create-rigel 0.1.0

package/templates/express/.github/workflows/load-test.yml

@@ -0,0 +1,41 @@
+name: Load Test
+
+# Manual only — never runs on push or PR. Trigger from the Actions tab
+# (GitHub → Actions → Load Test → Run workflow) and point it at any reachable URL.
+on:
+  workflow_dispatch:
+    inputs:
+      base_url:
+        description: 'Target base URL (e.g. https://staging.example.com)'
+        required: true
+        type: string
+      test:
+        description: 'Which test to run'
+        required: true
+        type: choice
+        default: smoke
+        options:
+          - smoke
+          - stress
+          - soak
+      auth_token:
+        description: 'Bearer token for authenticated endpoints (optional)'
+        required: false
+        type: string
+
+jobs:
+  load-test:
+    name: k6 ${{ inputs.test }} → ${{ inputs.base_url }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install k6
+        uses: grafana/setup-k6-action@v1
+
+      - name: Run k6 ${{ inputs.test }}
+        env:
+          BASE_URL: ${{ inputs.base_url }}
+          AUTH_TOKEN: ${{ inputs.auth_token }}
+        run: k6 run tests/load/${{ inputs.test }}.js

package/templates/express/.gitleaks.toml

@@ -0,0 +1,18 @@
+# gitleaks config — extends the default ruleset and allowlists the template's known,
+# non-secret dev/test placeholders so the CI secret-scan job doesn't false-positive on
+# them. Real secrets anywhere else are still detected. Used by .github/workflows/ci.yml.
+title = "harness-template gitleaks config"
+
+[extend]
+useDefault = true
+
+[allowlist]
+description = "Template dev/test placeholders — not real secrets"
+# .env.example is an example file by convention — it must never hold real secrets.
+paths = ['''\.env\.example$''']
+# The dev/CI JWT placeholders (docker-compose.yml, ci.yml). Matched by value so the
+# allowlist applies across the whole git history, not just the current commit.
+regexes = [
+  '''dev-only-secret-change-me-min-32-characters''',
+  '''ci-test-secret-not-a-real-key-min-32-chars''',
+]

package/templates/express/.lintstagedrc.json

@@ -0,0 +1,3 @@
+{
+  "*.ts": ["eslint --fix", "prettier --write"]
+}

package/templates/express/.nvmrc

@@ -0,0 +1 @@
+24

package/templates/express/.prettierrc

@@ -0,0 +1,8 @@
+{
+  "semi": false,
+  "singleQuote": true,
+  "printWidth": 100,
+  "trailingComma": "es5",
+  "tabWidth": 2,
+  "useTabs": false
+}

package/templates/express/.sequelizerc

@@ -0,0 +1,8 @@
+const path = require('path')
+
+module.exports = {
+  config: path.resolve('src', 'config', 'database.ts'),
+  'models-path': path.resolve('src', 'models'),
+  'seeders-path': path.resolve('db', 'seeders'),
+  'migrations-path': path.resolve('db', 'migrations'),
+}

package/templates/express/AGENTS.md

@@ -0,0 +1,94 @@
+# AGENTS.md — Navigation Map
+
+Stack: Node 24 LTS · TypeScript · Express · Sequelize · PostgreSQL · Redis · BullMQ
+(versions mostly unpinned — `/infra-setup` installs the latest LTS; Sequelize is pinned to v6
+for `sequelize-typescript` compatibility)
+
+> Common tasks: `make help` (wraps the npm scripts) or run them directly — e.g. `npm run gate`.
+
+---
+
+## 🗺️ Where Everything Lives
+
+| What you need                      | Where                                  |
+| ---------------------------------- | -------------------------------------- |
+| Layer rules + dependency diagram   | `ARCHITECTURE.md`                      |
+| Engineering constitution (the WHY) | `docs/design-docs/core-beliefs.md`     |
+| Active execution plan              | `docs/exec-plans/active/`              |
+| Completed plans (history)          | `docs/exec-plans/completed/`           |
+| Product roadmap (epics → specs)    | `docs/product-specs/ROADMAP.md`        |
+| Product specs (draft)              | `docs/product-specs/draft/`            |
+| Product specs (approved)           | `docs/product-specs/ready/`            |
+| Architectural decisions (ADRs)     | `docs/design-docs/decisions/`          |
+| Known tech debt                    | `docs/exec-plans/tech-debt-tracker.md` |
+| Domain health grades               | `docs/QUALITY_SCORE.md`                |
+| Plan format + lifecycle            | `docs/PLANS.md`                        |
+| Generated DB schema                | `docs/generated/db-schema.md`          |
+| Generated API contract (OpenAPI)   | `docs/generated/openapi.json`          |
+
+---
+
+## ⚡ Slash Commands
+
+| Command            | What it does                                           |
+| ------------------ | ------------------------------------------------------ |
+| `/infra-setup`     | Phase 0 — full infra scaffold (run once)               |
+| `/write-roadmap`   | Brief → ordered, dependency-aware spec roadmap → `docs/product-specs/ROADMAP.md` |
+| `/write-spec`      | Write a product spec → `docs/product-specs/draft/`     |
+| `/write-plan`      | Turn a READY spec into an execution plan               |
+| `/build-layer`     | Build next unchecked layer from active plan + run gate |
+| `/validate-layer`  | Run gate check on current layer without building       |
+| `/push-layer`      | Commit + push current layer with conventional message  |
+| `/layer-check`     | Ad-hoc architecture violation scan                     |
+| `/garbage-collect` | End-of-feature cleanup pass                            |
+| `/doc-garden`      | Scan + fix stale documentation                         |
+| `/db-optimize`     | EXPLAIN ANALYZE workflow for slow queries              |
+| `/load-test`       | Run k6 smoke / stress / soak test                      |
+
+---
+
+## 🤖 Agents
+
+| Agent               | When to use                                                  |
+| ------------------- | ------------------------------------------------------------ |
+| `gate-checker`      | Called automatically by `/build-layer` — PASS/FAIL per layer |
+| `spec-writer`       | Use the `/write-spec` skill (invokes this)                   |
+| `planner`           | Use the `/write-plan` skill (invokes this)                   |
+| `reviewer`          | Before opening a PR — full harness review                    |
+| `arch-validator`    | Deep import + layer compliance scan                          |
+| `db-optimizer`      | N+1, missing index, pagination audit on repo layer           |
+| `security-auditor`  | OWASP Top 10 review — run before any auth/payment PR         |
+| `doc-gardener`      | Use the `/doc-garden` skill (invokes this)                   |
+| `garbage-collector` | Use the `/garbage-collect` skill (invokes this)              |
+
+---
+
+## ✅ Non-Negotiable Invariants
+
+- No `console.log` → use `logger` from `src/config/logger.ts`
+- No `process.env` outside `src/config/env.ts`
+- No `as SomeType` on external/DB data → Zod parse only
+- No file > 400 lines → split into focused modules
+- No cross-layer imports → enforced by `eslint-plugin-boundaries` + `madge` + structural tests
+- Every DB query result → `Schema.parse(raw.toJSON())`
+- Every list endpoint → cursor-based pagination
+- Every protected route → `requireAuth` as first line
+- Every owned resource → a cross-user isolation test (`tests/architecture/isolation.test.ts` enforces it)
+- Every mutating endpoint → honours `Idempotency-Key` (idempotency middleware)
+- Every route → registered in `runtime/openapi.ts`; commit a fresh `npm run openapi:export`
+- Every external call → retry + timeout
+- Gate green (`npm run gate`) and all tests pass before `/push-layer`
+
+---
+
+## 🔁 The Flow
+
+```
+# Whole product (run once at the start):
+/write-roadmap  →  human reviews ROADMAP  →  pick the walking-skeleton spec
+
+# Every feature (repeat down the roadmap):
+/write-spec (roadmap-guided)  →  human marks READY  →  /write-plan
+  →  /build-layer (repeats, gate-enforced)
+  →  /garbage-collect  →  plan closed
+```

package/templates/express/ARCHITECTURE.md

@@ -0,0 +1,161 @@
+# ARCHITECTURE.md — Layered Architecture
+
+Stack: TypeScript 5 · Express 5 · Sequelize 6 · PostgreSQL · Redis · BullMQ
+
+---
+
+## Dependency Layer Diagram
+
+```
+┌─────────────────────────────────────────────────────────┐
+│  Utils  — stateless helpers, zero domain imports        │
+│           100% test coverage required                    │
+└────────────────────┬────────────────────────────────────┘
+                     │ (imported by all layers below)
+┌────────────────────▼────────────────────────────────────┐
+│                                                          │
+│  Types ──► Config ──► Models ──► Repo                   │
+│                                    │                     │
+│                                    ▼                     │
+│                                 Service                  │
+│                                    │                     │
+│                                    ▼                     │
+│                    Runtime { Routes · Workers }          │
+│                                                          │
+│  Providers (auth, telemetry SDK, redis)                  │
+│  └─ wired in by Runtime (composition root) only          │
+│                                                          │
+│  Config also hosts cross-cutting helpers every layer     │
+│  needs: logger, tracing (withSpan), metrics              │
+│                                                          │
+└──────────────────────────────────────────────────────────┘
+```
+
+---
+
+## Layer Definitions
+
+### Types (`src/types/`)
+- Pure TypeScript interfaces, enums, type aliases, Zod schemas
+- **Zero imports** from any other layer
+- **Zero runtime code** — no function bodies with logic
+- Examples: `Application`, `ApplicationStage`, `CreateApplicationInput`, `PageResult<T>`
+
+### Config (`src/config/`)
+- Env vars (Zod-validated), constants, timeouts
+- Cross-cutting helpers every layer may import: `logger` (pino), `withSpan` (tracing), `metrics`
+  — these use only the `@opentelemetry/api` global, so they are safe no-ops when the SDK is off
+- Imports: **Types only** (plus third-party: `zod`, `pino`, `@opentelemetry/api`)
+- `env.ts` calls `process.exit(1)` on invalid config — fail fast
+- Examples: `env.ts`, `constants.ts`, `timeouts.ts`, `database.ts`, `logger.ts`, `tracing.ts`, `metrics.ts`
+
+### Models (`src/models/`)
+- Sequelize model class definitions — schema only, no logic
+- Imports: **Types, Config**
+- All models: `paranoid: true`, `@Default(() => newId())`, indexes defined
+- Examples: `User.model.ts`, `Application.model.ts`
+
+### Repo (`src/repo/`)
+- DB access only. All external data validated with Zod.
+- Imports: **Types, Config, Models**
+- **Every** query result: `Schema.parse(raw.toJSON())`
+- All list methods: cursor-based pagination (cursors encoded with **base64url**)
+- Ownership enforced: `findByIdAndUser(id, userId)` — never `findById` alone
+- **Cross-user isolation**: a resource owned by user A must be invisible to user B.
+  When B requests A's resource, the repo returns nothing and the route responds
+  **404** (never 403 — do not reveal that the resource exists). **Enforced**: every
+  ownership-scoped repo must ship `tests/integration/<resource>.isolation.test.ts`
+  (copy `isolation.test.template.ts`); `tests/architecture/isolation.test.ts` fails
+  CI if one is missing.
+- Examples: `user.repo.ts`, `application.repo.ts`
+
+### Service (`src/services/`)
+- Business logic and use-case orchestration
+- Imports: **Types, Config, Repo**
+- **No** `Request`, `Response`, `HttpException`, `express` imports
+- **No** inline HTTP calls — external APIs go via Repo
+- Examples: `application.service.ts`, `auth.service.ts`
+
+### Runtime (`src/runtime/`)
+- HTTP handlers, job workers, CLI entry points
+- Imports: **Types, Config, Repo, Service**
+- Routes: auth → validate → service → respond (this order, every time)
+- Thin layer — zero business logic, delegates everything to Service
+- **Canonical response envelope** (see `.claude/rules/api.md` for full spec):
+  - Success: `{ ok: true, data, meta: { requestId, timestamp } }` via the `ok()` helper
+  - Error: `{ ok: false, error: { code, message }, meta: { requestId } }` via `errorHandler`
+  - `error.code` ∈ `VALIDATION_ERROR | NOT_FOUND | UNAUTHORIZED | FORBIDDEN | CONFLICT | RATE_LIMITED | INTERNAL_ERROR`
+- Mutating routes accept an `Idempotency-Key` header via `middleware/idempotency.ts` (Redis-backed replay)
+- The OpenAPI registry lives in `runtime/openapi.ts`; routes register their schemas + paths there
+- Examples: `routes/v1/applications.route.ts`, `middleware/idempotency.ts`, `workers/reminder.worker.ts`
+
+### Providers (`src/providers/`)
+- Stateful cross-cutting singletons: auth, redis, the OpenTelemetry `NodeSDK`, feature flags
+- Wired in by **Runtime** (the composition root) — never imported by Service/Repo/Models
+- `telemetry.ts` is **boot-only**: it owns the `NodeSDK` and is the *only* file that imports it.
+  The reusable `withSpan`/`metrics`/`logger` helpers live in **Config** (the api-global, no SDK)
+  so that Service and Repo can stay clean without importing this layer.
+- Examples: `redis.ts`, `auth/jwt.ts`, `telemetry.ts`, `featureFlags.ts`
+
+### Utils (`src/utils/`)
+- Stateless helpers — **type-only imports from Types allowed** (e.g. the response-envelope types in `response.util.ts`); zero other domain imports
+- **100% test coverage** required — enforced in CI
+- Examples: `retry.ts`, `circuitBreaker.ts`, `mapWithConcurrency.ts`, `uuid.ts`
+
+---
+
+## Allowed Imports (strict — linter enforces)
+
+```
+Types   →  (nothing)
+Config  →  Types
+Models  →  Types, Config
+Repo    →  Types, Config, Models
+Service →  Types, Config, Repo
+Runtime →  Types, Config, Repo, Service
+Utils   →  Types (type-only)
+Providers → nothing from domain (domain imports Providers, not reverse)
+```
+
+**Forbidden:**
+- Service importing from Runtime or Providers — *blocked by ESLint* (`boundaries/dependencies`)
+- Utils importing from any domain layer other than type-only Types — *blocked by ESLint* (`boundaries/dependencies`)
+- Circular imports of any kind — *blocked by `madge --circular`* (`npm run check:circular`)
+- Repo containing business logic (if/else beyond null checks) — *checked by gate-checker + review*
+  (no linter can express this rule; it is a judgment check, not a mechanical one)
+
+---
+
+## File Size Limit
+- **400 lines maximum** per file
+- Approaching limit → split into focused sub-modules
+- Enforced by: PostToolUse hook + gate-checker agent
+
+---
+
+## Naming Conventions
+
+| Layer | File pattern | Example |
+|---|---|---|
+| Types | `*.types.ts` | `application.types.ts` |
+| Config | `*.ts` in `config/` | `env.ts`, `timeouts.ts` |
+| Models | `*.model.ts` | `Application.model.ts` |
+| Repo | `*.repo.ts` | `application.repo.ts` |
+| Service | `*.service.ts` | `application.service.ts` |
+| Route | `*.route.ts` | `applications.route.ts` |
+| Worker | `*.worker.ts` | `reminder.worker.ts` |
+| Utils | `*.util.ts` | `retry.util.ts` |
+| Zod schemas | `*Schema` | `ApplicationSchema` |
+
+---
+
+## Mechanical Enforcement Stack
+
+1. **ESLint** (`eslint.config.mjs`) — `boundaries/dependencies` (eslint-plugin-boundaries v6, with the TypeScript import resolver) blocks cross-layer imports;
+   `no-restricted-syntax` blocks `process.env` outside `config/env.ts`; plus `no-console`,
+   `no-explicit-any`, `no-unsafe-assignment`, `no-floating-promises`.
+2. **madge** — `npm run check:circular` blocks circular imports (ESLint does not do this).
+3. **Structural tests** — `tests/architecture/layers.test.ts` — a second, independent layer check; fails CI.
+4. **PostToolUse hook** — `.claude/hooks/post-write.sh` warns on write (size, console.log, process.env, unsafe cast).
+5. **gate / gate-checker** — `npm run gate` (humans + CI) and the `gate-checker` agent (called by `/build-layer`);
+   PASS required before commit.

package/templates/express/Dockerfile

@@ -0,0 +1,40 @@
+# Stage 1: Dependencies
+FROM node:24-alpine AS deps
+WORKDIR /app
+COPY package*.json ./
+# --omit=dev installs production deps only (--only=production is deprecated in npm 7+).
+RUN npm ci --omit=dev && npm cache clean --force
+
+# Stage 2: Builder
+FROM node:24-alpine AS builder
+WORKDIR /app
+COPY package*.json ./
+RUN npm ci
+COPY . .
+RUN npm run build
+
+# Stage 3: Runner
+FROM node:24-alpine AS runner
+WORKDIR /app
+
+# Create non-root user
+RUN addgroup -g 1001 -S nodejs && \
+    adduser -S nodejs -u 1001
+
+# Copy dependencies and build artifacts
+COPY --from=deps --chown=nodejs:nodejs /app/node_modules ./node_modules
+COPY --from=builder --chown=nodejs:nodejs /app/dist ./dist
+COPY --from=builder --chown=nodejs:nodejs /app/package.json ./
+
+# Switch to non-root user
+USER nodejs
+
+# Expose port
+EXPOSE 3000
+
+# Health check
+HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
+  CMD node -e "require('http').get('http://localhost:3000/health', (res) => process.exit(res.statusCode === 200 ? 0 : 1))"
+
+# Start server
+CMD ["node", "dist/runtime/server.js"]

package/templates/express/Makefile

@@ -0,0 +1,79 @@
+# Makefile — thin wrapper over the npm scripts so the same verbs (make gate, make
+# dev, make test, make setup) work identically across the harness family (FastAPI,
+# Express, NestJS). The npm scripts in package.json remain the source of truth;
+# this just gives cross-stack muscle memory. Run `make` or `make help` for the list.
+
+.DEFAULT_GOAL := help
+.PHONY: help setup dev build start test test-coverage gate lint format typecheck \
+        check-circular audit openapi migrate migrate-undo seed load-smoke load-stress \
+        load-soak up down logs
+
+help: ## Show this help
+	@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) \
+		| awk 'BEGIN {FS = ":.*?## "}; {printf "  \033[36m%-16s\033[0m %s\n", $$1, $$2}'
+
+setup: ## First-run: install deps (the agent flow uses /infra-setup; this is the manual path)
+	npm install
+
+dev: ## Run the dev server (tsx watch)
+	npm run dev
+
+build: ## Compile TypeScript to dist/
+	npm run build
+
+start: ## Run the compiled server
+	npm run start
+
+test: ## Run the test suite
+	npm test
+
+test-coverage: ## Run tests with coverage (per-layer thresholds enforced)
+	npm run test:coverage
+
+gate: ## The deterministic gate: typecheck + lint + circular-check + arch tests
+	npm run gate
+
+lint: ## ESLint (0 warnings; includes layer-boundary enforcement)
+	npm run lint
+
+format: ## Prettier write
+	npm run format
+
+typecheck: ## tsc --noEmit
+	npm run typecheck
+
+check-circular: ## madge circular-import check
+	npm run check:circular
+
+audit: ## npm audit (fail on high+)
+	npm run audit
+
+openapi: ## Regenerate docs/generated/openapi.{json,yaml}
+	npm run openapi:export
+
+migrate: ## Run DB migrations
+	npm run db:migrate
+
+migrate-undo: ## Revert the last migration
+	npm run db:migrate:undo
+
+seed: ## Seed the database
+	npm run db:seed
+
+load-smoke: ## k6 smoke test
+	npm run load:smoke
+
+load-stress: ## k6 stress test
+	npm run load:stress
+
+load-soak: ## k6 soak test
+	npm run load:soak
+
+up: ## Start the local stack (postgres, redis, app, lgtm, alloy)
+	docker compose up -d
+
+down: ## Stop the local stack and remove volumes
+	docker compose down -v
+
+logs: ## Tail the app container logs
+	docker compose logs -f app

package/templates/express/QUICKSTART.md

@@ -0,0 +1,131 @@
+# QUICKSTART — Your First 30 Minutes
+
+This is an **agent-first** backend template. You don't write code by hand — you
+drive [Claude Code](https://claude.com/claude-code) through a gated, layer-by-layer
+flow. This guide gets you from clone to first feature.
+
+---
+
+## What is this template?
+
+A governance skeleton for building Express + TypeScript + Sequelize backends with
+Claude Code. It ships with:
+
+- **Rules** (`.claude/rules/`) auto-injected when Claude edits matching files
+- **Skills** (`.claude/skills/`) — the `/slash-commands` that drive the workflow
+- **Agents** (`.claude/agents/`) — e.g. the `gate-checker` that blocks bad layers
+- **Config** (`package.json`, `tsconfig.json`, `jest.config.ts`, `Dockerfile`, …) ready to run
+- **Docs** (`docs/`) — specs, plans, ADRs, quality scores
+
+It does **not** ship application code. `/infra-setup` generates `src/` on first run.
+
+---
+
+## Prerequisites
+
+| Tool | Version | Check |
+|---|---|---|
+| Node.js | 24 LTS | `node -v` |
+| npm | 11+ | `npm -v` |
+| Docker Desktop | latest | `docker --version` |
+| Claude Code | latest | `claude --version` |
+| Git | any recent | `git --version` |
+
+Install Claude Code: see https://claude.com/claude-code. Open this folder in your
+IDE (the VS Code / JetBrains extension) or run `claude` in the terminal here.
+
+---
+
+## Step 1 — Start the local services
+
+The template includes Postgres + Redis (and an app container) via Docker Compose:
+
+```bash
+cp .env.example .env        # then fill in JWT_SECRET and any blanks
+docker compose up -d postgres redis
+```
+
+## Step 2 — Run infrastructure setup (once)
+
+In Claude Code, run:
+
+```
+/infra-setup
+```
+
+This installs dependencies (latest LTS — nothing is version-pinned), generates the
+full `src/` layer structure, providers, middleware, health checks, and the ADR-000
+record, then runs the gate and commits. It refuses to run twice (aborts if `src/` exists).
+
+When it finishes you should be able to:
+
+```bash
+npm run dev          # server on http://localhost:3000
+curl localhost:3000/health   # → { "ok": true, ... }
+npm test             # green
+```
+
+## Step 3 — Build your first feature
+
+Planning a whole product first? Run `/write-roadmap` (brief → ordered, dependency-aware specs in
+`docs/product-specs/ROADMAP.md`), then author each spec down the list. The flow for **every**
+feature is the same:
+
+```
+/write-roadmap   → (whole product, optional) brief → ordered, dependency-aware spec roadmap
+   ↓  (review the roadmap; build the walking-skeleton spec first, then go down the list)
+/write-spec      → describe what you're building (roadmap-guided; saved to docs/product-specs/draft/)
+   ↓  (you review the spec and mark it READY)
+/write-plan      → turns the spec into a layered execution plan
+   ↓
+/build-layer     → builds the next unchecked layer, runs the gate, commits
+   ↓  (repeat /build-layer until all layers are checked off)
+/garbage-collect → end-of-feature cleanup, closes the plan
+```
+
+`/build-layer` is the heartbeat: it builds **one layer**, runs the `gate-checker`
+agent, auto-fixes failures (up to 3 attempts), commits, and then **waits for you**
+before the next layer. You stay in control at every boundary.
+
+---
+
+## What to expect
+
+- **You approve direction, the agent does the typing.** Read each layer summary
+  before confirming the next.
+- **The gate is non-negotiable.** A layer can't be committed until tsc, eslint,
+  madge (circular imports), and the architecture tests pass.
+- **Rules enforce themselves.** Try adding a `console.log` in a service — the
+  post-write hook warns you and the gate blocks it. Use `logger` instead.
+- **Everything is documented.** Non-obvious decisions become ADRs in
+  `docs/design-docs/decisions/`.
+
+---
+
+## Where to look next
+
+| You want to… | Read |
+|---|---|
+| Understand the layers | `ARCHITECTURE.md` |
+| Understand the *why* | `docs/design-docs/core-beliefs.md` |
+| See all commands | `AGENTS.md` |
+| Know the plan format | `docs/PLANS.md` |
+| Work as a team | `docs/design-docs/team-workflow.md` |
+| Check domain health | `docs/QUALITY_SCORE.md` |
+
+---
+
+## Troubleshooting
+
+- **`/infra-setup` says it's already set up** — `src/` exists. It only runs once per repo.
+- **`npm test` fails right after clone** — expected. Tests need `npm install` + the
+  source `/infra-setup` generates. Run `/infra-setup` first.
+- **DB connection refused** — `docker compose up -d postgres redis` and confirm
+  `DATABASE_URL` in `.env` matches the compose credentials.
+- **A skill feels stale** — check its `verified:` date in the frontmatter. If it's
+  >60 days old, Claude will re-check library versions before following it (see the
+  Skill Freshness Check in `.claude/CLAUDE.md`).
+- **Load tests** — install k6 (`choco install k6` on Windows, `brew install k6` on
+  macOS), start the server, then `npm run load:smoke`. The shipped scripts hit
+  `/health` out of the box. In CI, run the **Load Test** workflow manually from the
+  Actions tab (it never runs on push/PR). See `/load-test`.