everything-gemini 1.1.1 → 1.2.0

package/.vscode/extensions.json

@@ -0,0 +1,8 @@
+{
+  "recommendations": [
+    "redhat.vscode-yaml",
+    "timonwong.shellcheck",
+    "esbenp.prettier-vscode",
+    "yzhang.markdown-all-in-one"
+  ]
+}

package/.vscode/settings.json

@@ -0,0 +1,3 @@
+{
+  "python.defaultInterpreterPath": "${workspaceFolder}/.venv/bin/python"
+}

package/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to **Everything Gemini (`everything-gemini`)** will be docum
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.2.0] - 2026-10-15
+
+### Added
+- **30 Progressive Disclosure Skills Milestone**:
+  - **`agent-evals`**: Automated evaluation pipelines, LLM-as-a-judge rubrics, golden test datasets, and regression testing.
+  - **`docker-compose-orchestrator`**: Multi-container local environments (Postgres + pgvector, Redis), healthcheck dependency wiring, and persistent volumes.
+  - **`graphql-architect`**: Schema-first GraphQL APIs, DataLoader N+1 query batching, and Relay cursor-based pagination.
+- **Enterprise Security Policy**: Added [`SECURITY.md`](SECURITY.md) establishing formal vulnerability disclosure workflows.
+- **IDE Extensions**: Added [`.vscode/extensions.json`](.vscode/extensions.json) for developer workspace onboarding.
+
+---
+
 ## [1.1.1] - 2026-10-15
 
 ### Added

package/README.md

@@ -145,7 +145,7 @@ everything-gemini/
 ├── agents/                       # Scoped subagent fleet (Planner, Reviewer, Architect, etc.)
 ├── scripts/                      # Automated installers and harness validators
 ├── plugins/                      # Reusable modular plugins (web-fullstack, python-ai, security)
-├── skills/                       # 27 Progressive disclosure skills (25 core + 2 plugins)
+├── skills/                       # 30 Progressive disclosure skills (28 core + 2 plugins)
 ├── rules/                        # Contextual guidelines & standards
 ├── hooks/                        # Event-driven lifecycle hooks (GeminiShield, Auto-lint)
 ├── mcp/                          # Production-ready MCP server blueprints
@@ -179,13 +179,16 @@ Skills in Antigravity are lazy-loaded runbooks. Only their YAML frontmatter (`na
 - **[`rag-architect`](skills/rag-architect/SKILL.md)**: RAG pipeline design, AST semantic chunking, hybrid vector-keyword retrieval, and Gemini re-ranking.
 - **[`gemini-function-calling`](skills/gemini-function-calling/SKILL.md)**: Production function declarations, structured JSON output schemas (Pydantic), and parallel tool dispatch.
 - **[`ai-first-engineering`](skills/ai-first-engineering/SKILL.md)**: Requirement decomposition, executable acceptance criteria (BDD), and blast-radius containment.
+- **[`agent-evals`](skills/agent-evals/SKILL.md)**: Automated evaluation pipelines, LLM-as-a-judge scoring, golden test datasets, and prompt regression testing.
 - **[`github-ops`](skills/github-ops/SKILL.md)**: GitHub workflow automation, PR generation, code review triage, and semantic releases with `gh` CLI & GitHub MCP.
 - **[`subagent-handoff`](skills/subagent-handoff/SKILL.md)**: Multi-agent task delegation protocol, scoped contexts, and report synthesis.
 - **[`api-craftsman`](skills/api-craftsman/SKILL.md)**: REST, OpenAPI 3.1 specifications, gRPC protos, and RFC 7807 error envelopes.
 - **[`database-architect`](skills/database-architect/SKILL.md)**: Zero-downtime migrations, concurrent indexing, and ACID schema modeling.
 - **[`fullstack-nextjs`](skills/fullstack-nextjs/SKILL.md)**: Next.js App Router, React Server Components (RSC), hydration error diagnosis, and Server Actions.
+- **[`graphql-architect`](skills/graphql-architect/SKILL.md)**: Schema-first GraphQL APIs, DataLoader N+1 query batching, and Relay cursor pagination.
 - **[`supabase-architect`](skills/supabase-architect/SKILL.md)**: Row Level Security (RLS) policies, pgvector embeddings, and edge function workflows.
 - **[`cloudflare-workers`](skills/cloudflare-workers/SKILL.md)**: Serverless edge functions, Wrangler v3, D1 SQL, and KV low-latency storage.
+- **[`docker-compose-orchestrator`](skills/docker-compose-orchestrator/SKILL.md)**: Multi-container local environments (Postgres + pgvector, Redis) with healthchecks.
 - **[`kubernetes-operator`](skills/kubernetes-operator/SKILL.md)**: Production k8s manifests, HPA autoscaling, zero-downtime rolling updates, and health probes.
 - **[`stripe-integration`](skills/stripe-integration/SKILL.md)**: Webhook signature verification, idempotent payments, and customer portal session flows.
 - **[`devops-pipeline`](skills/devops-pipeline/SKILL.md)**: Multi-stage Dockerfiles and caching GitHub Actions CI/CD workflows.
@@ -305,6 +308,9 @@ The zero-dependency `everything-gemini` CLI manages your configurations effortle
 # Test and validate a specific skill's frontmatter and scripts
 ./bin/everything-gemini test-skill gemini-multimodal
 
+# View detailed playbook overview and triggers for a skill
+./bin/everything-gemini info agent-evals
+
 # Scaffold a new progressive-disclosure skill
 ./bin/everything-gemini new-skill my-custom-skill
 

package/SECURITY.md

@@ -0,0 +1,38 @@
+# Security Policy
+
+## Supported Versions
+
+We actively provide security patches and dependency updates for the following versions:
+
+| Version | Supported          |
+| :---    | :---               |
+| 1.x     | :white_check_mark: |
+| < 1.0   | :x:                |
+
+---
+
+## Reporting a Vulnerability
+
+The Everything Gemini team takes the security of agent systems, lifecycle hooks, and model interactions seriously.
+
+If you discover a security vulnerability, prompt injection bypass in safety gates, or credential exposure vector:
+
+1. **Do NOT open a public GitHub issue.**
+2. Report the vulnerability privately via **GitHub Security Advisories** on the repository:
+   - Go to [https://github.com/salmandev/everything-gemini/security/advisories](https://github.com/salmandev/everything-gemini/security/advisories)
+   - Click **"Report a vulnerability"**
+3. Alternatively, email the maintainer directly at `salman@salmandev.com` with the subject:
+   `[SECURITY] Everything Gemini Vulnerability Report`.
+
+Please include:
+- A clear description of the vulnerability and attack vector.
+- Minimal reproduction steps, sample prompts, or script commands.
+- Potential impact on agent runtimes or host filesystem integrity.
+
+---
+
+## Response Timeline
+
+- **Initial Acknowledgment**: Within 48 hours of receipt.
+- **Triage & Assessment**: Within 5 business days.
+- **Remediation & Patch**: Published as an expedited patch release (`v1.x.y`).

package/bin/everything-gemini

@@ -51,6 +51,7 @@ function printHelp() {
   console.log(`  ${GREEN}add${RESET} <type> <name>           Add a specific skill, agent, or plugin to workspace`);
   console.log(`  ${GREEN}remove${RESET} <type> <name>        Remove a specific skill, agent, or plugin from workspace`);
   console.log(`  ${GREEN}test-skill${RESET} <name>           Validate a specific skill frontmatter & scripts`);
+  console.log(`  ${GREEN}info${RESET} <skill-name>            Display detailed instructions and trigger for a skill`);
   console.log(`  ${GREEN}validate${RESET}                    Run self-test on frontmatter, JSON schemas & hooks`);
   console.log(`  ${GREEN}help${RESET}                        Show this help message\n`);
   console.log(`${BOLD}OPTIONS for 'install':${RESET}`);
@@ -653,6 +654,70 @@ function testSkill(name) {
   console.log(`\n${GREEN}${BOLD}✨ Skill '${cleanName}' passed all validation checks!${RESET}\n`);
 }
 
+function showSkillInfo(skillName) {
+  if (!skillName) {
+    console.error(`\n${RED}Error: Please specify a skill name.${RESET}`);
+    console.log(`Usage: everything-gemini info <skill-name>\n`);
+    process.exit(1);
+  }
+
+  const cleanName = skillName.trim().replace(/^skills\//, '');
+  let skillDir = path.join(REPO_ROOT, 'skills', cleanName);
+  let pluginName = null;
+
+  if (!fs.existsSync(skillDir)) {
+    const pluginsDir = path.join(REPO_ROOT, 'plugins');
+    if (fs.existsSync(pluginsDir)) {
+      const plugins = fs.readdirSync(pluginsDir, { withFileTypes: true })
+        .filter(d => d.isDirectory())
+        .map(d => d.name);
+      for (const p of plugins) {
+        const candidate = path.join(pluginsDir, p, 'skills', cleanName);
+        if (fs.existsSync(candidate)) {
+          skillDir = candidate;
+          pluginName = p;
+          break;
+        }
+      }
+    }
+  }
+
+  const skillMd = path.join(skillDir, 'SKILL.md');
+  if (!fs.existsSync(skillMd)) {
+    console.error(`\n${RED}Error: Skill '${cleanName}' not found in catalog.${RESET}\n`);
+    process.exit(1);
+  }
+
+  printBanner();
+  console.log(`${BOLD}📖 Skill Overview: ${CYAN}${cleanName}${RESET}`);
+  if (pluginName) {
+    console.log(`Source Plugin: ${YELLOW}${pluginName}${RESET}`);
+  }
+  console.log(`Path: ${GRAY}${skillMd}${RESET}\n`);
+
+  const content = fs.readFileSync(skillMd, 'utf8');
+  const parts = content.split('---');
+  if (parts.length >= 3) {
+    const frontmatter = parts[1];
+    const descMatch = frontmatter.match(/description:\s*>?-?\s*([^\n\r]+)/);
+    if (descMatch) {
+      console.log(`${BOLD}🎯 Trigger Description:${RESET}`);
+      console.log(`  ${descMatch[1].trim()}\n`);
+    }
+
+    const body = parts.slice(2).join('---').trim();
+    const lines = body.split('\n').slice(0, 22);
+    console.log(`${BOLD}📋 Playbook Preview:${RESET}`);
+    console.log(lines.join('\n'));
+    if (body.split('\n').length > 22) {
+      console.log(`\n${GRAY}... (${body.split('\n').length - 22} more lines in ${skillMd})${RESET}`);
+    }
+  } else {
+    console.log(content.split('\n').slice(0, 25).join('\n'));
+  }
+  console.log('');
+}
+
 // CLI Argument Parsing
 const args = process.argv.slice(2);
 const command = args[0] || 'help';
@@ -679,6 +744,10 @@ switch (command) {
   case 'test-skill':
     testSkill(args[1]);
     break;
+  case 'info':
+  case 'show':
+    showSkillInfo(args[1]);
+    break;
   case 'init':
   case 'install': {
     let profile = 'developer';

package/docs/LAUNCH_KIT.md

@@ -8,11 +8,11 @@ This launch kit contains ready-to-post announcements, social copy, and submissio
 
 ### Option A: The High-Impact Single Tweet (251 chars)
 ```text
-🪐 Everything Gemini v1.1.0 is live!
+🪐 Everything Gemini v1.2.0 is live!
 
 The open-source multi-agent harness for Google Antigravity & Gemini 3.8.
 
-⚡ 27 lazy-loaded skills (Multimodal, RAG, 2M context caching)
+⚡ 30 lazy-loaded skills (Multimodal, RAG, Evals, 2M context caching)
 🤖 6 scoped subagents
 🛡️ GeminiShield safety gates
 
@@ -33,9 +33,10 @@ Introducing Everything Gemini 🪐 — the open-source agent harness & multi-age
 **Tweet 2 (Core Innovations)**:
 ```text
 Unlike traditional prompt dumps, Everything Gemini uses strict Progressive Disclosure:
-- 🧠 27 lazy-loaded skills load runbooks on demand (saving up to 85% token overhead).
+- 🧠 30 lazy-loaded skills load runbooks on demand (saving up to 85% token overhead).
 - ⚡ Exploits Gemini's 2M token context with static prefix caching.
 - 👁️ Multimodal visual QA with automated WebP recordings.
+- 🧪 Agent Evals with LLM-as-a-judge scoring rubrics.
 ```
 
 **Tweet 3 (Fleet & Safety)**:
@@ -63,7 +64,7 @@ Give it a ⭐ and let me know what skills to add next!
 
 **Title**:
 ```text
-Everything Gemini: Open-source multi-agent harness, 27 progressive skills & subagent fleet for Google Antigravity
+Everything Gemini: Open-source multi-agent harness, 30 progressive skills & subagent fleet for Google Antigravity
 ```
 
 **Body**:
@@ -74,10 +75,10 @@ With Google Antigravity rolling out across Desktop 2.0, IDE, and CLI surfaces, I
 
 ### 🌟 Key Highlights
 
-1. **27 Lazy-Loaded Progressive Disclosure Skills**:
-   - **Frontier**: Native multimodal UI testing, 2M token prefix context caching, real-time Google Search grounding, RAG with re-ranking (`rag-architect`), and typed function calling schemas.
-   - **Cloud & Backend**: Supabase RLS policies, Cloudflare Workers & D1 SQL, Kubernetes manifests with HPA, Stripe webhook verification, and Next.js App Router.
-   - **Engineering**: Test-Driven Development (Red-Green-Refactor), automated git bisect debugging, GitHub Ops, and performance profiling.
+1. **30 Lazy-Loaded Progressive Disclosure Skills**:
+   - **Frontier**: Native multimodal UI testing, 2M token prefix context caching, real-time Google Search grounding, RAG with re-ranking (`rag-architect`), agent evaluations (`agent-evals`), and typed function calling schemas.
+   - **Cloud & Backend**: Supabase RLS policies, Cloudflare Workers & D1 SQL, Kubernetes manifests with HPA, GraphQL APIs with DataLoader, Stripe webhook verification, and Next.js App Router.
+   - **Engineering & DevOps**: Docker Compose orchestrator, Test-Driven Development (Red-Green-Refactor), automated git bisect debugging, GitHub Ops, and performance profiling.
 
 2. **6 Scoped Subagents (`agents/`)**:
    - Specialized specifications for **Planner**, **Code Reviewer**, **Build Repair**, **Browser QA**, **Security Auditor**, and **Architect** with formal task delegation and boundary protocols.
@@ -120,7 +121,7 @@ As coding agents move beyond simple single-turn prompts into multi-step autonomo
 
 Inspired by Affan Mustafa's Everything Claude Code (ECC), I built Everything Gemini (everything-gemini) specifically optimized for Google Antigravity and Gemini's architecture:
 
-- Progressive Disclosure: The agent only sees metadata in its system prompt; complete procedural playbooks (27 skills) are lazy-loaded only when triggered by user intent.
+- Progressive Disclosure: The agent only sees metadata in its system prompt; complete procedural playbooks (30 skills) are lazy-loaded only when triggered by user intent.
 - Massive Context Economics: Harnesses Gemini's 1M-2M token window with static prefix caching (~75% cost reduction).
 - Scoped Subagent Fleet: Discrete roles for Planner, Reviewer, Browser QA, Build Repair, Security, and Architect.
 - GeminiShield: Deterministic PreToolUse lifecycle gates intercepting catastrophic commands.
@@ -141,7 +142,7 @@ Would love to hear your thoughts and feedback!
 As AI coding platforms evolve, developers need structured engineering workflows, deterministic safety rails, and context-efficient architectures.
 
 🪐 Everything Gemini delivers:
-✅ 27 Progressive Disclosure Skills (Multimodal vision, 2M context caching, RAG with re-ranking, Supabase, Cloudflare Workers, GitHub Ops)
+✅ 30 Progressive Disclosure Skills (Multimodal vision, 2M context caching, RAG with re-ranking, Agent Evals, Supabase, Cloudflare Workers, GitHub Ops)
 ✅ 6 Scoped Subagents with formal delegation boundaries (Planner, Reviewer, QA, Repair, Security, Architect)
 ✅ GeminiShield deterministic lifecycle safety hooks
 ✅ 1-second setup: `npx everything-gemini install`

package/docs/index.html

@@ -10,14 +10,14 @@
   <meta property="og:type" content="website">
   <meta property="og:url" content="https://salmandev.github.io/everything-gemini/">
   <meta property="og:title" content="Everything Gemini — Agent Harness for Google Antigravity">
-  <meta property="og:description" content="27 Progressive Disclosure Skills, 6 Scoped Subagents, and Deterministic Safety Gates for Gemini 3.8 & Google Antigravity.">
+  <meta property="og:description" content="30 Progressive Disclosure Skills, 6 Scoped Subagents, and Deterministic Safety Gates for Gemini 3.8 & Google Antigravity.">
   <meta property="og:image" content="https://raw.githubusercontent.com/salmandev/everything-gemini/main/assets/banner.jpg">
 
   <!-- Twitter Card -->
   <meta name="twitter:card" content="summary_large_image">
   <meta name="twitter:url" content="https://salmandev.github.io/everything-gemini/">
   <meta name="twitter:title" content="Everything Gemini — Agent Harness for Google Antigravity">
-  <meta name="twitter:description" content="27 Progressive Disclosure Skills, 6 Scoped Subagents, and Deterministic Safety Gates for Gemini 3.8 & Google Antigravity.">
+  <meta name="twitter:description" content="30 Progressive Disclosure Skills, 6 Scoped Subagents, and Deterministic Safety Gates for Gemini 3.8 & Google Antigravity.">
   <meta name="twitter:image" content="https://raw.githubusercontent.com/salmandev/everything-gemini/main/assets/banner.jpg">
 
   <link rel="preconnect" href="https://fonts.googleapis.com">
@@ -364,7 +364,7 @@
     <div class="container nav-inner">
       <a href="#" class="brand">
         🪐 Everything Gemini
-        <span class="brand-badge">v1.1.1</span>
+        <span class="brand-badge">v1.2.0</span>
       </a>
       <div class="nav-links">
         <a href="https://github.com/salmandev/everything-gemini" class="nav-link">GitHub</a>
@@ -399,7 +399,7 @@
       <!-- Metrics -->
       <div class="metrics">
         <div class="metric-card">
-          <div class="metric-value">27+</div>
+          <div class="metric-value">30+</div>
           <div class="metric-label">Progressive Skills</div>
         </div>
         <div class="metric-card">
@@ -473,7 +473,10 @@
       { name: "tdd-workflow", type: "skill", cat: "devops", desc: "Strict Test-Driven Development (Red-Green-Refactor) loop ensuring tests exist before code is written." },
       { name: "root-cause-debugger", type: "skill", cat: "devops", desc: "Systematic regression diagnosis using binary search (git bisect), log traces, and minimal reproduction harnesses." },
       { name: "browser-qa-tester", type: "skill", cat: "frontier", desc: "Automated browser end-to-end testing with native WebP recording for visual validation." },
+      { name: "agent-evals", type: "skill", cat: "frontier", desc: "Automated evaluation pipelines, LLM-as-a-judge rubrics, golden test datasets, and prompt regression testing." },
       { name: "git-craftsman", type: "skill", cat: "devops", desc: "Conventional atomic commits, interactive rebasing, clean branch lifecycles, and git hygiene." },
+      { name: "docker-compose-orchestrator", type: "skill", cat: "devops", desc: "Multi-container local environments, database services (Postgres, pgvector, Redis), and healthcheck wiring." },
+      { name: "graphql-architect", type: "skill", cat: "backend", desc: "Schema-first GraphQL APIs, DataLoader N+1 query batching, and Relay cursor-based pagination." },
       { name: "performance-profiler", type: "skill", cat: "devops", desc: "Application latency profiling, CPU/memory leak diagnosis, and slow query optimization." },
       { name: "continuous-learning", type: "skill", cat: "frontier", desc: "Adaptive Learned Instincts and Knowledge Item memory capturing developer corrections across sessions." },
       { name: "repo-onboarding", type: "skill", cat: "frontier", desc: "Rapid codebase indexing, directory mapping, pattern extraction, and Knowledge Item generation." },

package/examples/cli-workflows/README.md

@@ -0,0 +1,45 @@
+# 🛠️ CLI Workflow Automation Example
+
+This example demonstrates how to automate workspace onboarding and component management using the **`everything-gemini`** CLI in scripts, CI pipelines, or devcontainer lifecycles.
+
+---
+
+## 🏃 Running the Demo
+
+Make the script executable and run:
+
+```bash
+chmod +x demo_workflow.sh
+./demo_workflow.sh
+```
+
+---
+
+## 📋 What the Script Does
+
+1. **Creates an isolated temporary directory** to simulate a fresh project repository.
+2. **Initializes the workspace** with `everything-gemini init --workspace <dir>`.
+3. **Installs granular components** on-demand:
+   ```bash
+   everything-gemini add skill agent-evals
+   everything-gemini add skill docker-compose-orchestrator
+   everything-gemini add agent architect
+   ```
+4. **Validates the skill frontmatter & boundary definitions**:
+   ```bash
+   everything-gemini test-skill agent-evals
+   ```
+
+---
+
+## 🐳 Devcontainer Integration
+
+You can integrate `everything-gemini` into your `.devcontainer/devcontainer.json` `postCreateCommand`:
+
+```json
+{
+  "name": "Gemini Antigravity Environment",
+  "image": "mcr.microsoft.com/devcontainers/javascript-node:20",
+  "postCreateCommand": "npx everything-gemini install --profile developer"
+}
+```

package/examples/cli-workflows/demo_workflow.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# ==============================================================================
+# Everything Gemini CLI Workflow Automation Demo
+# Demonstrates initializing an empty workspace, installing profiles,
+# adding individual skills, and running automated skill validation.
+# ==============================================================================
+
+set -euo pipefail
+
+DEMO_DIR="$(mktemp -d -t everything-gemini-demo-XXXXXX)"
+echo "🚀 Initializing demo workspace at: $DEMO_DIR"
+
+# 1. Initialize workspace with Everything Gemini
+echo -e "\n📦 Step 1: Initializing developer profile in workspace..."
+everything-gemini init --workspace "$DEMO_DIR"
+
+# 2. Add specific on-demand skills
+echo -e "\n⚡ Step 2: Adding frontier skills to the workspace..."
+everything-gemini add skill agent-evals --workspace "$DEMO_DIR"
+everything-gemini add skill docker-compose-orchestrator --workspace "$DEMO_DIR"
+
+# 3. Add a scoped subagent
+echo -e "\n🤖 Step 3: Adding architect subagent..."
+everything-gemini add agent architect --workspace "$DEMO_DIR"
+
+# 4. Validate skill configuration
+echo -e "\n🔍 Step 4: Validating installed skills..."
+everything-gemini test-skill agent-evals
+
+echo -e "\n✨ Workflow demo completed successfully!"
+echo "Inspect the workspace structure at: $DEMO_DIR"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "everything-gemini",
-  "version": "1.1.1",
+  "version": "1.2.0",
   "description": "Everything Gemini (everything-gemini) - The Ultimate Agent Harness, Multi-Agent Orchestrator & Performance Suite for Gemini & Google Antigravity",
   "main": "bin/everything-gemini",
   "bin": {

package/skills/agent-evals/SKILL.md

@@ -0,0 +1,61 @@
+---
+name: agent-evals
+description: Designs, executes, and benchmarks AI agent evaluation pipelines, LLM-as-a-judge scoring rubrics, golden test datasets, and prompt regression testing harnesses.
+---
+
+# Agent Evals & LLM Benchmark Playbook
+
+This skill guides the creation of automated evaluation harnesses, LLM-as-a-judge scoring pipelines, and regression testing suites for AI agents and LLM applications.
+
+---
+
+## 1. Core Principles
+
+1. **Deterministic Assertions First**:
+   - Prefer deterministic, unit-testable assertions (schema validation, regex matching, exit codes, latency limits) before falling back to subjective LLM judges.
+2. **Golden Datasets with Ground Truth**:
+   - Maintain versioned golden evaluation datasets (`evals/golden.jsonl`) pairing input prompts with expected outputs or behavioral criteria.
+3. **Regression Containment**:
+   - Any prompt revision or model switch must run against the baseline eval suite to measure accuracy deltas, token consumption, and latency shifts.
+
+---
+
+## 2. Evaluation Dimensions
+
+When assessing agent output quality, evaluate across four standardized vectors:
+
+| Dimension | Metric | Measurement Method |
+| :--- | :--- | :--- |
+| **Accuracy / Correctness** | Factual precision, task fulfillment | LLM-as-a-judge with binary pass/fail rubric |
+| **Safety & Alignment** | Injection vulnerability, secret leakage | Automated static analysis & safety classifiers |
+| **Schema Compliance** | Valid JSON, Pydantic type conformance | Deterministic parser validation (`json.loads`, Pydantic) |
+| **Context Economics** | Token count, time-to-first-token (TTFT) | Profiler logs & Gemini metadata tokens |
+
+---
+
+## 3. LLM-as-a-Judge Scoring Template
+
+When using Gemini as an automated evaluator, structure the prompt with strict zero-shot rubrics and JSON output:
+
+```python
+EVAL_SYSTEM_PROMPT = """You are an impartial, expert evaluation judge. 
+Assess the candidate agent response against the provided Reference Criteria.
+Provide a structured JSON evaluation adhering to the schema:
+{
+  "score": <float 0.0 to 1.0>,
+  "reasoning": "<concise explanation of strengths and shortcomings>",
+  "violations": ["<list of any missed constraints>"]
+}
+Only output valid JSON.
+"""
+```
+
+---
+
+## 4. Eval Runner Execution Flow
+
+1. **Load Test Suite**: Ingest test cases from `evals/test_cases.jsonl`.
+2. **Execute Candidate Prompt**: Query the model with temperature=0.0 for reproducible benchmarking.
+3. **Run Deterministic Checks**: Validate JSON schema, required keys, and formatting constraints.
+4. **Run LLM Judge**: Pass model output + reference criteria to the evaluator.
+5. **Aggregate Metrics**: Calculate overall pass rate, p95 latency, and token cost per run.

package/skills/docker-compose-orchestrator/SKILL.md

@@ -0,0 +1,85 @@
+---
+name: docker-compose-orchestrator
+description: Architects, configures, and troubleshoots multi-container Docker Compose environments, database services (Postgres, pgvector, Redis), healthchecks, and local dev networking.
+---
+
+# Docker Compose Multi-Service Orchestrator
+
+This skill guides the design, hardening, and troubleshooting of multi-container local and staging environments using Docker Compose v2.
+
+---
+
+## 1. Core Principles
+
+1. **Deterministic Healthchecks**:
+   - Always define explicit `healthcheck` blocks for stateful services (databases, caches, message brokers).
+   - Use `depends_on: { condition: service_healthy }` to prevent app containers from starting before databases are ready.
+2. **Persistent Named Volumes**:
+   - Store persistent data (e.g., PostgreSQL data, Redis dumps, uploaded media) in named volumes, never in ephemeral container layers.
+3. **Environment Isolation**:
+   - Use `.env.example` templates with sensible local defaults; never hardcode production secrets in compose files.
+
+---
+
+## 2. Production-Grade Compose Blueprint
+
+Example architecture pairing an application server with PostgreSQL (pgvector enabled) and Redis caching:
+
+```yaml
+version: '3.8'
+
+services:
+  db:
+    image: pgvector/pgvector:pg16
+    container_name: app_db
+    environment:
+      POSTGRES_USER: ${POSTGRES_USER:-postgres}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-postgres}
+      POSTGRES_DB: ${POSTGRES_DB:-app_dev}
+    ports:
+      - "5432:5432"
+    volumes:
+      - pgdata:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U postgres"]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+    networks:
+      - app-net
+
+  redis:
+    image: redis:7-alpine
+    container_name: app_redis
+    ports:
+      - "6379:6379"
+    volumes:
+      - redisdata:/data
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 5s
+      timeout: 3s
+      retries: 5
+    networks:
+      - app-net
+
+volumes:
+  pgdata:
+  redisdata:
+
+networks:
+  app-net:
+    driver: bridge
+```
+
+---
+
+## 3. Common Operations & Diagnostics
+
+| Command | Action |
+| :--- | :--- |
+| `docker compose up -d` | Start all services in the background |
+| `docker compose ps` | Inspect service health and exposed ports |
+| `docker compose logs -f <service>` | Stream logs for a specific container |
+| `docker compose down -v` | Tear down containers and wipe persistent volumes |
+| `docker compose exec <service> sh` | Open an interactive shell inside a container |

package/skills/graphql-architect/SKILL.md

@@ -0,0 +1,78 @@
+---
+name: graphql-architect
+description: Designs, specifies, and implements production GraphQL APIs, DataLoader N+1 query batching, Relay-style cursor pagination, and schema federation.
+---
+
+# GraphQL Architecture & API Craftsmanship
+
+This skill guides the design, schema modeling, query optimization, and implementation of production-grade GraphQL APIs.
+
+---
+
+## 1. Core Principles
+
+1. **Schema-First Design**:
+   - Model client domain requirements into a declarative Schema Definition Language (SDL) before implementing resolvers.
+2. **Defeat the N+1 Problem**:
+   - Never query database tables inside nested resolvers without a batching mechanism (e.g., `DataLoader`).
+3. **Cursor-Based Pagination**:
+   - For real-time or dynamic lists, implement Relay-compliant cursor pagination (`Connection`, `Edge`, `PageInfo`) rather than offset/limit pagination.
+
+---
+
+## 2. Relay-Compliant Cursor Pagination Pattern
+
+```graphql
+type PageInfo {
+  hasNextPage: Boolean!
+  hasPreviousPage: Boolean!
+  startCursor: String
+  endCursor: String
+}
+
+type UserEdge {
+  cursor: String!
+  node: User!
+}
+
+type UserConnection {
+  edges: [UserEdge!]!
+  pageInfo: PageInfo!
+  totalCount: Int!
+}
+
+type Query {
+  users(first: Int, after: String): UserConnection!
+}
+```
+
+---
+
+## 3. DataLoader Batching Blueprint
+
+Prevent database query fan-out by batching IDs into a single SQL `IN` query per event loop tick:
+
+```typescript
+import DataLoader from 'dataloader';
+
+// Batch function loading users by array of IDs
+const batchUsers = async (userIds: readonly string[]): Promise<(User | Error)[]> => {
+  const users = await db.user.findMany({
+    where: { id: { in: [...userIds] } },
+  });
+  
+  // Map results back to exact input order
+  const userMap = new Map(users.map(u => [u.id, u]));
+  return userIds.map(id => userMap.get(id) || new Error(`User ${id} not found`));
+};
+
+export const createUserDataLoader = () => new DataLoader(batchUsers);
+```
+
+---
+
+## 4. Query Complexity & Depth Limiting
+
+To prevent Denial-of-Service attacks through cyclic or deeply nested queries:
+- Enforce maximum query depth (e.g., max 6 levels).
+- Assign cost multipliers to nested connections to reject queries exceeding complexity thresholds.