mustflow 2.115.17 → 2.116.1

package/dist/core/skill-route-resolution.js

@@ -483,6 +483,7 @@ function hasDependencySignal(signal, dependencySignals, taskTerms, pathTerms) {
 function collectDependencySignals(paths, reasons, taskTerms, pathTerms) {
     const dependencySignals = new Set(reasons);
     const inputTerms = new Set([...taskTerms, ...pathTerms]);
+    const hasAnyInputTerm = (...terms) => terms.some((term) => inputTerms.has(term));
     if (inputTerms.has('output') &&
         (inputTerms.has('machine') || inputTerms.has('json') || inputTerms.has('jsonl') || inputTerms.has('cli'))) {
         dependencySignals.add('machine_output_changed');
@@ -497,6 +498,36 @@ function collectDependencySignals(paths, reasons, taskTerms, pathTerms) {
         (inputTerms.has('next') && inputTerms.has('action'))) {
         dependencySignals.add('concrete_followup_exists');
     }
+    if (hasAnyInputTerm('commit', 'committed') &&
+        hasAnyInputTerm('publish', 'published', 'publisher') &&
+        hasAnyInputTerm('split', 'outbox', 'reconcile', 'reconciliation')) {
+        dependencySignals.add('commit_publish_split');
+    }
+    if (inputTerms.has('capability') &&
+        hasAnyInputTerm('scope', 'scoped') &&
+        hasAnyInputTerm('tool', 'tools')) {
+        dependencySignals.add('capability_scoped_tool');
+    }
+    if (inputTerms.has('allow') && inputTerms.has('deny') && inputTerms.has('approval')) {
+        dependencySignals.add('allow_deny_approval');
+    }
+    if (inputTerms.has('contract') &&
+        inputTerms.has('version') &&
+        hasAnyInputTerm('migrate', 'migrated', 'migration')) {
+        dependencySignals.add('contract_version_migration');
+    }
+    const hasReservationTerm = hasAnyInputTerm('reserve', 'reserved', 'reserves', 'reservation');
+    if (inputTerms.has('budget') && hasReservationTerm) {
+        dependencySignals.add('budget_reservation');
+    }
+    if (hasReservationTerm && hasAnyInputTerm('settle', 'settled', 'settles', 'settlement')) {
+        dependencySignals.add('reservation_settlement');
+    }
+    if (hasAnyInputTerm('child', 'children') &&
+        hasAnyInputTerm('join', 'joined') &&
+        hasAnyInputTerm('cancel', 'cancelled', 'cancellation')) {
+        dependencySignals.add('child_join_cancel');
+    }
     return dependencySignals;
 }
 function addDependencySelectionReason(candidate, reason) {
@@ -549,14 +580,14 @@ function selectAdjuncts(main, scoredCandidates, allCandidatesBySkill, metadata,
     for (const skill of selectedMain.route_card.route_dependencies.requires_skills) {
         addDependencySkill(skill, `route_dependency:requires:${selectedMain.skill}`);
     }
-    for (const skill of selectedMain.route_card.route_dependencies.suggests_adjuncts) {
-        addDependencySkill(skill, `route_dependency:suggested_by:${selectedMain.skill}`);
-    }
     for (const unlockRule of selectedMain.route_card.route_dependencies.unlocks_on) {
         if (hasDependencySignal(unlockRule.signal, dependencySignals, taskTerms, pathTerms)) {
             addDependencySkill(unlockRule.skill, `route_dependency:unlocked_by:${selectedMain.skill}:${unlockRule.signal}`);
         }
     }
+    for (const skill of selectedMain.route_card.route_dependencies.suggests_adjuncts) {
+        addDependencySkill(skill, `route_dependency:suggested_by:${selectedMain.skill}`);
+    }
     if (selected.length >= DEFAULT_MAX_ADJUNCTS) {
         return selected.slice(0, DEFAULT_MAX_ADJUNCTS);
     }

package/dist/core/source-anchors.js

@@ -116,6 +116,14 @@ function sourceAnchorPathPartIsIgnored(part, ignoredDirectoryNames) {
     return (ignoredDirectoryNames.has(part) ||
         SOURCE_ANCHOR_DEFAULT_EXCLUDED_PATH_PREFIXES.some((prefix) => part.startsWith(prefix)));
 }
+function directoryIsLinkedGitCheckout(directoryPath) {
+    try {
+        return statSync(path.join(directoryPath, '.git')).isFile();
+    }
+    catch {
+        return false;
+    }
+}
 function listFilesRecursive(root, options, current = root, depth = 0) {
     if (!existsSync(current)) {
         return [];
@@ -123,6 +131,9 @@ function listFilesRecursive(root, options, current = root, depth = 0) {
     if (depth > MAX_SOURCE_ANCHOR_DIRECTORY_DEPTH) {
         return [];
     }
+    if (depth > 0 && directoryIsLinkedGitCheckout(current)) {
+        return [];
+    }
     let currentRealPath;
     try {
         currentRealPath = realpathSync(current);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mustflow",
-  "version": "2.115.17",
+  "version": "2.116.1",
   "description": "Agent workflow documents and CLI for mustflow repository roots.",
   "type": "module",
   "license": "MIT-0",

package/templates/default/i18n.toml

@@ -62,7 +62,7 @@ translations = {}
 [documents."skills.index"]
 source = "locales/en/.mustflow/skills/INDEX.md"
 source_locale = "en"
-revision = 243
+revision = 245
 translations = {}
 
 [documents."skill.ada-code-change"]
@@ -74,7 +74,7 @@ translations = {}
 [documents."skill.adapter-boundary"]
 source = "locales/en/.mustflow/skills/adapter-boundary/SKILL.md"
 source_locale = "en"
-revision = 13
+revision = 14
 translations = {}
 
 [documents."skill.artifact-integrity-check"]
@@ -92,7 +92,7 @@ translations = {}
 [documents."skill.api-contract-change"]
 source = "locales/en/.mustflow/skills/api-contract-change/SKILL.md"
 source_locale = "en"
-revision = 3
+revision = 4
 translations = {}
 
 [documents."skill.http-api-semantics-review"]
@@ -182,6 +182,36 @@ translations = {}
 [documents."skill.credit-ledger-integrity-review"]
 source = "locales/en/.mustflow/skills/credit-ledger-integrity-review/SKILL.md"
 source_locale = "en"
+revision = 2
+translations = {}
+
+[documents."skill.dual-write-consistency"]
+source = "locales/en/.mustflow/skills/dual-write-consistency/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
+[documents."skill.durable-workflow-orchestration"]
+source = "locales/en/.mustflow/skills/durable-workflow-orchestration/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
+[documents."skill.execution-ledger-integrity-review"]
+source = "locales/en/.mustflow/skills/execution-ledger-integrity-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
+[documents."skill.policy-decision-integrity-review"]
+source = "locales/en/.mustflow/skills/policy-decision-integrity-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
+[documents."skill.structured-concurrency-supervision-review"]
+source = "locales/en/.mustflow/skills/structured-concurrency-supervision-review/SKILL.md"
+source_locale = "en"
 revision = 1
 translations = {}
 
@@ -401,6 +431,12 @@ source_locale = "en"
 revision = 4
 translations = {}
 
+[documents."skill.parser-engineering-review"]
+source = "locales/en/.mustflow/skills/parser-engineering-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
 [documents."skill.type-state-modeling-review"]
 source = "locales/en/.mustflow/skills/type-state-modeling-review/SKILL.md"
 source_locale = "en"
@@ -422,7 +458,7 @@ translations = {}
 [documents."skill.concurrency-invariant-review"]
 source = "locales/en/.mustflow/skills/concurrency-invariant-review/SKILL.md"
 source_locale = "en"
-revision = 2
+revision = 3
 translations = {}
 
 [documents."skill.failure-integrity-review"]
@@ -470,7 +506,7 @@ translations = {}
 [documents."skill.idempotency-integrity-review"]
 source = "locales/en/.mustflow/skills/idempotency-integrity-review/SKILL.md"
 source_locale = "en"
-revision = 1
+revision = 2
 translations = {}
 
 [documents."skill.retry-policy-integrity-review"]
@@ -482,13 +518,13 @@ translations = {}
 [documents."skill.queue-processing-integrity-review"]
 source = "locales/en/.mustflow/skills/queue-processing-integrity-review/SKILL.md"
 source_locale = "en"
-revision = 1
+revision = 2
 translations = {}
 
 [documents."skill.transaction-boundary-integrity-review"]
 source = "locales/en/.mustflow/skills/transaction-boundary-integrity-review/SKILL.md"
 source_locale = "en"
-revision = 1
+revision = 2
 translations = {}
 
 [documents."skill.testability-boundary-review"]
@@ -985,7 +1021,7 @@ translations = {}
 [documents."skill.public-json-contract-change"]
 source = "locales/en/.mustflow/skills/public-json-contract-change/SKILL.md"
 source_locale = "en"
-revision = 2
+revision = 3
 translations = {}
 
 [documents."skill.provenance-license-gate"]
@@ -1003,7 +1039,7 @@ translations = {}
 [documents."skill.command-pattern"]
 source = "locales/en/.mustflow/skills/command-pattern/SKILL.md"
 source_locale = "en"
-revision = 13
+revision = 14
 translations = {}
 
 [documents."skill.command-contract-authoring"]
@@ -1092,7 +1128,7 @@ translations = {}
 [documents."skill.migration-safety-check"]
 source = "locales/en/.mustflow/skills/migration-safety-check/SKILL.md"
 source_locale = "en"
-revision = 8
+revision = 9
 translations = {}
 
 [documents."skill.multi-agent-work-coordination"]
@@ -1164,7 +1200,7 @@ translations = {}
 [documents."skill.state-machine-pattern"]
 source = "locales/en/.mustflow/skills/state-machine-pattern/SKILL.md"
 source_locale = "en"
-revision = 5
+revision = 6
 translations = {}
 
 [documents."skill.strategy-pattern"]
@@ -1332,7 +1368,7 @@ translations = {}
 [documents."skill.llm-token-cost-control-review"]
 source = "locales/en/.mustflow/skills/llm-token-cost-control-review/SKILL.md"
 source_locale = "en"
-revision = 4
+revision = 5
 translations = {}
 
 [documents."skill.llm-response-latency-review"]
@@ -1344,7 +1380,7 @@ translations = {}
 [documents."skill.agent-execution-control-review"]
 source = "locales/en/.mustflow/skills/agent-execution-control-review/SKILL.md"
 source_locale = "en"
-revision = 1
+revision = 2
 translations = {}
 
 [documents."skill.browser-automation-reliability-review"]

package/templates/default/locales/en/.mustflow/skills/INDEX.md

@@ -2,7 +2,7 @@
 mustflow_doc: skills.index
 locale: en
 canonical: true
-revision: 243
+revision: 245
 authority: router
 lifecycle: mustflow-owned
 ---
@@ -134,6 +134,21 @@ refer to `AGENTS.md` and `.mustflow/config/commands.toml` to implement the most
   reconciliation jobs need ledger integrity review for idempotency, atomic balance changes,
   concurrency, ordering, ownership, amount precision, policy snapshots, expiry lots, audit, or
   reconciliation risk.
+- Use `dual-write-consistency` as an adjunct when one logical operation commits local state and
+  separately publishes, projects, calls, or writes another independently committed system, so
+  crash points, outbox or inbox delivery, reconciliation, and eventual convergence must be proved.
+- Use `durable-workflow-orchestration` as a primary route when one business outcome spans multiple
+  persisted commands, entities, services, callbacks, timers, approvals, retries, or compensations
+  and must resume safely after process loss or deployment.
+- Use `execution-ledger-integrity-review` as an adjunct when runs, attempts, leases, approvals,
+  checkpoints, effects, receipts, terminal outcomes, reconciliation, or replay need append-only
+  execution truth rather than logs or session summaries.
+- Use `policy-decision-integrity-review` as an adjunct when a versioned policy, specification,
+  decision table, capability, approval rule, limit, or masking rule derives allow, deny,
+  require-approval, downgrade, or obligations from actor, resource, action, context, and budget.
+- Use `structured-concurrency-supervision-review` as an adjunct when one runtime parent starts
+  concurrent children and correctness depends on bounded fan-out, ownership, deadline and
+  cancellation propagation, joining, sibling failure policy, cleanup, or rejecting late results.
 - Use `notification-delivery-integrity-review` as an adjunct when notification generation, email,
   push, SMS, in-app inboxes, unsubscribe, suppression, digest, quiet hours, timezone scheduling,
   provider webhooks, delivery attempts, templates, or notification audit logs need delivery
@@ -356,6 +371,9 @@ refer to `AGENTS.md` and `.mustflow/config/commands.toml` to implement the most
 - Use `quadratic-scan-review` as an adjunct when the suspected performance smell is specifically
   hidden O(N^2) work from repeated scans, membership checks, code joins, helper-body lookups,
   render-time lookup, resolver fan-out, repeated sort, or copy accumulation over growing data.
+- Use `parser-engineering-review` as an adjunct when lexer, grammar, CST or AST lowering, operator
+  binding, recovery, incremental parsing, Unicode positions, large-input limits, hostile-input
+  budgets, or parser fuzzing needs implementation or review.
 - Use `type-state-modeling-review` as an adjunct when code review needs to make impossible
   domain states, invalid ID or unit swaps, nullable/status contradictions, unsafe DTO boundaries,
   or cast-heavy models unrepresentable by type shape.
@@ -537,6 +555,10 @@ routes. Event routes stay inactive until their event occurs.
 | Trigger | Skill Document | Required Input | Edit Scope | Risk | Verification Intents | Expected Output |
 | --- | --- | --- | --- | --- | --- | --- |
 | Code changes need review before report | `.mustflow/skills/code-review/SKILL.md` | Diff and task goal | Changed files | behavior and regression | `test`, `test_related`, `test_audit`, `lint` | Findings or no-issue note |
+| One logical operation commits durable state and separately publishes, projects, calls, or writes another independently committed system, including database-plus-broker delivery, CDC, relay workers, or materialized projections | `.mustflow/skills/dual-write-consistency/SKILL.md` | Operation identity, local commit boundary, external delivery boundary, ordering rule, crash matrix, durable handoff records, retry and dedupe policy, reconciliation owner, and configured command intents | Transactional outbox or inbox records, CDC or relay ownership, stable event and operation IDs, delivery state, idempotent application, retry classification, reconciliation queries or jobs, crash-point tests, and directly synchronized docs or templates | commit succeeded but publish vanished, publish happened before rollback, duplicate relay delivery, reordered projection, ambiguous provider outcome, poison event, non-atomic completion marker, unreconciled split state, or false exactly-once claim | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `test_audit`, `docs_validate_fast`, `test_release`, `mustflow_check` | Dual-write boundary, commit and delivery authorities, crash matrix, convergence protocol, reconciliation evidence, verification, and remaining divergence risk |
+| One business outcome spans multiple persisted commands, entities, services, callbacks, timers, approvals, retries, or compensations and must resume after process loss or deployment | `.mustflow/skills/durable-workflow-orchestration/SKILL.md` | Business outcome, workflow instance identity, step and effect ledger, persisted state and version, trigger and timer inputs, retry and compensation rules, terminal states, migration policy, and configured command intents | Durable workflow state, deterministic step transitions, stable command and effect IDs, checkpoints, timers, approval records, retry classification, compensation order, stuck-work recovery, version migration, replay fixtures, and directly synchronized docs or templates | memory-only progress, duplicate step after resume, callback race, stale timer, lost approval, compensation in the wrong order, unversioned in-flight state, nonterminal limbo, or deployment breaking active runs | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `test_audit`, `docs_validate_fast`, `test_release`, `mustflow_check` | Workflow boundary, instance and state model, step/effect/compensation ownership, resume and migration behavior, verification, and remaining durable-workflow risk |
+| Runs, attempts, leases, approvals, checkpoints, effects, receipts, terminal outcomes, resume, reconciliation, or replay require append-only execution truth rather than ordinary logs or handoff summaries | `.mustflow/skills/execution-ledger-integrity-review/SKILL.md` | Run and attempt identity, event sequence, lease and fencing data, checkpoint model, effect identity, approval binding, receipt contract, terminal-state rules, replay policy, and configured command intents | Append-only execution events, monotonic sequence guards, attempt and lease identity, effect intent and receipt records, approval linkage, terminal-state derivation, replay and reconciliation logic, tamper or gap checks, focused fixtures, and directly synchronized docs or templates | overwritten run status, receipt without effect identity, late worker write, duplicate terminal outcome, sequence gap, reused approval, log treated as authority, replay repeating a committed effect, or reconciliation hiding uncertainty | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `test_audit`, `docs_validate_fast`, `test_release`, `mustflow_check` | Execution-ledger boundary, identity and sequence model, effects and receipts, terminal derivation, replay evidence, verification, and remaining ledger-truth risk |
+| One runtime parent starts concurrent child tasks, workers, coroutines, threads, goroutines, or agent-runtime children and correctness depends on bounded fan-out, joining, cancellation, deadline propagation, sibling failure policy, cleanup, or rejecting late results | `.mustflow/skills/structured-concurrency-supervision-review/SKILL.md` | Parent and child ownership tree, spawn sites, join boundary, deadline and cancellation model, sibling failure policy, resource budget, late-result fence, cleanup path, deterministic test evidence, and configured command intents | Task groups or nurseries, bounded child creation, owned cancellation scopes, explicit joins, propagated deadlines, sibling-failure aggregation, cleanup guarantees, late-result rejection, deterministic supervision tests, and directly synchronized docs or templates | orphan child, fire-and-forget mutation, parent success before child completion, swallowed cancellation, unbounded fan-out, sibling failure loss, leaked permit, deadline not propagated, late child overwriting newer state, or shutdown without join | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `test_audit`, `docs_validate_fast`, `test_release`, `mustflow_check` | Supervision tree, join and cancellation policy, fan-out and deadline bounds, sibling failure and cleanup behavior, deterministic evidence, verification, and remaining structured-concurrency risk |
 | An unfamiliar codebase area needs an evidence-based map before planning, implementation, or reporting | `.mustflow/skills/codebase-orientation/SKILL.md` | User request, target area, relevant instructions, and current source, test, schema, template, configuration, or documentation files | Read-only orientation notes and any smallest follow-up edit chosen from inspected evidence | stale documentation, wrong ownership boundary, or invented architecture claim | `changes_status`, `changes_diff_summary`, `mustflow_check` | Scope inspected, entrypoints, flow map, ownership boundaries, verification options, risks, unknowns, and smallest safe next step |
 | Large-scope code, docs, tests, content, log, data, or refactor work needs cheap-signal candidate selection before reading or editing many files | `.mustflow/skills/heuristic-candidate-selection/SKILL.md` | User goal, target scope, file-role boundaries, cheap signals, exclusions, scoring factors, batch limit, and verification contract | Candidate discovery, scoring, read plan, bounded batch edits, and directly synchronized surfaces | token waste, false positives, generated-file noise, unimportant cleanup, hallucinated source content, oversized diff, or missed high-impact file | `changes_status`, `changes_diff_summary`, `test_related`, `docs_validate_fast`, `test_release`, `mustflow_check` | Selection goal, excluded surfaces, cheap signals, scored candidates, selected batch, skipped/deferred files, verification, and remaining selection risk |
 | Assistant-authored, AI-generated, vibe-coded, copied, or broad code changes need a hardening pass for symptom-only fixes, pinpoint hardcoding, exact-value branches, same-defect-class sibling inputs or callers, duplicate helpers, duplicate types or shapes, hidden coupling, circular dependencies, re-export discipline, swallowed errors, excessive nesting, god functions or files, edge cases, and behavior-focused tests | `.mustflow/skills/ai-generated-code-hardening/SKILL.md` | User goal, current diff or target files, reported symptom or failing fixture, existing helpers/types/shapes, sibling inputs or callers, import and export paths, public entrypoints or barrels, error-handling conventions, edge/failure cases, tests, and configured command intents | Small hardening fixes, defect-class rule repair, deduplication into existing single source of truth, boundary notes, focused tests, and directly synchronized docs or contracts | symptom-only patch, pinpoint hardcode, exact literal fixture fix, uninspected sibling input, duplicate abstraction, hidden coupling, circular dependency, accidental public API, string-only tests, over-mocking, fallback sprawl, silent error handling, fan-in/fan-out concentration, or broad rewrite | `changes_status`, `changes_diff_summary`, `test_related`, `test_audit`, `lint`, `build`, `docs_validate_fast`, `test_release`, `mustflow_check` | Sources of truth reused or extended, symptom patch and same-class sibling findings, duplicate/coupling/export/error/complexity/test findings, fixes made, deferred enforcement, verification, and remaining hardening risk |
@@ -565,6 +587,7 @@ routes. Event routes stay inactive until their event occurs.
 | API endpoints, handlers, controllers, resolvers, serializers, mappers, service methods, middleware, webhook receivers, backend-for-frontend paths, admin APIs, or route-level request paths need latency review for repeated work inside one request | `.mustflow/skills/api-request-performance-review/SKILL.md` | API request boundary, Request cost ledger, route span, DB query count, Redis count, external API calls, pool acquire wait, transaction scope, cache hit or miss, payload and response bytes, serialization time, ORM behavior, correctness boundaries, and configured command intents | Projection narrowing, query-count or lazy-loading guards, bounded batching, request-scope memoization, Redis `MGET` or pipeline use, app-side filtering or sorting cleanup, transaction narrowing, route-level observability, focused tests, and directly synchronized docs or templates | per-request I/O fan-out, ORM serializer lazy loading, eager-load row explosion, `SELECT *`, app-side filtering after overfetch, deep `OFFSET`, expensive `COUNT(*)`, index mismatch for `WHERE` plus `ORDER BY` plus `LIMIT`, external API inside transaction, pool acquire wait hidden behind fast queries, Redis loop, cache miss amplification, repeated JSON serialization, huge response bytes, CPU-heavy request work, Node flame graph gap, Go pprof gap, MongoDB `explain()` gap, or missing OpenTelemetry span evidence | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | API request path reviewed, Request cost ledger, route-level DB/Redis/external/cache/serialization/CPU findings, evidence level, verification, and remaining API request performance risk |
 | Code review or implementation needs cache-integrity triage for cache key truth, viewer context, query normalization, key versioning, TTL and jitter, soft and hard TTL, stale-while-revalidate, stampede protection, negative caching, invalidation ordering, update races, list or page caches, tag invalidation, local L1 and external L2 caches, Redis fallback, value size, eviction policy, TTL-less keys, `KEYS *`, hot keys, Redis Cluster hash tags, HTTP `Vary`, `no-cache`, `no-store`, permission caches, cache warming, observability, or cache failure tests | `.mustflow/skills/cache-integrity-review/SKILL.md` | Cache surface, source of truth, cached value, key dimensions, freshness contract, failure and concurrency contract, observability evidence, and configured command intents | Cache key construction, query normalization, key versioning, TTL and jitter, soft or hard TTL behavior, stale serve, singleflight or request coalescing, negative-cache policy, invalidation order, version checks, tag invalidation, bounded fallback, cache warming, observability, focused tests, and directly synchronized docs or templates | stale data spread, tenant or permission leak, wrong viewer response, cache key collision or explosion, old schema read after deploy, synchronized expiry bomb, thundering herd, temporary failure cached as truth, delete-before-commit resurrection, stale overwrite, list invalidation drift, page duplicate or gap, global flush pressure, L1/L2 split brain, Redis outage killing DB, hit-rate-only blind spot, oversized values, eviction surprise, stateful TTL-less cache, production `KEYS *`, hot-key overload, broken cluster distribution, wrong HTTP cache reuse, stale auth cache, cold-start source surge, or happy-path-only cache test | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Cache surface reviewed, source truth and key dimensions, TTL/invalidation/fallback decisions, Redis/HTTP/permission/cache-layer checks, evidence level, verification, and remaining cache-integrity risk |
 | Code review or implementation specifically needs to catch hidden O(N^2), pairwise work, repeated membership checks, map/filter/find/includes chains, code joins by ID, duplicate removal with index search, sorted-array linear search, repeated sort, reducer spread, string concatenation, JSON comparison, helper-hidden full-list scans, ORM lazy loading, GraphQL resolver fan-out, render-time lookup, tree or graph parent-child scans, event-history scans, interval all-pairs checks, or incremental updates that recompute whole state | `.mustflow/skills/quadratic-scan-review/SKILL.md` | Outer work, inner work, data shape, join or membership key, semantic contract, evidence level, and configured command intents | Set or Map lookup, grouping maps, parent-to-children maps, composite keys, sorted merge, single-pass aggregation, database-side joins, focused behavior tests, and bounded complexity notes tied to the repeated scan | disguised nested loop, same collection rescanned per item, array membership over growing data, ID join without index, duplicate-removal O(N^2), sorted linear search, sort inside loop, copy accumulation, JSON stringify comparison, helper-body scan, ORM N+1, resolver fan-out, render jank, graph traversal slowdown, event-history rescan, interval all-pairs leak, or small-list excuse without a hard cap | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Repeated path, outer and inner counts, data-growth classification, hidden scan findings, chosen index or intentional all-pairs decision, semantics preserved, evidence level, verification, and remaining quadratic-scan risk |
+| Lexer, tokenizer, grammar, parser, CST, AST lowering, operator table, formatter grouping, error recovery, incremental parser, Unicode source position, large-input behavior, parser resource limit, or parser fuzzing needs implementation, review, debugging, or claim validation | `.mustflow/skills/parser-engineering-review/SKILL.md` | Parser role, byte and text boundary, output contract, compatibility surface, lexer and grammar, tree and lowering model, incremental snapshot model, diagnostics, budgets, fixtures, and configured command intents | Explicit source units, progress invariants, lossless CST, separate lowering, executable binding powers, bounded recovery, context convergence, immutable snapshots, shared ParseBudget, chunk and edit differential tests, structured mutation, and directly synchronized docs or templates | zero-width lexer loop, raw/cooked span drift, CST source loss, AST/semantic collapse, wrong associativity, formatter disagreement, speculative side effect, recovery loop or cascade, fixed-radius invalidation, stale snapshot publish, UTF-8/UTF-16 confusion, surrogate split, deep or wide bomb, ReDoS, expansion bomb, unbounded token or node retention, validation/execution parser split, or throughput-only proof | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `test_audit`, `docs_validate_fast`, `test_release`, `mustflow_check` | Parser boundary and compatibility, source/token/tree/operator/recovery/incremental/Unicode/storage/budget decisions, positive and adversarial evidence, verification, and remaining parser risk |
 | Code review or implementation needs type modeling to make impossible states unrepresentable, including branded IDs, unit and currency types, boolean flag clusters, broad string statuses, nullable state fields, raw external data, partial update inputs, DTO/domain/response mixing, broad maps, `any`, casts, non-null assertions, Result error variants, non-empty collections, permission capabilities, lifecycle timestamps, or exhaustiveness | `.mustflow/skills/type-state-modeling-review/SKILL.md` | Domain invariant, current type surface, construction path, boundary map, exhaustiveness surface, and configured command intents | Branded types, newtypes, wrappers, literal unions, sealed or discriminated variants, parsers, constructors, validators, DTO boundary splits, focused tests, and directly synchronized docs or templates | swapped IDs, unit or currency confusion, contradictory boolean flags, status drift, optional-field invalid state, raw DTO leakage, unsafe `Partial<T>`, domain/API/DB coupling, broad `Record<string, unknown>`, `any` spread, cast cover-up, non-null assertion crash, untyped Result errors, empty collection invariant leak, permission boolean drift, lifecycle timestamp contradiction, or missed exhaustive case | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Type surface reviewed, impossible states found or ruled out, boundary and construction path tightened, exhaustiveness and tests checked, verification, and remaining impossible-state risk |
 | Code review or implementation needs race-condition triage for shared state observed across interleaving execution flows, including check-then-act, read-modify-write, stale reads after `await`, I/O, callbacks or events, lock scope or global lock order, `tryLock`, timeout, retry, cache miss fill, lazy initialization, double-checked locking, atomics, memory ordering, DB transaction isolation, conditional updates, unique constraints, distributed locks, idempotency, filesystem exists/open, atomic create or rename, outbox ordering, queue duplicates or reordering, concurrent same-user work, shutdown, cancellation, timers, close/send races, shared collections, iterator snapshots, object reuse, fake immutability, sleep-based race tests, log ordering, or status values without transitions | `.mustflow/skills/race-condition-review/SKILL.md` | Shared state surface, invariant, interleaving points, synchronization or transaction boundary, retry and idempotency policy, event, queue, timer, cancellation and shutdown paths, collection or object ownership, evidence level, and configured command intents | Atomic conditional update, atomic create, compare-and-swap, lock scope or lock-order fix, unique constraint, row lock, idempotency guard, singleflight, outbox or inbox guard, state transition guard, snapshot iteration, ownership split, focused concurrency tests, and directly synchronized docs or templates | check-then-act, lost update, stale read after await, torn invariant, callback under lock, deadlock, retry duplication, cache stampede, double init, unsafe atomic assumption, isolation mismatch, app-only uniqueness, broken distributed lock, duplicate side effect, event/state split brain, queue duplicate or out-of-order damage, shutdown drop, cancellation completion race, old timer update, double close, send after close, shared collection mutation, pooled object corruption, fake immutable mutation, sleep-test false confidence, log-order lie, or state value race | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Shared state and invariant reviewed, interleaving ledger, atomicity and synchronization findings, stale-read and ordering checks, tests or evidence level, verification, and remaining race-condition risk |
 | Code, tests, docs, or reports add, change, review, justify, or debug arbitrary sleeps, fixed delays, `setTimeout`, timer waits, event-loop yields, microtask or next-tick waits, render-frame or after-paint waits, CI waits, readiness polling, startup waits, file flush waits, worker readiness, Promise completion claims, async one-time side effects, or eventual-consistency waits | `.mustflow/skills/async-timing-boundary-review/SKILL.md` | Wait surface, intended condition, boundary class, available completion signal, caller ownership, test evidence, and command contract entries | Timing helpers, async flow, lifecycle waits, readiness probes, bounded polling, fake-time tests, stream/filesystem/process/worker/server/database/queue/index/device waits, and directly synchronized docs or templates | tuned millisecond threshold, sleep as readiness, Promise that only schedules work, one-time side-effect scope drift, render-before-layout measurement, stream or file durability lie, process or server ready guess, replica/search/queue visibility race, unbounded polling, timeout layering bug, CI-only flake, or sleep-based proof | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Waits classified, completion signal chosen or missing, fixed waits removed or bounded, Promise/once/render/I/O/external checks, verification, skipped timing diagnostics, and remaining async timing risk |
@@ -651,6 +674,7 @@ routes. Event routes stay inactive until their event occurs.
 
 | Trigger | Skill Document | Required Input | Edit Scope | Risk | Verification Intents | Expected Output |
 | --- | --- | --- | --- | --- | --- | --- |
+| A policy object, specification, decision table, rule engine, capability policy, approval rule, limit, masking rule, or default-deny path derives allow, deny, require-approval, downgrade, or obligations from versioned facts | `.mustflow/skills/policy-decision-integrity-review/SKILL.md` | Actor, resource, action, context and budget facts, policy source and version, combining algorithm, defaults, obligations, explanation contract, cache and freshness rules, enforcement sites, and configured command intents | Pure decision inputs and outputs, explicit deny precedence, default behavior, policy snapshots, reason codes, obligations, capability scope and attenuation, cache keys, decision-to-effect binding, table-driven policy tests, and directly synchronized docs or templates | fail-open default, hidden rule order, stale policy cache, caller-supplied authority, approval detached from action, capability widening, missing obligation enforcement, inconsistent explanation, policy drift across entrypoints, or decision made from mutable current facts | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `test_audit`, `docs_validate_fast`, `test_release`, `mustflow_check` | Policy boundary, input and version ledger, combining and default decision, obligations and capability scope, enforcement evidence, verification, and remaining policy risk |
 | Environment variables, config keys, secrets, public env prefixes, build-time or runtime config, config schemas or parsers, feature flags, deployment variables, CI secrets, Docker or Compose env, Kubernetes ConfigMaps or Secrets, Cloudflare bindings, Vite, Next.js, Astro, SvelteKit, Tauri, Node, Bun, generated env types, `.env` examples, config docs, or config validation behavior are created, changed, reviewed, or reported | `.mustflow/skills/config-env-change/SKILL.md` | Key name, value meaning, sensitivity, visibility, timing, required environments, owner, default, validation shape, config source of truth, read-first surfaces, platform timing, deployment surfaces, generated types, docs, tests, and command contract entries | Config schemas, parser code, runtime loader wiring, generated type expectations, fake-value env examples, deployment docs, tests, CI or deployment variable names, feature flag defaults, redacted validation errors, and deprecation notes | secret leak, public-prefix misuse, build-time/runtime confusion, stale deploy config, missing `.env.example`, unchecked raw env read, boolean truthiness bug, unredacted error, stale feature flag, production fallback from local/test, or missing restart/rebuild/rollout note | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Keys or flags changed, sensitivity, visibility, timing, required action after value change, source of truth, synchronized surfaces, public/private boundary, redaction notes, build/runtime classification, feature flag behavior, verification, and remaining config/env risk |
 | Authentication, authorization, permission, effective-permission decision, role, RBAC/ABAC policy, tenant, organization or team membership, session, cookie, JWT, refresh token, OAuth/OIDC, MFA, passkey, account recovery, API key, route guard, admin, impersonation, database policy, object-level access control, or permission cache behavior is created or changed | `.mustflow/skills/auth-permission-change/SKILL.md` | Actors, principals, permission decision tuple, effective permissions, tenants, organizations, teams, resources, actions, context, auth middleware, sessions, cookies, tokens, refresh-token store, OAuth/OIDC, MFA/passkeys, API keys, route guards, server policy, DB policy, role matrix, audit, and tests | Auth middleware, policy functions, controllers, services, jobs, webhooks, database queries, RLS, UI guards, audit logs, docs, migrations, and tests | authentication treated as authorization, role column mistaken for effective permission, unexplained allow or deny, client guard trusted as security, object-level authorization bypass, cross-tenant leak, stale token or cache permission, refresh-token reuse gap, account-recovery privilege escalation, over-broad admin/API-key scope, or missing denial tests | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Auth/authz boundary, principal/tenant/resource/action/context, effective permission, policy version, decision explanation, revocation window, policy source of truth, server/database enforcement, client UX-only guards, account-takeover response, denial coverage, verification, and remaining permission risk |
 | API security review needs api-access-control triage for BOLA or IDOR, effective permission decisions, broken authentication, object-level authorization, object-property authorization, function-level authorization, request-supplied user, tenant, role, or owner identifiers, tenant isolation, scoped admin, list/detail mismatch, write permissions, mass assignment, DTO exposure, client-only admin, temporary public holes, router order, GraphQL resolvers, batch APIs, exports, downloads, previews, signed storage URLs, cache keys, async job revalidation, webhook ownership mapping, OAuth or OIDC confusion, JWT verification, stale token claims, session rotation, cookie flags, reauthentication, reset tokens, account enumeration, automation defense, internal identity planes, or denial-case matrices | `.mustflow/skills/api-access-control-review/SKILL.md` | User goal, current diff or target files, subject-object-action-context ledger, decision explanation ledger, object authorization ledger, property authorization ledger, function authorization ledger, authentication proof ledger, denial evidence, and configured command intents | Server-side object checks, tenant-scoped lookups, relationship checks, function-level checks, property allowlists, DTO mappers, signed URL scoping, cache-key dimensions, worker revalidation, webhook ownership mapping, token/session/cookie hardening, reauthentication gates, enumeration-safe responses, rate limits, audit logs, focused denial tests, and directly synchronized docs or templates | login-as-authorization, request-owned identity trust, findById before owner check, role-only admin, unexplainable allow/deny decision, list/detail authorization drift, read/write permission confusion, mass assignment, entity DTO leak, client-only admin, permitAll leak, route shadowing, resolver bypass, batch item bypass, export/download bypass, signed URL bypass, tenantless query or cache, stale queue permission, webhook ownership confusion, OAuth/OIDC token confusion, decoded-but-unverified JWT, stale token claim, session fixation, weak cookie, missing reauth, reusable reset token, account enumeration, automation abuse, internal account exposure, or happy-path-only auth tests | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `test_audit`, `docs_validate_fast`, `test_release`, `mustflow_check` | API access control reviewed, subject/object/action/field/tenant map, effective permission and decision-explanation findings, object/property/function/auth findings, fixes or recommendation, denial evidence, verification, and remaining API access-control risk |

package/templates/default/locales/en/.mustflow/skills/adapter-boundary/SKILL.md

@@ -2,7 +2,7 @@
 mustflow_doc: skill.adapter-boundary
 locale: en
 canonical: true
-revision: 13
+revision: 14
 lifecycle: mustflow-owned
 authority: procedure
 name: adapter-boundary
@@ -66,6 +66,8 @@ Use the port as a change-isolation contract. Before changing the implementation
 - The task only needs broad ownership, cohesion, or future-change spread review before deciding whether a port is the right repair; use `module-boundary-review` or `change-blast-radius-review` first.
 - The only problem is hidden construction or global lookup of a dependency; use `dependency-injection` first, then return here only if external data, errors, or protocol behavior also need a boundary.
 - The operation coordinates several already-translated ports, repositories, queues, caches, or providers behind one caller-facing workflow; use `facade-pattern` for that high-level entry point while keeping this skill for each external boundary.
+- The main problem is convergence after two databases, a database and broker, or a database and provider can commit independently; use `dual-write-consistency`. Keep this skill only for request, response, identifier, and failure translation at each external boundary.
+- The main problem is deriving or proving an allow, block, or downgrade decision for a provider or model call; use `policy-decision-integrity-review`. An adapter may carry the decision and translate the selected provider request, but must not redefine the policy.
 - The task is a disposable one-off script that is not imported, repeated, tested, used in production, or connected to external systems.
 - The repository already has a more specific local integration skill that fully covers the boundary.
 
@@ -87,7 +89,7 @@ Use the port as a change-isolation contract. Before changing the implementation
 - Provider failure policy: timeout, retryable status categories, backoff and jitter rule, rate-limit handling, circuit-breaker behavior, bulkhead or queue isolation, idempotency key support, unknown-result reconciliation, and dead-letter handling when available.
 - Observability portability policy: request id, trace id, span id, correlation id, causation id, user or anonymous id, tenant or organization id, job run id, webhook event id, event schema version, and which context fields are propagated, redacted, hashed, or kept internal.
 - AI usage policy when AI models are involved: feature key, model key, user request id, provider call id, token usage fields, cached-input treatment, pricing snapshot, cost unit, retry grouping, cache key hash, prompt/output retention rule, and plan-limit behavior.
-- AI gateway policy when AI models are involved: preflight estimate, hard limit, selected model, fallback model, blocked reason, remaining budget, maximum input and output tokens, maximum tool calls, maximum agent steps, maximum retries, timeout, provider-console budget role, and emergency kill switch.
+- AI policy handoff when AI models are involved: the already-derived decision, selected provider or model, limits, and reason fields that the adapter must translate without recomputing allow, block, or downgrade policy.
 - API contract risk: stable resource ids, public identifiers, pagination, machine-readable status, safe error codes, field omission, private file URL handling, and whether the response shape is domain-oriented or screen-component-oriented.
 - Relevant command-intent contract entries for tests, builds, docs, template checks, release checks, and mustflow validation.
 
@@ -179,7 +181,7 @@ Use the port as a change-isolation contract. Before changing the implementation
    - Provider identifiers for payments, email, maps, search, AI, and storage are mappings. Internal orders, entitlements, emails, locations, documents, jobs, and file objects should remain product-owned resources even when the provider performs the work.
 9. Keep database transactions and external side effects separate by default.
    - Do not call external APIs inside database transactions unless a local rule explicitly justifies the risk.
-   - Use explicit states, an outbox, an action ledger, or a reconciliation path when database changes and external effects must be coordinated.
+   - When independently committed database, broker, or provider effects must converge, route the convergence protocol to `dual-write-consistency`; this skill owns only the local port translation and failure mapping.
 10. Harden webhooks and duplicate delivery.
     - Verify signatures before trusting payloads.
     - Preserve the raw body or safe raw reference when needed for verification and replay.
@@ -196,8 +198,7 @@ Use the port as a change-isolation contract. Before changing the implementation
     - Capture token usage, cached input usage when available, latency, provider request id, model, status, pricing snapshot, and integer cost unit after the provider response or failure.
     - Classify AI caches as app response cache, provider prompt cache, embedding cache, or search-result cache. Store cache key hashes or safe identifiers, not raw prompts or confidential user content.
    - Apply plan, request-size, model-tier, token, request-count, and cost limits before the provider call where possible; update actual usage after the call.
-   - Treat provider budgets and rate limits as secondary guardrails unless the provider is proven to enforce a hard stop before cost. Product-owned preflight policy should decide allow, block, downgrade, or queue before the provider call.
-   - Enforce agent-specific caps such as maximum steps, tool calls, total tokens, total cost, and timeout before running autonomous or multi-call AI work.
+   - Consume an already-derived product policy decision before the provider call. Route allow, block, downgrade, fallback, and obligation derivation to `policy-decision-integrity-review`; translate only the selected request and provider result here.
    - Validate structured output before returning it.
     - Return internal purpose-level outputs such as summaries, classifications, recommendations, or extracted fields.
 12. Make observability safe and useful.
@@ -223,7 +224,7 @@ Use the port as a change-isolation contract. Before changing the implementation
 - Ports are named in internal business language and expose only internal input, output, and error types.
 - Preserved consumer contracts are explicit, and implementation changes behind adapters do not force unrelated caller, DTO, test, workflow, or neighboring-module edits.
 - Provider dashboards, hosted settings, and SDK payloads do not become the only source for core business facts, search policy, queue failure policy, analytics event definitions, email customer state, or file ownership.
-- Public URLs, provider identity claims, image variants, entitlement decisions, and AI policy decisions are represented as product-owned contracts before provider-specific syntax reaches callers.
+- Public URLs, provider identity claims, image variants, entitlement decisions, and AI policy decision results are translated as product-owned contracts before provider-specific syntax reaches callers; policy derivation remains outside the adapter.
 - Streaming and delivery transport details such as SSE ids, WebTransport datagrams, content-coding variants, fallback paths, and CDN cache keys are contained at adapter boundaries before core logic receives product-level events or commands.
 - Critical external SDKs are contained behind internal use-case contracts so provider names, SDK types, and dashboard assumptions do not spread through core logic.
 - Inbound adapters validate and translate before calling use cases.
@@ -232,7 +233,7 @@ Use the port as a change-isolation contract. Before changing the implementation
 - Request, trace, user, tenant, job, cron, and webhook identifier propagation is explicit where diagnostic continuity matters, and telemetry backend details do not leak into core logic.
 - Circuit-breaker, bulkhead, dead-letter, and reconciliation behavior is explicit where provider failure can spread beyond the integration.
 - AI model boundaries centralize provider calls, cost attribution, usage recording, pricing snapshots, cache-hit classification, plan limits, and redacted prompt or output handling when AI calls are cost-bearing.
-- AI gateway boundaries enforce preflight hard limits, model fallback, agent-loop caps, provider-budget fallback assumptions, and emergency disable behavior when cost-bearing or autonomous AI work exists.
+- AI adapters consume bounded product decisions and translate selected provider calls without owning allow, block, downgrade, or fallback policy.
 - Tests cover core behavior through fakes and adapter behavior through mapping, error, and boundary tests.
 
 <!-- mustflow-section: verification -->
@@ -275,7 +276,7 @@ Prefer the narrowest configured test or build intent that proves the affected bo
 - Outbound request, response, and error mapping handled
 - Timeout, retry, circuit-breaker, bulkhead, idempotency, duplicate, dead-letter, and reconciliation behavior handled or explicitly deferred
 - AI usage, cost, pricing snapshot, cache-hit, retry grouping, plan-limit, and redacted observability behavior handled or explicitly deferred when relevant
-- AI gateway preflight limit, model fallback, agent cap, and kill-switch behavior handled or explicitly deferred when relevant
+- AI policy decision handed off to `policy-decision-integrity-review` and translated without re-derivation when relevant
 - Security and redaction surfaces checked
 - Observability identifier propagation and backend portability checked when relevant
 - Tests, fixtures, fakes, or contract checks added or reused

package/templates/default/locales/en/.mustflow/skills/agent-execution-control-review/SKILL.md

@@ -2,7 +2,7 @@
 mustflow_doc: skill.agent-execution-control-review
 locale: en
 canonical: true
-revision: 1
+revision: 2
 lifecycle: mustflow-owned
 authority: procedure
 name: agent-execution-control-review
@@ -51,6 +51,10 @@ Review agent systems as controlled workbenches, not smarter chat prompts. An age
 - The main risk is agent eval integrity, trace or trajectory grading, judge-model calibration, final environment state scoring, golden or dirty eval sets, pass@k or pass^k metrics, shadow environments, or production-monitoring-to-eval feedback; use `agent-eval-integrity-review`.
 - The task coordinates several repository workers or subagents for one coding task rather than designing a product/runtime agent; use `multi-agent-work-coordination`.
 - The task is ordinary idempotency, retry, queue, approval, state-machine, or workflow code with no LLM-directed agent behavior; use the narrower integrity or pattern skill first.
+- The main problem is non-LLM parent-child lifetime, join, cancellation, deadline, or orphan prevention; use `structured-concurrency-supervision-review`.
+- The main problem is deterministic multi-step resume, callback correlation, or compensation; use `durable-workflow-orchestration`.
+- The main problem is generic run, attempt, checkpoint, or effect truth; use `execution-ledger-integrity-review`.
+- The main problem is reusable allow, deny, limit, downgrade, or obligation evaluation; use `policy-decision-integrity-review`. Keep this skill for agent-specific application of that decision.
 
 <!-- mustflow-section: required-inputs -->
 ## Required Inputs
@@ -59,6 +63,7 @@ Review agent systems as controlled workbenches, not smarter chat prompts. An age
 - Stage gate ledger: requirement extraction, plan, route, tool selection, tool arguments, execution, verification, final response, and which gate can reject or revise each artifact.
 - Role separation ledger: planner, executor, verifier, evaluator, deterministic validators, human reviewers, and any self-check limitations.
 - Tool contract ledger: tool names, descriptions, argument schema, trusted server-known arguments, model-supplied arguments, unsafe actions, preconditions, postconditions, idempotency key, timeout, partial result, and error states.
+- Capability ledger: tenant and resource scope, permitted effects, expiry, call count, token or cost ceiling, attenuation chain, server-known arguments, and the exact policy decision and tool call the capability authorizes.
 - Effect ledger: draft versus execute mode, external side effects, database writes, emails, payments, deletes, job starts, queue publishes, cache invalidations, idempotency key source, approval requirement, and side-effect position relative to interrupts.
 - State and resume ledger: run ID, thread ID, checkpoint store, state schema version, migration or compatibility rule, resume owner, pending side effects, completed side effects, and recovery behavior.
 - Memory and context ledger: profile, thread state, and evidence cache boundaries, retention, TTL, provenance, access control, and stale-state handling.
@@ -93,6 +98,11 @@ Review agent systems as controlled workbenches, not smarter chat prompts. An age
 3. Split planner, executor, and verifier where risk justifies it. If one model performs multiple roles, add deterministic gates or independent checks before external effects or final success claims.
 4. Gate intermediate artifacts. Validate extracted requirements, plans, routes, tool selections, tool arguments, execution results, and final answers before later stages consume them.
 5. Make tools model-readable and execution-safe. Tool names should describe the action, descriptions should state when to use and not use them, schemas should be explicit, and unsafe side effects should be visible in the contract.
+   - Issue scoped capabilities for tool execution: bind tenant, resource, permitted effects, expiry, call count, and token or cost ceiling.
+   - Permit attenuation only. A handoff or child agent may narrow scope, duration, calls, effects, or cost, but must not widen them.
+   - Keep trusted tenant, resource, actor, and policy inputs as server-known arguments rather than model-supplied text.
+   - Bind the policy decision to the exact capability and normalized tool call; reject reuse after arguments, target, effect, expiry, or budget changes.
+   - Canonicalize defaulted and omitted tool arguments before binding or hashing the call. Persist the parent capability ID, issuer, policy version, and revocation state, then consume call and cost limits atomically at the trusted tool boundary.
 6. Remove relative-path and implicit-default traps. Prefer absolute project paths, explicit working directories, explicit tenant or workspace IDs supplied by the server, and no hidden dependence on current conversation state.
 7. Use structured outputs plus business validation. Schema validity is only the first gate; validate permissions, ownership, state transitions, amounts, dates, IDs, and product rules outside free-form generation.
 8. Separate draft from execute. For deletes, writes, emails, payments, external API mutations, job starts, queue publishes, or other irreversible actions, have the agent propose a plan or draft before execution unless the path is explicitly low-risk and idempotent.
@@ -100,6 +110,7 @@ Review agent systems as controlled workbenches, not smarter chat prompts. An age
 10. Treat approval as durable state. Store who approved what, which exact proposed action was approved, when it expires, what changed after approval, and what resume step owns execution.
 11. Design interrupt and resume before side effects. Code before an interrupt may run again after resume in many graph runtimes, so keep pre-interrupt work pure or idempotent and keep irreversible effects after approval checkpoints.
 12. Version long-running state. Add a state schema version, migration or compatibility rule, stale-run behavior, and final-state classification for interrupted, cancelled, failed, succeeded, and partially applied runs.
+    Route deterministic multi-step resume, callback, and compensation semantics to `durable-workflow-orchestration`; route generic run, attempt, checkpoint, and effect truth to `execution-ledger-integrity-review`.
 13. Split memory. Keep profile, thread state, and evidence cache separate; store provenance and freshness, avoid making summaries authoritative, and keep access-control and TTL rules visible.
 14. Summarize tool results into state. Preserve source IDs, key fields, uncertainty, errors, and provenance instead of passing raw blobs or letting a long observation become hidden authority.
 15. Evaluate tool triggering both ways. Test overtriggering that calls tools unnecessarily and undertriggering that skips required evidence, permission, or freshness checks.
@@ -118,6 +129,7 @@ Review agent systems as controlled workbenches, not smarter chat prompts. An age
 ## Postconditions
 
 - The agent path has an explicit workflow-versus-agent decision, autonomy envelope, stop conditions, stage gates, role separation, tool contracts, effect boundaries, and verification path.
+- Agent tool capabilities are scoped, attenuation-only, populated with server-known authority inputs, and bound to the exact policy decision and normalized tool call.
 - External side effects are drafted, approved, idempotent, replay-safe, or explicitly reported as residual risk.
 - Durable state, memory, handoffs, guardrails, loop budgets, retries, traces, evals, and sensitive-data policy are bounded where they affect correctness.
 - Final reports distinguish static control-plane hardening from measured agent success, model-quality assumptions, and unverified framework behavior.

package/templates/default/locales/en/.mustflow/skills/api-contract-change/SKILL.md

@@ -2,7 +2,7 @@
 mustflow_doc: skill.api-contract-change
 locale: en
 canonical: true
-revision: 3
+revision: 4
 lifecycle: mustflow-owned
 authority: procedure
 name: api-contract-change
@@ -50,6 +50,7 @@ The goal is to keep runtime behavior, type contracts, generated artifacts, calle
 - The change is a purely private implementation refactor with no request, response, generated type, client, docs, status, or error behavior change.
 - The task is only authentication or authorization policy with no API contract change; use `auth-permission-change`.
 - The task is only CLI output contract; use `cli-output-contract-review`.
+- The changed schema is a private in-flight workflow or checkpoint representation rather than a caller-facing API; use `durable-workflow-orchestration` for workflow semantics and `migration-safety-check` for old-to-new persisted transformation.
 
 <!-- mustflow-section: required-inputs -->
 ## Required Inputs

package/templates/default/locales/en/.mustflow/skills/command-pattern/SKILL.md

@@ -2,7 +2,7 @@
 mustflow_doc: skill.command-pattern
 locale: en
 canonical: true
-revision: 13
+revision: 14
 lifecycle: mustflow-owned
 authority: procedure
 name: command-pattern
@@ -29,7 +29,7 @@ metadata:
 <!-- mustflow-section: purpose -->
 ## Purpose
 
-Model a state-changing user or system intent as one clear execution unit.
+Model one accepted state-changing user or system intent and its local commit as one clear execution unit. This skill does not own the full durable lifecycle after acceptance.
 
 A command is not a decorative wrapper around a button handler or function. It is the application-level unit that gathers input validation, authorization, domain object loading, domain rule execution, state changes, transaction boundaries, idempotency, audit evidence, event recording, failure handling, retry decisions, and observability around one intent.
 
@@ -73,6 +73,9 @@ Use commands to make these questions answerable later:
 - The only problem is business logic mixed with I/O; use `pure-core-imperative-shell` first and let this skill shape the shell execution unit when state changes need command semantics.
 - The only problem is provider, SDK, database, file, webhook, queue, cache, or framework object leakage; use `adapter-boundary` and `dependency-injection`.
 - The only problem is that several already-owned subsystem steps need one stable caller-facing entry point; use `facade-pattern` unless the operation also needs command payload, context, idempotency, audit, retry, transaction, outbox, or queue semantics.
+- The work spans multiple durable steps, checkpoints, process loss, callbacks, or compensation; use `durable-workflow-orchestration`. The command may accept or start that workflow, but does not redefine its lifecycle.
+- The main contract is truthful run, attempt, checkpoint, or effect evidence across executions; use `execution-ledger-integrity-review`.
+- The main contract derives allow, deny, limit, downgrade, or obligation decisions; use `policy-decision-integrity-review`. The command consumes the decision.
 
 <!-- mustflow-section: required-inputs -->
 ## Required Inputs
@@ -88,7 +91,7 @@ Use commands to make these questions answerable later:
 - Work-acceptance response policy, such as immediate success, queued status, processing status, or accepted response; job status vocabulary; deduplication key; attempt limit; next-run time; lock expiry; dead-letter handling; and worker ownership.
 - Queue contract details when work crosses a queue: queue name, business urgency, job id, job type, schema version, created time, run-after time, attempt count, idempotency key, request or trace context, safe payload reference, retry categories, timeout, dead-letter target, ordering requirement, and manual replay rule.
 - AI work accounting when relevant: feature key, model key, usage ledger entry, user request id, provider call id, pricing snapshot, cache-hit type, retry grouping, cost limit, and whether failed or unknown calls require reconciliation before retry.
-- AI policy decision when relevant: estimated cost, remaining budget, selected model, fallback model, blocked reason, maximum input tokens, maximum output tokens, maximum tool calls, maximum agent steps, timeout, and whether provider budgets are only secondary guardrails.
+- AI policy decision when relevant: the already-derived allow, deny, limit, downgrade, or obligation result that the command consumes without redefining policy.
 - Cost-bearing work accounting when relevant: value unit, cost unit, workspace or account quota, shared tenant credit pool, free-plan limit, user-action fan-out, usage event, rollup target, and whether retries or duplicate jobs can double-count cost.
 - Idempotency layers for request acceptance, job execution, provider calls, and incoming webhooks, including scope, request hash, duplicate result behavior, and different-payload conflict behavior.
 - Existing local conventions for result types, option types, domain errors, repositories, gateways, unit of work, outbox, audit logs, command buses, and tests.
@@ -173,9 +176,9 @@ Use commands to make these questions answerable later:
    - Schedule follow-up work only after the command decision is persisted.
    - For payment, point, credit, inventory, entitlement, subscription, coupon, and refund commands, prefer append-only ledgers or action records as the evidence source. Treat summary balances or statuses as derived or transactionally updated read state.
    - For ordinary content, account, and workflow commands, persist the core state and outbox or job records before triggering analytics, email, search indexing, AI processing, statistics, cache purge, or feed refresh work.
-   - For cost-bearing AI commands, persist the accepted work, idempotency decision, usage-limit decision, and job or outbox record before a worker performs model calls. Record actual usage, retry grouping, cache-hit type, pricing snapshot, and provider outcome after the call.
-   - For agentic AI commands, persist the policy decision and hard caps before the first model call. Steps, tool calls, total tokens, elapsed time, and cost should be bounded by the command or job contract, not by provider defaults or operator memory.
-   - For any cost-bearing command, check plan, tenant, quota, credit, request-size, and rate limits before accepting the work when possible. Record usage intent or reserved quota before fan-out work starts, then reconcile actual usage after workers and provider calls complete.
+   - For cost-bearing AI commands, persist accepted work and reservation consumption before a worker performs model calls. `credit-ledger-integrity-review` owns prepaid or money-equivalent reserve, capture, and release invariants; `llm-token-cost-control-review` owns token estimates and caps.
+   - For agentic AI commands, consume and persist the policy decision and accepted-work limits before the first model call. Route policy derivation to `policy-decision-integrity-review` and multi-step resume or compensation to `durable-workflow-orchestration`.
+   - A command may consume an existing reservation or quota allocation, but it must not redefine credit-ledger balance invariants. Keep accepted-work reservation persistence here and reserve, capture, and release accounting in `credit-ledger-integrity-review`.
    - When one command creates many internal jobs, record the causation relationship so thumbnails, OCR, AI calls, embeddings, search indexing, notifications, logs, analytics exports, and webhooks can be attributed to the original user action without losing retry or cost detail.
    - For HTTP acceptance of long-running work, persist the command result, job row, or outbox row in the same local transaction, then return the created resource identifier and current status. Do not make the HTTP request wait for the worker's external side effect unless the product contract truly requires immediate completion.
    - For external API work, persist the internal intent before the provider call becomes the only record. Payment, email, map, AI, search, file, and webhook follow-up commands should leave enough local evidence to answer what was attempted, why, for whom, and how to retry or reconcile it later.
@@ -236,6 +239,7 @@ Use commands to make these questions answerable later:
    - Put exhausted or poison jobs into a dead-letter or manual-review state with safe error metadata instead of retrying forever.
    - Treat a queued failure as hidden until metrics, alerts, or operator review make it visible. Track queue depth, job age, retry count, failure rate, dead-letter growth, provider rate-limit pressure, and manual replay results for important queues.
    - Define the smallest operator actions that make the command recoverable at 03:00: resend a specific email, reprocess a specific webhook, retry a specific AI job, rebuild a specific search index, reconcile a specific payment attempt, or temporarily disable one provider-backed feature.
+   - When these steps must resume deterministically across process loss, callbacks, checkpoints, or compensation, hand the accepted command to `durable-workflow-orchestration`. When run, attempt, checkpoint, and effect receipts are the source of truth, use `execution-ledger-integrity-review`.
 17. Test command behavior.
     - Cover success, required input absence, invalid input, unauthorized actor, missing resource, state conflict, domain invariant failure, duplicate retry with same payload, duplicate key with different payload, transaction rollback, outbox creation, dependency failure, retryability, non-retryability, and concurrency conflicts.
     - Use fake repositories and gateways for handler unit tests.
@@ -250,7 +254,7 @@ Use commands to make these questions answerable later:
 - The handler has injected dependencies and handles one command.
 - Authorization, idempotency, transaction boundaries, outbox behavior, retry classification, concurrency protection, observability, and audit requirements are explicit where relevant.
 - Request, trace, command, job, cron, webhook, correlation, and causation identifiers are explicit where the command crosses asynchronous or external boundaries.
-- HTTP acceptance, durable job or outbox creation, worker ownership, queue separation, deduplication, retry budget, dead-letter behavior, and reconciliation rules are explicit when long-running or external work is involved.
+- HTTP acceptance and the local durable handoff are explicit; full multi-step resume, checkpoint, callback, and compensation semantics are owned by `durable-workflow-orchestration`.
 - Credit, quota, tenant-limit, usage-event, fan-out attribution, and retry-cost behavior are explicit when one command consumes high-cost resources or creates multiple internal jobs.
 - Expected command failures are returned as typed values.
 - External effects do not run inside local database transactions.