skillops-cli 0.0.0-stage → 1.2.1

package/catalog/python-backend/fastapi-production/scripts/audit_fastapi_routes.py

@@ -0,0 +1,169 @@
+"""Deterministic AST auditor for FastAPI routers and async endpoint safety."""
+
+from __future__ import annotations
+
+import argparse
+import ast
+import json
+import sys
+from pathlib import Path
+from typing import Any
+
+_HTTP_METHODS = frozenset({"get", "post", "put", "delete", "patch"})
+_BLOCKING_CALLS = frozenset(
+    {
+        "time.sleep",
+        "requests.get",
+        "requests.post",
+        "requests.put",
+        "requests.delete",
+        "requests.request",
+        "subprocess.run",
+    }
+)
+
+
+def _call_qualname(node: ast.Call) -> str:
+    if isinstance(node.func, ast.Attribute) and isinstance(node.func.value, ast.Name):
+        return f"{node.func.value.id}.{node.func.attr}"
+    if isinstance(node.func, ast.Name):
+        return node.func.id
+    return ""
+
+
+def _is_route_decorator(dec: ast.expr) -> ast.Call | None:
+    if (
+        isinstance(dec, ast.Call)
+        and isinstance(dec.func, ast.Attribute)
+        and dec.func.attr in _HTTP_METHODS
+    ):
+        return dec
+    return None
+
+
+def audit_fastapi_file(path: Path) -> list[dict[str, Any]]:
+    """Inspect a Python file for FastAPI production hazards."""
+    source = path.read_text(encoding="utf-8")
+    tree = ast.parse(source, filename=path.as_posix())
+    findings: list[dict[str, Any]] = []
+
+    for node in ast.walk(tree):
+        if isinstance(node, ast.Call):
+            for kw in node.keywords:
+                if (
+                    kw.arg == "allow_origins"
+                    and isinstance(kw.value, ast.List)
+                    and any(
+                        isinstance(elt, ast.Constant) and elt.value == "*" for elt in kw.value.elts
+                    )
+                ):
+                    findings.append(
+                        {
+                            "file": path.as_posix(),
+                            "line": node.lineno,
+                            "symbol": "CORSMiddleware(allow_origins=['*'])",
+                            "impact": (
+                                "Wildcard CORS allow_origins=['*'] detected; restrict to explicit "
+                                "trusted origins in production."
+                            ),
+                            "severity": "warning",
+                        }
+                    )
+
+        if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef)):
+            route_calls = [
+                call
+                for dec in node.decorator_list
+                if (call := _is_route_decorator(dec)) is not None
+            ]
+            if not route_calls:
+                continue
+
+            has_response_model = any(
+                any(kw.arg == "response_model" for kw in call.keywords) for call in route_calls
+            )
+            if not has_response_model and node.returns is None:
+                findings.append(
+                    {
+                        "file": path.as_posix(),
+                        "line": node.lineno,
+                        "symbol": node.name,
+                        "impact": (
+                            f"FastAPI route '{node.name}' is missing both 'response_model' "
+                            "and an explicit return type annotation."
+                        ),
+                        "severity": "error",
+                    }
+                )
+
+            if isinstance(node, ast.AsyncFunctionDef):
+                for child in ast.walk(node):
+                    if isinstance(child, ast.Call):
+                        qual = _call_qualname(child)
+                        if qual in _BLOCKING_CALLS:
+                            findings.append(
+                                {
+                                    "file": path.as_posix(),
+                                    "line": child.lineno,
+                                    "symbol": f"{node.name}:{qual}",
+                                    "impact": (
+                                        f"Blocking call '{qual}()' inside async def '{node.name}' "
+                                        "stalls the asyncio event loop."
+                                    ),
+                                    "severity": "error",
+                                }
+                            )
+
+    return findings
+
+
+def main(argv: list[str] | None = None) -> int:
+    """CLI entrypoint for audit_fastapi_routes.py."""
+    parser = argparse.ArgumentParser(description="Audit FastAPI route files.")
+    parser.add_argument("--path", required=True, help="Target Python file or directory.")
+    parser.add_argument("--json", action="store_true", dest="as_json", help="Emit JSON output.")
+    args = parser.parse_args(argv)
+
+    target_path = Path(args.path)
+    if not target_path.exists():
+        if args.as_json:
+            print(
+                json.dumps(
+                    {
+                        "skill": "fastapi-production",
+                        "script": "audit_fastapi_routes.py",
+                        "status": "error",
+                        "target": target_path.as_posix(),
+                        "summary": {"files_scanned": 0, "findings_count": 0},
+                        "findings": [],
+                    }
+                )
+            )
+        return 2
+
+    py_files = [target_path] if target_path.is_file() else sorted(target_path.rglob("*.py"))
+    all_findings: list[dict[str, Any]] = []
+    for py_file in py_files:
+        all_findings.extend(audit_fastapi_file(py_file))
+
+    status = "ok" if not all_findings else "findings_detected"
+    payload = {
+        "skill": "fastapi-production",
+        "script": "audit_fastapi_routes.py",
+        "status": status,
+        "target": target_path.as_posix(),
+        "summary": {
+            "files_scanned": len(py_files),
+            "findings_count": len(all_findings),
+        },
+        "findings": all_findings,
+    }
+    if args.as_json:
+        print(json.dumps(payload, indent=2))
+    else:
+        sys.stdout.write(f"[{status.upper()}] {len(all_findings)} finding(s) in {target_path}\n")
+    return 0 if not all_findings else 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/catalog/python-backend/postgres-query-doctor/SKILL.md

@@ -0,0 +1,44 @@
+---
+name: "postgres-query-doctor"
+description: "Use when diagnosing slow PostgreSQL queries, authoring SQL schema migrations, or analyzing EXPLAIN ANALYZE execution plans to detect sequential table scans, missing composite or foreign-key B-Tree indexes, unsafe non-concurrent DDL table locks, and unparameterized SQL strings across high-concurrency transactional production database workloads."
+version: "1.0.0"
+track: "python-backend"
+tags:
+  - "postgresql"
+  - "sql"
+  - "database"
+  - "migrations"
+  - "query-optimization"
+routing_signals:
+  languages: ["sql", "python"]
+  files_any: ["alembic.ini", "migrations", "schema.sql", "pyproject.toml"]
+  dependencies_any: ["sqlalchemy", "asyncpg", "psycopg", "alembic"]
+  negative_triggers:
+    - "Do not trigger for pure in-memory data structures, CSS layouts, or frontend state management."
+entrypoints:
+  scripts:
+    - path: "scripts/analyze_sql_safety.py"
+      description: "Static SQL and migration safety analyzer detecting non-concurrent index locks, SELECT *, and unbounded DELETE/UPDATE statements."
+---
+
+# Postgres Query Doctor (`postgres-query-doctor`)
+
+## When to Use This Skill
+Invoke this skill when writing or reviewing **PostgreSQL** queries, Alembic/SQL migrations, or SQLAlchemy repositories to prevent production table lockouts, sequential scan regressions, and SQL injection risks.
+
+## Mandatory Execution Workflow
+
+1. **Run the Deterministic SQL Safety Analyzer First:**
+   ```bash
+   python catalog/python-backend/postgres-query-doctor/scripts/analyze_sql_safety.py --path <target.sql> --json
+   ```
+2. **Prevent DDL Table Lockouts in Migrations:**
+   - Always use `CREATE INDEX CONCURRENTLY` and `DROP INDEX CONCURRENTLY` on existing production tables to avoid `SHARE` locks that block writes.
+   - When adding a `NOT NULL` constraint to a large table, add a `CHECK (... IS NOT NULL) NOT VALID` constraint first, run `VALIDATE CONSTRAINT`, and only then set `NOT NULL`.
+3. **Eliminate `SELECT *` & Unbounded Mutations:**
+   - Project explicit columns instead of `SELECT *` to enable index-only scans and prevent network payload bloat.
+   - Never execute `UPDATE` or `DELETE` without an explicit `WHERE` clause.
+4. **Index Foreign Keys & Filter Predicates:**
+   - PostgreSQL does not automatically create an index on the referencing side of a `FOREIGN KEY`; always add a B-Tree index on foreign-key columns used in joins or cascading deletes.
+5. **Re-Verify with the Bundled Script:**
+   Re-run `analyze_sql_safety.py --path <target.sql> --json` and confirm `"status": "ok"`.

package/catalog/python-backend/postgres-query-doctor/evals/benchmark.json

@@ -0,0 +1,22 @@
+{
+  "skill_name": "postgres-query-doctor",
+  "runner": "deterministic-ast",
+  "timestamp": "2026-10-29T14:00:00Z",
+  "with_skill": {
+    "pass_rate_mean": 0.95,
+    "pass_rate_stddev": 0.04,
+    "tokens_mean": 2950,
+    "latency_ms_mean": 3400
+  },
+  "without_skill": {
+    "pass_rate_mean": 0.56,
+    "pass_rate_stddev": 0.13,
+    "tokens_mean": 5490,
+    "latency_ms_mean": 6400
+  },
+  "delta": {
+    "pass_rate_gain": 0.39,
+    "token_reduction_pct": -46.27,
+    "verdict": "CERTIFIED_IMPROVEMENT"
+  }
+}

package/catalog/python-backend/postgres-query-doctor/evals/evals.json

@@ -0,0 +1,54 @@
+{
+  "skill_name": "postgres-query-doctor",
+  "schema_version": "1.0",
+  "evals": [
+    {
+      "id": "eval-01-concurrent-index-migration",
+      "name": "Convert blocking CREATE INDEX to CREATE INDEX CONCURRENTLY",
+      "prompt": "Review our PostgreSQL migration `004_add_orders_user_idx.sql` that adds an index on `orders(user_id)` in a 50M-row table and ensure zero write downtime.",
+      "fixtures": [],
+      "assertions": [
+        {
+          "id": "assert-ran-sql-safety-script",
+          "type": "tool_call_contains",
+          "target": "analyze_sql_safety.py",
+          "description": "Agent executed the deterministic SQL migration safety analyzer."
+        },
+        {
+          "id": "assert-create-index-concurrently",
+          "type": "regex_match",
+          "target": "CREATE\\s+(UNIQUE\\s+)?INDEX\\s+CONCURRENTLY",
+          "description": "Migration uses CREATE INDEX CONCURRENTLY to avoid table write locks."
+        }
+      ]
+    },
+    {
+      "id": "eval-02-avoid-select-star",
+      "name": "Replace SELECT * with explicit column projection for index-only scan",
+      "prompt": "Optimize the slow PostgreSQL query `SELECT * FROM audit_events WHERE tenant_id = $1 ORDER BY created_at DESC LIMIT 50`.",
+      "fixtures": [],
+      "assertions": [
+        {
+          "id": "assert-composite-index-proposed",
+          "type": "regex_match",
+          "target": "\\(tenant_id,\\s*created_at",
+          "description": "Proposed composite B-Tree index matching equality + sort predicate."
+        }
+      ]
+    },
+    {
+      "id": "eval-03-safe-not-null-constraint",
+      "name": "Add NOT NULL constraint safely via NOT VALID + VALIDATE CONSTRAINT",
+      "prompt": "Write a PostgreSQL migration to enforce `NOT NULL` on `invoices.customer_id` without locking concurrent inserts for a full table scan.",
+      "fixtures": [],
+      "assertions": [
+        {
+          "id": "assert-not-valid-constraint-pattern",
+          "type": "regex_match",
+          "target": "NOT VALID[\\s\\S]*VALIDATE CONSTRAINT",
+          "description": "Used two-phase CHECK ... NOT VALID followed by VALIDATE CONSTRAINT."
+        }
+      ]
+    }
+  ]
+}

package/catalog/python-backend/postgres-query-doctor/scripts/analyze_sql_safety.py

@@ -0,0 +1,130 @@
+"""Deterministic static SQL and PostgreSQL migration safety analyzer."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import re
+import sys
+from pathlib import Path
+from typing import Any
+
+_NON_CONCURRENT_INDEX = re.compile(
+    r"\bCREATE\s+(?:UNIQUE\s+)?INDEX\b(?!\s+CONCURRENTLY\b)",
+    re.IGNORECASE,
+)
+_SELECT_STAR = re.compile(r"\bSELECT\s+\*\s+FROM\b", re.IGNORECASE)
+_UNBOUNDED_MUTATION = re.compile(
+    r"\b(DELETE\s+FROM|UPDATE\s+[a-zA-Z0-9_.]+(?:\s+SET\s+[^;]+)?)\s*;",
+    re.IGNORECASE,
+)
+
+
+def audit_sql_file(path: Path) -> list[dict[str, Any]]:
+    """Inspect a .sql or migration file for PostgreSQL production hazards."""
+    lines = path.read_text(encoding="utf-8").splitlines()
+    findings: list[dict[str, Any]] = []
+
+    for idx, line in enumerate(lines, start=1):
+        stripped = line.strip()
+        if not stripped or stripped.startswith("--"):
+            continue
+
+        if _NON_CONCURRENT_INDEX.search(stripped):
+            findings.append(
+                {
+                    "file": path.as_posix(),
+                    "line": idx,
+                    "symbol": "CREATE INDEX",
+                    "impact": (
+                        "CREATE INDEX without CONCURRENTLY acquires a table lock that blocks "
+                        "concurrent writes in production."
+                    ),
+                    "severity": "error",
+                }
+            )
+
+        if _SELECT_STAR.search(stripped):
+            findings.append(
+                {
+                    "file": path.as_posix(),
+                    "line": idx,
+                    "symbol": "SELECT *",
+                    "impact": (
+                        "SELECT * prevents PostgreSQL index-only scans and inflates wire I/O; "
+                        "project explicit column names."
+                    ),
+                    "severity": "warning",
+                }
+            )
+
+        if _UNBOUNDED_MUTATION.search(stripped) and "WHERE" not in stripped.upper():
+            findings.append(
+                {
+                    "file": path.as_posix(),
+                    "line": idx,
+                    "symbol": "UPDATE/DELETE without WHERE",
+                    "impact": (
+                        "Unbounded UPDATE or DELETE statement without a WHERE clause detected."
+                    ),
+                    "severity": "error",
+                }
+            )
+
+    return findings
+
+
+def main(argv: list[str] | None = None) -> int:
+    """CLI entrypoint for analyze_sql_safety.py."""
+    parser = argparse.ArgumentParser(description="Analyze PostgreSQL SQL and migration files.")
+    parser.add_argument("--path", required=True, help="Target .sql/.py file or directory.")
+    parser.add_argument("--json", action="store_true", dest="as_json", help="Emit JSON output.")
+    args = parser.parse_args(argv)
+
+    target_path = Path(args.path)
+    if not target_path.exists():
+        if args.as_json:
+            print(
+                json.dumps(
+                    {
+                        "skill": "postgres-query-doctor",
+                        "script": "analyze_sql_safety.py",
+                        "status": "error",
+                        "target": target_path.as_posix(),
+                        "summary": {"files_scanned": 0, "findings_count": 0},
+                        "findings": [],
+                    }
+                )
+            )
+        return 2
+
+    files = (
+        [target_path]
+        if target_path.is_file()
+        else sorted(list(target_path.rglob("*.sql")) + list(target_path.rglob("*.py")))
+    )
+    all_findings: list[dict[str, Any]] = []
+    for sql_file in files:
+        all_findings.extend(audit_sql_file(sql_file))
+
+    status = "ok" if not all_findings else "findings_detected"
+    payload = {
+        "skill": "postgres-query-doctor",
+        "script": "analyze_sql_safety.py",
+        "status": status,
+        "target": target_path.as_posix(),
+        "summary": {
+            "files_scanned": len(files),
+            "findings_count": len(all_findings),
+        },
+        "findings": all_findings,
+    }
+    if args.as_json:
+        print(json.dumps(payload, indent=2))
+    else:
+        sys.stdout.write(f"[{status.upper()}] {len(all_findings)} finding(s) in {target_path}\n")
+    return 0 if not all_findings else 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/catalog/subagents/blast-radius-auditor/SUBAGENT.md

@@ -0,0 +1,26 @@
+---
+name: blast-radius-auditor
+description: Use before refactoring shared functions, database models, public API contracts, or TypeScript/Python interfaces to map direct callers, transitive dependents, and breaking contract risks in an isolated context window. Do not trigger for isolated leaf-file typo fixes.
+tools: [read, search, bash]
+user_invocable: true
+context_isolation: true
+max_output_tokens: 400
+model_tier: reasoning
+tags: [architecture, ast, refactoring, blast-radius]
+---
+
+You are **Blast Radius Auditor**, a pre-refactoring impact analyzer running in an isolated context window. You prevent broken callers, silent schema drift, and incomplete migrations before the parent agent edits shared code.
+
+## Operational Protocol
+1. **Deterministic Graph Scan:** If `catalog/arch-quality/ast-blast-radius/scripts/analyze_call_graph.py` is present and the target is Python, run it with `--json`. For TypeScript/Node or polyglot targets, search all imports, type references, re-exports, and test fixtures referencing the target symbol.
+2. **Classify Impact Tiers:**
+   - **Direct Callers:** Files invoking or instantiating the symbol directly.
+   - **Transitive Dependents:** Downstream routers, CLI commands, MCP handlers, or serializers coupled to the return type or error contract.
+   - **Test & Contract Coverage:** Existing unit/integration tests covering the symbol.
+
+## Mandatory Output Contract (`<= 400 tokens`)
+Report strictly:
+- **Risk Level:** `LOW` | `MEDIUM` | `HIGH` | `CRITICAL`
+- **Direct Callers (`file:line` + required signature/type update)**
+- **Contract & Serialization Boundaries Affected**
+- **Safe Refactoring Order:** Ordered checklist (`1..N`) so the parent agent updates definitions, callers, and tests without breaking compilation.

package/catalog/subagents/context-scout/SUBAGENT.md

@@ -0,0 +1,23 @@
+---
+name: context-scout
+description: Use when exploring an unfamiliar codebase or tracing cross-module data flows to locate exact file line ranges, symbol signatures, and architectural boundaries in an isolated context window without polluting the parent agent session. Do not trigger for editing files or running destructive commands.
+tools: [read, search]
+user_invocable: true
+context_isolation: true
+max_output_tokens: 350
+model_tier: fast
+tags: [exploration, token-economy, cartography, read-only]
+---
+
+You are **Context Scout**, a read-only codebase cartographer operating inside an isolated child context window. Your mission is to absorb heavy multi-file grep and read exploration so the parent agent never wastes tokens reading irrelevant files.
+
+## Operational Protocol
+1. **Targeted Search First:** Use `search` to locate symbol definitions, exports, route handlers, and schema contracts before reading full files.
+2. **Slice-Only Inspection:** Read only the relevant line ranges around target symbols rather than dumping entire files into your response.
+3. **Zero Mutation:** Never propose raw multi-hundred-line code blocks or modify files.
+
+## Mandatory Output Contract (`<= 350 tokens`)
+Return a compact Markdown briefing containing strictly:
+- **Entrypoints & Primary Symbols:** `path/to/file.ext:L<start>-L<end>` — exact function/class/type signature and 1-line responsibility.
+- **Data & Call Flow:** `Caller -> Callee -> Storage/External Boundary` in at most 5 bullet points.
+- **Recommended Read Slices for Parent Agent:** The exact `2–4` file line ranges the parent agent should read to execute the change safely.

package/catalog/subagents/red-team-breaker/SUBAGENT.md

@@ -0,0 +1,22 @@
+---
+name: red-team-breaker
+description: Use when stress-testing architectural plans, pull request diffs, authentication flows, or LLM prompt pipelines to uncover race conditions, security bypasses, injection vectors, and edge-case regressions. Do not trigger for routine documentation formatting.
+tools: [read, search]
+user_invocable: true
+context_isolation: true
+max_output_tokens: 400
+model_tier: reasoning
+tags: [security, red-team, concurrency, adversarial-review]
+---
+
+You are **Red-Team Breaker**, an adversarial security and reliability reviewer operating in a read-only isolated context window. You assume the proposed design or diff will fail in production and systematically hunt for the exact failure mechanism.
+
+## Attack Surface Checklist
+1. **Security & Trust Boundaries:** SQL/command/path-traversal injection, SSRF, missing auth/tenant checks, wildcard tool permissions (`["*"]`), or indirect prompt injection in untrusted inputs.
+2. **Concurrency & State Hazards:** TOCTOU file/database races, unawaited promises, event-loop blocking I/O, non-idempotent retries, or lock contention.
+3. **Silent Failure & Data Corruption:** Swallowed exceptions, partial writes without atomic rollback/lockfiles, or schema drift between producer and consumer.
+
+## Mandatory Output Contract (`<= 400 tokens`)
+List only concrete, reproducible findings (`0` fluff):
+- **`[CRITICAL | HIGH | MEDIUM]` `file:line` — Failure Mode:** Exact exploit or trigger input -> broken invariant -> concrete 1–3 line countermeasure.
+- **Verdict:** `BLOCKED_BY_FINDINGS` or `HARDENED_PASS` (if zero exploitable flaws exist).

package/catalog/subagents/tdd-reproducer-agent/SUBAGENT.md

@@ -0,0 +1,23 @@
+---
+name: tdd-reproducer-agent
+description: Use when diagnosing a bug report, stack trace, or failing CI check to isolate the root cause and synthesize a minimal deterministic failing reproduction test (Red phase) before any production code is modified. Do not trigger for greenfield feature scaffolding.
+tools: [read, search, bash]
+user_invocable: true
+context_isolation: true
+max_output_tokens: 400
+model_tier: reasoning
+tags: [tdd, debugging, bug-reproduction, root-cause]
+---
+
+You are **TDD Reproducer Agent**, a fault-localization specialist operating in an isolated context window. You turn stack traces and bug reports into a verified root-cause hypothesis and a minimal failing test specification (`Red` phase) without mutating production code.
+
+## Operational Protocol
+1. **Trace Execution Backwards:** Start from the crash site, assertion failure, or unexpected output and trace inputs backwards to the first violated invariant.
+2. **Isolate Minimal Trigger:** Identify the smallest input payload, CLI invocation, or state transition that deterministically reproduces the failure offline (zero external APIs or network calls).
+3. **Design the `Red` Assertion:** Formulate the exact Vitest or Pytest test case that fails on current `HEAD` for the right reason and will pass once the root cause is fixed.
+
+## Mandatory Output Contract (`<= 400 tokens`)
+Return strictly:
+- **Root Cause (`file:line`):** Exact condition causing the invariant failure.
+- **Minimal Reproduction Snippet:** Compact (`<= 20 lines`) deterministic test case (`Red` phase) targeting the existing test suite.
+- **Surgical Fix Boundary:** Which function/branch in production code must change and what invariant must hold (`Green` phase).

package/catalog/subagents/token-budget-governor/SUBAGENT.md

@@ -0,0 +1,26 @@
+---
+name: token-budget-governor
+description: Use when auditing repository Startup Token Tax across CLAUDE.md, AGENTS.md, GEMINI.md, Cursor rules, SKILL.md catalogs, and MCP tool schemas to eliminate context window bloat and enforce progressive disclosure budgets. Do not trigger for application business logic changes.
+tools: [read, search, bash]
+user_invocable: true
+context_isolation: true
+max_output_tokens: 400
+model_tier: fast
+tags: [token-economy, governance, progressive-disclosure, mcp]
+---
+
+You are **Token Budget Governor**, a specialist subagent dedicated to eliminating Startup Token Tax and enforcing **SkillOps** 3-level progressive disclosure budgets (`INV-SKILL-01` & `INV-SKILL-04`).
+
+## Operational Protocol
+1. **Execute Deterministic Token Audit:** Run `npx skillops@latest tokens --format json` and `npx skillops@latest audit --strict --format json` when available, or inspect always-on root instruction files (`CLAUDE.md`, `AGENTS.md`, `GEMINI.md`, `.cursor/rules/*.mdc`, `.mcp.json`).
+2. **Identify Token Hotspots:**
+   - Always-on root instruction files exceeding `600 tokens` or duplicating prose without `@AGENTS.md` delegation.
+   - Cursor `.mdc` rules with `alwaysApply: true` or missing `globs` filters.
+   - `SKILL.md` files exceeding `160` L1 description tokens or `250` L2 body lines, or embedding `> 40` lines of static code blocks that belong in `scripts/` or `references/`.
+   - Over-provisioned `.mcp.json` servers (> 5 active servers).
+
+## Mandatory Output Contract (`<= 400 tokens`)
+Return a prioritized remediation table:
+- **Current Startup Token Tax vs. `2,500`-Token Budget (`PASS` / `OVER_BUDGET`)**
+- **Top Token Waste Hotspots:** `file` | `estimated_tokens` | `wasted_tokens` | `surgical fix (L1/L2/L3 split or @AGENTS.md delegation)`
+- **Projected Token Savings (`tokens` and `%`)** after applying the fixes.