showdar-skills 0.2.0

package/skills/showdar-security/scripts/inspect-security-surface.mjs

@@ -0,0 +1,47 @@
+#!/usr/bin/env node
+import { readdir, readFile, stat } from 'node:fs/promises';
+import path from 'node:path';
+
+const root = path.resolve(process.argv[2] ?? process.cwd());
+
+function add(groups, group, relative) {
+  groups[group].push(relative || '.');
+}
+
+function classify(relative, groups) {
+  const name = path.basename(relative).toLowerCase();
+  const normalized = relative.toLowerCase().replaceAll(path.sep, '/');
+  if (/^\.env(?:\.|$)/.test(name)) add(groups, 'envFiles', relative);
+  if (/^(package(-lock)?\.json|yarn\.lock|pnpm-lock\.yaml|bun\.lockb?|composer\.lock|go\.sum|cargo\.lock)$/.test(name)) add(groups, 'dependencyManifests', relative);
+  if (/(auth|security|permission|token|session|crypto|oauth|login|biometric|deep[-_ ]?link|webview|key|cert|credential)/.test(name)) add(groups, 'securitySensitiveFiles', relative);
+  if (/\.(ya?ml|json|toml|xml|plist|conf|config)$/.test(name)) add(groups, 'configurationFiles', relative);
+  if (/(^|\/)(android|ios|mobile)(\/|$)/.test(normalized)) add(groups, 'platformSecurityFiles', relative);
+}
+
+async function walk(directory, relative = '', depth = 0, groups = {
+  envFiles: [], dependencyManifests: [], securitySensitiveFiles: [], configurationFiles: [], platformSecurityFiles: [],
+}) {
+  if (depth > 4) return groups;
+  let entries = [];
+  try { entries = await readdir(directory, { withFileTypes: true }); } catch { return groups; }
+  entries.sort((a, b) => a.name.localeCompare(b.name));
+  for (const entry of entries) {
+    if (entry.name === 'node_modules' || entry.name === '.git') continue;
+    const childRelative = relative ? path.join(relative, entry.name) : entry.name;
+    const child = path.join(directory, entry.name);
+    if (entry.isDirectory()) await walk(child, childRelative, depth + 1, groups);
+    else classify(childRelative, groups);
+  }
+  return groups;
+}
+
+try {
+  const info = await stat(root);
+  if (!info.isDirectory()) throw new Error('target must be a directory');
+  const groups = await walk(root);
+  for (const values of Object.values(groups)) values.sort();
+  console.log(JSON.stringify({ root, ...groups }, null, 2));
+} catch (error) {
+  console.error(`inspect-security-surface: ${error.message}`);
+  process.exitCode = 1;
+}

package/skills/showdar-ship/SKILL.md

@@ -0,0 +1,234 @@
+---
+name: showdar-ship
+description: Use when checking whether a change, artifact, or release is ready for handoff or external release.
+---
+
+# Showdar Ship
+
+## Purpose
+
+`showdar-ship` is a delivery-verification skill. Its normal job is to decide
+whether the requested change is safe to hand off, merge, package, publish, or
+release, using fresh local evidence and repository-defined checks.
+
+It may inspect existing release, deployment, and CI configuration as evidence.
+It does not create or modify that infrastructure in its normal verification
+mode. A readiness report is not an instruction to deploy.
+
+## When to use
+
+- Verifying a completed change before handoff or merge.
+- Assessing release readiness for a web, backend, mobile, Docker, or desktop artifact.
+- Checking package/export/type/build metadata before a requested handoff.
+- Reviewing existing release or CI configuration for canonical commands and gaps.
+- Verifying an explicitly requested deployment, store submission, or release execution.
+
+## When not to use
+
+- Routine implementation, debugging, code review, or test-strategy work.
+- Creating CI/CD, deployment, release, secrets, or environment infrastructure.
+- Treating “ship”, “release checklist”, or “is this ready?” as permission to deploy or publish.
+- Requiring a deployed endpoint when local artifact and repository checks answer the request.
+
+## Inputs and assumptions
+
+- The requested outcome and whether it explicitly names release/deployment execution.
+- Current Git/worktree state and the exact change or artifact under review.
+- Repository-owned test, typecheck, lint, build, package, and smoke commands.
+- Existing release/CI configuration may be inspected read-only to discover commands.
+- Secret, signing, store, deployment, and production access remains external; never request values.
+- `scripts/detect-targets.mjs` and `scripts/release-check.mjs` provide read-only preflight signals.
+
+## Non-negotiable rules
+
+- Default mode is delivery verification, not deployment execution.
+- No readiness claim without fresh checks appropriate to the requested change.
+- Ordinary Ship verification does not require CI/CD, a hosted provider, or a deployed endpoint.
+- Existing CI is read-only by default: inspect it for commands or inconsistencies, but do not modify it.
+- A deployed endpoint is not required for ordinary ship verification. Report external checks as unavailable when they are outside the request.
+- Never print, commit, embed, or copy secret values into artifacts, logs, or reports.
+- Publishing, deploying, tagging, pushing, store submission, production mutation, and destructive migration require explicit user intent and any separate approval required by repository policy.
+- Keep release-specific metadata, symbols, mappings, migration compatibility, and rollback evidence when they are relevant to the requested artifact.
+
+## Hard scope boundary
+
+Unless the current user/task explicitly requests deployment or release execution,
+`showdar-ship` MUST NOT:
+
+- create or modify `.github/workflows/**`;
+- create GitHub Actions, CI/CD pipelines, or release automation;
+- configure deployment providers, coverage/SaaS CI services, branch protection, or environment/secrets infrastructure;
+- add Docker solely for CI or deployment;
+- deploy anything, publish packages/apps, or change production infrastructure.
+
+`.github/workflows/**` is outside normal Ship mutation scope even when an
+existing workflow is failing. An explicit CI/CD task must be routed and scoped
+as that task before any CI change is proposed.
+
+## Explicit intent gate
+
+Words such as “ship”, “release-ready”, “prepare a checklist”, “handoff”, or
+“verify” select verification mode. Execution mode is activated only when the
+request explicitly names an action, target, and release/deployment context,
+such as “deploy this service to staging”, “publish this package”, “submit this
+build to TestFlight”, or “create the GitHub Actions workflow”.
+
+Only when explicit deployment or release-execution intent exists may the skill
+prepare execution-specific commands or load `references/post-deploy.md`,
+`references/rollback.md`, or rollout guidance. Even then, describe the command
+and its risk before running it, and stop for any required approval.
+
+## Existing CI is read-only
+
+If `.github/workflows/**`, `.gitlab-ci.yml`, `Jenkinsfile`, or another CI file
+already exists:
+
+Inspect existing CI configuration without modifying it.
+
+- read it to discover canonical test/build/package commands and target assumptions;
+- compare it with local scripts and report drift, missing coverage, or failures;
+- do not edit, add, delete, enable, or “repair” the CI file in ordinary Ship mode;
+- do not infer that CI must exist, must pass, or must be recreated for local readiness.
+
+## Workflow
+
+### Phase 1 — classify request and scope
+
+- Read the exact request and classify it as verification or explicit execution.
+- Record the target artifact/platform only when relevant.
+- If intent is ambiguous, stay in verification mode and report the missing decision.
+
+### Phase 2 — inspect repository state
+
+- Run `git status`, inspect the requested diff, and confirm the active branch.
+- Identify repository-owned scripts from `package.json`, Makefiles, task runners, and existing CI configuration without changing them.
+- Use read-only target detection when platform selection is unclear.
+
+### Phase 3 — run local readiness checks
+
+Run the smallest relevant set of existing commands:
+
+- focused tests and the repository test command;
+- typecheck, analyzer, and lint when configured;
+- production/release build or package/export validation when the artifact is in scope;
+- install, smoke, API, or native checks that can run locally;
+- version, build number, changelog, package exports, and generated-file checks when relevant.
+
+Do not add a workflow, hosted service, deployed endpoint, or production secret
+just to obtain one of these checks.
+
+### Phase 4 — inspect platform guidance
+
+- Web/static web -> `stacks/web.md`.
+- Next.js -> `stacks/nextjs.md` plus applicable web checks.
+- Node backend -> `stacks/node-backend.md`.
+- Docker -> `stacks/docker.md`.
+- iOS -> `stacks/ios.md`.
+- Android -> `stacks/android.md`.
+- Tauri/desktop -> `stacks/tauri.md`.
+- Container orchestration -> `stacks/orchestration.md` only when the request explicitly concerns that execution surface.
+
+Keep platform checks focused on evidence that can be gathered locally. Store,
+provider, deployed-service, and production-observability checks are external
+unless the request explicitly asks for their verification.
+
+### Phase 5 — optional explicit execution branch
+
+When the explicit intent gate is satisfied, identify the exact command, target,
+credentials boundary, irreversible effects, rollout/rollback constraints, and
+post-execution evidence before acting. Load the execution references only for
+that branch. Do not convert a checklist request into execution permission.
+
+### Phase 6 — readiness report
+
+Report passed, failed, blocked, and unverified checks. Distinguish local proof
+from external proof. State whether execution was requested and whether any
+execution occurred. Do not call a change ready merely because a workflow is
+green or an upload command succeeded.
+
+## Decision points
+
+- Ordinary code/package change? Verify local scope, tests, static checks, build, and exports; no endpoint or CI change is needed.
+- Existing CI found? Inspect commands and report drift; keep it unchanged.
+- Static web? Inspect generated files, routes, asset paths, and cache intent; do not publish an artifact by default.
+- Backend or Docker? Verify local startup, health/readiness behavior, config names, migrations, and graceful shutdown where reproducible.
+- Mobile/native artifact? Verify identifiers, signing metadata, permissions, symbols, and installable output when available; store submission is separate.
+- Stateful change? Assess backward compatibility and rollback safety; do not run production data mutation without explicit approval.
+- Explicit deployment/release execution? Add target-specific external checks only after the intent gate is satisfied.
+
+## Stack detection
+
+- Detect targets before choosing local checks, but do not turn detected CI or deployment files into a mutation request.
+- Web and backend checks remain separate when a repository contains both.
+- React Native and Flutter release artifacts may need native iOS/Android checks even when shared code changed only once.
+- Tauri/Electron signing and updater surfaces are distinct from frontend build verification.
+- Docker is an artifact/runtime layer; orchestration execution is a separate, explicit scope.
+- Existing CI detection is evidence collection only.
+
+## Failure modes
+
+- “CI green” treated as proof that the requested local artifact or diff is ready.
+- A checklist request interpreted as deploy, publish, tag, or workflow creation permission.
+- A local readiness task blocked because no deployed endpoint exists.
+- Existing workflow edited to make a local test pass.
+- Upload or package command treated as proof of user-visible health.
+- Secrets printed while proving configuration presence.
+- Migration, signing, symbol, mapping, or package metadata omitted from the evidence.
+- Production behavior guessed from a development server or preview configuration.
+
+## Stop conditions
+
+- Stop before creating or modifying CI/CD, deployment, release, provider, secret, environment, branch-protection, or production infrastructure unless explicitly requested.
+- Stop before deploy, publish, tag, push, store submission, destructive migration, credential operation, or production mutation without explicit intent and required approval.
+- Stop when the request is ordinary verification but the next proposed action would change external state.
+- Stop when required local evidence is unavailable; report it as blocked or unverified instead of inventing a hosted check.
+- Stop when repository instructions conflict with this playbook; user and repository instructions win.
+
+## Escalation conditions
+
+- Ask for the target and explicit action when execution intent is unclear.
+- Escalate signing, store, provider, production, irreversible data, and credential decisions without requesting secret values.
+- Escalate CI changes as a separate task; do not smuggle them into Ship readiness work.
+- Escalate missing rollback or observability evidence when the user explicitly requests deployment/release execution.
+
+## Verification
+
+- Run fresh relevant local test, typecheck/analyzer, lint, build, package, export, install, and smoke commands.
+- Inspect `git status` and the requested diff for scope and generated artifacts.
+- Confirm package exports, public types, version/build metadata, and changelog only when relevant.
+- Read existing CI/release configuration without modifying it.
+- Record external endpoint, store, provider, deployment, and observability checks as unverified unless explicitly requested and actually observed.
+- For explicit execution, record the exact target, artifact/version, command status, and post-execution evidence separately.
+
+## Output contract
+
+- **Intent and scope** — verification or explicitly requested execution.
+- **Target/artifact** — only the platform and version relevant to the request.
+- **Local evidence** — commands and exact results.
+- **Existing CI/release inspection** — read-only findings, if any.
+- **Readiness** — ready, not ready, blocked, or unverified with reasons.
+- **External checks** — clearly separated from local proof; not required for ordinary Ship verification.
+- **Execution status** — not requested / not performed / performed with explicit authorization.
+- **Next decision** — the smallest user decision needed, if any.
+
+## Anti-patterns
+
+- Creating `.github/workflows/**` because a normal change needs verification.
+- Adding CI/CD, a hosted coverage service, Docker, deployment config, or secrets infrastructure to complete a checklist.
+- Auto-deploying because the user said “ship”.
+- Requiring a production URL for local readiness.
+- Editing existing CI when the task is only implementation, testing, review, or release-readiness assessment.
+- Printing environment, signing, store, or deployment secrets.
+- Claiming “deployed”, “published”, or “healthy” without observing the corresponding external state.
+
+## Example
+
+User request: “Ship the current fix and tell me if it is ready.”
+
+- Stay in verification mode: inspect the diff, run repository tests/typecheck/lint/build, inspect package or release metadata when relevant, and report readiness.
+- Read an existing workflow only to find the canonical command if useful; do not create or modify CI.
+- Do not require a deployed endpoint and do not deploy or publish.
+
+User request: “Deploy this backend to staging and verify the deployed health endpoint.”
+
+- Use the explicit execution branch, name the target and artifact, present the command/risk boundary, obtain required approval, then use `references/post-deploy.md` for the requested external verification.

package/skills/showdar-ship/data/index.json

@@ -0,0 +1,14 @@
+{
+  "version": 1,
+  "skill": "showdar-ship",
+  "datasets": [
+    {
+      "file": "data/release-checks.csv",
+      "idField": "id",
+      "requiredColumns": ["id", "target", "category", "check", "critical", "evidence", "owner", "rollback_or_followup", "tags", "reference", "stack"],
+      "searchableFields": ["target", "category", "check", "evidence", "owner", "rollback_or_followup", "tags"],
+      "filterFields": ["target", "category", "critical", "stack"],
+      "reference": "references/release-readiness.md"
+    }
+  ]
+}

package/skills/showdar-ship/data/release-checks.csv

@@ -0,0 +1,28 @@
+id,target,category,check,critical,evidence,owner,rollback_or_followup,tags,reference,stack
+web-build,web,build,release candidate build completes locally,yes,build exit code and artifact manifest,change owner,record prior artifact for explicit rollback assessment,web build,references/release-readiness.md,*
+web-env,web,environment,required environment names are present without exposing values,yes,redacted config metadata and startup check,release owner,restore prior environment mapping,web environment,references/secrets.md,*
+web-routes,web,smoke,critical routes and assets load in a local production-like preview,yes,authenticated and unauthenticated local smoke result,product owner,record external route failure for explicit execution review,web smoke,references/release-readiness.md,nextjs
+web-cache,web,delivery,headers and cache freshness match release intent,no,response headers and local cache/revalidation evidence,change owner,record external cache action as unverified,web cache,references/release-readiness.md,*
+backend-artifact,backend,build,backend artifact starts with a release-like runtime locally,yes,start log and artifact digest,change owner,record prior digest for explicit rollback assessment,backend artifact,references/release-readiness.md,node
+backend-config,backend,environment,config and secret references resolve by name,yes,startup/readiness result without values,backend owner,restore prior config mapping,backend config,references/secrets.md,node
+backend-migration,backend,data,migration is compatible with old and new app,yes,schema diff and compatibility analysis,change owner,document compatibility limits for explicit execution,backend migration,references/migrations.md,node
+backend-health,backend,health,health and readiness checks pass in a local release-like runtime,yes,versioned response from local instance,change owner,report external health as unverified unless explicitly requested,backend health,references/release-readiness.md,node
+backend-shutdown,backend,reliability,graceful shutdown drains work,yes,termination test and no dropped in-flight work,backend owner,restore prior process config,graceful shutdown,references/release-readiness.md,node
+backend-observability,backend,observability,local logs metrics traces and alert assumptions identify the candidate,yes,local release marker and alert configuration check,change owner,inspect external dashboard only for explicit execution,observability,references/release-readiness.md,node
+docker-build,docker,build,image builds reproducibly,yes,digest and build command output,release owner,retain prior image digest,docker image,references/release-readiness.md,docker
+docker-runtime,docker,smoke,container starts expected entrypoint as non-root where practical,yes,local container smoke and health result,change owner,record prior image for explicit rollback assessment,docker runtime,references/release-readiness.md,docker
+docker-secrets,docker,security,secrets are injected at runtime not baked into layers,yes,config inspection and secret scan without values,platform owner,rebuild from prior safe image,docker secrets,references/secrets.md,docker
+orchestration-rollout,docker,rollout,explicit orchestration task has readiness gates and replica assumptions,yes,configuration inspection and recorded target evidence,change owner,leave cluster action for explicit execution,orchestration,references/release-readiness.md,kubernetes
+orchestration-rollback,docker,rollback,explicit orchestration task has a recoverable previous image and config,yes,dry-run or recorded rollback plan,change owner,execute only after explicit approval,orchestration rollback,references/rollback.md,kubernetes
+ios-version,ios,version,bundle ID and marketing/build version are deliberate,yes,archive metadata,release owner,restore prior version metadata,ios version,references/release-readiness.md,ios
+ios-signing,ios,signing,scheme signing entitlements and provisioning validate,yes,archive validation result,release owner,use prior signed artifact,ios signing,references/secrets.md,ios
+ios-privacy,ios,compliance,privacy manifest and usage descriptions match APIs,yes,archive/store validation,release owner,withdraw build and keep prior release,ios privacy,references/release-readiness.md,ios
+ios-symbols,ios,diagnostics,dSYM and archive are retained with release identity,yes,artifact checksum and local symbol identity,change owner,retain prior symbols for explicit release recovery,ios symbols,references/release-readiness.md,ios
+ios-smoke,ios,smoke,install launch login push/deep-link critical flow on a local device or simulator,yes,local device smoke result,QA owner,record TestFlight/store verification as unverified,ios smoke,references/release-readiness.md,ios
+android-version,android,version,application ID versionCode and versionName are correct,yes,AAB metadata,release owner,restore prior version config,android version,references/release-readiness.md,android
+android-signing,android,signing,release signing and permissions validate,yes,bundle build and signing result,release owner,use prior signed bundle,android signing,references/secrets.md,android
+android-symbols,android,diagnostics,R8 mapping and native symbols are retained,yes,mapping artifact linked to candidate version,change owner,retain prior mapping for explicit release recovery,android symbols,references/release-readiness.md,android
+android-smoke,android,smoke,install launch update and critical journey pass on a local device,yes,local device result,QA owner,record Play track verification as unverified,android smoke,references/release-readiness.md,android
+tauri-artifact,desktop,build,Rust/frontend bundle and updater metadata are correct,yes,platform artifact and checksum,release owner,retain previous bundle,tauri artifact,references/release-readiness.md,tauri
+tauri-signing,desktop,signing,desktop signing/notarization and update path validate,yes,platform verification result,release owner,serve previous signed release,tauri signing,references/secrets.md,tauri
+tauri-smoke,desktop,smoke,clean-machine install launch and update smoke pass,yes,clean local environment result,QA owner,record updater-channel action for explicit execution,desktop smoke,references/release-readiness.md,tauri

package/skills/showdar-ship/examples/release-report.md

@@ -0,0 +1,25 @@
+# Example delivery-readiness report
+
+Intent: verify whether the iOS candidate is ready for handoff; no store
+submission or deployment was requested.
+
+Target: iOS candidate `2.4.0 (318)`.
+
+Local evidence: focused tests, typecheck, archive, signing, entitlements,
+version/build-number, privacy strings, push/deep-link configuration, dSYM
+identity, and clean-device smoke passed.
+
+Existing CI: inspected the workflow to confirm its canonical test command;
+unchanged because CI modification was outside scope.
+
+External/unverified: App Store/TestFlight processing, production push delivery,
+provider monitoring, and rollout state. These are not required for this local
+readiness decision and must not be reported as passed.
+
+Readiness: ready for the requested handoff, subject to the release owner's
+separate decision about any later submission or deployment.
+
+If the user explicitly requests TestFlight submission or deployment
+verification, record the target, artifact, authorized command, processing
+result, install/launch smoke, observation owner, and recovery trigger
+separately. Use `references/post-deploy.md` only for that explicit scope.

package/skills/showdar-ship/references/migrations.md

@@ -0,0 +1,12 @@
+# Migration readiness
+
+Classify migrations as additive/backward-compatible, lock-heavy, backfill,
+destructive, or irreversible. For a readiness assessment, inspect the schema
+diff, compatibility window, lock/timeout behavior, retry/idempotency, ordering,
+rollback compatibility, and abort trigger without mutating production data.
+
+If the task explicitly requests deployment execution, the expand/migrate/contract
+sequence may be evaluated: add a compatible shape, run compatible readers and
+writers, backfill with observable progress, then contract after old consumers
+are gone. Production data mutation still requires explicit approval and
+backup/recovery evidence.

package/skills/showdar-ship/references/post-deploy.md

@@ -0,0 +1,12 @@
+# Explicit deployment verification
+
+Only load this reference when the task explicitly requests deployment or
+release-execution verification. It is not part of ordinary delivery readiness
+and does not authorize a deploy.
+
+For that explicit scope, verify the deployed version or artifact digest,
+health/readiness, critical user/API flows, logs/error rate, dependency
+reachability, queue/migration state, and platform-specific distribution status.
+Define a risk-appropriate observation window and abort threshold. Separate
+successful upload/deploy from successful behavior, and record which external
+signals remain manual or unavailable.

package/skills/showdar-ship/references/release-readiness.md

@@ -0,0 +1,13 @@
+# Delivery readiness
+
+Delivery readiness is a verification decision, not an execution command. Gather
+fresh evidence for relevant tests, typecheck/analyzer, lint, build, package or
+export output, artifact metadata, and target-specific prerequisites. Confirm
+version, environment names, feature flags, migrations, secret references
+without values, and observability assumptions when they are in scope.
+
+Inspect existing CI or release configuration read-only when it helps discover
+canonical commands. A deployed endpoint, provider result, store result, or
+green CI run is not required for ordinary local readiness. Separate local proof
+from external proof and report external checks as unverified unless the task
+explicitly requests release/deployment verification.

package/skills/showdar-ship/references/rollback.md

@@ -0,0 +1,12 @@
+# Rollback readiness
+
+Use this reference to assess rollback safety; do not execute a rollback during
+ordinary delivery verification. Record the previous artifact/version/digest,
+schema compatibility, feature-flag state, config changes, secret references,
+data irreversibility, traffic assumptions, and trigger conditions. Check that
+old code can read current data and that a recovery path does not repeat a
+migration.
+
+Only an explicitly requested deployment/release-execution task may exercise the
+rollback mechanics. Otherwise list the command or external check as unverified
+and leave production state unchanged.

package/skills/showdar-ship/references/secrets.md

@@ -0,0 +1,3 @@
+# Secrets
+
+Never print, copy into source, or include secrets in generated artifacts, logs, screenshots, or issue text. Verify presence by variable/key name, provider metadata, or a safe startup check only. Distinguish public build configuration from server, signing, updater, and store secrets. Use platform secret stores, least privilege, rotation, and redaction. Treat a secret exposed once as compromised and escalate rotation without requesting the value.

package/skills/showdar-ship/scripts/detect-targets.mjs

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+import { detectStacks } from './lib/detect-stack.mjs'; import path from 'node:path';
+const root=path.resolve(process.argv[2]??process.cwd()); const stacks=await detectStacks(root); const targets=[];
+if(stacks.some(s=>['nextjs','react','vue','svelte'].includes(s)))targets.push('web'); if(stacks.some(s=>['node','fastify','nestjs'].includes(s)))targets.push('backend'); if(stacks.includes('ios'))targets.push('ios'); if(stacks.includes('android'))targets.push('android'); if(stacks.includes('tauri'))targets.push('desktop');
+console.log(JSON.stringify({root,stacks,targets:[...new Set(targets)]},null,2));

package/skills/showdar-ship/scripts/lib/detect-stack.mjs

@@ -0,0 +1,48 @@
+import { access, readdir, readFile } from 'node:fs/promises';
+import path from 'node:path';
+
+async function exists(target) { try { await access(target); return true; } catch { return false; } }
+
+export async function detectStacks(projectRoot) {
+  const found = new Set();
+  try {
+    const names = await readdir(projectRoot);
+    if (names.some((name) => ['package-lock.json', 'yarn.lock', 'pnpm-lock.yaml', 'bun.lockb'].includes(name))) found.add('package-manager');
+    if (names.some((name) => ['pnpm-workspace.yaml', 'lerna.json', 'turbo.json', 'nx.json'].includes(name))) found.add('workspace');
+    if (names.some((name) => name.endsWith('.xcodeproj') || name.endsWith('.xcworkspace'))) found.add('ios');
+  } catch { /* inaccessible repository is reported by the caller */ }
+  const packageFile = path.join(projectRoot, 'package.json');
+  if (await exists(packageFile)) {
+    try {
+      const pkg = JSON.parse(await readFile(packageFile, 'utf8'));
+      const deps = { ...(pkg.dependencies ?? {}), ...(pkg.devDependencies ?? {}), ...(pkg.peerDependencies ?? {}) };
+      if (pkg.packageManager) found.add('package-manager');
+      if (pkg.workspaces) found.add('workspace');
+      if (deps.next) found.add('nextjs');
+      if (deps.react) found.add('react');
+      if (deps['react-native']) found.add('react-native');
+      if (deps.vue) found.add('vue');
+      if (deps.svelte) found.add('svelte');
+      if (deps.tailwindcss) found.add('html-tailwind');
+      if (deps.fastify || deps['@fastify/core']) found.add('fastify');
+      if (deps['@nestjs/core']) found.add('nestjs');
+      if (deps['@tauri-apps/api']) found.add('tauri');
+      if (deps.electron) found.add('electron');
+      if (deps.expo || deps['expo-router']) found.add('expo');
+      found.add('node');
+    } catch { /* malformed package is reported by higher-level skills */ }
+  }
+  if (await exists(path.join(projectRoot, 'pubspec.yaml'))) {
+    const pubspec = await readFile(path.join(projectRoot, 'pubspec.yaml'), 'utf8');
+    if (/\bflutter\s*:/m.test(pubspec)) found.add('flutter');
+    found.add('dart');
+  }
+  if (await exists(path.join(projectRoot, 'ios'))) found.add('ios');
+  if (await exists(path.join(projectRoot, 'android'))) found.add('android');
+  if (await exists(path.join(projectRoot, 'Package.swift'))) { found.add('swift'); found.add('spm'); }
+  if (await exists(path.join(projectRoot, 'Cargo.toml'))) found.add('rust');
+  if (await exists(path.join(projectRoot, 'go.mod'))) found.add('go');
+  if (await exists(path.join(projectRoot, 'pyproject.toml')) || await exists(path.join(projectRoot, 'requirements.txt'))) found.add('python');
+  if (await exists(path.join(projectRoot, '.github', 'workflows')) || await exists(path.join(projectRoot, '.gitlab-ci.yml')) || await exists(path.join(projectRoot, 'Jenkinsfile'))) found.add('ci');
+  return [...found].sort();
+}

package/skills/showdar-ship/scripts/release-check.mjs

@@ -0,0 +1,6 @@
+#!/usr/bin/env node
+import { access, readFile } from 'node:fs/promises'; import path from 'node:path';
+const root=path.resolve(process.argv[2]??process.cwd()); const exists=async p=>{try{await access(p);return true}catch{return false}}; const checks=[];
+if(await exists(path.join(root,'package.json'))){const p=JSON.parse(await readFile(path.join(root,'package.json'),'utf8'));checks.push({check:'package version',status:p.version?'present':'missing',value:p.version??null});checks.push({check:'build script',status:p.scripts?.build?'present':'missing'});checks.push({check:'test script',status:p.scripts?.test?'present':'missing'})}
+checks.push({check:'git repository',status:await exists(path.join(root,'.git'))?'present':'not-detected'}); checks.push({check:'ios project',status:await exists(path.join(root,'ios'))?'present':'not-applicable'}); checks.push({check:'android project',status:await exists(path.join(root,'android'))?'present':'not-applicable'});
+console.log(JSON.stringify({root,checks,note:'Read-only preflight. It does not prove release readiness; run project verification commands and platform checks.'},null,2));

package/skills/showdar-ship/stacks/android.md

@@ -0,0 +1,33 @@
+# Android delivery verification
+
+Verify the signed release artifact locally by default. Play Console upload,
+track changes, and staged rollout require explicit release-execution intent.
+
+## Identity, SDK, and signing
+
+Record `applicationId`, `versionCode`, `versionName`, min/target/compile SDK, release variant, JDK/AGP/Gradle/Kotlin versions, and the exact signing configuration. Verify the keystore/alias reference and Play app identity without printing secrets. Check manifest merger output, exported components, permissions, app links, notification/push configuration, network security, and target-SDK behavior changes for the supported API range.
+
+## Artifact and symbols
+
+Prefer the signed AAB for Play distribution and inspect generated APKs/splits for ABI, resource, and permission behavior. Run R8/ProGuard in the release path and retain the exact mapping file, native symbols, build ID, and artifact digest; a release crash without matching mapping cannot be diagnosed reliably. Validate version code monotonicity and any signing-key/Play App Signing constraint before upload.
+
+## Distribution readiness (explicit execution only)
+
+Smoke clean install, upgrade install, process death/restore, permissions,
+deep links/push, offline/reconnect, and release-only code paths locally. Play
+Console upload, internal/closed tracks, staged rollout, and external crash/ANR
+observation are execution-only checks. Android rollback is limited by
+monotonic version codes, installed clients, data/schema changes, and track
+state; record forward-fix or halt options without changing Play state by
+default.
+
+## Wrong turns and caveats
+
+Do not test only a debug APK, disable R8 to make a release pass, or assume emulator behavior covers ABI/OEM/API differences. Target/min SDK implications and Play policy requirements change over time; verify current requirements and the target device matrix.
+
+## Verification
+
+Run tests and the release bundle task, inspect manifest/resources and signing,
+install generated artifacts with `adb`, and preserve mapping/native symbols for
+the candidate build. Upload/validate the AAB in a track only when explicitly
+requested.

package/skills/showdar-ship/stacks/docker.md

@@ -0,0 +1,30 @@
+# Docker delivery verification
+
+Build and inspect Docker locally by default. Do not add Docker, deployment
+configuration, or registry/host changes to an ordinary readiness task.
+
+## Build an immutable artifact
+
+Pin the base image by an approved tag/digest and record the resulting image digest. Use a multi-stage build so compilers, package-manager caches, tests, and source-only files do not enter the runtime image. Keep the build context minimal, run as a non-root UID/GID where compatible, define an explicit exec-form entrypoint, and make the target architecture (`linux/amd64`, `linux/arm64`, or both) deliberate.
+
+## Runtime contract
+
+Inject secrets at runtime and verify only variable names/references, never values. Check ports, DNS/service names, writable paths, persistent volumes, time zone/CA requirements, resource limits, and PID 1 signal handling. A health check should test the service's readiness contract without depending on a permanently unavailable external system; startup ordering is not readiness. Preserve data volumes and migration order separately from image rollout.
+
+## Artifact and local runtime verification
+
+Scan/build the intended image, inspect labels and entrypoint, then run it by
+digest in an isolated local network with non-secret configuration. Verify health
+transitions, critical smoke flow, graceful stop/restart, dependency outage,
+volume ownership, and architecture-specific startup. Keep prior digest/config
+as readiness evidence; read `references/rollback.md` for safety assessment and
+`references/post-deploy.md` only for explicit external verification.
+
+## Wrong turns and edge cases
+
+For an explicitly requested deployment, do not use a mutable `latest` tag, bake
+`.env` or credentials into a layer, use `localhost` for another service, or run
+as root to bypass a permissions defect. In ordinary verification, still watch
+for native addon/libc mismatch, line endings, shell-form signal loss,
+bind-mount masking, and a container that is “healthy” while its worker/queue
+path is dead.

package/skills/showdar-ship/stacks/electron.md

@@ -0,0 +1,7 @@
+# Electron delivery verification
+
+Verify renderer production assets, main/preload packaging, context isolation,
+application ID/version, platform signing, update metadata, and clean-machine
+install/update behavior locally. Retain symbols and previous signed artifacts.
+Treat successful packaging or upload as incomplete until launch and critical IPC
+flows pass; upload and updater publication require explicit execution intent.

package/skills/showdar-ship/stacks/ios.md

@@ -0,0 +1,34 @@
+# iOS delivery verification
+
+Verify the archive and installable artifact locally by default. TestFlight,
+App Store, signing-service, and rollout actions are separate explicit scopes.
+
+## Identity and signing
+
+Record the bundle identifier, marketing version, build number, release scheme/configuration, deployment target, and archive export method. Confirm the identifier matches App Store Connect and the intended provisioning profile; certificates, distribution profiles, entitlements, capabilities, and keychain access groups must belong to the same app identity. Validate push, associated domains, background modes, Sign in with Apple, and other capabilities against the archive rather than the project editor alone.
+
+## Privacy and artifact evidence
+
+Check privacy manifests, permission usage descriptions, SDK-required declarations, URL schemes, and tracking disclosures for every native dependency. Archive with release settings, retain the matching dSYM/BCSymbolMaps and exported IPA metadata, and verify bitcode/symbol expectations for the current toolchain. Do not treat a successful archive as proof that launch, permissions, deep links, push, or background behavior works on a device.
+
+## Distribution readiness (explicit execution only)
+
+Run archive validation and install the exact build on a clean simulator/device
+when available. Smoke first launch, upgrade from the previous version, login,
+critical native capabilities, push/deep links, offline/reconnect,
+background/foreground, and crash reporting. TestFlight groups, App Store
+rollout, and external observation are execution-only checks; use them only when
+explicitly requested. iOS rollback is constrained after users migrate local
+data or distribution advances, so record recovery assumptions without
+submitting or changing store state.
+
+## Wrong turns and caveats
+
+Do not reuse a development profile, increment only the marketing version, or copy entitlements from another target. Signing, privacy, Xcode, SDK, and App Store rules are version-sensitive; verify current target requirements and provider status. Report store processing, phased rollout, and crash-observability checks that cannot be verified locally.
+
+## Verification
+
+Run repository tests plus `xcodebuild archive`/export and validation for the
+affected scheme, inspect signing/entitlements, verify dSYM UUIDs, and install
+the exported artifact. Record TestFlight/store status only for an explicit
+external-verification request, without exposing credentials.

package/skills/showdar-ship/stacks/nextjs.md

@@ -0,0 +1,30 @@
+# Next.js delivery verification
+
+Default to local build and runtime verification. Do not deploy or change
+provider configuration unless the task explicitly requests deployment.
+
+## Choose the runtime
+
+Record Next.js version, router, Node version, output mode, hosting target, and whether each route is static, Node/serverless, or edge. Static export removes server runtime features; Node and edge deployments differ in available APIs, startup, streaming, caching, and environment access. Confirm provider support for the exact output mode before treating `next build` as deployable.
+
+## Build-time and runtime configuration
+
+Classify public `NEXT_PUBLIC_*` values and server-only variables. Public values are commonly embedded during build, so changing them after deployment may require rebuilding; server variables must exist in the runtime environment. Inspect route output, middleware/runtime assignments, image/font assets, base path, redirects/headers, and source-map/secret exposure. For App Router, verify server/client boundaries, server actions, and cache/revalidation behavior in the production build.
+
+## Artifact and local smoke
+
+Run the repository's tests, typecheck/lint, and `next build`; start the
+production artifact with `next start` when possible. Smoke direct load and
+client navigation for critical routes, auth/session, API/route handlers, image
+assets, error/404 paths, and local cache behavior. Check deployed health,
+logs, CDN behavior, or deployed commit/version only through the explicit
+deployment-verification gate in `references/post-deploy.md`.
+
+## Wrong turns and caveats
+
+Do not use a development server as release evidence, assume preview environment
+variables match another environment, or add `dynamic`/`no-store` merely to
+force a passing build. React/Next cache APIs, bundlers, edge support, and
+provider output rules are version-sensitive; verify migration/release notes
+when relevant and record prior-artifact rollback assumptions without changing
+provider state.