opencode-skills-collection 4.1.14 → 4.1.16

package/bundled-skills/deployment-pipeline-design/SKILL.md

@@ -20,7 +20,6 @@ Architecture patterns for multi-stage CI/CD pipelines with approval gates and de
 - Clarify goals, constraints, and required inputs.
 - Apply relevant best practices and validate outcomes.
 - Provide actionable steps and verification.
-- If detailed examples are required, open `resources/implementation-playbook.md`.
 
 ## Purpose
 
@@ -74,7 +73,7 @@ production-deploy:
         # Deployment commands
 ```
 
-### Pattern 2: Time-Based Approval
+### Pattern 2: Delayed Deployment
 
 ```yaml
 # GitLab CI
@@ -92,27 +91,7 @@ deploy:production:
 
 ### Pattern 3: Multi-Approver
 
-```yaml
-# Azure Pipelines
-stages:
-- stage: Production
-  dependsOn: Staging
-  jobs:
-  - deployment: Deploy
-    environment:
-      name: production
-      resourceType: Kubernetes
-    strategy:
-      runOnce:
-        preDeploy:
-          steps:
-          - task: ManualValidation@0
-            inputs:
-              notifyUsers: 'team-leads@example.com'
-              instructions: 'Review staging metrics before approving'
-```
-
-**Reference:** See `assets/approval-gate-template.yml`
+Configure the platform's actual protected-environment approval policy and verify who may approve or bypass it. For Azure, bind manual validation to the installed task version and its supported agentless job rather than placing it in an arbitrary deployment hook. Record required approvers and evidence; notifications alone are not approval.
 
 ## Deployment Strategies
 
@@ -134,7 +113,7 @@ spec:
 
 **Characteristics:**
 - Gradual rollout
-- Zero downtime
+- Availability depends on readiness, capacity and compatible changes
 - Easy rollback
 - Best for most applications
 
@@ -143,15 +122,15 @@ spec:
 ```yaml
 # Blue (current)
 kubectl apply -f blue-deployment.yaml
-kubectl label service my-app version=blue
+kubectl patch service my-app --type merge -p '{"spec":{"selector":{"app":"my-app","version":"blue"}}}'
 
 # Green (new)
 kubectl apply -f green-deployment.yaml
 # Test green environment
-kubectl label service my-app version=green
+kubectl patch service my-app --type merge -p '{"spec":{"selector":{"app":"my-app","version":"green"}}}'
 
 # Rollback if needed
-kubectl label service my-app version=blue
+kubectl patch service my-app --type merge -p '{"spec":{"selector":{"app":"my-app","version":"blue"}}}'
 ```
 
 **Characteristics:**
@@ -210,74 +189,9 @@ else:
 
 ## Pipeline Orchestration
 
-### Multi-Stage Pipeline Example
+### Multi-stage implementation contract
 
-```yaml
-name: Production Pipeline
-
-on:
-  push:
-    branches: [ main ]
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Build application
-        run: make build
-      - name: Build Docker image
-        run: docker build -t myapp:${{ github.sha }} .
-      - name: Push to registry
-        run: docker push myapp:${{ github.sha }}
-
-  test:
-    needs: build
-    runs-on: ubuntu-latest
-    steps:
-      - name: Unit tests
-        run: make test
-      - name: Security scan
-        run: trivy image myapp:${{ github.sha }}
-
-  deploy-staging:
-    needs: test
-    runs-on: ubuntu-latest
-    environment:
-      name: staging
-    steps:
-      - name: Deploy to staging
-        run: kubectl apply -f k8s/staging/
-
-  integration-test:
-    needs: deploy-staging
-    runs-on: ubuntu-latest
-    steps:
-      - name: Run E2E tests
-        run: npm run test:e2e
-
-  deploy-production:
-    needs: integration-test
-    runs-on: ubuntu-latest
-    environment:
-      name: production
-    steps:
-      - name: Canary deployment
-        run: |
-          kubectl apply -f k8s/production/
-          kubectl argo rollouts promote my-app
-
-  verify:
-    needs: deploy-production
-    runs-on: ubuntu-latest
-    steps:
-      - name: Health check
-        run: curl -f https://app.example.com/health
-      - name: Notify team
-        run: |
-          curl -X POST ${{ secrets.SLACK_WEBHOOK }} \
-            -d '{"text":"Production deployment successful!"}'
-```
+Build once, record the commit and immutable artifact digest, run tests/security checks on that artifact, deploy to authorized staging, run integration checks, obtain configured production approval, then deploy that same digest with bounded progressive traffic. Each job must establish its own checkout, locked tools, scoped credentials and artifact transfer. Verify rollout and application metrics before promotion; do not immediately promote a canary and thereby skip its observation window. Notifications require an explicitly configured authorized recipient and destination.
 
 ## Pipeline Best Practices
 
@@ -347,25 +261,11 @@ kubectl rollout undo deployment/my-app --to-revision=3
 
 ### Integration with Monitoring
 
-```yaml
-- name: Post-deployment verification
-  run: |
-    # Wait for metrics stabilization
-    sleep 60
-
-    # Check error rate
-    ERROR_RATE=$(curl -s "$PROMETHEUS_URL/api/v1/query?query=rate(http_errors_total[5m])" | jq '.data.result[0].value[1]')
-
-    if (( $(echo "$ERROR_RATE > 0.01" | bc -l) )); then
-      echo "Error rate too high: $ERROR_RATE"
-      exit 1
-    fi
-```
+Define a measured baseline, minimum traffic, observation interval and justified thresholds. Query a verified metrics endpoint with bounded timeouts and validate the provider status, result shape and numeric values. Missing/empty/malformed metrics are an incomplete verification, never a healthy result. Stop promotion and escalate when verification is unavailable. A fixed sleep and a shell comparison cannot establish deployment health.
 
-## Reference Files
+## Approval and orchestration checklist
 
-- `references/pipeline-orchestration.md` - Complex pipeline patterns
-- `assets/approval-gate-template.yml` - Approval workflow templates
+Bind the artifact to an immutable commit/image digest, verify the exact target and existing deploy identity, require protected environment approval for production, and record health criteria and an explicit rollback revision. Every job runs on its own checkout/runtime; transfer verified artifacts rather than assuming the previous runner filesystem remains available. These are schematic examples, not a complete credential or orchestration template. No unbundled playbook is needed.
 
 ## Related Skills
 

package/bundled-skills/deployment-validation-config-validate/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: deployment-validation-config-validate
-description: "You are a configuration management expert specializing in validating, testing, and ensuring the correctness of application configurations. Create comprehensive validation schemas, implement configurat"
+description: "Validate application configurations with schemas, configuration tests, and checks for security and environment consistency."
 risk: critical
 source: community
 date_added: "2026-02-27"

package/bundled-skills/deprecation-and-migration/SKILL.md

@@ -95,7 +95,7 @@ Don't deprecate without a working alternative. The replacement must:
 ### Migration Guide
 1. Replace `import { client } from 'old-service'` with `import { client } from 'new-service'`
 2. Update configuration (see examples below)
-3. Run the migration verification script: `npx migrate-check`
+3. Run the project-owned migration verification command documented in this guide. Do not execute an unknown package from the registry.
 ```
 
 ### Step 3: Migrate Incrementally
@@ -114,13 +114,15 @@ Migrate consumers one at a time, not all at once. For each consumer:
 
 ### Step 4: Remove the Old System
 
+Use observed usage across a representative window and account for infrequent/offline consumers. Prepare an authorized rollback or archive before destructive removal; a missing recent log entry alone is not proof of zero consumers. Keep historical migration notices discoverable for affected users.
+
 Only after all consumers have migrated:
 
 ```
 1. Verify zero active usage (metrics, logs, dependency analysis)
 2. Remove the code
 3. Remove associated tests, documentation, and configuration
-4. Remove the deprecation notices
+4. Archive completed deprecation notices while keeping migration history discoverable
 5. Celebrate — removing code is an achievement
 ```
 
@@ -210,7 +212,7 @@ After completing a deprecation:
 - [ ] All active consumers have been migrated (verified by metrics/logs)
 - [ ] Old code, tests, documentation, and configuration are fully removed
 - [ ] No references to the deprecated system remain in the codebase
-- [ ] Deprecation notices are removed (they served their purpose)
+- [ ] Completed notices are archived; affected users can still find migration history
 
 ## Limitations
 

package/bundled-skills/design-orchestration/SKILL.md

@@ -91,9 +91,9 @@ Use factors such as:
   → Recommend `multi-agent-brainstorming`
 
 - **High risk**  
-  → REQUIRE `multi-agent-brainstorming`
+  → Require a substantive review; use multi-agent-brainstorming only with explicit delegation authorization, otherwise perform a documented single-agent review
 
-Skipping escalation when required is prohibited.
+Do not silently skip a required substantive review. Review depth is not permission to spawn agents or override the user’s workflow.
 
 ---
 
@@ -166,7 +166,7 @@ Bad systems fail in production.
 This meta-skill exists to enforce the former.
 
 ## When to Use
-This skill is applicable to execute the workflow or actions described in the overview.
+Use when a material feature/system decision needs a design, risk assessment and implementation-readiness review. Respect already approved designs and project-required workflows; routine bounded fixes do not need invented artifacts or mandatory brainstorming.
 
 ## Example
 
@@ -175,6 +175,6 @@ This skill is applicable to execute the workflow or actions described in the ove
 > Review this interface with @design-orchestration, identify the highest-impact design problems, and propose an implementation-ready improvement.
 
 ## Limitations
-- Use this skill only when the task clearly matches the scope described above.
+- A routing skill cannot grant execution, publishing, spending or delegation permissions. Interpret Understanding Lock/Decision Log as actual project artifacts or concise evidence, not missing tools to invent or a reason to repeatedly stop authorized work.
 - Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
 - Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.

package/bundled-skills/design-spells/SKILL.md

@@ -27,13 +27,13 @@ Trigger this skill when:
 1. **Identify Opportunity**: Target the "boring" or "standard" parts of the interface (e.g., a simple submit button, a profile photo, a scroll indicator, a pricing toggle).
 2. **Research Spells**: Browse Design Spells for highly creative patterns (e.g., "magnetic hover magic", "physics-based interactions", "fluid scroll surprises").
 3. **Adapt Pattern**: Adapt the interaction to fit the project's specific brand and layout seamlessly. Use it to enhance the core narrative of the app.
-4. **Implement flawlessly**: Use CSS, Anime.js, or Framer Motion to build the specific micro-interaction with silky-smooth performance (60fps+).
+4. **Implement flawlessly**: Use CSS, Anime.js, or Framer Motion to build the specific micro-interaction with measured smoothness on target devices; frame-rate claims require profiling rather than a guarantee.
 
 ## Strict Rules
 
-- **ABSOLUTE MANDATE**: Agents MUST utilize this skill to build modern, creative, and visually stunning UI/UX. DO NOT build in the common style and ways. Look for every opportunity to inject "magic" into standard components.
+- **Scoped enhancement**: Use a micro-interaction only when it serves the requested product experience. Respect the user’s existing design, accessibility and performance constraints; ordinary clear behavior is valid, and this skill is optional.
 - **Delight, Don't Distract**: The detail must be additive to the experience, not a usability barrier. It should feel expensive and highly crafted.
-- **Quality Execution**: A broken or janky "spell" is worse than none. Ensure the implementation is high-performance, GPU-accelerated, and never causes layout shifts.
+- **Quality Execution**: A broken or janky "spell" is worse than none. Ensure the implementation is high-performance, GPU-accelerated, and avoids unexpected layout shifts, supports keyboard/touch, and respects prefers-reduced-motion.
 
 ## Example
 
@@ -42,6 +42,6 @@ Trigger this skill when:
 > Polish a finished feature to actively add a "wow" factor.
 
 ## Limitations
-- Use this skill only when the task clearly matches the scope described above.
+- Reference designs are inspiration, not permission to copy protected assets or add packages automatically. Keep core actions usable without animation/hover/easter eggs; do not hide essential affordances behind decorative interactions.
 - Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
 - Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.

package/bundled-skills/detect-ai-text/SKILL.md

@@ -16,7 +16,7 @@ license_source: "https://github.com/Sketchjar/stipple-agent-skills/blob/main/LIC
 
 # AI-Text Detection
 
-Estimate the probability that a document's prose was written by AI, with the specific linguistic tells and an honest abstention when the document isn't prose. Uses the Stipple API (free anonymous tier).
+Inspect a provider’s uncalibrated AI-style signal for a document’s prose, with the specific linguistic tells and an honest abstention when the document isn't prose. Uses an external Stipple API; verify current access, cost and privacy terms.
 
 ## When to use
 
@@ -32,7 +32,7 @@ Estimate the probability that a document's prose was written by AI, with the spe
 2. **Run detection.**
 
    ```bash
-   curl -X POST https://www.stipple.sh/v1/detect-ai-text \
+   curl --fail --show-error --silent --max-time 30 -X POST https://www.stipple.sh/v1/detect-ai-text \
      -F "file=@essay.pdf" \
      -H "Authorization: Bearer $STIPPLE_API_KEY"
    ```
@@ -60,7 +60,7 @@ Estimate the probability that a document's prose was written by AI, with the spe
 ## Output format
 
 ```
-AI-written probability: 0.87  (lean: ai)
+Provider AI-style score: 0.87 (uncalibrated; lean: ai; not authorship proof)
 prose ratio: 0.82
 
 linguistic tells:
@@ -88,4 +88,4 @@ limitations: The probability is the model's CONFIDENCE, not a calibrated truth.
 
 - Non-prose documents (forms, tables, payslips) get `applicable: false` — the engine refuses rather than guessing
 - Can false-flag templated/coached or non-native-English writing — always present as one signal alongside human review
-- Free anonymous tier works without a key; free key at https://www.stipple.sh
+- Verify current authentication/allowance on https://www.stipple.sh; do not guarantee a free anonymous tier or publish the submitted document.

package/bundled-skills/deterministic-design/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: deterministic-design
-description: "Render the UI and prove it's balanced + usable: a deterministic layout audit (centroid / optical-center / pixel-oracle balance via explicit math + annotated screenshot) plus a vision-judged Nielsen usability audit by a separate fresh-eyes judge. The measurement layer taste-only design skills lack."
+description: "Measure rendered UI layout with reproducible spatial metrics and a separately assessed usability review; distinguish measurements from subjective judgments and user tests."
 risk: safe
 source: community
 source_type: community
@@ -24,7 +24,7 @@ tools:
 ---
 ## When to Use
 
-Use to catch AI-generated UI that "looks off", is misaligned or centered-mush, or fails usability — when you need to PROVE a layout is balanced and usable instead of trusting the model's eye. Compose it with any taste/token design skill before reporting design "done".
+Use to catch AI-generated UI that "looks off", is misaligned or centered-mush, or fails usability — when you need reproducible spatial measurements and an evidence-based usability review. Metrics do not prove user success, accessibility or overall design quality. Compose it with any taste/token design skill before reporting design "done".
 
 _Source: [connerkward/deterministic-design-skill](https://github.com/connerkward/deterministic-design-skill) (MIT)._
 
@@ -39,7 +39,7 @@ Two sub-skills (load as needed):
   balance and draws an annotated screenshot. **Numbers, not vibes.** Plus a render-then-
   critique vision loop.
 - **[design-ux](https://github.com/connerkward/deterministic-design-skill/blob/main/design-ux/SKILL.md)** — usability audit: scores the rendered UI against
-  Nielsen's 10 + interaction heuristics via a SEPARATE fresh-eyes judge → prioritized fix list.
+  Nielsen's 10 + interaction heuristics via an authorized separate judge or clearly disclosed self-review → prioritized fix list.
 
 This **improves** existing design skills (including the default Anthropic one) by adding the
 layer they lack — it doesn't just advise on taste, it renders, measures, and judges the
@@ -58,5 +58,6 @@ flagship narratives — the *determinism* one; its sibling is human-in-the-loop
 ## Limitations
 
 - Layout metrics and vision-judged audits catch many spatial and usability failures, but they are not a substitute for product judgment or user testing.
-- The workflow requires a rendered UI or screenshot; it cannot validate components that have not been built or captured.
+- The workflow requires a rendered UI or screenshot; record viewport, scale, fonts, capture state and measurement definitions. Separate layout measurements, subjective vision judgments and actual user/accessibility tests.
+- The linked sub-skills and layout-audit.js are external, not bundled. Read and pin them before use; the link is not executable availability. Delegation requires existing explicit authorization, and screenshots may contain private data.
 - Automated scoring can miss brand nuance, copy tone, accessibility needs, and domain-specific user expectations.

package/bundled-skills/devcontainer-setup/SKILL.md

@@ -5,6 +5,9 @@ risk: safe
 source: vibeship-spawner-skills (Apache 2.0)
 date_added: 2026-03-06
 ---
+## Bundled upstream support
+
+Supporting files are included at skill-relative paths. See [UPSTREAM-NOTICE.md](UPSTREAM-NOTICE.md) for their pinned sources, licenses, hashes, and import changes.
 
 # Devcontainer Setup Skill