create-rigel 0.1.0

package/templates/nestjs/.claude/rules/testing.md

@@ -0,0 +1,145 @@
+---
+paths:
+  - "src/**/*.spec.ts"
+  - "test/**/*.spec.ts"
+  - "test/**/*.e2e-spec.ts"
+---
+
+# Testing Rules — Auto-injected on test file edits
+
+## Coverage Thresholds (enforced in CI)
+
+| Layer | Threshold |
+|---|---|
+| Services | **90%** — happy path + all error paths |
+| Repositories | **80%** — queries, Zod parse, cursor pagination |
+| Controllers | **75%** — via E2E: 201, 401, 422, 404 |
+| Utils/Common | **100%** — every branch |
+
+## Service Unit Tests — Mock the Repository
+
+```typescript
+// src/applications/application.service.spec.ts
+import { Test } from '@nestjs/testing'
+import { ApplicationService } from './application.service'
+import { ApplicationRepository } from './application.repository'
+import { NotFoundException, ConflictException } from '@nestjs/common'
+
+describe('ApplicationService', () => {
+  let service: ApplicationService
+  let repo: jest.Mocked<ApplicationRepository>
+
+  beforeEach(async () => {
+    const module = await Test.createTestingModule({
+      providers: [
+        ApplicationService,
+        {
+          provide: ApplicationRepository,
+          useValue: {
+            findById: jest.fn(),
+            create: jest.fn(),
+            list: jest.fn(),
+            updateStage: jest.fn(),
+            softDelete: jest.fn(),
+          },
+        },
+      ],
+    }).compile()
+
+    service = module.get(ApplicationService)
+    repo    = module.get(ApplicationRepository)
+  })
+
+  describe('findOne', () => {
+    it('returns application when found', async () => {
+      repo.findById.mockResolvedValue(mockApplication)
+      const result = await service.findOne('user-1', 'app-1')
+      expect(result).toEqual(mockApplication)
+    })
+
+    it('propagates NotFoundException from repository', async () => {
+      repo.findById.mockRejectedValue(new NotFoundException())
+      await expect(service.findOne('user-1', 'bad-id')).rejects.toThrow(NotFoundException)
+    })
+  })
+
+  describe('transitionStage', () => {
+    it('throws ConflictException on invalid transition', async () => {
+      repo.findById.mockResolvedValue({ ...mockApplication, stage: 'ACCEPTED' })
+      await expect(service.transitionStage('user-1', 'app-1', 'APPLIED'))
+        .rejects.toThrow(ConflictException)
+    })
+  })
+})
+```
+
+## E2E Tests — Full HTTP Stack
+
+```typescript
+// test/applications.e2e-spec.ts
+import { Test } from '@nestjs/testing'
+import * as request from 'supertest'
+import { AppModule } from '../src/app.module'
+import { INestApplication, ValidationPipe } from '@nestjs/common'
+
+describe('ApplicationController (e2e)', () => {
+  let app: INestApplication
+  let token: string
+
+  beforeAll(async () => {
+    const module = await Test.createTestingModule({
+      imports: [AppModule],
+    }).compile()
+
+    app = module.createNestApplication()
+    app.useGlobalPipes(new ValidationPipe({ whitelist: true, transform: true }))
+    await app.init()
+
+    // Register + login to get token
+    const res = await request(app.getHttpServer())
+      .post('/v1/auth/login')
+      .send({ email: 'test@test.com', password: 'password123' })
+    token = res.body.data.tokens.accessToken
+  })
+
+  afterAll(() => app.close())
+
+  it('POST /v1/applications — 201 with valid body', async () => {
+    const res = await request(app.getHttpServer())
+      .post('/v1/applications')
+      .set('Authorization', `Bearer ${token}`)
+      .send({ company: 'Acme', role: 'Engineer' })
+
+    expect(res.status).toBe(201)
+    expect(res.body.data).toHaveProperty('id')
+    expect(res.body.data.stage).toBe('SAVED')
+  })
+
+  it('POST /v1/applications — 401 without token', async () => {
+    const res = await request(app.getHttpServer())
+      .post('/v1/applications')
+      .send({ company: 'Acme', role: 'Engineer' })
+    expect(res.status).toBe(401)
+  })
+
+  it('POST /v1/applications — 422 with invalid body', async () => {
+    const res = await request(app.getHttpServer())
+      .post('/v1/applications')
+      .set('Authorization', `Bearer ${token}`)
+      .send({ role: 'Engineer' })  // missing company
+    expect(res.status).toBe(422)
+  })
+})
+```
+
+## NestJS TestingModule Pattern
+```typescript
+// Always use Test.createTestingModule — never instantiate classes directly
+const module = await Test.createTestingModule({
+  providers: [
+    MyService,
+    { provide: MyRepository, useValue: mockRepo },
+    { provide: ConfigService, useValue: { get: jest.fn(), getOrThrow: jest.fn() } },
+  ],
+}).compile()
+```

package/templates/nestjs/.claude/settings.json

@@ -0,0 +1,33 @@
+{
+  "model": "claude-sonnet-4-5",
+  "permissions": {
+    "allow": [
+      "Bash(npm *)",
+      "Bash(npx *)",
+      "Bash(node *)",
+      "Bash(git *)",
+      "Bash(bash *)",
+      "Bash(sh *)",
+      "Bash(cat *)",
+      "Bash(ls *)",
+      "Bash(grep *)",
+      "Bash(find *)",
+      "Bash(wc *)",
+      "Bash(k6 *)"
+    ],
+    "deny": []
+  },
+  "hooks": {
+    "PostToolUse": [
+      {
+        "matcher": "Write|Edit|MultiEdit",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash .claude/hooks/post-write.sh"
+          }
+        ]
+      }
+    ]
+  }
+}

package/templates/nestjs/.claude/skills/00-infra-setup/SKILL.md

@@ -0,0 +1,222 @@
+# /infra-setup — Phase 0: Full NestJS Scaffold
+
+Triggered by: `/infra-setup`
+Run ONCE. If `package.json` exists → abort.
+
+---
+
+## Step 1 — Create NestJS App
+```bash
+npm install -g @nestjs/cli
+nest new . --package-manager npm --strict
+```
+Select: `npm` as package manager. This creates the NestJS scaffold.
+
+## Step 2 — Install All Dependencies
+```bash
+# Core
+npm install @nestjs/config joi
+npm install @nestjs/sequelize sequelize sequelize-typescript pg pg-hstore
+npm install @nestjs/jwt @nestjs/passport passport passport-jwt
+npm install argon2
+npm install nestjs-pino pino-http pino
+npm install @nestjs/throttler
+npm install @nestjs/swagger
+npm install @nestjs/terminus @nestjs/schedule
+npm install @nestjs/bullmq bullmq ioredis
+npm install class-validator class-transformer
+npm install uuid zod
+npm install helmet
+
+# Dev
+npm install -D @types/passport-jwt @types/sequelize @types/pg
+npm install -D @types/node @types/uuid
+npm install -D sequelize-cli
+npm install -D pino-pretty
+```
+
+## Step 3 — Directory Structure
+```bash
+mkdir -p \
+  src/common/{decorators,filters,guards,interceptors,pipes,dto} \
+  src/config \
+  src/database \
+  src/auth/{dto,strategies,guards} \
+  src/users/{dto,models} \
+  src/health \
+  src/prisma \
+  db/{migrations,seeders} \
+  docs/{product-specs/{draft,ready},exec-plans/{active,completed},design-docs/decisions,generated} \
+  test
+```
+
+## Step 4 — Configuration Files to Write
+
+### src/config/configuration.ts
+Typed config factory returning all env vars. Validated by Joi schema.
+
+### src/config/config.module.ts
+```typescript
+ConfigModule.forRoot({
+  isGlobal: true,
+  load: [configuration],
+  validationSchema: Joi.object({
+    NODE_ENV: Joi.string().valid('development','test','production').default('development'),
+    PORT: Joi.number().default(3000),
+    DATABASE_URL: Joi.string().uri().required(),
+    DATABASE_POOL_MAX: Joi.number().default(10),
+    DATABASE_POOL_MIN: Joi.number().default(2),
+    REDIS_URL: Joi.string().uri().required(),
+    JWT_SECRET: Joi.string().min(32).required(),
+    JWT_ACCESS_EXPIRY: Joi.string().default('15m'),
+    JWT_REFRESH_EXPIRY: Joi.string().default('7d'),
+    CORS_ORIGINS: Joi.string().default('http://localhost:3001'),
+    LOG_LEVEL: Joi.string().default('info'),
+  }),
+})
+```
+
+### src/database/database.module.ts
+```typescript
+SequelizeModule.forRootAsync({
+  imports: [ConfigModule],
+  inject: [ConfigService],
+  useFactory: (config: ConfigService) => ({
+    dialect: 'postgres',
+    uri: config.getOrThrow('DATABASE_URL'),
+    pool: {
+      max: config.get('DATABASE_POOL_MAX', 10),
+      min: config.get('DATABASE_POOL_MIN', 2),
+      acquire: 30_000,
+      idle: 10_000,
+    },
+    dialectOptions: {
+      statement_timeout: 5000,
+    },
+    autoLoadModels: true,
+    synchronize: false,
+    logging: false,
+    benchmark: true,
+  }),
+})
+```
+
+### src/common/decorators/current-user.decorator.ts
+`@CurrentUser()` — extracts user from JWT payload on request object.
+
+### src/common/decorators/public.decorator.ts
+`@Public()` — metadata marker to skip global JWT guard.
+
+### src/common/decorators/roles.decorator.ts
+`@Roles('ADMIN')` — metadata for RolesGuard.
+
+### src/common/guards/jwt-auth.guard.ts
+Checks `@Public()` metadata — if present, skip. Otherwise validate JWT.
+
+### src/common/guards/roles.guard.ts
+Reads `@Roles()` metadata from reflector, checks user.role.
+
+### src/common/filters/all-exceptions.filter.ts
+Global exception filter — maps all exceptions to standard envelope:
+`{ statusCode, message, timestamp, path, requestId }`. No stack traces in production.
+
+### src/common/interceptors/logging.interceptor.ts
+Global interceptor — logs every request/response via nestjs-pino Logger with duration.
+
+### src/common/dto/pagination.dto.ts
+```typescript
+export class PaginationDto {
+  @IsOptional() @IsString() cursor?: string
+  @IsOptional() @IsInt() @Min(1) @Max(100) @Transform(({ value }) => parseInt(value))
+  limit?: number = 20
+}
+```
+
+### src/auth/* — Full JWT auth module
+- `JwtStrategy` validates token, checks revocation in Redis, attaches user to request
+- `AuthService` — register (argon2.hash), login (argon2.verify), refresh (rotate), logout (revoke)
+- `AuthController` — `@Public()` on all auth routes, strict rate limit
+
+### src/health/health.module.ts
+```typescript
+TerminusModule — /health (liveness) + /ready (DB + Redis checks)
+```
+
+### src/utils/uuid.util.ts
+```typescript
+import { v7 as uuidv7 } from 'uuid'
+export const newId = (): string => uuidv7()
+```
+
+### main.ts — Global setup
+```typescript
+app.useGlobalPipes(new ValidationPipe({ whitelist: true, transform: true, forbidNonWhitelisted: true }))
+app.useGlobalFilters(new AllExceptionsFilter())
+app.useGlobalInterceptors(new LoggingInterceptor())
+// JwtAuthGuard registered as APP_GUARD in AppModule providers
+// Helmet
+app.use(helmet())
+// CORS
+app.enableCors({ origin: config.get('CORS_ORIGINS').split(','), credentials: true })
+// Swagger
+const swaggerConfig = new DocumentBuilder()
+  .setTitle('API').setVersion('1.0').addBearerAuth().build()
+SwaggerModule.setup('api/docs', app, SwaggerModule.createDocument(app, swaggerConfig))
+// Listen
+await app.listen(config.get('PORT', 3000))
+```
+
+### .sequelizerc
+```javascript
+module.exports = {
+  'config': 'src/database/sequelize-cli.cjs',
+  'migrations-path': 'db/migrations',
+  'seeders-path': 'db/seeders',
+}
+```
+
+### src/database/sequelize-cli.cjs
+Loads DATABASE_URL from .env for sequelize-cli.
+
+### Docker
+`Dockerfile` — multi-stage: deps → builder → runner, non-root user, HEALTHCHECK.
+`docker-compose.yml` — app + postgres:16 + redis:7 with healthchecks.
+
+### GitHub Actions
+`.github/workflows/ci.yml` — lint → typecheck → test → npm audit → secret-scan.
+
+### Scaffold Docs
+`AGENTS.md`, `ARCHITECTURE.md`, `ADR-000-infrastructure.md`, `docs/product-specs/index.md`,
+`docs/exec-plans/tech-debt-tracker.md`, `docs/QUALITY_SCORE.md`, `.env.example`, `.gitignore`.
+
+---
+
+## Gate Check
+```bash
+npx tsc --noEmit
+npx eslint src/ --max-warnings=0
+npx jest --no-coverage 2>&1 | tail -5
+curl http://localhost:3000/health
+curl http://localhost:3000/ready
+```
+
+## Commit
+```bash
+git add -A
+git commit -m "chore(infra): phase 0 NestJS infrastructure setup
+
+- NestJS 11 + TypeScript 5 strict
+- @nestjs/sequelize + sequelize-typescript + sequelize-cli
+- Global JWT guard (opt-out with @Public())
+- Global ValidationPipe, AllExceptionsFilter, LoggingInterceptor
+- nestjs-pino structured logging
+- @nestjs/swagger Swagger UI at /api/docs
+- @nestjs/terminus health checks (/health + /ready)
+- @nestjs/throttler rate limiting
+- @nestjs/bullmq queue infrastructure
+- Helmet security headers
+- Docker multi-stage + docker-compose
+- GitHub Actions CI
+- ADR-000: infrastructure decisions"
+git push origin main
+```

package/templates/nestjs/.claude/skills/01-write-spec/SKILL.md

@@ -0,0 +1,25 @@
+# /write-spec
+1. Get next number: ls docs/product-specs/{draft,ready}/ 2>/dev/null | grep SPEC | sort | tail -1
+2. Write to docs/product-specs/draft/SPEC-XXX-{slug}.md
+
+Template:
+```markdown
+# SPEC-XXX — {Name}
+**Status:** DRAFT
+**Created:** YYYY-MM-DD
+**Plan:** —
+
+## Problem Statement
+## What We're Building
+## Core Entities
+## API Endpoints (will map to NestJS controllers)
+## Business Rules
+## State Machines (if any)
+## Non-Functional Requirements
+## Out of Scope (v1)
+## Acceptance Criteria
+- [ ] criterion
+```
+
+3. Update docs/product-specs/index.md
+4. Tell human: move to ready/ and change Status to READY, then run /write-plan.

package/templates/nestjs/.claude/skills/02-write-plan/SKILL.md

@@ -0,0 +1,18 @@
+# /write-plan
+1. Check docs/product-specs/ready/ — stop if empty
+2. Get next plan number
+3. Write to docs/exec-plans/active/PLAN-XXX-{slug}.md
+
+Layer order for each NestJS feature:
+| # | Layer | Gate |
+|---|---|---|
+| 1 | Model | paranoid, UUIDv7, indexes |
+| 2 | Migration | runs clean, has down() |
+| 3 | DTOs | class-validator + @ApiProperty on every field |
+| 4 | Repository | Zod parse, cursor pagination, ownership, no N+1 |
+| 5 | Service | no HTTP, NestJS exceptions, ≥90% coverage |
+| 6 | Controller | @ApiTags, @ApiOperation, @ApiResponse, one-liner handlers |
+| 7 | Module | SequelizeModule.forFeature, registered in AppModule |
+| 8 | Tests | service unit (mock repo) + e2e (201, 401, 422) |
+
+Tell human: Run /build-layer to start Layer 1.

package/templates/nestjs/.claude/skills/03-build-layer/SKILL.md

@@ -0,0 +1,242 @@
+# /build-layer — Build Next Layer from Active Plan
+
+Triggered by: `/build-layer` (no argument)
+
+---
+
+## Step 1 — Find Active Plan and Next Layer
+```bash
+PLAN=$(ls docs/exec-plans/active/*.md 2>/dev/null | head -1)
+[[ -z "$PLAN" ]] && echo "No active plan. Run /write-plan first." && exit 1
+cat "$PLAN"
+```
+Find first `[ ]` row. If all `[x]` → run `/garbage-collect`.
+
+---
+
+## Step 2 — Load Context
+Read: active plan, spec, `ARCHITECTURE.md`, path-scoped rule:
+- Model → `.claude/rules/database.md` + `.claude/rules/architecture.md`
+- DTOs → `.claude/rules/api.md` + `.claude/rules/architecture.md`
+- Repository → `.claude/rules/database.md` + `.claude/rules/security.md`
+- Service → `.claude/rules/architecture.md` + `.claude/rules/security.md`
+- Controller → `.claude/rules/api.md` + `.claude/rules/security.md`
+- Module → `.claude/rules/architecture.md`
+- Tests → `.claude/rules/testing.md`
+
+---
+
+## Step 3 — Build the Layer
+
+### Model (`src/[feature]/models/[feature].model.ts`)
+```typescript
+import { Table, Column, Model, DataType, Default, DeletedAt, CreatedAt, UpdatedAt, BelongsTo, ForeignKey, HasMany, Index } from 'sequelize-typescript'
+import { newId } from '../../utils/uuid.util'
+
+@Table({
+  tableName: 'applications',
+  paranoid: true,   // ← always
+  indexes: [
+    { fields: ['user_id'] },
+    { fields: ['user_id', 'stage'] },
+  ],
+})
+export class Application extends Model {
+  @Default(() => newId())   // ← UUIDv7 always
+  @Column({ type: DataType.UUID, primaryKey: true })
+  id!: string
+
+  @ForeignKey(() => User)
+  @Column(DataType.UUID)
+  userId!: string
+
+  @Column(DataType.STRING(200)) company!: string
+  @Column(DataType.STRING(200)) role!: string
+  @Column({ type: DataType.ENUM(...STAGES), defaultValue: 'SAVED' }) stage!: string
+
+  @CreatedAt createdAt!: Date
+  @UpdatedAt updatedAt!: Date
+  @DeletedAt deletedAt?: Date
+}
+```
+
+### Migration (`db/migrations/YYYYMMDDHHMMSS-create-[feature].js`)
+```javascript
+module.exports = {
+  up: async (queryInterface, Sequelize) => {
+    await queryInterface.createTable('applications', {
+      id: { type: Sequelize.UUID, primaryKey: true },
+      user_id: { type: Sequelize.UUID, allowNull: false, references: { model: 'users', key: 'id' } },
+      company: { type: Sequelize.STRING(200), allowNull: false },
+      stage: { type: Sequelize.ENUM(...stages), defaultValue: 'SAVED' },
+      created_at: { type: Sequelize.DATE, defaultValue: Sequelize.NOW },
+      updated_at: { type: Sequelize.DATE, defaultValue: Sequelize.NOW },
+      deleted_at: { type: Sequelize.DATE, allowNull: true },
+    })
+    await queryInterface.sequelize.query(
+      'CREATE INDEX CONCURRENTLY idx_applications_user_id ON applications(user_id)'
+    )
+  },
+  down: async (queryInterface) => queryInterface.dropTable('applications'),
+}
+```
+Run: `npm run db:migrate`
+
+### DTOs (`src/[feature]/dto/`)
+```typescript
+// create-application.dto.ts
+import { IsString, IsOptional, MinLength, MaxLength, IsUrl } from 'class-validator'
+import { ApiProperty, ApiPropertyOptional } from '@nestjs/swagger'
+
+export class CreateApplicationDto {
+  @IsString() @MinLength(1) @MaxLength(200)
+  @ApiProperty({ example: 'Acme Corp', description: 'Company name' })
+  company: string
+
+  @IsString() @MinLength(1) @MaxLength(200)
+  @ApiProperty({ example: 'Software Engineer' })
+  role: string
+
+  @IsOptional() @IsUrl()
+  @ApiPropertyOptional({ example: 'https://jobs.acme.com/123' })
+  postingUrl?: string
+}
+
+// application-response.dto.ts — what we return (controls serialisation)
+export class ApplicationResponseDto {
+  @ApiProperty() id: string
+  @ApiProperty() company: string
+  @ApiProperty({ enum: ApplicationStage }) stage: ApplicationStage
+  @ApiProperty() createdAt: string
+}
+```
+
+### Repository (`src/[feature]/[feature].repository.ts`)
+```typescript
+@Injectable()
+export class ApplicationRepository {
+  constructor(
+    @InjectModel(Application) private appModel: typeof Application,
+    @InjectConnection() private sequelize: Sequelize,
+  ) {}
+
+  async findById(id: string, userId: string): Promise<ApplicationRecord> {
+    const raw = await this.appModel.findOne({
+      where: { id, userId },     // ownership always
+      include: [{ model: Note }, { model: Contact }],  // eager load
+    })
+    if (!raw) throw new NotFoundException(`Application ${id} not found`)
+    return ApplicationSchema.parse(raw.toJSON())  // Zod ALWAYS
+  }
+
+  async list(userId: string, cursor?: PageCursor, limit = 20): Promise<PageResult<ApplicationRecord>> {
+    const where: WhereOptions = { userId }
+    if (cursor) {
+      where[Op.or as symbol] = [
+        { createdAt: { [Op.lt]: cursor.createdAt } },
+        { createdAt: cursor.createdAt, id: { [Op.lt]: cursor.id } },
+      ]
+    }
+    const rows = await this.appModel.findAll({
+      where, order: [['createdAt', 'DESC'], ['id', 'DESC']], limit: limit + 1,
+    })
+    const hasMore = rows.length > limit
+    const items = hasMore ? rows.slice(0, limit) : rows
+    return {
+      items: items.map(r => ApplicationSchema.parse(r.toJSON())),
+      nextCursor: hasMore ? { id: items.at(-1)!.id, createdAt: items.at(-1)!.createdAt } : null,
+      hasMore,
+    }
+  }
+}
+```
+
+### Service (`src/[feature]/[feature].service.ts`)
+```typescript
+@Injectable()
+export class ApplicationService {
+  private readonly logger = new Logger(ApplicationService.name)
+
+  constructor(private readonly applicationRepository: ApplicationRepository) {}
+
+  async findOne(userId: string, id: string): Promise<ApplicationRecord> {
+    return this.applicationRepository.findById(id, userId)
+    // NotFoundException thrown by repo if not found — no try/catch needed
+  }
+
+  async transitionStage(userId: string, id: string, to: ApplicationStage): Promise<ApplicationRecord> {
+    const app = await this.applicationRepository.findById(id, userId)
+    const validNext = VALID_TRANSITIONS[app.stage]
+    if (!validNext.includes(to)) {
+      throw new ConflictException(`Cannot transition from ${app.stage} to ${to}`)
+    }
+    const result = await this.applicationRepository.updateStage(id, to)
+    this.logger.log({ event: 'application.stage_changed', id, from: app.stage, to })
+    return result
+  }
+}
+```
+
+### Controller (`src/[feature]/[feature].controller.ts`)
+```typescript
+@ApiTags('Applications')
+@ApiBearerAuth()
+@Controller('v1/applications')
+export class ApplicationController {
+  constructor(private readonly appService: ApplicationService) {}
+
+  @Get(':id')
+  @ApiOperation({ summary: 'Get application by ID' })
+  @ApiOkResponse({ type: ApplicationResponseDto })
+  @ApiNotFoundResponse()
+  findOne(
+    @Param('id', ParseUUIDPipe) id: string,
+    @CurrentUser() user: JwtPayload,
+  ) {
+    return this.appService.findOne(user.sub, id)
+  }
+
+  @Post()
+  @HttpCode(HttpStatus.CREATED)
+  @ApiOperation({ summary: 'Create application' })
+  @ApiCreatedResponse({ type: ApplicationResponseDto })
+  create(@Body() dto: CreateApplicationDto, @CurrentUser() user: JwtPayload) {
+    return this.appService.createApplication(user.sub, dto)
+  }
+}
+```
+
+### Module (`src/[feature]/[feature].module.ts`)
+```typescript
+@Module({
+  imports: [SequelizeModule.forFeature([Application, Note, Contact])],
+  controllers: [ApplicationController],
+  providers: [ApplicationRepository, ApplicationService],
+  exports: [ApplicationService],  // only if other modules need it
+})
+export class ApplicationModule {}
+```
+Then add to `AppModule.imports`.
+
+### Tests
+- `src/[feature]/[feature].service.spec.ts` — mock repository, test all error paths
+- `test/[feature].e2e-spec.ts` — supertest full HTTP cycle
+
+---
+
+## Step 4 — Gate
+Call `gate-checker` agent. Auto-fix failures. Re-run up to 3 times.
+
+## Step 5 — ADR if needed
+`docs/design-docs/decisions/ADR-XXX-{slug}.md`
+
+## Step 6 — Commit
+```bash
+git add -A
+git commit -m "{feat|chore|test}({feature}): {description}
+PLAN-XXX Layer N/Total"
+git push origin main
+```
+
+## Step 7 — Report + Wait
+Show progress, auto-fixed items, ADR. Wait for human `yes` before next layer.

package/templates/nestjs/.claude/skills/04-validate-layer/SKILL.md

@@ -0,0 +1,4 @@
+# /validate-layer
+Calls gate-checker agent. Read-only — no auto-fix, no commit.
+Present full PASS/FAIL report.
+To auto-fix: run /build-layer.

package/templates/nestjs/.claude/skills/05-push-layer/SKILL.md

@@ -0,0 +1,6 @@
+# /push-layer
+1. npx tsc --noEmit && npx eslint src/ --max-warnings=0
+2. If fails → stop
+3. git add -A
+4. git commit -m "{type}({scope}): {description from active plan}"
+5. git push origin main