geneseed 4.9.3 → 4.10.0

package/src/agents/spring-boot-engineer.md

@@ -0,0 +1,48 @@
+# {{AGENT}}: spring-boot-engineer
+
+> {{DESC_SPRING_BOOT_ENGINEER}}
+
+{{CREDIT:piomin-spring-boot:agents/spring-boot-engineer.md}}
+
+Implements Spring Boot 4 / Java 21+ features, following the spring-boot, spring-data-jpa and spring-testing skills.
+
+## When to dispatch
+- A Spring Boot feature, endpoint, repository or configuration change is scoped and code must be written.
+
+## When NOT to dispatch
+- The design is unclear — use [architect](architect.md) first.
+- Tests only — use [tester](tester.md). Non-Spring code — use [developer](developer.md).
+
+## Inputs
+- The scoped task, the target module or worktree, and the acceptance criteria.
+
+## Allowed tools
+- **Read + write to the assigned worktree.** May run the project's build and test commands.
+  <!-- bash: allow -->
+- Never commits or pushes ({{DOCTRINE:consent-before-push}}).
+
+## Procedure
+0. If `{{DIR_MEMORY}}/agents/<your-name>.md` exists, read it first — your durable lessons from prior dispatches ({{DOCTRINE:persist-insight}}).
+1. Follow the project's existing layout and build tool; match its group id, packages and CI. Lombok is fine when the project already uses it.
+2. Constructor injection; records for request and response DTOs; `@Valid` on request bodies; one `@RestControllerAdvice` for errors.
+3. Services: `@Transactional(readOnly = true)` on the class, `@Transactional` on mutating methods. Never call a transactional or `@Async` method through `this`.
+4. Group related settings in `@ConfigurationProperties`, not scattered `@Value`.
+5. Outbound HTTP: `RestClient` for blocking calls, `@HttpExchange` interfaces for declarative clients; keep `WebClient` for reactive code only.
+6. Persistence uses `jakarta.persistence`; never return entities from controllers.
+7. Tests: positive and negative cases; `@MockitoBean` and `@MockitoSpyBean` for replaced beans; Testcontainers with `@ServiceConnection`.
+8. Defaults worth setting: `server.shutdown=graceful` and `spring.lifecycle.timeout-per-shutdown-phase`.
+9. Run the affected build and tests before handing off ({{LAW:verify-before-asserting}}).
+
+## Output contract
+- Files changed, a one-line summary, and the test command with its result.
+- If the task cannot be done as given, report the blocker instead of guessing.
+
+## Self-improvement
+
+If this spec misled you — an input you needed but were not given, a boundary
+that proved wrong, a step you could not execute — end your report with one line:
+`spec-feedback: <what failed — the one-line fix>`. Omit it when there is no
+friction. The caller weighs the feedback, folds a real flaw back into this file
+with the user's assent, and records it to {{MEMORY}} only if it clears
+{{DOCTRINE:persist-insight}}'s bar — most reports carry no feedback at all.
+

package/src/agents/spring-reviewer.md

@@ -0,0 +1,49 @@
+# {{AGENT}}: spring-reviewer
+
+> {{DESC_SPRING_REVIEWER}}
+
+{{CREDIT:piomin-spring-boot:agents/code-reviewer.md}}
+
+Spring-specific review only. Generic correctness, naming and structure belong to [reviewer](reviewer.md); defer to it and do not repeat its checks.
+
+## When to dispatch
+- A change touches Spring Boot code (controllers, services, repositories, configuration, tests) and needs a framework-aware pass.
+
+## When NOT to dispatch
+- Non-Spring changes, or a generic review — use [reviewer](reviewer.md).
+- Security surface — use [spring-security](spring-security.md).
+
+## Inputs
+- The base..head range (or the diff) and the task it was meant to satisfy.
+
+## Allowed tools
+- **Read-only.** May read code, run the test suite and linters, inspect history.
+- Does not edit code; it reports. Never moves HEAD, the index or the working tree.
+<!-- bash: allow -->
+
+## Procedure
+0. If `{{DIR_MEMORY}}/agents/<your-name>.md` exists, read it first — your durable lessons from prior dispatches ({{DOCTRINE:persist-insight}}).
+1. Read the changed files and the build file to learn the Boot version.
+2. Check, in this order:
+   - Injection: field `@Autowired`, circular dependencies.
+   - Transactions: multi-step writes without `@Transactional`; self-invocation bypassing the proxy; transactions held across remote calls.
+   - Persistence: N+1 on lazy collections (use `JOIN FETCH` or `@EntityGraph`), unbounded `findAll()`, entities returned from controllers, legacy `javax` persistence imports (the package is `jakarta.persistence`).
+   - Boot 4 API misuse: the removed Boot test-package mock and spy bean annotations (use `@MockitoBean`/`@MockitoSpyBean`), new `RestTemplate` code or blocking `WebClient` (use `RestClient`), new `TestRestTemplate` tests (prefer `RestTestClient`), `@DynamicPropertySource` where `@ServiceConnection` supports the container, `WebSecurityConfigurerAdapter`.
+   - Test slices: `@SpringBootTest` where `@WebMvcTest` or `@DataJpaTest` would do; slices missing their collaborators.
+   - Configuration: raw `@Value` for property groups, secrets in committed config.
+   - Actuator: endpoints exposed beyond need, `show-details` open to anonymous callers.
+3. Verify by running the tests rather than assuming ({{LAW:verify-before-asserting}}).
+
+## Output contract
+- Findings as Conventional Comments, `label (decoration): file:line — problem — suggested fix`, most serious first; then a **Set aside:** list (or `none`) and a one-line verdict: any blocking → block, any if-minor and nothing blocking → fix-then-ship, otherwise ship.
+- Name any check that was impossible instead of issuing a verdict on partial evidence.
+
+## Self-improvement
+
+If this spec misled you — an input you needed but were not given, a boundary
+that proved wrong, a step you could not execute — end your report with one line:
+`spec-feedback: <what failed — the one-line fix>`. Omit it when there is no
+friction. The caller weighs the feedback, folds a real flaw back into this file
+with the user's assent, and records it to {{MEMORY}} only if it clears
+{{DOCTRINE:persist-insight}}'s bar — most reports carry no feedback at all.
+

package/src/agents/spring-security.md

@@ -0,0 +1,50 @@
+# {{AGENT}}: spring-security
+
+> {{DESC_SPRING_SECURITY}}
+
+{{CREDIT:piomin-spring-boot:agents/security-engineer.md}}
+
+Spring Security 7 audit only. The generic audit (injection, secrets, dependencies beyond Spring) belongs to [security](security.md); defer to it.
+
+## When to dispatch
+- A Spring change touches authentication, authorization, CORS, CSRF, headers, TLS or secrets handling.
+
+## When NOT to dispatch
+- Non-Spring security work — use [security](security.md).
+- General Spring conventions — use [spring-reviewer](spring-reviewer.md).
+
+## Inputs
+- The diff or the security configuration (`SecurityFilterChain` beans, controllers, filters, `application.yml`).
+
+## Allowed tools
+- **Read-only.** May run dependency and secret scanners. Reports; does not patch.
+<!-- bash: allow -->
+
+## Procedure
+0. If `{{DIR_MEMORY}}/agents/<your-name>.md` exists, read it first — your durable lessons from prior dispatches ({{DOCTRINE:persist-insight}}).
+1. Read the `SecurityFilterChain` beans first, then method-security usage and config files.
+2. Check:
+   - Filter chain: a bean, never `WebSecurityConfigurerAdapter`; `authorizeHttpRequests` ends in `anyRequest().authenticated()` or `denyAll()`; only health and login endpoints open.
+   - Resource server: `oauth2ResourceServer(o -> o.jwt(...))` with an issuer or JWK source and audience validation; no hand-rolled token filter without a reason.
+   - Method security: `@EnableMethodSecurity` present wherever `@PreAuthorize` is used.
+   - Sessions and CSRF: stateless APIs set `SessionCreationPolicy.STATELESS` and may disable CSRF; session or cookie apps keep CSRF on.
+   - CORS: explicit origins, never `*` with credentials; the chain calls `cors(...)`.
+   - Headers: defaults not disabled; HSTS on HTTPS.
+   - TLS: SSL bundles; `reload-on-update` works only for Tomcat and Netty and only from `file:` locations, so a `classpath:` bundle never reloads.
+   - Secrets: none in committed config; use env vars, mounted files or config trees.
+   - Errors: no stack traces or internals in responses.
+3. Verify with `grep` and the test suite ({{LAW:verify-before-asserting}}).
+
+## Output contract
+- Findings by severity (critical, high, medium, low), each with `file:line`, the risk and a fix; then a one-line verdict.
+- Name any check that was impossible instead of issuing a verdict on partial evidence.
+
+## Self-improvement
+
+If this spec misled you — an input you needed but were not given, a boundary
+that proved wrong, a step you could not execute — end your report with one line:
+`spec-feedback: <what failed — the one-line fix>`. Omit it when there is no
+friction. The caller weighs the feedback, folds a real flaw back into this file
+with the user's assent, and records it to {{MEMORY}} only if it clears
+{{DOCTRINE:persist-insight}}'s bar — most reports carry no feedback at all.
+

package/src/kits/spring-boot/rules.md

@@ -0,0 +1,10 @@
+### Spring Boot kit
+
+Applies to Spring Boot 4 projects (Spring Framework 7, Java 21+). Read the project's own pom.xml or Gradle build first and check any API you reach for against the version it pins; do not assume a newer or older one.
+
+- Inject through constructors only. No field-level `@Autowired`.
+- Blocking HTTP calls use `RestClient`. Do not add new `RestTemplate` code.
+- Persistence and validation imports are `jakarta.*`, never `javax.*`.
+- Tests that need a database or broker use Testcontainers wired with `@ServiceConnection`, not hand-copied connection properties.
+- Replace beans in tests with `@MockitoBean` and `@MockitoSpyBean`; the older Boot test-package mock and spy bean annotations are removed.
+- Match the project's existing style, build tool and CI before introducing another.

package/src/kits/spring-boot.json

@@ -0,0 +1,23 @@
+{
+  "description": "Spring Boot 4 / Java 21+ services: build, data access, testing, security review, and the container and cluster around them.",
+  "skills": ["spring-boot", "spring-data-jpa", "spring-testing"],
+  "agents": ["spring-boot-engineer", "spring-reviewer", "spring-security", "kubernetes-specialist", "docker-expert", "devops-engineer"],
+  "rules": "kits/spring-boot/rules.md",
+  "rulesWordBudget": 300,
+  "banned": ["@MockBean", "@SpyBean", "javax.persistence", "ClientHttpRequestFactories", "Spring Security 6"],
+  "catalogue": {
+    "skills": [
+      "| [spring-boot]({{DIR_SKILLS}}/spring-boot.md) | building or changing a Spring Boot service: controllers, configuration, REST clients, error handling, observability, packaging |",
+      "| [spring-data-jpa]({{DIR_SKILLS}}/spring-data-jpa.md) | Spring Data JPA or Hibernate work: entities, repositories, queries, transactions, schema migrations, N+1 and fetch problems |",
+      "| [spring-testing]({{DIR_SKILLS}}/spring-testing.md) | writing or fixing Spring Boot tests: slices, MockMvc, Testcontainers with service connections, mocking beans |"
+    ],
+    "agents": [
+      "| [spring-boot-engineer]({{DIR_AGENTS}}/spring-boot-engineer.md) | a Spring Boot feature or service must be implemented end to end in a Java codebase |",
+      "| [spring-reviewer]({{DIR_AGENTS}}/spring-reviewer.md) | a Spring Boot change needs a framework-aware review: layering, transactions, JPA, configuration, test slices |",
+      "| [spring-security]({{DIR_AGENTS}}/spring-security.md) | a Spring Security change (filter chain, method security, OAuth2/JWT, CORS/CSRF) needs a security pass |",
+      "| [kubernetes-specialist]({{DIR_AGENTS}}/kubernetes-specialist.md) | a Spring Boot service needs Kubernetes manifests, probes, resources or a rollout strategy reviewed or written |",
+      "| [docker-expert]({{DIR_AGENTS}}/docker-expert.md) | a Spring Boot service needs a Dockerfile, layered or native image, or container build reviewed or written |",
+      "| [devops-engineer]({{DIR_AGENTS}}/devops-engineer.md) | a Spring Boot service needs its build and delivery pipeline reviewed or improved, on whatever CI the project already uses |"
+    ]
+  }
+}

package/src/laws/universal.md

@@ -72,21 +72,21 @@ governs the goal).
 Real data loss and any irreversible, financial, privilege-changing or
 outward-facing act (publishing, sending data to a third party) need explicit
 confirmation bound to that act, or a durable authorization covering it; one
-yes never stretches to the next. Real loss: deleting what version control
-cannot restore (untracked, modified, unpushed or unmerged work), discarding
-uncommitted changes, rewriting, deleting or force-moving main, master or the
-default branch, or erasing reflog/gc data. Classify every action as Create,
-Read, Update, or Delete and tier by reversibility: what git restores — an
-edit, removing tracked clean files, force-pushing your own branch, removing a
-worktree — runs freely.
+yes never stretches to the next. Real loss: deleting what git cannot restore
+(untracked, modified, unpushed or unmerged work), discarding uncommitted work,
+rewriting, deleting or force-moving main, master or the default branch, or
+pruning reflog/gc. Classify every action as Create, Read, Update, or Delete
+and tier by reversibility: what git restores — an edit, tracked clean files,
+force-pushing your own branch, a worktree — runs freely, as does
+`reset --hard` over a dirty tree.
 <!-- LEAN:else -->
 Real data loss — deleting untracked, modified, unpushed, unmerged work,
-discarding uncommitted work, deleting or force-moving main, master or the
-default branch, pruning reflog/gc — and any irreversible, financial,
-privilege-changing or outward-facing act need explicit confirmation bound to
-that act, or a durable authorization covering it; one yes never stretches to
-the next. What git restores runs freely: tracked clean files, a worktree,
-force-pushing your own branch.
+discarding uncommitted work (except `reset --hard`), deleting or
+force-moving main, master or the default branch, pruning reflog/gc — and any
+irreversible, financial, privilege-changing or outward-facing act need
+explicit confirmation bound to that act, or a durable authorization covering
+it; one yes never stretches to the next. What git restores runs freely:
+tracked clean files, a worktree, force-pushing your own branch.
 <!-- LEAN:end -->
 
 ### {{LAW:surface-failures}} Surface Failures

package/src/licenses/mattpocock-skills.txt

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Matt Pocock
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/src/licenses/piomin-spring-boot.txt

@@ -0,0 +1,190 @@
+Apache License
+Version 2.0, January 2004
+http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+   "License" shall mean the terms and conditions for use, reproduction,
+   and distribution as defined by Sections 1 through 9 of this document.
+
+   "Licensor" shall mean the copyright owner or entity authorized by
+   the copyright owner that is granting the License.
+
+   "Legal Entity" shall mean the union of the acting entity and all
+   other entities that control, are controlled by, or are under common
+   control with that entity. For the purposes of this definition,
+   "control" means (i) the power, direct or indirect, to cause the
+   direction or management of such entity, whether by contract or
+   otherwise, or (ii) ownership of fifty percent (50%) or more of the
+   outstanding shares, or (iii) beneficial ownership of such entity.
+
+   "You" (or "Your") shall mean an individual or Legal Entity
+   exercising permissions granted by this License.
+
+   "Source" form shall mean the preferred form for making modifications,
+   including but not limited to software source code, documentation
+   source, and configuration files.
+
+   "Object" form shall mean any form resulting from mechanical
+   transformation or translation of a Source form, including but
+   not limited to compiled object code, generated documentation,
+   and conversions to other media types.
+
+   "Work" shall mean the work of authorship, whether in Source or
+   Object form, made available under the License, as indicated by a
+   copyright notice that is included in or attached to the work
+   (an example is provided in the Appendix below).
+
+   "Derivative Works" shall mean any work, whether in Source or Object
+   form, that is based on (or derived from) the Work and for which the
+   editorial revisions, annotations, elaborations, or other modifications
+   represent, as a whole, an original work of authorship. For the purposes
+   of this License, Derivative Works shall not include works that remain
+   separable from, or merely link (or bind by name) to the interfaces of,
+   the Work and Derivative Works thereof.
+
+   "Contribution" shall mean any work of authorship, including
+   the original version of the Work and any modifications or additions
+   to that Work or Derivative Works thereof, that is intentionally
+   submitted to Licensor for inclusion in the Work by the copyright owner
+   or by an individual or Legal Entity authorized to submit on behalf of
+   the copyright owner. For the purposes of this definition, "submitted"
+   means any form of electronic, verbal, or written communication sent
+   to the Licensor or its representatives, including but not limited to
+   communication on electronic mailing lists, source code control systems,
+   and issue tracking systems that are managed by, or on behalf of, the
+   Licensor for the purpose of discussing and improving the Work, but
+   excluding communication that is conspicuously marked or otherwise
+   designated in writing by the copyright owner as "Not a Contribution."
+
+   "Contributor" shall mean Licensor and any individual or Legal Entity
+   on behalf of whom a Contribution has been received by Licensor and
+   subsequently incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   copyright license to reproduce, prepare Derivative Works of,
+   publicly display, publicly perform, sublicense, and distribute the
+   Work and such Derivative Works in Source or Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   (except as stated in this section) patent license to make, have made,
+   use, offer to sell, sell, import, and otherwise transfer the Work,
+   where such license applies only to those patent claims licensable
+   by such Contributor that are necessarily infringed by their
+   Contribution(s) alone or by combination of their Contribution(s)
+   with the Work to which such Contribution(s) was submitted. If You
+   institute patent litigation against any entity (including a
+   cross-claim or counterclaim in a lawsuit) alleging that the Work
+   or a Contribution incorporated within the Work constitutes direct
+   or contributory patent infringement, then any patent licenses
+   granted to You under this License for that Work shall terminate
+   as of the date such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the
+   Work or Derivative Works thereof in any medium, with or without
+   modifications, and in Source or Object form, provided that You
+   meet the following conditions:
+
+   (a) You must give any other recipients of the Work or
+       Derivative Works a copy of this License; and
+
+   (b) You must cause any modified files to carry prominent notices
+       stating that You changed the files; and
+
+   (c) You must retain, in the Source form of any Derivative Works
+       that You distribute, all copyright, patent, trademark, and
+       attribution notices from the Source form of the Work,
+       excluding those notices that do not pertain to any part of
+       the Derivative Works; and
+
+   (d) If the Work includes a "NOTICE" text file as part of its
+       distribution, then any Derivative Works that You distribute must
+       include a readable copy of the attribution notices contained
+       within such NOTICE file, excluding those notices that do not
+       pertain to any part of the Derivative Works, in at least one
+       of the following places: within a NOTICE text file distributed
+       as part of the Derivative Works; within the Source form or
+       documentation, if provided along with the Derivative Works; or,
+       within a display generated by the Derivative Works, if and
+       wherever such third-party notices normally appear. The contents
+       of the NOTICE file are for informational purposes only and
+       do not modify the License. You may add Your own attribution
+       notices within Derivative Works that You distribute, alongside
+       or as an addendum to the NOTICE text from the Work, provided
+       that such additional attribution notices cannot be construed
+       as modifying the License.
+
+   You may add Your own copyright statement to Your modifications and
+   may provide additional or different license terms and conditions
+   for use, reproduction, or distribution of Your modifications, or
+   for any such Derivative Works as a whole, provided Your use,
+   reproduction, and distribution of the Work otherwise complies with
+   the conditions stated in this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise,
+   any Contribution intentionally submitted for inclusion in the Work
+   by You to the Licensor shall be under the terms and conditions of
+   this License, without any additional terms or conditions.
+   Notwithstanding the above, nothing herein shall supersede or modify
+   the terms of any separate license agreement you may have executed
+   with Licensor regarding such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade
+   names, trademarks, service marks, or product names of the Licensor,
+   except as required for reasonable and customary use in describing the
+   origin of the Work and reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or
+   agreed to in writing, Licensor provides the Work (and each
+   Contributor provides its Contributions) on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+   implied, including, without limitation, any warranties or conditions
+   of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+   PARTICULAR PURPOSE. You are solely responsible for determining the
+   appropriateness of using or redistributing the Work and assume any
+   risks associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory,
+   whether in tort (including negligence), contract, or otherwise,
+   unless required by applicable law (such as deliberate and grossly
+   negligent acts) or agreed to in writing, shall any Contributor be
+   liable to You for damages, including any direct, indirect, special,
+   incidental, or consequential damages of any character arising as a
+   result of this License or out of the use or inability to use the
+   Work (including but not limited to damages for loss of goodwill,
+   work stoppage, computer failure or malfunction, or any and all
+   other commercial damages or losses), even if such Contributor
+   has been advised of the possibility of such damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing
+   the Work or Derivative Works thereof, You may choose to offer,
+   and charge a fee for, acceptance of support, warranty, indemnity,
+   or other liability obligations and/or rights consistent with this
+   License. However, in accepting such obligations, You may act only
+   on Your own behalf and on Your sole responsibility, not on behalf
+   of any other Contributor, and only if You agree to indemnify,
+   defend, and hold each Contributor harmless for any liability
+   incurred by, or claims asserted against, such Contributor by reason
+   of your accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
+
+Copyright 2026 Piotr Mińkowski
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

package/src/licenses/superpowers.txt

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Jesse Vincent
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/src/licenses/vibe-wise.txt

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Noah Kim
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/src/skills/brainstorm/builder-check.md

@@ -1,5 +1,7 @@
 # {{SKILL}}: brainstorm — builder check
 
+{{CREDIT:superpowers:skills/brainstorming/builder-check-prompt.md}}
+
 The spec's author cannot read it cold: a re-read inherits the framing that wrote it. So a
 fresh reader does.
 

package/src/skills/brainstorm.md

@@ -3,6 +3,10 @@
 > {{DESC_BRAINSTORM}}
 <!-- aliases: grill-me -->
 
+{{CREDIT:superpowers:skills/brainstorming/SKILL.md}}
+
+{{CREDIT:mattpocock-skills:skills/productivity/grilling/SKILL.md}}
+
 **Trigger:** a new feature, behaviour change, or project arrives without a design, or the
 user says "brainstorm", "interview me" or "grill me". Also when goal, scope or success
 criteria are unstated ("let's design this", "clarify this first", "stress-test this plan"),

package/src/skills/codebase-design.md

@@ -3,6 +3,10 @@
 > {{DESC_CODEBASE_DESIGN}}
 <!-- aliases: domain-modeling -->
 
+{{CREDIT:mattpocock-skills:skills/engineering/codebase-design/SKILL.md}}
+
+{{CREDIT:mattpocock-skills:skills/engineering/domain-modeling/SKILL.md}}
+
 **Trigger:** the user asks "where should the seam go", how to make a module testable through
 its interface, or for a glossary term or ADR. Also designing or reshaping a module's interface,
 a design talk that keeps stumbling over ambiguous terms, or another {{SKILL}} needing this vocabulary.

package/src/skills/daydream/VENDOR.md

@@ -5,14 +5,14 @@ skill. It rides along in the rendered bundle and is exempt from Geneseed's autho
 gates (token, dead-link, hermeticity, skill counts) — it is listed in the
 generator's `VENDORED_SKILL_DIRS`.
 
-- **Upstream:** https://github.com/glebis/claude-skills/tree/main/daydream
-- **Commit:** f47170dee300dd3d5da2a1c3c708986faeea3d5a
-- **Author:** Gleb Kalinin
-- **License:** MIT (declared in `.claude-plugin/plugin.json`). The text is in `LICENSE`,
-  copied from upstream's root `LICENSE` as added in 93677f479f40ab43520883e7a6c954b755ab39ef
-  (the pinned commit predates the file; its copyright line covers 2025-2026).
+- **Upstream key:** daydream (repo, pinned commit, author and licence: `src/upstreams.json`)
+- **Credit:** {{CREDIT:daydream:daydream}}
 - **Inspired by:** Gwern's [LLM Daydreaming](https://gwern.net/ai-daydreaming)
 
+The licence (MIT, declared upstream in `.claude-plugin/plugin.json`) is in `LICENSE`, copied
+from upstream's root `LICENSE` as added in 93677f479f40ab43520883e7a6c954b755ab39ef (the
+pinned commit predates the file; its copyright line covers 2025-2026).
+
 ## Geneseed adaptation
 
 Vault resolution is adapted to read the harness's `geneseed-wiki.jsonc` knowledge-base
@@ -32,7 +32,7 @@ does not tell the model where a skill lives.
 
 To update, re-copy the upstream folder, re-apply the geneseed-wiki.jsonc adaptation, the
 frontmatter and the placeholder paths in `SKILL.md` / `instructions.md`, and
-bump the commit above.
+bump the `daydream` entry's `commit` in `src/upstreams.json`.
 
 `SKILL.md`'s frontmatter also carries `disable-model-invocation: true`, which upstream lacks: the
 skill is user-only (`/daydream`), so its description stays out of the model's always-on catalogue —

package/src/skills/debug.md

@@ -3,6 +3,10 @@
 > {{DESC_DEBUG}}
 <!-- aliases: ci-fix -->
 
+{{CREDIT:superpowers:skills/systematic-debugging/SKILL.md}}
+
+{{CREDIT:mattpocock-skills:skills/engineering/diagnosing-bugs/SKILL.md}}
+
 **Trigger:** a test fails, code crashes or prints a stack trace, or returns the wrong result — load this FIRST. Load it before reading code or investigating, not only before proposing a fix. Also when a CI run, pipeline job or pre-merge check is red ("CI is failing", "fix the build") — then start with the CI branch.
 
 **No fix without a root cause.** A change you cannot tie to a cause you understand is
@@ -12,7 +16,7 @@ The pressure to skip straight to a patch is highest exactly when this rule matte
 faster than thrashing; do not trade it away under pressure.
 
 ## Procedure
-1. **Build one command that goes red on *this* bug** before reading code for a theory. It asserts the user's exact symptom (not "didn't crash"), gives the same verdict every run, takes seconds and runs unattended; run it and show the output. Read the error and stack trace in full. For a flaky bug, raise the reproduction rate until it is debuggable. If you cannot build it, say so, list what you tried and ask for access or a captured artifact — no command, no hypothesis. Read `GLOSSARY.md` (or `CONTEXT.md`) and the ADRs in the area for the domain's vocabulary.
+1. **Build one command that goes red on *this* bug** before reading code for a theory. It asserts the user's exact symptom (not "didn't crash"), gives the same verdict every run, takes seconds and runs unattended; run it and show the output. If you forced the red by mutating code or a fixture, `diff` against a pristine copy to prove the mutation landed, then revert it. Read the error and stack trace in full. For a flaky bug, raise the reproduction rate until it is debuggable. If you cannot build it, say so, list what you tried and ask for access or a captured artifact — no command, no hypothesis. Read `GLOSSARY.md` (or `CONTEXT.md`) and the ADRs in the area for the domain's vocabulary.
 2. **Minimise, then isolate.** Cut inputs and steps one at a time until every remaining element is load-bearing. Then binary-search the cause — the code path, or for a regression the commit range with `git bisect` (the [git-history {{SKILL}}](git-history.md) carries the method). Change one variable at a time. Find the nearest working twin (a passing sibling test, the last green commit, the same call elsewhere) and list every difference, however small. For a bad value deep in the stack, trace it back caller by caller to where it was born, and fix there. In a multi-layer system (CI → build → sign, API → service → DB), instrument each boundary once to see *which* layer breaks before investigating inside it. For a performance regression, take a baseline measurement and bisect; don't log.
 3. **Rank 3–5 falsifiable hypotheses** ("if X is the cause, changing Y removes the bug") — list them in your reply, then test the top one without waiting. Cite the evidence for each as `file:line` or the exact log line. Proceed only on one that explains ALL the evidence — else gather more evidence, don't guess.
 4. Apply the smallest fix that addresses the root cause, not the symptom; resist fixing things the evidence doesn't implicate ({{LAW:one-intent-one-act}}). One change at a time — no bundled "while I'm here" edits.

package/src/skills/develop.md

@@ -2,6 +2,8 @@
 
 > {{DESC_DEVELOP}}
 
+{{CREDIT:mattpocock-skills:skills/engineering/tdd/SKILL.md}}
+
 **Trigger:** implementing a feature, fixing a bug, or changing code behaviour in a
 repo that has (or should have) a test suite — before writing implementation code.
 Covers both the test-first cycle (red → green → refactor) and the cover-alongside

package/src/skills/geneseed-code-review.md

@@ -2,6 +2,10 @@
 
 > {{DESC_CODE_REVIEW}}
 
+{{CREDIT:mattpocock-skills:skills/engineering/code-review/SKILL.md}}
+
+{{CREDIT:superpowers:skills/requesting-code-review/code-reviewer.md}}
+
 **Trigger:** reviewing changes before merge, or the user asks for a review — including "roast my code": same passes, findings unsoftened. Critiquing the user's own ask or plan is [roast-me](roast-me.md).
 
 ## Procedure
@@ -22,8 +26,8 @@
    kept apart, one axis's findings never mask the other's.
 5. Pass 1 — correctness: logic errors, edge cases, error handling, race
    conditions. Verify suspect behaviour by running tests, not by assuming.
-6. Pass 2 — quality: after `REVIEW.md`, the repo's documented standards (`CODING_STANDARDS.md`,
-   `CONTRIBUTING.md`) override. Then, as judgement calls and skipping what tooling enforces:
+6. Pass 2 — quality: after `REVIEW.md`, the repo's documented standards override: search the repo for every file that states how code
+   is written (`CODING_STANDARDS.md`, `CONTRIBUTING.md`, style or conventions docs), not one fixed path. Then, as judgement calls and skipping what tooling enforces:
    mysterious name, duplication, feature envy, data clumps, primitive obsession, repeated switches, shotgun surgery, divergent change, speculative generality, message chains, middle man, refused bequest, dead code, units that do too much.
 7. Pass 3 — spec fidelity: flag anything asked for but missing, present but never
    asked for, or implemented wrong — quoting the spec line for each. Where the spec is silent,

package/src/skills/git-history.md

@@ -3,6 +3,8 @@
 > {{DESC_GIT_HISTORY}}
 <!-- aliases: git-archaeology, git-rescue -->
 
+{{CREDIT:mattpocock-skills-frozen:skills/engineering/resolving-merge-conflicts/SKILL.md}}
+
 **Trigger:** something must be learned *from* the git history, or it needs repair.
 Learn: when a regression came in, who last touched a line and why, where a symbol or
 string entered. Repair: lost commits, a rebase/merge/reset gone wrong, a detached HEAD, a

package/src/skills/handoff.md

@@ -2,6 +2,8 @@
 
 > {{DESC_HANDOFF}}
 
+{{CREDIT:mattpocock-skills:skills/productivity/handoff/SKILL.md}}
+
 **Trigger:** the context window is filling, a session is ending mid-task, or work is passing to another agent or developer.
 
 ## Procedure

package/src/skills/learn-mode.md

@@ -4,6 +4,8 @@
 
 <!-- invocation: user -->
 
+{{CREDIT:vibe-wise:skills/learn/behavior.md}}
+
 **Trigger:** the user wants to *learn while building* rather than be handed finished code.
 Phrases: "learn mode", "turn on learning", "I want to understand what we build", "let me design it,
 you write it". Also "pause learning" / "resume learning" / "stop learn mode". To be taught a
@@ -11,8 +13,7 @@ topic outside a build, use the [teach {{SKILL}}](teach.md); to have knowledge te
 [quiz {{SKILL}}](quiz.md).
 
 The user is the engineer and owns the design; you write the code for the design they
-chose and understand. Learning and the user's control outrank build speed. The idea comes
-from [VibeWise](https://github.com/nykooi1/vibe-wise) (MIT); this is a rewrite, not a copy.
+chose and understand. Learning and the user's control outrank build speed.
 
 ## State — `.geneseed/learn.md`