mustflow 2.103.16 → 2.103.21

package/schemas/check-report.schema.json

@@ -0,0 +1,52 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://mustflow.github.io/schemas/check-report.schema.json",
+  "title": "mustflow check report",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "ok",
+    "strict",
+    "issueCount",
+    "issues",
+    "warningCount",
+    "warnings",
+    "issueDetails"
+  ],
+  "properties": {
+    "ok": { "type": "boolean" },
+    "strict": { "type": "boolean" },
+    "issueCount": { "type": "integer", "minimum": 0 },
+    "issues": {
+      "type": "array",
+      "items": { "type": "string" }
+    },
+    "warningCount": { "type": "integer", "minimum": 0 },
+    "warnings": {
+      "type": "array",
+      "items": { "type": "string" }
+    },
+    "issueDetails": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/issueDetail" }
+    }
+  },
+  "$defs": {
+    "issueDetail": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "severity", "mode", "message"],
+      "properties": {
+        "id": {
+          "anyOf": [
+            { "type": "string" },
+            { "type": "null" }
+          ]
+        },
+        "severity": { "enum": ["error", "warning"] },
+        "mode": { "enum": ["base", "strict"] },
+        "message": { "type": "string" }
+      }
+    }
+  }
+}

package/schemas/index-report.schema.json

@@ -0,0 +1,103 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://mustflow.github.io/schemas/index-report.schema.json",
+  "title": "mustflow local index report",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema_version",
+    "command",
+    "ok",
+    "mustflow_root",
+    "database_path",
+    "dry_run",
+    "wrote_files",
+    "index_mode",
+    "reused_existing",
+    "rebuild_reason",
+    "document_count",
+    "skill_count",
+    "skill_route_count",
+    "command_intent_count",
+    "command_effect_count",
+    "verification_evidence_summary_count",
+    "verification_plan_count",
+    "acceptance_criteria_count",
+    "criterion_coverage_count",
+    "verification_receipt_summary_count",
+    "command_receipt_summary_count",
+    "verification_coverage_state_count",
+    "verification_risk_signal_count",
+    "validation_ratchet_signal_count",
+    "completion_verdict_summary_count",
+    "repro_route_count",
+    "repro_observation_count",
+    "failure_fingerprint_count",
+    "source_index_enabled",
+    "source_anchor_count",
+    "source_anchor_risk_signal_count",
+    "search_backend",
+    "search_fts5_available",
+    "content_mode",
+    "store_full_content",
+    "max_snippet_bytes_per_document",
+    "excluded_raw_data_kinds",
+    "indexed_file_count",
+    "indexed_paths"
+  ],
+  "properties": {
+    "schema_version": { "type": "string", "pattern": "^[0-9]+$" },
+    "command": { "const": "index" },
+    "ok": { "type": "boolean" },
+    "mustflow_root": { "type": "string" },
+    "database_path": { "type": "string" },
+    "dry_run": { "type": "boolean" },
+    "wrote_files": { "type": "boolean" },
+    "index_mode": { "enum": ["full", "incremental"] },
+    "reused_existing": { "type": "boolean" },
+    "rebuild_reason": {
+      "anyOf": [
+        { "type": "string" },
+        { "type": "null" }
+      ]
+    },
+    "document_count": { "$ref": "#/$defs/count" },
+    "skill_count": { "$ref": "#/$defs/count" },
+    "skill_route_count": { "$ref": "#/$defs/count" },
+    "command_intent_count": { "$ref": "#/$defs/count" },
+    "command_effect_count": { "$ref": "#/$defs/count" },
+    "verification_evidence_summary_count": { "$ref": "#/$defs/count" },
+    "verification_plan_count": { "$ref": "#/$defs/count" },
+    "acceptance_criteria_count": { "$ref": "#/$defs/count" },
+    "criterion_coverage_count": { "$ref": "#/$defs/count" },
+    "verification_receipt_summary_count": { "$ref": "#/$defs/count" },
+    "command_receipt_summary_count": { "$ref": "#/$defs/count" },
+    "verification_coverage_state_count": { "$ref": "#/$defs/count" },
+    "verification_risk_signal_count": { "$ref": "#/$defs/count" },
+    "validation_ratchet_signal_count": { "$ref": "#/$defs/count" },
+    "completion_verdict_summary_count": { "$ref": "#/$defs/count" },
+    "repro_route_count": { "$ref": "#/$defs/count" },
+    "repro_observation_count": { "$ref": "#/$defs/count" },
+    "failure_fingerprint_count": { "$ref": "#/$defs/count" },
+    "source_index_enabled": { "type": "boolean" },
+    "source_anchor_count": { "$ref": "#/$defs/count" },
+    "source_anchor_risk_signal_count": { "$ref": "#/$defs/count" },
+    "search_backend": { "enum": ["fts5", "table_scan"] },
+    "search_fts5_available": { "type": "boolean" },
+    "content_mode": { "const": "metadata_and_snippets" },
+    "store_full_content": { "const": false },
+    "max_snippet_bytes_per_document": { "type": "integer", "minimum": 0 },
+    "excluded_raw_data_kinds": {
+      "type": "array",
+      "items": { "type": "string" }
+    },
+    "indexed_file_count": { "$ref": "#/$defs/count" },
+    "indexed_paths": {
+      "type": "array",
+      "items": { "type": "string" }
+    }
+  },
+  "$defs": {
+    "count": { "type": "integer", "minimum": 0 }
+  }
+}

package/schemas/module-boundary-report.schema.json

@@ -0,0 +1,210 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://mustflow.github.io/schemas/module-boundary-report.schema.json",
+  "title": "mustflow module-boundary report",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema_version",
+    "command",
+    "pack_id",
+    "script_id",
+    "script_ref",
+    "action",
+    "status",
+    "ok",
+    "mustflow_root",
+    "policy",
+    "input_hash",
+    "config",
+    "targets",
+    "graph",
+    "rules",
+    "cycles",
+    "shared_metrics",
+    "truncated",
+    "findings",
+    "issues"
+  ],
+  "properties": {
+    "schema_version": { "const": "1" },
+    "command": { "const": "script-pack" },
+    "pack_id": { "const": "code" },
+    "script_id": { "const": "module-boundary" },
+    "script_ref": { "const": "code/module-boundary" },
+    "action": { "const": "check" },
+    "status": { "enum": ["passed", "failed", "error"] },
+    "ok": { "type": "boolean" },
+    "mustflow_root": { "type": "string" },
+    "policy": { "$ref": "#/$defs/policy" },
+    "input_hash": { "$ref": "#/$defs/sha256" },
+    "config": { "$ref": "#/$defs/config" },
+    "targets": { "type": "array", "items": { "$ref": "#/$defs/target" } },
+    "graph": { "$ref": "#/$defs/graph" },
+    "rules": { "type": "array", "items": { "$ref": "#/$defs/rule" } },
+    "cycles": { "type": "array", "items": { "$ref": "#/$defs/cycle" } },
+    "shared_metrics": { "type": "array", "items": { "$ref": "#/$defs/sharedMetric" } },
+    "truncated": { "type": "boolean" },
+    "findings": { "type": "array", "items": { "$ref": "#/$defs/finding" } },
+    "issues": { "type": "array", "items": { "type": "string" } }
+  },
+  "$defs": {
+    "sha256": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
+    "stringArray": { "type": "array", "items": { "type": "string" } },
+    "language": {
+      "enum": [
+        "typescript",
+        "tsx",
+        "javascript",
+        "jsx",
+        "javascript-module",
+        "javascript-commonjs",
+        "json",
+        "other"
+      ]
+    },
+    "targetKind": { "enum": ["file", "directory", "missing", "other", "unknown"] },
+    "edgeKind": { "enum": ["static_import", "static_export", "dynamic_import", "require"] },
+    "configStatus": { "enum": ["found", "missing", "invalid"] },
+    "ruleKind": {
+      "enum": ["layer_deny", "public_entrypoint", "feature_direct_import", "shared_budget", "import_cycle"]
+    },
+    "policy": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "max_file_bytes",
+        "max_files",
+        "max_depth",
+        "max_nodes",
+        "max_edges",
+        "extensions",
+        "ignored_directories",
+        "config_path",
+        "max_cycles",
+        "max_shared_files"
+      ],
+      "properties": {
+        "max_file_bytes": { "type": "integer", "minimum": 1 },
+        "max_files": { "type": "integer", "minimum": 1 },
+        "max_depth": { "type": "integer", "minimum": 1 },
+        "max_nodes": { "type": "integer", "minimum": 1 },
+        "max_edges": { "type": "integer", "minimum": 1 },
+        "extensions": { "$ref": "#/$defs/stringArray" },
+        "ignored_directories": { "$ref": "#/$defs/stringArray" },
+        "config_path": { "type": "string" },
+        "max_cycles": { "type": "integer", "minimum": 1 },
+        "max_shared_files": { "type": "integer", "minimum": 1 }
+      }
+    },
+    "config": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "path",
+        "status",
+        "layer_rule_count",
+        "public_entrypoint_rule_count",
+        "feature_group_rule_count",
+        "shared_budget_rule_count"
+      ],
+      "properties": {
+        "path": { "type": "string" },
+        "status": { "$ref": "#/$defs/configStatus" },
+        "layer_rule_count": { "type": "integer", "minimum": 0 },
+        "public_entrypoint_rule_count": { "type": "integer", "minimum": 0 },
+        "feature_group_rule_count": { "type": "integer", "minimum": 0 },
+        "shared_budget_rule_count": { "type": "integer", "minimum": 0 }
+      }
+    },
+    "target": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["input", "path", "exists", "kind", "language"],
+      "properties": {
+        "input": { "type": "string" },
+        "path": { "type": "string" },
+        "exists": { "type": ["boolean", "null"] },
+        "kind": { "$ref": "#/$defs/targetKind" },
+        "language": { "$ref": "#/$defs/language" }
+      }
+    },
+    "graph": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["script_ref", "status", "node_count", "edge_count", "cycle_hint_count", "truncated"],
+      "properties": {
+        "script_ref": { "const": "code/dependency-graph" },
+        "status": { "enum": ["passed", "failed", "error"] },
+        "node_count": { "type": "integer", "minimum": 0 },
+        "edge_count": { "type": "integer", "minimum": 0 },
+        "cycle_hint_count": { "type": "integer", "minimum": 0 },
+        "truncated": { "type": "boolean" }
+      }
+    },
+    "rule": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["rule_id", "kind", "finding_count"],
+      "properties": {
+        "rule_id": { "type": "string" },
+        "kind": { "$ref": "#/$defs/ruleKind" },
+        "finding_count": { "type": "integer", "minimum": 0 }
+      }
+    },
+    "cycle": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["cycle_id", "path_count", "paths"],
+      "properties": {
+        "cycle_id": { "type": "string", "pattern": "^cycle:[a-f0-9]{12}$" },
+        "path_count": { "type": "integer", "minimum": 0 },
+        "paths": { "$ref": "#/$defs/stringArray" }
+      }
+    },
+    "sharedMetric": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["rule_id", "path", "file_count", "export_count", "max_files", "max_exports"],
+      "properties": {
+        "rule_id": { "type": "string" },
+        "path": { "type": "string" },
+        "file_count": { "type": "integer", "minimum": 0 },
+        "export_count": { "type": "integer", "minimum": 0 },
+        "max_files": { "type": ["integer", "null"], "minimum": 0 },
+        "max_exports": { "type": ["integer", "null"], "minimum": 0 }
+      }
+    },
+    "finding": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["code", "severity", "message", "path"],
+      "properties": {
+        "code": {
+          "enum": [
+            "dependency_graph_path_outside_root",
+            "dependency_graph_unreadable_path",
+            "dependency_graph_max_files_exceeded",
+            "dependency_graph_max_nodes_exceeded",
+            "dependency_graph_max_edges_exceeded",
+            "module_boundary_config_missing",
+            "module_boundary_invalid_config",
+            "module_boundary_forbidden_import",
+            "module_boundary_public_entry_violation",
+            "module_boundary_feature_direct_import",
+            "module_boundary_shared_budget_exceeded",
+            "module_boundary_import_cycle_detected"
+          ]
+        },
+        "severity": { "enum": ["low", "medium", "high", "critical"] },
+        "message": { "type": "string" },
+        "path": { "type": "string" },
+        "rule_id": { "type": "string" },
+        "source_path": { "type": "string" },
+        "target_path": { "type": "string" },
+        "line": { "type": "integer", "minimum": 1 },
+        "cycle_id": { "type": "string", "pattern": "^cycle:[a-f0-9]{12}$" }
+      }
+    }
+  }
+}

package/schemas/search-report.schema.json

@@ -0,0 +1,102 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://mustflow.github.io/schemas/search-report.schema.json",
+  "title": "mustflow local search report",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema_version",
+    "command",
+    "ok",
+    "mustflow_root",
+    "database_path",
+    "query",
+    "limit",
+    "scope",
+    "index_fresh",
+    "stale_paths",
+    "search_backend",
+    "search_fts5_available",
+    "result_count",
+    "results"
+  ],
+  "properties": {
+    "schema_version": { "type": "string", "pattern": "^[0-9]+$" },
+    "command": { "const": "search" },
+    "ok": { "type": "boolean" },
+    "mustflow_root": { "type": "string" },
+    "database_path": { "type": "string" },
+    "query": { "type": "string" },
+    "limit": { "type": "integer", "minimum": 1, "maximum": 50 },
+    "scope": { "enum": ["workflow", "source", "all"] },
+    "index_fresh": { "type": "boolean" },
+    "stale_paths": {
+      "type": "array",
+      "items": { "type": "string" }
+    },
+    "search_backend": { "enum": ["fts5", "table_scan"] },
+    "search_fts5_available": { "type": "boolean" },
+    "result_count": { "type": "integer", "minimum": 0 },
+    "results": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/searchItem" }
+    }
+  },
+  "$defs": {
+    "searchItem": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "kind",
+        "cache_layer",
+        "volatile",
+        "authority_rank",
+        "authority_label",
+        "source_scope",
+        "navigation_only",
+        "can_instruct_agent",
+        "match",
+        "score"
+      ],
+      "properties": {
+        "kind": { "enum": ["document", "skill", "skill_route", "command_intent", "source_anchor"] },
+        "path": { "type": "string" },
+        "name": { "type": "string" },
+        "title": { "type": "string" },
+        "document_type": { "type": "string" },
+        "anchor_id": { "type": "string" },
+        "line_start": { "type": "integer", "minimum": 1 },
+        "risk": { "type": "string" },
+        "cache_layer": { "enum": ["stable", "task", "volatile"] },
+        "volatile": { "type": "boolean" },
+        "authority_rank": { "type": "integer", "minimum": 0 },
+        "authority_label": { "type": "string" },
+        "source_scope": { "enum": ["workflow", "source"] },
+        "navigation_only": { "type": "boolean" },
+        "can_instruct_agent": { "type": "boolean" },
+        "stale_status": { "type": "string" },
+        "stale_confidence": { "type": "number" },
+        "effect_locks": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "effect_paths": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "effect_modes": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "route_trigger": { "type": "string" },
+        "route_risk": { "type": "string" },
+        "verification_intents": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "match": { "type": "string" },
+        "score": { "type": "number" }
+      }
+    }
+  }
+}

package/schemas/status-report.schema.json

@@ -0,0 +1,50 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://mustflow.github.io/schemas/status-report.schema.json",
+  "title": "mustflow status report",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "installed",
+    "manifestLock",
+    "trackedFiles",
+    "changedFiles",
+    "missingFiles",
+    "issues",
+    "template"
+  ],
+  "properties": {
+    "installed": { "type": "boolean" },
+    "manifestLock": { "enum": ["missing", "invalid", "present"] },
+    "trackedFiles": { "type": "integer", "minimum": 0 },
+    "changedFiles": {
+      "type": "array",
+      "items": { "type": "string" }
+    },
+    "missingFiles": {
+      "type": "array",
+      "items": { "type": "string" }
+    },
+    "issues": {
+      "type": "array",
+      "items": { "type": "string" }
+    },
+    "template": {
+      "anyOf": [
+        { "$ref": "#/$defs/template" },
+        { "type": "null" }
+      ]
+    }
+  },
+  "$defs": {
+    "template": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "version"],
+      "properties": {
+        "id": { "type": "string" },
+        "version": { "type": "string" }
+      }
+    }
+  }
+}

package/templates/default/i18n.toml

@@ -62,7 +62,7 @@ translations = {}
 [documents."skills.index"]
 source = "locales/en/.mustflow/skills/INDEX.md"
 source_locale = "en"
-revision = 188
+revision = 189
 translations = {}
 
 [documents."skill.adapter-boundary"]
@@ -89,6 +89,12 @@ source_locale = "en"
 revision = 3
 translations = {}
 
+[documents."skill.http-api-semantics-review"]
+source = "locales/en/.mustflow/skills/http-api-semantics-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
 [documents."skill.backend-reliability-change"]
 source = "locales/en/.mustflow/skills/backend-reliability-change/SKILL.md"
 source_locale = "en"
@@ -128,7 +134,7 @@ translations = {}
 [documents."skill.module-boundary-review"]
 source = "locales/en/.mustflow/skills/module-boundary-review/SKILL.md"
 source_locale = "en"
-revision = 1
+revision = 2
 translations = {}
 
 [documents."skill.change-blast-radius-review"]
@@ -146,7 +152,7 @@ translations = {}
 [documents."skill.payment-integrity-review"]
 source = "locales/en/.mustflow/skills/payment-integrity-review/SKILL.md"
 source_locale = "en"
-revision = 2
+revision = 3
 translations = {}
 
 [documents."skill.credit-ledger-integrity-review"]
@@ -446,7 +452,7 @@ translations = {}
 [documents."skill.database-migration-change"]
 source = "locales/en/.mustflow/skills/database-migration-change/SKILL.md"
 source_locale = "en"
-revision = 2
+revision = 3
 translations = {}
 
 [documents."skill.database-query-bottleneck-review"]

package/templates/default/locales/en/.mustflow/skills/INDEX.md

@@ -2,7 +2,7 @@
 mustflow_doc: skills.index
 locale: en
 canonical: true
-revision: 188
+revision: 189
 authority: router
 lifecycle: mustflow-owned
 ---
@@ -106,6 +106,11 @@ refer to `AGENTS.md` and `.mustflow/config/commands.toml` to implement the most
   shapes, response shapes, pagination, idempotency, async jobs, versioning, deprecation, rate
   limits, retry rules, observability, or caller-facing docs need caller-ergonomics and misuse-risk
   review rather than only schema compatibility.
+- Use `http-api-semantics-review` as an adjunct when HTTP method choices, safe/idempotent/cacheable
+  claims, GET/HEAD bodies, OPTIONS or Allow discovery, HTTP QUERY, POST versus PUT URI ownership,
+  PUT replacement, PATCH document formats, DELETE behavior, conditional requests, status codes,
+  cache headers, CORS method discovery, retry behavior, or intermediary compatibility need HTTP
+  semantics review rather than only schema compatibility.
 - Use `api-access-control-review` as an adjunct when API security review needs BOLA or IDOR,
   object, property, or function authorization, tenant isolation, request-supplied identity,
   mass assignment, signed URLs, queue revalidation, webhook ownership, token/session hardening,
@@ -471,6 +476,7 @@ routes. Event routes stay inactive until their event occurs.
 | Product, app, service, CLI, API, SDK, library, desktop app, automation tool, or developer tool work needs a decision about which user, developer, operator, automation, integration, recovery, upgrade, documentation, or observability surfaces are supported now, deferred, explicitly unsupported, or internal-only | `.mustflow/skills/support-surface-advisor/SKILL.md` | Product stage, primary actors, main usage path, integration need, maintenance capacity, public-contract willingness, explicit non-goals, recovery and observability expectations, and current repository evidence | Support-surface plan, selected implementation boundaries, docs, tests, route metadata, core-engine boundary, and directly synchronized templates when installed | support-contract bloat, accidental public API, UI/CLI/API duplicate core logic, hidden integration promise, unsupported automation route, unowned recovery path, stale compatibility promise, or implementation explanation leaking into user-facing UI copy | `changes_status`, `changes_diff_summary`, `docs_validate_fast`, `test_release`, `mustflow_check` | Product stage, actors, recommended surfaces, deferred and unsupported surfaces, blocking questions, maintenance and compatibility risks, core engine versus shell boundary, staged plan, verification, and remaining support-surface risk |
 | A task chooses, migrates, rewrites, or justifies a primary language, runtime, framework, compile target, or execution environment | `.mustflow/skills/runtime-target-selection/SKILL.md` | Current runtime surfaces, target options, product or system need, environment constraints, migration boundary, smoke targets, and performance or reliability claims | Decision records, skill procedures, route metadata, migration plans, command-contract proposals, tests, fixtures, docs, and smallest selected migration scaffold | language-preference rewrite, unsupported runtime target, unusable build loop, cache or artifact blowup, missing smoke target, deployment drift, or false performance claim | `changes_status`, `changes_diff_summary`, `docs_validate_fast`, `test_related`, `test_release`, `mustflow_check` | Decision boundary, candidate targets, environment and build-loop evidence, smoke targets, migration boundary, calibrated claims, verification, and remaining runtime-target risk |
 | Non-trivial code work needs early structure decisions around domain rules, public contracts, external I/O, operational safety, failure handling, concurrency, data flow, or future change cost | `.mustflow/skills/structure-first-engineering/SKILL.md` | User request, target files, project context, core boundary, data flow, expected failures, public contracts, I/O surfaces, and verification contract | Risk block, focused boundaries, DTOs, adapters, pure functions, error models, tests, and directly synchronized docs or contracts | under-designed hard boundary, speculative abstraction, vague service layer, mixed I/O and domain rules, hidden partial failure, or untestable behavior | `changes_status`, `changes_diff_summary`, `test_related`, `test`, `lint`, `build`, `docs_validate_fast`, `test_release`, `mustflow_check` | Work risk, structure decision, data flow, failure model, I/O and concurrency boundaries, tests, verification, and remaining structure risk |
+| HTTP API method semantics, safe/idempotent/cacheable claims, GET or HEAD request-body assumptions, OPTIONS capability discovery, HTTP QUERY, POST versus PUT URI ownership, PUT replacement, PATCH document formats, DELETE behavior, conditional requests, status-code recovery, cache headers, CORS method discovery, retry behavior, or intermediary compatibility are created, changed, reviewed, or reported | `.mustflow/skills/http-api-semantics-review/SKILL.md` | Endpoint method ledger, method contract, concurrency contract, PATCH media type and atomicity, GET/QUERY/POST search contract, cache and capability headers, caller and intermediary support evidence, and configured command intents | Route handlers, method choices, validators, OpenAPI or docs, SDK examples, gateway rules, CORS rules, cache headers, conditional request handling, status-code maps, focused tests, and directly synchronized templates | hidden GET mutation, non-portable GET or HEAD body, PUT partial merge, ambiguous PATCH JSON, PATCH partial success, DELETE body dependency, duplicate DELETE side effect, POST search semantic blur, QUERY without media type or body-aware cache key, stale-client field loss, missing If-Match, confused Allow versus CORS methods, `no-cache` treated as `no-store`, collapsed status-code recovery, or proxy/CDN/client incompatibility | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | HTTP API semantics reviewed, endpoint method ledger, safe/idempotent/cache/header/status/conditional request findings, fixes or recommendations, synchronized API surfaces, verification, and remaining HTTP semantics risk |
 | HTTP, REST, GraphQL, tRPC, Hono RPC, Elysia Eden, gRPC, protobuf, OpenAPI, request/response schema, status code, header, content negotiation, cache header, error envelope, pagination, filtering, sorting, search, generated client, SDK, mock, fixture, or API docs contract is created or changed | `.mustflow/skills/api-contract-change/SKILL.md` | API style, contract source of truth, changed operations, request and response schemas, status and headers, content negotiation, error envelope, auth and permission behavior, pagination/filter/sort/search semantics, generated clients, SDKs, mocks, fixtures, callers, docs, and command contract entries | Routes, handlers, resolvers, validators, schemas, generated clients, SDKs, mocks, fixtures, docs, tests, and directly synchronized examples | route-only change, schema drift, generated-client breakage, hidden breaking change, status or error drift, pagination/search semantic drift, auth/permission drift, cache/header drift, or stale docs examples | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | API contract source, changed operations, compatibility classification, synchronized client/schema/docs/tests surfaces, verification, and remaining API contract risk |
 | Backend APIs, workers, jobs, queues, caches, database write paths, external service calls, health checks, observability, feature flags, idempotency, retries, outbox/inbox processing, or operational failure handling are created, changed, reviewed, or reported | `.mustflow/skills/backend-reliability-change/SKILL.md` | Backend surface, trigger shape, idempotency boundary, external-call deadline and retry policy, persistence and transaction boundary, queue/cache behavior, observability fields, rollout gate, and command contract entries | Handlers, services, workers, retry policy, timeout policy, idempotency storage, outbox/inbox code, cache boundaries, health endpoints, observability fields, flags, tests, docs, and directly synchronized templates | duplicate side effects, retry storm, unbounded wait, DB uniqueness race, cache stampede, stale cache authority, poison message loop, missing outbox/inbox, raw ORM response, object-level authorization bypass, high-cardinality telemetry, secret or personal-data log leak, broken liveness/readiness, or missing kill switch | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Backend surface, idempotency and retry/timeout decisions, queue/cache/database notes, health-probe split, observability and auth/DTO notes, rollout gate, verification, and remaining backend reliability risk |
 | HTTP delivery, content coding, compression negotiation, CDN or proxy cache behavior, streaming responses, SSE, EventSource, WebTransport, WebSocket fallback, HTTP/2 or HTTP/3 transport behavior, browser transport clients, reverse-proxy buffering, reconnect behavior, or delivery observability is created, changed, reviewed, or reported | `.mustflow/skills/http-delivery-streaming/SKILL.md` | Delivery surface, routes or assets, headers, cache and proxy/CDN path, browser/API clients, fallback behavior, streaming lifecycle, compression or dictionary choice, and observability fields | Route handlers, response headers, CDN/proxy config, browser transport code, streaming adapters, fallback clients, docs, tests, and directly synchronized templates | wrong content decoding, cache poisoning, private data cached publicly, proxy buffering, lost events, reconnect gaps, unsupported transport, unreliable datagram misuse, false compression win, or fallback failure | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `docs_validate_fast`, `test_release`, `mustflow_check` | Delivery ledger, negotiated encodings, cache/proxy behavior, stream/reconnect/fallback behavior, verification, and remaining delivery risk |