natureco-cli 5.18.3 → 5.19.0

package/skills/azure-resource-visualizer/SKILL.md

@@ -0,0 +1,183 @@
+---
+name: azure-resource-visualizer
+description: "Analyze Azure resource groups and generate detailed Mermaid architecture diagrams showing the relationships between individual resources. WHEN: create architecture diagram, visualize Azure resources, show resource relationships, generate Mermaid diagram, analyze resource group, diagram my resources, architecture visualization, resource topology, map Azure infrastructure."
+license: MIT
+metadata:
+  author: Microsoft
+  version: "1.1.2"
+---
+
+# Azure Resource Visualizer - Architecture Diagram Generator
+
+A user may ask for help understanding how individual resources fit together, or to create a diagram showing their relationships. Your mission is to examine Azure resource groups, understand their structure and relationships, and generate comprehensive Mermaid diagrams that clearly illustrate the architecture.
+
+## Core Responsibilities
+
+1. **Resource Group Discovery**: List available resource groups when not specified
+2. **Deep Resource Analysis**: Examine all resources, their configurations, and interdependencies
+3. **Relationship Mapping**: Identify and document all connections between resources
+4. **Diagram Generation**: Create detailed, accurate Mermaid diagrams
+5. **Documentation Creation**: Produce clear markdown files with embedded diagrams
+
+## Workflow Process
+
+### Step 1: Resource Group Selection
+
+If the user hasn't specified a resource group:
+
+1. Use your tools to query available resource groups. If you do not have a tool for this, use `az`.
+2. Present a numbered list of resource groups with their locations
+3. Ask the user to select one by number or name
+4. Wait for user response before proceeding
+
+If a resource group is specified, validate it exists and proceed.
+
+### Step 2: Resource Discovery & Analysis
+
+For bulk resource discovery across subscriptions, use Azure Resource Graph queries. See [Azure Resource Graph Queries](references/azure-resource-graph.md) for cross-subscription inventory and relationship discovery patterns.
+
+Once you have the resource group:
+
+1. **Query all resources** in the resource group using Azure MCP tools or `az`.
+2. **Analyze each resource** type and capture:
+   - Resource name and type
+   - SKU/tier information
+   - Location/region
+   - Key configuration properties
+   - Network settings (VNets, subnets, private endpoints)
+   - Identity and access (Managed Identity, RBAC)
+   - Dependencies and connections
+
+3. **Map relationships** by identifying:
+   - **Network connections**: VNet peering, subnet assignments, NSG rules, private endpoints
+   - **Data flow**: Apps → Databases, Functions → Storage, API Management → Backends
+   - **Identity**: Managed identities connecting to resources
+   - **Configuration**: App Settings pointing to Key Vaults, connection strings
+   - **Dependencies**: Parent-child relationships, required resources
+
+> **Important**: You must only use placeholder names to represent secret values, such as keys, connection strings, Key Vault secrets, etc. Use meaningful placeholder names to represent each secret in the diagram. Never put secret values in the resource diagram.
+
+### Step 3: Diagram Construction
+
+Create a **detailed Mermaid diagram** using the `graph TB` (top-to-bottom) or `graph LR` (left-to-right) format.
+
+See [example-diagram.md](./assets/example-diagram.md) for a complete sample architecture diagram.
+
+**Key Diagram Requirements:**
+
+- **Group by layer or purpose**: Network, Compute, Data, Security, Monitoring
+- **Include details**: SKUs, tiers, important settings in node labels (use `<br/>` for line breaks)
+- **Label all connections**: Describe what flows between resources (data, identity, network)
+- **Use meaningful node IDs**: Abbreviations that make sense (APP, FUNC, SQL, KV)
+- **Visual hierarchy**: Subgraphs for logical grouping
+- **Connection types**:
+  - `-->` for data flow or dependencies
+  - `-.->` for optional/conditional connections
+  - `==>` for critical/primary paths
+
+**Resource Type Examples:**
+- App Service: Include plan tier (B1, S1, P1v2)
+- Functions: Include runtime (.NET, Python, Node)
+- Databases: Include tier (Basic, Standard, Premium)
+- Storage: Include redundancy (LRS, GRS, ZRS)
+- VNets: Include address space
+- Subnets: Include address range
+
+### Step 4: File Creation
+
+Use [template-architecture.md](./assets/template-architecture.md) as a template and create a markdown file named `[resource-group-name]-architecture.md` with:
+
+1. **Header**: Resource group name, subscription, region
+2. **Summary**: Brief overview of the architecture (2-3 paragraphs)
+3. **Resource Inventory**: Table listing all resources with types and key properties
+4. **Architecture Diagram**: The complete Mermaid diagram
+5. **Relationship Details**: Explanation of key connections and data flows
+6. **Notes**: Any important observations, potential issues, or recommendations
+
+## Operating Guidelines
+
+### Quality Standards
+
+- **Accuracy**: Verify all resource details before including in diagram
+- **Completeness**: Don't omit resources; include everything in the resource group
+- **Clarity**: Use clear, descriptive labels and logical grouping
+- **Detail Level**: Include configuration details that matter for architecture understanding
+- **Relationships**: Show ALL significant connections, not just obvious ones
+
+### Tool Usage Patterns
+
+1. **Azure MCP Search**: 
+   - Use `intent="list resource groups"` to discover resource groups
+   - Use `intent="list resources in group"` with group name to get all resources
+   - Use `intent="get resource details"` for individual resource analysis
+   - Use `command` parameter when you need specific Azure operations
+
+2. **File Creation**:
+   - Always create in workspace root or a `docs/` folder if it exists
+   - Use clear, descriptive filenames: `[rg-name]-architecture.md`
+   - Ensure Mermaid syntax is valid (test syntax mentally before output)
+
+3. **Terminal (when needed)**:
+   - Use Azure CLI for complex queries not available via MCP
+   - Example: `az resource list --resource-group <name> --output json`
+   - Example: `az network vnet show --resource-group <name> --name <vnet-name>`
+
+### Constraints & Boundaries
+
+**Always Do:**
+- ✅ List resource groups if not specified
+- ✅ Wait for user selection before proceeding
+- ✅ Analyze ALL resources in the group
+- ✅ Create detailed, accurate diagrams
+- ✅ Include configuration details in node labels
+- ✅ Group resources logically with subgraphs
+- ✅ Label all connections descriptively
+- ✅ Create a complete markdown file with diagram
+
+**Never Do:**
+- ❌ Skip resources because they seem unimportant
+- ❌ Make assumptions about resource relationships without verification
+- ❌ Create incomplete or placeholder diagrams
+- ❌ Omit configuration details that affect architecture
+- ❌ Proceed without confirming resource group selection
+- ❌ Generate invalid Mermaid syntax
+- ❌ Modify or delete Azure resources (read-only analysis)
+
+### Edge Cases & Error Handling
+
+- **No resources found**: Inform user and verify resource group name
+- **Permission issues**: Explain what's missing and suggest checking RBAC
+- **Complex architectures (50+ resources)**: Consider creating multiple diagrams by layer
+- **Cross-resource-group dependencies**: Note external dependencies in diagram notes
+- **Resources without clear relationships**: Group in "Other Resources" section
+
+## Output Format Specifications
+
+### Mermaid Diagram Syntax
+- Use `graph TB` (top-to-bottom) for vertical layouts
+- Use `graph LR` (left-to-right) for horizontal layouts (better for wide architectures)
+- Subgraph syntax: `subgraph "Descriptive Name"`
+- Node syntax: `ID["Display Name<br/>Details"]`
+- Connection syntax: `SOURCE -->|"Label"| TARGET`
+
+### Markdown Structure
+- Use H1 for main title
+- Use H2 for major sections
+- Use H3 for subsections
+- Use tables for resource inventories
+- Use bullet lists for notes and recommendations
+- Use code blocks with `mermaid` language tag for diagrams
+
+## Success Criteria
+
+A successful analysis includes:
+- ✅ Valid resource group identified
+- ✅ All resources discovered and analyzed
+- ✅ All significant relationships mapped
+- ✅ Detailed Mermaid diagram with proper grouping
+- ✅ Complete markdown file created
+- ✅ Clear, actionable documentation
+- ✅ Valid Mermaid syntax that renders correctly
+- ✅ Professional, architect-level output
+
+Your goal is to provide clarity and insight into Azure architectures, making complex resource relationships easy to understand through excellent visualization.

package/skills/azure-storage/SKILL.md

@@ -0,0 +1,100 @@
+---
+name: azure-storage
+description: "Azure Storage Services including Blob Storage, File Shares, Queue Storage, Table Storage, and Data Lake. Answers questions about storage access tiers (hot, cool, cold, archive), when to use each tier, and tier comparison. Provides object storage, SMB file shares, async messaging, NoSQL key-value, and big data analytics. Includes lifecycle management. USE FOR: blob storage, file shares, queue storage, table storage, data lake, upload files, download blobs, storage accounts, access tiers, storage tiers, hot cool cold archive, storage tier comparison, when to use storage tiers, lifecycle management, Azure Storage concepts. DO NOT USE FOR: SQL databases, Cosmos DB (use azure-prepare), messaging with Event Hubs or Service Bus (use azure-messaging)."
+license: MIT
+metadata:
+  author: Microsoft
+  version: "1.1.2"
+---
+
+# Azure Storage Services
+
+## Services
+
+| Service | Use When | MCP Tools | CLI |
+|---------|----------|-----------|-----|
+| Blob Storage | Objects, files, backups, static content | `azure__storage` | `az storage blob` |
+| File Shares | SMB file shares, lift-and-shift | - | `az storage file` |
+| Queue Storage | Async messaging, task queues | - | `az storage queue` |
+| Table Storage | NoSQL key-value (consider Cosmos DB) | - | `az storage table` |
+| Data Lake | Big data analytics, hierarchical namespace | - | `az storage fs` |
+
+## MCP Server (Preferred)
+
+When Azure MCP is enabled:
+
+- `azure__storage` with command `storage_account_list` - List storage accounts
+- `azure__storage` with command `storage_container_list` - List containers in account
+- `azure__storage` with command `storage_blob_list` - List blobs in container
+- `azure__storage` with command `storage_blob_get` - Download blob content
+- `azure__storage` with command `storage_blob_put` - Upload blob content
+
+**If Azure MCP is not enabled:** Run `/azure:setup` or enable via `/mcp`.
+
+## CLI Fallback
+
+```bash
+# List storage accounts
+az storage account list --output table
+
+# List containers
+az storage container list --account-name ACCOUNT --output table
+
+# List blobs
+az storage blob list --account-name ACCOUNT --container-name CONTAINER --output table
+
+# Download blob
+az storage blob download --account-name ACCOUNT --container-name CONTAINER --name BLOB --file LOCAL_PATH
+
+# Upload blob
+az storage blob upload --account-name ACCOUNT --container-name CONTAINER --name BLOB --file LOCAL_PATH
+```
+
+## Storage Account Tiers
+
+| Tier | Use Case | Performance |
+|------|----------|-------------|
+| Standard | General purpose, backup | Milliseconds |
+| Premium | Databases, high IOPS | Sub-millisecond |
+
+## Blob Access Tiers
+
+| Tier | Access Frequency | Cost |
+|------|-----------------|------|
+| Hot | Frequent | Higher storage, lower access |
+| Cool | Infrequent (30+ days) | Lower storage, higher access |
+| Cold | Rare (90+ days) | Lower still |
+| Archive | Rarely (180+ days) | Lowest storage, rehydration required |
+
+## Redundancy Options
+
+| Type | Durability | Use Case |
+|------|------------|----------|
+| LRS | 11 nines | Dev/test, recreatable data |
+| ZRS | 12 nines | Regional high availability |
+| GRS | 16 nines | Disaster recovery |
+| GZRS | 16 nines | Best durability |
+
+## Service Details
+
+For deep documentation on specific services:
+
+- Blob storage patterns and lifecycle -> [Blob Storage documentation](https://learn.microsoft.com/azure/storage/blobs/storage-blobs-overview)
+- File shares and Azure File Sync -> [Azure Files documentation](https://learn.microsoft.com/azure/storage/files/storage-files-introduction)
+- Queue patterns and poison handling -> [Queue Storage documentation](https://learn.microsoft.com/azure/storage/queues/storage-queues-introduction)
+
+## SDK Quick References
+
+For building applications with Azure Storage SDKs, see the condensed guides:
+
+- **Blob Storage**: [Python](references/sdk/azure-storage-blob-py.md) | [TypeScript](references/sdk/azure-storage-blob-ts.md) | [Java](references/sdk/azure-storage-blob-java.md) | [Rust](references/sdk/azure-storage-blob-rust.md)
+- **Queue Storage**: [Python](references/sdk/azure-storage-queue-py.md) | [TypeScript](references/sdk/azure-storage-queue-ts.md)
+- **File Shares**: [Python](references/sdk/azure-storage-file-share-py.md) | [TypeScript](references/sdk/azure-storage-file-share-ts.md)
+- **Data Lake**: [Python](references/sdk/azure-storage-file-datalake-py.md)
+- **Tables**: [Python](references/sdk/azure-data-tables-py.md) | [Java](references/sdk/azure-data-tables-java.md)
+
+For full package listing across all languages, see [SDK Usage Guide](references/sdk-usage.md).
+
+## Azure SDKs
+
+For building applications that interact with Azure Storage programmatically, Azure provides SDK packages in multiple languages (.NET, Java, JavaScript, Python, Go, Rust). See [SDK Usage Guide](references/sdk-usage.md) for package names, installation commands, and quick start examples.

package/skills/azure-upgrade/SKILL.md

@@ -0,0 +1,91 @@
+---
+name: azure-upgrade
+description: "Assess and upgrade Azure workloads between plans, tiers, or SKUs, or modernize Azure SDK dependencies in source code. WHEN: upgrade Consumption to Flex Consumption, upgrade Azure Functions plan, change hosting plan, function app SKU, migrate App Service to Container Apps, modernize legacy Azure Java SDKs (com.microsoft.azure to com.azure), migrate Azure Cache for Redis (ACR/ACRE) to Azure Managed Redis (AMR)."
+license: MIT
+compatibility: python3.10+
+metadata:
+  author: Microsoft
+  version: "1.1.4"
+---
+
+# Azure Upgrade
+
+> This skill handles **assessment and automated upgrades** of existing Azure workloads from one Azure service, hosting plan, or SKU to another — all within Azure. This includes plan/tier upgrades (e.g. Consumption → Flex Consumption), cross-service migrations (e.g. App Service → Container Apps), and SKU changes. It also covers **Azure SDK for Java source-code modernization** (e.g. legacy Java `com.microsoft.azure.*` → modern `com.azure.*`). This is NOT for cross-cloud migration — use `azure-cloud-migrate` for that.
+
+## Triggers
+
+| User Intent | Example Prompts |
+|-------------|-----------------|
+| Upgrade Azure Functions plan | "Upgrade my function app from Consumption to Flex Consumption" |
+| Change hosting tier | "Move my function app to a better plan" |
+| Assess upgrade readiness | "Is my function app ready for Flex Consumption?" |
+| Automate plan migration | "Automate the steps to upgrade my Functions plan" |
+| Modernize legacy Azure Java SDK | "Migrate legacy Azure SDKs for Java", "Upgrade legacy Azure Java SDK", "Migrate my Java project from com.microsoft.azure to com.azure" |
+| Migrate Azure Cache for Redis (ACR/OSS) to Azure Managed Redis (AMR) | "Migrate my Redis cache to AMR", "ACR to AMR", "OSS to AMR", "Upgrade my Premium P2 cache to Managed Redis", "Pick an AMR SKU", "Convert my Redis IaC template to AMR" |
+| Migrate Azure Cache for Redis Enterprise (ACRE) to Azure Managed Redis (AMR) | "Migrate my Enterprise_E10 cache to AMR", "ACRE to AMR", "Update my ACRE IaC template for AMR", "Migrate EnterpriseFlash to AMR", "Migrate my geo-replicated Enterprise Redis" |
+
+## Rules
+
+1. Follow phases sequentially — do not skip
+2. Generate an assessment before any upgrade operations
+3. Load the scenario reference and follow its rules
+4. Use `mcp_azure_mcp_get_azure_bestpractices` and `mcp_azure_mcp_documentation` MCP tools
+5. Destructive actions require `ask_user` — [global-rules](references/global-rules.md)
+6. Always confirm the target plan/SKU with the user before proceeding
+7. Never delete or stop the original app without explicit user confirmation
+8. All automation scripts must be idempotent and resumable
+
+## Upgrade Scenarios
+
+| Source | Target | Reference |
+|--------|--------|-----------|
+| Azure Functions Consumption Plan | Azure Functions Flex Consumption Plan | [consumption-to-flex.md](references/services/functions/consumption-to-flex.md) |
+| Legacy Azure Java SDK (`com.microsoft.azure.*`) | Modern Azure Java SDK (`com.azure.*`) | [languages/java/README.md](references/languages/java/README.md) |
+| Azure Cache for Redis (ACR/OSS) Basic/Standard/Premium | Azure Managed Redis (AMR) | [services/redis/redis-to-amr.md](references/services/redis/redis-to-amr.md) |
+| Azure Cache for Redis Enterprise (ACRE) / Enterprise Flash | Azure Managed Redis (AMR) | [services/redis/redis-to-amr.md](references/services/redis/redis-to-amr.md) |
+
+> SDK upgrade scenarios (e.g. Java legacy → modern) run a **source-code modernization flow** that is distinct from Azure service/plan/SKU upgrades: follow the scenario reference, **not** the Steps below.
+
+> No matching scenario? Use `mcp_azure_mcp_documentation` and `mcp_azure_mcp_get_azure_bestpractices` tools to research the upgrade path.
+
+## MCP Tools
+
+| Tool | Purpose |
+|------|---------|
+| `mcp_azure_mcp_get_azure_bestpractices` | Get Azure best practices for the target service |
+| `mcp_azure_mcp_documentation` | Look up Azure documentation for upgrade scenarios |
+| `mcp_azure_mcp_appservice` | Query App Service and Functions plan details |
+| `mcp_azure_mcp_applicationinsights` | Verify monitoring configuration |
+
+## Steps
+
+1. **Identify** — Determine the source and target Azure plans/SKUs. Ask user to confirm.
+2. **Assess** — Analyze existing app for upgrade readiness → load scenario reference (e.g., [consumption-to-flex.md](references/services/functions/consumption-to-flex.md))
+3. **Pre-migrate** — Collect settings, identities, configs from the existing app
+4. **Upgrade** — Execute the automated upgrade steps (create new resources, migrate settings, deploy code)
+5. **Validate** — Hit the function app default URL to confirm the app is reachable, then verify endpoints and monitoring
+6. **Ask User** — "Upgrade complete. Would you like to verify performance, clean up the old app, or update your IaC?"
+7. **Hand off** to `azure-validate` for deep validation or `azure-deploy` for CI/CD setup
+
+Track progress in `upgrade-status.md` inside the workspace root.
+
+## References
+
+- [Global Rules](references/global-rules.md)
+- [Workflow Details](references/workflow-details.md)
+- **Functions**
+  - [Consumption to Flex Consumption](references/services/functions/consumption-to-flex.md)
+  - [Assessment](references/services/functions/assessment.md)
+  - [Automation Scripts](references/services/functions/automation.md)
+- **Redis**
+  - [Redis (ACR or ACRE) to AMR Migration](references/services/redis/redis-to-amr.md) — routes to dedicated [amr-migration-skill](https://github.com/AzureManagedRedis/amr-migration-skill) (ACR/OSS) or [acre-to-amr-migration-skill](https://github.com/AzureManagedRedis/acre-to-amr-migration-skill) (Enterprise)
+- **Java SDK Migration Templates**
+  - [Plan Template](references/languages/java/templates/PLAN_TEMPLATE.md)
+  - [Progress Template](references/languages/java/templates/PROGRESS_TEMPLATE.md)
+  - [Summary Template](references/languages/java/templates/SUMMARY_TEMPLATE.md)
+
+## Next
+
+After upgrade is validated, hand off to:
+- `azure-validate` — for thorough post-upgrade validation
+- `azure-deploy` — if the user wants to set up CI/CD for the new app

package/skills/azure-validate/SKILL.md

@@ -0,0 +1,72 @@
+---
+name: azure-validate
+description: azure-validate skill from microsoft/azure-skills
+---
+
+---
+name: azure-validate
+description: "Pre-deployment validation for Azure readiness. Run deep checks on configuration, infrastructure (Bicep or Terraform), RBAC role assignments, managed identity permissions, and prerequisites before deploying. WHEN: validate my app, check deployment readiness, run preflight checks, verify configuration, check if ready to deploy, validate azure.yaml, validate Bicep, test before deploying, troubleshoot deployment errors, validate Azure Functions, validate function app, validate serverless deployment, verify RBAC roles, check role assignments, review managed identity permissions, what-if analysis, validate Container Apps deployment."
+license: MIT
+metadata:
+  author: Microsoft
+  version: "1.1.2"
+---
+
+# Azure Validate
+
+> **AUTHORITATIVE GUIDANCE** — Follow these instructions exactly unless they contradict security policies given to you.
+
+> **⛔ STOP — PREREQUISITE CHECK REQUIRED**
+>
+> Before proceeding, verify this prerequisite is met:
+>
+> **azure-prepare** was invoked and completed → `.azure/deployment-plan.md` exists with status `Approved` or later
+>
+> If the plan is missing, **STOP IMMEDIATELY** and invoke **azure-prepare** first.
+>
+> The complete workflow ensures success:
+>
+> `azure-prepare` → `azure-validate` → `azure-deploy`
+
+## Triggers
+
+- Check if app is ready to deploy
+- Validate azure.yaml or Bicep
+- Run preflight checks
+- Troubleshoot deployment errors
+
+## Rules
+
+1. Run after azure-prepare, before azure-deploy
+2. All checks must pass—do not deploy with failures
+3. ⛔ **Destructive actions require `ask_user`** — [global-rules](references/global-rules.md)
+
+## Steps
+
+| # | Action | Reference |
+|---|--------|-----------|
+| 1 | **Load Plan** — Read `.azure/deployment-plan.md` for recipe and configuration. If missing → run azure-prepare first | `.azure/deployment-plan.md` |
+| 2 | **Add Validation Steps** — Copy recipe "Validation Steps" to `.azure/deployment-plan.md` as children of "All validation checks pass" | [recipes/README.md](references/recipes/README.md), `.azure/deployment-plan.md` |
+| 3 | **Run Validation** — Execute recipe-specific validation commands | [recipes/README.md](references/recipes/README.md) |
+| 4 | **Build Verification** — Build the project and fix any errors before proceeding | See recipe |
+| 5 | **Static Role Verification** — Review Bicep/Terraform for correct RBAC role assignments in code | [role-verification.md](references/role-verification.md) |
+| 6 | **Record Proof** — Populate **Section 7: Validation Proof** with commands run and results | `.azure/deployment-plan.md` |
+| 7 | **Resolve Errors** — Fix failures before proceeding | See recipe's `errors.md` |
+| 8 | **Update Status** — Only after ALL checks pass, set status to `Validated` | `.azure/deployment-plan.md` |
+| 9 | **Deploy** — Invoke **azure-deploy** skill | — |
+> **⛔ VALIDATION AUTHORITY**
+>
+> This skill is the officially verified way to set plan status to `Validated`. You MUST follow these steps to make sure every prerequisite is fulfilled before setting status to `Validated`:
+> 1. Run actual validation commands (azd provision --preview, bicep build, terraform validate, etc.)
+> 2. Populate **Section 7: Validation Proof** with the commands you ran and their results
+> 3. Only then set status to `Validated`
+>
+> Do NOT set status to `Validated` without running checks and recording proof.
+
+---
+
+> **⚠️ MANDATORY NEXT STEP — DO NOT SKIP**
+>
+> After ALL validations pass, you **MUST** invoke **azure-deploy** to execute the deployment. Do NOT attempt to run `azd up`, `azd deploy`, or any deployment commands directly. Let azure-deploy handle execution.
+>
+> If any validation failed, fix the issues and re-run azure-validate before proceeding.

package/skills/brainstorming/SKILL.md

@@ -0,0 +1,159 @@
+---
+name: brainstorming
+description: "You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation."
+---
+
+# Brainstorming Ideas Into Designs
+
+Help turn ideas into fully formed designs and specs through natural collaborative dialogue.
+
+Start by understanding the current project context, then ask questions one at a time to refine the idea. Once you understand what you're building, present the design and get user approval.
+
+<HARD-GATE>
+Do NOT invoke any implementation skill, write any code, scaffold any project, or take any implementation action until you have presented a design and the user has approved it. This applies to EVERY project regardless of perceived simplicity.
+</HARD-GATE>
+
+## Anti-Pattern: "This Is Too Simple To Need A Design"
+
+Every project goes through this process. A todo list, a single-function utility, a config change — all of them. "Simple" projects are where unexamined assumptions cause the most wasted work. The design can be short (a few sentences for truly simple projects), but you MUST present it and get approval.
+
+## Checklist
+
+You MUST create a task for each of these items and complete them in order:
+
+1. **Explore project context** — check files, docs, recent commits
+2. **Offer the visual companion just-in-time** — NOT upfront. The first time a question would genuinely be clearer shown than described, offer it then (its own message); on approval its browser tab opens for you. If no visual question ever arises, never offer it. See the Visual Companion section below.
+3. **Ask clarifying questions** — one at a time, understand purpose/constraints/success criteria
+4. **Propose 2-3 approaches** — with trade-offs and your recommendation
+5. **Present design** — in sections scaled to their complexity, get user approval after each section
+6. **Write design doc** — save to `docs/superpowers/specs/YYYY-MM-DD-<topic>-design.md` and commit
+7. **Spec self-review** — quick inline check for placeholders, contradictions, ambiguity, scope (see below)
+8. **User reviews written spec** — ask user to review the spec file before proceeding
+9. **Transition to implementation** — invoke writing-plans skill to create implementation plan
+
+## Process Flow
+
+```dot
+digraph brainstorming {
+    "Explore project context" [shape=box];
+    "Ask clarifying questions" [shape=box];
+    "Propose 2-3 approaches" [shape=box];
+    "Present design sections" [shape=box];
+    "User approves design?" [shape=diamond];
+    "Write design doc" [shape=box];
+    "Spec self-review\n(fix inline)" [shape=box];
+    "User reviews spec?" [shape=diamond];
+    "Invoke writing-plans skill" [shape=doublecircle];
+
+    "Explore project context" -> "Ask clarifying questions";
+    "Ask clarifying questions" -> "Propose 2-3 approaches";
+    "Propose 2-3 approaches" -> "Present design sections";
+    "Present design sections" -> "User approves design?";
+    "User approves design?" -> "Present design sections" [label="no, revise"];
+    "User approves design?" -> "Write design doc" [label="yes"];
+    "Write design doc" -> "Spec self-review\n(fix inline)";
+    "Spec self-review\n(fix inline)" -> "User reviews spec?";
+    "User reviews spec?" -> "Write design doc" [label="changes requested"];
+    "User reviews spec?" -> "Invoke writing-plans skill" [label="approved"];
+}
+```
+
+**The terminal state is invoking writing-plans.** Do NOT invoke frontend-design, mcp-builder, or any other implementation skill. The ONLY skill you invoke after brainstorming is writing-plans.
+
+## The Process
+
+**Understanding the idea:**
+
+- Check out the current project state first (files, docs, recent commits)
+- Before asking detailed questions, assess scope: if the request describes multiple independent subsystems (e.g., "build a platform with chat, file storage, billing, and analytics"), flag this immediately. Don't spend questions refining details of a project that needs to be decomposed first.
+- If the project is too large for a single spec, help the user decompose into sub-projects: what are the independent pieces, how do they relate, what order should they be built? Then brainstorm the first sub-project through the normal design flow. Each sub-project gets its own spec → plan → implementation cycle.
+- For appropriately-scoped projects, ask questions one at a time to refine the idea
+- Prefer multiple choice questions when possible, but open-ended is fine too
+- Only one question per message - if a topic needs more exploration, break it into multiple questions
+- Focus on understanding: purpose, constraints, success criteria
+
+**Exploring approaches:**
+
+- Propose 2-3 different approaches with trade-offs
+- Present options conversationally with your recommendation and reasoning
+- Lead with your recommended option and explain why
+
+**Presenting the design:**
+
+- Once you believe you understand what you're building, present the design
+- Scale each section to its complexity: a few sentences if straightforward, up to 200-300 words if nuanced
+- Ask after each section whether it looks right so far
+- Cover: architecture, components, data flow, error handling, testing
+- Be ready to go back and clarify if something doesn't make sense
+
+**Design for isolation and clarity:**
+
+- Break the system into smaller units that each have one clear purpose, communicate through well-defined interfaces, and can be understood and tested independently
+- For each unit, you should be able to answer: what does it do, how do you use it, and what does it depend on?
+- Can someone understand what a unit does without reading its internals? Can you change the internals without breaking consumers? If not, the boundaries need work.
+- Smaller, well-bounded units are also easier for you to work with - you reason better about code you can hold in context at once, and your edits are more reliable when files are focused. When a file grows large, that's often a signal that it's doing too much.
+
+**Working in existing codebases:**
+
+- Explore the current structure before proposing changes. Follow existing patterns.
+- Where existing code has problems that affect the work (e.g., a file that's grown too large, unclear boundaries, tangled responsibilities), include targeted improvements as part of the design - the way a good developer improves code they're working in.
+- Don't propose unrelated refactoring. Stay focused on what serves the current goal.
+
+## After the Design
+
+**Documentation:**
+
+- Write the validated design (spec) to `docs/superpowers/specs/YYYY-MM-DD-<topic>-design.md`
+  - (User preferences for spec location override this default)
+- Use elements-of-style:writing-clearly-and-concisely skill if available
+- Commit the design document to git
+
+**Spec Self-Review:**
+After writing the spec document, look at it with fresh eyes:
+
+1. **Placeholder scan:** Any "TBD", "TODO", incomplete sections, or vague requirements? Fix them.
+2. **Internal consistency:** Do any sections contradict each other? Does the architecture match the feature descriptions?
+3. **Scope check:** Is this focused enough for a single implementation plan, or does it need decomposition?
+4. **Ambiguity check:** Could any requirement be interpreted two different ways? If so, pick one and make it explicit.
+
+Fix any issues inline. No need to re-review — just fix and move on.
+
+**User Review Gate:**
+After the spec review loop passes, ask the user to review the written spec before proceeding:
+
+> "Spec written and committed to `<path>`. Please review it and let me know if you want to make any changes before we start writing out the implementation plan."
+
+Wait for the user's response. If they request changes, make them and re-run the spec review loop. Only proceed once the user approves.
+
+**Implementation:**
+
+- Invoke the writing-plans skill to create a detailed implementation plan
+- Do NOT invoke any other skill. writing-plans is the next step.
+
+## Key Principles
+
+- **One question at a time** - Don't overwhelm with multiple questions
+- **Multiple choice preferred** - Easier to answer than open-ended when possible
+- **YAGNI ruthlessly** - Remove unnecessary features from all designs
+- **Explore alternatives** - Always propose 2-3 approaches before settling
+- **Incremental validation** - Present design, get approval before moving on
+- **Be flexible** - Go back and clarify when something doesn't make sense
+
+## Visual Companion
+
+A browser-based companion for showing mockups, diagrams, and visual options during brainstorming. Available as a tool — not a mode. Accepting the companion means it's available for questions that benefit from visual treatment; it does NOT mean every question goes through the browser.
+
+**Offering the companion (just-in-time):** Do NOT offer it upfront. Wait until a question would genuinely be clearer shown than told — a real mockup / layout / diagram question, not merely a UI *topic*. The first time that happens, offer it then, as its own message:
+> "This next part might be easier if I show you — I can put together mockups, diagrams, and comparisons in a browser tab as we go. It's still new and can be token-intensive. Want me to? I'll open it for you."
+
+**This offer MUST be its own message.** Only the offer — no clarifying question, summary, or other content. Wait for the user's response. If they accept, start the server with `--open` so their browser opens to the first screen automatically. If they decline, continue text-only and don't offer again unless they raise it.
+
+**Per-question decision:** Even after the user accepts, decide FOR EACH QUESTION whether to use the browser or the terminal. The test: **would the user understand this better by seeing it than reading it?**
+
+- **Use the browser** for content that IS visual — mockups, wireframes, layout comparisons, architecture diagrams, side-by-side visual designs
+- **Use the terminal** for content that is text — requirements questions, conceptual choices, tradeoff lists, A/B/C/D text options, scope decisions
+
+A question about a UI topic is not automatically a visual question. "What does personality mean in this context?" is a conceptual question — use the terminal. "Which wizard layout works better?" is a visual question — use the browser.
+
+If they agree to the companion, read the detailed guide before proceeding:
+`skills/brainstorming/visual-companion.md`