mustflow 2.117.0 → 2.118.0

package/schemas/workspace-command-fragments.schema.json

@@ -59,6 +59,8 @@
       "properties": {
         "enabled": { "type": "boolean" },
         "roots": { "$ref": "#/$defs/stringArray" },
+        "authority_mode": { "enum": ["repository_local", "delegated_scoped"] },
+        "delegated_contract_count": { "type": "integer", "minimum": 0 },
         "max_depth": { "type": "integer", "minimum": 1 },
         "max_repositories": { "type": "integer", "minimum": 1 },
         "follow_symlinks": { "type": "boolean" },

package/schemas/workspace-status.schema.json

@@ -32,6 +32,8 @@
       "properties": {
         "enabled": { "type": "boolean" },
         "roots": { "$ref": "#/$defs/stringArray" },
+        "authority_mode": { "enum": ["repository_local", "delegated_scoped"] },
+        "delegated_contract_count": { "type": "integer", "minimum": 0 },
         "max_depth": { "type": "integer", "minimum": 1 },
         "max_repositories": { "type": "integer", "minimum": 1 },
         "follow_symlinks": { "type": "boolean" },
@@ -122,9 +124,10 @@
       ],
       "properties": {
         "relative_path": { "type": "string" },
-        "status": { "enum": ["mustflow_ready", "contract_missing", "contract_invalid"] },
+        "status": { "enum": ["mustflow_ready", "delegated_ready", "contract_missing", "contract_invalid"] },
         "git_repository": { "const": true },
         "mustflow": { "type": "boolean" },
+        "command_authority": { "enum": ["repository_local", "delegated_scoped", null] },
         "agent_rules": { "$ref": "#/$defs/nullableString" },
         "repo_map": { "$ref": "#/$defs/nullableString" },
         "mustflow_config": { "$ref": "#/$defs/nullableString" },

package/schemas/workspace-verification-plan.schema.json

@@ -57,6 +57,8 @@
       "properties": {
         "enabled": { "type": "boolean" },
         "roots": { "$ref": "#/$defs/stringArray" },
+        "authority_mode": { "enum": ["repository_local", "delegated_scoped"] },
+        "delegated_contract_count": { "type": "integer", "minimum": 0 },
         "max_depth": { "type": "integer", "minimum": 1 },
         "max_repositories": { "type": "integer", "minimum": 1 },
         "follow_symlinks": { "type": "boolean" },
@@ -140,6 +142,7 @@
             "plan_unavailable"
           ]
         },
+        "command_authority": { "enum": ["repository_local", "delegated_scoped", null] },
         "command_contract": { "$ref": "#/$defs/commandSurface" },
         "changed_file_count": { "type": ["integer", "null"], "minimum": 0 },
         "changed_files": { "$ref": "#/$defs/stringArray" },

package/templates/default/common/.mustflow/config/mustflow.toml

@@ -96,6 +96,8 @@ anchor_files = [
 [workspace]
 enabled = true
 roots = ["projects"]
+authority_mode = "repository_local"
+contracts = []
 max_depth = 4
 max_repositories = 50
 follow_symlinks = false

package/templates/default/i18n.toml

@@ -62,7 +62,7 @@ translations = {}
 [documents."skills.index"]
 source = "locales/en/.mustflow/skills/INDEX.md"
 source_locale = "en"
-revision = 289
+revision = 294
 translations = {}
 
 [documents."skill.ada-code-change"]
@@ -113,6 +113,12 @@ source_locale = "en"
 revision = 1
 translations = {}
 
+[documents."skill.connection-lifecycle-integrity-review"]
+source = "locales/en/.mustflow/skills/connection-lifecycle-integrity-review/SKILL.md"
+source_locale = "en"
+revision = 2
+translations = {}
+
 [documents."skill.behavior-preserving-refactor"]
 source = "locales/en/.mustflow/skills/behavior-preserving-refactor/SKILL.md"
 source_locale = "en"
@@ -278,7 +284,7 @@ translations = {}
 [documents."skill.memory-lifetime-review"]
 source = "locales/en/.mustflow/skills/memory-lifetime-review/SKILL.md"
 source_locale = "en"
-revision = 3
+revision = 5
 translations = {}
 
 [documents."skill.desktop-memory-footprint-review"]
@@ -1616,3 +1622,9 @@ source = "locales/en/.mustflow/skills/web-asset-optimization/SKILL.md"
 source_locale = "en"
 revision = 3
 translations = {}
+
+[documents."skill.ai-game-asset-production"]
+source = "locales/en/.mustflow/skills/ai-game-asset-production/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}

package/templates/default/locales/en/.mustflow/skills/INDEX.md

@@ -2,7 +2,7 @@
 mustflow_doc: skills.index
 locale: en
 canonical: true
-revision: 289
+revision: 294
 authority: router
 lifecycle: mustflow-owned
 ---
@@ -272,7 +272,14 @@ refer to `AGENTS.md` and `.mustflow/config/commands.toml` to implement the most
   review rather than prose polishing.
 - Use `memory-lifetime-review` as an adjunct when code creates, registers, caches, spawns, opens,
   subscribes, schedules, streams, or otherwise retains values or resources whose cleanup,
-  cancellation, eviction, shutdown, or ownership transfer must be reviewed.
+  cancellation, eviction, shutdown, ownership transfer, RSS/heap/external classification,
+  allocator residency, queue-byte growth, end-to-end backpressure, or same-source cross-runtime
+  memory and stream reproduction must be reviewed.
+- Use `connection-lifecycle-integrity-review` as an adjunct when TCP sockets, HTTP keep-alive or
+  pooling, HTTP/2 streams or sessions, Node or Web Streams, FIN/RST, half-close, destroy or abort
+  races, response-body abandonment, reader or writer locks, backpressure, buffer budgets, natural
+  process exit, connection shutdown, fault injection, soak testing, resource-growth gates, or
+  connection-lifetime resolution claims need transport-lifecycle review.
 - Use `desktop-memory-footprint-review` as an adjunct when Windows, macOS, Linux, Electron,
   WebView, WPF, WinUI, Win32, Qt, Java Swing or JavaFX, .NET, JVM, Rust, C++, Python, or other
   desktop app code needs scenario-level memory review across working set versus private memory,
@@ -686,7 +693,8 @@ routes. Event routes stay inactive until their event occurs.
 | Notification generation, email, push, SMS, in-app inbox, digest, reminder, campaign, announcement, marketing message, transactional message, security alert, receipt, legal notice, notification preference, unsubscribe, suppression, quiet hours, timezone schedule, provider webhook, delivery attempt, notification template, or notification audit work needs notification-delivery triage for duplicate, late, suppressed, unsubscribed, wrong-channel, quiet-hours, timezone, retry, provider-webhook, hard-bounce, complaint, invalid-token, fallback, or audit risk | `.mustflow/skills/notification-delivery-integrity-review/SKILL.md` | User goal, current diff or target files, notification event ledger, notification intent ledger, recipient/channel/category ledger, preference and legal policy ledger, suppression ledger, schedule/timezone/quiet-hours/digest ledger, delivery job and attempt ledger, provider event ledger, in-app inbox ledger, audit/security/privacy/operations ledger, existing tests, and configured command intents | Source event and outbox records, notification intent records, preference snapshots, final pre-send rechecks, suppression records, schedule records, timezone-safe recurring intent, quiet-hours behavior, digest records, delivery jobs, delivery attempts, provider event receipts, provider webhook signature and dedupe handling, in-app inbox state, semantic dedupe keys, queue priority, retry classification, template snapshots, redacted audit logs, campaign dry run/sample/canary/ramp-up/kill-switch controls, focused hostile-path tests, and directly synchronized docs or templates | sendNotification shortcut, global opt-out, marketing consent bypass, provider acceptance treated as delivery, missing outbox, stale recipient scope, hard bounce ignored, complaint ignored, one-click unsubscribe missing, link-scanner mutation, stale push token, logout token leak, collapse key misuse, lockscreen data leak, in-app inbox count drift, mark_all_read_before race, semantic dedupe key missing, aggregation hidden as dedupe, digest window drift, quiet-hours delayed blast, timezone DST bug, provider limit starvation, unknown provider outcome blind retry, poison notification loop, provider webhook signature or dedupe gap, template render-time leak, account deletion pending-send leak, fallback spam, dry-run/sample/canary gap, no why-sent or why-suppressed audit, or happy-path-only notification tests | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Notification delivery reviewed, source-event/intent/recipient/preference/suppression/schedule/digest/delivery/provider/inbox/audit map, findings, fixes or recommendation, hostile-path evidence, verification, and remaining notification-delivery risk |
 | Code review or implementation needs api-misuse-resistance triage for APIs, SDKs, function boundaries, service methods, endpoints, command methods, DTOs, request shapes, response shapes, operation names, call ordering, lifecycle setup, boolean parameters, option bags, null or empty semantics, internal table leakage, string-only errors, success-only failure models, idempotency, pagination, sorting, filtering, authorization shape, status mutation, PATCH command buses, time formats, money amounts, open enums, async jobs, bulk partial failures, cacheability, response size, overfragmented calls, internal/external API mixing, version policy, deprecation telemetry, rate limits, retry hints, observability, SDK ergonomics, or caller contract tests | `.mustflow/skills/api-misuse-resistance-review/SKILL.md` | User goal, current diff or target files, caller ledger, operation ledger, shape ledger, compatibility evidence, existing style, and configured command intents | Operation-centered names, explicit lifecycle or builder boundaries, named options or split operations, narrowed option bags, explicit absence and PATCH semantics, public DTO mapping, stable errors, idempotency metadata, cursor stability, auth-specific operations, command-shaped state changes, time and money units, unknown enum handling, job resources, item-level bulk results, cache and rate-limit hints, observability fields, SDK examples, focused tests, and directly synchronized docs or templates | implementation-leaking name, hidden state machine, boolean riddle, trash-can options, null folklore, DB schema frozen as API, string-only error, success-only design, duplicate side effect, moving-list pagination, random default order, hidden permission mode, illegal status transition, PATCH-as-command bus, timezone ambiguity, floating money, closed external enum, fake synchronous completion, erased partial failure, uncacheable expensive read, all-in-one payload bloat, frontend-as-backend call graph, internal/external contract blur, decorative version number, unmeasured deprecation, retry-hostile rate limit, untraceable operation, awkward SDK, happy-path-only contract test, or first-time caller trap | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `test_audit`, `docs_validate_fast`, `test_release`, `mustflow_check` | API misuse resistance reviewed, caller and operation ledgers, shape and contract findings, fixes or recommendation, compatibility notes, verification, and remaining caller-misuse risk |
 | Code review or implementation needs error-message-integrity triage for error text, error codes, validation messages, parse failures, API or CLI error envelopes, public user messages, internal logs, structured diagnostics, exception wrapping, provider errors, retryable flags, idempotency errors, queue or batch failures, partial failures, permission errors, conflict errors, impossible-state errors, support IDs, redaction, stable machine fields, monitoring fields, or troubleshooting text | `.mustflow/skills/error-message-integrity-review/SKILL.md` | User goal, current diff or target files, error audience ledger, error contract ledger, disclosure ledger, recovery ledger, and configured command intents | Stable error codes, expected/actual fields, failed-operation context, reasons, safe identifiers, public/internal message split, redaction, retryability, idempotency metadata, provider metadata, parse positions, range bounds, conflict facts, partial-failure summaries, structured log fields, focused tests, and directly synchronized docs or templates | empty failed label, invalid-value fog, missing action, result repeated as cause, no work context, public/internal message mixing, sensitive value leak, missing safe identifier, retry ambiguity, try-again-later dodge, unstable string-only code, overbroad error bucket, validation info leak, parse location missing, range without bounds, timezone ambiguity, provider evidence loss, cause destruction, brittle message concatenation, prose-only logs, internal jargon in user text, permission existence leak, should-never-happen message, vague conflict, idempotency uncertainty, missing attempt count, partial failure erased, untested error contract, no 30-second next action, or call-site-specific taxonomy drift | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `test_audit`, `docs_validate_fast`, `test_release`, `mustflow_check` | Error message integrity reviewed, surfaces and audiences, code/message contract, evidence and redaction findings, fixes or recommendation, verification, and remaining error-message risk |
-| Object lifetime, retained references, cleanup symmetry, event listeners, timers, subscriptions, goroutines, threads, workers, streams, native handles, caches, queues, registries, closures, or memory/resource leak risk is created, changed, reviewed, or reported | `.mustflow/skills/memory-lifetime-review/SKILL.md` | Lifetime surface, setup sites, cleanup sites, retainer graph, repetition path, success and error paths, and configured command intents | Teardown, cancellation, ownership, weak-reference, eviction, queue-bound, stream-close, worker-shutdown, lifecycle-symmetry code, focused tests, and directly synchronized docs or templates | long-lived owner retaining short-lived object, setup without cleanup, unstable listener identity, timeout without cancellation, unbounded cache or queue, debug/log retention, leaked goroutine/thread/worker, native handle leak, finalizer-only cleanup, weak-reference cover-up, or missing repeated-lifecycle proof | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Lifetime boundary, setup and cleanup owners, retainer paths, long-lived owners and short-lived objects, repeated-lifecycle proof, verification, and remaining lifetime risk |
+| Object lifetime, retained references, cleanup symmetry, event listeners, timers, subscriptions, goroutines, threads, workers, streams, native handles, caches, queues, registries, closures, RSS, heap, external memory, ArrayBuffer or Buffer retention, allocator fragmentation, unbounded buffering, backpressure, or memory/resource leak risk is created, changed, reviewed, diagnosed, validated, or reported | `.mustflow/skills/memory-lifetime-review/SKILL.md` | Lifetime surface, setup and cleanup sites, retainer graph, repetition path, success and error paths, storage-location/retention-owner/terminal-status classification, controlled workload phases, post-GC and post-quiescent slopes, request-attempt-branch-stream ownership DAG, byte-flow and queue ledgers, cache/pool/handle evidence, protocol backpressure evidence, statistical tolerance, and configured command intents | Teardown, cancellation, ownership, weak-reference, eviction, queue-bound, stream-close, worker-shutdown, lifecycle-symmetry code, bounded memory and resource instrumentation, queue-byte accounting, terminal invariants, stop/plateau/resume fixtures, focused tests, and directly synchronized docs or templates | long-lived owner retaining short-lived object, setup without cleanup, unstable listener identity, timeout without cancellation, RSS-only diagnosis, overlapping totals subtracted as native memory, heapTotal called live memory, TIME_WAIT called a process leak, unbounded queue called safe because it drains, cache called bounded by TTL alone, fragmentation claimed before live native allocations are ruled out, accepted bytes confused with committed bytes, count HWM used as a byte cap, clone/tee branch abandoned, whole HTTP/2 transport paused for one stream, finalizer-only cleanup, weak-reference cover-up, or missing repeated-lifecycle proof | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Lifetime boundary, storage/owner/terminal classification, setup and cleanup owners, ownership DAG, retainer paths, memory floors and slopes, queue/backpressure envelope, stop and resume evidence, repeated-lifecycle proof, verification, and remaining lifetime risk |
+| TCP sockets, HTTP keep-alive or pooling, HTTP/2 streams or sessions, Node.js streams, Web Streams readers or writers, FIN/RST, half-close, destroy or abort races, unconsumed response bodies, backpressure, connection shutdown, transport resource leaks, fault injection, soak tests, or connection-lifetime resolution claims are created, changed, reviewed, debugged, validated, or reported | `.mustflow/skills/connection-lifecycle-integrity-review/SKILL.md` | Protocol and role, physical connection, request, body, lock and pool ownership, event and action ledger, orthogonal lifecycle dimensions, terminal-cause policy, reuse gate, buffer and resource ledgers, shutdown paths, harness isolation, closed-cohort request ledger, fault schedule, clean comparator, seed and duration policy, resource-growth gates, and configured command intents | Transport, read, write, pool, request, body, reader or writer, termination admission, quarantine, body lease, buffer budget, resource scope, shutdown state, diagnostics, fault and soak fixtures, measurement gates, regression contracts, docs, route metadata, and synchronized templates | single closing enum, destroy-everywhere cleanup, duplicate finalize, total-order event assumption, request/socket lifetime collapse, body cancel killing an HTTP/2 session, unsafe keep-alive reuse, unbounded discard, backpressure ignored, pending write double settlement, TIME_WAIT called a leak, flat RSS called a fix, contaminated harness counts, retry-until-green, restart called resolution, unref as cleanup, upgraded transport leak, or natural-exit theater | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Protocol and ownership layers, orthogonal states, event/action and primary-cause decisions, finalize/destroy admission, reuse/quarantine and body disposition, resource and buffer invariants, fault and soak evidence, application/library/runtime/environment attribution, resolution classification, verification, and remaining connection-lifecycle risk |
 | Desktop app memory footprint needs scenario-level review for Windows, macOS, Linux, Electron, WebView, WPF, WinUI, Win32, Qt, Java Swing or JavaFX, .NET, JVM, Rust, C++, Python, working set versus private memory, RSS, dirty pages, live set, peak and after-close memory, UI virtualization, data virtualization, renderer and window count, module loading, image decode size, OS-discardable caches, memory-mapped files, `madvise`, `EmptyWorkingSet`, .NET LOH, `ArrayPool<T>`, WPF visual trees, GDI or USER handles, detached DOM nodes, hidden windows or tabs, string deduplication, large buffer capacity, struct padding, object graph shape, undo history, inactive views, low-memory signals, or scenario memory budgets | `.mustflow/skills/desktop-memory-footprint-review/SKILL.md` | Scenario ledger, measurement ledger, UI residency ledger, data residency ledger, cache ledger, runtime ledger, existing tests, package surfaces, synchronized docs or templates, and configured command intents | UI virtualization, data virtualization, container recycling, lazy model fetch, renderer or window disposal, feature-entry module loading, image downsampling, cache cost limits, discardable cache behavior, streaming or memory-mapped file access, mapped-range release hints, low-memory handlers, after-close cleanup, undo compaction, object-shape flattening, string or symbol tables, pooled-buffer scope, native handle release, and focused tests | working-set theater, full UI object creation, UI-only virtualization, hidden renderer retention, eager feature module, original-size thumbnail, item-count-only cache, full file read, mapped range held forever, unsafe pooled buffer return, GDI or USER handle leak, detached DOM retention, console measurement artifact, duplicate string bloat, live-set staircase, cleared-but-huge buffer, padded bulk struct, pointer-heavy row model, whole-document undo snapshot, inactive tab kept fully rendered, no-op low-memory handler, or missing after-close evidence | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Desktop memory footprint boundary reviewed, scenario budget, measurement metric, UI/data virtualization, renderer/window, module, media, cache, file, runtime, native handle, UI retention, string, data model, history, inactive view, memory-pressure, after-close evidence, verification, and remaining desktop-memory risk |
 | Code review or implementation needs hot-path triage for repeated ordinary work, external round trips, multi-pass collection chains, hidden quadratic lookup, per-item allocation or serialization, transaction or lock hold time, sequential async waits, unbounded fan-out, cache stampede, queue throughput, retry multiplication, timeout waits, or missing observability before a broader optimization pass | `.mustflow/skills/hot-path-performance-review/SKILL.md` | Hot path, multipliers, per-iteration cost, boundary ledger, data-size and tail-latency evidence, correctness boundaries, and configured command intents | Batching, projection, lookup tables, bounded concurrency, timeout and cancellation wiring, bulk writes, cache-key boundaries, queue backpressure, transaction or lock narrowing, focused tests, and lightweight observability tied to the hot path | repeated I/O in loops, N+1 query, multi-pass array traversal, hidden `O(n^2)` lookup, unbounded `SELECT *`, large offset pagination, index defeat, wide transaction, lock-held slow work, sequential `await`, unbounded `Promise.all`, per-item client creation, cache key explosion, cache stampede, hot-path logging, deep clone, repeated JSON conversion, CPU-heavy request work, queue bottleneck relocation, retry storm, or p95/p99 blind spot | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Hot path reviewed, cost ledger, repeated-boundary and hidden-complexity findings, semantics preserved, evidence level, verification, and remaining hot-path performance risk |
 | API endpoints, handlers, controllers, resolvers, serializers, mappers, service methods, middleware, webhook receivers, backend-for-frontend paths, admin APIs, or route-level request paths need latency review for repeated work inside one request | `.mustflow/skills/api-request-performance-review/SKILL.md` | API request boundary, Request cost ledger, route span, DB query count, Redis count, external API calls, pool acquire wait, transaction scope, cache hit or miss, payload and response bytes, serialization time, ORM behavior, correctness boundaries, and configured command intents | Projection narrowing, query-count or lazy-loading guards, bounded batching, request-scope memoization, Redis `MGET` or pipeline use, app-side filtering or sorting cleanup, transaction narrowing, route-level observability, focused tests, and directly synchronized docs or templates | per-request I/O fan-out, ORM serializer lazy loading, eager-load row explosion, `SELECT *`, app-side filtering after overfetch, deep `OFFSET`, expensive `COUNT(*)`, index mismatch for `WHERE` plus `ORDER BY` plus `LIMIT`, external API inside transaction, pool acquire wait hidden behind fast queries, Redis loop, cache miss amplification, repeated JSON serialization, huge response bytes, CPU-heavy request work, Node flame graph gap, Go pprof gap, MongoDB `explain()` gap, or missing OpenTelemetry span evidence | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | API request path reviewed, Request cost ledger, route-level DB/Redis/external/cache/serialization/CPU findings, evidence level, verification, and remaining API request performance risk |
@@ -839,6 +847,7 @@ routes. Event routes stay inactive until their event occurs.
 | Core Web Vitals, real-user web performance, CrUX, Search Console, Lighthouse-versus-field discrepancy, RUM instrumentation, LCP, INP, CLS, FID replacement, LCP subparts, interaction latency, Long Animation Frames, long tasks, bfcache, speculation rules, third-party scripts, tag managers, ads, web fonts, responsive hero media, layout shifts, or deployment performance regression needs field-data triage rather than a one-off lab score | `.mustflow/skills/core-web-vitals-field-review/SKILL.md` | User goal, current diff or target files, metric contract, field evidence ledger, LCP ledger, INP ledger, CLS ledger, lab and diagnostics ledger, current official threshold evidence when needed, and configured command intents | RUM instrumentation, metric payloads, route grouping, p75 reporting, field-versus-lab wording, LCP candidate attribution, Server-Timing, Resource Timing, LoAF or long-task capture, bfcache diagnostics, safe speculation rules, focused tests, and narrower render/image/frame/bundle fixes when selected | Lighthouse trophy claim, stale FID dashboard, averaged Web Vitals, hidden mobile failure, missing p75 split, uninstrumented RUM, lazy LCP media, undiscovered hero, render-blocked LCP, INP blocked by hydration or third-party scripts, GTM tag drift, long task without attribution, CLS from ads or skeleton mismatch, bfcache blocker, unsafe prerender side effect, single bundle-size budget, or unmonitored deploy regression | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Core Web Vitals field review, evidence level, threshold and percentile contract, mobile/desktop split, LCP/INP/CLS ledgers, fixes or recommendations, verification, and remaining CWV field risk |
 | Web page, frontend route, landing page, ecommerce page, dashboard, SSR/RSC/SPA route, hero image, LCP candidate, above-the-fold CSS, font, image, iframe, third-party script, chat widget, client bundle, hydration boundary, route prefetch, first-view data fetch, HTML streaming, CDN cache, resource hint, compression, content-visibility, long task, or Core Web Vitals test needs web-render-performance triage for first-render performance, LCP, CLS, FCP, TTFB, render-blocking CSS, asset priority, JavaScript execution cost, or cache and delivery risk | `.mustflow/skills/web-render-performance-review/SKILL.md` | User goal, current diff or target files, first viewport and LCP candidate ledger, critical resource discovery ledger, CSS/render-blocking ledger, font loading ledger, image/video/iframe ledger, third-party script ledger, JavaScript bundle and hydration ledger, data and HTML delivery ledger, cache/compression/resource-hint ledger, main-thread/long-task ledger, measurement or test evidence, and configured command intents | LCP image loading priority, preload and preconnect hints, critical CSS, route CSS splitting, font-display and font preload policy, font subsetting, responsive images, image CDN usage, lazy image and iframe dimensions, third-party script gating, chat widget loading, client/server component boundaries, dynamic imports, code splitting, modulepreload, first-view data fetching, streaming HTML, static shell and dynamic hole split, TTFB instrumentation, CDN and cache headers, compression, content-visibility, long task scheduling, route prefetch behavior, focused tests, and directly synchronized docs or templates | lazy LCP image, undiscovered background hero, fetchpriority everywhere, render-blocking global CSS, common/vendor CSS bloat, font FOIT or CLS, over-preloaded fonts, unsubset Korean or CJK font, oversized image, missing srcset or sizes, lazy image CLS, eager offscreen iframe, global third-party script, first-paint chat SDK, broad use-client boundary, eager modal/chart/editor/map import, tiny-chunk waterfall, modulepreload spam, client-effect first data, all-or-nothing HTML wait, personalized whole-page dynamic render, TTFB handwave, uncacheable static HTML, wrong immutable/no-store cache header, missing text compression, Early Hints or preconnect spam, below-fold DOM layout cost, long main-thread task, overbroad Link prefetch, or lab-only perf claim | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Web render performance reviewed, viewport/resource/CSS/font/media/third-party/JS/data/cache/main-thread map, findings, fixes or recommendation, measurement or test evidence, verification, and remaining web-render performance risk |
 | Web image, hero image, LCP image, product image, feed image, gallery, avatar, thumbnail, carousel image, CSS background hero, `img`, `picture`, `source`, `srcset`, `sizes`, framework image component, responsive preload, `imagesrcset`, `imagesizes`, `fetchpriority`, `loading`, `decoding`, intrinsic dimensions, DPR bucket, width bucket, AVIF/WebP/JPEG/PNG/SVG fallback, quality budget, blur placeholder, base64 inline image, image CDN transformation, derivative cache key, content-hash URL, `Accept` negotiation, image proxy allowlist, EXIF orientation, ICC profile, uploaded SVG handling, `elementtiming`, Resource Timing, DevTools image waterfall, or RUM image evidence needs image-delivery-performance triage for discovery, priority, candidate size, layout stability, cacheability, quality, or abuse risk | `.mustflow/skills/image-delivery-performance-review/SKILL.md` | User goal, current diff or target files, image role ledger, discovery and priority ledger, responsive candidate ledger, layout stability ledger, format and quality ledger, pipeline and metadata ledger, CDN and cache ledger, safety and abuse ledger, image measurement evidence or gap, and configured command intents | Image markup, `picture` source order, `srcset`, `sizes`, `loading`, `decoding`, `fetchpriority`, responsive preload, `imagesrcset`, `imagesizes`, intrinsic dimensions, `aspect-ratio`, placeholders, CSS background preload hints, framework image props, width and DPR buckets, format fallback policy, quality settings, metadata handling, cache headers, derivative cache key rules, `Accept` forwarding, remote image allowlists, transform limits, focused tests, and directly synchronized docs or templates | lazy LCP image, priority inflation, hidden background image discovery, responsive preload missing `imagesrcset` or `imagesizes`, multi-format preload, wrong `sizes`, framework fill without sizes, lazy image missing dimensions, unbounded 3x variants, arbitrary width bucket, CDN cache-key confetti, wrong format by content type, weak JPEG fallback, global quality constant, missing byte budget, EXIF rotation bug, color-profile loss, unsafe SVG serving, meaningful image hidden as CSS background, first-view lazy loading, giant lazy gallery, wrong `decoding` hint, oversized blur placeholder, base64 HTML bloat, missing content-hash URL, lost original, dropped `Accept` header, public image proxy, unbounded remote transform, Lighthouse-only claim, or duplicate image download | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Image delivery performance reviewed, image role/discovery/priority/candidate/layout/format/quality/cache/pipeline/safety map, findings, fixes or recommendation, measurement or static image-delivery evidence, verification, and remaining image-delivery performance risk |
+| AI-generated 2D game assets, transparent PNGs, icons, sprites, sprite sheets, animation frames, tiles, terrain transitions, parallax backgrounds, props, VFX, texture atlases, pivots, trim metadata, alpha fringes, texture bleeding, foot sliding, loop discontinuity, or engine-ready image pipelines are planned, generated, integrated, reviewed, or validated | `.mustflow/skills/ai-game-asset-production/SKILL.md` | Asset roles, target engine and renderer version, camera and projection, final sizes and pixels per unit, alpha and color-space convention, master references, anchors, provenance ledger, source/work/output ownership, acceptance metrics, and configured command intents | Asset contracts, source manifests, masks, metadata, image-processing code, atlas and engine import settings, acceptance scenes, fixtures, tests, and directly synchronized docs within the selected asset scope | prompt-only production, baked background, matte fringe, unstable identity or scale, trim jitter, foot sliding, broken seams or loops, atlas bleed, collision derived from decorative pixels, stale legal claim, unknown provenance, or source-only verification | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `mustflow_check` | Asset and engine contract, provenance and stage boundaries, geometry/alpha/pivot/tile/animation/atlas findings, threshold sources, candidate disposition, verification, and remaining visual, gameplay, provenance, or runtime risk |
 | Frontend app, client package, route, design system, component library, import graph, package entrypoint, bundler config, shared vendor chunk, first-route JS, tree shaking, ESM/CJS dependency, barrel file, package exports, sideEffects metadata, PURE annotation, Next use-client boundary, Server Component split, dynamic import, React lazy, Angular defer, Vue route lazy loading, import modularization, icon import, date locale, syntax highlighter, markdown renderer, code editor, Node polyfill, browser target, Babel polyfill, dev-only branch, console stripping, Rollup manualChunks, Vite modulepreload, Tailwind extraction, safelist, or inline asset rule needs client-bundle-pruning triage for dead-code elimination, dependency bloat, initial JS, shared vendor, or route chunk risk | `.mustflow/skills/client-bundle-pruning-review/SKILL.md` | User goal, current diff or target files, bundle target ledger, entry and import graph ledger, dependency format ledger, framework boundary ledger, heavy-feature ledger, polyfill and target ledger, bundle budget or analyzer evidence, and configured command intents | Import paths, package entrypoints, subpath exports, barrel usage, ESM package choices, package `sideEffects`, Rollup `moduleSideEffects`, PURE annotations, client/server boundaries, dynamic imports, framework deferral boundaries, package import modularization, icon/date/highlighter/editor imports, Node polyfill fallbacks, browser and Babel targets, dev-only constants, logging wrapper behavior, manual chunk rules, modulepreload policy, Tailwind extraction shapes, asset inline thresholds, focused tests, and directly synchronized docs or templates | total-dist theater, no initial-JS budget, CJS package on client path, broad utility import, hot-path barrel, package-root import dragging design system, missing subpath export, unsafe `sideEffects: false`, CSS or polyfill shaken away, global `moduleSideEffects: false`, missing PURE hint, false PURE annotation, page-level `use client`, server-safe parser in client bundle, dynamic import with variable path, lazy component declared in render, eager modal/chart/editor/map/search/PDF import, library import before user intent, Angular defer leak, Vue eager route, unverified import modularization, icon catalog import, all date locales, all highlighter languages, Node polyfill bundle, old browser-target helper bloat, whole `core-js` import, dev branch not folded, unsafe console drop, one giant vendor chunk, modulepreload spam, dynamic Tailwind class miss, broad safelist, large inline SVG/font/image, or unmeasured bundle claim | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Client bundle pruning reviewed, first-route/shared-vendor/import/dependency/client-boundary/polyfill/chunk/CSS/asset map, findings, fixes or recommendation, measurement or test evidence, verification, and remaining client-bundle pruning risk |
 | Frontend route, component, animation, scroll path, input path, list, table, chart, map, canvas, media slot, modal, drawer, hydration boundary, DOM read/write path, CSS selector, class toggle, CSS custom property, containment, content-visibility, virtualization, observer, event listener, requestAnimationFrame loop, long task, worker boundary, ResizeObserver path, runtime CSS injection, React memo boundary, context provider, deferred update, transition, or DevTools rendering trace needs frame-render-performance triage for INP, animation smoothness, scroll responsiveness, style recalculation, layout, paint, compositing, main-thread, or hydration risk | `.mustflow/skills/frame-render-performance-review/SKILL.md` | User goal, current diff or target files, interaction and frame ledger, DOM and layout ledger, style and CSS ledger, paint and compositing ledger, event and scheduling ledger, framework render ledger, rendering evidence or measurement gap, and configured command intents | DOM read/write batching, layout-affecting writes, transform/opacity animations, will-change scope, containment, content-visibility and contain-intrinsic-size, virtualization, selector simplification, state-class scope, CSS variable scope, media geometry reservation, native lazy loading, IntersectionObserver, passive listeners, overscroll-behavior, requestAnimationFrame scheduling, long-task chunking, worker and OffscreenCanvas boundaries, ResizeObserver, runtime CSS rule reduction, React prop and context stability, deferred and transition updates, hydration narrowing, focused tests, and directly synchronized docs or templates | forced synchronous layout, layout thrashing, width/height/top/left animation, stale will-change, missing containment, unsafe contain side effect, content-visibility scroll jump, offscreen chart or canvas work, oversized DOM, deep wrapper tree, expensive selector, body/html state blast, root CSS variable churn, unreserved media slot, LCP concern misrouted as frame fix, JS lazy loader overhead, scroll polling, non-passive wheel/touch handler, JS scroll lock, setTimeout frame clock, long task, main-thread heavy compute, canvas blocking input, resize measurement loop, runtime style injection, ineffective memo, broad context rerender, urgent heavy result render, full hydration INP cost, Lighthouse-score-only claim, or unmeasured rendering win | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Frame render performance reviewed, interaction/DOM/style/layout/paint/compositing/event/framework map, findings, fixes or recommendation, measurement or static frame-risk evidence, verification, and remaining frame-render performance risk |
 | UI motion, animation, transition, microinteraction, motion recipe, motion design system, CSS animation or transition, WAAPI, Framer Motion, GSAP, View Transition, hover, press, focus, drag, viewport entry, loading, async success, async failure, reduced motion, interruption, cancellation, settlement, timeline track, transform, opacity, filter, layout animation, or additive composition is planned, edited, reviewed, or reported | `.mustflow/skills/motion-system-contract-review/SKILL.md` | User goal, current diff or target files, motion slot, source and target roles, semantic event class, logical from-state and to-state, timeline tracks, interruption policy, settlement policy, reduced-motion policy, binding approach, async signal owner, evidence level, and configured command intents | Motion recipes, component motion props, CSS keyframes and transitions, animation lifecycle handlers, reduced-motion rules, state and signal policies, role/ref/slot/data binding, story fixtures, focused tests, and directly synchronized docs or templates | motion owns product state, false success or failure feedback, timer pretending to be a signal, missing from-state or to-state, same target and channel collision, unsupported additive composition, layout-channel animation, `animation-fill-mode` state lie, missing reduced motion, hover-only access, brittle selector binding, production animation failure blocking core action, or unverified visual proof | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Motion contract reviewed, state/event/track/interruption/settlement/reduced-motion/binding ledgers, async and collision findings, evidence level, verification, and remaining motion contract risk |

package/templates/default/locales/en/.mustflow/skills/ai-game-asset-production/SKILL.md

@@ -0,0 +1,209 @@
+---
+mustflow_doc: skill.ai-game-asset-production
+locale: en
+canonical: true
+revision: 1
+lifecycle: mustflow-owned
+authority: procedure
+name: ai-game-asset-production
+description: Apply this skill when AI-generated 2D game assets such as transparent PNGs, icons, sprites, animation frames, tiles, backgrounds, atlases, or engine-ready textures are planned, generated, normalized, integrated, reviewed, or validated as a repeatable production pipeline.
+metadata:
+  mustflow_schema: "1"
+  mustflow_kind: procedure
+  pack_id: mustflow.core
+  skill_id: mustflow.core.ai-game-asset-production
+  command_intents:
+    - changes_status
+    - changes_diff_summary
+    - lint
+    - build
+    - test_related
+    - test
+    - docs_validate_fast
+    - mustflow_check
+---
+
+# AI Game Asset Production
+
+<!-- mustflow-section: purpose -->
+## Purpose
+
+Turn generated pictures into reproducible 2D game assets by making the project contract, source
+provenance, geometry, alpha handling, pivots, animation semantics, engine import behavior, and
+acceptance evidence authoritative instead of treating prompt wording or a visually pleasing master
+image as the production contract.
+
+<!-- mustflow-section: use-when -->
+## Use When
+
+- AI-generated transparent PNGs, icons, sprites, sprite sheets, animation frames, tiles, terrain
+  transitions, parallax backgrounds, props, VFX, or texture atlases are created or revised for a game.
+- Assets look acceptable alone but drift in projection, scale, lighting, palette, edge continuity,
+  pivot, ground contact, collision alignment, frame identity, or runtime filtering.
+- A repository needs a repeatable raw-to-engine asset pipeline, asset contract, atlas metadata,
+  automatic image checks, contact sheets, or engine-scene acceptance fixtures.
+- A bug reports baked checkerboards, matte fringes, texture bleeding, trim jitter, foot sliding,
+  broken animation loops, inconsistent directional sprites, or seams between tiles and backgrounds.
+
+<!-- mustflow-section: do-not-use-when -->
+## Do Not Use When
+
+- The task only optimizes website image delivery, responsive sources, LCP behavior, or browser cache
+  policy; use `web-asset-optimization` or `image-delivery-performance-review`.
+- The task only creates a concept illustration with no game-engine integration, repeatability, or
+  asset acceptance requirement.
+- The main deliverable is a 3D mesh, rig, topology, UV layout, shader, or physically based material;
+  this skill may use a 3D proxy as an input but does not own a full 3D production pipeline.
+- The task asks for a legal conclusion about copyright, trademark, platform policy, or commercial
+  rights. Use current authoritative sources and `provenance-license-gate`; do not convert this
+  procedure into legal advice.
+- The task only reviews UI motion state, interruption, or reduced-motion behavior rather than game
+  sprite frame production; use `motion-system-contract-review`.
+
+<!-- mustflow-section: required-inputs -->
+## Required Inputs
+
+- Asset inventory and role for each output: isolated cutout, opaque background, translucent effect,
+  repeating tile, transition mask, icon, pixel art, painted sprite, normal map, or data mask.
+- Target engine and renderer version, camera or projection, final display sizes, pixels per world
+  unit, color-space and straight or premultiplied alpha convention, filtering, mipmap, wrap,
+  compression, and atlas policy.
+- Existing asset contract, style references, turnaround or calibration set, palette, meaningful
+  anchors, collision ownership, and animation state definitions; missing decisions must be named.
+- Source and provenance ledger for generators, model or checkpoint components, reference images,
+  licenses or permissions, human edits, and retained source files.
+- Repository paths and ownership for immutable source material, editable work files, generated
+  engine outputs, metadata, tests, and review artifacts.
+- Acceptance metrics with a source of truth, measurement scale, threshold, exception, and failure
+  action, plus configured command intents in the selected repository.
+
+<!-- mustflow-section: preconditions -->
+## Preconditions
+
+- The task matches the use conditions and does not match an exclusion.
+- Higher-priority instructions, the selected repository's command contract, current engine setup,
+  and existing asset pipeline have been inspected.
+- The final runtime scale and renderer behavior are known, or the work stops at a calibration plan
+  instead of inventing production thresholds.
+- Reference inputs have usable provenance, or unknown-rights inputs are excluded from shipped
+  assets and reported.
+
+<!-- mustflow-section: allowed-edits -->
+## Allowed Edits
+
+- Add or update project-owned asset contracts, source manifests, masks, metadata, image-processing
+  code, atlas configuration, engine import settings, acceptance scenes, fixtures, tests, and directly
+  synchronized documentation within the user-selected asset scope.
+- Preserve immutable generated originals and manually authored masters when the repository declares
+  them as sources. Treat derived engine output as regenerable unless the repository says otherwise.
+- When durable automation is needed, use the repository's existing cross-platform toolchain; under
+  the host policy, new repository automation defaults to Bun-backed TypeScript unless a nearer rule
+  selects another runtime.
+- Do not install dependencies, call online generators, upload reference material, change legal or
+  platform policy, regenerate broad asset catalogs, or run unconfigured engine tools.
+- Do not derive gameplay collision directly from decorative alpha unless the project contract
+  explicitly defines that bounded case.
+
+<!-- mustflow-section: procedure -->
+## Procedure
+
+1. Classify every requested asset by rendering role and reject a one-setting-for-every-PNG pipeline.
+   Color textures, normal or mask data, hard cutouts, soft VFX, repeatable tiles, icons, and animation
+   frames have different alpha, color-space, resize, compression, and verification contracts.
+2. Locate or define the smallest project-owned asset contract. Record canvas and target sizes,
+   projection and camera, pixels per unit, ground line, safe region, palette and value structure,
+   light direction, alpha convention, layers, anchors, sockets, collision profile, atlas rules, and
+   engine import expectations. Prompt text may derive from this contract but never replaces it.
+3. Build a provenance and replacement ledger before generation. Separate provider permission,
+   copyrightability, third-party infringement risk, and exclusivity. Record the exact generator and
+   component chain, reference rights, source hashes, human contributions, review status, output
+   hashes, and every shipped use so one disputed asset can be quarantined and replaced.
+4. Establish a calibration set before bulk generation: geometric primitives, a humanoid or object
+   scale reference, representative materials, smallest target-size previews, tile neighbors, and the
+   engine acceptance scene. Reject model, style, or post-processing combinations that cannot hold
+   geometry, scale, light, or identity across this set.
+5. Freeze invariants separately from variables. Projection, camera, scale, light, palette, outline,
+   body ratios, anchors, and master references stay fixed; pose, expression, equipment, damage, and
+   material variants change deliberately. Derive variants from the approved master and original
+   reference set, not from a chain of progressively drifted outputs.
+6. Preserve stages as source, work, and generated engine output. Keep generator settings and source
+   hashes with the immutable source; perform masks, paintover, segmentation, alignment, and palette
+   work in the editable stage; rebuild atlas and engine output from declared inputs.
+7. Apply the alpha, icon, separation, trim, resize, atlas, and runtime checks in
+   `references/raster-alpha-atlas-checklist.md`. Test isolated cutouts on light, dark, and saturated
+   backgrounds. Preserve soft foreground alpha for glass, smoke, fire, and light instead of forcing
+   a binary mask.
+8. Apply the tile, background, object-contact, and animation branches in
+   `references/tile-animation-checklist.md`. Generate tile topology and masks before surface detail,
+   align frames by semantic anchors, keep gameplay shapes separate from art, and preserve full
+   untrimmed-frame metadata after packing.
+9. Define the automatic acceptance contract from
+   `references/asset-contract-validation.md`. Every metric needs a named coordinate space, target
+   scale, threshold source, exception policy, and deterministic failure action. A candidate starting
+   value is calibration evidence, not a universal default.
+10. Validate the derived output after the same resize, premultiplication, packing, compression,
+    filtering, mipmap, and color-space conversions used by the shipped build. Inspect native and
+    reduced scales in the actual renderer; source-PNG inspection alone cannot prove engine behavior.
+11. Classify each candidate as accepted, rework, quarantined, or rejected. Do not move a failing
+    threshold to fit a favored image. If the contract is wrong, revise it with new gameplay or
+    rendering evidence and re-evaluate the full calibration set.
+12. Run only configured oneshot intents in the selected repository. Keep asset generation,
+    conversion, tests, builds, and engine verification local to that repository's command authority.
+
+<!-- mustflow-section: postconditions -->
+## Postconditions
+
+- Every shipped output is traceable to project-owned contract fields, source inputs, transformation
+  settings, metadata, and an acceptance result.
+- Transparent edges, pivots, trim offsets, atlas padding, tile seams, frame identity, contact points,
+  and runtime import settings are verified at the target scale or explicitly reported as unverified.
+- Gameplay collision and event timing remain project-owned semantic data rather than accidental
+  consequences of generated pixels.
+- Missing provenance, engine evidence, thresholds, or configured verification causes a bounded stop,
+  quarantine, or calibration report rather than an unsupported completion claim.
+
+<!-- mustflow-section: verification -->
+## Verification
+
+Use configured oneshot command intents when available in the selected repository:
+
+- `changes_status`
+- `changes_diff_summary`
+- `lint`
+- `build`
+- `test_related`
+- `test`
+- `docs_validate_fast`
+- `mustflow_check`
+
+Prefer the narrowest asset compiler, image validator, atlas, engine import, or acceptance-scene intent
+declared by the project. A passing static PNG check does not replace renderer or engine evidence.
+
+<!-- mustflow-section: failure-handling -->
+## Failure Handling
+
+- If projection, target scale, alpha convention, pivot, or runtime import behavior is unknown, stop
+  production output and return the missing contract fields plus a calibration plan.
+- If reference provenance or commercial-use evidence is missing, exclude that input and its
+  derivatives from shipped output; do not make a legal assumption from generator marketing copy.
+- If an isolated cutout fails RGBA, border-alpha, fringe, clipping, or safe-margin checks, quarantine
+  it before atlas packing. If a translucent effect fails a cutout-only rule, fix the role contract
+  rather than destroying its soft alpha.
+- If frames fail identity, anchor, foot-contact, skeleton, arc, timing, or loop gates, rework the
+  source frames or metadata before assembling the sheet.
+- If source files pass but engine output fails, inspect premultiplication, color space, padding,
+  extrude, UVs, filtering, mipmaps, wrap, compression, and import version before regenerating art.
+- If a needed validator or engine check lacks a configured intent, report the missing intent and the
+  exact unverified risk instead of running a guessed command.
+
+<!-- mustflow-section: output-format -->
+## Output Format
+
+- Asset roles and target engine contract
+- Source, work, generated-output, and provenance boundaries
+- Geometry, alpha, pivot, tile, animation, atlas, and engine findings
+- Acceptance metrics, threshold sources, exceptions, and candidate disposition
+- Files and metadata created or changed
+- Command intents run
+- Skipped checks and reasons
+- Remaining visual, gameplay, provenance, or runtime risk

package/templates/default/locales/en/.mustflow/skills/ai-game-asset-production/references/asset-contract-validation.md

@@ -0,0 +1,106 @@
+# Asset Contract and Validation Ledger
+
+Use this reference to turn a visual request into project-owned inputs and observable acceptance
+evidence. Values below are fields to decide, not Mustflow defaults.
+
+## Contract fields
+
+Record the fields that apply to the selected asset role:
+
+| Area | Contract fields |
+| --- | --- |
+| identity | asset ID, role, variant family, master source, replacement tier |
+| geometry | canvas, intended occupied bounds, target display sizes, pixels per unit, world dimensions, projection, camera, horizon or ground line |
+| presentation | palette, value bands, outline range, material simplification, light vector, shadow policy, allowed baked lighting |
+| transparency | straight or premultiplied delivery, cutout or soft alpha, background model, matte policy, color dilation policy |
+| alignment | root pivot, ground contact, center of mass, sockets, trim policy, untrimmed source size |
+| gameplay | movement collider, hurtbox, hitbox, interaction region, occluder, z-sort anchor, event frames |
+| texture | color space, bit depth, filter, mipmap, wrap, compression, atlas rotation, extrude, shape padding, border padding |
+| lifecycle | raw source owner, editable master, derived output, generator version, transform version, reviewer, replacement map |
+
+For perspective or isometric work, also record screen directions for world axes and the expected
+projection of a calibration cube. A style name such as "isometric" or "three-quarter" is not a
+projection contract.
+
+## Provenance and replacement ledger
+
+Keep provenance evidence separate from visual approval:
+
+- exact provider, model, checkpoint, adapter, VAE, pose or control input, and post-processor versions;
+- account or license context needed by the project, captured at the generation date when required;
+- source URL or file identity, hash, author or owner, license or permission, attribution, and use scope
+  for every reference input;
+- prompt or prompt hash, seed when meaningful, settings hash, generation date, and immutable raw hash;
+- human-authored blockout, silhouette, composition, paintover, palette, rig, frame alignment, and
+  gameplay metadata contributions;
+- similarity, watermark, logo, trademark, platform disclosure, and human-review disposition;
+- final file hash and every game, atlas, UI, store, marketing, and localization reference that must be
+  changed during quarantine or replacement.
+
+Do not collapse provider permission, copyright ownership, non-infringement, and exclusivity into one
+"commercial use" boolean. Time-sensitive legal, vendor, and platform claims require current
+authoritative sources; this ledger records evidence and decisions but does not supply legal advice.
+
+## Metric contract
+
+Every automated metric should declare:
+
+| Field | Question |
+| --- | --- |
+| metric ID | What stable name identifies the rule? |
+| asset roles | Which cutout, effect, tile, icon, frame, or atlas roles does it apply to? |
+| coordinate space | Source pixels, target pixels, normalized canvas, world units, UVs, or color space? |
+| sampling stage | Raw, work, resized, packed, compressed, imported, or rendered? |
+| threshold | What exact bound causes pass, warning, review, quarantine, or rejection? |
+| source | Project contract, engine rule, representative approved set, or measured runtime budget? |
+| exception | Which intentional edge-touch, full-canvas effect, soft-alpha, or asymmetric pose is exempt? |
+| evidence | Which report, image, contact sheet, metadata record, or engine scene proves the result? |
+| action | Rework, quarantine, reject, or revise the contract with new evidence? |
+
+## Required metric families
+
+Select only the families relevant to the asset role:
+
+- file contract: exact canvas, color mode, RGBA presence, bit depth, color profile, byte budget, empty
+  output, duplicate hash, naming, and metadata completeness;
+- alpha contract: corner and border alpha, border-connected background residue, low-alpha noise area,
+  alpha histogram, matte fringe on contrasting backgrounds, and hidden RGB policy;
+- framing contract: occupied bounds, border contact, safe margin, ground contact, pivot, sockets,
+  source size, trim rectangle, and sprite-source position;
+- icon contract: silhouette occupancy, minimum negative space, minimum stroke, connected-component
+  count, contrast, pixel-grid alignment, and size-specific detail budget;
+- seam contract: opposite-edge color and gradient distance, corner closure, repeated-pattern peak,
+  topology validity, object-contact height, and worst-neighbor matrix;
+- animation contract: root and pivot drift, support-foot world drift, silhouette-area change, landmark
+  and bone-length change, palette drift, motion-arc deviation, loop pose and velocity discontinuity,
+  optical-flow outliers, and event-frame completeness;
+- runtime contract: atlas bleed, UV region, alpha blend agreement, filter and mipmap behavior, wrap,
+  compression artifacts, draw scale, pixel snap, import metadata, and engine-scene result.
+
+## Threshold calibration
+
+Exact values belong to the project because a 16-pixel icon, a 256-pixel painted sprite, and a
+full-canvas smoke effect cannot share one tolerance. Calibrate from target-size approved examples and
+known-bad fixtures.
+
+Useful starting hypotheses from the supplied production material include exact alpha zero at isolated
+cutout corners, no unintended occupied border pixel, pivot or grounded-foot drift no greater than one
+target pixel, silhouette-height drift around two percent, and light-direction drift around five
+degrees. These are calibration candidates only. Record the tested scale and replace them with the
+project's measured bounds before using them as release gates.
+
+If no approved baseline or engine evidence exists, emit measurements and contact sheets as a
+calibration report. Do not silently turn an arbitrary number into a pass or fail contract.
+
+## Acceptance matrix
+
+Render or inspect at least:
+
+- transparent cutouts on black, white, mid-gray, and saturated backgrounds;
+- icons at every shipped optical size, not only a large master preview;
+- tiles as same-tile repeats and worst valid neighbors, including all four corners;
+- sprites at native, reduced, and enlarged scales with the shipped filter and mipmap policy;
+- atlases before and after compression with adjacent high-contrast sprites;
+- animation at intended frame durations, slow inspection speed, and the loop boundary;
+- debug overlays for pivot, ground line, sockets, trim rectangle, collider, hurtbox, hitbox, occluder,
+  motion paths, light vector, and tile topology.