novahiz 0.2.5 → 0.3.2

package/catalog/providers.json

@@ -3,7 +3,7 @@
     "id": "playwright",
     "label": "Playwright MCP",
     "kind": "mcp",
-    "command": ["npx", "-y", "@playwright/mcp@latest"],
+    "command": ["npx", "-y", "@playwright/mcp@0.0.82"],
     "source": "https://github.com/microsoft/playwright-mcp",
     "license": "Apache-2.0",
     "categories": ["browser", "design-ui"]
@@ -12,7 +12,7 @@
     "id": "security",
     "label": "Security MCP",
     "kind": "mcp",
-    "command": ["npx", "-y", "security-mcp@latest", "serve"],
+    "command": ["npx", "-y", "security-mcp@1.3.7", "serve"],
     "source": "https://github.com/AbrahamOO/security-mcp",
     "license": "MIT",
     "categories": ["audit"]
@@ -21,7 +21,7 @@
     "id": "narsil",
     "label": "Narsil Code Intelligence",
     "kind": "mcp",
-    "command": ["npx", "-y", "narsil-mcp@latest", "--repos", "."],
+    "command": ["npx", "-y", "narsil-mcp@1.7.0", "--repos", "."],
     "source": "https://github.com/postrv/narsil-mcp",
     "license": "MIT OR Apache-2.0",
     "categories": ["code", "review"]
@@ -30,7 +30,7 @@
     "id": "context7",
     "label": "Context7 Documentation",
     "kind": "mcp",
-    "command": ["npx", "-y", "@upstash/context7-mcp@latest"],
+    "command": ["npx", "-y", "@upstash/context7-mcp@4.1.1"],
     "source": "https://github.com/upstash/context7",
     "license": "MIT",
     "categories": ["code"]
@@ -39,18 +39,71 @@
     "id": "cron",
     "label": "Cron Scheduler",
     "kind": "mcp",
-    "command": ["npx", "-y", "mcp-cron@latest"],
-    "source": "https://github.com/jolks/mcp-cron",
-    "license": "AGPL-3.0-only",
-    "categories": ["devops"]
+    "command": ["python", "C:/path/to/scheduler-mcp/main.py"],
+    "source": "https://github.com/PhialsBasement/scheduler-mcp",
+    "license": "MIT",
+    "categories": ["devops"],
+    "purpose": "MIT scheduler clone (requirements pin mcp<2); no npm package exists. Clone PhialsBasement/scheduler-mcp, install its requirements into a venv, then point `command` at that venv's python and your clone's main.py (setup in docs/PROVIDERS.md). Shipped disabled: enable it after the local setup."
   },
   {
     "id": "novahiz",
     "label": "novahiz",
     "kind": "mcp",
-    "command": ["node", "C:/Users/hiz/.config/novahiz/mcp/novahiz-tools/index.mjs"],
+    "command": ["node", "~/.config/novahiz/mcp/novahiz-tools/index.mjs"],
     "source": "https://github.com/novahiz/novahiz",
     "license": "Apache-2.0",
-    "categories": ["code", "planning"]
+    "categories": ["code", "planning"],
+    "purpose": "Novahiz stdio MCP (novahiz_providers, novahiz_deps, memory tools). The opencode plugin resolves this path from the home directory itself; edit the command for other harnesses."
+  },
+  {
+    "id": "dart",
+    "label": "Dart / Flutter MCP",
+    "kind": "mcp",
+    "command": ["dart", "mcp-server"],
+    "requires": ["dart"],
+    "source": "https://github.com/dart-lang/ai/tree/main/pkgs/dart_mcp_server",
+    "license": "BSD-3-Clause",
+    "categories": ["code", "debug", "design-ui", "flutter"],
+    "purpose": "Official Dart SDK MCP: analyzer diagnostics, symbols, test launch, runtime inspection."
+  },
+  {
+    "id": "flutter-skills",
+    "label": "Flutter agent skills",
+    "kind": "skill",
+    "install": ["npx", "-y", "skills@1.7.0", "add", "flutter/agent-plugins", "--skill", "*", "-g", "-a", "opencode", "-y"],
+    "source": "https://github.com/flutter/agent-plugins",
+    "license": "BSD-3-Clause",
+    "categories": ["code", "design-ui", "flutter"],
+    "purpose": "25 official Flutter/Dart agent skills (layouts, tests, architecture, routing, l10n)."
+  },
+  {
+    "id": "dart-skills",
+    "label": "Dart agent skills",
+    "kind": "skill",
+    "install": ["npx", "-y", "skills@1.7.0", "add", "dart-lang/skills", "--skill", "*", "-g", "-a", "opencode", "-y"],
+    "source": "https://github.com/dart-lang/skills",
+    "license": "BSD-3-Clause",
+    "categories": ["code", "debug", "flutter"],
+    "purpose": "15 official Dart skills (subset of flutter/agent-plugins, kept for provenance)."
+  },
+  {
+    "id": "expo-skills",
+    "label": "Expo agent skills",
+    "kind": "skill",
+    "install": ["npx", "-y", "skills@1.7.0", "add", "expo/skills", "--skill", "expo-overview", "expo-project-structure", "expo-router", "expo-animation", "expo-native-ui", "expo-design-system", "expo-ui", "expo-data-fetching", "expo-dom", "expo-web-to-native", "expo-module", "expo-brownfield", "expo-dev-client", "expo-examples", "expo-app-clip", "expo-upgrade", "expo-skill-feedback", "-g", "-a", "opencode", "-y"],
+    "source": "https://github.com/expo/skills",
+    "license": "MIT",
+    "categories": ["code", "expo"],
+    "purpose": "17 official Expo framework skills (expo-* group); the 7 eas-* paid-service skills are excluded. Installed to ~/.agents/skills; when git clone fails, fetch the tarball from codeload.github.com and copy the skill folders."
+  },
+  {
+    "id": "impeccable",
+    "label": "Impeccable design skill",
+    "kind": "skill",
+    "install": ["npx", "-y", "skills@1.7.0", "add", "pbakaus/impeccable", "--skill", "impeccable", "-g", "-a", "opencode", "-y"],
+    "source": "https://github.com/pbakaus/impeccable",
+    "license": "Apache-2.0",
+    "categories": ["design-ui"],
+    "purpose": "Upstream Impeccable skill (critique, audit and polish playbooks) required by gate rule R14. Installed to ~/.agents/skills; rerun the command to update."
   }
 ]

package/catalog/rules.json

@@ -16,8 +16,6 @@
       "match": "any",
       "promptCategories": ["browser"],
       "pathGlobs": [
-        "**/*.spec.ts",
-        "**/*.spec.js",
         "**/*.e2e.ts",
         "**/*.e2e.js",
         "**/*.pw.ts",
@@ -32,7 +30,23 @@
     "id": "R6-Novahiz",
     "description": "Load Novahiz pipeline skills for any task triggering the workflow.",
     "when": {
-      "promptCategories": ["code", "debug", "review", "audit", "browser", "design-ui", "database-supabase", "docs-writing", "planning", "devops", "data", "general"]
+      "promptCategories": [
+        "code",
+        "debug",
+        "review",
+        "audit",
+        "browser",
+        "design-ui",
+        "database-supabase",
+        "docs-writing",
+        "planning",
+        "devops",
+        "data",
+        "general",
+        "flutter",
+        "expo",
+        "test"
+      ]
     },
     "require": ["novahiz-plan", "novahiz-clarify", "novahiz-analyse", "novahiz-implement", "novahiz-converge"]
   },
@@ -48,17 +62,19 @@
     "id": "R8-docs",
     "description": "Load novahiz-docs when editing project documentation.",
     "when": {
-      "pathGlobs": ["novahiz-docs/**/*.md"]
+      "pathGlobs": ["**/novahiz-docs/**/*.md"]
     },
     "require": ["novahiz-docs"]
   },
   {
     "id": "R9-code-review",
-    "description": "Load novahiz-code-review on any code review task.",
+    "description": "Load novahiz-code-review on code review tasks or code edits of 200+ characters (small touch-ups skip the review).",
     "when": {
       "match": "any",
       "promptCategories": ["review"],
-      "fileClasses": ["code"]
+      "fileClasses": ["code"],
+      "pathGlobs": ["**/*.tsx", "**/*.jsx", "**/*.vue", "**/*.svelte", "**/*.astro"],
+      "minChange": 200
     },
     "require": ["novahiz-code-review"]
   },
@@ -67,13 +83,13 @@
     "description": "Load novahiz-security on any security audit or hardening task.",
     "when": {
       "match": "any",
-      "promptCategories": ["audit", "security"]
+      "promptCategories": ["audit"]
     },
     "require": ["novahiz-security"]
   },
   {
     "id": "R11-accessibility",
-    "description": "Load novahiz-wcag-audit on any a11y audit or WCAG task.",
+    "description": "Load novahiz-wcag-audit on design-ui work and on audit prompts, where accessibility is in scope.",
     "when": {
       "match": "any",
       "promptCategories": ["design-ui", "audit"]
@@ -105,5 +121,22 @@
       ]
     },
     "require": ["novahiz-humanizer", "ui-slop-remover", "ui-craft-rules"]
+  },
+  {
+    "id": "R14-impeccable",
+    "description": "Load the impeccable design skill on frontend design tasks so critique/audit/polish playbooks stay available.",
+    "when": {
+      "match": "any",
+      "promptCategories": ["design-ui"],
+      "pathGlobs": [
+        "**/*.css",
+        "**/*.scss",
+        "**/*.sass",
+        "**/*.less",
+        "**/*.html",
+        "**/*.htm"
+      ]
+    },
+    "require": ["impeccable"]
   }
-]
+]

package/docs/ARCHITECTURE.md

@@ -41,8 +41,8 @@ Novahiz has one core and thin adapters. The core holds every decision. An adapte
 
 Three versioned JSON files under `catalog/`:
 
-- `categories.json` — lists 15 categories with keywords, required skills, and execution roadmaps.
-- `rules.json` — lists 6 pre-edit rules with conditions (file class, path glob, prompt category, content match) and required skills.
+- `categories.json` — lists 17 categories with keywords, required skills, and execution roadmaps.
+- `rules.json` — lists 11 pre-edit rules with conditions (file class, path glob, prompt category, content match) and required skills.
 - `providers.json` — lists external MCP servers with their purpose and the categories they serve.
 - `overrides.json` — carries manual skill curation (power, stars, tags, categories).
 

package/docs/CATALOG.md

@@ -6,9 +6,9 @@ The catalog is the knowledge base of Novahiz. It defines what categories exist,
 
 ```
 catalog/
-├── categories.json    # 15 categories with keywords, skills, roadmaps
-├── rules.json         # 6 pre-edit rules (file class + content triggers)
-├── providers.json     # 6 external MCP servers and skill packs
+├── categories.json    # 17 categories with keywords, skills, roadmaps
+├── rules.json         # 11 pre-edit rules (file class + content triggers)
+├── providers.json     # 11 external providers (7 MCP + 4 skill packs)
 └── overrides.json     # Manual skill curation (power, stars, tags)
 ```
 
@@ -23,7 +23,7 @@ Each category is a JSON object:
   "priority": 57,
   "keywords": ["supabase", "postgres", "sql", "rls", "migration", ...],
   "negativeKeywords": ["mockup", "landing"],
-  "defaultSkills": ["supabase", "supabase-postgres-best-practices"],
+  "defaultSkills": ["novahiz-supabase", "novahiz-postgres"],
   "roadmap": {
     "id": "schema",
     "steps": [

package/docs/CLASSIFICATION.md

@@ -75,10 +75,12 @@ The classifier is the brain of Novahiz. It maps a natural language prompt to cat
 
 ## Categories
 
-Novahiz defines 15 categories, each with its own keywords, priority, and roadmap:
+Novahiz defines 17 categories, each with its own keywords, priority, and roadmap:
 
 | Category | Priority | Keywords (examples) | Roadmap |
 |----------|----------|---------------------|---------|
+| `flutter` | 61 | flutter, dart, widget, pubspec, riverpod | `flutter-feature` (10 steps) |
+| `expo` | 61 | expo, react native, expo router, eas build | `expo-feature` (11 steps) |
 | `code` | 60 | code, function, class, typescript, react, api | `feature` (7 steps) |
 | `debug` | 58 | bug, error, crash, fix, regression | `bugfix` (7 steps) |
 | `database-supabase` | 57 | supabase, postgres, sql, rls, migration | `schema` (9 steps) |

package/docs/CONFIGURATION.md

@@ -25,7 +25,7 @@ These files live in `catalog/` and are part of the git repository:
     "enabled": true,
     "mode": "block",
     "envEscape": "NOVAHIZ_GATE",
-    "tools": ["edit", "write", "patch", "apply_patch", "bash", "shell"],
+    "tools": ["edit", "write", "patch", "apply_patch", "bash", "shell", "cron_add_command_task", "cron_update_command_task", "cron_update_task", "cron_run_task_now"],
     "ignoreFiles": ["**/node_modules/**", "**/dist/**", ...],
     "placeholders": true,
     "trace": {
@@ -41,7 +41,7 @@ These files live in `catalog/` and are part of the git repository:
   "providers": {
     "autoRegister": true,
     "autoInstall": false,
-    "disabled": []
+    "disabled": ["cron"]
   },
   "ledger": {
     "enabled": true,
@@ -62,14 +62,14 @@ These files live in `catalog/` and are part of the git repository:
 | `gate.enabled` | `true` | Enable/disable the gate |
 | `gate.mode` | `block` | `block`, `warn`, or `audit` |
 | `gate.envEscape` | `NOVAHIZ_GATE` | Schema field only. The kill-switch name is hardcoded to `NOVAHIZ_GATE` in the CLI, MCP gate, and plugin; a config value cannot redirect it. |
-| `gate.tools` | `[edit, write, patch, ...]` | Tools to intercept |
+| `gate.tools` | `[edit, write, patch, apply_patch, bash, shell, cron_add_command_task, cron_update_command_task, cron_update_task, cron_run_task_now]` | Tools to intercept |
 | `gate.placeholders` | `true` | Block edits with placeholder markers |
 | `classify.minScore` | `1` | Minimum score to match a category |
 | `classify.maxCategories` | `3` | Maximum categories per prompt |
 | `classify.fallbackCategory` | `general` | Fallback when no category matches |
 | `providers.autoRegister` | `true` | Auto-register MCP providers |
 | `providers.autoInstall` | `false` | Auto-install provider dependencies |
-| `providers.disabled` | `[]` | Providers to skip |
+| `providers.disabled` | `["cron"]` | Providers to skip (`cron` needs a local scheduler clone first) |
 | `ledger.enabled` | `true` | Enable the task ledger |
 | `ledger.review.edits` | `3` | Force review after N edits |
 | `ledger.review.todos` | `2` | Force review after N completed todos |
@@ -88,7 +88,7 @@ These files live in `catalog/` and are part of the git repository:
 
 The installer generates `opencode.jsonc` with:
 
-- MCP server registrations (context7, narsil, cron, playwright, supabase)
+- MCP server registrations (context7, narsil, cron, playwright, security, dart, novahiz)
 - Skill paths
 - Plugin list
 - Compaction settings

package/docs/CONVERGENCE-2026-09-25.md

@@ -0,0 +1,5 @@
+# Convergence audit 2026-09-25
+SATISFAIT: LOW plugin (b3ccf5d), GATE_TOOLS (a3edbe0), regles/tests (64d266b), Orca (49d3ce3), audit sub-agents (b3).
+DEFERE (utilisateur accepte): P0-P2 audit recommendations (16 items: gate tier/content, kill-switch, skills index, plugin session, capture-cli, postinstall, bootstrap, cron, narsil, auth, env, index rebuild, docs sync, R8, test cat, .tsx, dedup, purge).
+NON EVALUE: runtime Edge/Orca, conversations, CVE dependances.
+ACTION: redemarrer opencode (plugin/config changes).

package/docs/GATE.md

@@ -14,14 +14,14 @@ The gate is the enforcement mechanism. It inspects every file edit and decides w
 ┌─────────────────────────────────────────────────────────────┐
 │                 FILE CLASSIFICATION                         │
 │                                                             │
-│  src/components/Hero.tsx → "code"                          │
+│  src/components/Hero.tsx → "design"                         │
 │                                                             │
 │  Rules:                                                     │
-│  • *.ts, *.tsx, *.js, *.jsx, *.py, *.go, ... → "code"     │
-│  • *.css, *.scss, *.html, *.vue, *.svelte → "design"      │
+│  • *.ts, *.js, *.py, *.go, *.sql, *.sh, ... → "code"       │
+│  • *.css, *.scss, *.html, *.vue, *.svelte, *.tsx → "design" │
 │  • *.md, *.txt, *.rst → "text"                             │
-│  • *.json, *.yaml, *.toml → "config"                       │
-│  • *.csv, *.sql, *.db → "data"                             │
+│  • *.json, *.yaml, *.toml, *.csv → "data"                  │
+│  • *.env, *.ini, *.cfg, dotfiles → "config"                │
 └──────────────────────────┬──────────────────────────────────┘
                            │
                            ▼
@@ -38,6 +38,11 @@ The gate is the enforcement mechanism. It inspects every file edit and decides w
 │              + ui-slop-remover + ui-craft-rules             │
 │    (Humanizer and ui-slop-remover are design-only.)         │
 │                                                             │
+│  R14-impeccable:                                            │
+│    match: any                                               │
+│    promptCategories: ["design-ui"] OR pathGlobs: css/html   │
+│    → require impeccable (critique/audit/polish playbooks)   │
+│                                                             │
 │  R3-supabase:                                               │
 │    promptCategories: ["database-supabase"]                  │
 │    → Was the prompt classified as Supabase?                 │
@@ -59,14 +64,17 @@ The gate is the enforcement mechanism. It inspects every file edit and decides w
 │  Primary category: database-supabase                        │
 │  Roadmap: schema                                            │
 │                                                             │
-│  Non-optional skill steps:                                  │
+│  Non-optional skill steps (kind: "skill" only):            │
 │  • plan → novahiz-plan                                 │
 │  • clarify → novahiz-clarify                           │
 │  • inspect → novahiz-analyse                           │
 │  • load → novahiz-supabase                             │
-│  • migration → novahiz-implement                       │
 │  • security → novahiz-postgres                         │
-│  • converge → novahiz-converge                         │
+│                                                             │
+│  Skipped (kind is not "skill"):                            │
+│  • migration (edit), test (verify), converge (verify),     │
+│    document (advisory) — listed in the roadmap, never      │
+│    added to requiredSkills                                │
 └──────────────────────────┬──────────────────────────────────┘
                            │
                            ▼
@@ -100,8 +108,8 @@ The gate is the enforcement mechanism. It inspects every file edit and decides w
 │                 VERDICT                                     │
 │                                                             │
 │  allow: false                                               │
-│  missingSkills: ["supabase", "supabase-postgres-best-..."]  │
-│  reasons: ["missing skill: supabase"]                       │
+│  missingSkills: ["novahiz-supabase", "novahiz-postgres"]    │
+│  reasons: ["missing skill: novahiz-supabase"]               │
 │                                                             │
 │  Exit code: 2 → ADAPTER THROWS → MODEL SEES ERROR          │
 └─────────────────────────────────────────────────────────────┘
@@ -113,11 +121,14 @@ The gate classifies files by extension:
 
 | Class | Extensions |
 |-------|------------|
-| `code` | `.ts`, `.tsx`, `.js`, `.jsx`, `.py`, `.go`, `.rs`, `.java`, `.kt`, `.swift`, `.php`, `.dart`, `.rb`, `.c`, `.cpp`, `.h` |
-| `design` | `.css`, `.scss`, `.sass`, `.less`, `.styl`, `.html`, `.vue`, `.svelte`, `.astro` |
-| `text` | `.md`, `.txt`, `.rst`, `.adoc` |
-| `config` | `.json`, `.yaml`, `.yml`, `.toml`, `.ini`, `.env` |
-| `data` | `.csv`, `.sql`, `.db`, `.sqlite` |
+| `code` | `.ts`, `.js`, `.mjs`, `.cjs`, `.py`, `.go`, `.rs`, `.java`, `.kt`, `.swift`, `.php`, `.dart`, `.rb`, `.c`, `.cpp`, `.h`, `.sh`, `.ps1`, `.sql` |
+| `design` | `.css`, `.scss`, `.sass`, `.less`, `.styl`, `.html`, `.htm`, `.vue`, `.svelte`, `.astro`, `.jsx`, `.tsx` |
+| `text` | `.md`, `.mdx`, `.txt`, `.rst`, `.adoc` |
+| `data` | `.json`, `.jsonc`, `.yaml`, `.yml`, `.toml`, `.csv`, `.tsv`, `.xml` |
+| `config` | `.env`, `.ini`, `.cfg`, `.conf`, dotfiles (`.gitignore`, `.eslintrc.json`, …) |
+| `other` | anything else (including `.db` and `.sqlite`, which have no mapping) |
+
+Note the deliberate differences from intuition: `.tsx`/`.jsx` are `design` (component styling surfaces), `.json`/`.yaml` are `data`, and `.sql` is `code`.
 
 ## Rule selectors
 

package/docs/HARNESSES.md

@@ -19,14 +19,18 @@ Source: opencode plugin docs (`~/.config/opencode/plugins/`).
 
 ### Third-party opencode plugins
 
-Besides the Novahiz adapter, the bootstrap and installer may pin these packages in `opencode.jsonc` under `plugin[]`. They ship from npm and are not vendored here.
+Besides the Novahiz adapter, no third-party plugin is installed. The bootstrap and installer no longer pin any package under `plugin[]` — these were removed on 2026-09-26 and must not come back:
 
-| Package | Repository | License |
-| --- | --- | --- |
-| `@mohak34/opencode-notifier` | https://github.com/mohak34/opencode-notifier | MIT |
-| `@tarquinen/opencode-dcp` | https://github.com/Opencode-DCP/opencode-dynamic-context-pruning | AGPL-3.0-or-later |
+| Package | Repository | License | Status |
+| --- | --- | --- | --- |
+| `@mohak34/opencode-notifier` | https://github.com/mohak34/opencode-notifier | MIT | removed 2026-09-26 |
+| `@tarquinen/opencode-dcp` | https://github.com/Opencode-DCP/opencode-dynamic-context-pruning | AGPL-3.0-or-later | removed 2026-09-26 |
 
-`opencode-dcp` is AGPL-3.0-or-later. Installing it accepts that license for the plugin package. Full provider MCP provenance lives in [PROVIDERS.md](PROVIDERS.md) and `catalog/providers.json`.
+Full provider MCP provenance lives in [PROVIDERS.md](PROVIDERS.md) and `catalog/providers.json`.
+
+### Official Flutter / Dart providers
+
+The installer can register the Dart MCP (`dart mcp-server`) and, with `--flutter-skills`, install the official skill packs into `~/.agents/skills` (merged into `skills.paths`). Nothing is vendored here; commands and licences are in [PROVIDERS.md](PROVIDERS.md) and `NOTICE.md`. After a config change, restart opencode so the new MCP entry is read at import.
 
 ## Other clients
 

package/docs/INSTALL.md

@@ -37,6 +37,7 @@ Restart opencode afterward. The plugin in `~/.config/opencode/plugins/novahiz.ts
 - `--no-skills` skips the skills copy.
 - `--force-skills` recopies a skill even when another scanned root already provides it.
 - `--install-providers` runs the provider dependency bootstrap and install commands.
+- `--flutter-skills` installs the official skill packs from `flutter/agent-plugins` and `dart-lang/skills` via `npx skills add -g -a opencode` (upstream licences apply; nothing is vendored).
 - `--force` rewrites `novahiz.config.json` (the previous file is backed up as `novahiz.config.json.novahiz-bak`).
 - `--yes` skips every prompt. Use it in scripts and CI, where there is no terminal to answer.
 - `--interactive` forces the prompts even when the output is not a terminal.

package/docs/PROVIDERS.md

@@ -40,16 +40,30 @@ MCP servers, with provenance from `catalog/providers.json`:
 | --- | --- | --- | --- | --- |
 | `playwright` | `@playwright/mcp` | [microsoft/playwright-mcp](https://github.com/microsoft/playwright-mcp) | Apache-2.0 | browser, design-ui |
 | `security` | `security-mcp` | [AbrahamOO/security-mcp](https://github.com/AbrahamOO/security-mcp) | MIT | audit |
-| `narsil` | `narsil-mcp` | [postrv/narsil-mcp](https://github.com/postrv/narsil-mcp) | MIT OR Apache-2.0 | code, debug, review, audit |
-| `context7` | `@upstash/context7-mcp` | [upstash/context7](https://github.com/upstash/context7) | MIT | code, research |
-| `cron` | `mcp-cron` | [jolks/mcp-cron](https://github.com/jolks/mcp-cron) | AGPL-3.0-only | devops, general |
+| `narsil` | `narsil-mcp` | [postrv/narsil-mcp](https://github.com/postrv/narsil-mcp) | MIT OR Apache-2.0 | code, review |
+| `context7` | `@upstash/context7-mcp` | [upstash/context7](https://github.com/upstash/context7) | MIT | code |
+| `cron` | `scheduler-mcp` (local venv) | [PhialsBasement/scheduler-mcp](https://github.com/PhialsBasement/scheduler-mcp) | MIT | devops |
 | `novahiz` | local (`mcp/novahiz-tools`) | [novahiz/novahiz](https://github.com/novahiz/novahiz) | Apache-2.0 | code, planning |
+| `dart` | `dart mcp-server` (Dart SDK) | [dart-lang/ai · dart_mcp_server](https://github.com/dart-lang/ai/tree/main/pkgs/dart_mcp_server) | BSD-3-Clause | code, debug, design-ui, flutter |
 
-`cron` is AGPL-3.0-only. Enabling it means you accept that license for the install command, not for Novahiz itself.
+`cron` runs `scheduler-mcp` (MIT) from a local clone with its own virtualenv. It replaced the former AGPL `mcp-cron` npm package; there is no npm install step for it. It ships disabled because the `command` has to point at your own clone: install the upstream requirements into a venv, set `command` to that venv's python plus your clone's `main.py`, then remove `cron` from `providers.disabled`.
+
+`dart` requires the Dart SDK on `PATH` (`requires: ["dart"]`). Without it the MCP entry still registers, but the server fails to start; disable it or install the SDK.
 
 Skill and command packs:
 
-None are bundled. Design and text skills ship as ordinary skills under the `Novahiz-*` prefix (or the catalog), not as providers.
+| Id | Install command | Upstream | License | Categories |
+| --- | --- | --- | --- | --- |
+| `flutter-skills` | `npx skills add flutter/agent-plugins --skill '*' -g -a opencode -y` | [flutter/agent-plugins](https://github.com/flutter/agent-plugins) | BSD-3-Clause | code, design-ui, flutter |
+| `dart-skills` | `npx skills add dart-lang/skills --skill '*' -g -a opencode -y` | [dart-lang/skills](https://github.com/dart-lang/skills) | BSD-3-Clause | code, debug, flutter |
+| `expo-skills` | `npx skills add expo/skills --skill expo-overview ... -g -a opencode -y` | [expo/skills](https://github.com/expo/skills) | MIT | code, expo |
+| `impeccable` | `npx skills add pbakaus/impeccable --skill impeccable -g -a opencode -y` | [pbakaus/impeccable](https://github.com/pbakaus/impeccable) | Apache-2.0 | design-ui |
+
+Installed skills land under `~/.agents/skills` for OpenCode. They are referenced by install command, never vendored in this repository. `dart-lang/skills` is a subset of `flutter/agent-plugins` (same 15 Dart skills); both are listed for provenance.
+
+`expo-skills` names the 17 `expo-*` skills explicitly; the 7 `eas-*` skills (paid EAS services) are excluded. When `npx skills add` cannot reach the repo (git clone failures), fetch the tarball from `codeload.github.com` and copy the skill folders into `~/.agents/skills`, then run `Novahiz sync` — that fallback was used on this machine.
+
+`impeccable` is the one design skill referenced as a provider: gate rule R14 requires it, and it installs from upstream under its own Apache-2.0 terms instead of being vendored. The other design and text skills ship as ordinary Novahiz skills under `skills/`, not as providers.
 
 ## Mapping
 
@@ -79,7 +93,7 @@ Control it in `novahiz.config.json`:
 
 - `autoRegister`: register missing MCP servers on startup.
 - `autoInstall`: run the official install commands during `node install/install.mjs`.
-- `disabled`: provider ids to skip.
+- `disabled`: provider ids to skip. `cron` ships disabled by default; enable it after the local scheduler setup described above.
 
 Run the install commands on demand:
 
@@ -95,6 +109,7 @@ Installation is opt-in on purpose. The commands download third-party packages, i
 Each provider declares its prerequisites in `requires` (the executable it needs) and, when it can be bootstrapped, a per-platform `bootstrap` command. No provider currently declares a `bootstrap`; `Novahiz deps --install` supports the field for future entries.
 
 - `npx` based providers need `npx`, which ships with Node.
+- `dart` needs the Dart SDK on `PATH` (`dart --version`). Flutter installs ship it.
 
 `Novahiz deps` checks every prerequisite and reports what is missing. `Novahiz deps --install` first bootstraps a missing prerequisite through its official installer, then runs each provider's install command. The installer runs the check on every install and, when `providers.autoInstall` is true or `--install-providers` is passed, runs the installs too.
 

package/docs/ROADMAPS.md

@@ -6,6 +6,8 @@ A roadmap is an ordered list of steps attached to a category. The classifier pic
 
 Eight categories run the same pipeline: `code`, `debug`, `browser`, `design-ui`, `database-supabase`, `planning`, `devops`, and `data`. Every stage is a skill, and `novahiz-planner` is the orchestrator that fixes the order.
 
+`flutter` (`flutter-feature`) follows the same six stages and inserts three non-optional quality skills: `flutter-apply-architecture-best-practices`, `dart-run-static-analysis` before implement, then `dart-add-unit-test` after implement, plus a final self-review. On `lite` and `trivial` tiers those architecture/analyze/test steps are filtered like every other roadmap (lite keeps only implement and converge).
+
 | # | Stage | Skill | Produces |
 |---|---|---|---|
 | 1 | Plan | `novahiz-plan` | direction, scope, dependency order, slicing strategy, risks |
@@ -19,6 +21,32 @@ Stages 1 to 4 write no application file; they produce a plan and decisions. Clar
 
 `review` runs analyse and then the diff review. `audit` and `test` keep their own steps and end on a converge. `research` drives a single gather step.
 
+## Expo (progressive gate)
+
+`expo` (`expo-feature`, 11 steps) runs the six stages and inserts four **optional** `expo-*` skills between analyse and implement: `expo-router` (routes, links, modals), `expo-module` (native code), `expo-dev-client` (dev client / EAS build), `expo-upgrade` (SDK upgrades). Optional steps guide without blocking — only the pipeline skills are enforced — and `expo-overview` loads through `defaultSkills` as the entry point. `flutter` is excluded through negative keywords, so a prompt naming both picks the right category.
+
+Task-to-skill routing, the full `expo-*` pack (17 skills, `eas-*` paid services excluded):
+
+| Task | Skill |
+|------|-------|
+| Any Expo request (entry point) | `expo-overview` |
+| Routes, links, modals, tabs | `expo-router` |
+| Folder structure, file-based layout | `expo-project-structure` |
+| Native modules (Swift / Kotlin) | `expo-module` |
+| Dev client, EAS build setup | `expo-dev-client` |
+| SDK upgrade | `expo-upgrade` |
+| Animations, gestures | `expo-animation` |
+| Data fetching, caching | `expo-data-fetching` |
+| Design system, tokens | `expo-design-system` |
+| Native-feeling styling | `expo-native-ui` |
+| `@expo/ui` components | `expo-ui` |
+| Web → native migration | `expo-web-to-native` |
+| DOM components | `expo-dom` |
+| Brownfield (existing app) | `expo-brownfield` |
+| Example patterns | `expo-examples` |
+| App Clip (iOS) | `expo-app-clip` |
+| Feedback / telemetry control | `expo-skill-feedback` |
+
 ## Model
 
 Roadmaps live inline in `catalog/categories.json`:
@@ -60,6 +88,7 @@ When several categories match, the one with the highest score provides the roadm
 - Both skills are required on design-ui prompts and style file edits (css/scss/less/html).
 - Outside frontend design, neither skill is required by the gate.
 - The design-ui roadmap also carries an optional `design-craft` step for guidance; it does not block.
+- `R14-impeccable` requires the `impeccable` skill on the same design selectors. The design-ui roadmap adds optional `impeccable-critique`, `impeccable-audit`, and `impeccable-polish` steps after implement, and the flutter roadmap an optional `impeccable-critique` step for UI work; optional steps guide without blocking.
 
 Rules express this with `when.contentMatches` (`prose`, `style`, or a regex), `when.contentExcludes`, `when.minChange`, and `when.match` (`any` or `all`) to combine the class, path, and category selectors.
 

package/docs/RULES.md

@@ -34,15 +34,18 @@ Content conditions are combined with AND against the selectors. A rule with `con
 | Id | Condition | Requires |
 | --- | --- | --- |
 | R3-supabase | a Supabase path or a Supabase prompt | `novahiz-supabase`, `novahiz-postgres` |
-| R4-playwright | a browser prompt category, or a browser test path (`**/*.spec.ts`, `**/e2e/**`, `**/playwright/**`, …) | `novahiz-browser` |
+| R4-playwright | a browser prompt category, or a browser test path (`**/*.e2e.ts`, `**/e2e/**`, `**/playwright/**`, `**/*.cy.ts`, …) | `novahiz-browser` |
 | R6-Novahiz | a prompt in a workflow category | pipeline skills (`novahiz-plan`, `novahiz-clarify`, `novahiz-analyse`, `novahiz-implement`, `novahiz-converge`) |
-| R9-code-review | a review prompt or a code file under review | `novahiz-code-review` |
-| R10-security | an audit or security prompt | `novahiz-security` |
+| R7-assessment | an `assessment` prompt | assessment pipeline skills (`novahiz-assess-intake`, `novahiz-assess-research`, `novahiz-assess-define`, `novahiz-assess-shape`, `novahiz-assess-decide`) |
+| R8-docs | a documentation file under `novahiz-docs/` (`**/novahiz-docs/**/*.md`, relative or absolute) | `novahiz-docs` |
+| R9-code-review | a review prompt, any code file, or a `.tsx`/`.jsx`/`.vue`/`.svelte`/`.astro` file | `novahiz-code-review` |
+| R10-security | an audit prompt | `novahiz-security` |
 | R11-accessibility | a design-ui or audit prompt | `novahiz-wcag-audit` |
 | R12-web-extract | a research prompt | `novahiz-web-extract` |
 | R13-design-craft | a design-ui prompt or a style file (css/scss/less/html) | `novahiz-humanizer`, `ui-slop-remover`, `ui-craft-rules` |
+| R14-impeccable | a design-ui prompt or a style file (css/scss/less/html) | `impeccable` |
 
-`novahiz-humanizer` and `ui-slop-remover` are required only by R13, on frontend design tasks. They are not required on ordinary text, docs, or code edits.
+`novahiz-humanizer` and `ui-slop-remover` are required only by R13, on frontend design tasks. They are not required on ordinary text, docs, or code edits. `impeccable` loads under R14 on the same selectors, so the critique, audit, and polish playbooks stay reachable after UI work.
 
 ## Resolution