opencode-agent-skill 7.7.0

package/global-config/plugins/ues-router/index.js

@@ -0,0 +1,277 @@
+import { Plugin } from "@opencode/plugin"
+import { readFileSync } from "node:fs"
+import { fileURLToPath } from "node:url"
+import path from "node:path"
+import { spawnSync } from "node:child_process"
+import { routeSkills } from "./router.js"
+import { destructiveShellRisk } from "./safety.js"
+import { runtimeCapabilities } from "./capabilities.js"
+
+const CONFIG_FILE = path.resolve(
+  path.dirname(fileURLToPath(import.meta.url)),
+  "..",
+  "..",
+  ".ues",
+  "router.json",
+)
+
+function routerConfig() {
+  try {
+    const parsed = JSON.parse(readFileSync(CONFIG_FILE, "utf8"))
+    return {
+      enabled: parsed.enabled !== false,
+      maxSkills: Number.isInteger(parsed.maxSkills) ? Math.max(1, Math.min(parsed.maxSkills, 6)) : 4,
+    }
+  } catch {
+    return { enabled: true, maxSkills: 4 }
+  }
+}
+
+
+function runOcskill(args, cwd) {
+  const result = spawnSync("ocskill", args, {
+    cwd,
+    encoding: "utf8",
+    shell: process.platform === "win32",
+    maxBuffer: 4 * 1024 * 1024,
+  })
+  if (result.status !== 0) {
+    throw new Error((result.stderr || result.stdout || "ocskill command failed").trim())
+  }
+  return (result.stdout || "").trim()
+}
+
+function runOcskillJSON(args, cwd) {
+  const output = runOcskill(args, cwd)
+  try {
+    return JSON.parse(output)
+  } catch {
+    throw new Error("ocskill returned invalid JSON for: " + args.join(" "))
+  }
+}
+
+function modelRef(value) {
+  if (!value || typeof value !== "string") return null
+  const [base, variant] = value.split("#", 2)
+  const slash = base.indexOf("/")
+  if (slash <= 0 || slash === base.length - 1) return null
+  return {
+    providerID: base.slice(0, slash),
+    id: base.slice(slash + 1),
+    ...(variant ? { variant } : {}),
+  }
+}
+
+function messageExcerpt(messages) {
+  const value = Array.isArray(messages) ? messages.slice(-6) : messages
+  const text = JSON.stringify(value)
+  return text.length <= 24000 ? text : text.slice(-24000)
+}
+
+export default Plugin.define({
+  id: "ues-router",
+  async setup(ctx) {
+    const projectRoot = ctx.location.project?.canonical || ctx.location.directory
+    const capabilities = runtimeCapabilities(ctx)
+
+    await ctx.tool.transform((editor) => {
+      editor.namespace({
+        name: "ues",
+        description: "UES long-horizon state, deterministic planning evidence, and fresh-context task execution.",
+      })
+      editor.add({
+        name: "capabilities",
+        description: "Report detected OpenCode runtime capabilities used by UES instead of assuming behavior from a version number.",
+        input: {
+          type: "object",
+          properties: {},
+          additionalProperties: false,
+        },
+        options: { namespace: "ues", codemode: true },
+        execute: async () => ({ content: JSON.stringify(capabilities, null, 2) }),
+      })
+      editor.add({
+        name: "task_policy",
+        description: "Classify an engineering request into inline, standard or long-horizon mode with risk/model/context guidance.",
+        input: {
+          type: "object",
+          properties: { text: { type: "string" } },
+          required: ["text"],
+          additionalProperties: false,
+        },
+        options: { namespace: "ues", codemode: true },
+        execute: async (input) => ({
+          content: runOcskill(["task-policy", input.text], projectRoot),
+        }),
+      })
+      editor.add({
+        name: "work_status",
+        description: "Read durable status for a UES .ues-work item without modifying it.",
+        input: {
+          type: "object",
+          properties: { slug: { type: "string" } },
+          required: ["slug"],
+          additionalProperties: false,
+        },
+        options: { namespace: "ues", codemode: true },
+        execute: async (input) => ({
+          content: runOcskill(["work", "status", input.slug, projectRoot], projectRoot),
+        }),
+      })
+      editor.add({
+        name: "task_graph",
+        description: "Validate a UES PLAN.json and compute dependency-safe execution waves.",
+        input: {
+          type: "object",
+          properties: { plan: { type: "string" } },
+          required: ["plan"],
+          additionalProperties: false,
+        },
+        options: { namespace: "ues", codemode: true },
+        execute: async (input) => ({
+          content: runOcskill(["task-graph", input.plan], projectRoot),
+        }),
+      })
+      editor.add({
+        name: "context_pack",
+        description: "Read the bounded durable context pack for one UES task executor.",
+        input: {
+          type: "object",
+          properties: {
+            slug: { type: "string" },
+            task: { type: "string" },
+          },
+          required: ["slug", "task"],
+          additionalProperties: false,
+        },
+        options: { namespace: "ues", codemode: true },
+        execute: async (input) => ({
+          content: runOcskill(["context-pack", input.slug, input.task, projectRoot], projectRoot),
+        }),
+      })
+      editor.add({
+        name: "dispatch_task",
+        description: "Start one approved UES task and execute it in a fresh ues-executor session, applying configured attempt-based model escalation when available. The parent must inspect the diff and record completion evidence separately.",
+        input: {
+          type: "object",
+          properties: {
+            slug: { type: "string" },
+            task: { type: "string" },
+          },
+          required: ["slug", "task"],
+          additionalProperties: false,
+        },
+        options: { namespace: "ues", codemode: true },
+        execute: async (input, tool) => {
+          if (!capabilities.freshDispatch) {
+            throw new Error("OpenCode runtime does not expose the fresh-session capabilities required by ues.dispatch_task")
+          }
+          await tool.progress({ status: "starting fresh UES executor" })
+          const started = runOcskillJSON(["work", "start", input.slug, input.task, projectRoot], projectRoot)
+          const attempt = started?.record?.attempts || 1
+          const runId = started?.record?.runId || null
+          const taskText = [
+            started?.contextPack?.task?.title,
+            started?.contextPack?.task?.summary,
+            ...(started?.contextPack?.task?.acceptance || []),
+          ].filter(Boolean).join(" ")
+          const taskPolicy = runOcskillJSON(["task-policy", taskText], projectRoot)
+          const policyArgs = ["model-policy", "executor", "--attempt", String(attempt)]
+          if (taskText) policyArgs.push("--text", taskText)
+          const policy = runOcskillJSON(policyArgs, projectRoot)
+          const heartbeatStarted = Date.now()
+          const heartbeat = setInterval(() => {
+            try {
+              const args = ["work", "heartbeat", input.slug, input.task, projectRoot]
+              if (runId) args.push("--run-id", runId)
+              runOcskill(args, projectRoot)
+              void tool.progress({ status: "executor running " + Math.round((Date.now() - heartbeatStarted) / 1000) + "s" })
+            } catch {}
+          }, 30_000)
+
+          try {
+            const created = await ctx.session.create({ title: "UES " + input.slug + " " + input.task })
+            await ctx.session.switchAgent({ sessionID: created.id, agent: "ues-executor" })
+            const selectedModel = modelRef(policy?.model)
+            if (selectedModel) {
+              await ctx.session.switchModel({ sessionID: created.id, model: selectedModel })
+            }
+
+            await ctx.session.prompt({
+              sessionID: created.id,
+              text:
+                "Implement exactly this approved UES task in the current repository. " +
+                "Do not broaden scope or launch child agents. Run the declared verification and return the executor report.\n\n" +
+                JSON.stringify(started.contextPack, null, 2),
+            })
+            await ctx.session.wait({ sessionID: created.id })
+            const messages = await ctx.session.context({ sessionID: created.id })
+            return {
+              content: JSON.stringify({
+                sessionID: created.id,
+                task: input.task,
+                attempt,
+                runId,
+                taskPolicy,
+                model: policy,
+                messages: messageExcerpt(messages),
+                next: "Inspect the child diff and verification, then call ocskill work complete or fail.",
+              }, null, 2),
+            }
+          } catch (error) {
+            try {
+              const failArgs = [
+                "work", "fail", input.slug, input.task, projectRoot,
+                "--reason", "fresh executor failed: " + String(error?.message || error),
+              ]
+              if (runId) failArgs.push("--run-id", runId)
+              runOcskill(failArgs, projectRoot)
+            } catch {}
+            throw error
+          } finally {
+            clearInterval(heartbeat)
+          }
+        },
+      })
+    })
+
+    await ctx.session.hook("context", (event) => {
+      if (event.agent === "title" || event.agent === "summary" || event.agent === "compaction") return
+      event.system.push({
+        type: "text",
+        text: "UES V7 runtime: classify task complexity/risk, trust durable .ues-work state over conversation memory, use lease-backed fresh execution when supported, prefer structured verification receipts, recover stale work after interruption, and require integration evidence before completion.",
+      })
+    })
+
+    await ctx.session.hook("prompt", (event) => {
+      const config = routerConfig()
+      if (!config.enabled) return
+
+      const selected = routeSkills(event.prompt.text, config.maxSkills)
+      if (selected.length === 0) return
+
+      event.prompt.skills ??= []
+      if (!Array.isArray(event.prompt.skills)) return
+
+      for (const id of selected) {
+        if (!event.prompt.skills.includes(id)) event.prompt.skills.push(id)
+      }
+
+      event.metadata = {
+        ...event.metadata,
+        uesRouter: {
+          selected,
+          version: 3,
+        },
+      }
+    })
+
+    await ctx.permission.hook("evaluate", (event) => {
+      if (event.action !== "shell") return
+      const risk = destructiveShellRisk(event.resources.join("\n"))
+      if (!risk.risky) return
+      event.effect = "ask"
+      event.message = "UES safety gate: confirm destructive/high-impact shell action (" + risk.id + ")."
+    })
+  },
+})

package/global-config/plugins/ues-router/router.js

@@ -0,0 +1,74 @@
+function add(list, id) {
+  if (!list.includes(id)) list.push(id)
+}
+
+const PROCESS_SKILLS = new Set([
+  "ues-engineering-orchestrator",
+  "ues-long-task-state",
+  "ues-task-planner",
+  "ues-bug-diagnosis",
+  "ues-research-verification",
+  "ues-repo-explorer",
+])
+
+export function routeSkills(text, maxSkills = 4) {
+  const value = String(text || "").toLowerCase()
+  const limit = Number.isInteger(maxSkills) ? Math.max(1, Math.min(maxSkills, 6)) : 4
+  const routed = []
+  const risky = /(migration|schema|database|sql|auth|permission|security|payment|webhook|public api|contract|dependency|deploy|ci|production|rollback)/
+  const nonTrivial = value.length > 220 || risky.test(value) || /(implement|feature|refactor|fix|debug|investigate|review|audit|bug|regression|failing|failure|error|exception|broken)/.test(value)
+
+  if (nonTrivial) add(routed, "ues-engineering-orchestrator")
+  const longHorizon = value.length > 700 || /(large task|big task|long[- ]running|multi[- ]file|cross[- ]module|whole (?:repo|repository|project)|entire (?:repo|repository|project)|full refactor|refactor all|migrate all|resume this work)/.test(value)
+  if (longHorizon) {
+    add(routed, "ues-engineering-orchestrator")
+    add(routed, "ues-long-task-state")
+    add(routed, "ues-task-planner")
+  }
+  if (/(\bfix\b|\bbug\b|crash|regression|failing|failure|error|exception|broken|\bdebug\b)/.test(value)) add(routed, "ues-bug-diagnosis")
+  if (/(latest|current docs|documentation|release notes|version compatibility|dependency|package version|api changed)/.test(value)) add(routed, "ues-research-verification")
+
+  if (/(react native|expo|android|ios|gradle|xcode|metro)/.test(value)) add(routed, "ues-react-native-engineering")
+  else if (/(next\.js|nextjs|app router|server component)/.test(value)) add(routed, "ues-nextjs-engineering")
+  else if (/(\breact\b|\bhook\b|useeffect|usestate|\bcomponent\b)/.test(value)) add(routed, "ues-react-engineering")
+
+  if (/(database|migration|sql|query|index|transaction|schema changes?)/.test(value)) {
+    add(routed, "ues-database-engineering")
+    add(routed, "ues-change-impact-analysis")
+  }
+  if (/(auth|authorization|authentication|permission|role|tenant|idor|token|session)/.test(value)) {
+    add(routed, "ues-auth-security")
+    add(routed, "ues-change-impact-analysis")
+  }
+  if (/(payment|checkout|webhook|refund|idempotenc)/.test(value)) {
+    add(routed, "ues-payment-engineering")
+    add(routed, "ues-change-impact-analysis")
+  }
+  if (/(api contract|openapi|response schema|request schema|breaking api|public api)/.test(value)) {
+    add(routed, "ues-api-contract")
+    add(routed, "ues-change-impact-analysis")
+  }
+  if (/(docker|github actions|ci\/cd|pipeline|deploy|kubernetes|container)/.test(value)) add(routed, "ues-devops-engineering")
+  if (/(performance|slow|latency|memory leak|n\+1|bundle size)/.test(value)) add(routed, "ues-performance-engineering")
+  if (/(accessibility|accessible|a11y|screen reader|keyboard navigation|aria|focus management|focus handling)/.test(value)) add(routed, "ues-accessibility")
+  if (/(upload|file upload|multipart|object storage)/.test(value)) add(routed, "ues-file-upload-engineering")
+  if (/(ecommerce|marketplace|inventory|cart|catalog|order)/.test(value)) add(routed, "ues-ecommerce-engineering")
+
+  if (routed.length === 0 && /(code|repository|repo|project|function|class|endpoint|test)/.test(value)) {
+    add(routed, "ues-repo-explorer")
+  }
+
+  if (routed.length > limit) {
+    const prioritized = []
+    const domain = []
+    const process = []
+    for (const id of routed) {
+      if (id === "ues-engineering-orchestrator") prioritized.push(id)
+      else if (PROCESS_SKILLS.has(id)) process.push(id)
+      else domain.push(id)
+    }
+    return prioritized.concat(domain, process).slice(0, limit)
+  }
+
+  return routed.slice(0, limit)
+}

package/global-config/plugins/ues-router/safety.js

@@ -0,0 +1,16 @@
+const RULES = [
+  { id: "git-force", pattern: /\bgit\s+(?:push\b[^\n]*(?:--force(?:-with-lease)?|(?:^|\s)-f(?:\s|$))|reset\s+--hard|clean\s+-[^\n]*f)/i },
+  { id: "history-rewrite", pattern: /\bgit\s+(?:rebase\b|filter-branch\b|filter-repo\b)/i },
+  { id: "publish", pattern: /\b(?:npm\s+publish|pnpm\s+publish|yarn\s+npm\s+publish)\b/i },
+  { id: "destructive-files", pattern: /(?:^|[;&|]\s*)(?:rm\s+-[^\n]*r[^\n]*f|rmdir\s+\/s|del\s+\/s|remove-item\b[^\n]*-recurse[^\n]*-force)/i },
+  { id: "database-drop", pattern: /\b(?:drop\s+(?:database|schema|table)|truncate\s+table)\b/i },
+  { id: "deployment", pattern: /\b(?:kubectl\s+(?:delete|apply)|terraform\s+(?:apply|destroy)|helm\s+(?:install|upgrade|uninstall))\b/i },
+]
+
+export function destructiveShellRisk(command) {
+  const value = String(command || "")
+  for (const rule of RULES) {
+    if (rule.pattern.test(value)) return { risky: true, id: rule.id }
+  }
+  return { risky: false, id: null }
+}

package/global-config/skills/accessibility/SKILL.md

@@ -0,0 +1,10 @@
+---
+name: accessibility
+description: Improve web/mobile accessibility including semantics, keyboard behavior, labels, focus, touch targets, and screen-reader usability.
+---
+
+# Accessibility
+
+Check semantic elements/roles, labels, keyboard navigation, focus order/visibility, form errors, image alternatives, touch targets, dynamic content and reduced motion when relevant. Prefer native semantics over ARIA workarounds.
+
+Read [workflow.md](references/workflow.md) when the task reaches domain-specific behavior, compatibility, failure, or verification boundaries.

package/global-config/skills/accessibility/references/workflow.md

@@ -0,0 +1,17 @@
+# Accessibility workflow
+
+Start from the actual interaction and semantic tree, not visual appearance alone.
+
+Check:
+- native element/control semantics before adding ARIA
+- accessible name, description, state and error association
+- keyboard reachability, order, visible focus and escape from traps
+- pointer/touch target size and equivalent keyboard behavior
+- headings/landmarks and meaningful image alternatives
+- live/dynamic updates that need status or alert semantics
+- color contrast, zoom/reflow, reduced motion and text scaling
+- modal focus entry/return and background inertness
+
+For forms, connect labels, instructions, errors and invalid state to the exact field. Do not use placeholder text as the only label.
+
+Verification should include keyboard-only flow and, when available, automated accessibility checks plus at least one screen-reader or accessibility-tree inspection for the changed path. Treat automated tools as partial evidence, not proof.

package/global-config/skills/api-contract/SKILL.md

@@ -0,0 +1,12 @@
+---
+name: api-contract
+description: Keep frontend, backend, DTOs, schemas, generated clients, validation, status codes, serialization, pagination, and errors consistent end-to-end across producers and consumers.
+---
+
+# API Contract
+
+Treat an API change as a producer/consumer contract, not only a handler edit.
+
+Trace request -> validation -> handler/service -> persistence -> response serialization -> client/generated types -> UI/consumer. Compare method/path, params/query/body, required/optional/nullability, enums, status/error shapes, pagination and date/number serialization.
+
+Read [workflow.md](references/workflow.md) for compatibility analysis, source-of-truth selection, generated clients, error semantics and contract verification.

package/global-config/skills/api-contract/references/workflow.md

@@ -0,0 +1,17 @@
+# API contract workflow
+
+Identify the contract source of truth: OpenAPI/schema/protobuf/generated types/server DTOs or repository convention. Do not create a second conflicting truth.
+
+Before editing, map all known producers and consumers. Classify each field/change:
+- additive optional
+- additive required
+- rename/remove
+- type/nullability/enum change
+- semantic change with same type
+- status/error/pagination change
+
+Backward compatibility depends on consumer behavior, not only type compatibility. A new enum value can break exhaustive clients; changing null to missing can break serializers; changing 404 to 200-empty can alter control flow.
+
+Update generated clients through the repository's generator rather than hand-editing generated files.
+
+Verification should cover provider validation/serialization and at least one real consumer or contract test. Test error/status shapes and boundary serialization, not only the success body.

package/global-config/skills/auth-security/SKILL.md

@@ -0,0 +1,12 @@
+---
+name: auth-security
+description: Implement and review authentication, authorization, sessions, tokens, passwords, permissions, roles, secrets, and security-sensitive APIs with server-side enforcement.
+---
+
+# Auth Security
+
+Separate authentication (who) from authorization (may do what). Identify the trust boundary and enforce permissions on the server for every protected object/action; UI hiding is never authorization.
+
+Inspect session/token creation, validation, rotation/revocation, expiry, password storage, cookies/CSRF/CORS, object-level access, redirects, secrets and error leakage as relevant to the stack.
+
+Read [workflow.md](references/workflow.md) for threat questions, IDOR/object ownership, session/token invariants, web cookie controls, and negative verification.

package/global-config/skills/auth-security/references/workflow.md

@@ -0,0 +1,15 @@
+# Auth/security workflow
+
+Map: credential/session source -> authentication middleware -> identity -> authorization policy -> protected resource/action.
+
+Ask:
+- Can an unauthenticated caller reach the action?
+- Can an authenticated user change an identifier and access another user's object (IDOR)?
+- Is role/tenant/resource ownership checked at the server boundary that performs the action?
+- Are token/session expiry, revocation, rotation and replay properties consistent with the design?
+- For cookie auth, are Secure/HttpOnly/SameSite and CSRF protections appropriate to the request model?
+- Are CORS and redirect allowlists narrowly scoped?
+- Are password hashes using the project's approved adaptive algorithm/settings?
+- Can logs/errors expose credentials, tokens or sensitive data?
+
+Verification must include negative cases: missing auth, wrong role/tenant/owner, expired/revoked session/token and malformed input where relevant. Do not weaken controls to make tests or local development pass.

package/global-config/skills/bug-diagnosis/SKILL.md

@@ -0,0 +1,28 @@
+---
+name: bug-diagnosis
+description: Diagnose runtime errors, build failures, regressions, failing tests, integration issues, crashes, and incorrect behavior through reproducible evidence and root-cause hypotheses before fixing.
+---
+
+# Bug Diagnosis
+
+Do not patch the first visible symptom.
+
+## 1. Establish the failure
+
+Capture the exact error, failing command, reproduction steps, environment/version clues, and recent relevant diff. If the issue is intermittent, gather enough evidence to identify the changing condition.
+
+## 2. Trace cause
+
+Find where the bad value/state first becomes wrong. In multi-component flows, inspect boundaries one at a time: input, output, configuration, ownership, and assumptions. Find a nearby working analogue and compare meaningful differences.
+
+## 3. Test one hypothesis
+
+State one causal hypothesis and why the evidence supports it. Make the smallest diagnostic or code change that can confirm/refute it. Do not bundle multiple speculative fixes.
+
+## 4. Fix and prove
+
+When practical, add a focused failing regression test or reproduction. Fix the earliest supported cause, rerun the exact failure, then run adjacent checks.
+
+If two fixes fail, stop stacking changes and restart the investigation from fresh evidence. If three distinct hypotheses fail or the fixes expose widening coupling, surface the architectural assumption before another broad edit.
+
+Never use cache clearing, lockfile deletion, disabled checks, or dependency upgrades as generic debugging rituals without evidence.

package/global-config/skills/change-impact-analysis/SKILL.md

@@ -0,0 +1,23 @@
+---
+name: change-impact-analysis
+description: Map the blast radius of cross-module, public-contract, schema, auth, payment, migration, or shared-library changes before editing and before final review.
+---
+
+# Change Impact Analysis
+
+For changes that cross a boundary, identify both producers and consumers. If `ocskill` is available, use `ocskill impact <term>` as a bounded evidence pass, then validate important matches with exact repository reads/callers.
+
+Map:
+- entry point and changed contract
+- direct callers/importers/clients
+- persisted data or schema assumptions
+- validation/error behavior
+- configuration/environment dependencies
+- tests/fixtures/mocks
+- generated code or documentation
+- compatibility, migration, and rollback concerns
+
+Before editing, identify the smallest safe boundary for the change.
+After editing, inspect the diff and re-run the map: confirm every affected consumer was either updated, proven compatible, or explicitly left unchanged for a reason.
+
+Do not infer "no impact" merely because compilation succeeds.

package/global-config/skills/code-review/SKILL.md

@@ -0,0 +1,19 @@
+---
+name: code-review
+description: Review changed code for real defects and regressions with context-aware evidence, prioritizing correctness, data loss, security, contracts, state/races, performance, and missing verification over style noise.
+---
+
+# Code Review
+
+Review the actual diff and enough surrounding context to validate each finding.
+
+Prioritize:
+1. correctness, data loss, and broken invariants
+2. security, authentication, and permission boundaries
+3. API, schema, type, and compatibility mismatches
+4. error handling, edge cases, races, and state bugs
+5. plausible performance regressions
+6. maintainability problems that create concrete risk
+7. missing or misleading verification
+
+For each material finding include the location, evidence, impact, and a practical fix direction. Distinguish confirmed defects from risks or uncertainty. Check callers or contracts before asserting an issue. Prefer a few high-signal findings over speculative volume. Do not nitpick formatting already enforced by tooling.

package/global-config/skills/context-engineering/SKILL.md

@@ -0,0 +1,18 @@
+---
+name: context-engineering
+description: Control context in large or unfamiliar repositories by building a compact evidence map, reading only relevant interfaces and analogues, and avoiding repeated low-value file loading.
+---
+
+# Context Engineering
+
+Build a working set instead of reading the repository indiscriminately.
+
+1. Read applicable instructions and manifests.
+2. Locate the task entry point and exact symbols/errors involved.
+3. Find the nearest working analogue before inventing a new pattern.
+4. Trace only direct callers, dependencies, contracts, tests, and configuration needed to explain the behavior.
+5. Summarize findings as paths, interfaces, constraints, and open questions before expanding scope.
+6. Prefer targeted search and line ranges over whole-tree dumps.
+7. Reuse established findings; do not reread large unchanged files without a reason.
+
+For monorepos or deep dependency graphs, read [large-repo.md](references/large-repo.md).

package/global-config/skills/context-engineering/references/large-repo.md

@@ -0,0 +1,16 @@
+# Large repository strategy
+
+Start with a compact map:
+
+- repository instructions
+- package/workspace manifests
+- package containing the entry point
+- direct dependency packages
+- nearest analogous implementation
+- relevant tests and build scripts
+
+Then follow edges only when evidence requires it.
+
+Prefer interface boundaries (types, public functions, route/service contracts, schemas) over implementation detail until a boundary is implicated. When a search returns many matches, narrow by package/import/caller rather than opening every result.
+
+Before a major new read, ask: what uncertainty will this file resolve? If the answer is unclear, do not load it yet.

package/global-config/skills/database-engineering/SKILL.md

@@ -0,0 +1,12 @@
+---
+name: database-engineering
+description: Design and modify schemas, migrations, indexes, queries, ORM models, transactions, and data integrity with compatibility, rollback, and existing-data safety.
+---
+
+# Database Engineering
+
+Inspect the actual database/ORM, migration history, production-relevant query patterns, and existing data assumptions before editing.
+
+Treat schema constraints, nullability/defaults, foreign keys/cascades, uniqueness, transactions, locking/concurrency, indexes, migration ordering, data backfill and rollback as explicit invariants. Do not infer migration safety from compilation.
+
+Read [workflow.md](references/workflow.md) for expand/contract migrations, query/index analysis, transaction boundaries, data backfills, and verification.

package/global-config/skills/database-engineering/references/workflow.md

@@ -0,0 +1,15 @@
+# Database engineering workflow
+
+## Schema change
+Map old readers/writers and new readers/writers. For live systems prefer compatible expand -> backfill -> switch -> contract sequencing when one-step migration could break mixed versions.
+
+Check existing rows before adding NOT NULL/unique/foreign-key constraints. Separate schema migration from expensive data backfill when operational risk warrants it.
+
+## Queries and indexes
+Use real filter/join/order patterns. An index should support an observed query shape; avoid speculative indexes. Watch N+1 ORM access, full-table scans, unbounded result sets and lock amplification.
+
+## Transactions
+Define the invariant and the smallest atomic boundary. Consider retries, unique conflicts, lost updates, isolation behavior and external side effects that cannot roll back with the database.
+
+## Verification
+Validate migration up/down strategy when supported, run affected data tests, and inspect generated SQL/schema diff. For risky changes use representative existing data or a dry run. Confirm old/new application compatibility when rollout can overlap.

package/global-config/skills/dependency-management/SKILL.md

@@ -0,0 +1,12 @@
+---
+name: dependency-management
+description: Change dependencies safely by verifying package legitimacy, pinned/current compatibility, peer/runtime constraints, release guidance, lockfiles, supply-chain surface, and the smallest necessary version movement.
+---
+
+# Dependency Management
+
+Identify package manager, lockfile, runtime/framework versions and the concrete reason a dependency change is needed.
+
+Verify package identity and the intended version using registry/primary sources when current information matters. Prefer the smallest compatible movement, read migration guidance for behavior-changing upgrades, and avoid opportunistic dependency churn.
+
+Read [workflow.md](references/workflow.md) for compatibility evidence, lockfile discipline, transitive/supply-chain impact and verification.

package/global-config/skills/dependency-management/references/workflow.md

@@ -0,0 +1,14 @@
+# Dependency management workflow
+
+Before adding/upgrading:
+- confirm the package name is legitimate and maintained enough for the use case
+- inspect repository runtime/framework constraints
+- check peer dependencies, engines and platform/native requirements
+- compare current -> target release notes/migration guide for breaking or behavior changes
+- identify whether the change is direct or only needed transitively
+
+Use the repository package manager to update manifests/lockfiles; do not hand-edit lock resolution unless the ecosystem requires it.
+
+For major upgrades, map deprecated APIs and affected imports/config before changing the version. Keep unrelated packages stable.
+
+Verification should include a clean/locked install or package-manager resolution check, affected tests/build/typecheck, and runtime smoke for behavior-sensitive upgrades. If a security advisory motivates the change, verify the fixed version range from a primary advisory/registry source rather than guessing.

package/global-config/skills/devops-engineering/SKILL.md

@@ -0,0 +1,10 @@
+---
+name: devops-engineering
+description: Work on Docker, CI/CD, build pipelines, environment config, deployment, health checks, logging, and infrastructure-related files.
+---
+
+# Devops Engineering
+
+Inspect current deployment/runtime assumptions. Check reproducible builds, secrets, health/readiness, build caching, CI visibility, migration ordering, rollback and environment parity. Do not deploy production or rotate secrets without explicit intent.
+
+Read [workflow.md](references/workflow.md) when the task reaches domain-specific behavior, compatibility, failure, or verification boundaries.

package/global-config/skills/devops-engineering/references/workflow.md

@@ -0,0 +1,11 @@
+# DevOps engineering workflow
+
+Map source -> build artifact -> deploy unit -> runtime dependencies -> health signal -> rollback path.
+
+For containers, inspect build context, multi-stage boundaries, pinned base/runtime versions, non-root execution when practical, signal handling, health checks, secret injection and cache-invalidating COPY order.
+
+For CI, compare local and runner OS/runtime/tool versions, environment variables, working directories, permissions, caches, artifacts and service dependencies. Diagnose the first failing step rather than rewriting the pipeline broadly.
+
+For deployments, separate build-time from runtime configuration, sequence schema migrations safely, define readiness before traffic, preserve old/new compatibility during rolling changes, and keep rollback independent of destructive data changes.
+
+Verification should validate configuration syntax, run the closest representative build/job locally when possible, inspect produced artifacts, and exercise health/readiness/failure behavior. Never print or commit secrets.