mustflow 2.108.0 → 2.108.2

package/dist/cli/commands/api/serve.js

@@ -1,10 +1,10 @@
-import { createInterface } from 'node:readline';
 import { apiReportActionSpec, isApiReportAction } from './actions.js';
 import { printUsageError } from '../../lib/cli-output.js';
 import { formatCliOptionParseError, hasParsedCliOption, parseCliOptions, } from '../../lib/option-parser.js';
 import { isRecord } from '../../lib/command-contract.js';
 import { t } from '../../lib/i18n.js';
 const API_SERVE_SCHEMA_VERSION = '1';
+const API_SERVE_MAX_LINE_CHARS = 1024 * 1024;
 const API_SERVE_OPTIONS = [
     { name: '--stdio', kind: 'boolean' },
     { name: '--help', kind: 'boolean', aliases: ['-h'] },
@@ -53,6 +53,15 @@ function readApiServeId(request) {
     }
     return null;
 }
+function readApiServeChanged(request, id) {
+    if (!Object.hasOwn(request, 'changed')) {
+        return undefined;
+    }
+    if (typeof request.changed === 'boolean') {
+        return request.changed;
+    }
+    return createApiServeError(id, 'invalid_request', 'Request field "changed" must be a boolean when provided.');
+}
 function parseApiServeRequestLine(line) {
     let parsed;
     try {
@@ -72,11 +81,18 @@ function parseApiServeRequestLine(line) {
             error: createApiServeError(id, 'invalid_request', 'Request must be a JSON object.'),
         };
     }
+    const changed = readApiServeChanged(parsed, id);
+    if (typeof changed !== 'boolean' && changed !== undefined) {
+        return {
+            request: null,
+            error: changed,
+        };
+    }
     return {
         request: {
             id,
             action: parsed.action,
-            changed: parsed.changed,
+            changed,
         },
         error: null,
     };
@@ -99,8 +115,8 @@ function createApiServeResponse(request, runtime) {
     try {
         return createApiServeSuccess(id, runtime.createReport(request.action));
     }
-    catch (error) {
-        return createApiServeError(id, 'report_unavailable', error instanceof Error ? error.message : String(error));
+    catch {
+        return createApiServeError(id, 'report_unavailable', 'Report is unavailable for this action.');
     }
 }
 function writeApiServeResponse(response, reporter) {
@@ -111,6 +127,53 @@ function writeApiServeResponse(response, reporter) {
     }
     reporter.stdout(line.trimEnd());
 }
+async function* readApiServeInputLines(input) {
+    input.setEncoding('utf8');
+    let buffer = '';
+    let discardingOversizedLine = false;
+    for await (const chunk of input) {
+        const text = typeof chunk === 'string' ? chunk : String(chunk);
+        let start = 0;
+        while (start < text.length) {
+            const newlineIndex = text.indexOf('\n', start);
+            const segmentEnd = newlineIndex === -1 ? text.length : newlineIndex;
+            const segment = text.slice(start, segmentEnd);
+            if (discardingOversizedLine) {
+                if (newlineIndex !== -1) {
+                    yield { oversized: true };
+                    discardingOversizedLine = false;
+                }
+            }
+            else if (buffer.length + segment.length > API_SERVE_MAX_LINE_CHARS) {
+                buffer = '';
+                if (newlineIndex === -1) {
+                    discardingOversizedLine = true;
+                }
+                else {
+                    yield { oversized: true };
+                }
+            }
+            else {
+                buffer += segment;
+                if (newlineIndex !== -1) {
+                    yield { line: buffer.endsWith('\r') ? buffer.slice(0, -1) : buffer };
+                    buffer = '';
+                }
+            }
+            if (newlineIndex === -1) {
+                break;
+            }
+            start = newlineIndex + 1;
+        }
+    }
+    if (discardingOversizedLine) {
+        yield { oversized: true };
+        return;
+    }
+    if (buffer.length > 0) {
+        yield { line: buffer.endsWith('\r') ? buffer.slice(0, -1) : buffer };
+    }
+}
 export async function runApiServe(args, reporter, lang, runtime) {
     const parsed = parseCliOptions(args, API_SERVE_OPTIONS);
     if (hasParsedCliOption(parsed, '--help')) {
@@ -125,12 +188,12 @@ export async function runApiServe(args, reporter, lang, runtime) {
         printUsageError(reporter, t(lang, 'api.error.serveRequiresStdio'), 'mf api --help', runtime.getHelp(lang), lang);
         return 1;
     }
-    const input = createInterface({
-        input: process.stdin,
-        crlfDelay: Infinity,
-    });
-    for await (const rawLine of input) {
-        const line = rawLine.trim();
+    for await (const inputLine of readApiServeInputLines(process.stdin)) {
+        if (inputLine.oversized) {
+            writeApiServeResponse(createApiServeError(null, 'request_too_large', `Request line exceeds ${API_SERVE_MAX_LINE_CHARS} characters.`), reporter);
+            continue;
+        }
+        const line = inputLine.line?.trim() ?? '';
         if (line.length === 0) {
             continue;
         }

package/dist/core/run-receipt-state.js

@@ -3,6 +3,7 @@ import path from 'node:path';
 import { ensureInside, writeJsonFileInsideWithoutSymlinks } from './safe-filesystem.js';
 const RUN_RECEIPT_SCHEMA_VERSION = '1';
 const RUN_RECEIPT_DIR = path.join('.mustflow', 'state', 'runs');
+const RUN_RECEIPT_DIR_POSIX = '.mustflow/state/runs';
 const LATEST_RUN_RECEIPT_INDEX = 'latest.index.json';
 const STATE_DIR_PREFIXES = ['run-', 'verify-'];
 const MIN_RETAINED_RUN_DIRS = 1;
@@ -131,6 +132,24 @@ function stringField(value) {
 function stringArrayField(value) {
     return Array.isArray(value) && value.every((entry) => typeof entry === 'string') ? value : undefined;
 }
+function resolveReceiptPathInsideRunsDir(runsDir, receiptPath) {
+    if (path.isAbsolute(receiptPath)) {
+        return null;
+    }
+    const normalizedReceiptPath = receiptPath.replace(/\\/gu, '/');
+    const runsPrefix = `${RUN_RECEIPT_DIR_POSIX}/`;
+    if (!normalizedReceiptPath.startsWith(runsPrefix)) {
+        return null;
+    }
+    const relativeToRunsDir = normalizedReceiptPath.slice(runsPrefix.length);
+    const parts = relativeToRunsDir.split('/');
+    if (parts.length === 0 || parts.some((part) => part.length === 0 || part === '.' || part === '..')) {
+        return null;
+    }
+    const receiptAbsolutePath = path.resolve(runsDir, ...parts);
+    ensureInside(runsDir, receiptAbsolutePath);
+    return receiptAbsolutePath;
+}
 function createRunEntry(directory) {
     const receipt = readJsonObject(path.join(directory.absolutePath, 'receipt.json'));
     if (!receipt || receipt.command !== 'run' || typeof receipt.receipt_path !== 'string') {
@@ -154,8 +173,10 @@ function readVerifyIntentEntry(directory, manifest, manifestPath, manifestReceip
         return null;
     }
     const runsDir = path.dirname(directory.absolutePath);
-    const receiptAbsolutePath = path.resolve(runsDir, ...receiptPath.split('/').slice(3));
-    ensureInside(runsDir, receiptAbsolutePath);
+    const receiptAbsolutePath = resolveReceiptPathInsideRunsDir(runsDir, receiptPath);
+    if (!receiptAbsolutePath) {
+        return null;
+    }
     const receipt = readJsonObject(receiptAbsolutePath);
     return {
         command: 'verify',

package/dist/core/secret-redaction.js

@@ -8,9 +8,14 @@ const SECRET_REDACTION_RULES = [
     },
     {
         kind: 'secret_token',
-        pattern: /\b(?:sk-[A-Za-z0-9]{16,}|ghp_[A-Za-z0-9]{20,}|xox[baprs]-[A-Za-z0-9-]{20,}|AKIA[0-9A-Z]{16})\b/gu,
+        pattern: /\b(?:sk-[A-Za-z0-9_-]{16,}|ghp_[A-Za-z0-9_]{20,}|github_pat_[A-Za-z0-9_]{20,}|xox[baprs]-[A-Za-z0-9-]{20,}|AKIA[0-9A-Z]{16})\b/gu,
         replace: () => REDACTED_SECRET_MARKER,
     },
+    {
+        kind: 'secret_bearer_token',
+        pattern: /\b(Bearer\s+)([A-Za-z0-9._~+/=-]{24,})\b/gu,
+        replace: (_match, prefix) => `${prefix}${REDACTED_SECRET_MARKER}`,
+    },
 ];
 export const SECRET_LIKE_PATTERNS = SECRET_REDACTION_RULES.map((rule) => {
     const flags = rule.pattern.flags.replace('g', '');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mustflow",
-  "version": "2.108.0",
+  "version": "2.108.2",
   "description": "Agent workflow documents and CLI for mustflow repository roots.",
   "type": "module",
   "license": "MIT-0",

package/schemas/api-serve-response.schema.json

@@ -56,6 +56,7 @@
           "enum": [
             "invalid_json",
             "invalid_request",
+            "request_too_large",
             "unknown_action",
             "action_requires_changed",
             "action_does_not_accept_changed",

package/templates/default/i18n.toml

@@ -62,7 +62,7 @@ translations = {}
 [documents."skills.index"]
 source = "locales/en/.mustflow/skills/INDEX.md"
 source_locale = "en"
-revision = 206
+revision = 207
 translations = {}
 
 [documents."skill.adapter-boundary"]
@@ -242,7 +242,7 @@ translations = {}
 [documents."skill.ci-pipeline-triage"]
 source = "locales/en/.mustflow/skills/ci-pipeline-triage/SKILL.md"
 source_locale = "en"
-revision = 1
+revision = 2
 translations = {}
 
 [documents."skill.auth-flow-triage"]
@@ -428,7 +428,7 @@ translations = {}
 [documents."skill.cloud-cost-guardrail-review"]
 source = "locales/en/.mustflow/skills/cloud-cost-guardrail-review/SKILL.md"
 source_locale = "en"
-revision = 1
+revision = 2
 translations = {}
 
 [documents."skill.rate-limit-integrity-review"]
@@ -823,13 +823,13 @@ translations = {}
 [documents."skill.tauri-code-change"]
 source = "locales/en/.mustflow/skills/tauri-code-change/SKILL.md"
 source_locale = "en"
-revision = 3
+revision = 4
 translations = {}
 
 [documents."skill.wails-code-change"]
 source = "locales/en/.mustflow/skills/wails-code-change/SKILL.md"
 source_locale = "en"
-revision = 1
+revision = 2
 translations = {}
 
 [documents."skill.typescript-code-change"]

package/templates/default/locales/en/.mustflow/skills/INDEX.md

@@ -2,7 +2,7 @@
 mustflow_doc: skills.index
 locale: en
 canonical: true
-revision: 206
+revision: 207
 authority: router
 lifecycle: mustflow-owned
 ---
@@ -180,8 +180,9 @@ refer to `AGENTS.md` and `.mustflow/config/commands.toml` to implement the most
   registry, or runtime failure is not yet localized to host, daemon, image, app, network, storage,
   resource, or registry boundaries.
 - Use `ci-pipeline-triage` as a primary route when CI/CD workflow, pipeline, job, runner, trigger,
-  cache, artifact, deployment job, required check, or post-deploy verification failure is not yet
-  localized to trigger, runner, environment, build, test, artifact, deploy, or verification.
+  cache, artifact, runner-minute billing, artifact storage or retention, deployment job, required
+  check, or post-deploy verification failure or cost is not yet localized to trigger, runner,
+  environment, build, test, cache, artifact, billing, deploy, or verification.
 - Use `web-render-performance-review` as an adjunct when web frontend routes need first-render,
   Core Web Vitals, LCP, CLS, FCP, TTFB, critical CSS, font, image, iframe, third-party script,
   hydration, first-view data, resource-hint, CDN/cache, route-prefetch, or long-task review.
@@ -286,8 +287,9 @@ refer to `AGENTS.md` and `.mustflow/config/commands.toml` to implement the most
   changed, reviewed, or upgraded.
 - Use `wails-code-change` as a primary route when Wails v3 apps, Go services, generated bindings,
   TypeScript runtime calls, windows, menus, system tray, dialogs, events, WebView platform
-  behavior, Taskfile or build config, signing, packaging, custom protocols, file associations,
-  server builds, or Wails-related tests are created, changed, reviewed, or upgraded.
+  behavior, Taskfile or build config, signing, packaging, platform targets, native desktop CI build
+  matrices, custom protocols, file associations, server builds, or Wails-related tests are created,
+  changed, reviewed, or upgraded.
 - Use `axum-code-change` as a primary route when Axum routers, handlers, extractors, state,
   extensions, middleware, Tower or Tower-HTTP layers, CORS, cookies, headers, Tokio tasks or locks,
   SQLx pools, rejections, error responses, body limits, WebSockets, or Rust HTTP API tests are
@@ -370,7 +372,8 @@ refer to `AGENTS.md` and `.mustflow/config/commands.toml` to implement the most
   egress, CDN, logs, metrics, traces, autoscaling, quotas, budgets, tags, temporary resources,
   container registries, Marketplace, LLM API, or third-party SaaS usage needs review for whether
   spend can silently explode without account isolation, caps, lifecycle, retention, attribution,
-  or automated non-production stop guardrails.
+  or automated non-production stop guardrails. For CI runner-minute, workflow matrix, artifact
+  retention, cache quota, or release-asset handoff cost, use `ci-pipeline-triage` first.
 - Use `rate-limit-integrity-review` as an adjunct when rate limits, throttling, quotas, API usage
   limits, request costs, token buckets, fixed or sliding windows, GCRA, Redis counters, edge,
   gateway, service, tenant, user, API key, route-group, IP, 429, `Retry-After`, `RateLimit`,
@@ -495,7 +498,7 @@ routes. Event routes stay inactive until their event occurs.
 | Reported API, SDK, browser, mobile, webhook, gateway, CDN, load balancer, provider, wrong-status, wrong-body, CORS preflight, auth, rate-limit, cache, OpenAPI, or deployment-config failure is not yet localized to the client, network, proxy, app, database, cache, provider, or deployment boundary | `.mustflow/skills/api-failure-triage/SKILL.md` | Failing request packet, success comparator, boundary ledger, timing ledger, contract ledger, auth ledger, change ledger, redaction constraints, and configured command intents | Request/response evidence preservation, success/failure wire comparison, boundary localization, timing decomposition, status/body/content-type mapping, CORS/preflight split, redirect and proxy header checks, authn/authz split, retry/timeout/rate-limit/idempotency classification, cache and OpenAPI drift checks, focused reproduction fixtures, and directly synchronized docs or templates | log-first debugging, SDK argument theater, missing failing packet, success-only comparison, CORS blamed for server-to-server calls, redirect losing auth or method, proxy stripping idempotency or trace headers, `200` error body, HTML body with JSON content type, authn/authz collapse, object-auth incident missed, clock-skew flake, retry storm, non-idempotent replay, 429 hidden as 500, stale CDN or browser cache, OpenAPI drift, deployment config drift, or unfalsifiable log reading | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | API failure triaged, request packet and comparator, boundary and timing ledger, localized cause or evidence gap, hypotheses killed or open, fix or recommendation, evidence level, verification, and remaining API-failure risk |
 | Login, signup, logout, refresh, password reset, magic link, passkey, MFA, OAuth, OIDC, JWT, cookie, session, token exchange, provider callback, account-linking, or authorization-after-login behavior is failing or intermittent before the failing identity boundary is known | `.mustflow/skills/auth-flow-triage/SKILL.md` | Auth attempt packet, stage ledger, token and session ledger, browser and proxy ledger, provider ledger, denial and privacy ledger, redaction constraints, and configured command intents | Auth stage localization, sanitized success/failure comparison, cookie and CORS credential checks, proxy trust and redirect URI checks, state, nonce, PKCE, issuer and subject checks, token and JWKS validation, session refresh and logout checks, passkey and MFA checks, account-linking checks, focused denial tests, and directly synchronized docs or templates | login-as-one-bucket debugging, token or cookie logging, account enumeration, loose redirect matching, state or nonce bypass, PKCE mismatch hidden, issuer plus subject ignored, SameSite or Secure drift, forwarded-header trust bug, refresh-token race, session fixation, email-only account linking, stale token claims, clock-skew flake, broad CORS wildcard, or unverified provider-console assumption | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `test_audit`, `docs_validate_fast`, `test_release`, `mustflow_check` | Auth flow triaged, failing stage and comparator, cookie/proxy/provider/token/session/passkey/MFA findings, fix or recommendation, evidence level, verification, and remaining auth-flow risk |
 | Docker Engine, Docker Desktop, daemon, context, Compose, container start, crash loop, health check, image pull, build cache, port mapping, DNS, network, volume, bind mount, storage, proxy, registry, cgroup, OOM, signal handling, PID 1, or runtime behavior is failing before the failing container boundary is known | `.mustflow/skills/docker-runtime-triage/SKILL.md` | Runtime packet, container ledger, actual config ledger, host resource ledger, network ledger, storage ledger, evidence-preservation constraints, and configured command intents | Host, daemon, context, image, container, Compose, process, resource, storage, network, proxy, registry, and build boundary localization; evidence preservation before cleanup; focused Dockerfile, Compose, health, entrypoint, network, volume, resource, docs, fixture, or test edits only after localization | prune-before-evidence, restart loop hiding first error, app blame before daemon proof, logs-only diagnosis, exit code 137 treated as automatic OOM, PID 1 signal loss, container localhost confusion, bind mount hiding image files, Compose variable drift, tag identity confusion, stale build cache, broad firewall reset, volume deletion, or unbounded raw Docker command | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Docker runtime triaged, boundary findings, evidence preserved and missing, fix or recommendation, evidence level, verification, and remaining Docker runtime risk |
-| CI/CD workflow, pipeline, job, matrix, trigger, required check, runner, cache, artifact, deployment step, or post-deploy verification is failing, skipped, queued, flaky, slow, or green despite broken output before the failing pipeline boundary is known | `.mustflow/skills/ci-pipeline-triage/SKILL.md` | Failure classification, run identity ledger, last-good comparison, boundary ledger, redaction constraints, and configured command intents | Trigger, parsed graph, queue, runner, environment, dependency, build, test, cache, artifact, deploy, smoke, and final status localization; false-green checks; safe diagnostic evidence; focused workflow, package, docs, fixture, or test edits only after localization | last-red-line debugging, latest-code comparison, rerun-green treated as fixed, skipped required check, path-filter pending state, hidden `continue-on-error`, queue time mistaken for build time, floating `latest`, secret logging, sleep-based service readiness, cache-as-artifact confusion, deploying untested rebuilt artifacts, fork token scope surprise, unguarded environment concurrency, or zero-exit deploy without smoke evidence | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | CI pipeline triaged, failure shape and localized boundary, run identity and last-good comparison, trigger/runner/environment/build/test/cache/artifact/deploy/verification findings, verification, and remaining CI pipeline risk |
+| CI/CD workflow, pipeline, job, matrix, trigger, required check, runner, cache, artifact, runner-minute billing, artifact storage or retention, deployment step, or post-deploy verification is failing, skipped, queued, flaky, slow, unexpectedly expensive, or green despite broken output before the failing or expensive pipeline boundary is known | `.mustflow/skills/ci-pipeline-triage/SKILL.md` | Failure classification, run identity ledger, last-good comparison, CI billing ledger when cost is in scope, boundary ledger, redaction constraints, and configured command intents | Trigger, parsed graph, queue, runner, environment, dependency, build, test, cache, artifact, billing, deploy, smoke, and final status localization; false-green checks; runner-minute and storage-quota separation; safe diagnostic evidence; focused workflow, package, docs, fixture, or test edits only after localization | last-red-line debugging, latest-code comparison, rerun-green treated as fixed, skipped required check, path-filter pending state, hidden `continue-on-error`, queue time mistaken for build time, runner-minute billing mistaken for artifact storage, plan allowance unit confusion, matrix split rounding loss, premium runner surprise, floating `latest`, secret logging, sleep-based service readiness, cache-as-artifact confusion, deploying untested rebuilt artifacts, fork token scope surprise, unguarded environment concurrency, or zero-exit deploy without smoke evidence | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | CI pipeline triaged, failure or cost shape and localized boundary, run identity and last-good comparison, trigger/runner/environment/build/test/cache/artifact/billing/deploy/verification findings, verification, and remaining CI pipeline risk |
 
 ### General Code Change
 
@@ -538,7 +541,7 @@ routes. Event routes stay inactive until their event occurs.
 | Code review or implementation needs observability-debuggability triage for logs, metrics, traces, spans, structured events, telemetry context, collectors, exporters, telemetry queues, dashboards, alerts, runbooks, sampling, redaction, dependency calls, queues, batch jobs, caches, pools, rate limits, feature flags, releases, migrations, or partial-success paths where operators need to narrow incidents quickly without high-cardinality metric explosions, missing denominator counters, lost trace context, silent telemetry loss, or sensitive telemetry leakage | `.mustflow/skills/observability-debuggability-review/SKILL.md` | Incident question, signal inventory, request or job identity, metric model, trace and event model, log model, operational domain, telemetry pipeline evidence, privacy and retention constraints, verification evidence, and configured command intents | Structured event names, safe reason codes, total and failure counters, latency distributions, low-cardinality labels, trace and span context, dependency and operation names, async propagation, per-attempt telemetry, queue or batch lag signals, pool saturation metrics, release and feature attribution, telemetry self-metrics, signal pipeline survival checks, redaction, focused tests, and directly synchronized docs or templates | success-only log, no denominator, average-only latency, mixed success and error latency, raw URL label, raw user label, raw SQL telemetry, high-cardinality metric label, missing trace or span id, broken async trace propagation, attempt and operation collapse, generic timeout bucket, missing dependency name, missing idempotency or message evidence, missing queue age, missing batch last-success timestamp, missing pool saturation, missing release attribution, decorative metric, alert without action, dropped telemetry invisible, read-path visibility blind spot, sampling drops errors, unsafe baggage, or sink-side-only masking | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Observability boundary reviewed, incident question and signal ledger, metric/trace/log/pipeline/cardinality/privacy findings, evidence level, verification, and remaining observability-debuggability risk |
 | Code review, runbook work, or incident report needs incident-triage review for outages, degradations, timeout spikes, p95 or p99 latency spikes, queue backlog, pool saturation, CPU-idle slowness, memory pressure, OOM, disk or inode pressure, DNS or network failure, load balancer 5xx, Kubernetes node or pod issues, deployment regression, cache stampede, cron or batch spikes, Redis slowdown, DB lock waits, connection leaks, ephemeral-port exhaustion, conntrack saturation, or log floods where operators need to narrow the first bad time, affected slice, recent change, wait class, dependency, and manual-only diagnostics before reading every log | `.mustflow/skills/incident-triage-review/SKILL.md` | Incident frame, time evidence, scope axes, saturation and wait evidence, dependency evidence, change evidence, safety constraints, repository runbook or telemetry evidence, and configured command intents | Runbook steps, alert metadata, incident evidence checklists, telemetry contract notes, dashboard descriptions, test fixtures, docs, and directly synchronized templates that preserve first-bad-time, scope split, change ledger, wait classification, dependency split, success-versus-failure comparison, and manual-only diagnostic boundaries | average-only latency, all-logs-first triage, deployment dismissal, success-only comparison, proxy/app 5xx mixing, app-log-only OOM review, CPU-idle slowness ambiguity, DB-index reflex, pool-wait blindness, queue-lag understatement, cache-hit-rate overtrust, ping-only network checks, pod-only Kubernetes review, disk-capacity-only checks, log-volume blind spots, private incident-log capture, or raw live diagnostic commands treated as agent-authorized | `changes_status`, `changes_diff_summary`, `docs_validate_fast`, `test_release`, `mustflow_check` | Incident boundary reviewed, first bad time and affected scope, change/success-failure/latency/resource/wait/dependency evidence, elimination ledger, manual-only diagnostics, verification, and remaining incident-triage risk |
 | Code review, implementation, runbook work, or release preparation needs deployment-rollout safety review for server, backend, worker, scheduler, queue, cron, container, VM, serverless, DB migration, config, feature flag, cache, deployment pipeline, release envelope, image digest, deployment history, traffic rollback, canary, rollback, health check, readiness/liveness/startup probe, graceful shutdown, artifact promotion, release observability, or post-deploy smoke behavior where the deploy must be rolled out, stopped, observed, and rolled back safely | `.mustflow/skills/deployment-rollout-safety-review/SKILL.md` | Deployment resource ledger, release envelope, artifact identity, environment promotion path, deployment model, compatibility matrix, config diff, migration order, rollback history, traffic rollback path, cache and message compatibility, probe model, shutdown and drain behavior, canary cohort, version-split telemetry, stop conditions, rollback limits, synthetic transactions, post-deploy metrics, and configured command intents | Runbooks, release checklists, pipeline metadata, smoke tests, probe tests, config validation, feature-flag defaults, cache-key versions, worker-drain handling, deployment attribution, rollback compatibility notes, focused tests, and directly synchronized templates | unknown blast radius, missing release id, mutable latest tag, tag without digest, per-environment rebuild drift, deleted rollout history, cold old version, traffic rollback tied to rebuild, code and migration lockstep, destructive rollback SQL overclaim, missing PITR practice, config in-place mutation, missing startup config validation, process-only health check, readiness/liveness/startup probe collapse, liveness restart loop, ungraceful shutdown, load balancer drain shorter than app shutdown, worker work loss, non-idempotent queue retry, N-1 message incompatibility, unknown event poison message, missing external compensation, API N-1 or N+1 break, missing kill switch, unsafe flag fallback, vague canary cohort, global-average canary metrics, no automatic stop condition, read-only smoke, log format alert breakage, blanket cache flush, scheduler duplicate execution, CRD or operator downgrade break, missing deployment lock, production command without dry-run, or code-only rollback overclaim | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Deployment rollout boundary reviewed, resource ledger and release envelope, artifact identity, config/migration/cache/queue/API/probe/shutdown/canary/rollback/observation findings, verification, and remaining deployment-rollout risk |
-| Code review, implementation, runbook work, or infrastructure review needs cloud-cost-guardrail review for cloud accounts, projects, subscriptions, environments, Kubernetes namespaces, serverless, databases, object storage, block storage, snapshots, NAT, private endpoints, public IPs, egress, CDN, logs, metrics, traces, autoscaling, quotas, budgets, tags, temporary resources, container registries, Marketplace, LLM APIs, external APIs, or third-party SaaS where spend must be attributed, capped, lifecycle-managed, alerted, and safely stoppable before a silent bill explosion | `.mustflow/skills/cloud-cost-guardrail-review/SKILL.md` | Cost surface ledger, budget actual and forecast thresholds, automated non-production action path, account or project isolation, quota and cap model, tag taxonomy, temporary resource expiration, network cost model, telemetry cost model, storage lifecycle model, commitment baseline, Marketplace or LLM usage limits, and configured command intents | Cost guardrail docs, infrastructure policy files, review checklists, tag schemas, quota notes, budget-action runbooks, cleanup rules, retention defaults, autoscale caps, Kubernetes ResourceQuota and LimitRange notes, registry lifecycle policies, provider usage caps, focused tests, and directly synchronized templates | notification-only budget, imagined hard spending limit, mixed prod and dev account, over-wide service quota, missing owner tag, tag-key chaos, no expires_at, stopped VM with NAT or DB still running, unbounded autoscale, missing Kubernetes ResourceQuota, inflated requests growing nodes, cloud-native service through NAT, untracked egress, cross-AZ surprise, idle public IPv4, no CDN cache cost control, log ingest flood, infinite retention, high-cardinality metric label, unbounded flow or audit logs, object lifecycle missing, cold-storage minimum-duration trap, stale block volume type, snapshot landfill, sticky DB storage growth, unbounded registry images, premature commitment, stateful spot misuse, unmonitored Marketplace or LLM spend, or no safe cost stop runbook | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Cloud cost boundary reviewed, cost surface ledger, budget and action model, isolation/quota/tag/autoscale/Kubernetes/network/telemetry/storage/registry/commitment/spot/Marketplace/LLM/SaaS guardrail findings, manual-only provider checks, verification, and remaining cloud-cost risk |
+| Code review, implementation, runbook work, or infrastructure review needs cloud-cost-guardrail review for cloud accounts, projects, subscriptions, environments, Kubernetes namespaces, serverless, databases, object storage, block storage, snapshots, NAT, private endpoints, public IPs, egress, CDN, logs, metrics, traces, autoscaling, quotas, budgets, tags, temporary resources, container registries, Marketplace, LLM APIs, external APIs, or third-party SaaS where spend must be attributed, capped, lifecycle-managed, alerted, and safely stoppable before a silent bill explosion | `.mustflow/skills/cloud-cost-guardrail-review/SKILL.md` | Cost surface ledger, budget actual and forecast thresholds, automated non-production action path, account or project isolation, quota and cap model, tag taxonomy, temporary resource expiration, network cost model, telemetry cost model, storage lifecycle model, commitment baseline, Marketplace or LLM usage limits, and configured command intents | Cost guardrail docs, infrastructure policy files, review checklists, tag schemas, quota notes, budget-action runbooks, cleanup rules, retention defaults, autoscale caps, Kubernetes ResourceQuota and LimitRange notes, registry lifecycle policies, provider usage caps, focused tests, and directly synchronized templates. CI runner minutes, workflow matrix cost, artifact retention, cache quota, and release asset handoff route to `ci-pipeline-triage` first | notification-only budget, imagined hard spending limit, mixed prod and dev account, over-wide service quota, missing owner tag, tag-key chaos, no expires_at, stopped VM with NAT or DB still running, unbounded autoscale, missing Kubernetes ResourceQuota, inflated requests growing nodes, cloud-native service through NAT, untracked egress, cross-AZ surprise, idle public IPv4, no CDN cache cost control, log ingest flood, infinite retention, high-cardinality metric label, unbounded flow or audit logs, object lifecycle missing, cold-storage minimum-duration trap, stale block volume type, snapshot landfill, sticky DB storage growth, unbounded registry images, premature commitment, stateful spot misuse, unmonitored Marketplace or LLM spend, CI billing routed to broad cloud review before localizing workflow cost, or no safe cost stop runbook | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Cloud cost boundary reviewed, cost surface ledger, budget and action model, isolation/quota/tag/autoscale/Kubernetes/network/telemetry/storage/registry/commitment/spot/Marketplace/LLM/SaaS guardrail findings, manual-only provider checks, verification, and remaining cloud-cost risk |
 | Code review or implementation needs rate-limit integrity triage for rate limits, throttling, quotas, API usage limits, request costs, token bucket, leaky bucket, fixed window, sliding window counter, sliding window log, GCRA, Redis counters, Lua or EVAL updates, CDN or WAF limits, gateway limits, service limits, tenant, user, API key, route group, IP, 429, `Retry-After`, `RateLimit`, shadow mode, operator reset, async enqueue, cached-hit counting, or concurrency-limit overlap that must protect a named resource without bypass, unfairness, counter drift, storage growth, retry storms, or misleading client hints | `.mustflow/skills/rate-limit-integrity-review/SKILL.md` | Protected resource ledger, cost-weighted request ledger, layer model, key model, algorithm and storage model, failure mode model, response contract, observability and operator evidence, and configured command intents | Protected-resource definitions, request cost weights, per-key policy, layered limit placement, route-template keys, atomic counter updates, TTLs, storage-time use, fail-open or fail-closed policy, blocked-decision cache, shadow mode, 429 response shape, observability fields, operator lookup or reset behavior, focused tests, and directly synchronized docs or templates | algorithm-first limiter, request-count-only quota, IP-only authenticated key, raw URL key explosion, missing identity-header policy, fixed-window boundary burst, costly sliding-window log on hot paths, non-atomic Redis read-modify-write, missing counter TTL, Redis Cluster hash-slot failure, app-server clock reset drift, process-local global quota, approximate edge limit treated as precise, hidden fail-open, free failed responses, rate versus concurrency confusion, unhelpful or leaky 429, synchronized retry wave, unsafe allow-decision cache, no shadow-mode ramp, missing policy id logs, raw Redis reset, unlimited async enqueue, cached CDN hit ambiguity, or rate limit treated as authorization or hard cost control | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Rate-limit policy boundary reviewed, protected resource and cost/layer/key/storage/fail-mode/response/operator model mapped, evidence level, verification, and remaining rate-limit-integrity risk |
 | Code review or implementation needs idempotency-integrity triage for repeated requests, retries, duplicate POST/PATCH/DELETE calls, webhooks, provider callbacks, queue redelivery, scheduler or batch reruns, double clicks, app restarts, timeout recovery, external API callbacks, or duplicate business commands that can apply the same logical operation more than once | `.mustflow/skills/idempotency-integrity-review/SKILL.md` | Operation identity ledger, side-effect ledger, durable dedupe evidence, duplicate response policy, concurrency and recovery evidence, queue/webhook/scheduler/batch evidence, test evidence, and configured command intents | Durable idempotency records, request body hash checks, user and tenant binding, operation-type and target-resource binding, unique constraints, atomic insert-or-return behavior, state guards, affected-row checks, inbox and outbox records, applied-event ledgers, provider result lookup, response replay, processing lease recovery, focused duplicate tests, and directly synchronized docs or templates | POST-only assumption, idempotency key without durable storage, key not bound to payload or actor, memory-only or Redis-TTL-only dedupe, app-only `exists` then `insert`, missing unique index, duplicate success response drift, failed-attempt caching mistake, timeout treated as failure, external API before local operation record, provider idempotency used as internal proof, unconditional status update, duplicate increment, DELETE side-effect replay, GET hidden mutation, queue ack before durable commit, queue redelivery damage, webhook replay or stale event overwrite, scheduler rerun duplication, missing outbox or inbox, double compensation, stuck `PROCESSING`, lock-only proof, frontend-only debounce, or missing duplicate-path tests | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Idempotency boundary reviewed, logical operation and duplicate sources mapped, operation identity/payload/response/recovery evidence, durable dedupe and side-effect findings, tests or evidence level, verification, and remaining idempotency-integrity risk |
 | Code review or implementation needs retry-policy integrity triage for retry loops, SDK retry configs, client middleware, `while true`, `for (;;)`, recursive retry, `maxAttempts`, `maxRetries`, `maxElapsedTime`, deadline, timeout, sleep, backoff, jitter, `Retry-After`, retry predicates, layered retries, circuit breakers, bulkheads, token buckets, queue redelivery, broker retry, cancellation-aware sleep, or retry observability that can amplify failures, duplicate side effects, hide permanent errors, exhaust pools, or overload dependencies | `.mustflow/skills/retry-policy-integrity-review/SKILL.md` | Retry surface, layered retry ledger, attempt budget, retry predicate, side-effect and idempotency ledger, backoff and jitter policy, overload and throttling evidence, observability and test evidence, and configured command intents | Bounded attempts, max elapsed time, per-attempt timeout, total deadline, cancellation propagation, retry predicates, exponential backoff with jitter, `Retry-After` parsing and clamping, idempotency key reuse, dependency-specific policy, retry wrapper diagnostics, per-attempt logs and metrics, focused retry tests, and directly synchronized docs or templates | retry amplification, infinite retry, capped backoff without stop condition, timeout gap for DNS, TLS, pool wait, streaming, or parsing, fixed-sleep herd behavior, broad catch-and-retry, permanent error retry, unknown-outcome replay, new idempotency key per attempt, key not bound to actor or payload, retry inside transaction or lock, pool starvation, unlimited parallel retry, stale per-key failure counter, global limiter unfairness, wrong circuit breaker or bulkhead order, wrapper losing cause/status/retry-after/request id, committed-response retry, non-replayable streaming body retry, app-plus-broker retry multiplication, cancellation-ignoring sleep, generic dependency policy, missing retry metrics, or happy-path-only retry tests | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Retry policy boundary reviewed, layer multiplication and attempt budget mapped, timeout/backoff/predicate/idempotency/throttling findings, evidence level, verification, and remaining retry-policy-integrity risk |
@@ -637,8 +640,8 @@ routes. Event routes stay inactive until their event occurs.
 | Generated or edited code, configuration, CI workflows, package metadata, install instructions, examples, Docker images, framework setup, runtime declarations, toolchain declarations, TypeScript compiler-track references, Rust release or MSRV references, or migration-sensitive snippets introduce explicit external version references, action refs, package ranges, runtime versions, framework majors, Docker image tags, or scaffold commands that may be stale | `.mustflow/skills/version-freshness-check/SKILL.md` | Versioned reference, owning files, repository version policy, approved freshness source, compatibility context, migration risk, TypeScript compiler track or Rust MSRV/toolchain track when relevant, and command contract entries | Package metadata, lockfiles, CI workflows, Dockerfiles, runtime files, framework config, docs, examples, templates, tests, and version-decision reports | stale default version, false latest claim, accidental major migration, repository policy mismatch, unsupported generated example, TypeScript RC/nightly/API-track confusion, Rust stable/nightly/MSRV confusion, floating-tag drift, or unverified security/support claim | `changes_status`, `changes_diff_summary`, `build`, `test_related`, `docs_validate_fast`, `test_release`, `mustflow_check` | Versioned surfaces checked, repository policy and freshness source, selected version track, compatibility classification, TypeScript stable/RC/nightly/API-track and Rust stable/nightly/MSRV split when relevant, approval need, synchronized surfaces, verification, and remaining version-freshness risk |
 | External systems, protocols, SDKs, databases, webhooks, queues, files, object storage, signed upload or download URLs, caches, API response models, framework requests or responses, server actions, route handlers, edge functions, worker handlers, AI models, browser storage, search engines, analytics tools, email platforms, no-code tools, observability backends, trace or request context, provider data, or volatile component implementations cross the core boundary or need stable port/adapter translation, change isolation, error mapping, timeout, retry, circuit-breaker, bulkhead, idempotency, reconciliation, security, core-state ownership, vendor portability, or observability handling | `.mustflow/skills/adapter-boundary/SKILL.md` | External system or protocol, inbound/outbound direction, delivery boundary, internal use case, local port/adapter patterns, provider risk, provider failure policy, core-state ownership risk, vendor portability risk, observability identifier policy, API contract risk, change-isolation ledger, preserved consumer contract, changed files, and command contract entries | Ports, adapters, mappers, controllers, workers, stores, gateways, response mappers, telemetry mappers, timeout and retry policies, circuit breakers, bulkhead boundaries, tests, fixtures, assembly wiring, and directly synchronized docs or templates | provider leakage, caller churn from adapter-only changes, framework business-rule leakage, telemetry backend leakage, storage-key leakage, screen-shaped API coupling, pass-through wrapper, SaaS dashboard as truth source, search or analytics policy leakage, queue contract leakage, unclassified external failure, duplicate side effect, unsafe retry, missing timeout, missing circuit breaker, missing bulkhead, unresolved unknown provider outcome, broken identifier propagation, secret or personal-data leak, or untested integration drift | `changes_status`, `changes_diff_summary`, `test_related`, `test`, `lint`, `build`, `docs_validate_fast`, `test_release`, `mustflow_check` | Boundary classification, change-isolation ledger, preserved consumer contract, delivery adapter responsibility, internal port, provider containment, core-state ownership, vendor portability, validation and mapping, API response mapping, observability identifier flow, timeout/retry/circuit-breaker/bulkhead/idempotency handling, reconciliation behavior, security notes, verification, and remaining provider risk |
 | Third-party SDK or external API integration, review, debugging, upgrade, webhook handling, auth scope change, sandbox or production setup, provider SDK version change, API version migration, rate-limit handling, retry policy, idempotency key usage, pagination, provider error mapping, request id logging, changelog review, deprecation response, or provider operational-readiness test needs production integration review | `.mustflow/skills/third-party-api-integration-review/SKILL.md` | Provider and SDK/API ledger, source-of-truth docs, auth and scope ledger, operation and side-effect ledger, webhook ledger, error and observability ledger, changelog or migration evidence, existing fakes or sandbox tests, and configured command intents | Provider adapters, wrappers, typed request and response models, error mappers, timeout and retry policies, rate-limit handling, idempotency key handling, pagination handling, webhook signature verification and dedupe, redacted observability, sandbox tests, fixtures, runbooks, migration notes, and directly synchronized docs or templates | demo-only integration, stale provider docs, SDK/API drift, sandbox-production mixup, hardcoded secret, overbroad scope, token refresh gap, missing timeout, infinite retry, retrying permanent errors, mutating retry without idempotency, per-attempt idempotency key, 429 retry storm, ignored Retry-After, offset pagination assumption, raw provider error leak, string-only provider error, missing request id, trusted webhook payload, JSON-parsed signature breakage, duplicate webhook side effect, event-order assumption, success redirect as proof, unhandled unknown provider outcome, dashboard-only setting, untested SDK upgrade, or happy-path-only sandbox test | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `test_audit`, `docs_validate_fast`, `test_release`, `mustflow_check` | Third-party integration reviewed, provider source-of-truth and SDK/API version evidence, auth/environment/scope decisions, timeout/retry/rate-limit/idempotency/pagination decisions, webhook delivery and dedupe checks, error and observability mapping, tests or missing evidence, verification, and remaining provider operational risk |
-| Tauri frontend invokes, Rust commands, capabilities, permissions, scopes, plugins, filesystem, dialog, shell, opener, updater, sidecar, or mobile native permissions are created or changed | `.mustflow/skills/tauri-code-change/SKILL.md` | Frontend call sites, Tauri config, Rust commands, capability and permission files, plugin config, changed files, and command contract entries | Tauri frontend, Rust commands, capabilities, permissions, scopes, plugins, tests, and docs | broad native permission, untrusted IPC input, filesystem escape, shell or updater risk, or WebView/native boundary drift | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `mustflow_check` | IPC, permission, scope, filesystem, shell, updater, and native boundary checked, verification, and remaining Tauri risk |
-| Wails v3 applications, Go services, generated bindings, TypeScript runtime calls, windows, menus, system tray, dialogs, events, frontend bridge payloads, WebView platform behavior, Taskfile or build config, signing, packaging, custom protocols, file associations, server builds, or Wails-related tests are created, changed, reviewed, or upgraded | `.mustflow/skills/wails-code-change/SKILL.md` | Wails version track, Go module and frontend package metadata, generated bindings, app entry point, service/window/event/menu/tray/dialog/build/package evidence, changed files, and command contract entries | Wails app assembly, Go services, frontend bridge calls, generated bindings, windows, events, menus, tray, dialogs, WebView platform behavior, platform packaging, tests, and docs | Electron or Wails v2 migration drift, accidental exported RPC, binding or runtime version drift, shared-service race, unsafe frontend input, oversized bridge payload, event leak or broadcast, WebView platform mismatch, or packaging/signing drift | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `mustflow_check` | Wails version/app/service/bridge/binding/window/event/menu/tray/dialog/platform packaging notes, verification, and remaining Wails risk |
+| Tauri frontend invokes, Rust commands, capabilities, permissions, scopes, plugins, filesystem, dialog, shell, opener, updater, sidecar, mobile native permissions, Tauri bundling targets, release package formats, or native desktop CI build matrices are created or changed | `.mustflow/skills/tauri-code-change/SKILL.md` | Frontend call sites, Tauri config, Rust commands, capability and permission files, plugin config, bundle targets, release matrix evidence, changed files, and command contract entries | Tauri frontend, Rust commands, capabilities, permissions, scopes, plugins, bundle target narrowing, package target notes, tests, and docs | broad native permission, untrusted IPC input, filesystem escape, shell or updater risk, WebView/native boundary drift, all-target bundling surprise, cold Cargo cache cost, duplicated macOS packaging jobs, or long-retention CI artifacts posing as release assets | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `mustflow_check` | IPC, permission, scope, filesystem, shell, updater, native boundary, bundle target, release matrix, artifact retention, verification, and remaining Tauri risk |
+| Wails v3 applications, Go services, generated bindings, TypeScript runtime calls, windows, menus, system tray, dialogs, events, frontend bridge payloads, WebView platform behavior, Taskfile or build config, signing, packaging, platform targets, native desktop CI build matrices, custom protocols, file associations, server builds, or Wails-related tests are created, changed, reviewed, or upgraded | `.mustflow/skills/wails-code-change/SKILL.md` | Wails version track, Go module and frontend package metadata, generated bindings, app entry point, service/window/event/menu/tray/dialog/build/package evidence, platform target and release matrix evidence, changed files, and command contract entries | Wails app assembly, Go services, frontend bridge calls, generated bindings, windows, events, menus, tray, dialogs, WebView platform behavior, platform packaging, target narrowing, tests, and docs | Electron or Wails v2 migration drift, accidental exported RPC, binding or runtime version drift, shared-service race, unsafe frontend input, oversized bridge payload, event leak or broadcast, WebView platform mismatch, packaging/signing drift, all-platform PR packaging, duplicated macOS packaging jobs, or long-retention CI artifacts posing as release assets | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `mustflow_check` | Wails version/app/service/bridge/binding/window/event/menu/tray/dialog/platform packaging, release matrix, artifact retention notes, verification, and remaining Wails risk |
 | File path handling, cross-platform path behavior, path helpers, safe filesystem wrappers, clone or checkout destinations, scaffold roots, temp or cache paths, atomic writes, locks, archive extraction, uploads, downloads, scanners, CLI/API/schema path contracts, snapshots, generated outputs, or package artifact paths are created, changed, reviewed, or reported | `.mustflow/skills/file-path-cross-platform-change/SKILL.md` | Path ledger, trust classes, accepted path representation, base root, path helpers, safe filesystem wrappers, clone/checkout/scaffold/install/extract outputs, staging and promotion policy, temp/cache helpers, lock policy, archive policy, upload/download policy, scanner policy, CLI/API/schema/snapshot/generated/package surfaces, platform expectations, failure taxonomy, and command contract entries | Path validators, helpers, wrappers, schemas, CLI/API parsing, snapshots, fixtures, docs, tests, generated-output paths, package artifact paths, clone or scaffold destinations, archive extraction, scanner bounds, temp/cache handling, locks, and cleanup code | path traversal, base containment bypass, drive-relative path bug, reserved-name bug, case-collision bug, Unicode-collision bug, Git checkout path-length failure misreported as network or auth, unsafe archive extraction, non-atomic write claim, stale lock, scanner loop, partial-output cleanup data loss, user-selected destination deletion, path contract drift, or package artifact path drift | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Path contract, path ledger, trust classes, root policy, preflight/staging/promotion decisions, Windows/macOS/Linux/archive/upload/download/scanner/lock/temp/cache/atomic/cleanup decisions, failure taxonomy, synchronized contract surfaces, verification, and remaining path risk |
 | File paths, directories, symlinks, real paths, traversal, atomic writes, file copies, generated outputs, temporary files, clone or checkout materialization, cleanup, or Windows/POSIX filesystem behavior are created, changed, reviewed, or reported | `.mustflow/skills/cross-platform-filesystem-safety/SKILL.md` | Path inputs, base directory, trust boundary, symlink policy, write or cleanup strategy, clone/checkout/scaffold/install/extract path budget, app-owned staging boundary, platform expectations, failure taxonomy, and command contract entries | Path validation, file helpers, copy/update/delete code, clone/scaffold/archive cleanup code, scan bounds, fixtures, tests, docs, and templates | path traversal, symlink escape, unsafe overwrite, platform-only behavior, stale output, path-length or filename-length misclassification, watcher/resource misclassification, or cleanup data loss | `changes_status`, `changes_diff_summary`, `test_related`, `docs_validate_fast`, `test_release`, `mustflow_check` | Path trust classes, root boundary, symlink/write/delete/scan decisions, preflight and staging boundaries, clone/scaffold/extract classification, platform assumptions, verification, and remaining filesystem risk |
 | Child processes, shell or argv execution, built-in command reruns, Git/package-manager/scaffolder failures, timeouts, process trees, output limits, streaming, environment policy, command eligibility, failure classification, command-line length limits, or execution receipts are created, changed, reviewed, or reported | `.mustflow/skills/process-execution-safety/SKILL.md` | Execution path, timeout, output limit, stdin, argv and shell command-length budget, environment, cwd, process tree behavior, failure taxonomy, receipt and write-tracking expectations, and command contract entries | Process execution code, process-tree helpers, output buffers, environment creation, eligibility checks, failure classifiers, receipts, tests, and docs | runaway process, unbounded output, leaked environment, argv-too-long failure, shell-command-too-long failure, inconsistent JSON/text execution, false cleanup claim, Git checkout path failure misreported as network or auth, blind retry, diagnostic loss, or unreliable receipt | `changes_status`, `changes_diff_summary`, `test_related`, `test_release`, `mustflow_check` | Execution surface, timeout/output/environment/process-tree boundaries, argv and shell length handling, failure classification, diagnostic preservation, receipt consistency, tests, verification, and remaining process risk |

package/templates/default/locales/en/.mustflow/skills/ci-pipeline-triage/SKILL.md

@@ -2,11 +2,11 @@
 mustflow_doc: skill.ci-pipeline-triage
 locale: en
 canonical: true
-revision: 1
+revision: 2
 lifecycle: mustflow-owned
 authority: procedure
 name: ci-pipeline-triage
-description: Apply this skill when a CI/CD workflow, pipeline, job, runner, matrix, trigger, cache, artifact, deployment job, required check, or post-deploy verification is failing, skipped, queued, flaky, slow, green despite broken output, or not yet localized to trigger, runner, environment, build, test, artifact, deploy, or verification boundaries.
+description: Apply this skill when a CI/CD workflow, pipeline, job, runner, matrix, trigger, cache, artifact, runner-minute billing, artifact storage or retention, deployment job, required check, or post-deploy verification is failing, skipped, queued, flaky, slow, unexpectedly expensive, green despite broken output, or not yet localized to trigger, runner, environment, build, test, cache, artifact, billing, deploy, or verification boundaries.
 metadata:
   mustflow_schema: "1"
   mustflow_kind: procedure
@@ -46,6 +46,9 @@ changed from the last known-good run, and what evidence would disprove each boun
   deployment permissions, rollout completion, or post-deploy verification.
 - A pipeline suddenly breaks without application-code changes, or only fails on forks, protected
   branches, specific runners, specific regions, specific matrix entries, or reruns.
+- A CI workflow becomes unexpectedly expensive, burns private-repository minutes too quickly,
+  exhausts artifact storage, keeps long-lived test artifacts, or needs a release matrix cost review
+  before the expensive boundary is known.
 
 <!-- mustflow-section: do-not-use-when -->
 ## Do Not Use When
@@ -66,6 +69,10 @@ changed from the last known-good run, and what evidence would disprove each boun
 - Run identity ledger: commit SHA, branch or tag, trigger event, workflow file revision, matrix
   entry, runner label and image, architecture, region, toolchain versions, package-manager version,
   execution time, and run or job id.
+- CI billing ledger when cost is in scope: public versus private repository behavior, plan or
+  allowance snapshot, provider billing page or docs date, runner OS and size, job count, matrix
+  shape, per-job rounding behavior, queue versus execution time, artifact retention days, cache
+  retention or quota, and release asset handoff.
 - Last-good comparison: last successful commit and first failing commit, including workflow files,
   lockfiles, base images, shared scripts, secrets or permission scopes, runner labels, cache keys,
   feature flags, deployment config, and required-check settings.
@@ -88,9 +95,9 @@ changed from the last known-good run, and what evidence would disprove each boun
 ## Allowed Edits
 
 - Add or tighten workflow triggers, path filters, matrix guards, version pinning, cache keys,
-  artifact manifests, status aggregation, debug evidence collection, secret-safe diagnostics,
-  timeout classification, runner labels, concurrency locks, environment validation, smoke checks,
-  test isolation, docs, and focused fixtures.
+  artifact manifests, artifact retention, release-asset promotion, status aggregation, debug
+  evidence collection, secret-safe diagnostics, timeout classification, runner labels, concurrency
+  locks, environment validation, smoke checks, test isolation, docs, and focused fixtures.
 - Add tests or docs that prove workflow contract behavior, package metadata, template output,
   release checks, artifact identity, or command-contract mapping when the repository owns those
   surfaces.
@@ -134,21 +141,37 @@ changed from the last known-good run, and what evidence would disprove each boun
     dimensions. Artifacts need file list, size, hash, build SHA, and download verification.
 14. Verify that the tested artifact is the deployed artifact. Rebuilding during deploy can make CI
     test one thing and production receive another.
-15. Check auth and permissions by execution context. Fork PRs, protected branches, environments,
+15. For CI cost or quota questions, split the bill before optimizing:
+    - runner execution minutes, not artifact bytes, usually dominate native app release cost;
+    - macOS or other premium runners can dominate a matrix even when Linux jobs are longer;
+    - job-level minimum billing or rounding can make many tiny split jobs cost more than one
+      grouped job;
+    - public repository standard-runner rules can differ from private repository included minutes;
+    - billing pages may display currency spend while plan allowances are minute or storage quotas,
+      so confirm the unit before comparing options.
+16. Separate Actions artifacts, caches, package registries, and release assets. Short-lived test
+    bundles should use short retention. Long-lived distributables should be promoted through the
+    repository's release or package channel when that is the intended public artifact. Do not treat
+    cache quota as artifact storage or release assets as CI retention.
+17. For native desktop matrices, avoid full bundles on every PR unless the repository explicitly
+    requires it. Prefer PR checks that prove frontend build plus native compile or type contracts on
+    the cheapest adequate runner, then run signed or full OS package matrices only on release tags,
+    release branches, or protected manual gates.
+18. Check auth and permissions by execution context. Fork PRs, protected branches, environments,
     OIDC identity, package publishing identity, cloud role, and repository token scopes can differ
     across otherwise similar runs.
-16. For deployment jobs, require rollout evidence, readiness, smoke checks, error and latency
+19. For deployment jobs, require rollout evidence, readiness, smoke checks, error and latency
     thresholds, and environment concurrency locks instead of treating a zero exit code as success.
-17. Preserve evidence before cleanup. Do not delete runners, caches, artifacts, temporary dirs, or
+20. Preserve evidence before cleanup. Do not delete runners, caches, artifacts, temporary dirs, or
     diagnostic logs until the boundary and redaction plan are clear.
-18. Apply the smallest localized fix and verify with the narrowest configured intent that covers the
+21. Apply the smallest localized fix and verify with the narrowest configured intent that covers the
     changed workflow, package, docs, template, or test surface.
 
 <!-- mustflow-section: postconditions -->
 ## Postconditions
 
-- The pipeline failure is localized to trigger, runner, environment, build, test, artifact, deploy,
-  verification, or a named evidence gap.
+- The pipeline failure is localized to trigger, runner, environment, build, test, artifact, billing
+  or storage quota, deploy, verification, or a named evidence gap.
 - Last-good versus first-failure comparison, run identity, false-green risk, cache and artifact
   behavior, permission scope, and rerun determinism are explicit where relevant.
 - Follow-up deployment, test performance, security, command-contract, or package-release work is
@@ -178,6 +201,9 @@ CI reruns, deploys, cloud shell commands, or provider dashboard writes outside t
 
 - If run identity, last-good comparison, trigger graph, runner, cache, artifact, or permission
   evidence is missing, report the missing field instead of guessing.
+- If CI pricing, included minutes, storage quotas, or runner rates are time-sensitive and not
+  locally available, avoid exact price claims and name the provider billing evidence that must be
+  checked.
 - If debug logs contain secrets or private data, stop copying raw output and summarize safely.
 - If CI evidence requires remote provider access that is unavailable or unconfigured, report the
   manual evidence boundary and continue with local workflow or static evidence.
@@ -191,6 +217,8 @@ CI reruns, deploys, cloud shell commands, or provider dashboard writes outside t
 - Failure shape and localized boundary
 - Run identity and last-good comparison
 - Trigger, runner, environment, build, test, cache, artifact, deploy, and verification findings
+- Billing unit, runner-minute, matrix rounding, artifact retention, cache quota, and release asset
+  findings when cost is in scope
 - Hypotheses killed, still open, and selected follow-up boundary
 - Fix applied or recommended
 - Evidence level: provider run evidence, configured-test evidence, static review risk, manual-only,

package/templates/default/locales/en/.mustflow/skills/cloud-cost-guardrail-review/SKILL.md

@@ -2,7 +2,7 @@
 mustflow_doc: skill.cloud-cost-guardrail-review
 locale: en
 canonical: true
-revision: 1
+revision: 2
 lifecycle: mustflow-owned
 authority: procedure
 name: cloud-cost-guardrail-review
@@ -65,6 +65,9 @@ lifecycle cleanup, and service-specific caps before the bill becomes the first a
   narrower security skill first, then use this skill for spend blast radius.
 - The task only changes local development code with no cloud, provider, telemetry, storage,
   network, external API, or deployable infrastructure surface.
+- The task is primarily CI runner minutes, workflow matrix cost, Actions artifact retention,
+  build-cache quota, release asset handoff, or CI job billing; use `ci-pipeline-triage` first, then
+  return here only when broader cloud, SaaS, or provider spend guardrails remain.
 
 <!-- mustflow-section: required-inputs -->
 ## Required Inputs

package/templates/default/locales/en/.mustflow/skills/tauri-code-change/SKILL.md

@@ -2,11 +2,11 @@
 mustflow_doc: skill.tauri-code-change
 locale: en
 canonical: true
-revision: 3
+revision: 4
 lifecycle: mustflow-owned
 authority: procedure
 name: tauri-code-change
-description: Apply this skill when Tauri frontend invokes, Rust commands, capabilities, permissions, scopes, plugins, filesystem, dialog, shell, opener, updater, sidecar, or mobile native permissions are created or changed.
+description: Apply this skill when Tauri frontend invokes, Rust commands, capabilities, permissions, scopes, plugins, filesystem, dialog, shell, opener, updater, sidecar, mobile native permissions, Tauri bundling targets, release package formats, or native desktop CI build matrices are created or changed.
 metadata:
   mustflow_schema: "1"
   mustflow_kind: procedure
@@ -38,6 +38,8 @@ Treat the WebView as low trust and the Rust/native side as high authority. Front
 - `src-tauri`, `tauri.conf.*`, `Cargo.toml`, `#[tauri::command]`, `invoke`, Tauri JavaScript APIs, plugin config, capabilities, permissions, scopes, CSP, WebView bootstrap HTML, fs, dialog, shell, opener, updater, sidecar, mobile manifests, or native permissions change.
 - A frontend button, menu, or workflow calls native resources through Tauri.
 - A packaged Tauri app shows a blank or black WebView after release and browser console or built HTML may point to Content Security Policy blocking the frontend bootstrap.
+- Tauri release packaging, `bundle.targets`, platform target triples, updater artifacts, signing,
+  or CI matrix behavior changes.
 
 <!-- mustflow-section: do-not-use-when -->
 ## Do Not Use When
@@ -49,6 +51,9 @@ Treat the WebView as low trust and the Rust/native side as high authority. Front
 ## Required Inputs
 
 - Frontend package metadata, static build output or generated entry HTML, Tauri config, Rust manifests, main/lib command modules, command registration, capability and permission files, plugin config, updater config, sidecar config, mobile permissions, and tests.
+- Build and release evidence when packaging is in scope: CI workflow or task definitions, runner
+  OS matrix, package formats, `bundle.targets`, Rust and frontend cache strategy, signing or
+  notarization gates, updater artifacts, artifact retention, and release asset upload path.
 - Map of frontend calls to Rust commands or plugin APIs, permission scopes, exact window labels, exact webview labels, CSP directives, remote origins, WebView custom protocols or IPC origins, and actual OS resources.
 - Permission diff: previous permissions, new permissions, newly reachable windows/webviews, new scopes, and native operations enabled.
 - Configured verification intents.
@@ -69,6 +74,8 @@ Treat the WebView as low trust and the Rust/native side as high authority. Front
 - Prefer app-owned directories and stable app IDs over broad filesystem paths.
 - Keep shell, opener, sidecar, and updater behavior narrowly scoped.
 - Prefer Rust commands that map small enums or ids to fixed native operations over exposing broad plugin APIs directly to the frontend.
+- Keep package target lists explicit. Do not rely on broad "all targets" behavior when the product
+  only ships a small set of installers or archives.
 
 <!-- mustflow-section: procedure -->
 ## Procedure
@@ -81,7 +88,9 @@ Treat the WebView as low trust and the Rust/native side as high authority. Front
 6. Apply the CSP and WebView bootstrap policy below before tightening `script-src`, `connect-src`, `style-src`, `worker-src`, `img-src`, `font-src`, or remote-origin policy.
 7. Apply the command input policy below before adding or changing `#[tauri::command]` handlers or `invoke` wrappers.
 8. Apply the filesystem, dialog, shell, opener, updater, and sidecar policies below when those plugins or native operations are touched.
-9. Choose configured verification intents that cover Rust, frontend, Tauri build, permission/capability drift, CSP behavior, and security-sensitive behavior when available.
+9. Apply the build and release matrix policy below when `tauri.conf.*`, release scripts, CI
+   workflows, updater artifacts, signing, or bundle targets change.
+10. Choose configured verification intents that cover Rust, frontend, Tauri build, permission/capability drift, CSP behavior, and security-sensitive behavior when available.
 
 ## Capability And Permission Policy
 
@@ -138,6 +147,28 @@ Treat the WebView as low trust and the Rust/native side as high authority. Front
 - Frontend update input may select only a closed channel enum when needed. Rust or static config must map that enum to hard-coded HTTPS endpoints and configured public keys.
 - Do not enable insecure updater transport in production unless the user explicitly accepts the supply-chain boundary change and the repository records why.
 
+## Build And Release Matrix Policy
+
+- Treat Tauri release builds as Rust release builds plus frontend build plus bundling. Cold Cargo
+  builds can dominate CI time, so check Rust cache, Node or package-manager cache, lockfile keys,
+  and target-specific cache dimensions before blaming frontend code.
+- Do not run full native bundles for every pull request by default. Prefer PR checks that prove the
+  frontend build, Rust compile or checks, command contracts, and permission files on the cheapest
+  adequate runner. Reserve full Windows, Linux, macOS, signing, notarization, updater, and installer
+  matrices for release tags, release branches, or protected manual gates unless the repository
+  explicitly requires more.
+- Keep `bundle.targets` or equivalent packaging configuration to the formats actually shipped. Do
+  not leave broad all-format packaging enabled when the release only needs, for example, one Windows
+  installer, one macOS disk image or app bundle, and one Linux package format.
+- For macOS distribution, prefer one deliberate universal or architecture-specific strategy rather
+  than accidental duplicate jobs. Name signing and notarization boundaries separately from compile
+  time.
+- Keep test artifacts short-lived and promote durable distributables through the release or package
+  channel. Do not use long-retention CI artifacts as the canonical release surface.
+- If a cost comparison between Tauri and another desktop stack is requested, route the CI billing,
+  runner-minute, artifact-storage, and matrix-shape analysis through `ci-pipeline-triage`; use this
+  skill for Tauri-specific bundle targets, Cargo cache, updater, signing, and packaging behavior.
+
 ## Review Rejection Criteria
 
 Reject or revise a change when:
@@ -163,6 +194,8 @@ Reject or revise a change when:
 - Permission and capability changes have a clear diff and native-operation justification.
 - CSP changes have been checked against the generated frontend entry HTML and required Tauri IPC or custom protocol origins.
 - Missing Tauri-specific verification is reported.
+- Tauri package targets, release matrix, cache strategy, and artifact retention are explicit when
+  packaging is touched.
 
 <!-- mustflow-section: verification -->
 ## Verification
@@ -188,6 +221,9 @@ Report missing native build, packaged WebView smoke, CSP violation, permission d
 - If a CSP change breaks packaged app startup, inspect generated HTML and console CSP violations before widening policy; prefer nonce, hash, or externalized bootstrap before accepting `unsafe-inline`.
 - If a command accepts broad input, replace it with a typed request and Rust-side validation before exposing it to the frontend.
 - If updater, shell, opener, sidecar, or filesystem access cannot be narrowed, report the security boundary change instead of hiding it as a normal feature fix.
+- If packaging cost or duration grows unexpectedly, check `bundle.targets`, release-only matrix
+  gating, Rust cache, frontend cache, macOS job count, signing and notarization split, and artifact
+  retention before changing unrelated app code.
 
 <!-- mustflow-section: output-format -->
 ## Output Format
@@ -196,6 +232,8 @@ Report missing native build, packaged WebView smoke, CSP violation, permission d
 - IPC, command input, CSP, permission, capability, window/webview, and scope notes
 - Permission diff: old permissions, new permissions, newly reachable windows/webviews, new scopes, and native operation justification
 - Filesystem, dialog, shell, opener, updater, sidecar, or mobile risk
+- Build matrix, bundle target, signing or notarization, cache, artifact retention, and release asset
+  notes when packaging is touched
 - Files changed
 - Command intents run
 - Skipped checks and reasons

package/templates/default/locales/en/.mustflow/skills/wails-code-change/SKILL.md

@@ -2,11 +2,11 @@
 mustflow_doc: skill.wails-code-change
 locale: en
 canonical: true
-revision: 1
+revision: 2
 lifecycle: mustflow-owned
 authority: procedure
 name: wails-code-change
-description: Apply this skill when Wails v3 applications, Go services, generated bindings, TypeScript runtime calls, windows, menus, system tray, dialogs, events, frontend bridge payloads, WebView platform behavior, Taskfile or build config, signing, packaging, custom protocols, file associations, server builds, or Wails-related tests are created, changed, reviewed, or upgraded.
+description: Apply this skill when Wails v3 applications, Go services, generated bindings, TypeScript runtime calls, windows, menus, system tray, dialogs, events, frontend bridge payloads, WebView platform behavior, Taskfile or build config, signing, packaging, platform targets, native desktop CI build matrices, custom protocols, file associations, server builds, or Wails-related tests are created, changed, reviewed, or upgraded.
 metadata:
   mustflow_schema: "1"
   mustflow_kind: procedure
@@ -38,6 +38,8 @@ Treat Wails as a native shell around OS WebViews plus a Go-to-frontend bridge. D
 - `wails.json`, `build/config.yml`, `Taskfile.yml`, `go.mod`, Wails Go APIs, `application.New`, services, generated bindings, `@wailsio/runtime`, frontend calls to Go methods, events, raw messages, windows, menus, system tray, dialogs, browser, clipboard, autostart, notifications, file associations, custom protocols, single-instance handling, signing, packaging, server builds, or Wails tests change.
 - A task touches Wails v2-to-v3 migration, Electron-to-Wails migration, multi-window design, bridge payloads, binding generation, platform WebView behavior, OS integration, or cross-platform packaging.
 - The task writes durable guidance about Wails version status, Wails CLI or runtime versions, WebView2, WKWebView, WebKitGTK, GTK build tags, Taskfile behavior, or platform packaging.
+- Wails release packaging, `Taskfile.yml`, `build/config.yml`, `wails build` flags, platform
+  targets, installer formats, signing, or CI matrix behavior changes.
 
 <!-- mustflow-section: do-not-use-when -->
 ## Do Not Use When
@@ -54,6 +56,9 @@ Treat Wails as a native shell around OS WebViews plus a Go-to-frontend bridge. D
 - Map of frontend calls to Go services: generated function, Go method, request DTO, response DTO, error contract, concurrency owner, cancellation path, and security or permission boundary.
 - Window and native integration ledger: window name or id, owner, lifecycle, hide versus close policy, event subscriptions, runtime-ready handshake, menu projection, tray behavior, dialog decision flow, file association, custom protocol, and single-instance policy.
 - Platform ledger: Windows WebView2 runtime and user-data folder assumptions, macOS WKWebView and signing or notarization expectations, Linux GTK/WebKitGTK target, build tags, package format, and unsupported or legacy distribution targets.
+- Build and release ledger when packaging is in scope: Taskfile targets, build config, Wails CLI
+  flags, runner OS matrix, package formats, frontend and Go cache strategy, signing or
+  notarization gates, artifact retention, and release asset upload path.
 - Official or repository-local source evidence before preserving exact Wails status, alpha, release, CLI, runtime, package, platform dependency, or OS-support claims.
 - Configured verification intents.
 
@@ -72,6 +77,8 @@ Treat Wails as a native shell around OS WebViews plus a Go-to-frontend bridge. D
 - Keep Go services as app capability boundaries with typed DTOs, validation, thread-safe state, and explicit errors.
 - Keep frontend calls thin around generated bindings and runtime event subscriptions with cleanup.
 - Keep build and package changes in declared Wails config, Taskfile, Go module, frontend package, signing, installer, and docs surfaces.
+- Keep platform and package targets explicit. Do not build every OS, architecture, or installer on
+  every PR unless the repository has a clear compatibility contract requiring it.
 - Do not expose debug, destructive, secret, filesystem, shell, updater, protocol, or raw-message behavior through exported Go methods without an explicit product and security boundary.
 
 <!-- mustflow-section: procedure -->
@@ -130,8 +137,24 @@ Treat Wails as a native shell around OS WebViews plus a Go-to-frontend bridge. D
     - Wails v3 build and package behavior is Taskfile and build-config oriented;
     - do not assume one host can produce all signed distributable artifacts without platform-specific runners or signing steps;
     - keep WebView runtime strategy, installer format, macOS notarization, Linux distribution matrix, custom protocol registration, and file association registration explicit.
-16. When migration is involved, reject search-and-replace migrations. Rebuild the app assembly around application, services, windows, managers, lifecycle, generated bindings, events, and build tasks.
-17. Choose configured verification intents that cover Go code, frontend typecheck, generated bindings, package build, Wails build, platform package smoke, and docs. If those intents are missing, report the exact missing coverage.
+16. Keep CI release matrices narrow and deliberate:
+    - Wails builds are usually Go compile plus frontend build plus packaging, but signing,
+      notarization, WebView runtime checks, and Linux package dependencies can still dominate;
+    - prefer PR checks that prove frontend build, Go compile or tests, generated bindings, and
+      bridge contracts on the cheapest adequate runner;
+    - reserve full Windows, Linux, macOS, installer, signing, notarization, and cross-architecture
+      matrices for release tags, release branches, or protected manual gates unless the repository
+      explicitly requires every PR to produce distributables;
+    - use platform target and packaging flags such as no-package, installer-only, or universal
+      macOS behavior intentionally, according to the repository's Wails version and Taskfile style;
+    - keep test artifacts short-lived and promote durable distributables through the release or
+      package channel.
+17. When a cost comparison between Wails and another desktop stack is requested, route the CI
+    billing, runner-minute, artifact-storage, and matrix-shape analysis through
+    `ci-pipeline-triage`; use this skill for Wails-specific Taskfile, build config, Go/frontend
+    cache, platform dependency, signing, and packaging behavior.
+18. When migration is involved, reject search-and-replace migrations. Rebuild the app assembly around application, services, windows, managers, lifecycle, generated bindings, events, and build tasks.
+19. Choose configured verification intents that cover Go code, frontend typecheck, generated bindings, package build, Wails build, platform package smoke, and docs. If those intents are missing, report the exact missing coverage.
 
 <!-- mustflow-section: hard-bans -->
 ## Hard Bans
@@ -152,6 +175,8 @@ Treat Wails as a native shell around OS WebViews plus a Go-to-frontend bridge. D
 - Go service methods, DTOs, errors, shared state, and concurrency ownership are clear.
 - Window lifecycle, event subscriptions, menu/tray/dialog/native integration, and runtime-ready behavior are explicit.
 - Platform WebView and packaging assumptions are recorded when touched.
+- Wails package targets, release matrix, cache strategy, and artifact retention are explicit when
+  packaging is touched.
 - Missing Wails-specific verification is reported rather than hidden behind generic Go or frontend checks.
 
 <!-- mustflow-section: verification -->
@@ -176,6 +201,9 @@ Report missing Wails-specific intents when relevant: generated binding check, fr
 - If bridge calls race or return stale results, add request sequencing, cancellation, job ownership, or synchronized Go state before adding frontend retries.
 - If a large payload stalls, move the payload to pagination, chunks, file handles, or pull-after-notification events.
 - If a tray, menu, dialog, file association, protocol, or packaging behavior differs by OS, document and test the platform-specific path instead of forcing a fake cross-platform abstraction.
+- If packaging cost or duration grows unexpectedly, check Taskfile targets, build config, package
+  flags, release-only matrix gating, Go cache, frontend cache, macOS job count, signing and
+  notarization split, and artifact retention before changing unrelated app code.
 - If exact Wails version or platform support claims cannot be refreshed from official sources, keep the skill behavior version-agnostic and report the unverified source boundary.
 
 <!-- mustflow-section: output-format -->
@@ -184,6 +212,8 @@ Report missing Wails-specific intents when relevant: generated binding check, fr
 - Boundary checked
 - Wails version, app assembly, service, bridge, binding, window, event, menu, tray, dialog, and OS integration notes
 - WebView platform and packaging notes when touched
+- Build matrix, platform target, signing or notarization, cache, artifact retention, and release
+  asset notes when packaging is touched
 - Files changed
 - Command intents run
 - Skipped checks and reasons

package/templates/default/manifest.toml

@@ -1,6 +1,6 @@
 id = "default"
 name = "default"
-version = "2.108.0"
+version = "2.108.2"
 description = "Minimal workflow for LLM agents to read, edit, and verify their work in a repository."
 common_root = "common"
 locales_root = "locales"