opencode-skills-collection 3.1.6 → 3.1.8

package/bundled-skills/macos-spm-app-packaging/assets/templates/sign-and-notarize.sh

@@ -13,8 +13,13 @@ if [[ -z "${APP_STORE_CONNECT_API_KEY_P8:-}" || -z "${APP_STORE_CONNECT_KEY_ID:-
   exit 1
 fi
 
-echo "$APP_STORE_CONNECT_API_KEY_P8" | sed 's/\\n/\n/g' > /tmp/app-store-connect-key.p8
-trap 'rm -f /tmp/app-store-connect-key.p8 /tmp/${APP_NAME}Notarize.zip' EXIT
+TEMP_DIR=$(mktemp -d)
+chmod 700 "$TEMP_DIR"
+KEY_PATH="$TEMP_DIR/app-store-connect-key.p8"
+NOTARY_ZIP="$TEMP_DIR/${APP_NAME}Notarize.zip"
+trap 'rm -rf "$TEMP_DIR"' EXIT
+
+echo "$APP_STORE_CONNECT_API_KEY_P8" | sed 's/\\n/\n/g' > "$KEY_PATH"
 
 ARCHES_VALUE=${ARCHES:-"arm64 x86_64"}
 ARCH_LIST=( ${ARCHES_VALUE} )
@@ -31,10 +36,10 @@ codesign --force --timestamp --options runtime --sign "$APP_IDENTITY" \
   "$APP_BUNDLE"
 
 DITTO_BIN=${DITTO_BIN:-/usr/bin/ditto}
-"$DITTO_BIN" --norsrc -c -k --keepParent "$APP_BUNDLE" "/tmp/${APP_NAME}Notarize.zip"
+"$DITTO_BIN" --norsrc -c -k --keepParent "$APP_BUNDLE" "$NOTARY_ZIP"
 
-xcrun notarytool submit "/tmp/${APP_NAME}Notarize.zip" \
-  --key /tmp/app-store-connect-key.p8 \
+xcrun notarytool submit "$NOTARY_ZIP" \
+  --key "$KEY_PATH" \
   --key-id "$APP_STORE_CONNECT_KEY_ID" \
   --issuer "$APP_STORE_CONNECT_ISSUER_ID" \
   --wait

package/bundled-skills/pptx-official/ooxml/scripts/pack.py

@@ -16,6 +16,17 @@ import zipfile
 from pathlib import Path
 
 
+def validate_input_tree(input_dir: Path):
+    root = input_dir.resolve(strict=True)
+    for path in input_dir.rglob("*"):
+        if path.is_symlink():
+            raise ValueError(f"Refusing to pack symlink: {path}")
+        try:
+            path.resolve(strict=True).relative_to(root)
+        except (OSError, ValueError):
+            raise ValueError(f"Refusing to pack path outside input directory: {path}") from None
+
+
 def main():
     parser = argparse.ArgumentParser(description="Pack a directory into an Office file")
     parser.add_argument("input_directory", help="Unpacked Office document directory")
@@ -60,6 +71,7 @@ def pack_document(input_dir, output_file, validate=False):
         raise ValueError(f"{input_dir} is not a directory")
     if output_file.suffix.lower() not in {".docx", ".pptx", ".xlsx"}:
         raise ValueError(f"{output_file} must be a .docx, .pptx, or .xlsx file")
+    validate_input_tree(input_dir)
 
     # Work in temporary directory to avoid modifying original
     with tempfile.TemporaryDirectory() as temp_dir:

package/bundled-skills/pptx-official/ooxml/scripts/unpack.py

@@ -8,6 +8,11 @@ import sys
 import zipfile
 from pathlib import Path
 
+MAX_ARCHIVE_MEMBERS = 5000
+MAX_MEMBER_SIZE = 100 * 1024 * 1024
+MAX_TOTAL_UNCOMPRESSED = 512 * 1024 * 1024
+MAX_COMPRESSION_RATIO = 1000
+
 
 def _is_zip_symlink(member: zipfile.ZipInfo) -> bool:
     return stat.S_ISLNK(member.external_attr >> 16)
@@ -29,19 +34,35 @@ def _extract_member(archive: zipfile.ZipFile, member: zipfile.ZipInfo, output_ro
         shutil.copyfileobj(source, target)
 
 
+def _validate_archive_members(archive: zipfile.ZipFile, output_root: Path):
+    members = archive.infolist()
+    if len(members) > MAX_ARCHIVE_MEMBERS:
+        raise ValueError("Archive contains too many entries")
+
+    total_size = 0
+    for member in members:
+        if _is_zip_symlink(member):
+            raise ValueError(f"Unsafe archive entry: {member.filename}")
+        if not _is_safe_destination(output_root, member.filename):
+            raise ValueError(f"Unsafe archive entry: {member.filename}")
+        if member.file_size > MAX_MEMBER_SIZE:
+            raise ValueError(f"Archive entry too large: {member.filename}")
+        total_size += member.file_size
+        if total_size > MAX_TOTAL_UNCOMPRESSED:
+            raise ValueError("Archive uncompressed size is too large")
+        if member.compress_size and member.file_size / member.compress_size > MAX_COMPRESSION_RATIO:
+            raise ValueError(f"Archive entry compression ratio too high: {member.filename}")
+
+    return members
+
+
 def extract_archive_safely(input_file: str | Path, output_dir: str | Path):
     output_path = Path(output_dir)
     output_path.mkdir(parents=True, exist_ok=True)
     output_root = output_path.resolve()
 
     with zipfile.ZipFile(input_file) as archive:
-        for member in archive.infolist():
-            if _is_zip_symlink(member):
-                raise ValueError(f"Unsafe archive entry: {member.filename}")
-            if not _is_safe_destination(output_root, member.filename):
-                raise ValueError(f"Unsafe archive entry: {member.filename}")
-
-        for member in archive.infolist():
+        for member in _validate_archive_members(archive, output_root):
             _extract_member(archive, member, output_path)
 
 

package/bundled-skills/pptx-official/ooxml/scripts/validation/base.py

@@ -9,6 +9,14 @@ from pathlib import Path
 import lxml.etree
 
 
+def hardened_xml_parser():
+    return lxml.etree.XMLParser(resolve_entities=False, no_network=True, load_dtd=False, huge_tree=False)
+
+
+def parse_xml(source, **kwargs):
+    return lxml.etree.parse(source, parser=hardened_xml_parser(), **kwargs)
+
+
 def safe_extract_all(zip_ref, destination):
     """Extract a zip archive without allowing members to escape destination."""
     destination = Path(destination).resolve()
@@ -149,7 +157,7 @@ class BaseSchemaValidator:
         for xml_file in self.xml_files:
             try:
                 # Try to parse the XML file
-                lxml.etree.parse(str(xml_file))
+                parse_xml(str(xml_file))
             except lxml.etree.XMLSyntaxError as e:
                 errors.append(
                     f"  {xml_file.relative_to(self.unpacked_dir)}: "
@@ -177,7 +185,7 @@ class BaseSchemaValidator:
 
         for xml_file in self.xml_files:
             try:
-                root = lxml.etree.parse(str(xml_file)).getroot()
+                root = parse_xml(str(xml_file)).getroot()
                 declared = set(root.nsmap.keys()) - {None}  # Exclude default namespace
 
                 for attr_val in [
@@ -208,7 +216,7 @@ class BaseSchemaValidator:
 
         for xml_file in self.xml_files:
             try:
-                root = lxml.etree.parse(str(xml_file)).getroot()
+                root = parse_xml(str(xml_file)).getroot()
                 file_ids = {}  # Track IDs that must be unique within this file
 
                 # Remove all mc:AlternateContent elements from the tree
@@ -328,7 +336,7 @@ class BaseSchemaValidator:
         for rels_file in rels_files:
             try:
                 # Parse relationships file
-                rels_root = lxml.etree.parse(str(rels_file)).getroot()
+                rels_root = parse_xml(str(rels_file)).getroot()
 
                 # Get the directory where this .rels file is located
                 rels_dir = rels_file.parent
@@ -429,7 +437,7 @@ class BaseSchemaValidator:
 
             try:
                 # Parse the .rels file to get valid relationship IDs and their types
-                rels_root = lxml.etree.parse(str(rels_file)).getroot()
+                rels_root = parse_xml(str(rels_file)).getroot()
                 rid_to_type = {}
 
                 for rel in rels_root.findall(
@@ -452,7 +460,7 @@ class BaseSchemaValidator:
                         rid_to_type[rid] = type_name
 
                 # Parse the XML file to find all r:id references
-                xml_root = lxml.etree.parse(str(xml_file)).getroot()
+                xml_root = parse_xml(str(xml_file)).getroot()
 
                 # Find all elements with r:id attributes
                 for elem in xml_root.iter():
@@ -549,7 +557,7 @@ class BaseSchemaValidator:
 
         try:
             # Parse and get all declared parts and extensions
-            root = lxml.etree.parse(str(content_types_file)).getroot()
+            root = parse_xml(str(content_types_file)).getroot()
             declared_parts = set()
             declared_extensions = set()
 
@@ -611,7 +619,7 @@ class BaseSchemaValidator:
                     continue
 
                 try:
-                    root_tag = lxml.etree.parse(str(xml_file)).getroot().tag
+                    root_tag = parse_xml(str(xml_file)).getroot().tag
                     root_name = root_tag.split("}")[-1] if "}" in root_tag else root_tag
 
                     if root_name in declarable_roots and path_str not in declared_parts:
@@ -850,15 +858,12 @@ class BaseSchemaValidator:
         try:
             # Load schema
             with open(schema_path, "rb") as xsd_file:
-                parser = lxml.etree.XMLParser()
-                xsd_doc = lxml.etree.parse(
-                    xsd_file, parser=parser, base_url=str(schema_path)
-                )
+                xsd_doc = parse_xml(xsd_file, base_url=str(schema_path))
                 schema = lxml.etree.XMLSchema(xsd_doc)
 
             # Load and preprocess XML
             with open(xml_file, "r") as f:
-                xml_doc = lxml.etree.parse(f)
+                xml_doc = parse_xml(f)
 
             xml_doc, _ = self._remove_template_tags_from_text_nodes(xml_doc)
             xml_doc = self._preprocess_for_mc_ignorable(xml_doc)

package/bundled-skills/pptx-official/ooxml/scripts/validation/docx.py

@@ -10,7 +10,7 @@ from pathlib import Path
 
 import lxml.etree
 
-from .base import BaseSchemaValidator
+from .base import BaseSchemaValidator, parse_xml
 
 
 def safe_extract_all(zip_ref, destination):
@@ -100,7 +100,7 @@ class DOCXSchemaValidator(BaseSchemaValidator):
                 continue
 
             try:
-                root = lxml.etree.parse(str(xml_file)).getroot()
+                root = parse_xml(str(xml_file)).getroot()
 
                 # Find all w:t elements
                 for elem in root.iter(f"{{{self.WORD_2006_NAMESPACE}}}t"):
@@ -153,7 +153,7 @@ class DOCXSchemaValidator(BaseSchemaValidator):
                 continue
 
             try:
-                root = lxml.etree.parse(str(xml_file)).getroot()
+                root = parse_xml(str(xml_file)).getroot()
 
                 # Find all w:t elements that are descendants of w:del elements
                 namespaces = {"w": self.WORD_2006_NAMESPACE}
@@ -199,7 +199,7 @@ class DOCXSchemaValidator(BaseSchemaValidator):
                 continue
 
             try:
-                root = lxml.etree.parse(str(xml_file)).getroot()
+                root = parse_xml(str(xml_file)).getroot()
                 # Count all w:p elements
                 paragraphs = root.findall(f".//{{{self.WORD_2006_NAMESPACE}}}p")
                 count = len(paragraphs)
@@ -221,7 +221,7 @@ class DOCXSchemaValidator(BaseSchemaValidator):
 
                 # Parse document.xml
                 doc_xml_path = temp_dir + "/word/document.xml"
-                root = lxml.etree.parse(doc_xml_path).getroot()
+                root = parse_xml(doc_xml_path).getroot()
 
                 # Count all w:p elements
                 paragraphs = root.findall(f".//{{{self.WORD_2006_NAMESPACE}}}p")
@@ -244,7 +244,7 @@ class DOCXSchemaValidator(BaseSchemaValidator):
                 continue
 
             try:
-                root = lxml.etree.parse(str(xml_file)).getroot()
+                root = parse_xml(str(xml_file)).getroot()
                 namespaces = {"w": self.WORD_2006_NAMESPACE}
 
                 # Find w:delText in w:ins that are NOT within w:del

package/bundled-skills/pptx-official/ooxml/scripts/validation/pptx.py

@@ -4,7 +4,7 @@ Validator for PowerPoint presentation XML files against XSD schemas.
 
 import re
 
-from .base import BaseSchemaValidator
+from .base import BaseSchemaValidator, parse_xml
 
 
 class PPTXSchemaValidator(BaseSchemaValidator):
@@ -86,7 +86,7 @@ class PPTXSchemaValidator(BaseSchemaValidator):
 
         for xml_file in self.xml_files:
             try:
-                root = lxml.etree.parse(str(xml_file)).getroot()
+                root = parse_xml(str(xml_file)).getroot()
 
                 # Check all elements for ID attributes
                 for elem in root.iter():
@@ -142,7 +142,7 @@ class PPTXSchemaValidator(BaseSchemaValidator):
         for slide_master in slide_masters:
             try:
                 # Parse the slide master file
-                root = lxml.etree.parse(str(slide_master)).getroot()
+                root = parse_xml(str(slide_master)).getroot()
 
                 # Find the corresponding _rels file for this slide master
                 rels_file = slide_master.parent / "_rels" / f"{slide_master.name}.rels"
@@ -155,7 +155,7 @@ class PPTXSchemaValidator(BaseSchemaValidator):
                     continue
 
                 # Parse the relationships file
-                rels_root = lxml.etree.parse(str(rels_file)).getroot()
+                rels_root = parse_xml(str(rels_file)).getroot()
 
                 # Build a set of valid relationship IDs that point to slide layouts
                 valid_layout_rids = set()
@@ -209,7 +209,7 @@ class PPTXSchemaValidator(BaseSchemaValidator):
 
         for rels_file in slide_rels_files:
             try:
-                root = lxml.etree.parse(str(rels_file)).getroot()
+                root = parse_xml(str(rels_file)).getroot()
 
                 # Find all slideLayout relationships
                 layout_rels = [
@@ -258,7 +258,7 @@ class PPTXSchemaValidator(BaseSchemaValidator):
         for rels_file in slide_rels_files:
             try:
                 # Parse the relationships file
-                root = lxml.etree.parse(str(rels_file)).getroot()
+                root = parse_xml(str(rels_file)).getroot()
 
                 # Find all notesSlide relationships
                 for rel in root.findall(

package/bundled-skills/premium-3d-website/SKILL.md

@@ -0,0 +1,133 @@
+---
+name: premium-3d-website
+description: Guidelines for building premium 3D websites, focusing on custom WebGL shaders, post-processing, physics-based interactions, smooth animations, preloaders, and device optimization.
+category: frontend
+risk: safe
+source: self
+source_type: self
+date_added: "2026-06-25"
+author: Rsmiyani
+tags: [threejs, webgl, shaders, post-processing, creative-coding, premium-design]
+tools: [claude, cursor, gemini]
+---
+
+# Premium 3D Website
+
+## Overview
+
+This skill provides architectural guidelines and code patterns for developing premium, high-end 3D websites. It targets developers looking to implement advanced WebGL visual effects, custom shader pipelines, interactive physics elements, and immersive page transitions while maintaining high performance.
+
+## When to Use This Skill
+
+- Use when designing premium or award-winning creative websites with 3D elements.
+- Use when integrating Three.js, React Three Fiber (R3F), or Spline with custom shaders (GLSL).
+- Use when implementing post-processing effects like bloom, depth-of-field, or custom film grain.
+- Use when designing interactive preloaders and high-performance asset loading strategies.
+- Use when optimizing complex 3D scenes for mobile responsiveness and performance.
+
+## How It Works
+
+### Step 1: Establish the Render Loop and Scene Architecture
+Setting up a robust WebGL context with proper resize handling and performance-friendly pixel ratios is crucial. Keep pixel ratios capped at a maximum of 2 to avoid rendering too many pixels on high-DPI screens.
+
+### Step 2: Implement Shader Effects and Post-Processing
+Incorporate post-processing pipelines (using `EffectComposer` or `@react-three/postprocessing`) to add bloom, chromatic aberration, depth of field, or film grain. Keep pass counts low and combine custom fragment shaders to minimize draw calls.
+
+### Step 3: Integrate Interactive Physics and Motion
+Utilize physics frameworks (such as Cannon.js or Rapier) or procedural spring animations to make 3D objects react to mouse hover, drag, and click inputs with organic feedback.
+
+### Step 4: Asset Pipeline and Preloader
+Optimize 3D models (using Draco compression) and load them using custom loading managers. Render interactive preloaders to entertain users while heavy assets are fetched in the background.
+
+## Examples
+
+### Example 1: Custom Post-processing in React Three Fiber (R3F)
+
+```jsx
+import { Canvas } from '@react-three/fiber';
+import { EffectComposer, Bloom, DepthOfField, Vignette } from '@react-three/postprocessing';
+
+export default function PremiumComposer() {
+  return (
+    <Canvas dpr={[1, 2]} gl={{ powerPreference: "high-performance", antialias: false }}>
+      <ambientLight intensity={0.5} />
+      <mesh>
+        <boxGeometry />
+        <meshStandardMaterial emissive="orange" emissiveIntensity={2.0} />
+      </mesh>
+      
+      <EffectComposer disableNormalPass>
+        <DepthOfField focusDistance={0} focalLength={0.02} bokehScale={2} height={480} />
+        <Bloom luminanceThreshold={0.3} luminanceSmoothing={0.9} height={300} />
+        <Vignette eskil={false} offset={0.1} darkness={1.1} />
+      </EffectComposer>
+    </Canvas>
+  );
+}
+```
+
+### Example 2: Custom GLSL Shader Material for Liquid/Wavy Effects
+
+```javascript
+import * as THREE from 'three';
+
+const CustomWavyMaterial = new THREE.ShaderMaterial({
+  vertexShader: `
+    varying vec2 vUv;
+    uniform float uTime;
+    void main() {
+      vUv = uv;
+      vec3 pos = position;
+      pos.z += sin(pos.x * 5.0 + uTime) * 0.1;
+      pos.z += cos(pos.y * 5.0 + uTime) * 0.1;
+      gl_Position = projectionMatrix * modelViewMatrix * vec4(pos, 1.0);
+    }
+  `,
+  fragmentShader: `
+    varying vec2 vUv;
+    uniform float uTime;
+    uniform vec3 uColor;
+    void main() {
+      float pulse = 0.5 + 0.5 * sin(uTime + vUv.x * 10.0);
+      gl_FragColor = vec4(uColor * pulse, 1.0);
+    }
+  `,
+  uniforms: {
+    uTime: { value: 0.0 },
+    uColor: { value: new THREE.Color('#3b82f6') }
+  }
+});
+```
+
+## Best Practices
+
+- ✅ Set `dpr={[1, 2]}` to restrict the device pixel ratio to a maximum of 2.
+- ✅ Disable antialiasing on the WebGLRenderer when post-processing is active to prevent double-aliasing performance penalties.
+- ✅ Bake ambient occlusion, lighting, and shadows into textures using Blender or other 3D software instead of using dynamic lights and real-time shadows.
+- ✅ Use instance rendering (`THREE.InstancedMesh` or R3F `<Instances>`) for scenes containing multiple identical meshes.
+- ❌ Avoid using uncompressed GLTF/OBJ models. Always compress models using Draco or Meshopt.
+- ❌ Avoid real-time shadow maps (such as `THREE.DirectionalLightShadow`) on mobile or low-end devices due to the heavy performance overhead.
+
+## Limitations
+
+- This skill does not replace environment-specific validation, testing, or expert review.
+- Stop and ask for clarification if required inputs, permissions, or safety boundaries are missing.
+- Complex shader mathematics and advanced physics simulation bounds require manual testing across different device chipsets.
+
+## Security & Safety Notes
+
+- Verify that external 3D model URLs (loaded via `GLTFLoader`) are hosted on trusted, secure CDNs (HTTPS).
+- Do not execute arbitrary, unvalidated shell scripts or use unpinned NPM packages to optimize assets.
+
+## Common Pitfalls
+
+- **Problem**: Severe lag/framerate drop on mobile or high-DPI (Retina) screens.
+  **Solution**: Ensure the pixel ratio is limited to 2 (`renderer.setPixelRatio(Math.min(window.devicePixelRatio, 2))`) and disable unused post-processing passes.
+- **Problem**: Long loading times and white screens during initialization.
+  **Solution**: Use a loading manager (`THREE.LoadingManager`) and display a responsive, interactive preloader to keep the user engaged.
+
+## Related Skills
+
+- `@3d-web-experience` - Core WebGL, Three.js, and Spline concepts.
+- `@scroll-experience` - Integrating 3D animation with scroll controllers.
+- `@performance-optimizer` - General code execution performance tuning.

package/bundled-skills/review-animations/SKILL.md

@@ -0,0 +1,139 @@
+---
+name: review-animations
+description: "Use when reviewing animation and motion code against a strict craft, performance, accessibility, and interaction-quality bar."
+category: frontend
+risk: safe
+source: community
+source_repo: emilkowalski/skills
+source_type: community
+date_added: "2026-06-25"
+author: Emil Kowalski
+license: MIT
+license_source: "https://github.com/emilkowalski/skills/blob/main/LICENSE.txt"
+tags: [frontend, animation, motion, review, accessibility]
+tools: [claude, cursor, codex, antigravity]
+disable-model-invocation: true
+---
+
+# Reviewing Animations
+
+## When to Use
+
+- Use when the user asks for an animation, motion, or interaction review.
+- Use when a frontend diff changes CSS transitions, keyframes, Framer Motion, WAAPI, hover effects, gestures, toasts, modals, drawers, popovers, or loaders.
+- Use when motion quality, perceived performance, interruptibility, reduced-motion behavior, or animation origin needs a strict review verdict.
+
+## Limitations
+
+- This skill reviews motion and animation only; it should not replace a general code review, accessibility audit, or product design critique.
+- It does not implement fixes unless the user separately asks for code changes.
+- Final approval may still require browser, slow-motion, and real-device testing for gestures and highly visual interactions.
+
+## Examples
+
+Ask for this skill when you need a table of concrete motion findings, suggested fixes, and an explicit Block or Approve verdict for changed animation code.
+
+A specialized review skill. It does ONE thing: review animation and motion code against a high craft bar. It does not write features, fix unrelated bugs, or review non-motion code. If asked to review general code, decline and point to a general review skill.
+
+## Operating Posture
+
+You are a senior motion-design reviewer with a brutal eye for craft. Your bias is toward **motion that feels right**, not motion that merely runs. A transition that "works" but feels sluggish, lands from the wrong origin, fires too often, or drops frames is a regression, not a pass. Default to flagging. Approval is earned, not assumed.
+
+The substantive bar comes from Emil Kowalski's animation philosophy (animations.dev). The review *method* — non-negotiable standards, escalation triggers, a remedial hierarchy, tiered output, and explicit approval criteria — is adapted from aggressive code-quality review.
+
+For the full rule catalog (easing curves, duration tables, spring config, gestures, clip-path, performance, a11y), see [STANDARDS.md](STANDARDS.md). Load it whenever a finding needs a precise value or citation.
+
+## The Ten Non-Negotiable Standards
+
+Every animation in the diff is measured against these. A violation is a finding.
+
+1. **Justified motion.** Every animation must answer "why does this animate?" — spatial consistency, state indication, feedback, explanation, or preventing a jarring change. "It looks cool" on a frequently-seen element is a block.
+
+2. **Frequency-appropriate.** Match motion to how often it's seen. Keyboard-initiated and 100+/day actions get **no** animation. Tens/day gets reduced motion. Occasional gets standard. Rare/first-time can have delight.
+
+3. **Responsive easing.** Entering/exiting elements use `ease-out` or a strong custom curve. `ease-in` on UI is a block — it delays the moment the user watches most. Built-in CSS easings are too weak; expect custom cubic-beziers.
+
+4. **Sub-300ms UI.** UI animations stay under 300ms; anything slower on a UI element needs justification or it's a finding. Per-element budgets live in [STANDARDS.md](STANDARDS.md).
+
+5. **Origin & physical correctness.** Popovers/dropdowns/tooltips scale from their trigger (`transform-origin`), not center. Never animate from `scale(0)` — start from `scale(0.9–0.97)` + opacity (Modals are exempt — they stay centered.)
+
+6. **Interruptibility.** Rapidly-triggered or gesture-driven motion (toasts, toggles, drags) must be interruptible — CSS transitions or springs that retarget from current state, not keyframes that restart from zero.
+
+7. **GPU-only properties.** Animate `transform` and `opacity` only. Animating `width`/`height`/`margin`/`padding`/`top`/`left` (or Framer Motion `x`/`y`/`scale` shorthands under load) is a performance finding.
+
+8. **Accessibility.** `prefers-reduced-motion` is honored (gentler, not zero — keep opacity/color, drop movement). Hover animations are gated behind `@media (hover: hover) and (pointer: fine)`.
+
+9. **Asymmetric enter/exit.** Deliberate actions (a press, a hold, a destructive confirm) animate slower; system responses snap. Symmetric timing on a press-and-release or hold interaction is a finding.
+
+10. **Cohesion.** Motion matches the component's personality and the rest of the product — playful can be bouncier, a dashboard stays crisp. Mismatched personality, or a jarring crossfade where a subtle blur would bridge two states, is a finding. When unsure whether motion feels right, the strongest move is often to delete it.
+
+## Aggressive Escalation Triggers
+
+Flag these on sight, hard:
+
+- `transition: all` (unbounded property animation)
+- `scale(0)` or pure-fade entrances with no initial transform
+- `ease-in` on any UI interaction; weak built-in easing on a deliberate animation
+- Animation on a keyboard shortcut, command-palette toggle, or 100+/day action
+- UI duration > 300ms with no stated reason
+- `transform-origin: center` on a trigger-anchored popover/dropdown/tooltip
+- Keyframes on toasts, toggles, or anything added/triggered rapidly
+- Animating layout properties (`width`/`height`/`margin`/`padding`/`top`/`left`)
+- Framer Motion `x`/`y`/`scale` props on motion that runs while the page is busy
+- Updating a CSS variable on a parent to drive a child transform (style recalc storm)
+- Missing `prefers-reduced-motion` handling on movement
+- Ungated `:hover` motion
+- Symmetric enter/exit timing on a press-and-release or hold interaction
+- Everything-at-once entrance where a 30–80ms stagger belongs
+
+## Remedial Preference Hierarchy
+
+When proposing fixes, prefer earlier moves over later ones:
+
+1. **Delete the animation** (high-frequency / no purpose / keyboard-triggered).
+2. **Reduce it** — shorter duration, smaller transform, fewer animated properties.
+3. **Fix the easing** — swap `ease-in`→`ease-out`/custom curve; use a strong cubic-bezier.
+4. **Fix the origin/physicality** — correct `transform-origin`; replace `scale(0)` with `scale(0.95)`+opacity.
+5. **Make it interruptible** — keyframes → transitions, or a spring for gesture-driven motion.
+6. **Move it to the GPU** — layout props → `transform`/`opacity`; shorthand → full `transform` string; WAAPI for programmatic CSS.
+7. **Asymmetric timing** — slow the deliberate phase, snap the response.
+8. **Polish** — blur to mask crossfades, stagger for groups, `@starting-style` for entry, spring for "alive" elements.
+9. **Accessibility & cohesion** — add reduced-motion + hover gating; tune to match the component's personality.
+
+## Required Output Format
+
+Two parts, in this order.
+
+### Part 1 — Findings table (REQUIRED)
+
+A single markdown table. One row per issue. Never a "Before:/After:" list.
+
+| Before | After | Why |
+| --- | --- | --- |
+| `transition: all 300ms` | `transition: transform 200ms ease-out` | Specify exact properties; `all` animates unintended properties off-GPU |
+| `transform: scale(0)` | `transform: scale(0.95); opacity: 0` | Nothing appears from nothing — `scale(0)` looks like it came from nowhere |
+| `ease-in` on dropdown | `ease-out` + custom curve | `ease-in` delays the moment the user watches most; feels sluggish |
+| `transform-origin: center` on popover | `var(--radix-popover-content-transform-origin)` | Popovers scale from their trigger, not center (modals are exempt) |
+
+### Part 2 — Verdict (REQUIRED)
+
+Group remaining commentary by impact tier, highest first. Omit empty tiers.
+
+1. **Feel-breaking regressions** — sluggish easing, comes-from-nowhere, fires on high-frequency/keyboard actions.
+2. **Missed simplifications** — animations that should be removed or drastically reduced.
+3. **Performance** — non-GPU properties, dropped-frame risks, recalc storms.
+4. **Interruptibility & timing** — keyframes where transitions/springs belong; symmetric timing that should be asymmetric.
+5. **Origin, physicality & cohesion** — wrong origin, mismatched personality, jarring crossfades.
+6. **Accessibility** — reduced-motion and pointer/hover gating.
+
+Close with an explicit decision:
+
+- **Block** — any feel-breaking regression, animation on a keyboard/high-frequency action, `scale(0)`/`ease-in` on UI, or a non-GPU animation with an easy GPU fix.
+- **Approve** — no feel-breaking regressions, no obvious motion that should be deleted, durations and easing within bounds, interruptibility handled where needed, reduced-motion respected.
+
+Be specific and cite `file:line`. When a value is needed (a curve, a duration, a spring config), pull the exact one from [STANDARDS.md](STANDARDS.md) rather than approximating.
+
+## Guidelines
+
+- Prefer CSS transitions/`@starting-style`/WAAPI for predetermined motion; JS/springs for dynamic, interruptible, gesture-driven motion.
+- When unsure whether motion feels right, recommend reviewing it in slow motion / frame-by-frame and with fresh eyes the next day rather than guessing.