everything-gemini 1.1.1 → 1.8.0

package/README.md

@@ -7,6 +7,8 @@
 [![Live Showcase](https://img.shields.io/badge/Live_Showcase-Visit_Catalog-00e5ff.svg)](https://salmandev.github.io/everything-gemini/)
 [![npm version](https://img.shields.io/npm/v/everything-gemini.svg?color=cb3837)](https://www.npmjs.com/package/everything-gemini)
 [![CI](https://github.com/salmandev/everything-gemini/actions/workflows/ci.yml/badge.svg)](https://github.com/salmandev/everything-gemini/actions/workflows/ci.yml)
+[![OS Matrix](https://img.shields.io/badge/Platform-Linux%20%7C%20macOS%20%7C%20Windows-blue.svg)](https://github.com/salmandev/everything-gemini/actions/workflows/ci.yml)
+[![GitHub Action](https://img.shields.io/badge/GitHub_Action-everything--gemini-2088FF?logo=githubactions&logoColor=white)](https://github.com/salmandev/everything-gemini)
 [![License](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](LICENSE)
 [![Antigravity](https://img.shields.io/badge/Google-Antigravity-4285F4.svg)](https://antigravity.google)
 [![Status](https://img.shields.io/badge/status-active-success.svg)](https://github.com/salmandev/everything-gemini)
@@ -35,7 +37,7 @@ Out of the box, Antigravity is a formidable pair programmer. But without structu
 2. 🧠 **Progressive Disclosure Skills (`skills/`)**: On-demand procedural playbooks that load *only* when needed, saving up to **85% in token overhead**.
 3. 📏 **Hierarchical Rules (`GEMINI.md` / `AGENTS.md`)**: Context-aware coding standards, zero-hallucination protocols, and clean-architecture rules.
 4. 🔌 **Plug-and-Play Plugins (`plugins/`)**: Domain bundles for Fullstack Web, Python AI, DevOps, and Security.
-5. 🌐 **Curated MCP Servers (`mcp/`)**: Pre-configured connections for GitHub, PostgreSQL, SQLite, and Documentation scrapers.
+5. 🌐 **Curated MCP Servers (`mcp/`)**: Production blueprints for Persistent Semantic Memory (`@modelcontextprotocol/server-memory`), High-Performance Cache (`@modelcontextprotocol/server-redis`), Container Engine (`@modelcontextprotocol/server-docker`), Real-Time OLAP (`@modelcontextprotocol/server-clickhouse`), Web Fetch (`server-fetch`), GitHub, PostgreSQL, and SQLite.
 6. 🤖 **Subagent & Browser Automation**: Specialized recipes for autonomous browser subagents with automated WebP recording.
 
 ---
@@ -77,8 +79,20 @@ cd everything-gemini
 | Profile | Target Audience | What Gets Installed |
 | :--- | :--- | :--- |
 | **`core`** | Minimalists & Speed | Safety-shield hook, TDD skill, repo-onboarding skill, baseline `GEMINI.md`. |
-| **`developer`** *(Recommended)* | Daily Software Engineers | Core + Fullstack Web plugin, Python AI plugin, Git Craftsman, Auto-formatter hook, Stop verifier hook. |
-| **`full`** | Lead Engineers & Archs | Everything: all plugins, full skills catalog, all lifecycle hooks, pre-tested MCP configs, and templates. |
+| **`developer`** *(Recommended)* | Daily Software Engineers | Core + 11 Scoped Subagents (`agents/`), Frontier Skills (Multimodal vision, 2M context caching, Subagent handoff, Security audit), Fullstack & Python AI plugins, Auto-formatter & Goal-verifier hooks. |
+| **`full`** | Lead Engineers & Archs | Everything: all 52 progressive skills, 11 scoped subagents, full lifecycle hooks suite (7 hooks), all plugins, MCP configs, and templates. |
+
+### 5. In CI / GitHub Actions Workflows
+
+Automate Everything Gemini skill, subagent, and lifecycle safety hook provisioning directly in your CI pipelines using our official composite action:
+
+```yaml
+- name: Setup Everything Gemini
+  uses: salmandev/everything-gemini@v1
+  with:
+    profile: developer # core | developer | full
+    global: false      # true for ~/.gemini/config/, false for active workspace .agents/
+```
 
 ---
 
@@ -130,7 +144,7 @@ flowchart TB
 | **Context Window & Caching** | 200k tokens, ephemeral | **1M-2M+ tokens with Native Prefix Context Caching (~75% cost savings)** |
 | **Memory System** | Flat markdown files | **Knowledge Items (KI)** + **Adaptive Learned Instincts** |
 | **UI & Visual Multimodality** | Standard text output | **Native `browser_subagent` + WebP Screen Video Recording + Vision** |
-| **Subagents Fleet** | Manual sub-prompts | **6 Scoped Subagents (`agents/`) with Formal Handoff Protocol** |
+| **Subagents Fleet** | Manual sub-prompts | **10 Scoped Subagents (`agents/`) with Formal Handoff Protocol** |
 | **Lifecycle Hooks** | Shell scripts | Typed protojson contracts (`PreToolUse`, `PostToolUse`, `PreInvocation`, `PostInvocation`, `Stop`) |
 | **Tool Integration** | Claude tool use | **MCP standard (Stdio & SSE)** with auto-discovery & namespacing |
 
@@ -142,10 +156,10 @@ flowchart TB
 everything-gemini/
 ├── .github/                      # CI/CD workflows & issue templates
 ├── bin/                          # Zero-dependency harness & scaffolding CLI
-├── agents/                       # Scoped subagent fleet (Planner, Reviewer, Architect, etc.)
+├── agents/                       # Scoped subagent fleet (Planner, Reviewer, Release Engineer, etc.)
 ├── scripts/                      # Automated installers and harness validators
 ├── plugins/                      # Reusable modular plugins (web-fullstack, python-ai, security)
-├── skills/                       # 27 Progressive disclosure skills (25 core + 2 plugins)
+├── skills/                       # 48 Progressive disclosure skills (46 core + 2 plugins)
 ├── rules/                        # Contextual guidelines & standards
 ├── hooks/                        # Event-driven lifecycle hooks (GeminiShield, Auto-lint)
 ├── mcp/                          # Production-ready MCP server blueprints
@@ -169,23 +183,53 @@ Everything Gemini provides specialized subagent specifications designed for Anti
 | **[`browser-qa`](agents/browser-qa.md)** | Automated Visual QA | Native browser testing with automated WebP recording into artifacts. |
 | **[`security-auditor`](agents/security-auditor.md)** | Security Auditor | Credential scanning, OWASP Top 10, dependency audit, permission gates. |
 | **[`architect`](agents/architect.md)** | Systems Architect | C4 Mermaid blueprints, sequence diagrams, and formal ADR records. |
+| **[`database-migrator`](agents/database-migrator.md)** | Database Schema Specialist | Zero-downtime expand/contract SQL migrations, lock analysis, and rollbacks. |
+| **[`performance-tuner`](agents/performance-tuner.md)** | Latency & Profiling Expert | CPU/memory flamegraphs, database execution plans, and N+1 waterfalls. |
+| **[`documentation-writer`](agents/documentation-writer.md)** | Technical Documentation Specialist | API specifications, ADR governance, changelogs, and clickable file:// link fidelity. |
+| **[`release-engineer`](agents/release-engineer.md)** | Release Automation Gatekeeper | Semantic Versioning, build artifact checksums, git release tagging, and canary rollouts. |
+| **[`incident-responder`](agents/incident-responder.md)** | SRE & Incident Commander | Alert triage, OTel trace correlation, blast radius containment, blameless postmortems. |
 
 ### 1. Skills (`skills/`)
 Skills in Antigravity are lazy-loaded runbooks. Only their YAML frontmatter (`name` and `description`) is placed into the system prompt. The model only reads the full procedure when the user's prompt triggers the requirement.
 
+- **[`vllm-inference`](skills/vllm-inference/SKILL.md)**: High-throughput LLM serving, PagedAttention KV cache, continuous batching, and tensor parallelism.
+- **[`debezium-cdc`](skills/debezium-cdc/SKILL.md)**: Change Data Capture (CDC) streaming, PostgreSQL logical decoding, Kafka Connect, and outbox patterns.
+- **[`cilium-ebpf-networking`](skills/cilium-ebpf-networking/SKILL.md)**: Cloud-native eBPF networking, transparent mTLS, L7 CiliumNetworkPolicies, and Hubble observability.
+- **[`litellm-proxy-gateway`](skills/litellm-proxy-gateway/SKILL.md)**: Enterprise LLM proxy gateway, multi-provider routing (Gemini, Claude, OpenAI), budget controls, and fallback cascades.
+- **[`langgraph-orchestrator`](skills/langgraph-orchestrator/SKILL.md)**: Stateful multi-agent graphs, cyclic execution loops, persistent checkpointers, and human-in-the-loop pauses.
+- **[`playwright-visual-regression`](skills/playwright-visual-regression/SKILL.md)**: Automated visual regression testing, pixelmatch snapshot diffing, cross-browser viewports, and containerized stability.
+- **[`open-telemetry-tracing`](skills/open-telemetry-tracing/SKILL.md)**: Distributed tracing, OTLP exporters, W3C traceparent context propagation, and metric correlation.
+- **[`argo-workflows`](skills/argo-workflows/SKILL.md)**: Kubernetes-native DAG workflows, artifact passing, container steps, retry strategies, and CronWorkflows.
 - **[`gemini-multimodal`](skills/gemini-multimodal/SKILL.md)**: Native visual reasoning over mockups, diagrams, and automated WebP browser recordings.
 - **[`context-caching`](skills/context-caching/SKILL.md)**: 1M-2M token context optimization, static prefix caching, and repository indexing.
 - **[`gemini-grounding`](skills/gemini-grounding/SKILL.md)**: Real-time Google Search grounding, live documentation retrieval, and fact-checking.
 - **[`rag-architect`](skills/rag-architect/SKILL.md)**: RAG pipeline design, AST semantic chunking, hybrid vector-keyword retrieval, and Gemini re-ranking.
 - **[`gemini-function-calling`](skills/gemini-function-calling/SKILL.md)**: Production function declarations, structured JSON output schemas (Pydantic), and parallel tool dispatch.
 - **[`ai-first-engineering`](skills/ai-first-engineering/SKILL.md)**: Requirement decomposition, executable acceptance criteria (BDD), and blast-radius containment.
+- **[`agent-evals`](skills/agent-evals/SKILL.md)**: Automated evaluation pipelines, LLM-as-a-judge scoring, golden test datasets, and prompt regression testing.
 - **[`github-ops`](skills/github-ops/SKILL.md)**: GitHub workflow automation, PR generation, code review triage, and semantic releases with `gh` CLI & GitHub MCP.
 - **[`subagent-handoff`](skills/subagent-handoff/SKILL.md)**: Multi-agent task delegation protocol, scoped contexts, and report synthesis.
 - **[`api-craftsman`](skills/api-craftsman/SKILL.md)**: REST, OpenAPI 3.1 specifications, gRPC protos, and RFC 7807 error envelopes.
 - **[`database-architect`](skills/database-architect/SKILL.md)**: Zero-downtime migrations, concurrent indexing, and ACID schema modeling.
+- **[`turborepo-monorepo`](skills/turborepo-monorepo/SKILL.md)**: High-performance monorepo build caching, task pipelines, package boundaries, and Docker pruning.
+- **[`dbt-transformation`](skills/dbt-transformation/SKILL.md)**: Modular SQL transformations, Jinja macros, semantic layer models, schema tests, and docs.
+- **[`apache-kafka-streams`](skills/apache-kafka-streams/SKILL.md)**: Exactly-once event streaming, stateful window aggregations, consumer group rebalancing, and Schema Registry.
+- **[`grpc-connect-rpc`](skills/grpc-connect-rpc/SKILL.md)**: Lightweight, browser-compatible gRPC and Protocol Buffers with Connect-ES / Connect-Go and HTTP/2-3 streaming.
+- **[`duckdb-local-olap`](skills/duckdb-local-olap/SKILL.md)**: Embedded in-process SQL analytics, direct S3/Parquet querying, and zero-copy Arrow integration.
+- **[`nats-jetstream`](skills/nats-jetstream/SKILL.md)**: Ultra-low latency event streaming, message deduplication, durable consumer groups, and KV buckets.
+- **[`axum-web-service`](skills/axum-web-service/SKILL.md)**: Production Rust web APIs using Axum, Tokio async runtime, Tower middlewares, and SQLx connection pools.
+- **[`clickhouse-analytics`](skills/clickhouse-analytics/SKILL.md)**: High-throughput OLAP schemas, MergeTree engines, Kafka ingestion, and vector search.
+- **[`temporal-workflows`](skills/temporal-workflows/SKILL.md)**: Resilient distributed workflows, retry policies, async activities, and saga compensations.
+- **[`trpc-react-query`](skills/trpc-react-query/SKILL.md)**: End-to-end type safety, tRPC v11 routers, and TanStack React Query v5 optimistic UI.
+- **[`wasm-rust-optimizer`](skills/wasm-rust-optimizer/SKILL.md)**: High-throughput WebAssembly modules compiled from Rust with zero-copy memory buffers.
+- **[`fastapi-production`](skills/fastapi-production/SKILL.md)**: Production async FastAPI architecture, Pydantic v2 schemas, lifespan handlers, and health probes.
+- **[`redis-cache-patterns`](skills/redis-cache-patterns/SKILL.md)**: Enterprise Redis caching strategies, distributed locking with atomic Lua, and sliding-window rate limiting.
+- **[`svelte-kit-architect`](skills/svelte-kit-architect/SKILL.md)**: Modern SvelteKit apps with Svelte 5 runes ($state, $derived, $effect), SSR/prerender, and form actions.
 - **[`fullstack-nextjs`](skills/fullstack-nextjs/SKILL.md)**: Next.js App Router, React Server Components (RSC), hydration error diagnosis, and Server Actions.
+- **[`graphql-architect`](skills/graphql-architect/SKILL.md)**: Schema-first GraphQL APIs, DataLoader N+1 query batching, and Relay cursor pagination.
 - **[`supabase-architect`](skills/supabase-architect/SKILL.md)**: Row Level Security (RLS) policies, pgvector embeddings, and edge function workflows.
 - **[`cloudflare-workers`](skills/cloudflare-workers/SKILL.md)**: Serverless edge functions, Wrangler v3, D1 SQL, and KV low-latency storage.
+- **[`docker-compose-orchestrator`](skills/docker-compose-orchestrator/SKILL.md)**: Multi-container local environments (Postgres + pgvector, Redis) with healthchecks.
 - **[`kubernetes-operator`](skills/kubernetes-operator/SKILL.md)**: Production k8s manifests, HPA autoscaling, zero-downtime rolling updates, and health probes.
 - **[`stripe-integration`](skills/stripe-integration/SKILL.md)**: Webhook signature verification, idempotent payments, and customer portal session flows.
 - **[`devops-pipeline`](skills/devops-pipeline/SKILL.md)**: Multi-stage Dockerfiles and caching GitHub Actions CI/CD workflows.
@@ -198,21 +242,29 @@ Skills in Antigravity are lazy-loaded runbooks. Only their YAML frontmatter (`na
 - **[`security-audit`](skills/security-audit/SKILL.md)**: Scans for credentials in commit history and audits dependency risks.
 - **[`performance-profiler`](skills/performance-profiler/SKILL.md)**: Identifies CPU/memory bottlenecks, analyzes database queries, and critical paths.
 - **[`continuous-learning`](skills/continuous-learning/SKILL.md)**: Codifies corrections and developer feedback into enduring Knowledge Items.
+- **[`antigravity-sdk-orchestrator`](plugins/python-ai/skills/antigravity-sdk-orchestrator/SKILL.md)**: Programmatic multi-agent pipelines with the official `google-antigravity` Python SDK and token streaming.
+- **[`responsive-design`](plugins/web-fullstack/skills/responsive-design/SKILL.md)**: Fluid typography, mobile-first flex/grid layouts, media queries, and cross-browser accessibility.
 
 ### 2. Lifecycle Hooks (`hooks/`)
 Hooks run shell scripts at critical lifecycle events with typed JSON contracts on `stdin`/`stdout`:
 
-- **Safety Shield (`PreToolUse`)**: Intercepts `run_command` and inspects `CommandLine`. Instantly denies catastrophic commands like `rm -rf /`, `mkfs`, or `git push --force origin main`.
-- **Auto Lint Formatter (`PostToolUse`)**: Triggered after file modifications. Runs your project's linter/formatter (`prettier`, `black`, `ruff`, `gofmt`) automatically so code is always clean.
-- **Goal Verifier (`Stop`)**: Intercepts the agent's attempt to finish. If test suites are failing or background tasks are unfinished, it returns `{"decision": "continue", "reason": "Tests are still failing. Fix them before stopping."}`.
-- **Ephemeral Context Injector (`PreInvocation`)**: Injects transient warnings or guidelines before each model reasoning step without cluttering persistent conversation history.
+- **[`gemini-shield`](hooks/gemini-shield/hooks.json) (`PreToolUse`)**: Deterministic safety firewall intercepting `run_command` and denying catastrophic operations like `rm -rf /`, `mkfs`, or `git push --force origin main`.
+- **[`safety-shield`](hooks/safety-shield/hooks.json) (`PreToolUse`)**: Intercepts `run_command` and inspects `CommandLine` against strict security guidelines before shell execution.
+- **[`secret-scrubber`](hooks/secret-scrubber/hooks.json) (`PreToolUse`)**: Intercepts file write operations to block hardcoded API keys and private credentials before they reach disk.
+- **[`auto-lint-formatter`](hooks/auto-lint-formatter/hooks.json) (`PostToolUse`)**: Triggered after file modifications. Runs your project's linter/formatter (`prettier`, `black`, `ruff`, `gofmt`) automatically so code is always clean.
+- **[`goal-verifier`](hooks/goal-verifier/hooks.json) (`Stop`)**: Intercepts the agent's attempt to finish. If test suites are failing or background tasks are unfinished, it returns `{"decision": "continue", "reason": "Tests are still failing. Fix them before stopping."}`.
+- **[`ephemeral-context`](hooks/ephemeral-context/hooks.json) (`PreInvocation`)**: Injects transient warnings or guidelines before each model reasoning step without cluttering persistent conversation history.
+- **[`learned-instincts`](hooks/learned-instincts/hooks.json)**: Session learning hook that records developer corrections and feedback into persistent instincts.
 
 ### 3. Rules Hierarchy (`rules/`)
 Antigravity automatically discovers rules by walking up from the current file's directory to the repository root:
-- **`rules/common/GEMINI.md`**: Foundational instructions for precision, minimal changes, and strict verification.
-- **`rules/languages/typescript.md`**: Strict TypeScript, Zod validations, no `any`, modern ESM.
-- **`rules/languages/python.md`**: Python 3.12+, type hints, Pydantic v2, Ruff formatting.
-- **`rules/paradigms/security-hardened.md`**: Defense-in-depth, zero-trust file access, credential hygiene.
+- **[`rules/common/GEMINI.md`](rules/common/GEMINI.md)**: Foundational instructions for precision, minimal changes, and strict verification.
+- **[`rules/common/AGENTS.md`](rules/common/AGENTS.md)**: Multi-agent interaction protocols, dogfooding guidelines, and progressive disclosure discipline.
+- **[`rules/languages/typescript.md`](rules/languages/typescript.md)**: Strict TypeScript, Zod validations, no `any`, modern ESM.
+- **[`rules/languages/python.md`](rules/languages/python.md)**: Python 3.12+, type hints, Pydantic v2, Ruff formatting.
+- **[`rules/languages/golang.md`](rules/languages/golang.md)**: Idiomatic Go guidelines, table-driven unit tests, and structured logging.
+- **[`rules/paradigms/security-hardened.md`](rules/paradigms/security-hardened.md)**: Defense-in-depth, zero-trust file access, credential hygiene.
+- **[`rules/paradigms/tdd.md`](rules/paradigms/tdd.md)**: Enforces strict Red-Green-Refactor test cycle before writing production code.
 
 ---
 
@@ -263,14 +315,19 @@ Traditional agent harnesses dump dozens of prompt files into the system prompt o
 
 ```
 [Traditional Setup]
-System Prompt: Base Instructions + All 25 Skills (Full Text) + All Rules = ~45,000 Tokens / turn
+System Prompt: Base Instructions + All 30 Skills (Full Text) + All Rules = ~48,000 Tokens / turn
 
 [Everything Gemini on Antigravity]
-System Prompt: Base Instructions + 25 Skill Summaries (YAML) + Directory Rules = ~3,200 Tokens / turn
+System Prompt: Base Instructions + 30 Skill Summaries (YAML) + Directory Rules = ~3,400 Tokens / turn
 Skill Body: Loaded on-demand ONLY when invoked = ~1,500 Tokens (one-time)
 Savings: > 85% Token Reduction & 3x Faster First-Token Latency!
 ```
 
+Run the built-in diagnostic benchmark across all 70 ecosystem components:
+```bash
+./bin/everything-gemini test-all
+```
+
 ---
 
 ## 🛠️ Usage & CLI Reference
@@ -281,6 +338,37 @@ The zero-dependency `everything-gemini` CLI manages your configurations effortle
 # Verify your installation and check for conflicts
 ./bin/everything-gemini doctor
 
+# Inspect active workspace status dashboard (installed skills, subagents, hooks)
+./bin/everything-gemini status
+./bin/everything-gemini status --global
+./bin/everything-gemini status --json
+
+# Compare installed workspace components against master catalog
+./bin/everything-gemini diff
+
+# Export installed configuration bundle into a portable JSON profile
+./bin/everything-gemini export
+./bin/everything-gemini export --output my-profile.json
+
+# Import portable configuration bundle into workspace
+./bin/everything-gemini import my-profile.json
+./bin/everything-gemini import my-profile.json --dry-run
+./bin/everything-gemini import my-profile.json --workspace ./my-project
+
+# Package offline distribution bundle for air-gapped environments or CI/CD
+./bin/everything-gemini bundle
+./bin/everything-gemini bundle --output ./offline-bundle
+./bin/everything-gemini bundle --dry-run
+./bin/everything-gemini bundle --json
+
+# Update installed ecosystem components in-place to latest catalog versions
+./bin/everything-gemini update
+./bin/everything-gemini update --global
+./bin/everything-gemini update --dry-run
+
+# Preview an installation without modifying disk
+./bin/everything-gemini install --profile developer --dry-run
+
 # Install a specific profile into the current workspace (.agents/)
 ./bin/everything-gemini install --profile developer
 
@@ -299,11 +387,29 @@ The zero-dependency `everything-gemini` CLI manages your configurations effortle
 # Remove a skill from your active workspace
 ./bin/everything-gemini remove skill tdd-workflow
 
+# Add or remove lifecycle safety hooks
+./bin/everything-gemini add hook safety-shield
+./bin/everything-gemini remove hook safety-shield
+
 # Add a specific plugin
 ./bin/everything-gemini add plugin web-fullstack
 
-# Test and validate a specific skill's frontmatter and scripts
-./bin/everything-gemini test-skill gemini-multimodal
+# Search components across skills, subagents, hooks, and MCP blueprints
+./bin/everything-gemini search kafka
+./bin/everything-gemini search dbt --json
+
+# Run comprehensive ecosystem audit across frontmatter, contracts, hooks, and links
+./bin/everything-gemini audit
+./bin/everything-gemini audit --json
+
+# Benchmark and validate all 52 skills, 11 subagents, and 7 hooks (human or JSON)
+./bin/everything-gemini test-all
+./bin/everything-gemini benchmark --json
+
+# View detailed playbook or specification for any skill, subagent, or hook
+./bin/everything-gemini info agent-evals
+./bin/everything-gemini info planner
+./bin/everything-gemini info gemini-shield
 
 # Scaffold a new progressive-disclosure skill
 ./bin/everything-gemini new-skill my-custom-skill
@@ -311,6 +417,14 @@ The zero-dependency `everything-gemini` CLI manages your configurations effortle
 # Scaffold a new scoped subagent
 ./bin/everything-gemini new-agent my-worker-agent
 
+# Generate shell autocompletion script (bash/zsh)
+./bin/everything-gemini completion >> ~/.zshrc
+
+# Or automatically install autocompletion idempotently into your active shell rc
+./bin/everything-gemini completion --install
+./bin/everything-gemini completion --install --dry-run
+./bin/everything-gemini completion --install --rc ~/.bashrc
+
 # Validate all schemas, hooks, and frontmatter
 ./bin/everything-gemini validate
 ```
@@ -321,10 +435,17 @@ The zero-dependency `everything-gemini` CLI manages your configurations effortle
 
 We welcome community contributions! You can contribute new **Skills**, **Rules**, **Lifecycle Hooks**, **MCP Blueprints**, or **Plugins**.
 
+Check out our [Community Wishlist & Good First Issues](CONTRIBUTING.md#community-wishlist--good-first-issues) for high-impact skills ready to be built.
 See [CONTRIBUTING.md](CONTRIBUTING.md) for full development guidelines, YAML frontmatter standards, and validation procedures.
 
 ---
 
+## 🌟 Star History
+
+[![Star History Chart](https://api.star-history.com/svg?repos=salmandev/everything-gemini&type=Date)](https://star-history.com/#salmandev/everything-gemini&Date)
+
+---
+
 ## 🙏 Acknowledgements & Inspiration
 
 * Inspired by [Affan Mustafa's Everything Claude Code (ECC)](https://github.com/affaan-m/everything-claude-code), re-engineered from the ground up for Google Antigravity (AGY) and the Gemini frontier ecosystem.

package/SECURITY.md

@@ -0,0 +1,38 @@
+# Security Policy
+
+## Supported Versions
+
+We actively provide security patches and dependency updates for the following versions:
+
+| Version | Supported          |
+| :---    | :---               |
+| 1.x     | :white_check_mark: |
+| < 1.0   | :x:                |
+
+---
+
+## Reporting a Vulnerability
+
+The Everything Gemini team takes the security of agent systems, lifecycle hooks, and model interactions seriously.
+
+If you discover a security vulnerability, prompt injection bypass in safety gates, or credential exposure vector:
+
+1. **Do NOT open a public GitHub issue.**
+2. Report the vulnerability privately via **GitHub Security Advisories** on the repository:
+   - Go to [https://github.com/salmandev/everything-gemini/security/advisories](https://github.com/salmandev/everything-gemini/security/advisories)
+   - Click **"Report a vulnerability"**
+3. Alternatively, email the maintainer directly at `salman@salmandev.com` with the subject:
+   `[SECURITY] Everything Gemini Vulnerability Report`.
+
+Please include:
+- A clear description of the vulnerability and attack vector.
+- Minimal reproduction steps, sample prompts, or script commands.
+- Potential impact on agent runtimes or host filesystem integrity.
+
+---
+
+## Response Timeline
+
+- **Initial Acknowledgment**: Within 48 hours of receipt.
+- **Triage & Assessment**: Within 5 business days.
+- **Remediation & Patch**: Published as an expedited patch release (`v1.x.y`).

package/action.yml

@@ -0,0 +1,35 @@
+name: 'Setup Everything Gemini Harness'
+description: 'Install Everything Gemini skills, subagents, and lifecycle safety hooks into your repository or CI workspace'
+author: 'Everything Antigravity Contributors'
+branding:
+  icon: 'shield'
+  color: 'blue'
+
+inputs:
+  profile:
+    description: 'Installation profile (core, developer, full)'
+    required: false
+    default: 'developer'
+  global:
+    description: 'Whether to install globally into ~/.gemini/config/ (true/false)'
+    required: false
+    default: 'false'
+  workspace:
+    description: 'Target workspace directory (default: active workspace .agents/)'
+    required: false
+    default: ''
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Run Everything Gemini Installer
+      shell: bash
+      run: |
+        ARGS="install --profile ${{ inputs.profile }}"
+        if [ "${{ inputs.global }}" = "true" ]; then
+          ARGS="$ARGS --global"
+        fi
+        if [ -n "${{ inputs.workspace }}" ]; then
+          ARGS="$ARGS --workspace ${{ inputs.workspace }}"
+        fi
+        node "${{ github.action_path }}/bin/everything-gemini" $ARGS

package/agents/browser-qa.md

@@ -21,6 +21,6 @@ The `browser-qa` subagent is an autonomous visual and interaction test engineer.
 ## Handoff Output Contract
 The subagent MUST return a structured markdown report containing:
 - **Test Summary**: Flow tested (e.g. "User Signup & Onboarding").
-- **Visual Evidence**: Markdown embed linking to the recorded WebP video (`![QA Recording](path/to/recording.webp)`).
+- **Visual Evidence**: Markdown embed linking to the recorded WebP video in artifacts (`![QA Recording](<artifacts-dir>/recording.webp)`).
 - **Console & Network Health**: Any unhandled JavaScript exceptions or 4xx/5xx HTTP calls observed.
 - **Defects Discovered**: Clear reproduction steps for any UI or interaction bugs found.

package/agents/database-migrator.md

@@ -0,0 +1,26 @@
+# Scoped Subagent: Database Migrator (`database-migrator`)
+
+## Role & Mission
+The `database-migrator` subagent is a dedicated database migration and schema evolution specialist. Its mission is to design zero-downtime expand/contract schema changes, generate backward-compatible migration files (SQL, Prisma, Alembic, Drizzle), analyze lock levels, and verify clean rollback paths without data loss.
+
+## Tool Permissions
+- **Permitted**: `view_file`, `grep_search`, `list_dir`, `write_to_file`, `replace_file_content` (scoped strictly to migration files and schema models), safe dry-run commands (e.g. `prisma migrate diff`, `alembic check`).
+- **Forbidden**: Direct production DDL execution, unchecked destructive queries (`DROP TABLE`, `TRUNCATE`, immediate non-null column additions without defaults).
+
+## Database Evolution Protocol
+1. **Schema Inspection**: Read existing migrations and active ORM schema models to detect schema drift.
+2. **Expand-and-Contract Architecture**:
+   - **Phase 1 (Expand)**: Add new columns as nullable or with safe defaults. Add concurrent indexes. Maintain dual-writing compatibility.
+   - **Phase 2 (Migrate Data)**: Backfill data asynchronously in batches without holding table locks.
+   - **Phase 3 (Contract)**: Switch application reads to new schema and safely deprecate old columns only after all active application versions no longer reference them.
+3. **Lock Contention Audit**:
+   - In PostgreSQL, ensure indexes use `CREATE INDEX CONCURRENTLY`.
+   - Set conservative lock timeouts (`SET lock_timeout = '2s';`).
+4. **Bidirectional Safety**: Verify that every forward migration has a matching, deterministic `down` rollback script.
+
+## Handoff Output Contract
+The subagent MUST return a structured markdown report containing:
+- **Schema Diff Summary**: Added, modified, or deprecated tables and columns.
+- **Migration Scripts**: Idempotent SQL/ORM migration definitions (Up & Down).
+- **Locking & Concurrency Analysis**: Expected lock type (`ACCESS SHARE`, `SHARE UPDATE EXCLUSIVE`, etc.) and estimated impact on running transactions.
+- **Rollback & Verification Plan**: Step-by-step verification commands to prove backward compatibility.

package/agents/documentation-writer.md

@@ -0,0 +1,27 @@
+# Scoped Subagent: Documentation Writer (`documentation-writer`)
+
+## Role & Mission
+The `documentation-writer` subagent is a specialized developer documentation and architectural record author. Its mission is to craft crystal-clear, developer-facing technical documentation, API specifications, Architecture Decision Records (ADRs), changelogs, and READMEs, while strictly enforcing progressive disclosure and maintaining 100% clickable `file://` markdown link fidelity.
+
+## Tool Permissions
+- **Permitted**: `view_file`, `grep_search`, `list_dir`, `write_to_file`, `replace_file_content`, `multi_replace_file_content` (scoped strictly to documentation files: `.md`, `.mdx`, `.txt`, `.rst`, JSDoc/docstrings, and diagrams).
+- **Forbidden**: Modifying application source code logic, running arbitrary terminal commands, deleting code files, or altering configuration outside documentation manifests.
+
+## Technical Documentation Protocol
+1. **Source Code & AST Inspection**: Analyze active exported functions, schemas, API routes, and types before writing documentation. Ensure zero hallucinations.
+2. **Clickable Link Verification**:
+   - Every file reference must use GitHub markdown syntax with full `file://` URLs (e.g. `[src/index.ts](file:///path/to/src/index.ts)`).
+   - Link specific symbols using anchor notation (e.g. `[OrderService](file:///path/to/order.ts#L25-L60)`).
+3. **Progressive Disclosure Principle**:
+   - Keep primary documentation concise, procedural, and focused on high-frequency workflows.
+   - Separate deep reference manuals, protocol specifications, and historical context into modular `references/` or `docs/` files.
+4. **Concrete Runnable Examples**:
+   - Every documented API or CLI command must include copy-pasteable runnable code blocks with expected outputs.
+5. **ADR Standardization**: Document significant architectural shifts with Context, Decision, Consequences, and Alternatives Considered.
+
+## Handoff Output Contract
+The subagent MUST return a structured markdown report containing:
+- **Documentation Changes Summary**: List of created or updated documentation files.
+- **Clickable References Audit**: Confirmation that all generated links resolve to real filesystem paths.
+- **API & Architectural Highlights**: Summary of newly documented endpoints, schemas, or design patterns.
+- **Open Questions / Needs Verification**: Any ambiguous API signatures or undocumented edge cases identified during analysis.

package/agents/incident-responder.md

@@ -0,0 +1,34 @@
+# Scoped Subagent: Incident Responder (`incident-responder`)
+
+## Role & Mission
+The `incident-responder` subagent is a dedicated Site Reliability Engineering (SRE) and production triage specialist. Its mission is to rapidly detect, isolate, and remediate system degradations, correlate distributed traces (OpenTelemetry), inspect error spikes (Sentry), analyze container crashloops, enforce blast radius containment, and generate comprehensive blameless postmortems with actionable preventative measures.
+
+## Tool Permissions
+- **Permitted**: `view_file`, `grep_search`, `list_dir`, `run_command` (scoped strictly to diagnostic inspection: querying logs, inspecting Kubernetes pod health, reviewing traces, checking process memory/CPU, running rollback scripts), `write_to_file`, `replace_file_content` (scoped strictly to postmortem reports, incident runbooks, and emergency feature flag overrides).
+- **Forbidden**: Authoring new core business features during an active incident, modifying production databases without atomic rollback scripts, bypassing security guardrails, or deleting audit logs.
+
+## Incident Lifecycle Protocol
+1. **Severity Classification & Triage (T0)**:
+   - Categorize impact: **SEV-1** (full service outage / data integrity risk), **SEV-2** (critical user flow degraded / partial outage), **SEV-3** (minor defect / non-blocking latency regression).
+   - Establish incident timeline and lock system state against uncoordinated concurrent edits.
+2. **Telemetry & Trace Correlation**:
+   - Trace HTTP/gRPC failure paths through OpenTelemetry spans to isolate the originating microservice.
+   - Correlate exception stack traces in Sentry against recent deployments or database migrations.
+   - Check container metrics (OOMKilled events, CPU throttling, network packet drops via Hubble).
+3. **Blast Radius Containment & Mitigation**:
+   - Prioritize service recovery over root-cause investigation: activate circuit breakers, enable rate limiting, route traffic to fallback models, or trigger immediate canary rollback (`git revert` / deployment rollback).
+   - Verify health probes return 200 OK and error rates normalize below SLO thresholds.
+4. **Root Cause Analysis (RCA)**:
+   - Identify precise trigger conditions (e.g. unindexed database query, memory leak in event loop, upstream third-party timeout).
+   - Formulate minimal reproducible test case.
+5. **Blameless Postmortem & Action Items**:
+   - Document root cause without personal blame.
+   - Define P0/P1 remediation engineering tasks to eliminate recurrence.
+
+## Handoff Output Contract
+The subagent MUST return a structured markdown incident report containing:
+- **Incident Summary & Timeline**: Severity level, time-to-detect (TTD), time-to-mitigate (TTM), and chronological timeline.
+- **Root Cause Analysis (RCA)**: Underlying architectural breakdown, contributing environmental factors, and why existing tests failed to catch it.
+- **Mitigation Applied**: Concrete steps taken to stabilize the production workload.
+- **Blast Radius & User Impact**: Affected percentage of requests, error rate delta, and affected services.
+- **Preventative Action Items**: Specific follow-up tasks categorized by priority (P0 architectural fix, P1 monitoring/alerting improvement, P2 process refinement).

package/agents/performance-tuner.md

@@ -0,0 +1,27 @@
+# Scoped Subagent: Performance Tuner (`performance-tuner`)
+
+## Role & Mission
+The `performance-tuner` subagent is a dedicated systems performance and latency optimization specialist. Its mission is to analyze CPU/memory profiles, diagnose memory leaks, optimize complex database query execution plans (`EXPLAIN ANALYZE`), eliminate N+1 query waterfalls, and tune high-throughput critical paths.
+
+## Tool Permissions
+- **Permitted**: `view_file`, `grep_search`, `list_dir`, `replace_file_content` (surgical performance diffs), `run_command` (benchmarking scripts, profiling runs, node `--prof`, py-spy).
+- **Forbidden**: Non-essential refactoring, rewriting unrelated application logic, disabling safety validations to improve benchmark scores.
+
+## Performance Optimization Protocol
+1. **Empirical Baseline Measurement**: Measure baseline latency (p50, p95, p99), throughput (RPS), and memory consumption before proposing any modifications. Never optimize based on intuition alone.
+2. **Hotspot Diagnosis**:
+   - **Database**: Run `EXPLAIN (ANALYZE, BUFFERS)` to detect Sequential Scans, missing indexes, and Cartesian product joins.
+   - **Application**: Inspect heap dumps or CPU flamegraphs to detect object retention, GC thrashing, and event loop blocks.
+   - **Network/Frontend**: Identify waterfall API calls, uncompressed payloads, and blocking rendering cycles.
+3. **Surgical Remediation**:
+   - Implement query projections, compound indexes, or DataLoader batching.
+   - Introduce cache-aside patterns with appropriate TTL jitter.
+   - Replace linear lookups (`O(N)`) with constant-time hash sets (`O(1)`).
+4. **Post-Optimization Verification**: Re-run the identical benchmark harness under the same load conditions to prove latency reduction.
+
+## Handoff Output Contract
+The subagent MUST return a structured markdown report containing:
+- **Benchmark Comparison Table**: Quantitative metrics (Latency p50/p95/p99, Throughput, Memory) comparing Before vs After.
+- **Root Cause Analysis**: The underlying computational or database bottleneck.
+- **Applied Modifications**: Clickable links to optimized code blocks and indexes.
+- **Continuous Guardrails**: Recommendations for ongoing latency budgets and CI performance tests.

package/agents/release-engineer.md

@@ -0,0 +1,34 @@
+# Scoped Subagent: Release Engineer (`release-engineer`)
+
+## Role & Mission
+The `release-engineer` subagent is a specialized release automation and deployment gatekeeper. Its mission is to enforce strict Semantic Versioning (`semver`), curate comprehensive changelogs, verify production build artifacts, validate CI/CD deployment pipelines, sign git release tags, and execute zero-downtime canary rollouts and automated rollback plans.
+
+## Tool Permissions
+- **Permitted**: `view_file`, `grep_search`, `list_dir`, `run_command` (scoped strictly to release validation: tests, build steps, git tagging, changelog generation, dependency audits), `write_to_file`, `replace_file_content` (scoped strictly to `package.json`, `CHANGELOG.md`, release manifests, and CI/CD workflow configurations).
+- **Forbidden**: Directly modifying core runtime business logic, skipping automated test suites, forcing untagged releases, or modifying database migration scripts without `database-migrator` approval.
+
+## Release Lifecycle Protocol
+1. **Pre-Release Preflight Gate**:
+   - Verify all test suites (`npm test`, unit, E2E, integration) pass with exit code 0.
+   - Run dependency security audit (`npm audit` / vulnerability scanner) to ensure zero high/critical CVEs.
+   - Confirm git working tree is clean and synchronized with upstream.
+2. **Semantic Versioning Assessment (`semver`)**:
+   - Analyze commit history since last release tag using conventional commits (`feat!`, `feat`, `fix`, `perf`).
+   - Categorize delta: Major (breaking API/schema changes), Minor (backward-compatible features), Patch (bug fixes/performance).
+3. **Changelog & Documentation Compilation**:
+   - Update `CHANGELOG.md` following Keep a Changelog standards.
+   - Synchronize release badges, version numbers, and links in `README.md` and manifests.
+4. **Artifact Build & Checksum Verification**:
+   - Compile production bundles; calculate and document SHA-256 integrity checksums.
+   - Verify bundle size budgets and tree-shaking efficacy.
+5. **Release Tagging & Deployment Orchestration**:
+   - Create annotated git tags (`git tag -a vX.Y.Z -m "..."`).
+   - Formulate canary rollout verification and rollback trigger criteria.
+
+## Handoff Output Contract
+The subagent MUST return a structured markdown report containing:
+- **Release Version & Delta**: Target version (e.g. `v1.7.0`), bump category (Major/Minor/Patch), and conventional commit summary.
+- **Preflight Verification Checklist**: Test results, security audit status, and git state.
+- **Artifact Checksums & Metrics**: Output artifact sizes, hash digests, and token/bundle efficiency metrics.
+- **Changelog Preview**: Markdown snippet of the release notes.
+- **Rollout & Rollback Plan**: Deployment sequence, health probe criteria, and instant rollback procedure.