### Best practice: ContextOS Standard (Inspected Active Codebase First)
+
+```typescript
+// GOOD: Inspected src/lib/auth.ts via view_file before writing code
+import { hashSecret, ARGON2_CONFIG } from '../lib/auth.js';
+const hash = await hashSecret(password, ARGON2_CONFIG);
+```
+
+---
+
+## Example 2: Zero-Placeholder Invariant (Complete Code Only)
+
+### Anti-pattern: Lazy Stubs and Ellipsis Comments
+
+```typescript
+// BAD: Emitting incomplete code with TODOs and ellipsis
+export function processTransaction(tx: Transaction) {
+  // TODO: validate transaction balance
+  // ... rest of implementation stays here ...
+  return { status: 'ok' };
+}
+```
+
+### Best practice: ContextOS Standard (100% Drop-in Compilable)
+
+```typescript
+// GOOD: Fully implemented logic with complete error handling
+export function processTransaction(tx: Transaction): TransactionResult {
+  if (!tx.amount || tx.amount <= 0) {
+    throw new ValidationError('Transaction amount must be positive');
+  }
+  if (tx.senderBalance < tx.amount) {
+    throw new InsufficientFundsError(tx.senderId, tx.amount);
+  }
+  return {
+    status: 'ok',
+    transactionId: tx.id,
+    newBalance: tx.senderBalance - tx.amount,
+  };
+}
+```
+
+---
+
+## Example 3: Mandatory Proof-of-Work Invariant
+
+### Anti-pattern: Claiming Task Complete Without Evidence
+
+```text
+BAD: "I have updated the authentication handler. The code looks correct and is ready to merge."
+```
+
+### Best practice: ContextOS Standard (Verified with Automated Gates)
+
+```bash
+# GOOD: Run test suite, staged scanner, and consistency checks
+npm test
+contextos scan --staged --enforce
+node .agents/ctx.js validate
+```
+
+<!-- Source: TROUBLESHOOTING.md -->
+
+# gemini-precision Troubleshooting & Common Failure Modes
+
+## 1. Test Failure Investigation (No Guesswork)
+
+- **Symptom**: Test fails during `npm test` after code modifications.
+- **Root Cause**: Trying to patch the code without reading the exact assertion diff.
+- **Fix**: Never guess the fix. View the test file line where assertion failed, inspect expected vs actual output, and resolve the root discrepancy.
+
+## 2. Accidental Staged Secrets or Placeholders
+
+- **Symptom**: `contextos scan --staged --enforce` fails with exit code 1.
+- **Root Cause**: Committed temporary `.env` file or left an unfinished `// TODO: implement later` stub in added lines.
+- **Fix**: Remove or redact the secret before committing. Fully implement the logic or replace the placeholder with an explicit tracked issue rather than committed code stubs.
+
+## 3. Scope Creep and Excessive Blast Radius
+
+- **Symptom**: Unrelated files reformatted or imports reordered across the repository.
+- **Root Cause**: Full-file rewrite instead of targeted surgical replacement.
+- **Fix**: Use targeted chunks that touch only the lines specified in the task plan. Avoid modifying unrelated styling or formatting.
+
+## 4. Forbidden Long Dashes
+
+- **Symptom**: Linter or compliance check flags unicode dashes in text.
+- **Root Cause**: Using typography dashes (`\u2014` or `\u2013`) instead of standard ASCII hyphens.
+- **Fix**: Replace all em-dashes and en-dashes with standard ASCII hyphens (` - `) or appropriate punctuation (parentheses, commas, colons).

package/.agents/generated/gemini/skills/gstack-roles/SKILL.md

@@ -15,7 +15,7 @@ Activate on every task to declare explicit specialist role and mindset before be
 
 ## Rules & Patterns
 
-Inspired by [Garry Tan's gstack](https://github.com/garrytan/gstack) — shipping 810× more logical code than a solo dev in 2013.
+Inspired by [Garry Tan's gstack](https://github.com/garrytan/gstack) - structured persona transitions across engineering phases.
 
 ## Core Principle
 
@@ -23,13 +23,14 @@ Inspired by [Garry Tan's gstack](https://github.com/garrytan/gstack) — shippin
 
 ## Role Identification Protocol
 
-At the start of each task or major phase switch, declare your role:
+At the start of each task or major phase switch, declare your role using the ContextOS standard format:
 
-```
-[ROLE: <Role Name>] — <One-line description of your mandate for this task>
+```text
+[DOMAIN: <Domain>] [PHASE: <Phase>] [ROLE: <Role Name>]
+Skills loaded: <skill-1>, <skill-2>
 ```
 
-> **Anti-Spam Invariant**: Declare this role **strictly once per phase**. Never prefix intermediate tool calls, file operations, or step updates with role tags.
+> **Anti-Spam Invariant**: Declare this role header **strictly once per phase**. Never prefix intermediate tool calls, file operations, or step updates with role tags.
 
 Then execute ONLY within the constraints of that role.
 
@@ -108,7 +109,7 @@ THINK          PLAN           BUILD          REVIEW         TEST           SHIP
 2. **One role at a time.** Don't mix QA and implementation in the same response.
 3. **Declare before acting.** Always state `[ROLE: X]` before switching modes.
 4. **Escalate correctly.** If a QA finds an architectural problem → escalate to Architect role.
-5. **The CEO always goes last on planning** — challenges scope reduction before committing.
+5. **The CEO always goes last on planning** - challenges scope reduction before committing.
 
 ## Example Usage
 

package/.agents/generated/gemini/skills/security/SKILL.md

@@ -30,7 +30,7 @@ Activate whenever writing authentication, authorization, session management, dat
 
 #### 1. Injection (SQL, NoSQL, Command)
 
-- Always use parameterized queries — never concatenate user input into SQL or shell commands.
+- Always use parameterized queries - never concatenate user input into SQL or shell commands.
 - Use ORMs (Prisma, Drizzle, SQLAlchemy) with strict schema validation.
 - Validate and sanitize all user input before processing.
 
@@ -79,14 +79,20 @@ When building AI workflows, tools, or MCP servers:
    - Never allow untrusted content to override system instructions or tool execution permissions.
 2. **Tool Execution Boundaries**:
    - Destructive operations (database drops, file deletions, payment triggers) MUST require explicit user confirmation.
-   - Restrict file system tools to the workspace root — block directory traversal (`../`).
+   - Restrict file system tools to the workspace root - block directory traversal (`../`).
 3. **Secret Masking & Output Sanitization**:
    - Scrub API keys (`sk-...`, `Bearer ...`), tokens, and credentials before writing to agent logs or step summaries.
+4. **Sandbox Execution & Write Isolation (Supply-Chain Defense)**:
+   - Target code is inspected strictly read-only; never execute target-controlled builds or tests with write access to the repository root.
+   - Restrict process write boundaries strictly to an isolated temporary `scratch/` directory.
+   - Enforce zero outbound external network access during security audits to prevent secret exfiltration via malicious scripts or dependencies.
+   - Promote verified non-secret results to retained `artifacts/` only via trusted parent-side inspection code.
 
 ---
 
 ## Code Examples
 
+
 ### Timing-Safe Secret Verification
 
 ```javascript
@@ -102,28 +108,50 @@ export function verifyWebhookSignature(payload, signature, secret) {
 }
 ```
 
-### Safe SSRF Prevention Wrapper
+### SSRF Prevention Requirements (OWASP Compliant)
 
-```typescript
-import dns from 'node:dns/promises';
+Per [OWASP SSRF Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html), naive application-level DNS pre-checks followed by standard `fetch(url)` are fundamentally flawed due to DNS rebinding (TOCTOU) and unvalidated HTTP 3xx redirects.
+
+#### Mandatory Architectural Controls
+
+1. **Network-Layer Defense (Primary)**: For user-supplied arbitrary webhooks or URLs, route all outbound traffic through an isolated egress forward proxy (e.g., Smokescreen, Envoy, Squid) configured with firewall-level IP filters blocking RFC 1918, RFC 6598, link-local (`169.254.169.254`), loopback, and IPv6 local addresses at the socket handshake level.
+2. **Positive Destination Allowlist**: If fetching from known external partners, validate destination hostname against a strict positive allowlist.
+3. **Disable Automatic Redirects**: Always set `redirect: 'error'` or `'manual'`. Never follow HTTP redirects automatically without re-validating the target URL against allowlist rules.
+4. **Protocol & Credential Restrictions**: Enforce `https:` exclusively; reject embedded credentials (`user:pass@host`) and non-standard ports.
 
-export async function validateSafeUrl(urlString: string): Promise<URL> {
+```typescript
+/**
+ * Verified Allowlist-based HTTP Client (OWASP SSRF Prevention)
+ * Enforces HTTPS, strict destination allowlist, and rejects HTTP redirects.
+ */
+export async function fetchFromAllowlist(
+  urlString: string,
+  allowedHostnames: ReadonlySet<string>,
+  options: RequestInit = {}
+): Promise<Response> {
   const parsed = new URL(urlString);
+
+  // 1. Enforce HTTPS only
   if (parsed.protocol !== 'https:') {
-    throw new Error('Only HTTPS protocol is permitted');
+    throw new Error(`SSRF blocked: protocol "${parsed.protocol}" is not permitted; HTTPS required`);
   }
 
-  const { address } = await dns.lookup(parsed.hostname);
-  if (
-    address.startsWith('127.') ||
-    address.startsWith('10.') ||
-    address.startsWith('192.168.') ||
-    address === '169.254.169.254'
-  ) {
-    throw new Error('Access to private/metadata IP addresses is blocked');
+  // 2. Reject credentials in URL
+  if (parsed.username || parsed.password) {
+    throw new Error('SSRF blocked: URL credentials (user:password@host) are prohibited');
   }
 
-  return parsed;
+  // 3. Strict positive destination allowlist (prevents internal network probing)
+  const normalizedHost = parsed.hostname.toLowerCase();
+  if (!allowedHostnames.has(normalizedHost)) {
+    throw new Error(`SSRF blocked: destination host "${normalizedHost}" is not in the approved allowlist`);
+  }
+
+  // 4. Disable automatic redirects to prevent redirection to private IPs or metadata endpoints
+  return fetch(urlString, {
+    ...options,
+    redirect: 'error'
+  });
 }
 ```
 
@@ -156,115 +184,6 @@ export async function validateSafeUrl(urlString: string): Promise<URL> {
 - Pairs with `system-design` to mandate secure network boundaries and authorization layers.
 
 
-<!-- Source: security.md -->
-
-# Application Security — Best Practices
-
-## OWASP Top 10
-
-### 1. Injection (SQL, NoSQL, Command)
-
-- **Always use parameterized queries** — never concatenate user input into SQL
-- Use ORM (Prisma, SQLAlchemy, TypeORM) — they parameterize by default
-- Validate and sanitize all user input
-
-### 2. Broken Authentication
-
-- Use bcrypt/argon2 for password hashing (cost factor ≥ 12)
-- JWT: short-lived access tokens (15min), refresh tokens (7 days)
-- Rate limit login attempts
-- Implement account lockout after N failed attempts
-- MFA for sensitive operations
-
-### 3. Sensitive Data Exposure
-
-- HTTPS everywhere — redirect HTTP to HTTPS
-- Encrypt sensitive data at rest (AES-256)
-- Never log passwords, tokens, or PII
-- Use environment variables for secrets
-
-### 4. XML/XXE
-
-- Disable external entity processing
-- Use JSON instead of XML where possible
-
-### 5. Broken Access Control
-
-- Default deny — explicitly grant access
-- RBAC (Role-Based Access Control) or ABAC (Attribute-Based)
-- Check authorization on every request, not just UI
-- Don't rely on client-side validation for security
-
-### 6. Security Misconfiguration
-
-- Remove default credentials
-- Disable debug mode in production
-- Security headers (see below)
-- Keep dependencies updated
-
-### 7. XSS (Cross-Site Scripting)
-
-- Escape all output by default
-- Content-Security-Policy header
-- HttpOnly + Secure + SameSite cookies
-- Use framework's built-in XSS protection
-
-### 8. Insecure Deserialization
-
-- Validate and schema-check all input (Zod, Pydantic, class-validator)
-- Don't deserialize untrusted data
-
-### 9. Insufficient Logging
-
-- Log all authentication events
-- Log authorization failures
-- Log input validation failures
-- Include request ID for tracing
-
-### 10. SSRF (Server-Side Request Forgery)
-
-- Validate and allowlist URLs
-- Don't let users control server-side HTTP requests
-
-## Security Headers
-
-```
-Content-Security-Policy: default-src 'self'
-X-Content-Type-Options: nosniff
-X-Frame-Options: DENY
-Strict-Transport-Security: max-age=31536000; includeSubDomains
-Referrer-Policy: strict-origin-when-cross-origin
-Permissions-Policy: camera=(), microphone=(), geolocation=()
-```
-
-## Authentication Patterns
-
-### JWT Flow
-
-```
-Login → Access Token (15min) + Refresh Token (7d, HttpOnly cookie)
-Request → Authorization: Bearer <access_token>
-Expired → POST /auth/refresh (sends refresh cookie) → new access token
-```
-
-### OAuth2 Flow
-
-```
-Redirect → Provider (Google, GitHub) → Callback → Create/link user → JWT
-```
-
-## Checklist Before Deploy
-
-- [ ] All secrets in environment variables
-- [ ] HTTPS enabled
-- [ ] Security headers configured
-- [ ] Input validation on all endpoints
-- [ ] Rate limiting enabled
-- [ ] CORS configured (not `*`)
-- [ ] Error messages don't leak internals
-- [ ] Dependency audit (`npm audit`, `pip audit`)
-- [ ] Logging for security events
-
 <!-- Source: EXAMPLES.md -->
 
 # Application Security Examples — Anti-patterns vs ContextOS Standard

package/.agents/plugins.js

@@ -901,17 +901,18 @@ async function search(query) {
  * Adapters call this instead of reading CORE_SKILLS directly.
  */
 function collectAllSkillDirs(targetRoot) {
+  const isTargetExplicit = Boolean(targetRoot);
   const root = targetRoot || process.cwd();
   const agentsDir = path.join(root, '.agents');
   const localCore = path.join(agentsDir, 'core', 'skills');
   const localPlugins = path.join(agentsDir, 'plugins');
 
-  const coreDir = fs.existsSync(localCore) ? localCore : CORE_SKILLS;
-  const pluginsDir = fs.existsSync(localPlugins) ? localPlugins : PLUGINS_DIR;
+  const coreDir = fs.existsSync(localCore) ? localCore : (isTargetExplicit ? null : CORE_SKILLS);
+  const pluginsDir = fs.existsSync(localPlugins) ? localPlugins : (isTargetExplicit ? null : PLUGINS_DIR);
   const dirs = [];
 
   // Core skills
-  if (fs.existsSync(coreDir)) {
+  if (coreDir && fs.existsSync(coreDir)) {
     for (const name of fs.readdirSync(coreDir)) {
       const d = path.join(coreDir, name);
       if (fs.statSync(d).isDirectory()) dirs.push(d);
@@ -919,7 +920,7 @@ function collectAllSkillDirs(targetRoot) {
   }
 
   // Plugin skills (supports both standalone skill dirs and plugin bundles with skills/)
-  if (fs.existsSync(pluginsDir)) {
+  if (pluginsDir && fs.existsSync(pluginsDir)) {
     for (const name of fs.readdirSync(pluginsDir)) {
       const d = path.join(pluginsDir, name);
       if (!fs.statSync(d).isDirectory()) continue;

package/.agents/resolver/canonical-resolver.js

@@ -23,15 +23,15 @@ const { WorkspaceGraphBuilder } = require('../workspace/workspace-graph');
 // Prompt budget limits (Section 14.4)
 const BUDGET_TIERS = {
   BOOTSTRAP: 1200,      // always-on bootstrap budget
-  SKILL_SUMMARY: 150,   // single skill summary limit
-  SKILL_BODY: 1200,     // single skill body limit
-  ROUTINE: 2000,        // routine context limit
-  STANDARD: 4000,       // standard normal compiled context limit
-  HIGH: 7500,           // high-risk compiled context limit
-  DESTRUCTIVE: 10000,   // destructive compiled context limit
+  SKILL_SUMMARY: 300,   // single skill summary limit
+  SKILL_BODY: 10000,    // single skill body limit (supports rich code examples and rules)
+  ROUTINE: 16000,       // routine context limit
+  STANDARD: 32000,      // standard normal compiled context limit (supports 8-10 full skills)
+  HIGH: 64000,          // high-risk compiled context limit
+  DESTRUCTIVE: 128000,  // destructive compiled context limit
 };
 
-const DEFAULT_CONTEXT_BUDGET_TOKENS = 8000;
+const DEFAULT_CONTEXT_BUDGET_TOKENS = 64000;
 
 // Risk-based workflows (Section 14.3)
 const WORKFLOW_TEMPLATES = {

package/.agents/validate.js

@@ -641,10 +641,74 @@ function checkRegistryV2() {
   }
 }
 
+// ═════════════════════════════════════════════════════════════════════════════
+//  CHECK 13 — Catalog Skills Validation (Optional, gated by --catalog)
+// ═════════════════════════════════════════════════════════════════════════════
+function checkCatalogSkills() {
+  const catalogSkillsDir = path.join(ROOT, 'catalog', 'skills');
+  if (!fs.existsSync(catalogSkillsDir)) {
+    error(`[catalog] Catalog skills directory not found: ${catalogSkillsDir}`);
+    return;
+  }
+
+  let validated = 0;
+  const entries = fs.readdirSync(catalogSkillsDir);
+
+  for (const name of entries) {
+    const dir = path.join(catalogSkillsDir, name);
+    if (!fs.statSync(dir).isDirectory()) continue;
+
+    const skillMd = path.join(dir, 'SKILL.md');
+    const yaml = path.join(dir, 'skill.yaml');
+    const validationJson = path.join(dir, 'VALIDATION.json');
+
+    if (!fs.existsSync(skillMd)) {
+      error(`[catalog] ${name}: missing SKILL.md`);
+      continue;
+    }
+
+    const content = fs.readFileSync(skillMd, 'utf8');
+    const fm = parseFrontmatter(content);
+    if (!fm || fm.malformed) {
+      error(`[catalog] ${name}: malformed YAML frontmatter in SKILL.md`);
+    } else {
+      if (!yamlField(fm.raw, 'name')) {
+        error(`[catalog] ${name}: missing 'name' in SKILL.md frontmatter`);
+      }
+      if (!yamlField(fm.raw, 'description')) {
+        error(`[catalog] ${name}: missing 'description' in SKILL.md frontmatter`);
+      }
+    }
+
+    if (!fs.existsSync(yaml)) {
+      error(`[catalog] ${name}: missing skill.yaml`);
+    } else {
+      const yamlText = fs.readFileSync(yaml, 'utf8');
+      if (!yamlField(yamlText, 'name') && !yamlField(yamlText, 'id')) {
+        error(`[catalog] ${name}: missing 'name' or 'id' in skill.yaml`);
+      }
+    }
+
+    if (fs.existsSync(validationJson)) {
+      try {
+        JSON.parse(fs.readFileSync(validationJson, 'utf8'));
+      } catch (err) {
+        error(`[catalog] ${name}: invalid JSON in VALIDATION.json: ${err.message}`);
+      }
+    }
+
+    validated++;
+  }
+
+  info(`[catalog] ${validated} catalog skills validated (frontmatter, skill.yaml, validation metadata)`);
+}
+
 // ═════════════════════════════════════════════════════════════════════════════
 //  MAIN
 // ═════════════════════════════════════════════════════════════════════════════
-function run() {
+function run(options = {}) {
+  const checkCatalog = Boolean(options.checkCatalog || process.argv.includes('--catalog'));
+
   console.log(c.cyan('\nContextOS Validator — scanning skills...\n'));
 
   if (!fs.existsSync(CORE_SKILLS)) {
@@ -670,6 +734,10 @@ function run() {
   checkProfilesIntegrity(sourceSkills);
   checkRegistryV2();
 
+  if (checkCatalog) {
+    checkCatalogSkills();
+  }
+
   const passed = printReport();
   process.exit(passed ? 0 : 1);
 }