just-vibe 0.7.0

package/plugins/just-vibe/skills/backend-auth/SKILL.md

@@ -0,0 +1,63 @@
+---
+name: backend-auth
+description: "Build or audit authentication and session behavior Use for identity/session lifecycle; backend-permissions handles what an identity may do."
+---
+
+# backend-auth
+
+Build or audit authentication and session behavior
+
+## Choose this workflow
+
+Use for identity/session lifecycle; backend-permissions handles what an identity may do.
+
+Read [shared execution](../../references/execution.md) for context/mode/authority handling and [Backend methods](../../references/packs/backend.md) for tool selection and operational details. Resolve these paths from this skill file; all runtime assets ship inside the plugin.
+
+## Input and mode
+
+Use the complete request appended to this invocation, preserving all constraints and references. Default mode: **inspect**. Inspect for audits; apply for a specified implementation. Requires identity provider, session model, and recovery/logout requirements.
+
+service source, data/interface contracts, framework/runtime versions, and test environment. Default apply operations target local code and isolated tests; live infrastructure/data mutations require their own requested scope.
+
+Declared evidence requirements: `project.read`. Use actual host discovery or adequate supplied artifacts; unavailable evidence remains blocked/unknown.
+
+## Scope
+
+Authentication and session lifecycle; resource authorization is separately checked by `backend-permissions`.
+
+None by default. Plan artifacts may be saved when requested.
+
+## Execute
+
+- Identify the provider, session owner, trust boundaries and the actual request: audit or implementation. Trace login, refresh, logout and recovery across browser and server.
+- Read only the matching cookie-session, OAuth callback, refresh-race or recovery scenario. Use the supported provider mechanism, implement the requested boundary and verify the relevant transitions.
+
+## Read when relevant
+
+- Working on cookie sessions, callbacks, refresh or recovery: [Authentication scenarios](../../references/scenarios/auth.md).
+
+## Decision branches
+
+- **When browser cookie sessions carry authentication:** Resolve cookie scope, proxy/HTTPS behavior, CSRF protection, session rotation and logout semantics.
+- **When OAuth/OIDC callbacks establish a session:** Bind the flow to the initiating browser, enforce the supported state/PKCE/nonce contract, and validate identity through the provider client.
+- **When refresh and logout can overlap across tabs or workers:** Choose the session owner and stale-result rule; test rotation/reuse, expired credentials and late refresh after logout.
+- **When recovery or account linking changes access:** Verify single-use/expiry, ownership proof, abuse controls and the intended existing-session invalidation.
+
+## Deliver and verify
+
+- Authentication findings or implementation with lifecycle checks.
+- Auth lifecycle, trust assumptions and expired/revoked/invalid-credential checks.
+
+Verify these observable conditions when applicable to the actual task; do not claim they were exercised from merely reading this file:
+
+- Logout/revocation invalidates the intended session; untrusted or expired tokens fail closed.
+
+## Stop and recover
+
+- Do not invent cryptography, log credentials, or mistake authentication for permission to access every resource.
+
+## Example requests
+
+- **Normal (inspect):** Audit session refresh, logout, and expired-token behavior.
+- **edge (inspect):** Repair refresh behavior across concurrent browser tabs and expired sessions.
+- **blocked (inspect):** Review auth configuration without credentials or live login attempts.

package/plugins/just-vibe/skills/backend-cache/SKILL.md

@@ -0,0 +1,59 @@
+---
+name: backend-cache
+description: "Design cache keys, invalidation, expiration, and fallback Use for cache correctness and measured caching changes; db-query fixes the underlying query semantics."
+---
+
+# backend-cache
+
+Design cache keys, invalidation, expiration, and fallback
+
+## Choose this workflow
+
+Use for cache correctness and measured caching changes; db-query fixes the underlying query semantics.
+
+Read [shared execution](../../references/execution.md) for context/mode/authority handling and [Backend methods](../../references/packs/backend.md) for tool selection and operational details. Resolve these paths from this skill file; all runtime assets ship inside the plugin.
+
+## Input and mode
+
+Use the complete request appended to this invocation, preserving all constraints and references. Default mode: **plan**. Plan; cached data, freshness tolerance, identity scope, workload, and failure expectations.
+
+service source, data/interface contracts, framework/runtime versions, and test environment. Default apply operations target local code and isolated tests; live infrastructure/data mutations require their own requested scope.
+
+Declared evidence requirements: `project.read`. Use actual host discovery or adequate supplied artifacts; unavailable evidence remains blocked/unknown.
+
+## Scope
+
+Key design, invalidation, expiry, stampedes, and fallback; implementation on request.
+
+None by default. Plan artifacts may be saved when requested.
+
+## Execute
+
+- Map the source of truth, consumers, authorization scope and every invalidation path. Define the key as an unambiguous identity tuple including relevant tenant, user, filters and representation version; distinguish a cached empty/falsey value from a miss.
+- Specify separate absent, in-flight, successful and failed states. Define whether concurrent callers share work, when the freshness clock starts, the exact expiry boundary and zero-TTL behavior. Choose these from product requirements, not a convenient implementation default.
+- If asynchronous work is shared, assign cancellation ownership: a caller may stop waiting without cancelling shared work needed by other callers. Handle already-aborted callers, synchronous fetch errors, asynchronous rejection and listener cleanup on every terminal path.
+- If invalidation can race with an asynchronous fill, associate each fill with its current entry or generation. Invalidation must detach obsolete work so its late success or failure cannot overwrite or remove a newer entry. Decide explicitly whether existing waiters still receive the detached result.
+- Verify identity isolation, falsey hits, coalescing, expiry, failure/retry, per-caller cancellation and reversed completion after invalidation using a controlled clock and deferred work. Measure hit rate or latency only with an actual representative workload.
+
+## Decision branches
+
+- **When an authorization change can outlive a cached response:** Invalidate or version the relevant identity boundary; a long TTL cannot substitute for access control.
+- **When multiple consumers share an in-flight fill:** Separate waiter lifetimes from fill ownership. Test cancelling one waiter while another completes, and an old rejection arriving during a newer fill.
+
+## Deliver and verify
+
+- Key and state/lifetime contract, chosen invalidation and cancellation ownership, implementation when requested, and independent isolation/race/failure evidence.
+
+Verify these observable conditions when applicable to the actual task; do not claim they were exercised from merely reading this file:
+
+- A cancelled or obsolete caller cannot poison another consumer or a newer fill; failures are recoverable according to the stated cache policy. Key collisions and valid falsey values do not cause cross-identity reuse or extra fetches.
+
+## Stop and recover
+
+- Do not treat caching as a fix for incorrect queries. No production flush or shared-cache changes without explicit scope.
+
+## Example requests
+
+- **Normal (plan):** Plan tenant-safe cache keys and invalidation for invoice summaries.
+- **edge (apply):** Fix cached dashboard data leaking between accounts with identical filters.
+- **blocked (inspect):** Inspect cache logic without flushing production or assuming current hit-rate data.

package/plugins/just-vibe/skills/backend-concurrency/SKILL.md

@@ -0,0 +1,58 @@
+---
+name: backend-concurrency
+description: "Investigate races, locking, and competing updates Use for violated invariants under competing operations; backend-idempotency handles repeat identity."
+---
+
+# backend-concurrency
+
+Investigate races, locking, and competing updates
+
+## Choose this workflow
+
+Use for violated invariants under competing operations; backend-idempotency handles repeat identity.
+
+Read [shared execution](../../references/execution.md) for context/mode/authority handling and [Backend methods](../../references/packs/backend.md) for tool selection and operational details. Resolve these paths from this skill file; all runtime assets ship inside the plugin.
+
+## Input and mode
+
+Use the complete request appended to this invocation, preserving all constraints and references. Default mode: **inspect**. Inspect; race symptom, shared resources, transaction semantics, and concurrency evidence.
+
+service source, data/interface contracts, framework/runtime versions, and test environment. Default apply operations target local code and isolated tests; live infrastructure/data mutations require their own requested scope.
+
+Declared evidence requirements: `project.read`. Use actual host discovery or adequate supplied artifacts; unavailable evidence remains blocked/unknown.
+
+## Scope
+
+Competing updates, locks, isolation, and atomicity; apply for an explicit fix.
+
+None by default. Plan artifacts may be saved when requested.
+
+## Execute
+
+- Write the shared invariant and the read/decide/write interleaving that violates it. Identify every worker/process and the actual shared boundary; list durable writes, external effects and cancellation points separately.
+- Choose the narrowest supported atomicity mechanism for that boundary: a conditional write, transaction, version check or shared lock. Define who starts and ends the transaction or lease; never accidentally commit or roll back a caller-owned transaction.
+- Validate before irreversible work and keep related invariant checks inside the serialization boundary when their inputs can race. Handle lock acquisition failure, deadlock/serialization conflict and cancellation with bounded retries only when replay is safe.
+- Force contention using separate real connections or workers and deterministic coordination. Exercise success, rejection, interruption after partial work and cleanup; assert final state and number of effects, not just the number of returned responses.
+
+## Decision branches
+
+- **When a caller already owns a transaction:** Follow the API contract: participate with documented savepoint semantics or reject before touching it. Do not use unconditional commit/rollback cleanup that can consume unrelated work.
+- **When multiple processes share the resource:** A process-local mutex cannot establish the shared invariant. Verify at the storage or service boundary used by all writers.
+
+## Deliver and verify
+
+- Violating interleaving, invariant and ownership boundary, selected mechanism, retry/cleanup behavior, contention and interruption results.
+
+Verify these observable conditions when applicable to the actual task; do not claim they were exercised from merely reading this file:
+
+- Independent workers preserve the invariant under contention. Failed operations leave owned resources usable, preserve caller-owned work, and cannot return success for an uncommitted or duplicated effect.
+
+## Stop and recover
+
+- No live contention experiments implicitly. Do not solve local races with process-local locks when multiple processes share the resource.
+
+## Example requests
+
+- **Normal (inspect):** Investigate two concurrent reservations exceeding inventory capacity.
+- **edge (inspect):** Prevent two concurrent reservations from selling the final available seat twice.
+- **blocked (inspect):** Review concurrency logic without performing live contention experiments.

package/plugins/just-vibe/skills/backend-idempotency/SKILL.md

@@ -0,0 +1,58 @@
+---
+name: backend-idempotency
+description: "Prevent duplicate effects from retries and repeated requests Use to make repeated operations produce the intended single effect; backend-concurrency covers broader interleavings."
+---
+
+# backend-idempotency
+
+Prevent duplicate effects from retries and repeated requests
+
+## Choose this workflow
+
+Use to make repeated operations produce the intended single effect; backend-concurrency covers broader interleavings.
+
+Read [shared execution](../../references/execution.md) for context/mode/authority handling and [Backend methods](../../references/packs/backend.md) for tool selection and operational details. Resolve these paths from this skill file; all runtime assets ship inside the plugin.
+
+## Input and mode
+
+Use the complete request appended to this invocation, preserving all constraints and references. Default mode: **apply**. Apply; retried operation, effect boundary, request identity, and deduplication lifetime.
+
+service source, data/interface contracts, framework/runtime versions, and test environment. Default apply operations target local code and isolated tests; live infrastructure/data mutations require their own requested scope.
+
+Declared evidence requirements: `project.read`. Use actual host discovery or adequate supplied artifacts; unavailable evidence remains blocked/unknown.
+
+## Scope
+
+Prevent duplicate effects for the specified operation, including concurrent duplicates.
+
+Only the requested local changes; external actions require their exact action and target in session authorization.
+
+## Execute
+
+- Define the business operation, key namespace, payload equivalence, validity/retention window and replay response. Include tenant and operation where they distinguish effects; specify how equal keys with different payloads or pending work are handled.
+- Validate the payload without permissive coercion where the contract requires exact types or bounds. Check ownership, funds/capacity and numeric limits at the boundary that protects against concurrent change.
+- When the effect and deduplication record share a database, make their success/failure atomic using the engine-supported transaction and uniqueness mechanism. Define transaction ownership and make identical concurrent requests converge on the original stored result.
+- For an external effect, walk the crash before send, timeout after possible success and failure before local recording. Use supported provider idempotency or durable reconciliation; a local key alone cannot prove exactly-once external execution.
+- Test equal replay, conflicting payload, separate tenants, simultaneous claims and failure after each durable step. Assert state, stored result and hook/provider call count; verify a retry after rollback can succeed without repeating a completed effect.
+
+## Decision branches
+
+- **When the same key arrives with a different payload or while pending:** Return explicit conflict/pending behavior; do not execute another effect or replay an unrelated result.
+
+## Deliver and verify
+
+- Operation/key/payload contract, durable ownership and retention policy, failure-window table, and replay/conflict/concurrency/interruption evidence.
+
+Verify these observable conditions when applicable to the actual task; do not claim they were exercised from merely reading this file:
+
+- Equal replay performs no new effect; a conflicting payload cannot inherit an unrelated result. Local rollback removes both partial effects and the claim when the contract permits retry; uncertain external outcomes remain explicitly unresolved.
+
+## Stop and recover
+
+- Do not claim exactly-once external delivery without provider support or reconciliation. Cache-only deduplication needs durability justification.
+
+## Example requests
+
+- **Normal (apply):** Prevent duplicate payment credits from concurrent and reordered webhooks.
+- **edge (apply):** Make payment creation safe when two equal requests arrive simultaneously.
+- **blocked (inspect):** Design idempotency without provider deduplication support; identify reconciliation requirements.

package/plugins/just-vibe/skills/backend-jobs/SKILL.md

@@ -0,0 +1,56 @@
+---
+name: backend-jobs
+description: "Implement background processing, scheduling, and recovery Use for durable background work; arch-event-flow defines cross-service consistency."
+---
+
+# backend-jobs
+
+Implement background processing, scheduling, and recovery
+
+## Choose this workflow
+
+Use for durable background work; arch-event-flow defines cross-service consistency.
+
+Read [shared execution](../../references/execution.md) for context/mode/authority handling and [Backend methods](../../references/packs/backend.md) for tool selection and operational details. Resolve these paths from this skill file; all runtime assets ship inside the plugin.
+
+## Input and mode
+
+Use the complete request appended to this invocation, preserving all constraints and references. Default mode: **apply**. Apply; job purpose, payload, scheduling/retry policy, concurrency, and environment.
+
+service source, data/interface contracts, framework/runtime versions, and test environment. Default apply operations target local code and isolated tests; live infrastructure/data mutations require their own requested scope.
+
+Declared evidence requirements: `project.read`. Use actual host discovery or adequate supplied artifacts; unavailable evidence remains blocked/unknown.
+
+## Scope
+
+Worker implementation and local/test registration; live scheduling must be requested.
+
+Only the requested local changes; external actions require their exact action and target in session authorization.
+
+## Execute
+
+- Define durable payloads, idempotent effects, lease/retry/dead-letter behavior, implement checkpoints where needed, and test crash/restart paths.
+- Specify payload version, stable job identity, lease expiry, ack timing, bounded retry and dead-letter inspection before coding the worker.
+
+## Decision branches
+
+- **When a worker dies after the external effect but before acknowledgement:** Reconcile the effect using durable identity before replaying it.
+
+## Deliver and verify
+
+- Worker, configuration, observable failure handling, and recovery checks.
+- Job state machine, retry/lease rules and crash-before/after-effect tests.
+
+Verify these observable conditions when applicable to the actual task; do not claim they were exercised from merely reading this file:
+
+- A worker crash can resume without duplicate irreversible effects; poison messages stop retrying after a defined bound.
+
+## Stop and recover
+
+- No unrequested recurring jobs. Unknown provider delivery guarantees require explicit assumptions and corresponding safeguards.
+
+## Example requests
+
+- **Normal (apply):** Implement a resumable worker with bounded retries and poison-message handling.
+- **edge (apply):** Implement a resumable job that might receive the same message concurrently.
+- **blocked (inspect):** Plan worker behavior with unknown broker delivery guarantees.

package/plugins/just-vibe/skills/backend-permissions/SKILL.md

@@ -0,0 +1,56 @@
+---
+name: backend-permissions
+description: "Define and test authorization for roles, resources, and ownership Use for application action/resource policy; arch-tenancy covers propagation across the whole system."
+---
+
+# backend-permissions
+
+Define and test authorization for roles, resources, and ownership
+
+## Choose this workflow
+
+Use for application action/resource policy; arch-tenancy covers propagation across the whole system.
+
+Read [shared execution](../../references/execution.md) for context/mode/authority handling and [Backend methods](../../references/packs/backend.md) for tool selection and operational details. Resolve these paths from this skill file; all runtime assets ship inside the plugin.
+
+## Input and mode
+
+Use the complete request appended to this invocation, preserving all constraints and references. Default mode: **plan**. Plan for policy definition; apply for explicit implementation. Requires roles, actions, ownership, tenant rules, and exceptions.
+
+service source, data/interface contracts, framework/runtime versions, and test environment. Default apply operations target local code and isolated tests; live infrastructure/data mutations require their own requested scope.
+
+Declared evidence requirements: `project.read`. Use actual host discovery or adequate supplied artifacts; unavailable evidence remains blocked/unknown.
+
+## Scope
+
+Server-side resource authorization across all relevant entry points.
+
+None by default. Plan artifacts may be saved when requested.
+
+## Execute
+
+- Build an action/resource matrix, identify enforcement boundaries, implement consistent checks when requested, and test cross-user, cross-tenant, and indirect access.
+- Build subject/action/resource/tenant cases, locate server-side enforcement and inspect alternate read/write/export paths and ownership transfers.
+
+## Decision branches
+
+- **When policy is ambiguous for one role/resource combination:** Isolate that decision while continuing checks for unambiguous denials and allowed paths.
+
+## Deliver and verify
+
+- Permission contract, enforcement changes if authorized, and negative/positive tests.
+- Access matrix, enforcement locations and positive/negative isolation checks.
+
+Verify these observable conditions when applicable to the actual task; do not claim they were exercised from merely reading this file:
+
+- Owners can perform intended actions; direct-ID requests cannot bypass tenant restrictions.
+
+## Stop and recover
+
+- Ambiguous policy blocks that decision, not unrelated analysis. Never rely solely on hidden UI buttons as enforcement.
+
+## Example requests
+
+- **Normal (plan):** Define read/update/export access rules for organization-owned invoices.
+- **edge (plan):** Add permission checks for direct-ID access and background exports.
+- **blocked (inspect):** Audit source without real tenant accounts; use synthetic identities and state assumptions.

package/plugins/just-vibe/skills/backend-resilience/SKILL.md

@@ -0,0 +1,56 @@
+---
+name: backend-resilience
+description: "Add appropriate timeouts, bounded retries, and failure handling Use for bounded dependency failure behavior; ops-incident handles an active incident."
+---
+
+# backend-resilience
+
+Add appropriate timeouts, bounded retries, and failure handling
+
+## Choose this workflow
+
+Use for bounded dependency failure behavior; ops-incident handles an active incident.
+
+Read [shared execution](../../references/execution.md) for context/mode/authority handling and [Backend methods](../../references/packs/backend.md) for tool selection and operational details. Resolve these paths from this skill file; all runtime assets ship inside the plugin.
+
+## Input and mode
+
+Use the complete request appended to this invocation, preserving all constraints and references. Default mode: **apply**. Apply; dependency failure modes, latency budget, retry constraints, and fallback policy.
+
+service source, data/interface contracts, framework/runtime versions, and test environment. Default apply operations target local code and isolated tests; live infrastructure/data mutations require their own requested scope.
+
+Declared evidence requirements: `project.read`. Use actual host discovery or adequate supplied artifacts; unavailable evidence remains blocked/unknown.
+
+## Scope
+
+Timeouts, bounded retries, cancellation, circuit/fallback behavior, and useful errors.
+
+Only the requested local changes; external actions require their exact action and target in session authorization.
+
+## Execute
+
+- Classify retry-safe operations, allocate end-to-end time budget, implement backoff/jitter where appropriate, propagate cancellation, and simulate partial dependency failures.
+- Allocate an end-to-end deadline across attempts and dependencies, classify retry-safe effects and control exponential backoff/jitter within the total cap.
+
+## Decision branches
+
+- **When the deadline expires with uncertain external mutation:** Return an explicit uncertain/reconcilable state and preserve the stable operation ID.
+
+## Deliver and verify
+
+- Resilience changes and bounded failure/recovery tests.
+- Timeout/retry/fallback matrix and controlled outage/partial-effect checks.
+
+Verify these observable conditions when applicable to the actual task; do not claim they were exercised from merely reading this file:
+
+- A failing dependency cannot trigger unbounded retries; non-idempotent operations are not duplicated by blind retry.
+
+## Stop and recover
+
+- Do not silently return stale/synthetic business results without an agreed fallback. Production fault injection requires separate authorization.
+
+## Example requests
+
+- **Normal (apply):** Add bounded retry and timeout behavior without duplicating unsafe requests.
+- **edge (apply):** Add retries without multiplying nested dependency attempts beyond the deadline.
+- **blocked (inspect):** Design resilience from contracts without injecting faults into production.

package/plugins/just-vibe/skills/backend-service/SKILL.md

@@ -0,0 +1,56 @@
+---
+name: backend-service
+description: "Implement a service with clear boundaries and validation Use for a domain service implementation; api-design defines transport-facing contracts."
+---
+
+# backend-service
+
+Implement a service with clear boundaries and validation
+
+## Choose this workflow
+
+Use for a domain service implementation; api-design defines transport-facing contracts.
+
+Read [shared execution](../../references/execution.md) for context/mode/authority handling and [Backend methods](../../references/packs/backend.md) for tool selection and operational details. Resolve these paths from this skill file; all runtime assets ship inside the plugin.
+
+## Input and mode
+
+Use the complete request appended to this invocation, preserving all constraints and references. Default mode: **apply**. Apply; service responsibility, request/event contracts, persistence, and error requirements.
+
+service source, data/interface contracts, framework/runtime versions, and test environment. Default apply operations target local code and isolated tests; live infrastructure/data mutations require their own requested scope.
+
+Declared evidence requirements: `project.read`. Use actual host discovery or adequate supplied artifacts; unavailable evidence remains blocked/unknown.
+
+## Scope
+
+One service boundary and necessary integration; no unrelated service decomposition.
+
+Only the requested local changes; external actions require their exact action and target in session authorization.
+
+## Execute
+
+- Reuse domain conventions, validate inputs, separate transport from business rules, implement persistence/error handling, and test observable behavior.
+- Identify transaction ownership and domain invariants, keep transport parsing outside business decisions and make dependency failures observable to callers.
+
+## Decision branches
+
+- **When one operation spans local persistence and an external effect:** Define outbox/reconciliation or compensating behavior before claiming atomicity.
+
+## Deliver and verify
+
+- Service implementation, interfaces, configuration guidance, and checks.
+- Service contract, effect/transaction boundaries and success/failure checks.
+
+Verify these observable conditions when applicable to the actual task; do not claim they were exercised from merely reading this file:
+
+- A valid operation persists the intended effect; validation/dependency failure leaves a consistent state.
+
+## Stop and recover
+
+- Do not invent business rules or create production infrastructure. Missing external credentials block live verification, not local contract work.
+
+## Example requests
+
+- **Normal (apply):** Implement a narrow invitation service using existing validation and persistence patterns.
+- **edge (apply):** Implement order creation when notification fails after persistence.
+- **blocked (inspect):** Inspect service requirements with an unavailable dependency; use a contract fixture only.

package/plugins/just-vibe/skills/brainstorm/SKILL.md

@@ -0,0 +1,56 @@
+---
+name: brainstorm
+description: "Generate distinct approaches and explain their tradeoffs Use to generate meaningfully different approaches before selection; decide evaluates a bounded shortlist."
+---
+
+# brainstorm
+
+Generate distinct approaches and explain their tradeoffs
+
+## Choose this workflow
+
+Use to generate meaningfully different approaches before selection; decide evaluates a bounded shortlist.
+
+Read [shared execution](../../references/execution.md) for context/mode/authority handling and [General methods](../../references/packs/general.md) for tool selection and operational details. Resolve these paths from this skill file; all runtime assets ship inside the plugin.
+
+## Input and mode
+
+Use the complete request appended to this invocation, preserving all constraints and references. Default mode: **plan**. Plan; problem, audience, constraints, and desired breadth. Requires the brief, with repository context when relevant.
+
+Resolve the user brief and inspect the relevant project or supplied evidence. External capabilities are optional unless the selected action actually needs them.
+
+Resolve any task-specific tools, target identity and evidence before dependent actions. No external connection is assumed.
+
+## Scope
+
+Generate distinct viable approaches; no implementation or final product commitment.
+
+None by default. Plan artifacts may be saved when requested.
+
+## Execute
+
+- Restate the objective, vary meaningful design dimensions, discard duplicates, and explain benefits, costs, and a validation method for each remaining approach.
+- Vary actual mechanisms such as ownership, interaction or persistence; include a minimal approach and attach a cheap validation experiment to each candidate.
+
+## Decision branches
+
+- **When constraints eliminate most options:** Keep a small feasible set rather than adding cosmetic variants to meet a count.
+
+## Deliver and verify
+
+- A bounded set of differentiated options and a recommended shortlist.
+- Distinct options, tradeoffs, validation experiments and a justified shortlist.
+
+Verify these observable conditions when applicable to the actual task; do not claim they were exercised from merely reading this file:
+
+- Alternatives differ in actual behavior or architecture; all respect explicit constraints such as no new service.
+
+## Stop and recover
+
+- Identify impossible constraint combinations. Avoid padding the output with renamed versions of the same idea.
+
+## Example requests
+
+- **Normal (plan):** Find distinct ways to reduce onboarding steps while preserving required consent.
+- **edge (plan):** Brainstorm offline collaboration without introducing a server.
+- **blocked (inspect):** Generate approaches from this brief; user research is unavailable, so label adoption assumptions.

package/plugins/just-vibe/skills/build/SKILL.md

@@ -0,0 +1,56 @@
+---
+name: build
+description: "Implement a feature through appropriate verification Use for a defined feature spanning existing code; specialist commands supply methods for fragile subproblems."
+---
+
+# build
+
+Implement a feature through appropriate verification
+
+## Choose this workflow
+
+Use for a defined feature spanning existing code; specialist commands supply methods for fragile subproblems.
+
+Read [shared execution](../../references/execution.md) for context/mode/authority handling and [General methods](../../references/packs/general.md) for tool selection and operational details. Resolve these paths from this skill file; all runtime assets ship inside the plugin.
+
+## Input and mode
+
+Use the complete request appended to this invocation, preserving all constraints and references. Default mode: **apply**. Apply; feature goal, constraints, and observable success criteria. Requires writable source and relevant local tooling.
+
+Resolve the user brief and inspect the relevant project or supplied evidence. External capabilities are optional unless the selected action actually needs them.
+
+Declared evidence requirements: `project.read`. Use actual host discovery or adequate supplied artifacts; unavailable evidence remains blocked/unknown.
+
+## Scope
+
+Complete the requested feature and necessary integration; no unrelated modernization or automatic publication.
+
+Only the requested local changes; external actions require their exact action and target in session authorization.
+
+## Execute
+
+- Inspect current patterns, resolve critical ambiguity, implement coherent changes, handle error states, and run checks appropriate to the behavior changed.
+- Trace the closest existing journey, implement the smallest complete vertical slice, and exercise failure recovery before expanding optional states.
+
+## Decision branches
+
+- **When a business rule is unspecified:** Continue independent plumbing and ask only for the rule that changes user-visible behavior.
+
+## Deliver and verify
+
+- Working changes, validation evidence, and material limitations.
+- Files changed, acceptance criteria exercised, failure-path evidence and remaining integration gaps.
+
+Verify these observable conditions when applicable to the actual task; do not claim they were exercised from merely reading this file:
+
+- The requested journey works end to end; an error path preserves existing contracts and user data.
+
+## Stop and recover
+
+- Missing secrets/services produce a specific integration blocker, not fabricated success. Preserve unrelated edits and report checks that could not run.
+
+## Example requests
+
+- **Normal (apply):** Add saved filters to search; use the current API and no new dependencies.
+- **edge (apply):** Build checkout while preserving an existing discount rule and pending user edits.
+- **blocked (inspect):** Inspect what can be implemented locally when the payment sandbox is unavailable.

package/plugins/just-vibe/skills/challenge/SKILL.md

@@ -0,0 +1,56 @@
+---
+name: challenge
+description: "Identify weak assumptions, complexity, and failure cases Use to test a proposal's assumptions, not to manufacture objections; decision-premortem explores a future failure story."
+---
+
+# challenge
+
+Identify weak assumptions, complexity, and failure cases
+
+## Choose this workflow
+
+Use to test a proposal's assumptions, not to manufacture objections; decision-premortem explores a future failure story.
+
+Read [shared execution](../../references/execution.md) for context/mode/authority handling and [General methods](../../references/packs/general.md) for tool selection and operational details. Resolve these paths from this skill file; all runtime assets ship inside the plugin.
+
+## Input and mode
+
+Use the complete request appended to this invocation, preserving all constraints and references. Default mode: **inspect**. Inspect; proposal, plan, architecture, or hypothesis and its success criteria.
+
+Resolve the user brief and inspect the relevant project or supplied evidence. External capabilities are optional unless the selected action actually needs them.
+
+Resolve any task-specific tools, target identity and evidence before dependent actions. No external connection is assumed.
+
+## Scope
+
+Test assumptions and failure modes; no adversarial criticism for its own sake and no implementation changes.
+
+None by default. Plan artifacts may be saved when requested.
+
+## Execute
+
+- Identify critical assumptions, search for disconfirming evidence, construct plausible edge cases, and rank issues by impact and likelihood.
+- Extract falsifiable assumptions and seek counterexamples in current code, workload and constraints; distinguish observed defects from speculative risks.
+
+## Decision branches
+
+- **When an assumption survives the available evidence:** Keep it accepted provisionally and name evidence that would reverse the conclusion.
+
+## Deliver and verify
+
+- Evidence-backed challenges, questions that matter, and smaller or more robust alternatives.
+- Ranked challenges with trigger, consequence, evidence and discriminating experiment.
+
+Verify these observable conditions when applicable to the actual task; do not claim they were exercised from merely reading this file:
+
+- A supported assumption remains accepted; a serious unsupported dependency receives a concrete validation step.
+
+## Stop and recover
+
+- Separate demonstrated flaws from speculative concerns. Do not demand certainty where a reversible experiment resolves the risk.
+
+## Example requests
+
+- **Normal (inspect):** Challenge the assumption that every notification needs a separate service.
+- **edge (inspect):** Challenge a cache proposal whose stale data could affect authorization.
+- **blocked (inspect):** Challenge this proposal without traffic data; do not invent capacity limits.