mustflow 2.112.13 → 2.113.0

package/dist/cli/commands/skill.js

@@ -16,6 +16,7 @@ const SKILL_OPTIONS = [
     { name: '--dry-run', kind: 'boolean' },
     { name: '--name', kind: 'string' },
     { name: '--ref', kind: 'string' },
+    { name: '--trust-scripts', kind: 'boolean' },
 ];
 export function getSkillHelp(lang = 'en') {
     return renderHelp({
@@ -32,6 +33,7 @@ export function getSkillHelp(lang = 'en') {
             { label: '--install', description: 'Install an external skill after previewing the same source' },
             { label: '--name <slug>', description: 'Override the installed external skill directory name' },
             { label: '--ref <ref>', description: 'Override the GitHub ref used for import' },
+            { label: '--trust-scripts', description: 'Create command-contract intents for imported scripts; requires --install to write them' },
             { label: '--json', description: t(lang, 'cli.option.json') },
             { label: '-h, --help', description: t(lang, 'cli.option.help') },
         ],
@@ -73,6 +75,7 @@ function parseSkillArgs(args) {
         dryRun: hasParsedCliOption(parsed, '--dry-run'),
         name: getParsedCliStringOption(parsed, '--name'),
         ref: getParsedCliStringOption(parsed, '--ref'),
+        trustScripts: hasParsedCliOption(parsed, '--trust-scripts'),
         error: parsed.error,
     };
 }
@@ -138,6 +141,15 @@ function renderSkillImportReport(report) {
             lines.push(`- ${file.relative_path} (${file.kind}, ${file.bytes} bytes, ${file.sha256})`);
         }
     }
+    if (report.script_trust) {
+        lines.push('', 'Script trust', `- requested: ${String(report.script_trust.requested)}`, `- status: ${report.script_trust.status}`, `- command authority: ${String(report.script_trust.grants_command_authority)}`);
+        if (report.script_trust.fragment_path) {
+            lines.push(`- command fragment: ${report.script_trust.fragment_path}`);
+        }
+        for (const intent of report.script_trust.intents) {
+            lines.push(`- intent: ${intent.intent}`);
+        }
+    }
     if (report.warnings.length > 0) {
         lines.push('', 'Warnings', ...report.warnings.map((warning) => `- ${warning}`));
     }
@@ -183,6 +195,7 @@ export async function runSkill(args, reporter, lang = 'en') {
             mode,
             name: parsed.name,
             ref: parsed.ref,
+            trustScripts: parsed.trustScripts,
         });
         if (parsed.json) {
             reporter.stdout(JSON.stringify(report, null, 2));

package/dist/cli/lib/external-skill-import.js

@@ -1,9 +1,12 @@
 import { existsSync, renameSync, rmSync } from 'node:fs';
 import { createHash } from 'node:crypto';
 import path from 'node:path';
-import { ensureFileTargetInsideWithoutSymlinks, writeJsonFileInsideWithoutSymlinks, writeUtf8FileInsideWithoutSymlinks, } from '../../core/safe-filesystem.js';
+import { readCommandContract, readCommandContractIncludePaths, } from '../../core/config-loading.js';
+import { ensureFileTargetInsideWithoutSymlinks, readUtf8FileInsideWithoutSymlinks, writeJsonFileInsideWithoutSymlinks, writeUtf8FileInsideWithoutSymlinks, } from '../../core/safe-filesystem.js';
 const EXTERNAL_SKILL_ROOT = '.mustflow/external-skills';
 const PROVENANCE_FILE = 'mustflow-skill-source.json';
+const COMMANDS_CONFIG_PATH = '.mustflow/config/commands.toml';
+const COMMAND_FRAGMENT_DIRECTORY = '.mustflow/config/commands';
 const DEFAULT_GITHUB_REF = 'HEAD';
 const MAX_IMPORTED_FILES = 40;
 const MAX_TOTAL_BYTES = 512 * 1024;
@@ -130,6 +133,9 @@ function sanitizeSkillName(value) {
         .replace(/^-+|-+$/gu, '')
         .replace(/-{2,}/gu, '-');
 }
+function commandSafeSegment(value) {
+    return sanitizeSkillName(value).replace(/-/gu, '_');
+}
 function readFrontmatterScalar(content, key) {
     if (!content.startsWith('---')) {
         return null;
@@ -359,7 +365,172 @@ function createTarget(skillName) {
         provenance_path: `${skillDir}/${PROVENANCE_FILE}`,
     };
 }
-function writeImportedSkillFiles(projectRoot, target, source, files, fileReport, warnings) {
+function scriptNameForIntent(relativePath) {
+    const basename = path.posix.basename(relativePath);
+    const withoutExtension = basename.replace(/\.[^.]+$/u, '');
+    const sanitized = commandSafeSegment(withoutExtension);
+    if (!sanitized) {
+        throw new Error(`External script path cannot be converted to a safe intent name: ${relativePath}`);
+    }
+    return sanitized;
+}
+function trustedScriptArgv(skillName, scriptPath) {
+    const extension = path.posix.extname(scriptPath).toLowerCase();
+    const projectScriptPath = `${EXTERNAL_SKILL_ROOT}/${skillName}/${scriptPath}`;
+    if (['.js', '.mjs', '.cjs'].includes(extension)) {
+        return ['node', projectScriptPath];
+    }
+    if (['.ts', '.mts', '.cts'].includes(extension)) {
+        return ['bun', projectScriptPath];
+    }
+    if (extension === '.ps1') {
+        return ['pwsh', '-NoProfile', '-File', projectScriptPath];
+    }
+    if (extension === '.sh') {
+        return ['sh', projectScriptPath];
+    }
+    throw new Error(`External script import cannot create a trusted command intent for unsupported script type: ${scriptPath}`);
+}
+function createTrustedScriptIntent(skillName, scriptPath) {
+    return {
+        intent: `external_skill_${commandSafeSegment(skillName)}_${scriptNameForIntent(scriptPath)}`,
+        script_path: scriptPath,
+        argv: trustedScriptArgv(skillName, scriptPath),
+        run_policy: 'agent_allowed',
+        network: true,
+        destructive: true,
+        approval_required: ['network_access', 'destructive_command'],
+    };
+}
+function createScriptTrust(projectRoot, target, files, trustScripts, mode) {
+    const scripts = files.filter((file) => file.kind === 'script');
+    if (!trustScripts) {
+        return {
+            requested: false,
+            status: 'not_requested',
+            grants_command_authority: false,
+            command_contract_path: null,
+            include_entry: null,
+            fragment_path: null,
+            intents: [],
+        };
+    }
+    if (scripts.length === 0) {
+        return {
+            requested: true,
+            status: 'no_scripts',
+            grants_command_authority: false,
+            command_contract_path: null,
+            include_entry: null,
+            fragment_path: null,
+            intents: [],
+        };
+    }
+    const fragmentName = `external-skills-${target.skill_name}.toml`;
+    const includeEntry = `commands/${fragmentName}`;
+    const fragmentPath = `${COMMAND_FRAGMENT_DIRECTORY}/${fragmentName}`;
+    const intents = scripts.map((script) => createTrustedScriptIntent(target.skill_name, script.relative_path));
+    const duplicateIntent = findDuplicate(intents.map((intent) => intent.intent));
+    if (duplicateIntent) {
+        throw new Error(`External skill trusted script intents contain a duplicate name: ${duplicateIntent}`);
+    }
+    validateTrustedScriptCommandPlan(projectRoot, includeEntry, fragmentPath, intents);
+    return {
+        requested: true,
+        status: mode === 'install' ? 'trusted' : 'planned',
+        grants_command_authority: mode === 'install',
+        command_contract_path: COMMANDS_CONFIG_PATH,
+        include_entry: includeEntry,
+        fragment_path: fragmentPath,
+        intents,
+    };
+}
+function findDuplicate(values) {
+    const seen = new Set();
+    for (const value of values) {
+        if (seen.has(value)) {
+            return value;
+        }
+        seen.add(value);
+    }
+    return null;
+}
+function validateTrustedScriptCommandPlan(projectRoot, includeEntry, fragmentPath, intents) {
+    const existingIncludes = new Set(readCommandContractIncludePaths(projectRoot).map((entry) => entry.replace(/^\.mustflow\/config\//u, '')));
+    if (existingIncludes.has(includeEntry)) {
+        throw new Error(`External skill trusted script command include already exists: ${includeEntry}`);
+    }
+    if (existsSync(path.join(projectRoot, ...fragmentPath.split('/')))) {
+        throw new Error(`External skill trusted script command fragment already exists: ${fragmentPath}`);
+    }
+    const contract = readCommandContract(projectRoot);
+    for (const intent of intents) {
+        if (Object.prototype.hasOwnProperty.call(contract.intents, intent.intent)) {
+            throw new Error(`External skill trusted script intent already exists in command contract: ${intent.intent}`);
+        }
+    }
+}
+function renderTomlString(value) {
+    return JSON.stringify(value);
+}
+function renderTomlStringArray(values) {
+    return `[${values.map(renderTomlString).join(', ')}]`;
+}
+function renderTrustedScriptCommandFragment(target, source, scriptTrust) {
+    const lines = [
+        `# Generated by mf skill import --trust-scripts for external skill ${JSON.stringify(target.skill_name)}.`,
+        `# Source: ${source.source_url}`,
+        '# These intents execute imported external script files. They are agent-runnable only through mf run,',
+        '# and remain gated by network_access and destructive_command approvals.',
+        '',
+    ];
+    for (const intent of scriptTrust.intents) {
+        lines.push(`[intents.${intent.intent}]`, 'status = "configured"', 'lifecycle = "oneshot"', 'run_policy = "agent_allowed"', `description = ${renderTomlString(`Run trusted external skill script ${intent.script_path} from ${target.skill_name}.`)}`, `argv = ${renderTomlStringArray(intent.argv)}`, 'cwd = "."', 'timeout_seconds = 300', 'stdin = "closed"', 'success_exit_codes = [0]', 'writes = []', 'network = true', 'destructive = true', 'env_policy = "minimal"', '');
+    }
+    return lines.join('\n');
+}
+function updateCommandIncludeText(content, includeEntry) {
+    const normalizedContent = content.replace(/\r\n?/gu, '\n');
+    const lines = normalizedContent.split('\n');
+    const includeLineIndex = lines.findIndex((line) => /^\s*\[include\]\s*$/u.test(line));
+    const includeLine = `  ${renderTomlString(includeEntry)},`;
+    if (includeLineIndex < 0) {
+        const separator = normalizedContent.endsWith('\n') ? '' : '\n';
+        return `${normalizedContent}${separator}\n[include]\nfiles = [\n${includeLine}\n]\n`;
+    }
+    const nextSectionIndex = lines.findIndex((line, index) => index > includeLineIndex && /^\s*\[[^\]]+\]\s*$/u.test(line));
+    const sectionEnd = nextSectionIndex < 0 ? lines.length : nextSectionIndex;
+    const filesLineIndex = lines.findIndex((line, index) => index > includeLineIndex &&
+        index < sectionEnd &&
+        /^\s*files\s*=\s*\[/u.test(line));
+    if (filesLineIndex < 0) {
+        lines.splice(includeLineIndex + 1, 0, 'files = [', includeLine, ']');
+        return lines.join('\n');
+    }
+    if (lines[filesLineIndex].includes(']')) {
+        const existingValues = [...lines[filesLineIndex].matchAll(/"([^"]+)"/gu)].map((match) => match[1]);
+        const values = [...new Set([...existingValues, includeEntry])].sort((left, right) => left.localeCompare(right));
+        lines.splice(filesLineIndex, 1, 'files = [', ...values.map((entry) => `  ${renderTomlString(entry)},`), ']');
+        return lines.join('\n');
+    }
+    const closingLineIndex = lines.findIndex((line, index) => index > filesLineIndex && index < sectionEnd && /^\s*\]\s*$/u.test(line));
+    if (closingLineIndex < 0) {
+        throw new Error(`[include].files in ${COMMANDS_CONFIG_PATH} must be a TOML array`);
+    }
+    lines.splice(closingLineIndex, 0, includeLine);
+    return lines.join('\n');
+}
+function writeTrustedScriptCommandContract(projectRoot, target, source, scriptTrust) {
+    if (scriptTrust.status !== 'trusted' || !scriptTrust.fragment_path || !scriptTrust.include_entry) {
+        return;
+    }
+    const fragmentContent = renderTrustedScriptCommandFragment(target, source, scriptTrust);
+    writeUtf8FileInsideWithoutSymlinks(projectRoot, path.join(projectRoot, ...scriptTrust.fragment_path.split('/')), fragmentContent);
+    const commandsPath = path.join(projectRoot, ...COMMANDS_CONFIG_PATH.split('/'));
+    const commandsContent = readUtf8FileInsideWithoutSymlinks(projectRoot, commandsPath, { maxBytes: 256 * 1024 });
+    writeUtf8FileInsideWithoutSymlinks(projectRoot, commandsPath, updateCommandIncludeText(commandsContent, scriptTrust.include_entry));
+}
+function writeImportedSkillFiles(projectRoot, target, source, files, fileReport, warnings, scriptTrust) {
     const targetPath = path.join(projectRoot, ...target.skill_dir.split('/'));
     const skillPath = path.join(targetPath, 'SKILL.md');
     if (existsSync(targetPath)) {
@@ -384,6 +555,7 @@ function writeImportedSkillFiles(projectRoot, target, source, files, fileReport,
             kind: 'external_skill_source',
             source,
             files: fileReport,
+            script_trust: scriptTrust,
             warnings,
         });
         renameSync(tempPath, targetPath);
@@ -424,14 +596,31 @@ export async function createExternalSkillImportReport(projectRoot, inputUrl, opt
         const source = externalSkillSourceFromParsed(inputUrl, parsed);
         const files = normalizeImportedSkillFiles(sourceFiles);
         const reports = fileReports(files);
+        const scriptTrust = createScriptTrust(projectRoot, target, reports, options.trustScripts === true, mode);
         const warnings = [
-            ...(reports.some((file) => file.kind === 'script')
+            ...(reports.some((file) => file.kind === 'script') && scriptTrust.status !== 'trusted'
                 ? ['Imported scripts are inert reference files; mustflow does not grant command authority for external scripts.']
                 : []),
+            ...(scriptTrust.status === 'trusted'
+                ? ['Imported scripts were trusted by request; mustflow created command-contract intents gated by network and destructive approvals.']
+                : []),
+            ...(scriptTrust.status === 'planned'
+                ? ['Imported scripts would be trusted by request during install; dry-run only reports the command-contract plan.']
+                : []),
             'External skills are untrusted until the agent reads and evaluates the selected SKILL.md.',
         ];
         if (mode === 'install') {
-            writeImportedSkillFiles(projectRoot, target, source, files, reports, warnings);
+            try {
+                writeImportedSkillFiles(projectRoot, target, source, files, reports, warnings, scriptTrust);
+                writeTrustedScriptCommandContract(projectRoot, target, source, scriptTrust);
+            }
+            catch (error) {
+                rmSync(path.join(projectRoot, ...target.skill_dir.split('/')), { recursive: true, force: true });
+                if (scriptTrust.fragment_path) {
+                    rmSync(path.join(projectRoot, ...scriptTrust.fragment_path.split('/')), { force: true });
+                }
+                throw error;
+            }
         }
         return {
             schema_version: '1',
@@ -444,6 +633,7 @@ export async function createExternalSkillImportReport(projectRoot, inputUrl, opt
             source,
             target,
             files: reports,
+            script_trust: scriptTrust,
             warnings,
             issues: [],
             wrote_files: mode === 'install',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mustflow",
-  "version": "2.112.13",
+  "version": "2.113.0",
   "description": "Agent workflow documents and CLI for mustflow repository roots.",
   "type": "module",
   "license": "MIT-0",

package/schemas/skill-import-report.schema.json

@@ -43,6 +43,7 @@
       "type": "array",
       "items": { "$ref": "#/$defs/file" }
     },
+    "script_trust": { "$ref": "#/$defs/scriptTrust" },
     "warnings": {
       "type": "array",
       "items": { "type": "string" }
@@ -92,6 +93,80 @@
         "bytes": { "type": "integer", "minimum": 0 },
         "sha256": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" }
       }
+    },
+    "scriptTrust": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "requested",
+        "status",
+        "grants_command_authority",
+        "command_contract_path",
+        "include_entry",
+        "fragment_path",
+        "intents"
+      ],
+      "properties": {
+        "requested": { "type": "boolean" },
+        "status": { "type": "string", "enum": ["not_requested", "no_scripts", "planned", "trusted"] },
+        "grants_command_authority": { "type": "boolean" },
+        "command_contract_path": {
+          "oneOf": [
+            { "const": ".mustflow/config/commands.toml" },
+            { "type": "null" }
+          ]
+        },
+        "include_entry": {
+          "oneOf": [
+            { "type": "string", "pattern": "^commands/external-skills-[a-z0-9]+(?:-[a-z0-9]+)*\\.toml$" },
+            { "type": "null" }
+          ]
+        },
+        "fragment_path": {
+          "oneOf": [
+            { "type": "string", "pattern": "^\\.mustflow/config/commands/external-skills-[a-z0-9]+(?:-[a-z0-9]+)*\\.toml$" },
+            { "type": "null" }
+          ]
+        },
+        "intents": {
+          "type": "array",
+          "items": { "$ref": "#/$defs/trustedScriptIntent" }
+        }
+      }
+    },
+    "trustedScriptIntent": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "intent",
+        "script_path",
+        "argv",
+        "run_policy",
+        "network",
+        "destructive",
+        "approval_required"
+      ],
+      "properties": {
+        "intent": { "type": "string", "pattern": "^external_skill_[A-Za-z0-9_-]+$" },
+        "script_path": { "type": "string", "pattern": "^scripts/.+$" },
+        "argv": {
+          "type": "array",
+          "minItems": 2,
+          "items": { "type": "string" }
+        },
+        "run_policy": { "const": "agent_allowed" },
+        "network": { "const": true },
+        "destructive": { "const": true },
+        "approval_required": {
+          "type": "array",
+          "prefixItems": [
+            { "const": "network_access" },
+            { "const": "destructive_command" }
+          ],
+          "minItems": 2,
+          "maxItems": 2
+        }
+      }
     }
   }
 }

package/templates/default/i18n.toml

@@ -62,7 +62,7 @@ translations = {}
 [documents."skills.index"]
 source = "locales/en/.mustflow/skills/INDEX.md"
 source_locale = "en"
-revision = 224
+revision = 226
 translations = {}
 
 [documents."skill.adapter-boundary"]
@@ -565,19 +565,19 @@ translations = {}
 [documents."skill.search-index-integrity-review"]
 source = "locales/en/.mustflow/skills/search-index-integrity-review/SKILL.md"
 source_locale = "en"
-revision = 1
+revision = 3
 translations = {}
 
 [documents."skill.vector-search-integrity-review"]
 source = "locales/en/.mustflow/skills/vector-search-integrity-review/SKILL.md"
 source_locale = "en"
-revision = 2
+revision = 4
 translations = {}
 
 [documents."skill.rag-pipeline-triage"]
 source = "locales/en/.mustflow/skills/rag-pipeline-triage/SKILL.md"
 source_locale = "en"
-revision = 1
+revision = 3
 translations = {}
 
 [documents."skill.dependency-injection"]
@@ -1164,7 +1164,7 @@ translations = {}
 [documents."skill.security-privacy-review"]
 source = "locales/en/.mustflow/skills/security-privacy-review/SKILL.md"
 source_locale = "en"
-revision = 24
+revision = 25
 translations = {}
 
 [documents."skill.security-regression-tests"]
@@ -1272,7 +1272,7 @@ translations = {}
 [documents."skill.llm-token-cost-control-review"]
 source = "locales/en/.mustflow/skills/llm-token-cost-control-review/SKILL.md"
 source_locale = "en"
-revision = 2
+revision = 4
 translations = {}
 
 [documents."skill.llm-response-latency-review"]

package/templates/default/locales/en/.mustflow/skills/INDEX.md

@@ -2,7 +2,7 @@
 mustflow_doc: skills.index
 locale: en
 canonical: true
-revision: 224
+revision: 226
 authority: router
 lifecycle: mustflow-owned
 ---
@@ -76,7 +76,8 @@ refer to `AGENTS.md` and `.mustflow/config/commands.toml` to implement the most
   citations, claim maps, evidence IDs, answerability states, retrieval thresholds, validators,
   abstain behavior, or hallucination metrics need product-controlled grounding review.
 - Use `llm-token-cost-control-review` as a primary route when LLM request assembly, token budgets,
-  prompt caching, chat history, RAG context size, tool or schema payloads, model routing, reasoning
+  prompt caching, chat history, RAG context size, prompt packing, document metadata, source maps,
+  question-scoped compression, evidence cards, tool or schema payloads, model routing, reasoning
   budget, retries, Batch, Flex, predicted outputs, or cost-per-success telemetry need token spend
   review.
 - Use `llm-response-latency-review` as a primary route when LLM response speed, time to first
@@ -424,16 +425,18 @@ refer to `AGENTS.md` and `.mustflow/config/commands.toml` to implement the most
   index-defeating predicates, plan skew, or long transaction scope before live plan evidence.
 - Use `search-index-integrity-review` as a primary route when keyword search, full-text search,
   Elasticsearch, OpenSearch, Lucene-style indexing, aliases, bulk ingestion, refresh visibility,
-  analyzer, synonym, autocomplete, pagination, shard failure, search quality, or search
-  performance needs source-to-search and query-contract evidence.
+  analyzer, metadata taxonomy, negative metadata, exact keyword fields, source maps, synonym,
+  autocomplete, pagination, shard failure, search quality, or search performance needs
+  source-to-search and query-contract evidence.
 - Use `vector-search-integrity-review` as a primary route when vector search, semantic search, RAG
-  retrieval, embeddings, ANN indexes, exact-versus-approximate search, filters, metadata,
-  namespaces, tenants, hybrid search, reranking, recall, latency, or golden-set behavior needs
-  retrieval-contract review.
+  retrieval, embeddings, contextual headers, synthetic questions, chunk text variants, ANN indexes,
+  exact-versus-approximate search, filters, metadata, namespaces, tenants, hybrid search, reranking,
+  recall, latency, or golden-set behavior needs retrieval-contract review.
 - Use `rag-pipeline-triage` as a primary route when a RAG, knowledge-base answer, grounded chat,
   citation answer, document QA, or support bot failure is not yet localized to ingestion, parsing,
-  chunking, retrieval, filtering, reranking, context assembly, prompt construction, generation,
-  citation validation, answerability, access control, latency, or cost.
+  document metadata, frontmatter schema, source maps, heading paths, chunking, retrieval, filtering,
+  reranking, context assembly, prompt construction, generation, citation validation, answerability,
+  access control, latency, or cost.
 - Use `database-json-modeling-review` as an adjunct when database review needs to decide whether
   JSON, jsonb, metadata, settings, raw payload, or dynamic keys should become typed columns,
   child tables, generated/computed columns, JSON indexes, schema versions, or key registries
@@ -533,8 +536,8 @@ routes. Event routes stay inactive until their event occurs.
 | AI product features, AI Gateways, provider/model integrations, prompt/RAG/tool paths, AI caches, fallback paths, streaming paths, evaluation gates, user-data flows, model registries, AI observability, incident runbooks, or model portability plans are created, changed, reviewed, or reported before the risk is narrow enough for one specialist LLM skill | `.mustflow/skills/ai-product-readiness-review/SKILL.md` | Product role ledger, harm model, gateway ledger, authority and action ledger, data ledger, cost and cache ledger, eval ledger, fallback and streaming ledger, model portability ledger, observability ledger, changed files, and command contract entries | AI Gateway boundaries, provider adapters, model registries, prompt registries, policy engines, tool proposal gates, quota guards, token budgets, cache keys, redaction, retry and fallback states, streaming validators, eval fixtures, observability fields, incident runbooks, tests, docs, route metadata, and directly synchronized templates | model-as-product shortcut, automatic high-risk decision, direct client provider call, prompt-only security, RAG permission leak, unvalidated model output, missing policy engine, cost budget gap, app cache tenant leak, eval theater, fallback-as-second-model, partial streaming disclosure, raw AI log retention, scattered model names, stale provider assumption, or missing kill switch | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `prompt_cache_audit`, `docs_validate_fast`, `test_release`, `mustflow_check` | AI product-readiness surface reviewed, AI role and harm model, gateway and policy boundaries, prompt-injection/data/output/permission/side-effect controls, cost/cache/eval/fallback/streaming/observability/model-portability decisions, specialist skills applied or deferred, verification, and remaining AI product-readiness risk |
 | Prompts, prompt builders, system or developer messages, RAG prompt assembly, few-shot examples, structured outputs, tool-use instructions, model selection, reasoning-effort settings, eval sets, refusal or fallback handling, prompt versioning, or AI feature completion criteria are created, changed, reviewed, or reported | `.mustflow/skills/prompt-contract-quality-review/SKILL.md` | Prompt contract ledger, input ledger, authority ledger, output schema, tool policy, model/runtime ledger, RAG evidence ledger, eval ledger, changed files, and command contract entries | Prompt builders, prompt templates, schemas, validators, eval fixtures, boundary examples, tool policies, fallback states, completion definitions, docs, tests, and directly synchronized templates | prompt-as-function gap, user input treated as authority, buried RAG evidence, happy-path-only examples, JSON-parse theater, unpinned production model, hidden prompt storage, raw chain-of-thought request, guessed tool parameters, missing failure state, unbounded reasoning/token cost, or vibe-based prompt improvement claim | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Prompt contract reviewed, function boundary, authority and source separation, eval and semantic validation status, model/runtime policy, RAG/tool/failure/completion states, verification, and remaining prompt-contract risk |
 | LLM answers, RAG responses, citations, source grounding, claim extraction, evidence IDs, answerability states, abstain behavior, retrieval thresholds, tool-backed facts, output validators, LLM judges, or hallucination-control metrics are created, changed, reviewed, or reported | `.mustflow/skills/llm-hallucination-control-review/SKILL.md` | Answer contract ledger, evidence ledger, claim ledger, tool ledger, validator ledger, eval ledger, observability ledger, changed files, and command contract entries | Answerability states, abstain states, missing-information states, source-coverage gates, claim maps, evidence-ID requirements, citation validators, retrieval thresholds, chunk metadata, tool-parameter ownership, deterministic calculators, domain validators, eval fixtures, tests, docs, route metadata, and directly synchronized templates | unsupported factual claim, fabricated citation, source ID invention, weak retrieval gate, noisy semantic-only retrieval, chunk context loss, summary-on-summary hallucination, guessed tool parameter, model arithmetic, source-priority conflict, LLM judge overtrust, low-temperature theater, missing abstain path, missing dirty eval, false citation metric gap, or unobservable grounding drift | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Hallucination-control surface reviewed, answerability and abstain states, evidence IDs, claim map, citations, source coverage, validators, retrieval thresholds, tool ownership, evals, metrics, verification, and remaining hallucination-control risk |
-| RAG, knowledge-base answer, grounded chat, citation answer, retrieval-augmented support bot, or document QA flow is wrong, stale, unsupported, slow, leaking data, over-refusing, or not yet localized to ingestion, parsing, chunking, retrieval, filtering, reranking, context assembly, prompt construction, generation, citation validation, or answerability boundaries | `.mustflow/skills/rag-pipeline-triage/SKILL.md` | Symptom classification, trace ledger, source ledger, comparison ledger, eval ledger, privacy ledger, changed files, and command contract entries | End-to-end trace preservation, source availability and parsed-text checks, chunk metadata, duplicate and stale source checks, no-retrieval/current-context/gold-context comparison, keyword/vector/hybrid/retriever/reranker/context/prompt/generation/citation/answerability localization, safe synthetic fixtures, metrics, docs, and directly synchronized templates | model scapegoating, tuning top-k before source proof, original-document theater while parsed text is broken, stale source mixing, filter blamed as vector failure, reranker candidate starvation, critical evidence truncated or buried, retrieved text treated as instruction, citation decoration, answerability missing state, private corpus dump, access filter bypass, or single satisfaction score hiding layer failure | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | RAG pipeline triaged, localized boundary, trace/source/comparison/eval/metric/privacy ledgers, layer findings, fix or recommendation, evidence level, verification, and remaining RAG pipeline risk |
-| LLM API calls, prompt assembly, chat history, RAG context, tool schemas, structured output schemas, model routing, reasoning settings, token budgets, provider prompt caching, app-level response caching, retries, batch or flex processing, predicted outputs, image or file inputs, or LLM cost metrics are created, changed, reviewed, or reported | `.mustflow/skills/llm-token-cost-control-review/SKILL.md` | Cost surface ledger, request ledger, cache ledger, context ledger, output ledger, routing ledger, observability ledger, changed files, and command contract entries | Request builders, prompt prefix ordering, canonical serialization, prompt hashes, cache keys, token counters, budget guards, model routers, context trimming, RAG packing, tool and schema payloads, output patch formats, retry repair paths, metrics, logs, tests, docs, route metadata, and directly synchronized templates | prompt-cache prefix drift, volatile field before stable prefix, unmeasured token count, full transcript replay, RAG chunk bloat, oversized tool or JSON schema payload, expensive model default, unbounded reasoning, no visible output after token cap, full-output regeneration, full-context retry replay, app cache key leak, predicted-output cost confusion, image or file token surprise, or per-call cost hiding cost-per-success regression | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `prompt_cache_audit`, `docs_validate_fast`, `test_release`, `mustflow_check` | LLM token-cost surface reviewed, cost unit and measurement source, stable prefix and cache behavior, app cache/history/RAG/tool/schema/input choices, routing/reasoning/output/retry/Batch/Flex/prediction choices, observability, verification, and remaining token-cost risk |
+| RAG, knowledge-base answer, grounded chat, citation answer, retrieval-augmented support bot, or document QA flow is wrong, stale, unsupported, slow, leaking data, over-refusing, or not yet localized to ingestion, parsing, document metadata, frontmatter schema, source maps, heading paths, chunking, retrieval, filtering, reranking, context assembly, prompt construction, generation, citation validation, or answerability boundaries | `.mustflow/skills/rag-pipeline-triage/SKILL.md` | Symptom classification, trace ledger, source ledger with original/index/prompt text, stable source/doc/chunk ids, document type/status/authority, routing summaries, document graph links, comparison ledger, eval ledger, privacy ledger, changed files, and command contract entries | End-to-end trace preservation, source availability and parsed-text checks, metadata, source maps, ACL prefilters, heading paths, semantic code chunks, table record shape, chunk graph, source-of-truth and supersession checks, duplicate and stale source checks, no-retrieval/current-context/gold-context comparison, keyword/vector/hybrid/retriever/reranker/context/prompt/generation/citation/answerability localization, safe synthetic fixtures, metrics, docs, and directly synchronized templates | model scapegoating, tuning top-k before source proof, original-document theater while parsed text is broken, generic heading coordinates, generated summary cited as source, missing source map, source/doc/chunk id collapse, stale source mixing, draft or meeting-note evidence outranking canonical documents, ACL inherited after retrieval, filter blamed as vector failure, fixed line-count code slicing, table number without row or column meaning, reranker candidate starvation, critical evidence truncated or buried, retrieved text treated as instruction, citation decoration, answerability missing state, private corpus dump, access filter bypass, or single satisfaction score hiding layer failure | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | RAG pipeline triaged, localized boundary, trace/source/comparison/eval/metric/privacy ledgers, metadata/frontmatter/source-map/ACL/chunk-graph/document-graph findings, fix or recommendation, evidence level, verification, and remaining RAG pipeline risk |
+| LLM API calls, prompt assembly, chat history, RAG context, document metadata, chunk summaries, prompt packing, question-scoped compression, evidence cards, tool schemas, structured output schemas, model routing, reasoning settings, token budgets, provider prompt caching, app-level response caching, retries, batch or flex processing, predicted outputs, image or file inputs, or LLM cost metrics are created, changed, reviewed, or reported | `.mustflow/skills/llm-token-cost-control-review/SKILL.md` | Cost surface ledger, request ledger with authority lanes, cache ledger, context ledger with inclusion tests, block role tags, filter-only versus LLM-visible metadata, source maps, state cards, and evidence cards, output ledger, routing ledger, observability ledger, changed files, and command contract entries | Request builders, prompt prefix ordering, canonical serialization, prompt hashes, cache keys, token counters, budget guards, model routers, context trimming, RAG packing, question-scoped compression, slot records, state snapshots, original/index/prompt text separation, source-map references, tool and schema payloads, output patch formats, retry repair paths, metrics, logs, tests, docs, route metadata, and directly synchronized templates | prompt-cache prefix drift, volatile field before stable prefix, unmeasured token count, full transcript replay, state delta without baseline, answer-irrelevant context hoarding, RAG chunk bloat, generated summary treated as original evidence, search-only metadata treated as answer text, missing source coordinate, missing token_count, compression not evaluated, oversized tool or JSON schema payload, expensive model default, unbounded reasoning, no visible output after token cap, full-output regeneration, full-context retry replay, app cache key leak, predicted-output cost confusion, image or file token surprise, or per-call cost hiding cost-per-success regression | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `prompt_cache_audit`, `docs_validate_fast`, `test_release`, `mustflow_check` | LLM token-cost surface reviewed, cost unit and measurement source, stable prefix and cache behavior, authority lanes, app cache/history/RAG/metadata/source-map/prompt-packing/evidence-card/tool/schema/input choices, routing/reasoning/output/retry/Batch/Flex/prediction choices, observability, verification, and remaining token-cost risk |
 | LLM response latency, time to first token, first useful output, streaming, output length, LLM round trips, tool-call wait, prompt-cache latency, model routing, speculative or parallel execution, realtime continuation, priority tiers, predicted outputs, or user-perceived AI speed are created, changed, reviewed, or reported | `.mustflow/skills/llm-response-latency-review/SKILL.md` | Latency target ledger, request timeline ledger, call graph ledger, output ledger, cache ledger, routing ledger, observability ledger, changed files, and command contract entries | Streaming paths, first-useful-output contracts, request timeline metrics, call graph simplification, parallel or speculative work, model routers, fallback cascades, output caps, schema shortening, prompt-cache prefix ordering, cache keys, realtime continuation, priority-tier routing, timeout and cancellation behavior, tests, docs, route metadata, and directly synchronized templates | slow first token, useless streamed preamble, extra sequential LLM round trip, tool wait blocking first output, cache-prefix drift, unmeasured cache miss, verbose output drift, long JSON key or enum overhead, RAG chunk bloat, router escalation loop, prediction-token mismatch, priority-tier misuse, unsafe speculative work, missing cancellation, or raw prompt telemetry leak | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | LLM response-latency surface reviewed, latency unit and request timeline, round trips, parallel/tool/stream/cancel behavior, output/schema/cache/history/RAG/routing/fallback/prediction/realtime/priority choices, observability, verification, and remaining response-latency risk |
 | Autonomous or semi-autonomous LLM agents, agentic workflows, planners, executors, verifiers, tool contracts, tool-call gates, human approval or interrupt flows, durable agent state, handoffs, guardrails, loop budgets, retry policies, trace evaluation, or agent outcome metrics are created, changed, reviewed, or reported | `.mustflow/skills/agent-execution-control-review/SKILL.md` | Autonomy ledger, stage gate ledger, role separation ledger, tool contract ledger, effect ledger, state and resume ledger, memory and context ledger, handoff and guardrail ledger, loop, retry, and budget ledger, trace and eval outcome ledger, changed files, and command contract entries | Workflow-versus-agent routing, stage gates, planner/executor/verifier boundaries, tool contracts, tool argument ownership, draft/execute separation, idempotency keys, approval records, durable checkpoints, state schema versions, memory partitions, handoff filters, guardrails, loop budgets, retry classification, trace spans, eval fixtures, tests, docs, route metadata, and directly synchronized templates | unnecessary autonomous agent, one model self-certifying success, ungated bad plan, ambiguous tool contract, guessed tool argument, relative-path trap, external effect before approval, missing idempotency key, interrupt replay side effect, stale state schema, over-shared handoff, misplaced guardrail, repeated tool loop, blind retry, final-answer-only eval, or unsafe trace data | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Agent execution-control surface reviewed, workflow-versus-agent decision, autonomy envelope, stage gates, role separation, tool contracts, approval and side-effect replay safety, state/resume/memory/handoff/guardrail/loop/retry/trace/eval checks, verification, and remaining agent execution-control risk |
 | Browser automation, UI automation, Playwright, Selenium, Puppeteer, WebDriver, computer-use or browser-driving agents, visual browser verification, flaky selectors, page readiness, authentication state, CAPTCHA or anti-bot handling, rate limits, screenshot checks, retry, timeout, human approval, or browser automation observability is created, changed, reviewed, triaged, or reported | `.mustflow/skills/browser-automation-reliability-review/SKILL.md` | Automation intent ledger, state ledger, readiness ledger, selector and action ledger, auth and identity ledger, external pressure ledger, verification ledger, agent and approval ledger, changed files, and command contract entries | Browser automation state machines, locator contracts, test IDs, accessible names, readiness assertions, frame and popup handlers, input verification, auth fixtures, per-worker account isolation, retry classification, timeout hierarchy, idempotency checks, rate-limit handling, approval gates, manual fallback states, traces, screenshots, redaction, cleanup, tests, docs, route metadata, and directly synchronized templates | sleep-as-readiness, `networkidle` faith, flaky selector string patch, hidden duplicate DOM, skeleton-as-content, stale element handle, force-click default, shared mutable account, CAPTCHA bypass, anti-bot evasion, retry storm, non-idempotent replay, timeout layer mismatch, screenshot-as-business-proof, unredacted trace data, page prompt injection, stale approval resume, coordinate click drift, or unverified browser success claim | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Browser automation surface reviewed, browser-versus-API boundary, automation owner, state/readiness/locator/actionability/auth/rate-limit/retry/timeout/idempotency decisions, screenshot and business-success evidence, agent page-content trust, approval and resume checks, verification, and remaining browser automation reliability risk |
@@ -660,8 +663,8 @@ routes. Event routes stay inactive until their event occurs.
 | PostgreSQL-specific schema, query, transaction, migration, indexing, extension, role, row-level security, connection pooling, replication, backup, restore, managed Postgres, or Postgres runtime behavior is created, changed, reviewed, or reported | `.mustflow/skills/postgresql-code-change/SKILL.md` | PostgreSQL role, version, provider, extension inventory, topology, pooler, schema/type rules, query-plan evidence, transaction/retry rules, migration and recovery needs, changed files, and command contract entries | PostgreSQL schema, queries, migrations, generated SQL, connection setup, pool settings, roles, RLS policies, extensions, tests, docs, and directly synchronized templates | version drift, provider constraint miss, connection storm, lock or rewrite surprise, unsafe online DDL claim, bad pooler assumption, RLS bypass, search-path risk, extension drift, stale replica read, query-plan overclaim, or unverified restore | `changes_status`, `changes_diff_summary`, `test_related`, `test`, `lint`, `build`, `docs_validate_fast`, `test_release`, `mustflow_check` | PostgreSQL version/topology, pooling, lock/transaction, schema/type/RLS/role, query/index/statistics, backup/restore, verification, and remaining PostgreSQL risk |
 | ClickHouse-specific schema, MergeTree engine configuration, partition or sorting keys, primary keys, projections, materialized views, dictionaries, ingest, async inserts, deduplication, mutations, joins, CTEs, aggregate states, arrays, maps, window functions, distributed queries, or query performance behavior is created, changed, reviewed, or reported | `.mustflow/skills/clickhouse-code-change/SKILL.md` | ClickHouse role, version or Cloud track, topology, engine, table shape, ingest shape, query shape, operational evidence, changed files, and command contract entries | ClickHouse DDL, SQL, query builders, ingest code, backfill code, materialized views, projections, dictionaries, settings, fixtures, tests, docs, and synchronized templates | OLTP-shaped table design, high-cardinality partition part explosion, primary-key uniqueness myth, bad sorting locality, tiny insert parts, async insert durability overclaim, block dedup retry drift, MV trigger misunderstanding, stale dictionary lookup, aggregate-state merge bug, `arrayJoin` row explosion, default window-frame bug, `FINAL` cost patch, `OPTIMIZE FINAL` routine, mutation write amplification, JOIN fan-out, CTE rerun surprise, projection backfill miss, skip-index cargo cult, or unverified query-plan claim | `changes_status`, `changes_diff_summary`, `test_related`, `test`, `lint`, `build`, `docs_validate_fast`, `test_release`, `mustflow_check` | ClickHouse role/version/topology, engine/storage, ingest/dedup/MV/backfill, aggregate/query/JOIN/distributed findings, evidence level, verification, and remaining ClickHouse risk |
 | DuckDB-specific embedded OLAP database use, `.duckdb` file ownership, concurrency, language bindings, Appender usage, CSV/Parquet/JSON ingestion, query determinism, timestamp behavior, memory and temp spill settings, profiling, indexes, CTEs, macros, or DuckDB runtime behavior is created, changed, reviewed, or reported | `.mustflow/skills/duckdb-code-change/SKILL.md` | DuckDB role, version or track, binding, extension inventory, file and process ownership, ingest/export shape, query shape, memory and temp spill settings, profiling evidence, changed files, and command contract entries | DuckDB SQL, schemas, query builders, connection setup, binding-specific code, ingest/export code, Appender code, settings, fixtures, tests, docs, and synchronized templates | SQLite-like OLTP assumption, native file multi-process write bug, hidden global connection, thread/process confusion, Appender visibility overclaim, CSV sampling loss, `ignore_errors` data loss, schema-drift memory spike, `SELECT *` Parquet scan, partition file explosion, missing `ORDER BY`, order-sensitive aggregate drift, TIMESTAMPTZ timezone surprise, memory-limit overclaim, temp spill disk-full, overwritten profiling output, ART-index theater, CTE materialization surprise, window memory spike, unsafe macro input, or unverified query-plan claim | `changes_status`, `changes_diff_summary`, `test_related`, `test`, `lint`, `build`, `docs_validate_fast`, `test_release`, `mustflow_check` | DuckDB role/version/binding, file/process ownership, concurrency/Appender/import/export, deterministic SQL, memory/temp/profiling, query-plan evidence, verification, and remaining DuckDB risk |
-| Keyword search, full-text search, Elasticsearch, OpenSearch, Lucene-style indexing, search APIs, indexing pipelines, aliases, bulk indexing, refresh visibility, analyzers, mappings, synonyms, autocomplete, pagination, shard failures, search quality, or search performance are created, changed, reviewed, or failing | `.mustflow/skills/search-index-integrity-review/SKILL.md` | Symptom classification, source-to-search ledger, query contract ledger, index contract ledger, quality ledger, performance ledger, privacy ledger, changed files, and command contract entries | Search canaries, indexing ledgers, bulk item error handling, alias checks, mapping and analyzer fixtures, exact-versus-full-text tests, tenant and permission filters, golden-set tests, synonym regression tests, pagination guards, query metrics, docs, and directly synchronized templates | cluster-green theater, batch-level bulk success, source/index count illusion, write alias drift, partial shard result, direct/API/UI mismatch, wrong keyword/text field, analyzer drift, synonym regression, rank eyeballing, profile misuse, query fingerprint leak, shard fan-out, cache-only benchmark, refresh overuse, segment merge backlog, disk watermark write block, deep pagination, oversized fetch, or private query/document leak | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Search index integrity reviewed, source-to-search/query/index/quality/performance/privacy ledgers, search findings, fix or recommendation, evidence level, verification, and remaining search-index risk |
-| Vector search, semantic search, RAG retrieval, embedding generation, preprocessing, chunking, vector schema, collection, namespace, tenant, named vector, metadata payload, filter, ANN index, exact-versus-approximate search, hybrid search, reranking, recall, latency, quantization, HNSW, IVF, pgvector, Qdrant, Milvus, Weaviate, OpenSearch kNN, or retrieval golden-set behavior is created, changed, reviewed, or failing | `.mustflow/skills/vector-search-integrity-review/SKILL.md` | Retrieval symptom, query contract ledger, ingestion ledger, quality ledger, performance ledger, privacy ledger, changed files, and command contract entries | Embedding and preprocessing versioning, vector validation, deterministic ids, namespace and tenant selection, metadata indexes, filter construction, exact-search checks, ANN parameters, reranker candidates, golden-set tests, synthetic fixtures, metrics, docs, and directly synchronized templates | vector-DB scapegoating, wrong embedding dimension, model revision drift, filter post-candidate loss, metadata type drift, tenant leak, duplicate chunk ids, stale deletes, metric or normalization mismatch, ANN tuning before exact-search proof, quantization recall loss, reranker candidate starvation, hybrid score misuse, deep ANN pagination, raw vector or document leak, or unmeasured p95 latency | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Vector search integrity reviewed, retrieval/query/ingestion/quality/performance/privacy ledgers, exact-versus-ANN and filter findings, fix or recommendation, evidence level, verification, and remaining vector-search risk |
+| Keyword search, full-text search, Elasticsearch, OpenSearch, Lucene-style indexing, search APIs, indexing pipelines, source maps, metadata taxonomy, negative metadata, exact keyword fields, aliases, bulk indexing, refresh visibility, analyzers, mappings, synonyms, autocomplete, pagination, shard failures, search quality, or search performance are created, changed, reviewed, or failing | `.mustflow/skills/search-index-integrity-review/SKILL.md` | Symptom classification, source-to-search ledger, query contract ledger, index contract ledger with taxonomy/source-map fields, metadata key budget, stable source/doc/chunk ids, lifecycle and effective-date fields, quality ledger, performance ledger, privacy ledger, changed files, and command contract entries | Search canaries, indexing ledgers, bulk item error handling, alias checks, mapping and analyzer fixtures, metadata taxonomy checks, frontmatter schema checks, controlled-vocabulary fixtures, exact-keyword fixtures, negative-metadata filters, filter-only versus LLM-visible metadata checks, exact-versus-full-text tests, tenant and permission filters, golden-set tests, synonym regression tests, pagination guards, query and miss-log metrics, docs, and directly synchronized templates | cluster-green theater, batch-level bulk success, source/index count illusion, write alias drift, partial shard result, direct/API/UI mismatch, wrong keyword/text field, analyzer drift, uncontrolled tag vocabulary, unbounded metadata keys, file path treated as status, synonym regression, negative metadata ignored, missing source map, stale index hash, rank eyeballing, profile misuse, query fingerprint leak, shard fan-out, cache-only benchmark, refresh overuse, segment merge backlog, disk watermark write block, deep pagination, oversized fetch, or private query/document leak | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Search index integrity reviewed, source-to-search/query/index/quality/performance/privacy ledgers, taxonomy/metadata-budget/exact-keyword/source-map/query-log findings, fix or recommendation, evidence level, verification, and remaining search-index risk |
+| Vector search, semantic search, RAG retrieval, embedding generation, preprocessing, chunking, contextual headers, synthetic questions, chunk text variants, vector schema, collection, namespace, tenant, named vector, metadata payload, filter, ANN index, exact-versus-approximate search, hybrid search, reranking, recall, latency, quantization, HNSW, IVF, pgvector, Qdrant, Milvus, Weaviate, OpenSearch kNN, or retrieval golden-set behavior is created, changed, reviewed, or failing | `.mustflow/skills/vector-search-integrity-review/SKILL.md` | Retrieval symptom, query contract ledger, ingestion ledger with stable source/doc/chunk ids, parent document genealogy, text variants and hashes, quality ledger, performance ledger, privacy ledger, changed files, and command contract entries | Embedding, preprocessing, and chunker versioning, vector validation, deterministic ids, contextual retrieval headers, synthetic question fields, original/index/prompt/embedding text separation, namespace and tenant selection, metadata payload field typing, metadata indexes, ACL prefilters, filter construction, exact-search checks, ANN parameters, lexical safeguards for exact identifiers, hybrid score ledgers, RRF or MMR settings, reranker candidates, golden-set tests, synthetic fixtures, metrics, docs, and directly synchronized templates | vector-DB scapegoating, wrong embedding dimension, model revision drift, contextual retrieval text treated as source, synthetic question cited as evidence, unstable source/doc/chunk lineage, tiny chunk subject loss, huge chunk semantic averaging, overlap top-k duplication, filter post-candidate loss, metadata type drift, ACL applied after retrieval, tenant leak, duplicate chunk ids, stale deletes, content hash or embedding hash drift, metric or normalization mismatch, ANN tuning before exact-search proof, quantization recall loss, reranker candidate starvation, hybrid score misuse, exact identifiers smoothed into embedding-only text, deep ANN pagination, raw vector or document leak, or unmeasured p95 latency | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Vector search integrity reviewed, retrieval/query/ingestion/quality/performance/privacy ledgers, exact-versus-ANN/filter/text-variant/contextual-header/lineage/hybrid/rerank findings, fix or recommendation, evidence level, verification, and remaining vector-search risk |
 | Dependency versions, lockfiles, package-manager metadata, workspace constraints, runtime engines, peer dependencies, optional dependencies, security advisory fixes, vulnerability scanner alerts, generated dependency output, framework plugins, dev servers, test runners, TypeScript compiler tracks, CI actions, Docker base images, package manager behavior, or toolchain versions are upgraded, downgraded, pinned, widened, regenerated, reviewed, or reported | `.mustflow/skills/dependency-upgrade-review/SKILL.md` | Dependency name, old and new versions or ranges, direct or transitive path, ecosystem and package manager, declaration files, lockfiles, runtime or toolchain files, advisory or release-note evidence, exploit preconditions, generated outputs, callers, docs, package output, Docker, CI, dev-server or test-UI exposure, protocol role, or TypeScript compiler-track surfaces, and command contract entries | Package declarations, lockfiles, generated outputs, compatibility code, tests, docs, package metadata, Docker or CI files, dev-server/test-runner config notes, TypeScript compiler-track notes, and directly synchronized examples | lockfile churn, hidden transitive replacement, peer or engine break, module-format drift, native or optional package break, framework or generator output drift, devDependency advisory dismissed despite exposure, unsafe broad security update, weakened tests, Docker or CI runtime drift, protocol DoS misclassified, TS7 RC over-adoption, TS7 nightly over-adoption, or unreviewed supply-chain change | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Upgrade reason, ecosystem surface, direct and transitive graph changes, compatibility classification, runtime/peer/engine/module/feature/platform/generated-output/compiler-track risks, advisory exploit preconditions, synchronized surfaces, verification, and remaining dependency-upgrade risk |
 | Dependency, package, runtime, framework, tool, command, plugin, service, platform capability, supported-version policy, security patch path, ecosystem maturity claim, maintainer-risk assumption, runtime portability claim, edge or serverless compatibility claim, critical-path library choice, package script, lifecycle hook, binary download, lockfile, audit result, or supply-chain-sensitive dependency surface is assumed, added, removed, imported, invoked, installed, audited, or documented | `.mustflow/skills/dependency-reality-check/SKILL.md` | Assumed dependency or capability, declaration files, version or feature expectation, role criticality, supported-version or end-of-life evidence, patchability expectation, runtime compatibility boundary, maintainer and ecosystem evidence when available, lockfile entry, package script or lifecycle hook, audit or provenance evidence, and relevant command intents | Package metadata, lockfiles, imports, scripts, command contracts, docs, tests, runtime policy notes, portability notes, and reports | unavailable dependency, hallucinated or lookalike package, fragile single-maintainer core dependency, experimental technology in a survival path, unsupported runtime, unclear security patch path, runtime-specific API leakage into core logic, stale version claim, lifecycle script risk, audit suppression, lockfile drift, or install guidance mismatch | `changes_status`, `changes_diff_summary`, `build`, `test_release`, `mustflow_check` | Dependency checked, ecosystem and maintainer-risk boundary reviewed, supported-version, patchability, and runtime-portability boundary reviewed, supply-chain surface reviewed, declarations synchronized, verification, and remaining dependency risk |
 | Generated or edited code, configuration, CI workflows, package metadata, install instructions, examples, Docker images, framework setup, runtime declarations, toolchain declarations, TypeScript compiler-track references, Go release or framework references, Java/JDK GA, LTS, JEP, JVM, GC, or toolchain references, Rust release or MSRV references, or migration-sensitive snippets introduce explicit external version references, action refs, package ranges, runtime versions, framework majors, Docker image tags, or scaffold commands that may be stale | `.mustflow/skills/version-freshness-check/SKILL.md` | Versioned reference, owning files, repository version policy, approved freshness source, compatibility context, migration risk, TypeScript compiler track, Go toolchain/framework track, Java JDK/toolchain/bytecode/JEP track, or Rust MSRV/toolchain track when relevant, and command contract entries | Package metadata, lockfiles, CI workflows, Dockerfiles, runtime files, framework config, docs, examples, templates, tests, and version-decision reports | stale default version, false latest claim, accidental major migration, repository policy mismatch, unsupported generated example, TypeScript RC/nightly/API-track confusion, Java latest-GA/LTS/runtime/JEP/preview/incubator confusion, Rust stable/nightly/MSRV confusion, floating-tag drift, or unverified security/support claim | `changes_status`, `changes_diff_summary`, `build`, `test_related`, `docs_validate_fast`, `test_release`, `mustflow_check` | Versioned surfaces checked, repository policy and freshness source, selected version track, compatibility classification, TypeScript stable/RC/nightly/API-track, Go runtime/framework, Java GA/LTS/runtime/JEP/toolchain, and Rust stable/nightly/MSRV split when relevant, approval need, synchronized surfaces, verification, and remaining version-freshness risk |