mustflow 2.85.4 → 2.99.0

package/templates/default/locales/en/.mustflow/skills/vector-search-integrity-review/SKILL.md

@@ -0,0 +1,209 @@
+---
+mustflow_doc: skill.vector-search-integrity-review
+locale: en
+canonical: true
+revision: 2
+lifecycle: mustflow-owned
+authority: procedure
+name: vector-search-integrity-review
+description: Apply this skill when vector search, semantic search, RAG retrieval mechanics, embeddings, vector databases, ANN indexes, exact versus approximate search, filters, metadata payloads, namespaces, tenants, named vectors, hybrid search, reranking, recall, latency, quantization, HNSW, IVF, pgvector, Qdrant, Milvus, Weaviate, OpenSearch kNN, or retrieval golden-set behavior is created, changed, reviewed, or failing. Use rag-pipeline-triage first when a RAG failure is not yet localized to retrieval versus parsing, context assembly, prompt, generation, citation, or answerability.
+metadata:
+  mustflow_schema: "1"
+  mustflow_kind: procedure
+  pack_id: mustflow.core
+  skill_id: mustflow.core.vector-search-integrity-review
+  command_intents:
+    - changes_status
+    - changes_diff_summary
+    - lint
+    - build
+    - test_related
+    - test
+    - docs_validate_fast
+    - test_release
+    - mustflow_check
+---
+
+# Vector Search Integrity Review
+
+<!-- mustflow-section: purpose -->
+## Purpose
+
+Review vector and semantic search as a retrieval contract, not as "the vector database is good or
+bad."
+
+The core question is whether ingestion, embedding, storage, exact search, approximate search,
+filters, reranking, and latency evidence all agree for the same query contract.
+
+<!-- mustflow-section: use-when -->
+## Use When
+
+- Code creates or changes embedding generation, preprocessing, chunking, vector schema, collection
+  names, namespaces, tenants, named vectors, metadata payloads, filters, search parameters, ANN
+  indexes, hybrid search, reranking, retrieval metrics, RAG context selection, or vector DB clients.
+- Search is missing documents, returning wrong results, returning empty filtered results, duplicating
+  chunks, leaking tenants, becoming slow, changing quality after model or index changes, or behaving
+  differently across replicas.
+- A review needs recall, MRR, golden-set, exact-versus-ANN, filter, metadata index, quantization,
+  compaction, shard, consistency, reranker, or embedding-model-version evidence.
+
+<!-- mustflow-section: do-not-use-when -->
+## Do Not Use When
+
+- The task is only generic database schema or query performance with no vector, embedding, semantic
+  retrieval, or RAG boundary; use the database or performance skill.
+- The task is only LLM answer grounding after retrieval is already proven; use
+  `llm-hallucination-control-review`.
+- The task is an end-to-end RAG failure and it is not yet clear whether ingestion, retrieval,
+  context assembly, prompt construction, generation, citation validation, or answerability failed;
+  use `rag-pipeline-triage` first.
+- The task is only API transport or SDK failure before search boundaries are known; use
+  `api-failure-triage`.
+- The task asks for live production vector dumps containing sensitive text, embeddings, customer
+  documents, or private prompts. Use redacted hashes, ids, dimensions, norms, and aggregate metrics.
+
+<!-- mustflow-section: required-inputs -->
+## Required Inputs
+
+- Retrieval symptom classification: ingestion missing, write not visible, wrong results, empty
+  results, low recall, tenant leak, duplicate chunks, stale deletes, slow search, reranker drift, or
+  generated answer drift.
+- Query contract ledger: query text or safe fixture id, embedding model and revision, preprocessing
+  version, vector dimension, vector norm, metric, collection, namespace, tenant, named vector,
+  filters, `top_k`, candidate count, consistency level, ANN parameters, hybrid weights, and reranker
+  settings.
+- Ingestion ledger: source id, chunk id, deterministic vector id, embedding version, payload shape,
+  write count, unique id count, direct lookup count, indexed count, deleted or tombstoned count, and
+  visibility lag.
+- Quality ledger: golden queries, expected ids, acceptable alternatives, exact-search result,
+  ANN result, recall at k, MRR, empty rate, duplicate rate, filtered result count, and before/after
+  comparison.
+- Performance ledger: cold versus warm latency, p50, p95, p99, queue wait, DB search time, reranker
+  time, payload size, filter selectivity, shard distribution, compaction or indexing work, memory,
+  disk, and retry behavior.
+- Privacy ledger: raw text, vectors, prompts, document ids, tenant ids, provider payloads, and
+  whether evidence can be safely stored as ids, hashes, summaries, or aggregate metrics.
+
+<!-- mustflow-section: preconditions -->
+## Preconditions
+
+- The task matches the Use When conditions and does not match the Do Not Use When exclusions.
+- Higher-priority instructions and `.mustflow/config/commands.toml` have been checked.
+- Raw embeddings, raw document text, prompts, and tenant-identifying payloads are not copied into
+  docs, tests, commits, or reports unless they are safe synthetic fixtures.
+
+<!-- mustflow-section: allowed-edits -->
+## Allowed Edits
+
+- Add or tighten embedding versioning, preprocessing versioning, vector validation, deterministic
+  IDs, namespace or tenant selection, metadata indexes, filter construction, exact-search checks,
+  ANN parameters, reranker candidate counts, golden-set tests, metrics, docs, fixtures, and
+  retrieval contract tests.
+- Add focused synthetic fixtures that encode expected retrieval behavior, filtered retrieval,
+  tenant separation, duplicate handling, and exact-versus-ANN comparison.
+- Do not change embedding models, rebuild large indexes, tune ANN parameters, disable filters, widen
+  tenants, bypass authorization, or dump production vectors without explicit scope and evidence.
+
+<!-- mustflow-section: procedure -->
+## Procedure
+
+1. Classify the symptom first: ingestion missing, write-not-visible, wrong result, empty result,
+   stale delete, duplicate chunks, tenant leak, slow search, reranker drift, or answer generation.
+2. Build the query contract ledger before tuning. Include model revision, preprocessing, dimension,
+   norm, metric, collection, namespace, named vector, filters, `top_k`, ANN parameters, hybrid
+   weights, reranker settings, and consistency level.
+3. Validate vector shape at ingestion and query time. Reject wrong dimension, NaN, infinities,
+   all-zero vectors, extreme norms, and model or preprocessing version mismatches.
+4. Keep embedding model identity exact. Model name alone is not enough; include revision, tokenizer,
+   pooling, prefix policy, max length, HTML cleanup, chunking, and normalization.
+5. Compare exact search with approximate search on the same query and filter. If exact search is
+   wrong, stop tuning ANN and inspect embeddings, preprocessing, metric, payload, and expectations.
+6. Compare filter-free search, filter-only count, filtered exact search, and filtered ANN search.
+   Empty filtered results often mean filter construction, metadata typing, payload indexing, or
+   post-filter candidate loss rather than bad embeddings.
+7. Confirm collection, namespace, tenant, alias, and named vector. Directly inspect the problem id
+   or safe synthetic id in the same search surface the app uses.
+8. Check deterministic upsert ids. Source id, chunk index, tenant, and embedding version should not
+   accidentally duplicate chunks or overwrite all chunks with one id.
+9. Separate write success from search visibility. Check direct lookup, exact search, ANN search,
+   indexed count, consistency, segment state, and visibility lag.
+10. Check deletes and updates. Deletion marks, tombstones, compaction, vacuum, stale segments, and
+    old chunks can keep appearing after API success.
+11. Review metric and normalization. Cosine, dot product, and L2 are different contracts unless
+    the vectors are intentionally normalized and the index operator matches.
+12. Tune ANN only after the exact and filter contracts are correct. Evaluate recall and p95 latency
+    across parameter sweeps instead of changing one value blindly.
+13. Treat build-time index parameters as recall ceilings. If search-time parameters cannot recover
+    recall, the index may need rebuild policy, not a larger query knob.
+14. Review quantization and rescoring. Compare full-precision exact results with compressed-index
+    candidates and confirm enough candidates reach full-precision reranking.
+15. For hybrid search, store dense score, sparse or keyword score, normalized score, fusion method,
+    and final score. Do not add incompatible raw scores directly without a deliberate combiner.
+16. For reranking, record pre-rerank and post-rerank ids and ranks. If the right document never
+    enters the candidate set, the reranker cannot recover it.
+17. Avoid deep ANN pagination as a product contract. Use cursor, filters, grouping, or ordinary
+    sorted indexes for deep browsing instead of pretending vector search has cheap random offsets.
+18. Split cold and warm latency, server search time and client wait, vector DB time and reranker
+    time, and single-query latency from concurrent load.
+19. Inspect shard, replica, segment, compaction, flush, indexing, memory, disk, and cache state when
+    p99 or intermittent quality varies across nodes.
+20. Add a golden-set gate when the project has a test surface. Include easy, hard, filtered,
+    tenant-scoped, rare-name, synonym, short-query, long-query, and sparse-data cases.
+
+<!-- mustflow-section: postconditions -->
+## Postconditions
+
+- The retrieval symptom, query contract, ingestion contract, quality ledger, performance ledger, and
+  privacy boundary are explicit.
+- Exact search, ANN, filters, metadata, namespaces, tenants, named vectors, IDs, deletes, metric,
+  normalization, quantization, hybrid search, reranking, shards, consistency, and latency are fixed
+  or reported where relevant.
+- Search quality claims are backed by golden-set, exact-versus-ANN, configured-test, static review,
+  or manual-only evidence.
+
+<!-- mustflow-section: verification -->
+## Verification
+
+Use configured oneshot command intents when available:
+
+- `changes_status`
+- `changes_diff_summary`
+- `lint`
+- `build`
+- `test_related`
+- `test`
+- `docs_validate_fast`
+- `test_release`
+- `mustflow_check`
+
+Prefer the narrowest configured tests that cover retrieval contract, tenant isolation, filters,
+golden-set metrics, deterministic ids, and docs or template surfaces. Report missing vector DB,
+embedding provider, exact-search, ANN recall, reranker, load, or production-index evidence instead
+of inventing live diagnostics.
+
+<!-- mustflow-section: failure-handling -->
+## Failure Handling
+
+- If the query contract cannot be reconstructed, report the missing fields before changing model,
+  filter, or ANN settings.
+- If evidence contains raw text, embeddings, prompts, personal data, or tenant-identifying data,
+  redact to ids, hashes, dimensions, norms, and aggregate metrics.
+- If the fix requires model replacement, re-embedding, index rebuild, production data dump, or live
+  vector DB access outside the command contract, report the manual boundary.
+- If configured verification fails, preserve the failing intent and output tail, then fix only the
+  localized retrieval contract or test expectation.
+
+<!-- mustflow-section: output-format -->
+## Output Format
+
+- Vector search integrity reviewed
+- Retrieval symptom, query contract, ingestion ledger, quality ledger, performance ledger, and
+  privacy boundary
+- Exact versus ANN, filter, metadata, namespace, tenant, id, delete, metric, normalization,
+  quantization, hybrid, reranker, shard, consistency, and latency findings
+- Fix applied or recommended
+- Evidence level: golden-set evidence, configured-test evidence, static review risk, manual-only,
+  missing, or not applicable
+- Command intents run
+- Skipped vector diagnostics and reasons
+- Remaining vector search risk

package/templates/default/locales/en/.mustflow/skills/version-freshness-check/SKILL.md

@@ -2,7 +2,7 @@
 mustflow_doc: skill.version-freshness-check
 locale: en
 canonical: true
-revision: 7
+revision: 8
 lifecycle: mustflow-owned
 authority: procedure
 name: version-freshness-check
@@ -34,7 +34,7 @@ Prevent agents from writing stale external version references from memory, while
 
 - Generated or edited files introduce explicit external version references, action refs, package ranges, runtime versions, framework majors, Docker image tags, toolchain versions, setup actions, scaffold commands, install commands, or migration examples.
 - CI workflows, release workflows, Dockerfiles, package metadata, lockfiles, runtime files, framework configuration, README examples, docs, tests, fixtures, or templates mention external versions such as GitHub Actions refs, Node, Bun, Deno, Python, Rust, Tauri, Astro, Next, SvelteKit, Electron, Docker images, package managers, SDKs, plugins, or generators.
-- Python wording mentions current/stable/support status, Python 3.14+ standard-library APIs, runtime flags, changed default behavior, security defaults, or examples that depend on `requires-python`.
+- Python wording mentions current/stable/support status, Python 3.14+ or 3.15+ syntax, standard-library APIs, runtime flags, changed default behavior, security defaults, or examples that depend on `requires-python`.
 - TypeScript wording mentions current/stable/RC/nightly status for TypeScript 6, TypeScript 7, `@typescript/typescript6`, `tsc6`, `typescript@rc`, `@typescript/native-preview`, `tsgo`, compiler API compatibility, or migration readiness.
 - Go wording mentions current/stable/support status, Go release numbers, `go.mod` language version behavior, `toolchain` behavior, standard-library APIs, `GOEXPERIMENT`, runtime defaults, container behavior, JSON experiments, or examples that depend on a specific Go version.
 - Rust wording mentions current/stable/support status, Rust release numbers, `rust-version`, edition behavior, `rust-toolchain`, Cargo resolver or workspace behavior, standard-library APIs, compiler lints, target behavior, release profiles, or examples that depend on a specific Rust version.
@@ -94,19 +94,20 @@ Prevent agents from writing stale external version references from memory, while
 10. For patch, security-minimum, and low-risk minor differences, update only when the declaration, examples, lockfile policy, and verification surface can stay aligned. Otherwise report the proposed change and leave the pinned value unchanged.
 11. For GitHub Actions and CI tools, review the action source, major tag policy, runtime support, cache behavior, permissions, and organization pinning rule. Do not assume a newer major is safe only because it exists.
 12. For framework and runtime majors such as Astro, Tauri, Electron, Next, SvelteKit, Node, Bun, Deno, Python, Rust, or Java, check migration notes, config schema, plugin and adapter compatibility, generated files, security model, deployment target, and rollback path before recommending a major change.
-13. For Python standard-library or runtime-behavior claims, refresh official Python documentation before writing durable wording. Check `requires-python`, CI/runtime matrices, and container images before using or recommending version-gated features such as Python 3.14+ `map(strict=True)`, `functools.Placeholder`, `heapq` max-heap helpers, import-timing flag behavior, or changed security defaults.
+13. For Python standard-library or runtime-behavior claims, refresh official Python documentation before writing durable wording. Check `requires-python`, CI/runtime matrices, and container images before using or recommending Python 3.14+ standard-library APIs or version-gated features such as template string literals, `annotationlib`, Python 3.14+ `map(strict=True)`, `functools.Placeholder`, `heapq` max-heap helpers, import-timing flag behavior, `finally` flow-control warnings, or changed security defaults.
 14. For Python examples that use newer standard-library APIs, either keep the example behind an explicit runtime floor or provide a supported fallback. Do not call a Python 3.14-only API a general Python best practice when the repository declares lower support.
-15. For TypeScript 6 and 7 claims, refresh official TypeScript sources before writing durable wording. Treat TS6 stable API track (`@typescript/typescript6`, `tsc6`), TS7 RC compiler track (`typescript@rc`, `tsc`), TS7 nightly track (`@typescript/native-preview`, `tsgo`), and future TS7 stable `typescript` behavior as distinct tracks. Do not call RC or nightly output "latest stable TypeScript" just because it is newer.
-16. For TypeScript examples, make the selected track explicit: TS6 API compatibility, TS7 RC compiler verification, TS7 nightly comparison, editor preview, or repository adoption. If the project has compiler API consumers, transformers, framework wrappers, or declaration snapshots, classify the reference as migration-sensitive and keep API consumers on the TS6 API track until support is explicit.
-17. For Go release, toolchain, standard-library, runtime, or experiment claims, refresh official Go release notes or package documentation before writing durable wording. Check the repository's `go` directive, `toolchain` directive, CI/runtime matrix, and container target before using or recommending version-gated features such as expression operands to `new`, `errors.AsType`, `sync.WaitGroup.Go`, `testing/synctest`, `testing.B.Loop`, `os.Root`, `os.OpenInRoot`, `omitzero`, `go.mod` `tool`, `ReverseProxy.Rewrite`, container-aware `GOMAXPROCS`, goroutine leak profiles, `encoding/json/v2`, or `GOEXPERIMENT` APIs.
-18. For Go examples that use newer standard-library APIs or runtime defaults, either keep the example behind an explicit Go version floor or provide a supported fallback. Do not call an experimental `GOEXPERIMENT` feature or a newer `go` directive behavior a general Go best practice when the repository declares lower support.
-19. For Rust release, toolchain, standard-library, Cargo, edition, lint, target, or MSRV claims, refresh official Rust release notes, standard-library docs, the Cargo Book, Rust Reference, or rustc book before writing durable wording. Check `rust-version`, edition, `rust-toolchain.toml`, CI toolchain matrix, target triples, docs.rs metadata, and crate publish policy before using or recommending version-gated features such as let chains, match `if let` guards, `cfg_select!`, `assert_matches!`, `core::range`, `Vec::push_mut`, `HashMap::get_disjoint_mut`, `Option::take_if`, `LazyLock`, `OnceLock`, `workspace.lints`, `resolver = "2"`, Rust 2024 `unsafe_op_in_unsafe_fn`, or release-profile defaults.
-20. For Rust examples that use newer language or standard-library APIs, either keep the example behind an explicit Rust version floor or provide a supported fallback. Use an API-by-API MSRV ledger for features such as `cfg_select!`, match `if let` guards, `core::range` items, `Vec::push_mut`, `assert_matches!`, and `debug_assert_matches!`; do not collapse them into a single "latest Rust" bucket, and do not treat nightly-only behavior or target-specific linker behavior as stable without explicit evidence.
-21. For HTTP standards, browser APIs, proxy defaults, CDN defaults, and transport support claims, prefer official RFCs, standards bodies, MDN or browser vendor docs, and vendor-owned proxy/CDN documentation. Keep WebTransport, compression dictionary transport, zstd content coding, SSE/EventSource, HTTP/2, HTTP/3, QUIC, and proxy-buffering claims track-specific and dated when support is changing.
-22. For HTTP delivery examples that depend on newer or unevenly supported behavior, require feature detection, fallback behavior, or explicit deployment constraints. Do not present WebTransport, dictionary compression, or zstd negotiation as a universal default when the project still needs browsers, proxies, CDNs, or networks that may not support it.
-23. For Docker images, decide whether the project prefers semver tags, distro tags, LTS tags, date tags, or digests. Do not replace a digest or pinned base image with a floating tag unless the repository policy says so.
-24. Synchronize every accepted version decision across package metadata, lockfiles when intentionally updated, CI, Docker, runtime files, docs, examples, templates, tests, and release notes.
-25. Run the narrowest configured verification that covers the changed versioned surface. Use broader verification for major, migration-required, runtime, framework, generated-output, package-publish, Docker, CI, TypeScript compiler-track, Go toolchain or runtime support, Rust toolchain or MSRV support, HTTP delivery compatibility, or security-sensitive changes.
+15. For Python 3.15+ claims, keep beta, release-candidate, and stable tracks separate. Refresh official docs before using explicit lazy imports, built-in `frozendict`, built-in `sentinel`, unpacking comprehensions, typed `TypedDict` extra items, startup configuration files, or changed encoding behavior in durable examples.
+16. For TypeScript 6 and 7 claims, refresh official TypeScript sources before writing durable wording. Treat TS6 stable API track (`@typescript/typescript6`, `tsc6`), TS7 RC compiler track (`typescript@rc`, `tsc`), TS7 nightly track (`@typescript/native-preview`, `tsgo`), and future TS7 stable `typescript` behavior as distinct tracks. Do not call RC or nightly output "latest stable TypeScript" just because it is newer.
+17. For TypeScript examples, make the selected track explicit: TS6 API compatibility, TS7 RC compiler verification, TS7 nightly comparison, editor preview, or repository adoption. If the project has compiler API consumers, transformers, framework wrappers, or declaration snapshots, classify the reference as migration-sensitive and keep API consumers on the TS6 API track until support is explicit. Check exact support before relying on `rootDir` defaults, ambient `types` defaults, import attributes, subpath imports, `import defer`, `using`, or `await using`.
+18. For Go release, toolchain, standard-library, runtime, or experiment claims, refresh official Go release notes or package documentation before writing durable wording. Check the repository's `go` directive, `toolchain` directive, CI/runtime matrix, and container target before using or recommending version-gated features such as expression operands to `new`, range-over-function iterators, generic type aliases, reflect iterator methods, `errors.AsType`, `sync.WaitGroup.Go`, `testing/synctest`, `testing.B.Loop`, `T.ArtifactDir`, `B.ArtifactDir`, `F.ArtifactDir`, `testing/cryptotest.SetGlobalRandom`, `os.Root`, `os.OpenInRoot`, `omitzero`, `go.mod` `tool`, `ReverseProxy.Rewrite`, container-aware `GOMAXPROCS`, goroutine leak profiles, `encoding/json/v2`, or `GOEXPERIMENT` APIs.
+19. For Go examples that use newer standard-library APIs or runtime defaults, either keep the example behind an explicit Go version floor or provide a supported fallback. Do not call an experimental `GOEXPERIMENT` feature or a newer `go` directive behavior a general Go best practice when the repository declares lower support.
+20. For Rust release, toolchain, standard-library, Cargo, edition, lint, target, or MSRV claims, refresh official Rust release notes, standard-library docs, the Cargo Book, Rust Reference, or rustc book before writing durable wording. Check `rust-version`, edition, `rust-toolchain.toml`, CI toolchain matrix, target triples, docs.rs metadata, and crate publish policy before using or recommending version-gated features such as let chains, match `if let` guards, `cfg_select!`, `assert_matches!`, `core::range`, `Vec::push_mut`, `HashMap::get_disjoint_mut`, `Option::take_if`, `LazyLock`, `OnceLock`, `workspace.lints`, `resolver = "2"`, Rust 2024 `unsafe extern`, unsafe attributes, Rust 2024 `unsafe_op_in_unsafe_fn`, temporary drop-scope changes, macro fragment behavior, or release-profile defaults.
+21. For Rust examples that use newer language or standard-library APIs, either keep the example behind an explicit Rust version floor or provide a supported fallback. Use an API-by-API MSRV ledger for features such as `cfg_select!`, match `if let` guards, `core::range` items, `Vec::push_mut`, `assert_matches!`, and `debug_assert_matches!`; do not collapse them into a single "latest Rust" bucket, and do not treat nightly-only behavior or target-specific linker behavior as stable without explicit evidence.
+22. For HTTP standards, browser APIs, proxy defaults, CDN defaults, and transport support claims, prefer official RFCs, standards bodies, MDN or browser vendor docs, and vendor-owned proxy/CDN documentation. Keep WebTransport, compression dictionary transport, zstd content coding, SSE/EventSource, HTTP/2, HTTP/3, QUIC, and proxy-buffering claims track-specific and dated when support is changing.
+23. For HTTP delivery examples that depend on newer or unevenly supported behavior, require feature detection, fallback behavior, or explicit deployment constraints. Do not present WebTransport, dictionary compression, or zstd negotiation as a universal default when the project still needs browsers, proxies, CDNs, or networks that may not support it.
+24. For Docker images, decide whether the project prefers semver tags, distro tags, LTS tags, date tags, or digests. Do not replace a digest or pinned base image with a floating tag unless the repository policy says so.
+25. Synchronize every accepted version decision across package metadata, lockfiles when intentionally updated, CI, Docker, runtime files, docs, examples, templates, tests, and release notes.
+26. Run the narrowest configured verification that covers the changed versioned surface. Use broader verification for major, migration-required, runtime, framework, generated-output, package-publish, Docker, CI, TypeScript compiler-track, Go toolchain or runtime support, Rust toolchain or MSRV support, HTTP delivery compatibility, or security-sensitive changes.
 
 <!-- mustflow-section: postconditions -->
 ## Postconditions
@@ -116,6 +117,7 @@ Prevent agents from writing stale external version references from memory, while
 - Repository-pinned versions are preserved unless the task, policy, and compatibility classification support changing them.
 - Major or migration-required changes are either explicitly approved, deferred with a recommendation, or left unchanged with the risk reported.
 - Python standard-library examples and runtime-default claims match the declared Python support matrix or name the required runtime floor.
+- Python template strings, annotation inspection, explicit lazy imports, immutable mappings, sentinels, and advanced `TypedDict` shape claims are either official-source checked or omitted.
 - TypeScript 6 stable API, TypeScript 7 RC compiler, TypeScript 7 nightly, and future stable TypeScript tracks are not collapsed into one generic "latest TypeScript" claim.
 - Go release, `go.mod` language version, standard-library API, runtime-default, and `GOEXPERIMENT` claims match the declared Go support matrix or name the required runtime floor.
 - Rust release, `rust-version`, edition, standard-library API, Cargo resolver, lint-default, target, and nightly/stable claims match the declared Rust support matrix or name the required API-specific runtime floor.

package/templates/default/manifest.toml

@@ -1,6 +1,6 @@
 id = "default"
 name = "default"
-version = "2.85.4"
+version = "2.99.0"
 description = "Minimal workflow for LLM agents to read, edit, and verify their work in a repository."
 common_root = "common"
 locales_root = "locales"
@@ -38,11 +38,16 @@ creates = [
   ".mustflow/skills/desktop-memory-footprint-review/SKILL.md",
   ".mustflow/skills/hot-path-performance-review/SKILL.md",
   ".mustflow/skills/api-request-performance-review/SKILL.md",
+  ".mustflow/skills/api-failure-triage/SKILL.md",
+  ".mustflow/skills/ci-pipeline-triage/SKILL.md",
+  ".mustflow/skills/auth-flow-triage/SKILL.md",
+  ".mustflow/skills/docker-runtime-triage/SKILL.md",
   ".mustflow/skills/web-render-performance-review/SKILL.md",
   ".mustflow/skills/core-web-vitals-field-review/SKILL.md",
   ".mustflow/skills/image-delivery-performance-review/SKILL.md",
   ".mustflow/skills/client-bundle-pruning-review/SKILL.md",
   ".mustflow/skills/frame-render-performance-review/SKILL.md",
+  ".mustflow/skills/motion-system-contract-review/SKILL.md",
   ".mustflow/skills/app-startup-performance-review/SKILL.md",
   ".mustflow/skills/desktop-background-process-stability-review/SKILL.md",
   ".mustflow/skills/desktop-auto-update-safety-review/SKILL.md",
@@ -73,6 +78,7 @@ creates = [
   ".mustflow/skills/heuristic-candidate-selection/SKILL.md",
   ".mustflow/skills/clarifying-question-gate/SKILL.md",
   ".mustflow/skills/completion-evidence-gate/SKILL.md",
+  ".mustflow/skills/next-action-menu/SKILL.md",
   ".mustflow/skills/evidence-stall-breaker/SKILL.md",
   ".mustflow/skills/command-intent-mapping-gate/SKILL.md",
   ".mustflow/skills/astro-code-change/SKILL.md",
@@ -116,6 +122,9 @@ creates = [
   ".mustflow/skills/database-lock-contention-review/SKILL.md",
   ".mustflow/skills/sqlite-code-change/SKILL.md",
   ".mustflow/skills/postgresql-code-change/SKILL.md",
+  ".mustflow/skills/search-index-integrity-review/SKILL.md",
+  ".mustflow/skills/vector-search-integrity-review/SKILL.md",
+  ".mustflow/skills/rag-pipeline-triage/SKILL.md",
   ".mustflow/skills/dependency-injection/SKILL.md",
   ".mustflow/skills/dependency-reality-check/SKILL.md",
   ".mustflow/skills/dependency-upgrade-review/SKILL.md",
@@ -233,11 +242,16 @@ minimal = [
   "desktop-memory-footprint-review",
   "hot-path-performance-review",
   "api-request-performance-review",
+  "api-failure-triage",
+  "ci-pipeline-triage",
+  "auth-flow-triage",
+  "docker-runtime-triage",
   "web-render-performance-review",
   "core-web-vitals-field-review",
   "image-delivery-performance-review",
   "client-bundle-pruning-review",
   "frame-render-performance-review",
+  "motion-system-contract-review",
   "app-startup-performance-review",
   "desktop-background-process-stability-review",
   "desktop-auto-update-safety-review",
@@ -268,6 +282,7 @@ minimal = [
   "heuristic-candidate-selection",
   "clarifying-question-gate",
   "completion-evidence-gate",
+  "next-action-menu",
   "evidence-stall-breaker",
   "astro-code-change",
   "bun-code-change",
@@ -305,6 +320,9 @@ minimal = [
   "database-lock-contention-review",
   "sqlite-code-change",
   "postgresql-code-change",
+  "search-index-integrity-review",
+  "vector-search-integrity-review",
+  "rag-pipeline-triage",
   "dependency-reality-check",
   "dependency-upgrade-review",
   "version-freshness-check",
@@ -367,11 +385,16 @@ patterns = [
   "desktop-memory-footprint-review",
   "hot-path-performance-review",
   "api-request-performance-review",
+  "api-failure-triage",
+  "ci-pipeline-triage",
+  "auth-flow-triage",
+  "docker-runtime-triage",
   "web-render-performance-review",
   "core-web-vitals-field-review",
   "image-delivery-performance-review",
   "client-bundle-pruning-review",
   "frame-render-performance-review",
+  "motion-system-contract-review",
   "app-startup-performance-review",
   "desktop-background-process-stability-review",
   "desktop-auto-update-safety-review",
@@ -402,6 +425,7 @@ patterns = [
   "heuristic-candidate-selection",
   "clarifying-question-gate",
   "completion-evidence-gate",
+  "next-action-menu",
   "evidence-stall-breaker",
   "astro-code-change",
   "bun-code-change",
@@ -441,6 +465,9 @@ patterns = [
   "database-lock-contention-review",
   "sqlite-code-change",
   "postgresql-code-change",
+  "search-index-integrity-review",
+  "vector-search-integrity-review",
+  "rag-pipeline-triage",
   "dependency-injection",
   "dependency-reality-check",
   "dependency-upgrade-review",
@@ -512,11 +539,16 @@ oss = [
   "desktop-memory-footprint-review",
   "hot-path-performance-review",
   "api-request-performance-review",
+  "api-failure-triage",
+  "ci-pipeline-triage",
+  "auth-flow-triage",
+  "docker-runtime-triage",
   "web-render-performance-review",
   "core-web-vitals-field-review",
   "image-delivery-performance-review",
   "client-bundle-pruning-review",
   "frame-render-performance-review",
+  "motion-system-contract-review",
   "app-startup-performance-review",
   "desktop-background-process-stability-review",
   "desktop-auto-update-safety-review",
@@ -547,6 +579,7 @@ oss = [
   "heuristic-candidate-selection",
   "clarifying-question-gate",
   "completion-evidence-gate",
+  "next-action-menu",
   "evidence-stall-breaker",
   "astro-code-change",
   "bun-code-change",
@@ -588,6 +621,9 @@ oss = [
   "database-lock-contention-review",
   "sqlite-code-change",
   "postgresql-code-change",
+  "search-index-integrity-review",
+  "vector-search-integrity-review",
+  "rag-pipeline-triage",
   "dependency-injection",
   "dependency-reality-check",
   "dependency-upgrade-review",
@@ -673,11 +709,16 @@ team = [
   "desktop-memory-footprint-review",
   "hot-path-performance-review",
   "api-request-performance-review",
+  "api-failure-triage",
+  "ci-pipeline-triage",
+  "auth-flow-triage",
+  "docker-runtime-triage",
   "web-render-performance-review",
   "core-web-vitals-field-review",
   "image-delivery-performance-review",
   "client-bundle-pruning-review",
   "frame-render-performance-review",
+  "motion-system-contract-review",
   "app-startup-performance-review",
   "desktop-background-process-stability-review",
   "desktop-auto-update-safety-review",
@@ -708,6 +749,7 @@ team = [
   "heuristic-candidate-selection",
   "clarifying-question-gate",
   "completion-evidence-gate",
+  "next-action-menu",
   "evidence-stall-breaker",
   "astro-code-change",
   "bun-code-change",
@@ -748,6 +790,9 @@ team = [
   "database-lock-contention-review",
   "sqlite-code-change",
   "postgresql-code-change",
+  "search-index-integrity-review",
+  "vector-search-integrity-review",
+  "rag-pipeline-triage",
   "dependency-injection",
   "dependency-reality-check",
   "dependency-upgrade-review",
@@ -819,11 +864,16 @@ product = [
   "desktop-memory-footprint-review",
   "hot-path-performance-review",
   "api-request-performance-review",
+  "api-failure-triage",
+  "ci-pipeline-triage",
+  "auth-flow-triage",
+  "docker-runtime-triage",
   "web-render-performance-review",
   "core-web-vitals-field-review",
   "image-delivery-performance-review",
   "client-bundle-pruning-review",
   "frame-render-performance-review",
+  "motion-system-contract-review",
   "app-startup-performance-review",
   "desktop-background-process-stability-review",
   "desktop-auto-update-safety-review",
@@ -854,6 +904,7 @@ product = [
   "heuristic-candidate-selection",
   "clarifying-question-gate",
   "completion-evidence-gate",
+  "next-action-menu",
   "evidence-stall-breaker",
   "astro-code-change",
   "bun-code-change",
@@ -893,6 +944,9 @@ product = [
   "database-lock-contention-review",
   "sqlite-code-change",
   "postgresql-code-change",
+  "search-index-integrity-review",
+  "vector-search-integrity-review",
+  "rag-pipeline-triage",
   "dependency-injection",
   "dependency-reality-check",
   "dependency-upgrade-review",
@@ -971,11 +1025,16 @@ library = [
   "desktop-memory-footprint-review",
   "hot-path-performance-review",
   "api-request-performance-review",
+  "api-failure-triage",
+  "ci-pipeline-triage",
+  "auth-flow-triage",
+  "docker-runtime-triage",
   "web-render-performance-review",
   "core-web-vitals-field-review",
   "image-delivery-performance-review",
   "client-bundle-pruning-review",
   "frame-render-performance-review",
+  "motion-system-contract-review",
   "app-startup-performance-review",
   "desktop-background-process-stability-review",
   "desktop-auto-update-safety-review",
@@ -1006,6 +1065,7 @@ library = [
   "heuristic-candidate-selection",
   "clarifying-question-gate",
   "completion-evidence-gate",
+  "next-action-menu",
   "evidence-stall-breaker",
   "astro-code-change",
   "bun-code-change",
@@ -1047,6 +1107,9 @@ library = [
   "database-lock-contention-review",
   "sqlite-code-change",
   "postgresql-code-change",
+  "search-index-integrity-review",
+  "vector-search-integrity-review",
+  "rag-pipeline-triage",
   "dependency-injection",
   "dependency-reality-check",
   "dependency-upgrade-review",