mustflow 2.114.12 → 2.115.0

package/dist/core/skill-route-audit.js

@@ -15,6 +15,7 @@ const TEMPLATE_SKILL_ROOT = 'templates/default/locales/en/.mustflow/skills';
 const TEMPLATE_ROUTES_PATH = 'templates/default/locales/en/.mustflow/skills/routes.toml';
 const TEMPLATE_MANIFEST_PATH = 'templates/default/manifest.toml';
 const TEMPLATE_I18N_PATH = 'templates/default/i18n.toml';
+const MANIFEST_LOCK_PATH = '.mustflow/config/manifest.lock.toml';
 const SKILL_PATH_PATTERN = /^\.mustflow\/skills\/([^/]+)\/SKILL\.md$/u;
 function normalizePath(value) {
     return value.replace(/\\/gu, '/');
@@ -163,6 +164,27 @@ function readTemplateManifest(projectRoot, issues) {
         return { creates: [], profileEntries: [] };
     }
 }
+function readActiveInstallProfile(projectRoot, issues) {
+    try {
+        if (!existsSync(path.join(projectRoot, ...MANIFEST_LOCK_PATH.split('/')))) {
+            return null;
+        }
+        const parsed = readMustflowOwnedTomlFile(projectRoot, MANIFEST_LOCK_PATH);
+        const profile = isRecord(parsed) && isRecord(parsed.template) && typeof parsed.template.profile === 'string'
+            ? parsed.template.profile.trim()
+            : '';
+        if (profile.length === 0) {
+            issues.push(`${MANIFEST_LOCK_PATH} does not declare a non-empty [template].profile value`);
+            return null;
+        }
+        return profile;
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        issues.push(`Could not read ${MANIFEST_LOCK_PATH}: ${message}`);
+        return null;
+    }
+}
 function readI18nDocuments(projectRoot, issues) {
     const documents = new Map();
     try {
@@ -211,6 +233,77 @@ function compareSetPresence(findings, left, right, options) {
 function createInputHash(reportInput) {
     return sha256(JSON.stringify(reportInput));
 }
+function hasFindingCodePrefix(findings, prefixes) {
+    return findings.some((finding) => prefixes.some((prefix) => finding.code.startsWith(prefix)));
+}
+function hasIssueMention(issues, paths) {
+    return issues.some((issue) => paths.some((pathValue) => issue.includes(pathValue)));
+}
+function createResolution(inventory, findings, issues, activeInstallProfile) {
+    const localPartial = hasIssueMention(issues, [SOURCE_SKILL_ROOT, SOURCE_INDEX_PATH, SOURCE_ROUTES_PATH]);
+    const localIssues = hasFindingCodePrefix(findings, ['skill_', 'route_', 'index_', 'frontmatter_']);
+    const templateAvailable = inventory.template_skills.length > 0 ||
+        inventory.manifest_skill_creates.length > 0 ||
+        inventory.manifest_profile_skills.length > 0 ||
+        inventory.i18n_skill_documents.length > 0;
+    const templatePartial = hasIssueMention(issues, [TEMPLATE_SKILL_ROOT, TEMPLATE_ROUTES_PATH, TEMPLATE_MANIFEST_PATH, TEMPLATE_I18N_PATH]);
+    const templateIssues = hasFindingCodePrefix(findings, ['template_', 'manifest_', 'i18n_']);
+    const activeInstallPartial = hasIssueMention(issues, [MANIFEST_LOCK_PATH]);
+    const activeInstallIssues = findings.some((finding) => finding.code === 'route_without_skill' || finding.code === 'index_without_skill');
+    const activeInstallStatus = activeInstallPartial
+        ? 'partial'
+        : activeInstallProfile === null
+            ? 'not_available'
+            : activeInstallIssues
+                ? 'issues_found'
+                : 'ok';
+    return {
+        local_registry: {
+            status: localPartial ? 'partial' : localIssues ? 'issues_found' : 'ok',
+            profile: null,
+            skill_root: SOURCE_SKILL_ROOT,
+            route_metadata: SOURCE_ROUTES_PATH,
+            index: SOURCE_INDEX_PATH,
+            manifest: null,
+            i18n: null,
+            note: 'Local registry status compares the installed skill files, routes.toml, and INDEX.md inside mustflow_root.',
+        },
+        packaged_template_registry: {
+            status: templatePartial ? 'partial' : !templateAvailable ? 'not_available' : templateIssues ? 'issues_found' : 'ok',
+            profile: null,
+            skill_root: TEMPLATE_SKILL_ROOT,
+            route_metadata: TEMPLATE_ROUTES_PATH,
+            index: null,
+            manifest: TEMPLATE_MANIFEST_PATH,
+            i18n: TEMPLATE_I18N_PATH,
+            note: 'Packaged template status compares source skills with the default install template, manifest creates, profiles, and i18n metadata.',
+        },
+        shared_workspace_registry: {
+            status: 'not_evaluated',
+            profile: null,
+            skill_root: null,
+            route_metadata: null,
+            index: null,
+            manifest: null,
+            i18n: null,
+            note: 'This script-pack audits the current mustflow_root only; agents in nested repositories must separately inspect any parent shared workspace skill registry named by AGENTS.md.',
+        },
+        active_install_profile: {
+            status: activeInstallStatus,
+            profile: activeInstallProfile,
+            skill_root: SOURCE_SKILL_ROOT,
+            route_metadata: SOURCE_ROUTES_PATH,
+            index: SOURCE_INDEX_PATH,
+            manifest: MANIFEST_LOCK_PATH,
+            i18n: null,
+            note: activeInstallProfile === null
+                ? `No active install profile was found in ${MANIFEST_LOCK_PATH}; use local_registry for current files and packaged_template_registry for built-in template coverage.`
+                : activeInstallIssues
+                    ? `Active install profile is "${activeInstallProfile}". Route or index entries reference skills absent from the current .mustflow/skills install surface; compare packaged_template_registry and shared_workspace_registry before treating a related skill as missing from mustflow.`
+                    : `Active install profile is "${activeInstallProfile}". Current route and index entries resolve to local skill files for this installed profile.`,
+        },
+    };
+}
 export function auditSkillRoutes(projectRoot) {
     const root = path.resolve(projectRoot);
     const issues = [];
@@ -225,6 +318,7 @@ export function auditSkillRoutes(projectRoot) {
     const manifestCreateSkillNames = uniqueSorted(manifest.creates.map((entry) => skillFromSkillPath(entry)).filter(Boolean));
     const i18nDocuments = readI18nDocuments(root, issues);
     const i18nSkillNames = uniqueSorted([...i18nDocuments.keys()].map((id) => id.replace(/^skill\./u, '')));
+    const activeInstallProfile = readActiveInstallProfile(root, issues);
     const findings = [];
     compareSetPresence(findings, sourceSkillNames, routeSkillNames, {
         missingCode: 'skill_without_route',
@@ -320,6 +414,7 @@ export function auditSkillRoutes(projectRoot) {
         manifest_profile_skills: manifestProfileSkills,
         i18n_skill_documents: i18nSkillNames,
     };
+    const resolution = createResolution(inventory, findings, issues, activeInstallProfile);
     const status = issues.length > 0 ? 'partial' : findings.length > 0 ? 'issues_found' : 'ok';
     return {
         schema_version: '1',
@@ -337,7 +432,7 @@ export function auditSkillRoutes(projectRoot) {
             template_manifest: TEMPLATE_MANIFEST_PATH,
             template_i18n: TEMPLATE_I18N_PATH,
         },
-        input_hash: createInputHash({ inventory, findings, issues }),
+        input_hash: createInputHash({ inventory, resolution, findings, issues }),
         counts: {
             source_skills: sourceSkillNames.length,
             index_routes: indexSkillNames.length,
@@ -348,6 +443,7 @@ export function auditSkillRoutes(projectRoot) {
             i18n_skill_documents: i18nSkillNames.length,
         },
         inventory,
+        resolution,
         findings,
         issues,
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mustflow",
-  "version": "2.114.12",
+  "version": "2.115.0",
   "description": "Agent workflow documents and CLI for mustflow repository roots.",
   "type": "module",
   "license": "MIT-0",

package/schemas/README.md

@@ -164,7 +164,8 @@ Current schemas:
   rewriting `.mustflow/config/manifest.lock.toml`
 - `skill-route-audit-report.schema.json`: output of
   `mf script-pack run repo/skill-route-audit audit --json`, containing source skill, route metadata,
-  skill index, default template skill copy, manifest profile, and i18n metadata drift findings
+  skill index, default template skill copy, manifest profile, i18n metadata drift findings, and
+  local/template/shared-workspace/active-profile registry resolution status
 - `repo-version-source-report.schema.json`: output of
   `mf script-pack run repo/version-source inspect --json`, containing detected version sources,
   release-versioning preference status, source authority counts, and missing-source findings

package/schemas/next-report.schema.json

@@ -254,8 +254,43 @@
             { "type": "null" }
           ]
         },
+        "safety_contract": {
+          "$ref": "#/$defs/safetyContract"
+        },
         "run_hint": { "type": "string" }
       }
+    },
+    "safetyContract": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "authority_class",
+        "execution_mode",
+        "command_authority",
+        "run_hint_authority",
+        "input_scope",
+        "output_scope",
+        "cannot_satisfy_intents",
+        "forbidden_actions"
+      ],
+      "properties": {
+        "authority_class": { "const": "advisory_evidence" },
+        "execution_mode": { "const": "suggestion_only" },
+        "command_authority": { "const": "requires_configured_intent" },
+        "run_hint_authority": { "const": "not_authority" },
+        "input_scope": { "const": "explicit_or_changed_paths" },
+        "output_scope": { "const": "bounded_report" },
+        "cannot_satisfy_intents": {
+          "type": "array",
+          "items": { "type": "string" },
+          "minItems": 1
+        },
+        "forbidden_actions": {
+          "type": "array",
+          "items": { "type": "string" },
+          "minItems": 1
+        }
+      }
     }
   }
 }

package/schemas/script-pack-catalog.schema.json

@@ -93,6 +93,41 @@
             { "type": "string", "pattern": "^[a-z0-9-]+\\.schema\\.json$" },
             { "type": "null" }
           ]
+        },
+        "safety_contract": {
+          "$ref": "#/$defs/safetyContract"
+        }
+      }
+    },
+    "safetyContract": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "authority_class",
+        "execution_mode",
+        "command_authority",
+        "run_hint_authority",
+        "input_scope",
+        "output_scope",
+        "cannot_satisfy_intents",
+        "forbidden_actions"
+      ],
+      "properties": {
+        "authority_class": { "const": "advisory_evidence" },
+        "execution_mode": { "const": "suggestion_only" },
+        "command_authority": { "const": "requires_configured_intent" },
+        "run_hint_authority": { "const": "not_authority" },
+        "input_scope": { "const": "explicit_or_changed_paths" },
+        "output_scope": { "const": "bounded_report" },
+        "cannot_satisfy_intents": {
+          "type": "array",
+          "items": { "type": "string" },
+          "minItems": 1
+        },
+        "forbidden_actions": {
+          "type": "array",
+          "items": { "type": "string" },
+          "minItems": 1
         }
       }
     }

package/schemas/script-pack-suggestion-report.schema.json

@@ -152,8 +152,43 @@
             { "type": "null" }
           ]
         },
+        "safety_contract": {
+          "$ref": "#/$defs/safetyContract"
+        },
         "run_hint": { "type": "string" }
       }
+    },
+    "safetyContract": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "authority_class",
+        "execution_mode",
+        "command_authority",
+        "run_hint_authority",
+        "input_scope",
+        "output_scope",
+        "cannot_satisfy_intents",
+        "forbidden_actions"
+      ],
+      "properties": {
+        "authority_class": { "const": "advisory_evidence" },
+        "execution_mode": { "const": "suggestion_only" },
+        "command_authority": { "const": "requires_configured_intent" },
+        "run_hint_authority": { "const": "not_authority" },
+        "input_scope": { "const": "explicit_or_changed_paths" },
+        "output_scope": { "const": "bounded_report" },
+        "cannot_satisfy_intents": {
+          "type": "array",
+          "items": { "type": "string" },
+          "minItems": 1
+        },
+        "forbidden_actions": {
+          "type": "array",
+          "items": { "type": "string" },
+          "minItems": 1
+        }
+      }
     }
   }
 }

package/schemas/skill-route-audit-report.schema.json

@@ -18,6 +18,7 @@
     "input_hash",
     "counts",
     "inventory",
+    "resolution",
     "findings",
     "issues"
   ],
@@ -45,6 +46,7 @@
     "input_hash": { "$ref": "#/$defs/sha256" },
     "counts": { "$ref": "#/$defs/counts" },
     "inventory": { "$ref": "#/$defs/inventory" },
+    "resolution": { "$ref": "#/$defs/resolution" },
     "findings": {
       "type": "array",
       "items": { "$ref": "#/$defs/finding" }
@@ -107,6 +109,40 @@
         "i18n_skill_documents": { "$ref": "#/$defs/stringArray" }
       }
     },
+    "registryStatus": {
+      "enum": ["ok", "issues_found", "partial", "not_available", "not_evaluated"]
+    },
+    "registryScope": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["status", "profile", "skill_root", "route_metadata", "index", "manifest", "i18n", "note"],
+      "properties": {
+        "status": { "$ref": "#/$defs/registryStatus" },
+        "profile": { "type": ["string", "null"] },
+        "skill_root": { "type": ["string", "null"] },
+        "route_metadata": { "type": ["string", "null"] },
+        "index": { "type": ["string", "null"] },
+        "manifest": { "type": ["string", "null"] },
+        "i18n": { "type": ["string", "null"] },
+        "note": { "type": "string" }
+      }
+    },
+    "resolution": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "local_registry",
+        "packaged_template_registry",
+        "shared_workspace_registry",
+        "active_install_profile"
+      ],
+      "properties": {
+        "local_registry": { "$ref": "#/$defs/registryScope" },
+        "packaged_template_registry": { "$ref": "#/$defs/registryScope" },
+        "shared_workspace_registry": { "$ref": "#/$defs/registryScope" },
+        "active_install_profile": { "$ref": "#/$defs/registryScope" }
+      }
+    },
     "finding": {
       "type": "object",
       "additionalProperties": false,

package/schemas/skill-route-report.schema.json

@@ -291,9 +291,44 @@
             { "type": "null" }
           ]
         },
+        "safety_contract": {
+          "$ref": "#/$defs/safetyContract"
+        },
         "run_hint": { "type": "string" }
       }
     },
+    "safetyContract": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "authority_class",
+        "execution_mode",
+        "command_authority",
+        "run_hint_authority",
+        "input_scope",
+        "output_scope",
+        "cannot_satisfy_intents",
+        "forbidden_actions"
+      ],
+      "properties": {
+        "authority_class": { "const": "advisory_evidence" },
+        "execution_mode": { "const": "suggestion_only" },
+        "command_authority": { "const": "requires_configured_intent" },
+        "run_hint_authority": { "const": "not_authority" },
+        "input_scope": { "const": "explicit_or_changed_paths" },
+        "output_scope": { "const": "bounded_report" },
+        "cannot_satisfy_intents": {
+          "type": "array",
+          "items": { "type": "string" },
+          "minItems": 1
+        },
+        "forbidden_actions": {
+          "type": "array",
+          "items": { "type": "string" },
+          "minItems": 1
+        }
+      }
+    },
     "candidate": {
       "type": "object",
       "additionalProperties": false,

package/schemas/verification-plan.schema.json

@@ -221,9 +221,44 @@
             { "type": "null" }
           ]
         },
+        "safety_contract": {
+          "$ref": "#/$defs/safetyContract"
+        },
         "run_hint": { "type": "string" }
       }
     },
+    "safetyContract": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "authority_class",
+        "execution_mode",
+        "command_authority",
+        "run_hint_authority",
+        "input_scope",
+        "output_scope",
+        "cannot_satisfy_intents",
+        "forbidden_actions"
+      ],
+      "properties": {
+        "authority_class": { "const": "advisory_evidence" },
+        "execution_mode": { "const": "suggestion_only" },
+        "command_authority": { "const": "requires_configured_intent" },
+        "run_hint_authority": { "const": "not_authority" },
+        "input_scope": { "const": "explicit_or_changed_paths" },
+        "output_scope": { "const": "bounded_report" },
+        "cannot_satisfy_intents": {
+          "type": "array",
+          "items": { "type": "string" },
+          "minItems": 1
+        },
+        "forbidden_actions": {
+          "type": "array",
+          "items": { "type": "string" },
+          "minItems": 1
+        }
+      }
+    },
     "classification": {
       "type": "object",
       "additionalProperties": false,

package/templates/default/i18n.toml

@@ -778,6 +778,12 @@ source_locale = "en"
 revision = 4
 translations = {}
 
+[documents."skill.nestjs-code-change"]
+source = "locales/en/.mustflow/skills/nestjs-code-change/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
 [documents."skill.react-code-change"]
 source = "locales/en/.mustflow/skills/react-code-change/SKILL.md"
 source_locale = "en"

package/templates/default/locales/en/.mustflow/skills/INDEX.md

@@ -316,6 +316,10 @@ refer to `AGENTS.md` and `.mustflow/config/commands.toml` to implement the most
   extensions, middleware, Tower or Tower-HTTP layers, CORS, cookies, headers, Tokio tasks or locks,
   SQLx pools, rejections, error responses, body limits, WebSockets, or Rust HTTP API tests are
   created, changed, reviewed, or upgraded.
+- Use `nestjs-code-change` as a primary route when NestJS modules, controllers, providers,
+  dependency injection, guards, pipes, interceptors, filters, OpenAPI metadata, adapters,
+  lifecycle hooks, queues, schedulers, WebSockets, microservices, or Nest-backed HTTP API tests are
+  created, changed, reviewed, or upgraded.
 - Use `godot-code-change` as a primary route when Godot projects, scenes, nodes, GDScript, C#
   scripts, Resources, Autoloads, signals, groups, save/load systems, rendering, physics, UI,
   input, exports, plugins, editor tools, or Godot version migrations are created, changed, reviewed,
@@ -598,6 +602,7 @@ routes. Event routes stay inactive until their event occurs.
 | Godot projects, scenes, nodes, GDScript, C# scripts, Resources, Autoloads, signals, groups, save/load systems, rendering, physics, UI, input, exports, plugins, editor tools, or Godot version migrations are created, changed, reviewed, or upgraded | `.mustflow/skills/godot-code-change/SKILL.md` | Godot version, renderer, platform targets, project settings, input map, autoloads, addons, affected scenes, scripts, Resources, save/load participants, export presets, profiler evidence when performance is claimed, and command contract entries | Godot scenes, nodes, GDScript or C# scripts, Resources, Autoloads, signals, groups, save/load systems, rendering, physics, UI, input, exports, plugins, editor tools, tests, and docs examples | stale Godot version claim, scene-tree reach-through, global-state sprawl, shared Resource mutation, hidden signal flow, save corruption, thread-unsafe SceneTree access, renderer regression, target-device drift, export preset drift, or stale migration advice | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `mustflow_check` | Godot version, renderer, scene, node, signal, Resource, Autoload, save/load, rendering, physics, UI, input, export, verification, and remaining Godot risk |
 | Dart source, pub package metadata, null safety, Futures, Streams, isolates, analyzer lints, tests, CLI entry points, or public package APIs are created or changed | `.mustflow/skills/dart-code-change/SKILL.md` | Pub metadata, analyzer config, public exports, async ownership, package layout, changed files, and command contract entries | Dart source, pub metadata, exports, async code, tests, examples, and docs | null-safety bypass, discarded Future, uncanceled Stream, isolate ownership drift, or public API breakage | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `mustflow_check` | Nullability, async, stream, isolate, and API boundary checked, verification, and remaining Dart risk |
 | Hono apps, route chains, middleware order, validators, RPC or typed clients, OpenAPI schema generation, runtime bindings, context variables, auth, CORS, cookie, header, streaming, WebSocket, cache, static asset, or Cloudflare/Bun/Node/Deno/serverless adapter boundaries are created or changed | `.mustflow/skills/hono-code-change/SKILL.md` | App entry, runtime adapter, route modules, middleware order, binding and variable types, schemas, validators, OpenAPI setup, RPC or SDK client types, response contract, changed files, and command contract entries | Hono routes, middleware, validators, bindings, context variables, RPC types, OpenAPI or SDK surfaces, runtime entry files, tests, and docs examples | route-order shadowing, runtime API mixing, middleware order bug, auth/CORS/cookie/header gap, body parser drift, OpenAPI/RPC type drift, response envelope drift, streaming or WebSocket cancellation leak, cache or static path leak, adapter header drift, or broken typed route inference | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `mustflow_check` | Runtime, adapter, route-order, middleware, validation, auth/CORS/cookie/header, OpenAPI/RPC/SDK, streaming/cache/static, and response boundary checked, verification, and remaining Hono risk |
+| NestJS modules, controllers, providers, dependency injection, pipes, guards, interceptors, filters, decorators, OpenAPI metadata, adapters, lifecycle hooks, queues, schedulers, WebSockets, microservices, or Nest-backed HTTP API tests are created, changed, reviewed, or upgraded | `.mustflow/skills/nestjs-code-change/SKILL.md` | Nest package and adapter evidence, app bootstrap, modules, controllers, providers, DTOs, guards, pipes, interceptors, filters, middleware, OpenAPI setup, generated clients, changed files, and command contract entries | Nest modules, controllers, providers, DI tokens, dynamic modules, DTOs, validation pipes, guards, interceptors, filters, middleware, adapter-specific code, OpenAPI metadata, tests, and docs examples | hidden global module dependency, DI token drift, casual `forwardRef`, request-local singleton mutation, provider-scope performance bug, validation transform mismatch, auth or guard bypass, inconsistent error envelope, Express/Fastify adapter drift, OpenAPI/runtime drift, lifecycle leak, queue ack bug, or dishonest test-module override | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `mustflow_check` | Module, provider, DI token, scope, lifecycle, route, DTO, validation, guard, interceptor, filter, adapter, OpenAPI, verification, and remaining NestJS risk |
 | Elysia routes, schemas, Standard Schema validators, plugins, decorators, derives, resolves, guards, macros, auth, error handling, OpenAPI or Scalar docs, Eden Treaty clients, streaming, WebSocket, or Bun-backed server behavior are created or changed | `.mustflow/skills/elysia-code-change/SKILL.md` | Server entry, route modules, schemas, plugins, auth, cookies, CORS, lifecycle hooks, OpenAPI or Eden surface, streaming/WebSocket config, deploy settings, changed files, and command contract entries | Elysia routes, schemas, plugins, generated clients, docs UI or raw OpenAPI config, tests, deploy config, and docs examples | schema/type drift, context inference loss, lifecycle scope gap, auth gap, CORS or OpenAPI exposure, inconsistent error envelope, stale OpenAPI/Eden output, streaming timeout gap, WebSocket backpressure gap, or route path SDK drift | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `mustflow_check` | Schema, validation, type inference, lifecycle, auth, error, OpenAPI/Eden, runtime/deploy impact checked, verification, and remaining Elysia risk |
 | Source anchors are added, revised, reviewed, or used to mark a module boundary | `.mustflow/skills/source-anchor-authoring/SKILL.md` | Target files, anchor reason, nearby anchors, source-anchor policy, and validation surface | Source anchors and directly related workflow docs or comments | comment bloat, authority drift, false verification claims, or hidden module pressure | `mustflow_check`, `docs_validate_fast` | Anchor placement decision, field choices, module-boundary handoff, and verification |
 | Changed files need risk classification and verification selection | `.mustflow/skills/diff-risk-review/SKILL.md` | Changed-file list, diff summary, and task goal | Changed surfaces and verification report | under- or over-verification | `changes_status`, `changes_diff_summary`, `test`, `test_related`, `test_audit`, `lint`, `build`, `docs_validate`, `mustflow_check` | Risk level, verification choice, rollback notes |

package/templates/default/locales/en/.mustflow/skills/nestjs-code-change/SKILL.md

@@ -0,0 +1,141 @@
+---
+mustflow_doc: skill.nestjs-code-change
+locale: en
+canonical: true
+revision: 1
+lifecycle: mustflow-owned
+authority: procedure
+name: nestjs-code-change
+description: Apply this skill when NestJS modules, controllers, providers, dependency injection, pipes, guards, interceptors, filters, decorators, OpenAPI metadata, adapters, lifecycle hooks, queues, schedulers, WebSockets, microservices, or Nest-backed HTTP API tests are created, changed, reviewed, or upgraded.
+metadata:
+  mustflow_schema: "1"
+  mustflow_kind: procedure
+  pack_id: mustflow.core
+  skill_id: mustflow.core.nestjs-code-change
+  command_intents:
+    - changes_status
+    - changes_diff_summary
+    - lint
+    - build
+    - test_related
+    - test
+    - docs_validate_fast
+    - mustflow_check
+---
+
+# NestJS Code Change
+
+<!-- mustflow-section: purpose -->
+## Purpose
+
+Preserve NestJS module boundaries, dependency-injection ownership, request pipeline order, validation, auth, error, OpenAPI, adapter, lifecycle, and test-module behavior while making focused Nest-backed service or API changes.
+
+<!-- mustflow-section: use-when -->
+## Use When
+
+- `@Module`, `@Controller`, route decorators, providers, custom decorators, dependency injection tokens, dynamic modules, global modules, guards, pipes, interceptors, filters, middleware, or Nest testing modules change.
+- The task touches REST controllers, GraphQL resolvers, WebSockets, microservices, queues, schedulers, lifecycle hooks, adapters, request-scoped providers, validation pipes, class-transformer/class-validator behavior, OpenAPI metadata, or generated clients.
+- The task changes auth, tenant, permission, request id, session, cache, transaction, or outbound integration behavior inside a Nest request path.
+
+<!-- mustflow-section: do-not-use-when -->
+## Do Not Use When
+
+- The task only changes framework-free service code behind a Nest provider and no provider scope, module export, decorator, pipeline, route, or test-module behavior changes; use the relevant language, architecture, data, or security skill.
+- The project uses Hono, Elysia, Axum, Express without Nest, Fastify without Nest, or another framework as the route owner.
+- The task only updates version prose; use `source-freshness-check` unless the NestJS procedure itself changes.
+
+<!-- mustflow-section: required-inputs -->
+## Required Inputs
+
+- Package metadata, Nest package versions, TypeScript config, app bootstrap, adapter choice, modules, controllers, providers, decorators, guards, pipes, interceptors, filters, middleware, OpenAPI setup, generated client surfaces, and tests.
+- Route ledger: method, path, controller prefix, versioning, params, query, headers, cookies, body DTO, validation pipe behavior, auth boundary, response statuses, content types, and public error envelope.
+- Dependency ledger: module imports, provider tokens, exports, scopes, dynamic module options, global modules, circular dependencies, async factories, config sources, request scope, and lifecycle hooks.
+- Existing verification intents for typecheck, build, controller tests, provider tests, e2e HTTP tests, OpenAPI generation, and mustflow validation.
+
+<!-- mustflow-section: preconditions -->
+## Preconditions
+
+- Read package metadata, bootstrap, affected modules, controllers, providers, DTOs, decorators, pipeline components, OpenAPI setup, and tests before editing.
+- Identify whether Express or Fastify is the active Nest adapter before using adapter-specific APIs.
+- Identify global pipes, guards, interceptors, filters, middleware, versioning, CORS, prefix, and OpenAPI setup before changing route behavior.
+- Refresh official or repository-local evidence before preserving exact latest-version, migration, or release-specific claims.
+
+<!-- mustflow-section: allowed-edits -->
+## Allowed Edits
+
+- Keep Nest framework concerns at module, controller, provider, decorator, and pipeline boundaries.
+- Keep framework-free business logic in services where possible, but do not erase provider tokens, scopes, or module ownership needed by DI.
+- Update DTOs, validation pipes, guards, interceptors, filters, OpenAPI metadata, tests, and docs examples when public API behavior changes.
+- Do not hide dependencies in global modules, static singletons, module-level mutable state, or `forwardRef()` unless the cycle is explicit and reported.
+- Do not bypass configured command intents or run unconfigured Nest servers, watchers, migrations, or generators.
+
+<!-- mustflow-section: procedure -->
+## Procedure
+
+1. Read bootstrap, app module, affected feature modules, controllers, providers, DTOs, guards, pipes, interceptors, filters, middleware, OpenAPI setup, and tests.
+2. Build a module ledger: imports, providers, exports, dynamic module options, global modules, async factories, provider tokens, scopes, lifecycle hooks, and any circular dependencies.
+3. Build a route ledger: controller prefix, method, path, version, params, query, headers, cookies, body DTO, validation pipe, auth and permission guards, interceptors, filters, response status, content type, and public client surface.
+4. Keep dependency injection explicit. Prefer constructor injection with stable tokens, avoid service locators, and avoid importing concrete infrastructure providers into unrelated feature modules.
+5. Treat provider scope as a performance and correctness contract. Use singleton scope by default, request scope only when request-local data truly belongs in DI, and transient scope only when every construction cost and state boundary is intentional.
+6. Avoid `forwardRef()` as a casual cycle fix. If a cycle appears, inspect the module boundary, extract a port/interface, move shared policy, or report why the explicit cycle is accepted.
+7. Check dynamic modules and async factories. Keep options typed, validate config at the boundary, avoid reading secrets into logs or reports, and make module initialization failure explicit.
+8. Keep request-local data out of singleton provider mutable fields. Current user, tenant, request id, locale, transaction, or per-request cache should travel through request objects, guards, interceptors, CLS-style infrastructure with clear ownership, or explicit method arguments.
+9. Review pipeline order:
+   - middleware runs before guards;
+   - guards decide access before interceptors and pipes complete the handler path;
+   - pipes transform and validate inputs;
+   - interceptors wrap handler execution and response mapping;
+   - filters map thrown exceptions.
+10. Do not treat CORS, Swagger hiding, or route omission from OpenAPI as authorization. Add real guards or report the exposure.
+11. For DTOs, distinguish TypeScript shape from runtime validation. Class decorators, global `ValidationPipe` options, transform behavior, whitelist, forbid settings, nested validation, arrays, dates, enums, partial update DTOs, and file uploads must be checked against real runtime behavior.
+12. For params, query, headers, and cookies, remember that HTTP input starts as strings. Use explicit parse pipes, DTO transform rules, or schema validation rather than relying on TypeScript annotations.
+13. Keep response and error envelopes consistent. Map validation, auth, permission, not-found, conflict, rate-limit, upstream, timeout, and internal failures deliberately; do not leak stack traces, SQL, tokens, or provider details.
+14. Review adapter-specific behavior. Express and Fastify differ in reply objects, middleware plugins, body parsing, cookies, streaming, multipart handling, and lifecycle hooks; isolate adapter-specific APIs.
+15. Review OpenAPI and generated clients as separate public contracts. Ensure decorators, DTO metadata, mapped types, unions, file uploads, auth schemes, versioning, and hidden routes match the actual runtime route.
+16. For GraphQL, WebSockets, queues, schedulers, and microservices, map the transport boundary, serialization, auth context, retry/ack semantics, idempotency, cancellation, and lifecycle shutdown behavior before editing.
+17. For transactions, caches, queues, and outbound calls inside providers, apply the narrower data, transaction, performance, or third-party integration skill when those invariants change.
+18. Keep test modules honest. Override only the provider under test, preserve guards/pipes/interceptors when testing route behavior, and avoid mocks that remove the behavior being changed.
+19. Choose configured verification intents that cover type checking, build, controller/provider tests, validation failure, auth failure, OpenAPI output, and e2e adapter behavior when available.
+
+<!-- mustflow-section: postconditions -->
+## Postconditions
+
+- Module imports, provider tokens, exports, scopes, and lifecycle hooks remain intentional.
+- Route, validation, auth, interceptor, filter, response, adapter, OpenAPI, and generated-client behavior are synchronized.
+- Request-local state is not hidden in singleton mutable fields.
+- Any missing route-level, OpenAPI, adapter, lifecycle, queue, WebSocket, microservice, or e2e verification is reported.
+
+<!-- mustflow-section: verification -->
+## Verification
+
+Use configured oneshot command intents when available:
+
+- `lint`
+- `build`
+- `test_related`
+- `test`
+- `docs_validate_fast`
+- `mustflow_check`
+
+Report missing Nest controller, provider, pipeline, OpenAPI, adapter, e2e, queue, WebSocket, microservice, or lifecycle verification intents when relevant.
+
+<!-- mustflow-section: failure-handling -->
+## Failure Handling
+
+- If DI fails, inspect provider token registration, module imports and exports, dynamic module setup, circular dependencies, and test module overrides before adding globals or broad imports.
+- If validation behaves unexpectedly, inspect global `ValidationPipe` options, DTO decorators, nested types, transform settings, and whether the route is using a raw body or file upload path.
+- If auth or permission behavior is unclear, stop that route change and inspect guards, decorators, metadata readers, and route-level overrides before broadening access.
+- If OpenAPI looks right but runtime behavior differs, make runtime behavior the source of truth and fix or report the documentation/client drift.
+- If adapter-specific behavior cannot be covered by configured checks, report the skipped Express or Fastify smoke coverage.
+
+<!-- mustflow-section: output-format -->
+## Output Format
+
+- Boundary checked
+- Module, provider, DI token, scope, and lifecycle notes
+- Route, DTO, validation, guard, interceptor, filter, and response notes
+- Adapter, OpenAPI, generated client, GraphQL, WebSocket, queue, scheduler, or microservice notes when touched
+- Files changed
+- Command intents run
+- Skipped checks and reasons
+- Remaining NestJS risk

package/templates/default/locales/en/.mustflow/skills/routes.toml

@@ -660,6 +660,12 @@ route_type = "primary"
 priority = 85
 applies_to_reasons = ["code_change", "behavior_change", "public_api_change", "test_change", "docs_change", "performance_change", "security_change", "privacy_change", "package_metadata_change", "release_risk"]
 
+[routes."nestjs-code-change"]
+category = "general_code"
+route_type = "primary"
+priority = 85
+applies_to_reasons = ["code_change", "behavior_change", "public_api_change", "test_change", "docs_change", "performance_change", "security_change", "privacy_change", "data_change", "package_metadata_change", "release_risk"]
+
 [routes."elysia-code-change"]
 category = "general_code"
 route_type = "primary"