opencode-skills-collection 4.0.72 → 4.0.73

package/bundled-skills/.antigravity-install-manifest.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "updatedAt": "2026-09-24T01:56:44.424Z",
+  "updatedAt": "2026-09-25T02:13:20.897Z",
   "entries": [
     "00-andruia-consultant",
     "007",
@@ -38,6 +38,7 @@
     "agent-harness-fault-injection",
     "agent-manager-skill",
     "agent-memory",
+    "agent-memory-discipline",
     "agent-memory-mcp",
     "agent-memory-systems",
     "agent-observability",
@@ -1603,6 +1604,7 @@
     "nfs-storage",
     "nft-standards",
     "nika",
+    "noaa-radar-satellite-fetching",
     "nodejs-backend-patterns",
     "nodejs-best-practices",
     "nosql-expert",
@@ -2362,8 +2364,12 @@
     "warp-delegate",
     "warren-buffett",
     "wcag-audit-patterns",
+    "weather-data-lifecycle-management",
+    "weather-data-reproducibility",
     "weather-model-data-fetching",
+    "weather-model-run-discovery",
     "weather-observation-fetching",
+    "weather-pipeline-performance-diagnosis",
     "weaviate",
     "weaviate-cookbooks",
     "web-artifacts-builder",

package/bundled-skills/agent-memory-discipline/SKILL.md

@@ -0,0 +1,204 @@
+---
+name: agent-memory-discipline
+description: "Rules for when an agent should recall from long-term memory before acting and when it should save decisions, corrections and failures afterwards. Works with any memory backend."
+category: memory
+risk: safe
+source: community
+source_repo: mnemoverse/agent-memory-discipline
+source_type: community
+date_added: "2026-09-23"
+author: mnemoverse
+tags: [agent-memory, long-term-memory, context-engineering, mcp, agent-skills]
+tools: [claude, cursor, gemini]
+license: "CC0-1.0"
+license_source: "https://github.com/mnemoverse/agent-memory-discipline/blob/main/LICENSE"
+---
+
+# Agent Memory Discipline
+
+## Overview
+
+Connecting a memory tool does not make an agent use it: tools register, the session runs, and nothing gets recalled or saved. This skill supplies the missing part, standing rules for when to read memory and when to write it.
+
+The problem it solves is specific. An agent with memory available still repeats settled questions, reverts corrected habits, and loses decisions between sessions, because nothing tells it when recall and save are due. The rules below make both moments explicit.
+
+## When to Use This Skill
+
+- Use when a memory tool or MCP memory server is connected but the agent is not using it consistently.
+- Use when the user complains that the assistant loses preferences, conventions or past decisions between sessions.
+- Use when setting up persistent memory for a project and the agent needs standing rules for reading and writing it.
+- Use when the user says "remember this", "what did we decide", "recall", or "save this for next time".
+
+## How It Works
+
+### Before You Start: Any Memory Backend
+
+The agent needs a memory tool it can call. Any backend works, and the rules are identical for each:
+
+- **Files.** A `memory/` folder of Markdown notes, one fact per file. No dependencies, fully greppable, versionable in git.
+- **A local MCP memory server.** Keeps everything on the local machine; several open-source options exist.
+- **A hosted memory service over MCP.** Adds portability across tools and machines at the cost of the data living elsewhere.
+
+Authentication is whatever the chosen backend requires: none for a local folder, the server's own configuration for a local MCP server, an API key or OAuth sign-in for a hosted service. This skill never handles credentials itself and never writes them into memory.
+
+### Step 1: Recall Before Acting
+
+Read memory **before** doing any of these, not after:
+
+- starting work on a project touched before
+- choosing a library, pattern, or tool
+- writing tests, commits, or documentation, where conventions apply
+- answering "how do we usually do X here"
+- anything the user phrases as "again", "like last time", or "as we agreed"
+
+Skip recall for one-off factual questions, arithmetic, or anything fully specified in the current message. Recall costs a tool call and context; spending it on a self-contained question is waste.
+
+Search with the words the user actually used, plus the project or repository name. If the first search returns nothing useful, try one broader query, then stop and proceed without memory rather than looping.
+
+### Step 2: Save After Deciding
+
+Write to memory when one of these has just happened:
+
+- a **decision** was made and will still matter next week ("we use pnpm", "the billing module stays untouched")
+- the user **corrected** the agent, which is the strongest signal there is
+- an approach **failed**, and why it failed
+- a preference was stated that applies beyond this task
+- a fact about the environment was discovered the hard way (a port, a flag, a service that must be running)
+
+Do **not** save: the contents of files that can be read again, restatements of the current task, transient state, anything the user marked as temporary, and anything containing secrets, tokens, or personal data.
+
+One memory, one fact. A paragraph containing four decisions cannot be superseded cleanly when one of them changes.
+
+### Step 3: Write It So It Survives
+
+A memory that is useless in three weeks was written wrong. Give each entry, in the text if the backend has no fields for it:
+
+- **what** was decided or observed, in one sentence
+- **why**, briefly, because the reason outlives the decision
+- **when** it became true, and when it stopped being true if it has
+- **where it came from**: a file, a commit, a conversation, a test run
+
+Prefer the user's own words over a paraphrase. Paraphrase drifts.
+
+### Step 4: Close the Past Instead of Overwriting It
+
+When something changes, the old memory is not wrong. It is **closed**.
+
+If the project moved from Redux to Zustand, "we use Redux" was true from January to June. Deleting it destroys the explanation for every component written in that window. Mark it superseded, keep its validity window, and write the new one alongside.
+
+This is the single most destructive habit in agent memory, and it stays invisible until someone asks a question about old code.
+
+### Step 5: Keep Contradictions Visible
+
+If recall returns two entries that disagree, do not pick the closer match and proceed. Surface both, with their dates, and ask or flag. A convention that a recent failure contradicts is exactly the situation where the user needs to be told, not smoothed over.
+
+### Step 6: Weigh Evidence and Policy Differently
+
+- **Evidence** is what happened: one run, one failure, one observation. Cheap, plentiful, individually unreliable.
+- **Policy** is what should happen: a convention, a decision, a rule. Expensive, and should be hard to change by accident.
+
+An observation becomes policy when a human confirms it, when it lands in a merged decision record, or when it has worked repeatedly. Never promote a single observation to a rule without one of those.
+
+### What Following This Skill Produces
+
+Two things, and nothing else:
+
+- **Recalled context, stated before the work starts.** The relevant entries are named with their dates and sources, so the user can see what the agent is relying on. Conflicting entries are shown side by side, not merged.
+- **New memory entries after decisions, corrections and failures.** One fact each, in this shape:
+
+```text
+Project uses pnpm, not npm. Stated by the user on 2026-08-11 after a lockfile conflict. Applies to all packages in this repo.
+```
+
+A superseded entry keeps its text and gains an end date and a pointer to the entry that replaced it. The full format, with closing and evidence examples, is in [references/entry-format.md](references/entry-format.md).
+
+## Examples
+
+### Example 1: A Correction
+
+The user says: *"stop using npm here, we're on pnpm."*
+
+1. This is a correction, which is the strongest save signal. Save it.
+2. Write the entry:
+
+```text
+Project uses pnpm, not npm. Stated by the user on 2026-08-11 after a lockfile conflict. Applies to all packages in this repo.
+```
+
+3. Do not also save "the user was annoyed", "ran npm install", or the lockfile contents.
+4. Next session, before running any package command in this repo, recall first and find it.
+
+### Example 2: A Contradiction
+
+Recall returns two entries:
+
+```text
+Integration tests run against the staging database (2026-06-02)
+Integration tests use a local container; staging is off limits after the incident (2026-08-19)
+```
+
+1. Do not pick one and continue. State both, with dates.
+2. Ask: *"Memory has two rules for integration tests; the August one says staging is off limits. Use the local container?"*
+3. After the answer, close the entry that no longer holds, with its end date, and keep the other.
+
+### Example 3: Closing an Entry That Stopped Being True
+
+Do not delete the old entry. Add an end date and a pointer to what replaced it, then write the new entry alongside:
+
+```text
+[closed 2026-06-30, replaced by "State management uses Zustand"] State management uses Redux. Decided in the January architecture review.
+State management uses Zustand. Migrated in June after the bundle size review. Applies to all new components.
+```
+
+## Best Practices
+
+- **Do:** recall before project-specific work, and name the entries you rely on with their dates and sources.
+- **Do:** save right after a decision, a correction, or a failure, in one sentence with its reason.
+- **Do:** keep one fact per entry, so a later change can supersede it cleanly.
+- **Do:** prefer the user's own words over a paraphrase.
+- **Don't:** overwrite or remove an entry that stopped being true; close it with an end date instead.
+- **Don't:** save file contents that can be read again, restatements of the current task, or transient state.
+- **Don't:** promote a single observation to a rule without human confirmation, a merged decision record, or repeated success.
+
+## Limitations
+
+- This skill installs no memory backend and requires no account. Without a memory tool the agent can call, it can only say that memory is unavailable and continue.
+- It decides when to recall and what to save. How well entries are found again depends on the backend's own search.
+- It does not resolve contradictions by itself. It surfaces them with their dates and asks the user which one holds.
+- What happens to an entry the user asks to remove depends on what the backend supports.
+- This skill does not replace environment-specific validation, testing, or expert review.
+- Stop and ask for clarification if required inputs, permissions, or safety boundaries are missing.
+
+## Security & Safety Notes
+
+- The skill contains no shell commands and makes no network calls of its own. It reads and writes memory only through the memory tool the user has already connected.
+- Never save secrets, tokens, passwords, or personal data into memory, and never write credentials into an entry.
+- A hosted memory backend stores entries outside the local machine. Choose the backend with that in mind.
+- When the user asks for an entry to be removed, close or remove it as the backend allows, and confirm what was removed.
+
+## Common Pitfalls
+
+- **Problem:** The memory tool is unavailable or failing.
+  **Solution:** Proceed without memory, say so in one line, and do not retry in a loop. Save the pending decision as soon as the tool is back, rather than dropping it.
+- **Problem:** Recall returns nothing.
+  **Solution:** Run one broader query, then continue without memory. An empty result is information: the topic is new, so a decision made now is worth saving.
+- **Problem:** Recall returns too much.
+  **Solution:** Keep the entries that match the current project and task; ignore the rest rather than pasting them into context.
+- **Problem:** Two entries disagree.
+  **Solution:** Show both with their dates and ask which holds. Do not resolve the conflict silently.
+- **Problem:** A save is rejected or filtered by the backend.
+  **Solution:** Report it once. Do not rephrase the same fact repeatedly to get it through.
+
+## Related Skills
+
+- `@memory-systems`: when designing the memory architecture itself (short-term, long-term, graph-based) rather than the habit of using it.
+- `@context-engineering`: when setting up rules files and session context, which this skill complements with rules for long-term memory.
+
+## Additional Resources
+
+- [Upstream repository](https://github.com/mnemoverse/agent-memory-discipline) (CC0-1.0)
+- [Agent Skills overview](https://platform.claude.com/docs/en/agents-and-tools/agent-skills/overview)
+- [Claude Code skills](https://code.claude.com/docs/en/skills)
+- [Model Context Protocol](https://modelcontextprotocol.io), for connecting memory servers
+
+*Written and maintained by the team behind [Mnemoverse](https://mnemoverse.com), which is one hosted implementation. The rules above are deliberately backend-neutral and were written to be useful without it.*

package/bundled-skills/agent-memory-discipline/references/entry-format.md

@@ -0,0 +1,37 @@
+# Memory entry format
+
+Reference for Step 3 and Step 4 of the skill. Use fields when the backend has them; otherwise write the same information into the text of the entry.
+
+## A new entry
+
+| Part | What to write | Example |
+|---|---|---|
+| What | One sentence, the decision or observation | Project uses pnpm, not npm. |
+| Why | The reason, briefly | Lockfile conflict between npm and pnpm. |
+| When | The date it became true | 2026-08-11 |
+| Source | Where it came from | Stated by the user in the session |
+| Scope | Where it applies | All packages in this repository |
+
+As a single line:
+
+```text
+Project uses pnpm, not npm. Stated by the user on 2026-08-11 after a lockfile conflict. Applies to all packages in this repo.
+```
+
+## Closing an entry that stopped being true
+
+Do not delete it. Add an end date and a pointer to what replaced it, then write the new entry alongside.
+
+```text
+[closed 2026-06-30, replaced by "State management uses Zustand"] State management uses Redux. Decided in the January architecture review.
+State management uses Zustand. Migrated in June after the bundle size review. Applies to all new components.
+```
+
+## Evidence and policy
+
+Mark which kind an entry is, so a single observation is not read later as a rule.
+
+```text
+[evidence] The integration suite failed twice against staging on 2026-08-19.
+[policy] Integration tests use a local container; staging is off limits. Confirmed by the user on 2026-08-20.
+```

package/bundled-skills/antigravity-maintainer-batch-release/SKILL.md

@@ -115,7 +115,7 @@ Use `data/specialized-plugin-candidates.json` for specialized-plugin membership
 
 Treat the current catalog and the legacy user-site bridge as one public system:
 
-- Current catalog: `sickn33/agentic-awesome-skills` at `https://sickn33.github.io/agentic-awesome-skills/`.
+- Current catalog: `sickn33/agentic-awesome-skills` at `https://aaskills.tech/`.
 - Legacy bridge: `sickn33/sickn33.github.io` at `https://sickn33.github.io/antigravity-awesome-skills/`.
 
 For SEO, indexing, Pages, redirect, or infrastructure changes:
@@ -163,7 +163,7 @@ Every stable or prerelease version requires full release alignment. Creating the
 5. Merge that release PR through its required checks, update local `main` to equal `origin/main`, and wait for every source, release, or canonical-sync PR in the release path to close. Re-run the release-state and plugin gates if protected `main` moved.
 6. Run `npm run release:publish -- X.Y.Z`. It must resolve exactly one merged release PR from the same repository, authored by the repository owner, with base `main`, exact title `chore: release vX.Y.Z`, and head branch `release/vX.Y.Z`. Zero or multiple candidates fail closed; never select the newest approximate match. The command then verifies that exact protected merge before creating or reusing the tag and GitHub Release.
    The npm publication workflow must first check out protected `main`, verify that the peeled release tag is an ancestor of current `origin/main`, validate the version directly from the tagged `package.json`, and only then check out or execute tag-controlled code. It has no manual-dispatch bypass.
-7. Wait for publishing workflows, then bind every proof to the exact released commit: verify the tag/ref, GitHub Release, npm version and intended dist-tag, required CI, CodeQL, and the explicitly dispatched release-only Pages build from the exact immutable `vX.Y.Z` tag. Never dispatch Pages from `main` or another branch. Verify live `llms.txt`, `skills.json`, catalog and plugin routes, and the legacy redirect bridge; do not accept a successful run for a different SHA.
+7. Wait for publishing workflows, then bind every proof to the exact released commit: verify the tag/ref, GitHub Release, npm version and intended dist-tag, required CI, CodeQL, and the release-tag Pages build from the exact immutable `vX.Y.Z` tag using `deployment_target=release`. Never manually dispatch the release-tag build from `main` or another branch. A separate `deployment_target=main` dispatch may publish a protected main commit after source and canonical-sync work completes; it must verify current-main identity before build and again before deploy. Canonical-sync commits marked `[skip pages]` are never dispatched by canonical synchronization. Verify live `llms.txt`, `skills.json`, catalog and plugin routes, and the legacy redirect bridge; do not accept a successful run for a different SHA.
 8. After npm confirms `X.Y.Z` as the published dist-tag, discover every already-configured local AAS MCP host from its real configuration and update each one to the exact same package version before declaring the release complete. Updating existing AAS host entries is part of the release; creating a previously absent host configuration still requires explicit authorization.
    - Use the published package's `aas mcp configure` two-pass flow: first preview the change, then repeat the identical command with its approval digest. Supply absolute host-config, cache, and backup paths; require a backup when replacing an existing configuration.
    - Pin `agentic-awesome-skills@X.Y.Z` and `--version X.Y.Z`; never use `latest`, reuse an older cached runtime, or create a previously absent host configuration without explicit authorization.

package/bundled-skills/jev-social/SKILL.md

@@ -11,7 +11,7 @@ author: socai-io
 tags: [social-media, research, instagram, tiktok, linkedin, browser-automation, jev]
 tools: [claude, codex]
 license: "MIT"
-license_source: "https://github.com/socai-io/jev-social/blob/05581cac6b8c21c85e54883b5f2b93c16f40f419/LICENSE"
+license_source: "https://github.com/socai-io/jev-social/blob/782d809c68e2015536359aa7dceede9a3cdbb7f1/LICENSE"
 ---
 # Jev Social
 
@@ -19,7 +19,7 @@ license_source: "https://github.com/socai-io/jev-social/blob/05581cac6b8c21c85e5
 
 Jev Social turns a natural-language social research goal into bounded Jev routing decisions, then delegates platform-read-only browser work to the local socai CLI. Use the captured posts, profiles, comments, videos, and opened details to produce a compact, source-linked report instead of exposing raw CLI output. "Read-only" means no social-account mutation; the CLI still writes private local run records and may download requested media.
 
-The executable examples below are pinned to the tested runtime commit included in Jev Social `v0.1.4`. A pin improves reproducibility but is not a trust guarantee; keep the package, browser data, and returned content inside the safety boundaries below.
+The executable examples below are pinned to the tested runtime commit included in Jev Social `v0.1.5`. A pin improves reproducibility but is not a trust guarantee; keep the package, browser data, and returned content inside the safety boundaries below.
 
 ## When to Use
 - Use when a user requests evidence-backed research on Instagram, TikTok, or LinkedIn and wants real public posts or profiles rather than a general web summary.
@@ -45,7 +45,7 @@ If the exact pinned package is not already available locally, explain that the n
 Run the status command before every research task:
 
 ```bash
-npx github:socai-io/jev-social#05581cac6b8c21c85e54883b5f2b93c16f40f419 status
+npx github:socai-io/jev-social#782d809c68e2015536359aa7dceede9a3cdbb7f1 status
 ```
 
 Require all of the following before continuing:
@@ -68,7 +68,7 @@ Pass the goal as one argument with an argv-capable process runner; never constru
 ```text
 program: npx
 argv:
-  - github:socai-io/jev-social#05581cac6b8c21c85e54883b5f2b93c16f40f419
+  - github:socai-io/jev-social#782d809c68e2015536359aa7dceede9a3cdbb7f1
   - search
   - <exact research goal as one argument>
   - --platform
@@ -126,7 +126,7 @@ Use only TikTok if its capability is reported as supported. Open details before
 When the user explicitly asks for the local demo UI, start it on loopback only:
 
 ```bash
-npx github:socai-io/jev-social#05581cac6b8c21c85e54883b5f2b93c16f40f419 serve --port 8766
+npx github:socai-io/jev-social#782d809c68e2015536359aa7dceede9a3cdbb7f1 serve --port 8766
 ```
 
 Report `http://127.0.0.1:8766`. Leave the process running only when the user asked for a local demo server, and do not expose it on a public interface.

package/bundled-skills/noaa-radar-satellite-fetching/SKILL.md

@@ -0,0 +1,253 @@
+---
+name: noaa-radar-satellite-fetching
+description: "Retrieve NOAA NEXRAD and GOES products from public cloud archives using verified site, product, channel, sector, and scan-time selection."
+category: data
+risk: safe
+source: self
+source_type: self
+date_added: "2026-09-24"
+author: ShianMike
+tags: [weather, noaa, nexrad, goes, radar, satellite, aws-s3]
+tools: [claude, cursor, gemini, codex]
+---
+
+# NOAA Radar and Satellite Fetching
+
+## Overview
+
+Retrieve NOAA NEXRAD radar and GOES satellite objects from public cloud
+archives while preserving the product, platform, spatial sector, and scan-time
+identity. Discover through narrow prefixes, choose by observation time rather
+than upload time, and validate the downloaded scientific file before use.
+
+This skill covers raw or provider-produced radar and satellite products. It
+does not retrieve numerical model output or ordinary station observations.
+
+## When to Use This Skill
+
+- A task needs NEXRAD Level II archive volumes or real-time chunks.
+- A task needs selected NEXRAD Level III products.
+- GOES ABI, GLM, or another GOES-R product is needed for a time and region.
+- A download must select the nearest completed scan within a tolerance.
+- A public S3 key, satellite assignment, radar site, channel, or sector is
+  uncertain or has changed.
+
+Do not activate this skill merely to display a third-party map tile or to answer
+a general weather question.
+
+## Define the Product Contract
+
+For NEXRAD, specify:
+
+- Level II archive, Level II real-time chunks, or a named Level III product;
+- four-character radar site, such as `KTLX`;
+- desired scan time in UTC and nearest/previous/next selection policy;
+- maximum time tolerance;
+- full volume or exact product code;
+- raw file retention and decoder.
+
+For GOES, specify:
+
+- physical satellite number or operational role, such as East or West;
+- instrument and product level/short name;
+- Full Disk, CONUS, Mesoscale 1, or Mesoscale 2 sector where applicable;
+- ABI channel or derived product;
+- desired scan time in UTC and tolerance;
+- calibration form needed, such as radiance or brightness temperature.
+
+Resolve an operational role to a physical satellite using current NOAA
+documentation at request time. East and West assignments change over a
+satellite program's lifetime.
+
+## Current Public AWS Routes
+
+Consult the AWS Registry of Open Data before hard-coding a bucket. As of this
+skill's publication:
+
+- NEXRAD Level II archive: `s3://unidata-nexrad-level2/`
+- NEXRAD Level II real-time chunks: `s3://unidata-nexrad-level2-chunks/`
+- selected NEXRAD Level III real-time data: `s3://unidata-nexrad-level3/`
+- GOES imagery and metadata: satellite-specific buckets such as
+  `s3://noaa-goes18/` and `s3://noaa-goes19/`
+
+The former `noaa-nexrad-level2` bucket was deprecated and scheduled to become
+unavailable on September 1, 2025. Do not copy that retired route from old
+tutorials.
+
+## Discover with Narrow Prefixes
+
+NEXRAD Level II archive objects are organized by UTC date and site. GOES
+objects are organized by product, year, day of year, and hour. List only the
+smallest prefix that can contain the requested scan.
+
+```bash
+aws s3 ls --no-sign-request \
+  s3://unidata-nexrad-level2/YYYY/MM/DD/KXXX/
+
+aws s3 ls --no-sign-request \
+  s3://noaa-goes19/ABI-L2-CMIPC/YYYY/DDD/HH/
+```
+
+Replace every placeholder with a validated value. Include the adjacent hour or
+UTC day only when the time tolerance crosses that boundary. Paginate listings
+and bound the total keys inspected.
+
+Use real-time chunk buckets only when the consumer is designed to assemble and
+validate chunks. Prefer completed archive volumes for ordinary historical or
+post-event processing.
+
+## Select by Scan Time
+
+Object `Last-Modified` is publication metadata, not the measurement time.
+
+- For NEXRAD, parse the site and scan timestamp from the documented object name,
+  then confirm time and site from the decoded volume header.
+- For GOES-R, filenames encode platform plus scan start (`s`), end (`e`), and
+  creation (`c`) timestamps. Select by scan start or interval overlap, not file
+  creation time.
+- Default to the closest scan at or before the requested instant for a
+  retrospective view. Allow a future scan only when the caller explicitly asks
+  for nearest-in-either-direction behavior.
+- Reject every candidate outside the stated tolerance.
+- When sectors overlap, require the requested sector instead of choosing solely
+  by time.
+
+This standard-library helper extracts GOES-R scan timestamps without opening
+the NetCDF payload:
+
+```python
+import re
+from datetime import datetime, timezone
+from pathlib import PurePosixPath
+
+
+GOES_TIMES = re.compile(
+    r"_s(?P<start>\d{14})_e(?P<end>\d{14})_c(?P<created>\d{14})"
+)
+
+
+def parse_goes_times(object_key):
+    match = GOES_TIMES.search(PurePosixPath(object_key).name)
+    if not match:
+        raise ValueError(f"unrecognized GOES-R filename: {object_key}")
+
+    def parse(value):
+        return datetime.strptime(value, "%Y%j%H%M%S%f").replace(
+            tzinfo=timezone.utc
+        )
+
+    return {name: parse(value) for name, value in match.groupdict().items()}
+```
+
+Treat filename parsing as discovery. After download, verify the corresponding
+time coverage and platform attributes inside the file.
+
+## Download and Validate
+
+1. Record bucket, exact key, size, ETag, and `Last-Modified` before transfer.
+2. Download to a request-owned temporary path. For public buckets, use unsigned
+   S3 access rather than supplying credentials.
+3. If the object might still be publishing, require stable metadata or pin a
+   conditional request to the observed object identity.
+4. Verify the received byte count and a provider checksum when one is supplied.
+   Otherwise compute and record a local SHA-256 digest.
+5. Open the object with an existing format-aware decoder.
+6. Verify site/platform, product, scan interval, and expected dimensions or
+   radar sweeps before renaming it into the cache.
+
+Reuse an installed NEXRAD or NetCDF reader. Do not build a binary radar or
+satellite decoder merely to fetch a file.
+
+## Radar-Specific Checks
+
+- Confirm that the radar site is the requested site and was operational at the
+  scan time.
+- Treat Level II volumes, real-time chunks, and Level III products as different
+  contracts; they are not interchangeable encodings.
+- Verify volume start time, end time when available, sweep count, moments, and
+  elevation angles after decoding.
+- Keep range folding, missing gates, quality masks, and velocity ambiguity
+  explicit.
+- A radar's nominal coverage radius does not guarantee useful low-level data at
+  a location. Consider distance, beam height, terrain blockage, and outages.
+
+## Satellite-Specific Checks
+
+- Confirm the physical satellite, instrument, product short name, sector, scan
+  mode, channel, and time coverage from NetCDF attributes.
+- Do not treat ABI fixed-grid `x` and `y` coordinates as latitude and longitude.
+  Use the file's geostationary projection metadata.
+- Apply scale/offset, fill values, data-quality flags, and product-specific
+  calibration according to NOAA documentation.
+- A Mesoscale file is not identified only by its small dimensions; distinguish
+  Mesoscale 1 and 2 explicitly.
+- Do not blend files from different scan modes, sectors, satellites, or product
+  levels without recording the transformation.
+
+## Reliability, Cache, and Cleanup
+
+- Cache by bucket, key, and object identity, not a friendly timestamp alone.
+- Retry timeouts, `408`, `429`, and transient `5xx` responses with bounded
+  backoff and jitter.
+- Bound time tolerance, adjacent-hour listings, pagination, concurrency, and
+  disk usage.
+- Keep partial downloads separate from valid cache entries.
+- Use event notifications for continuous real-time ingestion when appropriate;
+  do not repeatedly scan broad prefixes.
+- For a one-shot image or export, delete request-owned raw objects in `finally`
+  only after the final artifact and provenance manifest are durable.
+- Never delete a shared user cache as request cleanup.
+
+## Verification Checklist
+
+- The source bucket is current and documented by NOAA or its data distributor.
+- Radar site or physical satellite and operational role are explicit.
+- Product level, code/short name, sector, channel, and scan mode match the
+  request.
+- The selected scan satisfies the direction policy and maximum time tolerance.
+- Object size and identity match the downloaded bytes.
+- The format-aware decoder opens the file and confirms internal metadata.
+- Geolocation uses the product's real coordinate reference system.
+- Temporary data cleanup preserves the requested artifact and manifest.
+
+## Security & Safety Notes
+
+- Fetch only public data or resources the user is authorized to access.
+- Never embed AWS credentials, signed URLs, private endpoints, or notification
+  subscription tokens in code or logs.
+- Keep TLS verification enabled; `--no-sign-request` does not disable TLS.
+- Validate site, product, channel, sector, and time inputs against allowlists
+  before constructing object prefixes or local paths.
+- Bound response size and available disk space before downloading high-rate
+  radar or satellite streams.
+- Preserve NOAA attribution and do not imply NOAA endorsement.
+
+## Common Pitfalls
+
+- **Old NEXRAD examples return no data:** They reference the retired Level II
+  bucket. Resolve the current bucket from the registry.
+- **The right minute shows the wrong image:** Creation time was used instead of
+  scan start/end time.
+- **GOES East points to the wrong bucket:** An operational role was hard-coded
+  to a satellite number. Resolve the assignment for the requested date.
+- **The map is displaced:** Fixed-grid scan angles were treated as geographic
+  coordinates. Apply the geostationary projection.
+- **A real-time radar volume will not decode:** Individual chunks were treated
+  as a completed archive volume. Assemble and validate them or use the archive.
+
+## Limitations
+
+- Buckets, satellite assignments, product availability, scan modes, and naming
+  conventions can change; verify current official documentation.
+- This skill retrieves source products but does not guarantee meteorological
+  suitability, perform mosaicking, or implement scientific calibration.
+- Historical gaps and instrument or site outages cannot be repaired by provider
+  fallback.
+
+## Additional Resources
+
+- [NEXRAD on the AWS Registry of Open Data](https://registry.opendata.aws/noaa-nexrad/)
+- [NOAA GOES on the AWS Registry of Open Data](https://registry.opendata.aws/noaa-goes/)
+- [NOAA GOES-R documents](https://www.ospo.noaa.gov/resources/documents/goes-r.html)
+- [NOAA STAR guide to satellite filenames](https://www.star.nesdis.noaa.gov/atmospheric-composition-training/satellite_data_decoding_data_file_names.php)
+- [NOAA Radar Operations Center interface documents](https://www.roc.noaa.gov/wsr88d/BuildInfo/Files.aspx)