pi-dev 0.1.1

package/skills/do/SKILL.md

@@ -0,0 +1,180 @@
+---
+name: do
+description: One-shot engineering entry point. Classifies the user's request (intent + scope), loads merged preferences, runs the right chain of skills, and finishes the work. Refuses to start on un-migrated repos. Keep-going posture — expand scope and surface, never halt for ceremony. Call this for any non-trivial engineering request in any language ("버그 잡아줘", "기능 추가하자", "이 추출기 짜자", "이어서", etc).
+---
+
+# /do — Engineering Flow
+
+Single entry point for engineering work. Classifies the request, loads merged preferences, then runs the right chain of skills (`zoom-out`, `grill-with-docs`, `to-prd`, `to-issues`, `triage`, `tdd`, `improve-codebase-architecture`, `diagnose`, `recon-with-vision`) to completion.
+
+The point: **one request → one finished outcome**, with as few user interruptions as the user's preferences allow.
+
+## Hard rules
+
+1. **Migration gate (strict).** If `docs/agents/preferences.md` does not contain the `<!-- migrated: ... -->` marker, **stop** and invoke `/migrate`. Do not run any engineering work on un-migrated repos. The user makes the migration decision; the skill executes it. No partial-migration shortcuts.
+2. **Read preferences (3 layers).** Merge global (`~/.pi/agent/preferences.md`) → project (`docs/agents/preferences.md`) → package (`packages/<pkg>/preferences.md` if a single package is targeted). If global is missing, warn once and use built-in defaults from `/taste`.
+3. **Treat preferences as decisions.** Any choice the merged prefs answer is **decided**. Do not re-ask.
+4. **Keep going.** When something would normally cause a halt (ambiguous classification, scope creep beyond `change-budget`, missing follow-up), **expand and surface in the final summary** instead of stopping mid-flow. Halt only when:
+   - migration gate fails, OR
+   - GitHub gate fails (when GitHub is the tracker), OR
+   - a phase's terminal predicate fails twice and the failure cannot be characterised, OR
+   - user interrupts.
+5. **No handoff files.** State of work lives in three places only: **code (git), issue tracker, merged preferences**. Do not create `.scratch/flow/`, `docs/handoff/`, or any session-log file. Phase outputs are remembered in-context; persistent decisions are committed to code or filed as issues.
+6. **Side-effect gates respect prefs literally.** `auto-create-issues`, `auto-apply-labels`, `auto-commit-per-slice`, `auto-pr` follow merged prefs without reinterpretation.
+7. **Status line per phase.** `[flow N/M] <phase-name> — <one-sentence what>`.
+
+## Process
+
+### Step 0 — Bootstrap
+
+```
+- Source ~/.pi/agent/load-env.sh if it exists, to load NPM_TOKEN and other
+  shared secrets from ~/.pi/agent/.env. Skills that need these (e.g. local
+  npm publish) can rely on them being in the environment.
+- Check docs/agents/preferences.md for migration marker.
+  - Missing or no marker → invoke `/migrate`. Do not proceed until migrated.
+- Read ~/.pi/agent/preferences.md (global). Missing → built-in defaults + one-line warning.
+- Read docs/agents/preferences.md (project).
+- Read packages/<pkg>/preferences.md if a single package is targeted.
+- Merge global → project → package; last write wins per key.
+- Read docs/agents/{issue-tracker,triage-labels,domain}.md.
+- If GitHub is the tracker, run a 2-second readiness check (gh auth status, repo accessible). On fail, halt with fix commands.
+- If any preferences file's last-updated > 90 days, append a one-line refresh hint to the final summary.
+- If the user's request hints at continuation ("이어서", "지난번", "where were we", "다시 시작"), invoke `/where` (optional). Otherwise skip it — the migration-enforced state-of-work channels (code / issues / prefs) are usually enough.
+```
+
+### Step 1 — Classify intent
+
+Pick exactly one **intent**:
+
+- `feature` — new capability or extension
+- `bug` — defect / wrong behaviour
+- `perf` — regression or optimisation
+- `refactor` — structural change, no behaviour delta
+- `recon` — design/extractor/scraper exploration
+- `docs` — documentation / context only
+- `triage` — process an incoming ticket
+
+If confidence < `interrupt-on-ambiguity` threshold, ask once with your top guess + alternatives. Otherwise commit and continue.
+
+### Step 2 — Measure scope
+
+Pick exactly one **scope**:
+
+| scope    | proxy                                                |
+| -------- | ---------------------------------------------------- |
+| `nano`   | one file, < ~30 LOC                                  |
+| `small`  | one module/package, no public-API change             |
+| `medium` | one package + tests + ADR-worthy decision possible   |
+| `large`  | cross-package, schema/API change, or multi-day plan  |
+
+If measured scope exceeds `change-budget` (e.g. `module` budget vs `cross-package` work), **expand the budget for this run**, log it for the final summary, and continue. Do not halt.
+
+### Step 3 — Pick the chain
+
+| intent × scope        | chain                                                                                |
+| --------------------- | ------------------------------------------------------------------------------------ |
+| feature × nano        | `tdd`                                                                                |
+| feature × small       | `(opt zoom-out) → tdd → (opt improve-codebase-architecture)`                         |
+| feature × medium      | `(opt zoom-out) → grill-lite → to-issues → tdd per slice → improve-codebase-architecture` |
+| feature × large       | `zoom-out → grill-with-docs → to-prd → to-issues → triage → tdd per slice → improve-codebase-architecture` |
+| bug × nano/small      | `diagnose → tdd (regression) → (opt improve-codebase-architecture)`                  |
+| bug × medium/large    | `diagnose → grill-lite → to-issues → tdd per slice → improve-codebase-architecture`  |
+| perf × any            | same as bug, with diagnose Phase 1 emphasising a measurement loop                    |
+| refactor × any        | `(opt zoom-out) → improve-codebase-architecture → tdd (preserve behaviour)`          |
+| recon × any           | `recon-with-vision → (opt to-prd / to-issues)`                                       |
+| docs × any            | `grill-with-docs`                                                                    |
+| triage × any          | `triage`                                                                             |
+
+`grill-lite` = run `grill-with-docs` only on questions prefs cannot answer. If prefs answer everything, skip entirely.
+
+### Step 4 — Execute the chain
+
+For each phase:
+
+1. Print status line.
+2. Run the phase. Use merged prefs to make every taste decision the phase exposes.
+3. Check the terminal predicate. If fail, retry once with explicit diagnosis. If fail again, halt with reason.
+4. Continue.
+
+**No handoff writes.** Pass state in-context only.
+
+### Step 5 — Live verification
+
+Driven by **two separate prefs keys**:
+
+- `local-live-policy` — local live verification (app actually runs locally; agent drives it). Default: `mandatory`.
+- `ops-live-policy` — production / staging live verification (real users / real infra). Default: `risk-gated`.
+
+Local live is **always required for any change that touches runtime behaviour**, unless the diff is purely documentation, type-only refactors, or test-only edits. Local live = the agent boots the app or the relevant subsystem, drives it, and confirms the change behaves as intended. The agent owns the orchestration; the user is not the test runner.
+
+Ops live runs only when `ops-live-policy` triggers (risk-gated rules: external API, payment, auth, schema migration, business-critical rule, release).
+
+If `local-live-policy=mandatory`, the agent uses the **Local-live playbook** in `docs/agents/preferences.md` (recorded by `/migrate`). If the playbook is in TODO state (heavy stack with no local boot ever set up), the agent:
+
+1. Builds a minimal harness for the targeted subsystem (CLI invocation, single-service spawn, or in-process driver).
+2. Probes the alive-probe signal recorded in the playbook.
+3. Updates the playbook in place if a new boot path emerged.
+
+The user is **not** asked to run anything during a normal flow. The user is consulted again only if (a) the playbook is broken at a structural level (infra changed, secrets rotated, ops connection refused) — surfaced via the failure protocol, or (b) `local-live-policy=mandatory` plus a heavy stack the agent genuinely cannot orchestrate (rare; surface honestly).
+
+### Step 6 — Side effects
+
+Apply per merged prefs:
+
+- Issues / labels: per `auto-create-issues`, `auto-apply-labels`
+- Commits: per `auto-commit-per-slice`
+- Push / PR: per `auto-pr`
+
+If a side-effect was skipped because prefs said so, list it in the final summary so the user can do it manually.
+
+### Step 7 — Final summary
+
+One screen:
+
+- intent / scope / chain executed
+- diffs (files touched)
+- side effects done (issue URLs, commit SHAs, branch name, PR URL)
+- side effects deferred (with reason and the exact command to do them)
+- expansions (scope went beyond budget, ambiguous decisions made with rationale)
+- prefs refresh hint if stale
+
+## Phase contracts (terminal predicates)
+
+| phase                              | done when…                                                                              |
+| ---------------------------------- | --------------------------------------------------------------------------------------- |
+| `zoom-out`                         | module map produced with glossary-aligned names                                         |
+| `grill-with-docs` / `grill-lite`   | every open question answered, deferred with rationale, or escalated; relevant CONTEXT/ADR updates committed |
+| `to-prd`                           | PRD published to issue tracker with `needs-triage` (per `auto-create-issues`)           |
+| `to-issues`                        | all slices created on tracker; each is independently grabbable; labels applied per `auto-apply-labels` |
+| `triage`                           | issue carries exactly one state label; AI disclaimer present                            |
+| `diagnose`                         | reproducible pass/fail loop exists AND root cause identified AND regression test exists |
+| `tdd`                              | new test red→green; project's check command clean; commit per `auto-commit-per-slice`    |
+| `improve-codebase-architecture`    | proposed deepening either applied or recorded as a follow-up issue                      |
+| `recon-with-vision`                | fixture saved; verified field list documented; schema locked                            |
+| local live verification            | agent drove the subsystem; observed behaviour matches intent; evidence captured (log line, screenshot, or output snippet) embedded in the final summary |
+
+## Ambiguity protocol
+
+When you must interrupt (only after exhausting prefs):
+
+```
+[flow] Need one decision — preferences don't cover this.
+
+Question: <one-line>
+My default: <choice + 1-line rationale>
+Alternatives: <a> | <b>
+```
+
+If the user answers, (offer to) add to `preferences.md`.
+
+## Failure protocol
+
+If a phase's terminal predicate cannot be met after two honest attempts, stop and surface a short "blocked at phase X — reason — options" message. Do not silently proceed.
+
+## What this skill does not do
+
+- It does not bypass the migration gate.
+- It does not modify `preferences.md` itself; that is `/taste`'s job.
+- It does not write handoff files.
+- It does not delegate live verification to the user — it orchestrates it.

package/skills/grill-with-docs/ADR-FORMAT.md

@@ -0,0 +1,47 @@
+# ADR Format
+
+ADRs live in `docs/adr/` and use sequential numbering: `0001-slug.md`, `0002-slug.md`, etc.
+
+Create the `docs/adr/` directory lazily — only when the first ADR is needed.
+
+## Template
+
+```md
+# {Short title of the decision}
+
+{1-3 sentences: what's the context, what did we decide, and why.}
+```
+
+That's it. An ADR can be a single paragraph. The value is in recording *that* a decision was made and *why* — not in filling out sections.
+
+## Optional sections
+
+Only include these when they add genuine value. Most ADRs won't need them.
+
+- **Status** frontmatter (`proposed | accepted | deprecated | superseded by ADR-NNNN`) — useful when decisions are revisited
+- **Considered Options** — only when the rejected alternatives are worth remembering
+- **Consequences** — only when non-obvious downstream effects need to be called out
+
+## Numbering
+
+Scan `docs/adr/` for the highest existing number and increment by one.
+
+## When to offer an ADR
+
+All three of these must be true:
+
+1. **Hard to reverse** — the cost of changing your mind later is meaningful
+2. **Surprising without context** — a future reader will look at the code and wonder "why on earth did they do it this way?"
+3. **The result of a real trade-off** — there were genuine alternatives and you picked one for specific reasons
+
+If a decision is easy to reverse, skip it — you'll just reverse it. If it's not surprising, nobody will wonder why. If there was no real alternative, there's nothing to record beyond "we did the obvious thing."
+
+### What qualifies
+
+- **Architectural shape.** "We're using a monorepo." "The write model is event-sourced, the read model is projected into Postgres."
+- **Integration patterns between contexts.** "Ordering and Billing communicate via domain events, not synchronous HTTP."
+- **Technology choices that carry lock-in.** Database, message bus, auth provider, deployment target. Not every library — just the ones that would take a quarter to swap out.
+- **Boundary and scope decisions.** "Customer data is owned by the Customer context; other contexts reference it by ID only." The explicit no-s are as valuable as the yes-s.
+- **Deliberate deviations from the obvious path.** "We're using manual SQL instead of an ORM because X." Anything where a reasonable reader would assume the opposite. These stop the next engineer from "fixing" something that was deliberate.
+- **Constraints not visible in the code.** "We can't use AWS because of compliance requirements." "Response times must be under 200ms because of the partner API contract."
+- **Rejected alternatives when the rejection is non-obvious.** If you considered GraphQL and picked REST for subtle reasons, record it — otherwise someone will suggest GraphQL again in six months.

package/skills/grill-with-docs/CONTEXT-FORMAT.md

@@ -0,0 +1,77 @@
+# CONTEXT.md Format
+
+## Structure
+
+```md
+# {Context Name}
+
+{One or two sentence description of what this context is and why it exists.}
+
+## Language
+
+**Order**:
+{A concise description of the term}
+_Avoid_: Purchase, transaction
+
+**Invoice**:
+A request for payment sent to a customer after delivery.
+_Avoid_: Bill, payment request
+
+**Customer**:
+A person or organization that places orders.
+_Avoid_: Client, buyer, account
+
+## Relationships
+
+- An **Order** produces one or more **Invoices**
+- An **Invoice** belongs to exactly one **Customer**
+
+## Example dialogue
+
+> **Dev:** "When a **Customer** places an **Order**, do we create the **Invoice** immediately?"
+> **Domain expert:** "No — an **Invoice** is only generated once a **Fulfillment** is confirmed."
+
+## Flagged ambiguities
+
+- "account" was used to mean both **Customer** and **User** — resolved: these are distinct concepts.
+```
+
+## Rules
+
+- **Be opinionated.** When multiple words exist for the same concept, pick the best one and list the others as aliases to avoid.
+- **Flag conflicts explicitly.** If a term is used ambiguously, call it out in "Flagged ambiguities" with a clear resolution.
+- **Keep definitions tight.** One sentence max. Define what it IS, not what it does.
+- **Show relationships.** Use bold term names and express cardinality where obvious.
+- **Only include terms specific to this project's context.** General programming concepts (timeouts, error types, utility patterns) don't belong even if the project uses them extensively. Before adding a term, ask: is this a concept unique to this context, or a general programming concept? Only the former belongs.
+- **Group terms under subheadings** when natural clusters emerge. If all terms belong to a single cohesive area, a flat list is fine.
+- **Write an example dialogue.** A conversation between a dev and a domain expert that demonstrates how the terms interact naturally and clarifies boundaries between related concepts.
+
+## Single vs multi-context repos
+
+**Single context (most repos):** One `CONTEXT.md` at the repo root.
+
+**Multiple contexts:** A `CONTEXT-MAP.md` at the repo root lists the contexts, where they live, and how they relate to each other:
+
+```md
+# Context Map
+
+## Contexts
+
+- [Ordering](./src/ordering/CONTEXT.md) — receives and tracks customer orders
+- [Billing](./src/billing/CONTEXT.md) — generates invoices and processes payments
+- [Fulfillment](./src/fulfillment/CONTEXT.md) — manages warehouse picking and shipping
+
+## Relationships
+
+- **Ordering → Fulfillment**: Ordering emits `OrderPlaced` events; Fulfillment consumes them to start picking
+- **Fulfillment → Billing**: Fulfillment emits `ShipmentDispatched` events; Billing consumes them to generate invoices
+- **Ordering ↔ Billing**: Shared types for `CustomerId` and `Money`
+```
+
+The skill infers which structure applies:
+
+- If `CONTEXT-MAP.md` exists, read it to find contexts
+- If only a root `CONTEXT.md` exists, single context
+- If neither exists, create a root `CONTEXT.md` lazily when the first term is resolved
+
+When multiple contexts exist, infer which one the current topic relates to. If unclear, ask.

package/skills/grill-with-docs/SKILL.md

@@ -0,0 +1,88 @@
+---
+name: grill-with-docs
+description: Grilling session that challenges your plan against the existing domain model, sharpens terminology, and updates documentation (CONTEXT.md, ADRs) inline as decisions crystallise. Use when user wants to stress-test a plan against their project's language and documented decisions.
+---
+
+<what-to-do>
+
+Interview me relentlessly about every aspect of this plan until we reach a shared understanding. Walk down each branch of the design tree, resolving dependencies between decisions one-by-one. For each question, provide your recommended answer.
+
+Ask the questions one at a time, waiting for feedback on each question before continuing.
+
+If a question can be answered by exploring the codebase, explore the codebase instead.
+
+</what-to-do>
+
+<supporting-info>
+
+## Domain awareness
+
+During codebase exploration, read `docs/agents/domain.md` first if it exists, then look for existing documentation:
+
+### File structure
+
+Most repos have a single context:
+
+```
+/
+├── CONTEXT.md
+├── docs/
+│   └── adr/
+│       ├── 0001-event-sourced-orders.md
+│       └── 0002-postgres-for-write-model.md
+└── src/
+```
+
+If a `CONTEXT-MAP.md` exists at the root, the repo has multiple contexts. The map points to where each one lives:
+
+```
+/
+├── CONTEXT-MAP.md
+├── docs/
+│   └── adr/                          ← system-wide decisions
+├── src/
+│   ├── ordering/
+│   │   ├── CONTEXT.md
+│   │   └── docs/adr/                 ← context-specific decisions
+│   └── billing/
+│       ├── CONTEXT.md
+│       └── docs/adr/
+```
+
+Create files lazily — only when you have something to write. If no `CONTEXT.md` exists, create one when the first term is resolved. If no `docs/adr/` exists, create it when the first ADR is needed.
+
+## During the session
+
+### Challenge against the glossary
+
+When the user uses a term that conflicts with the existing language in `CONTEXT.md`, call it out immediately. "Your glossary defines 'cancellation' as X, but you seem to mean Y — which is it?"
+
+### Sharpen fuzzy language
+
+When the user uses vague or overloaded terms, propose a precise canonical term. "You're saying 'account' — do you mean the Customer or the User? Those are different things."
+
+### Discuss concrete scenarios
+
+When domain relationships are being discussed, stress-test them with specific scenarios. Invent scenarios that probe edge cases and force the user to be precise about the boundaries between concepts.
+
+### Cross-reference with code
+
+When the user states how something works, check whether the code agrees. If you find a contradiction, surface it: "Your code cancels entire Orders, but you just said partial cancellation is possible — which is right?"
+
+### Update CONTEXT.md inline
+
+When a term is resolved, update `CONTEXT.md` right there. Don't batch these up — capture them as they happen. Use the format in [CONTEXT-FORMAT.md](./CONTEXT-FORMAT.md).
+
+Don't couple `CONTEXT.md` to implementation details. Only include terms that are meaningful to domain experts.
+
+### Offer ADRs sparingly
+
+Only offer to create an ADR when all three are true:
+
+1. **Hard to reverse** — the cost of changing your mind later is meaningful
+2. **Surprising without context** — a future reader will wonder "why did they do it this way?"
+3. **The result of a real trade-off** — there were genuine alternatives and you picked one for specific reasons
+
+If any of the three is missing, skip the ADR. Use the format in [ADR-FORMAT.md](./ADR-FORMAT.md).
+
+</supporting-info>

package/skills/improve-codebase-architecture/DEEPENING.md

@@ -0,0 +1,37 @@
+# Deepening
+
+How to deepen a cluster of shallow modules safely, given its dependencies. Assumes the vocabulary in [LANGUAGE.md](LANGUAGE.md) — **module**, **interface**, **seam**, **adapter**.
+
+## Dependency categories
+
+When assessing a candidate for deepening, classify its dependencies. The category determines how the deepened module is tested across its seam.
+
+### 1. In-process
+
+Pure computation, in-memory state, no I/O. Always deepenable — merge the modules and test through the new interface directly. No adapter needed.
+
+### 2. Local-substitutable
+
+Dependencies that have local test stand-ins (PGLite for Postgres, in-memory filesystem). Deepenable if the stand-in exists. The deepened module is tested with the stand-in running in the test suite. The seam is internal; no port at the module's external interface.
+
+### 3. Remote but owned (Ports & Adapters)
+
+Your own services across a network boundary (microservices, internal APIs). Define a **port** (interface) at the seam. The deep module owns the logic; the transport is injected as an **adapter**. Tests use an in-memory adapter. Production uses an HTTP/gRPC/queue adapter.
+
+Recommendation shape: *"Define a port at the seam, implement an HTTP adapter for production and an in-memory adapter for testing, so the logic sits in one deep module even though it's deployed across a network."*
+
+### 4. True external (Mock)
+
+Third-party services (Stripe, Twilio, etc.) you don't control. The deepened module takes the external dependency as an injected port; tests provide a mock adapter.
+
+## Seam discipline
+
+- **One adapter means a hypothetical seam. Two adapters means a real one.** Don't introduce a port unless at least two adapters are justified (typically production + test). A single-adapter seam is just indirection.
+- **Internal seams vs external seams.** A deep module can have internal seams (private to its implementation, used by its own tests) as well as the external seam at its interface. Don't expose internal seams through the interface just because tests use them.
+
+## Testing strategy: replace, don't layer
+
+- Old unit tests on shallow modules become waste once tests at the deepened module's interface exist — delete them.
+- Write new tests at the deepened module's interface. The **interface is the test surface**.
+- Tests assert on observable outcomes through the interface, not internal state.
+- Tests should survive internal refactors — they describe behaviour, not implementation. If a test has to change when the implementation changes, it's testing past the interface.

package/skills/improve-codebase-architecture/INTERFACE-DESIGN.md

@@ -0,0 +1,44 @@
+# Interface Design
+
+When the user wants to explore alternative interfaces for a chosen deepening candidate, use this multi-pass design pattern. Based on "Design It Twice" (Ousterhout) — your first idea is unlikely to be the best.
+
+Uses the vocabulary in [LANGUAGE.md](LANGUAGE.md) — **module**, **interface**, **seam**, **adapter**, **leverage**.
+
+## Process
+
+### 1. Frame the problem space
+
+Before generating alternatives, write a user-facing explanation of the problem space for the chosen candidate:
+
+- The constraints any new interface would need to satisfy
+- The dependencies it would rely on, and which category they fall into (see [DEEPENING.md](DEEPENING.md))
+- A rough illustrative code sketch to ground the constraints — not a proposal, just a way to make the constraints concrete
+
+Show this to the user, then immediately proceed to Step 2. The user reads and thinks while the alternatives are generated.
+
+### 2. Generate alternatives
+
+Generate 3+ **radically different** interfaces for the deepened module. If the runtime offers subagents, run them in parallel. Otherwise, run separate design passes yourself and keep their constraints independent.
+
+Use a separate technical brief for each pass (file paths, coupling details, dependency category from [DEEPENING.md](DEEPENING.md), what sits behind the seam). The brief is independent of the user-facing problem-space explanation in Step 1. Give each pass a different design constraint:
+
+- Pass 1: "Minimize the interface — aim for 1–3 entry points max. Maximise leverage per entry point."
+- Pass 2: "Maximise flexibility — support many use cases and extension."
+- Pass 3: "Optimise for the most common caller — make the default case trivial."
+- Pass 4 (if applicable): "Design around ports & adapters for cross-seam dependencies."
+
+Include both [LANGUAGE.md](LANGUAGE.md) vocabulary and CONTEXT.md vocabulary in the brief so each pass names things consistently with the architecture language and the project's domain language.
+
+Each pass outputs:
+
+1. Interface (types, methods, params — plus invariants, ordering, error modes)
+2. Usage example showing how callers use it
+3. What the implementation hides behind the seam
+4. Dependency strategy and adapters (see [DEEPENING.md](DEEPENING.md))
+5. Trade-offs — where leverage is high, where it's thin
+
+### 3. Present and compare
+
+Present designs sequentially so the user can absorb each one, then compare them in prose. Contrast by **depth** (leverage at the interface), **locality** (where change concentrates), and **seam placement**.
+
+After comparing, give your own recommendation: which design you think is strongest and why. If elements from different designs would combine well, propose a hybrid. Be opinionated — the user wants a strong read, not a menu.

package/skills/improve-codebase-architecture/LANGUAGE.md

@@ -0,0 +1,53 @@
+# Language
+
+Shared vocabulary for every suggestion this skill makes. Use these terms exactly — don't substitute "component," "service," "API," or "boundary." Consistent language is the whole point.
+
+## Terms
+
+**Module**
+Anything with an interface and an implementation. Deliberately scale-agnostic — applies equally to a function, class, package, or tier-spanning slice.
+_Avoid_: unit, component, service.
+
+**Interface**
+Everything a caller must know to use the module correctly. Includes the type signature, but also invariants, ordering constraints, error modes, required configuration, and performance characteristics.
+_Avoid_: API, signature (too narrow — those refer only to the type-level surface).
+
+**Implementation**
+What's inside a module — its body of code. Distinct from **Adapter**: a thing can be a small adapter with a large implementation (a Postgres repo) or a large adapter with a small implementation (an in-memory fake). Reach for "adapter" when the seam is the topic; "implementation" otherwise.
+
+**Depth**
+Leverage at the interface — the amount of behaviour a caller (or test) can exercise per unit of interface they have to learn. A module is **deep** when a large amount of behaviour sits behind a small interface. A module is **shallow** when the interface is nearly as complex as the implementation.
+
+**Seam** _(from Michael Feathers)_
+A place where you can alter behaviour without editing in that place. The *location* at which a module's interface lives. Choosing where to put the seam is its own design decision, distinct from what goes behind it.
+_Avoid_: boundary (overloaded with DDD's bounded context).
+
+**Adapter**
+A concrete thing that satisfies an interface at a seam. Describes *role* (what slot it fills), not substance (what's inside).
+
+**Leverage**
+What callers get from depth. More capability per unit of interface they have to learn. One implementation pays back across N call sites and M tests.
+
+**Locality**
+What maintainers get from depth. Change, bugs, knowledge, and verification concentrate at one place rather than spreading across callers. Fix once, fixed everywhere.
+
+## Principles
+
+- **Depth is a property of the interface, not the implementation.** A deep module can be internally composed of small, mockable, swappable parts — they just aren't part of the interface. A module can have **internal seams** (private to its implementation, used by its own tests) as well as the **external seam** at its interface.
+- **The deletion test.** Imagine deleting the module. If complexity vanishes, the module wasn't hiding anything (it was a pass-through). If complexity reappears across N callers, the module was earning its keep.
+- **The interface is the test surface.** Callers and tests cross the same seam. If you want to test *past* the interface, the module is probably the wrong shape.
+- **One adapter means a hypothetical seam. Two adapters means a real one.** Don't introduce a seam unless something actually varies across it.
+
+## Relationships
+
+- A **Module** has exactly one **Interface** (the surface it presents to callers and tests).
+- **Depth** is a property of a **Module**, measured against its **Interface**.
+- A **Seam** is where a **Module**'s **Interface** lives.
+- An **Adapter** sits at a **Seam** and satisfies the **Interface**.
+- **Depth** produces **Leverage** for callers and **Locality** for maintainers.
+
+## Rejected framings
+
+- **Depth as ratio of implementation-lines to interface-lines** (Ousterhout): rewards padding the implementation. We use depth-as-leverage instead.
+- **"Interface" as the TypeScript `interface` keyword or a class's public methods**: too narrow — interface here includes every fact a caller must know.
+- **"Boundary"**: overloaded with DDD's bounded context. Say **seam** or **interface**.

package/skills/improve-codebase-architecture/SKILL.md

@@ -0,0 +1,71 @@
+---
+name: improve-codebase-architecture
+description: Find deepening opportunities in a codebase, informed by the domain language in CONTEXT.md and the decisions in docs/adr/. Use when the user wants to improve architecture, find refactoring opportunities, consolidate tightly-coupled modules, or make a codebase more testable and AI-navigable.
+---
+
+# Improve Codebase Architecture
+
+Surface architectural friction and propose **deepening opportunities** — refactors that turn shallow modules into deep ones. The aim is testability and AI-navigability.
+
+## Glossary
+
+Use these terms exactly in every suggestion. Consistent language is the point — don't drift into "component," "service," "API," or "boundary." Full definitions in [LANGUAGE.md](LANGUAGE.md).
+
+- **Module** — anything with an interface and an implementation (function, class, package, slice).
+- **Interface** — everything a caller must know to use the module: types, invariants, error modes, ordering, config. Not just the type signature.
+- **Implementation** — the code inside.
+- **Depth** — leverage at the interface: a lot of behaviour behind a small interface. **Deep** = high leverage. **Shallow** = interface nearly as complex as the implementation.
+- **Seam** — where an interface lives; a place behaviour can be altered without editing in place. (Use this, not "boundary.")
+- **Adapter** — a concrete thing satisfying an interface at a seam.
+- **Leverage** — what callers get from depth.
+- **Locality** — what maintainers get from depth: change, bugs, knowledge concentrated in one place.
+
+Key principles (see [LANGUAGE.md](LANGUAGE.md) for the full list):
+
+- **Deletion test**: imagine deleting the module. If complexity vanishes, it was a pass-through. If complexity reappears across N callers, it was earning its keep.
+- **The interface is the test surface.**
+- **One adapter = hypothetical seam. Two adapters = real seam.**
+
+This skill is _informed_ by the project's domain model. The domain language gives names to good seams; ADRs record decisions the skill should not re-litigate.
+
+## Process
+
+### 1. Explore
+
+Read `docs/agents/domain.md` if it exists, then read the project's domain glossary, relevant project docs, and any ADRs in the area you're touching.
+
+Then walk the codebase. If the runtime offers subagents, use an Explore subagent; otherwise run an explicit exploration pass yourself. Don't follow rigid heuristics — explore organically and note where you experience friction:
+
+- Where does understanding one concept require bouncing between many small modules?
+- Where are modules **shallow** — interface nearly as complex as the implementation?
+- Where have pure functions been extracted just for testability, but the real bugs hide in how they're called (no **locality**)?
+- Where do tightly-coupled modules leak across their seams?
+- Which parts of the codebase are untested, or hard to test through their current interface?
+
+Apply the **deletion test** to anything you suspect is shallow: would deleting it concentrate complexity, or just move it? A "yes, concentrates" is the signal you want.
+
+### 2. Present candidates
+
+Present a numbered list of deepening opportunities. For each candidate:
+
+- **Files** — which files/modules are involved
+- **Problem** — why the current architecture is causing friction
+- **Solution** — plain English description of what would change
+- **Benefits** — explained in terms of locality and leverage, and also in how tests would improve
+
+**Use CONTEXT.md vocabulary for the domain, and [LANGUAGE.md](LANGUAGE.md) vocabulary for the architecture.** If `CONTEXT.md` defines "Order," talk about "the Order intake module" — not "the FooBarHandler," and not "the Order service."
+
+**ADR conflicts**: if a candidate contradicts an existing ADR, only surface it when the friction is real enough to warrant revisiting the ADR. Mark it clearly (e.g. _"contradicts ADR-0007 — but worth reopening because…"_). Don't list every theoretical refactor an ADR forbids.
+
+Do NOT propose interfaces yet. Ask the user: "Which of these would you like to explore?"
+
+### 3. Grilling loop
+
+Once the user picks a candidate, drop into a grilling conversation. Walk the design tree with them — constraints, dependencies, the shape of the deepened module, what sits behind the seam, what tests survive.
+
+Side effects happen inline as decisions crystallize:
+
+- **Naming a deepened module after a concept not in `CONTEXT.md`?** Add the term to `CONTEXT.md` — same discipline as `/grill-with-docs` (see [CONTEXT-FORMAT.md](../grill-with-docs/CONTEXT-FORMAT.md)). Create the file lazily if it doesn't exist.
+- **Sharpening a fuzzy term during the conversation?** Update `CONTEXT.md` right there.
+- **User rejects the candidate with a load-bearing reason?** Offer an ADR, framed as: _"Want me to record this as an ADR so future architecture reviews don't re-suggest it?"_ Only offer when the reason would actually be needed by a future explorer to avoid re-suggesting the same thing — skip ephemeral reasons ("not worth it right now") and self-evident ones. See [ADR-FORMAT.md](../grill-with-docs/ADR-FORMAT.md).
+- **Want to explore alternative interfaces for the deepened module?** See [INTERFACE-DESIGN.md](INTERFACE-DESIGN.md).