swe-workflow-skills 0.1.0 → 0.2.0

package/README.md

@@ -1,10 +1,10 @@
 # SWE Workflow Skills for Claude Code
 
 [![roles-check](https://github.com/SWEStash/swe-workflow-skills/actions/workflows/roles-check.yml/badge.svg)](https://github.com/SWEStash/swe-workflow-skills/actions/workflows/roles-check.yml)
-![skills](https://img.shields.io/badge/skills-44-blue)
-[![license](https://img.shields.io/github/license/SWEStash/swe-workflow-skills)](LICENSE)
+![skills](https://img.shields.io/badge/skills-62-blue)
+[![license: MIT](https://img.shields.io/badge/license-MIT-yellow.svg)](LICENSE)
 
-A curated library of **44 Claude Code Agent Skills** that walk Claude through the
+A curated library of **62 Claude Code Agent Skills** that walk Claude through the
 software lifecycle the way a disciplined senior engineer would — planning, design,
 TDD, review, security, deployment, incidents, and the project-management work around
 them.
@@ -17,21 +17,37 @@ LLM-as-judge eval harness.
 
 ## Why this library
 
-- **An orchestrator, not a pile of skills.** A `skill-router` skill maps your intent to
-  the right skill(s) and chains them across phases. Activation is *routed and
-  deterministic*, not left to fuzzy auto-triggering.
+Not just a pile of skills — an activation architecture, an eval discipline, and
+full-SDLC breadth that popular collections don't cover:
+
+- **An orchestrator, not auto-trigger roulette.** A `skill-router` skill maps your
+  intent to the right skill(s) and chains them across phases. Activation is *routed and
+  deterministic*, not left to fuzzy auto-triggering — the routing eval harness measures
+  it (top-1 accuracy 1.00, zero misroutes on the current baseline, regression-gated in
+  CI).
 - **Scales past Claude's skill-listing budget.** Claude Code only injects skill
   descriptions up to ~1% of context, so large libraries silently stop triggering past
   ~20–40 skills. This library keeps only the router + safety skills "loud" and lists the
-  rest **name-only** — so the router can invoke all 44 by name, with no cropping and
-  without making you pre-pick a subset ([how it works](docs/ROLES.md)).
-- **Role-scoped.** `/role backend` (or `frontend`, `devops`, `ml`, `security`,
-  `architect`, `em`, `pm`, `qa`, `designer`) promotes a working set to auto-trigger; the
-  rest stay one route away.
+  rest **name-only** — the mechanism Claude Code's own docs now recommend for large
+  installs — so the router can invoke every skill by name, with no cropping and without
+  making you pre-pick a subset ([how it works](docs/ROLES.md)).
+- **Tested like code, not prose.** Every skill ships 3 evals; two LLM-as-judge
+  harnesses (content quality and routing accuracy) replay them with skill loaded vs
+  absent and gate regressions in CI. Safety-critical skills (deploys, releases, tests,
+  incidents, security) are **hardened**: an Iron Law, a rationalization table distilled
+  from real baseline failures, and pressure tests that try to talk the agent out of it.
+- **Full-SDLC breadth.** Planning, architecture/ADRs, API and data design, TDD, review,
+  security, releases, deploys, GitOps, observability, incidents, MLOps, LLM apps
+  and AI evaluation, data pipelines and data quality, and the PM/strategy work
+  around them — a wider slice of the lifecycle than the community collections we
+  know of aim for (they tend to go deep on the coding inner loop; see
+  [Acknowledgements](#acknowledgements)).
+- **Role-scoped.** `/role backend` (or `frontend`, `devops`, `ml`, `ai`, `data`,
+  `security`, `architect`, `em`, `pm`, `strategy`, `qa`, `mobile`, `designer`) promotes
+  a working set to auto-trigger; the rest stay one route away.
 - **Cross-platform install.** The installer and SessionStart hook are **pure Node** — the
   one runtime Claude Code already requires — so they run identically on Linux, macOS, and
   Windows (no bash, Python, or `sed`).
-- **Tested.** Every skill ships 3 evals; safety/discipline skills add pressure tests.
 
 ## Quick Start
 
@@ -46,7 +62,7 @@ web, claude.ai chat, and Cowork):
 **Want the whole library with the orchestrator** (CLI) — no clone needed:
 
 ```bash
-npx swe-workflow-skills install --global   # all 44 skills + router + /role + the SessionStart hook
+npx swe-workflow-skills install --global   # all 62 skills + router + /role + the SessionStart hook
 ```
 
 Or from a clone: `node install.mjs --global`.
@@ -104,15 +120,18 @@ review) live in the `skill-router` skill and **[ROLES.md](docs/ROLES.md)**.
 
 ## What's included
 
-44 skills — **[full catalog → SKILLS.md](docs/SKILLS.md)**:
+62 skills — **[full catalog → SKILLS.md](docs/SKILLS.md)**:
 
 | Area | Count | Examples |
 |------|-------|----------|
-| Software Engineering | 23 | feature-planning, architecture-design, tdd-workflow, code-reviewing, security-audit, refactoring, incident-response |
-| Project Management | 6 | prd-writing, effort-estimation, metrics-and-okrs, retrospective, strategic-review |
-| DevOps | 5 | containerization, cicd-pipeline, infrastructure-as-code, gitops-delivery |
+| Software Engineering | 30 | feature-planning, plan-execution, architecture-design, threat-modeling, compliance-privacy, code-archaeology, tdd-workflow, security-audit, browser-verification, subagent-orchestration |
+| Project Management | 8 | brainstorming, prd-writing, effort-estimation, build-vs-buy, metrics-and-okrs, retrospective, strategic-review |
+| DevOps | 8 | containerization, cicd-pipeline, release-management, gitops-delivery, resilience-engineering, finops-cost-optimization |
 | Design | 3 | ui-ux-design, frontend-architecture, accessibility-design |
 | MLOps | 3 | ml-pipeline-design, ml-experiment-tracking, ml-model-deployment |
+| AI Engineering | 2 | llm-app-engineering, ai-evaluation |
+| Data Engineering | 2 | data-pipeline-design, data-quality |
+| Mobile | 2 | mobile-architecture, mobile-release |
 | Evaluation & Monitoring | 2 | observability-design, test-data-strategy |
 | Meta | 2 | skill-router, writing-skills |
 
@@ -139,6 +158,27 @@ New or improved skills are welcome — start with **[AUTHORING.md](docs/AUTHORIN
 install the `writing-skills` skill). The short version: descriptions are everything, keep
 SKILL.md concise with detail in `references/`, and ship exactly 3 evals.
 
+## Acknowledgements
+
+This library stands on ideas from projects we found genuinely useful:
+
+- **[obra/superpowers](https://github.com/obra/superpowers)** — the guardrail pattern
+  our hardened safety skills adopt (an Iron Law, a rationalization table distilled from
+  real failures, and pressure tests that try to talk the agent out of it) comes from
+  Jesse Vincent's work here, as does the idea of a Socratic brainstorming skill as the
+  entry point to a feature. Superpowers goes deeper on the coding inner loop than we do;
+  if that's what you want, use it.
+- **[anthropics/skills](https://github.com/anthropics/skills)** — Anthropic's official
+  skills (and `skill-creator` in particular) are the authoring practice we benchmark
+  ours against; the eval-first loop in [AUTHORING.md](docs/AUTHORING.md) follows the
+  same instinct.
+- **The [Agent Skills docs](https://code.claude.com/docs/en/skills) and Anthropic's
+  engineering posts** — progressive disclosure, the listing budget, and the
+  `name-only` + `skillOverrides` activation surface this library's routing model is
+  built on.
+- **The awesome-claude-skills community lists** — the ecosystem survey that shaped our
+  gap analysis of what a full-SDLC library should cover.
+
 ## License
 
 MIT — see [LICENSE](LICENSE).

package/VERSION

@@ -1 +1 @@
-0.1.0
+0.2.0

package/catalog.json

@@ -6,6 +6,11 @@
       "description": "Design and implement accessible web/mobile apps to WCAG 2.1/2.2 — semantic HTML, ARIA patterns, keyboard navigation, focus management, color contrast, screen readers, accessible forms. Triggers: accessibility, a11y, WCAG, screen reader, keyboard navigation, ARIA, focus management, color contrast, alt text, semantic HTML, tab order, focus trap, skip link, announce. Build it in, don't bolt it on.",
       "path": "accessibility-design/SKILL.md"
     },
+    {
+      "name": "ai-evaluation",
+      "description": "Define how to evaluate ML models and GenAI/LLM apps — golden datasets, offline metrics, RAG evaluation (faithfulness, answer relevance, context precision/recall) with ragas/deepeval/promptfoo, LLM-as-judge design and calibration, eval regression gates in CI, online A/B and human feedback. Triggers: evaluate the model, eval my chatbot, RAG evals, ragas, LLM as judge, golden dataset, eval suite, is the new prompt better, hallucination rate, benchmark our AI app. Logging/comparing runs → ml-experiment-tracking; building the app → llm-app-engineering.",
+      "path": "ai-evaluation/SKILL.md"
+    },
     {
       "name": "api-design",
       "description": "Design RESTful and GraphQL APIs — endpoint naming, request/response contracts, error handling, pagination, versioning, auth patterns, OpenAPI specs. Triggers: design the API, API contract, REST API, GraphQL schema, error response format, pagination, API versioning, OpenAPI, swagger, endpoints. Use architecture-design for REST-vs-GraphQL or monolith-vs-microservices decisions.",
@@ -13,7 +18,7 @@
     },
     {
       "name": "architecture-design",
-      "description": "Guide architectural and structural decisions using Architecture Decision Records (ADRs) — new services, pattern choices, database selection, component boundaries, state management, costly-to-reverse decisions. Triggers: how should I architect, which pattern, design decision, should I use X or Y, system design, ADR, component design, architectural trade-off.",
+      "description": "Guide architectural and structural decisions using Architecture Decision Records (ADRs) — new services, pattern choices, database selection, component boundaries, state management, costly-to-reverse decisions. Triggers: how should I architect, which pattern, design decision, should I use X or Y, system design, ADR, component design, architectural trade-off. Owns internal-structure decisions — build vs buy/adopt a vendor or OSS capability → build-vs-buy.",
       "path": "architecture-design/SKILL.md"
     },
     {
@@ -21,21 +26,46 @@
       "description": "Design and maintain architecture documentation with multi-level diagrams (C4) and docs-as-code. Triggers: architecture diagram, document the architecture, C4 diagram, system context, container diagram, component diagram, architecture docs, docs-as-code, PlantUML, Structurizr, D2, Mermaid architecture, infrastructure diagram, runtime flow. Use architecture-design for ADRs.",
       "path": "architecture-documentation/SKILL.md"
     },
+    {
+      "name": "brainstorming",
+      "description": "Facilitate divergent ideation before committing to a spec — Socratic questioning, widening the option space, challenging assumptions and inherited constraints, then converging on candidates. Triggers: brainstorm, let's explore ideas, what are our options, help me think through, generate ideas, what could we build, not sure what I want, explore approaches, ideate. Once ideas converge, hand off to prd-writing (WHAT/WHY) or feature-planning (breakdown) — this skill opens options; those close them.",
+      "path": "brainstorming/SKILL.md"
+    },
+    {
+      "name": "browser-verification",
+      "description": "Verify a web app change by driving the real UI in a browser — reproduce the user flow end to end, watch console errors and network failures, exercise loading/error/empty states, capture screenshots as evidence. Use before claiming a UI change works. Triggers: check it in the browser, verify the UI, click through the flow, console errors, test it like a user, smoke test the frontend. Designing persistent test suites → test-suite-design; the generic done-gate → verification-before-completion (this is its browser-specific practice).",
+      "path": "browser-verification/SKILL.md"
+    },
     {
       "name": "bug-investigating",
       "description": "Systematic debugging and root cause analysis using structured methodology — reproduce, isolate, hypothesize, verify. Triggers: this doesn't work, I'm getting an error, something is broken, bug, debug this, why is this happening, unexpected behavior, regression, root cause, stack trace, error message.",
       "path": "bug-investigating/SKILL.md"
     },
+    {
+      "name": "build-vs-buy",
+      "description": "Decide whether to build in-house, buy a vendor/SaaS product, or adopt OSS — core-vs-commodity framing, multi-year total cost of ownership, integration and maintenance burden, vendor viability, lock-in and exit costs. Triggers: build vs buy, build or buy, vendor evaluation, SaaS vs in-house, should we adopt this open source, TCO, total cost of ownership, lock-in, exit cost, make or buy, off the shelf. Internal-structure decisions (patterns, service boundaries, ADRs for your own code) → architecture-design.",
+      "path": "build-vs-buy/SKILL.md"
+    },
     {
       "name": "cicd-pipeline",
       "description": "Design CI/CD pipelines for automated build, test, deploy — GitHub Actions, GitLab CI, quality gates. Triggers: CI/CD, pipeline, GitHub Actions, GitLab CI, workflow, automated deployment, build pipeline, continuous integration, continuous deployment, automate tests on PR, deploy automatically, quality gate.",
       "path": "cicd-pipeline/SKILL.md"
     },
+    {
+      "name": "code-archaeology",
+      "description": "Understand unfamiliar or legacy code before changing it — map entry points, mine git history (blame, churn, log -S), trace data flow, recover the why behind odd code, pin current behavior with characterization tests, find seams for safe change. Triggers: understand this codebase, legacy code, inherited this project, what does this code do, why is it written this way, nobody knows how this works, onboard to this repo, is it safe to change this. Prioritizing debt → technical-debt-review; improving code you already understand → refactoring.",
+      "path": "code-archaeology/SKILL.md"
+    },
     {
       "name": "code-reviewing",
       "description": "Structured code reviews enforcing DRY, KISS, YAGNI, SRP, best practices, and project conventions. Triggers: review this code, code review, check my code, what do you think of this implementation, review this PR, is this code good, feedback on my code, review staged changes before commit.",
       "path": "code-reviewing/SKILL.md"
     },
+    {
+      "name": "compliance-privacy",
+      "description": "Engineer for regulatory and privacy obligations — GDPR/CCPA privacy-by-design, PII data mapping and minimization, retention and deletion (right to erasure), data subject requests, consent, SOC 2 controls (access, change management, audit logging). Triggers: GDPR, CCPA, SOC 2, HIPAA, compliance, privacy review, PII, personal data, data retention, right to be forgotten, DSR, audit requirements, are we compliant. Vulnerabilities in code → security-audit; attack analysis of a design → threat-modeling.",
+      "path": "compliance-privacy/SKILL.md"
+    },
     {
       "name": "configuration-strategy",
       "description": "Design environment configuration, secrets management, and feature-flag hierarchy for a service or feature. Triggers: config strategy, environment variables, .env, secrets management, feature flag, config hierarchy, config precedence, twelve-factor config, environment-specific settings.",
@@ -51,6 +81,16 @@
       "description": "Design database schemas, relationships, indexes, and migration strategies — relational and document stores. Triggers: data model, schema design, ER diagram, database schema, table design, foreign key, index strategy, normalization, denormalization, migration plan, document model, partition key.",
       "path": "data-modeling/SKILL.md"
     },
+    {
+      "name": "data-pipeline-design",
+      "description": "Design batch and streaming data pipelines — ELT into a warehouse/lakehouse, dbt and analytics engineering (staging/intermediate/marts layers), orchestration with Airflow or Dagster, idempotent loads, incremental models, backfills, CDC ingestion. Triggers: data pipeline, ELT, ETL, dbt models, data warehouse, Snowflake, BigQuery, ingest into the warehouse, Airflow DAG, Dagster, Kafka streaming, backfill, incremental load, nightly job duplicates rows. ML training/feature pipelines → ml-pipeline-design; validating the data → data-quality.",
+      "path": "data-pipeline-design/SKILL.md"
+    },
+    {
+      "name": "data-quality",
+      "description": "Keep warehouse and pipeline data trustworthy — dbt tests, expectations (Great Expectations/Soda), data contracts with upstream producers, source freshness, schema-drift and volume anomaly detection, lineage and blast radius, severity and alerting. Triggers: data quality, bad data in dashboards, data validation, dbt tests, data contract, schema drift, stale data, freshness check, duplicate rows, nulls in the warehouse, data lineage, data SLA, upstream schema change broke us. Generating test/synthetic data → test-data-strategy; schema design → data-modeling.",
+      "path": "data-quality/SKILL.md"
+    },
     {
       "name": "dependency-impact-analysis",
       "description": "Map the blast radius of a change before implementing — find dependents, classify breaking vs additive, identify coordination needs, produce a propagation plan. Triggers: what will break if I change this, blast radius, impact analysis, breaking change, who depends on this, downstream impact, safe to rename, shared schema change, dependency graph.",
@@ -71,6 +111,11 @@
       "description": "Design a deployment (GitOps) repo that orchestrates multiple services in a polyrepo — version pinning, environment promotion, compatibility matrices, system config. Triggers: deployment repo, GitOps repo, polyrepo, multi-repo, version pinning, compatibility matrix, environment promotion, multi-service deployment, orchestration repo, which versions work together.",
       "path": "deployment-repo/SKILL.md"
     },
+    {
+      "name": "dx-audit",
+      "description": "Audit and improve developer experience — inner-loop feedback (build/test/reload times), CI wait and queue times, flaky tests, local environment setup, onboarding time-to-first-PR, tooling friction, docs discoverability; produce a prioritized remediation plan. Triggers: developer experience, DX audit, devex, builds are slow, CI takes forever, flaky tests, onboarding takes weeks, tooling friction, developer productivity, engineers are frustrated. Code health/debt hotspots → technical-debt-review; designing one pipeline → cicd-pipeline.",
+      "path": "dx-audit/SKILL.md"
+    },
     {
       "name": "effort-estimation",
       "description": "Estimate engineering effort with agile techniques — story points, t-shirt sizing, three-point estimation, capacity planning. Triggers: estimate this, how long will this take, story points, t-shirt sizing, effort estimation, capacity planning, sprint planning, budget estimate, forecast, velocity, when will this be done.",
@@ -78,9 +123,14 @@
     },
     {
       "name": "feature-planning",
-      "description": "Break features into well-scoped tasks with acceptance criteria, risk assessment, and dependency mapping. Triggers: plan this, break this down, scope this feature, create tasks for, sprint planning, how should I implement this feature, user stories, acceptance criteria, dependency mapping, feature breakdown.",
+      "description": "Break features into well-scoped tasks with acceptance criteria, risk assessment, and dependency mapping. Triggers: plan this, break this down, scope this feature, create tasks for, sprint planning, how should I implement this feature, user stories, acceptance criteria, dependency mapping, feature breakdown. Creates the plan — executing an already-approved plan checkpoint by checkpoint → plan-execution.",
       "path": "feature-planning/SKILL.md"
     },
+    {
+      "name": "finops-cost-optimization",
+      "description": "Understand and reduce cloud spend — cost visibility and allocation (tagging, ownership), unit economics, rightsizing, autoscaling, commitment discounts (reserved instances, savings plans), storage/egress traps, architecture cost review, budgets and anomaly alerts. Triggers: cloud costs, AWS bill, cut costs, cost optimization, FinOps, why is our bill so high, rightsizing, reserved instances, savings plan, egress fees, cost per customer. Whether to build or buy a capability → build-vs-buy; making code faster → performance-optimization.",
+      "path": "finops-cost-optimization/SKILL.md"
+    },
     {
       "name": "frontend-architecture",
       "description": "Design frontend architecture — React component hierarchy, state management, design tokens, data fetching, routing, error boundaries, code organization. Triggers: component architecture, state management, design system, design tokens, component library, React structure, folder structure, Zustand vs Redux, React Query, code splitting, error boundary, compound component.",
@@ -106,6 +156,11 @@
       "description": "Write and review IaC with Terraform, CloudFormation, Pulumi, or CDK — modularity, security, state management. Triggers: Terraform, CloudFormation, Pulumi, infrastructure as code, IaC, provision, cloud resources, terraform module, state management, terraform plan, CDK, drift, remote state.",
       "path": "infrastructure-as-code/SKILL.md"
     },
+    {
+      "name": "llm-app-engineering",
+      "description": "Design and build LLM-powered applications — prompt and context engineering, RAG architecture (chunking, hybrid retrieval, reranking, grounded prompts), agent design (tool surfaces, planning, sub-agents), and memory. Triggers: build a chatbot, LLM app, AI assistant, prompt engineering, system prompt, RAG design, chunking, embeddings, vector database, semantic search, AI agent, tool calling, agent memory, context window, hallucinations. Measuring quality → ai-evaluation; model serving/inference infra → ml-model-deployment.",
+      "path": "llm-app-engineering/SKILL.md"
+    },
     {
       "name": "metrics-and-okrs",
       "description": "Define OKRs, KPIs, success metrics, and engineering health metrics (DORA). Triggers: OKR, KPI, metrics, success metrics, key results, objectives, measure success, DORA metrics, engineering metrics, velocity, cycle time, deployment frequency, how do we measure, what should we track.",
@@ -113,7 +168,7 @@
     },
     {
       "name": "ml-experiment-tracking",
-      "description": "Design reproducible ML experiments — tracking, versioning, run comparison with MLflow, W&B, or DVC. Triggers: experiment tracking, MLflow, wandb, weights and biases, DVC, track experiments, compare models, hyperparameter, reproducibility, model registry, which model is better, experiment results, log metrics.",
+      "description": "Design reproducible ML experiments — tracking, versioning, run comparison with MLflow, W&B, or DVC. Triggers: experiment tracking, MLflow, wandb, weights and biases, DVC, track experiments, compare models, hyperparameter, reproducibility, model registry, which model is better, experiment results, log metrics. Defining WHAT to measure (metrics, golden datasets, judges) → ai-evaluation; this skill records and compares the runs.",
       "path": "ml-experiment-tracking/SKILL.md"
     },
     {
@@ -123,9 +178,19 @@
     },
     {
       "name": "ml-pipeline-design",
-      "description": "Design reproducible ML training and data pipelines — ingestion, validation, feature engineering, training, evaluation, continuous training orchestration. Triggers: training pipeline, data pipeline, feature engineering, ETL for ML, continuous training, data validation, feature store, preprocessing, notebook to pipeline, orchestrate training, Airflow, Kubeflow, pipeline DAG.",
+      "description": "Design reproducible ML training and data pipelines — ingestion, validation, feature engineering, training, evaluation, continuous training orchestration. Triggers: training pipeline, ML data pipeline, feature engineering, ETL for ML, continuous training, data validation, feature store, preprocessing, notebook to pipeline, orchestrate training, Kubeflow, pipeline DAG, point-in-time features. Analytics/BI ELT and dbt warehouse pipelines → data-pipeline-design.",
       "path": "ml-pipeline-design/SKILL.md"
     },
+    {
+      "name": "mobile-architecture",
+      "description": "Design mobile app architecture — native (Swift/Kotlin) vs cross-platform (React Native/Flutter) selection, navigation and deep linking, state management, offline-first design and data sync, local persistence, push notifications, platform constraints (background work, battery, permissions). Triggers: mobile app architecture, iOS app, Android app, React Native or Flutter, offline first, data sync, mobile state management, deep linking, push notifications, app structure. Web SPA component architecture → frontend-architecture.",
+      "path": "mobile-architecture/SKILL.md"
+    },
+    {
+      "name": "mobile-release",
+      "description": "Ship mobile apps through the app stores — signing and provisioning, store review and rejection handling, phased/staged rollouts with halt criteria, crash monitoring, versioning and build numbers, beta channels (TestFlight, Play tracks), forced updates, and the no-instant-rollback reality of mobile. Triggers: app store release, publish to App Store, Play Store, TestFlight, staged rollout, app review rejected, code signing, provisioning profile, mobile release, hotfix a mobile bug. General semver/registry/library publishing → release-management.",
+      "path": "mobile-release/SKILL.md"
+    },
     {
       "name": "observability-design",
       "description": "Design production observability — SLIs, SLOs, SLAs, error budgets, OpenTelemetry traces/metrics/logs, structured logging, alerting, dashboards. Triggers: SLO, SLI, SLA, error budget, observability, monitoring, OpenTelemetry, OTel, tracing, distributed tracing, structured logging, alerting, dashboard, metrics, correlation ID, alert fatigue.",
@@ -136,6 +201,11 @@
       "description": "Identify and resolve performance bottlenecks via static analysis — N+1 queries, algorithmic complexity, query optimization, caching, memory leaks, bundle size, connection management. Triggers: this is slow, optimize, performance, N+1, query optimization, caching, bundle size, memory leak, latency, response time, scale, bottleneck.",
       "path": "performance-optimization/SKILL.md"
     },
+    {
+      "name": "plan-execution",
+      "description": "Execute an already-approved plan with discipline — batch tasks into verifiable checkpoints, verify each with fresh evidence before marking it done, log drift, and stop to re-plan when reality diverges from the plan's assumptions. Triggers: execute the plan, implement the approved plan, work through this plan, continue/resume the plan, next phase, checkpoint. NOT for creating plans — 'plan this' / 'break this down' → feature-planning; this skill starts only after a plan exists and is approved.",
+      "path": "plan-execution/SKILL.md"
+    },
     {
       "name": "prd-writing",
       "description": "Write lightweight agile PRDs and technical RFCs that align stakeholders before implementation. Triggers: PRD, product requirements, RFC, request for comments, technical design doc, design document, tech spec, write requirements, what are we building, spec this out. Produces the WHAT and WHY — feature-planning handles HOW.",
@@ -161,6 +231,16 @@
       "description": "Systematic code improvement via design principles, smell detection, and safe transformation patterns. Triggers: refactor this, clean this up, simplify this code, reduce complexity, extract this, this code is messy, tech debt, improve this code, code smell, rename, extract function, dead code.",
       "path": "refactoring/SKILL.md"
     },
+    {
+      "name": "release-management",
+      "description": "Cut and publish software releases right-sized to the project — semver decisions, changelogs, tagging, automated version bumps (release-please, changesets, semantic-release), publishing gates, npm/PyPI/container registry publishing, pre-release channels, monorepo versioning. Triggers: cut a release, release this, publish to npm, publish to PyPI, publish this package, version bump, what version should this be, semver, changelog, tag a release, release notes, GitHub release, prerelease, release automation, release PR. Deploy-time safety → deployment-checklist; commit/PR hygiene → git-workflow.",
+      "path": "release-management/SKILL.md"
+    },
+    {
+      "name": "resilience-engineering",
+      "description": "Design systems that survive failure — failure-mode analysis, resilience patterns (timeouts, retries with backoff, circuit breakers, bulkheads, load shedding, graceful degradation), chaos experiments, disaster recovery with RTO/RPO, backup restore testing, game days. Triggers: chaos engineering, disaster recovery, DR plan, what if the database goes down, single point of failure, failover, circuit breaker, RTO, RPO, game day, high availability. An incident happening NOW → incident-response; undoing a bad deploy → rollback-strategy.",
+      "path": "resilience-engineering/SKILL.md"
+    },
     {
       "name": "retrospective",
       "description": "Facilitate sprint retros, project post-mortems, and incident post-mortems with actionable, owned improvements. Triggers: retrospective, retro, post-mortem, postmortem, lessons learned, what went wrong, what went well, incident review, blameless, action items, sprint review, after action review.",
@@ -173,7 +253,7 @@
     },
     {
       "name": "security-audit",
-      "description": "Comprehensive security analysis — OWASP Top 10, auth/authz flows, injection vulnerabilities, data exposure, secrets detection, dependency CVEs, hardening recommendations. Triggers: security audit, vulnerability, is this secure, security review, pentest prep, OWASP, harden this, check for vulnerabilities, injection, XSS, CSRF, auth security.",
+      "description": "Comprehensive security analysis — OWASP Top 10, auth/authz flows, injection vulnerabilities, data exposure, secrets detection, dependency CVEs, hardening recommendations. Triggers: security audit, vulnerability, is this secure, security review, pentest prep, OWASP, harden this, check for vulnerabilities, injection, XSS, CSRF, auth security. Reviews EXISTING code/config — design-time analysis of a system not yet built → threat-modeling.",
       "path": "security-audit/SKILL.md"
     },
     {
@@ -186,6 +266,11 @@
       "description": "Review a project's strategic position before going public, launching, or raising — vision, mission, value proposition, scope positioning, the defensible wedge, and a live competitive / market comparative analysis. Triggers: strategic review, positioning, go public, go-to-market, market analysis, competitive landscape, value proposition, is there a moat, who are our competitors, platform absorption risk, market positioning, comparable products. Use project-review for execution/roadmap/implementation health; delegates deep market scans to deep-research.",
       "path": "strategic-review/SKILL.md"
     },
+    {
+      "name": "subagent-orchestration",
+      "description": "Decompose big or parallelizable work across subagents — when to fan out vs stay solo, scoping self-contained sub-tasks, prompting agents that don't share your context, isolating parallel edits (git worktrees), skeptically verifying and synthesizing results you didn't produce. Triggers: use subagents, parallelize this, fan out, orchestrate agents, multi-agent, spawn agents, worktree, delegate to agents, split this across agents, agent team. Sequencing checkpoints of an approved plan → plan-execution (orchestration parallelizes within its batches).",
+      "path": "subagent-orchestration/SKILL.md"
+    },
     {
       "name": "tdd-workflow",
       "description": "Guide test-driven development with red-green-refactor. Triggers: use tdd, test first, write the tests, red green refactor, test-driven, what should I test, write tests before code, failing test, implement using TDD. For NEW code via test-first — use test-suite-design for adding tests to existing code.",
@@ -206,6 +291,11 @@
       "description": "Design comprehensive test suites for existing code — strategy across unit/integration/e2e, fixtures, factories, helpers. Triggers: add tests, write tests for, increase coverage, test this module, testing strategy, test plan, what tests do I need, test infrastructure, test helpers, this has no tests. Not for TDD — use tdd-workflow.",
       "path": "test-suite-design/SKILL.md"
     },
+    {
+      "name": "threat-modeling",
+      "description": "Design-time security analysis of a system or feature before it's built — trust boundaries, attack surface, STRIDE per element, abuse cases, prioritized mitigations that become security requirements. Triggers: threat model, STRIDE, trust boundary, attack surface, what could go wrong security-wise, security design review, abuse case, secure this design, security requirements. Reviewing EXISTING code/config for vulnerabilities → security-audit; use this skill while the design is still on the whiteboard.",
+      "path": "threat-modeling/SKILL.md"
+    },
     {
       "name": "ui-ux-design",
       "description": "Design user experiences from an engineer's perspective — user flows, wireframes, interaction patterns, responsive strategy, navigation, loading/error/empty states. Triggers: design the UI, user flow, wireframe, how should this screen look, loading state, error state, empty state, responsive design, navigation, page layout, form design, mockup.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "swe-workflow-skills",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "A curated library of 44 Claude Code Agent Skills for the software lifecycle, with orchestrator-routed activation that scales past the skill-listing budget.",
   "type": "module",
   "bin": {

package/roles.json

@@ -14,11 +14,13 @@
   "core": {
     "universal": [
       "skill-router",
+      "brainstorming",
       "feature-planning"
     ],
     "technical": [
       "skill-router",
       "feature-planning",
+      "plan-execution",
       "git-workflow",
       "code-reviewing",
       "verification-before-completion",
@@ -28,7 +30,8 @@
   },
 
   "meta_only": [
-    "writing-skills"
+    "writing-skills",
+    "subagent-orchestration"
   ],
 
   "roles": {
@@ -62,6 +65,7 @@
         "api-design",
         "tdd-workflow",
         "test-suite-design",
+        "browser-verification",
         "performance-optimization",
         "refactoring"
       ]
@@ -73,6 +77,7 @@
       "skills": [
         "containerization",
         "cicd-pipeline",
+        "release-management",
         "infrastructure-as-code",
         "deployment-repo",
         "gitops-delivery",
@@ -80,18 +85,43 @@
         "rollback-strategy",
         "incident-response",
         "observability-design",
-        "configuration-strategy",
-        "dependency-impact-analysis"
+        "resilience-engineering",
+        "configuration-strategy"
       ]
     },
     "ml": {
       "label": "ML Engineer / MLOps",
-      "description": "Skills for ML pipelines, experiment tracking, model deployment, and the data/observability around them.",
+      "description": "Skills for ML pipelines, experiment tracking, evaluation, model deployment, and the data/observability around them.",
       "core": "technical",
       "skills": [
         "ml-pipeline-design",
         "ml-experiment-tracking",
         "ml-model-deployment",
+        "ai-evaluation",
+        "data-modeling",
+        "test-data-strategy",
+        "observability-design"
+      ]
+    },
+    "ai": {
+      "label": "AI Engineer",
+      "description": "Skills for LLM-powered applications: prompt/RAG/agent design, evaluation, experiment tracking, model deployment, and the API around them.",
+      "core": "technical",
+      "skills": [
+        "llm-app-engineering",
+        "ai-evaluation",
+        "ml-experiment-tracking",
+        "ml-model-deployment",
+        "api-design"
+      ]
+    },
+    "data": {
+      "label": "Data Engineer",
+      "description": "Skills for data pipelines, analytics engineering, data quality/contracts, schema design, test data, and pipeline observability.",
+      "core": "technical",
+      "skills": [
+        "data-pipeline-design",
+        "data-quality",
         "data-modeling",
         "test-data-strategy",
         "observability-design"
@@ -99,10 +129,12 @@
     },
     "security": {
       "label": "Security Engineer",
-      "description": "Skills for security audits, dependency/CVE management, blast-radius analysis, and incident handling.",
+      "description": "Skills for design-time threat modeling, security audits, dependency/CVE management, blast-radius analysis, and incident handling.",
       "core": "technical",
       "skills": [
         "security-audit",
+        "threat-modeling",
+        "compliance-privacy",
         "dependency-management",
         "dependency-impact-analysis",
         "incident-response",
@@ -119,6 +151,7 @@
         "architecture-documentation",
         "api-design",
         "data-modeling",
+        "code-archaeology",
         "dependency-impact-analysis",
         "technical-debt-review",
         "project-review",
@@ -140,7 +173,9 @@
         "project-review",
         "strategic-review",
         "code-reviewing",
-        "incident-response"
+        "incident-response",
+        "release-management",
+        "dx-audit"
       ]
     },
     "pm": {
@@ -158,12 +193,14 @@
     },
     "strategy": {
       "label": "Strategy / Founder Review",
-      "description": "Skills for pre-public and strategic reviews: vision and positioning, market analysis, execution-vs-roadmap, and go/no-go synthesis.",
+      "description": "Skills for pre-public and strategic reviews: vision and positioning, market analysis, build-vs-buy decisions, execution-vs-roadmap, and go/no-go synthesis.",
       "core": "universal",
       "skills": [
         "strategic-review",
         "project-review",
         "project-proposal",
+        "build-vs-buy",
+        "finops-cost-optimization",
         "metrics-and-okrs"
       ]
     },
@@ -175,10 +212,24 @@
         "tdd-workflow",
         "test-suite-design",
         "test-data-strategy",
+        "browser-verification",
         "code-reviewing",
         "bug-investigating"
       ]
     },
+    "mobile": {
+      "label": "Mobile Engineer",
+      "description": "Skills for native and cross-platform mobile apps: architecture, offline/sync, UI/UX, accessibility, performance, API contracts, and app-store releases.",
+      "core": "technical",
+      "skills": [
+        "mobile-architecture",
+        "mobile-release",
+        "ui-ux-design",
+        "accessibility-design",
+        "performance-optimization",
+        "api-design"
+      ]
+    },
     "designer": {
       "label": "Designer / UX",
       "description": "Skills for user flows, accessibility, product requirements, and the frontend architecture that realizes them.",

package/skills/ai-evaluation/SKILL.md

@@ -0,0 +1,111 @@
+---
+name: ai-evaluation
+description: "Define how to evaluate ML models and GenAI/LLM apps — golden datasets, offline metrics, RAG evaluation (faithfulness, answer relevance, context precision/recall) with ragas/deepeval/promptfoo, LLM-as-judge design and calibration, eval regression gates in CI, online A/B and human feedback. Triggers: evaluate the model, eval my chatbot, RAG evals, ragas, LLM as judge, golden dataset, eval suite, is the new prompt better, hallucination rate, benchmark our AI app. Logging/comparing runs → ml-experiment-tracking; building the app → llm-app-engineering."
+model: sonnet
+allowed-tools: Read, Grep, Glob, Write, Edit, Bash
+---
+
+# AI Evaluation
+
+Define **what to measure and how** for ML models and GenAI apps. Without an
+evaluation harness, every prompt tweak, retrieval change, or model swap ships on
+vibes — and quality silently regresses. The boundary with its neighbors:
+`ml-experiment-tracking` *records and compares* runs; this skill *defines the
+metrics, datasets, and judges* those runs report. `llm-app-engineering` designs
+the app; this skill proves whether a change to it helped.
+
+## Workflow
+
+### Step 1: Pin Down What "Good" Means
+
+Before choosing tools, write down 3–5 quality criteria in the product's terms
+(answers grounded in our docs, no fabricated order numbers, resolves the ticket).
+Vague goals ("high quality answers") make every later step unmeasurable. Decide
+the primary metric — the one that decides ship/no-ship — before seeing results,
+to avoid cherry-picking.
+
+### Step 2: Build a Golden Dataset
+
+Evaluate against a fixed, versioned dataset — not ad-hoc spot checks:
+
+- **Source**: real user questions (logs, support tickets) first; synthesize from
+  the corpus only to fill gaps, and have a human review synthetic cases.
+- **Size**: 30–50 cases is enough to start; grow with every production failure
+  (each becomes a regression case — same principle as a bug's regression test).
+- **Coverage**: include the unhappy paths — questions the corpus can't answer
+  (the correct behavior is refusal), ambiguous phrasing, adversarial inputs.
+- **Version it** alongside the code; a metric is only comparable across runs on
+  the same dataset version.
+
+With zero labeled data, this is still not optional — bootstrap: label a few dozen
+cases by hand (an afternoon), use reference-free metrics (groundedness against
+the source, rubric-based judging) while the labeled set grows.
+
+### Step 3: Choose Metrics by System Type
+
+- **Classical ML models**: standard offline metrics vs held-out data (accuracy,
+  F1, RMSE, AUC), sliced by segment — aggregate numbers hide subgroup failures.
+- **RAG systems** — score the stages separately, or you can't tell whether a bad
+  answer is a retrieval or a generation failure:
+  - *Retrieval*: context precision / context recall (did the right chunks come back?)
+  - *Generation*: faithfulness/groundedness (is every claim supported by the
+    retrieved context?) and answer relevance (does it address the question?)
+- **Agents**: end-to-end task success rate plus trajectory checks (right tool,
+  no loops, steps within budget).
+- **Reference-free** (no ground truth): groundedness against the source,
+  rubric-based judge scores, and pairwise A-vs-B comparison between variants.
+
+Pick **one** eval tool and wire it in — ragas (RAG metrics), deepeval
+(pytest-style, broad metric set), or promptfoo (config-driven prompt/model
+comparison). Selection detail: [references/eval-tooling.md](references/eval-tooling.md).
+
+### Step 4: Design the Judge Deliberately
+
+LLM-as-judge is the workhorse for GenAI evals, and an uncalibrated judge is a
+random-number generator with authority. Treat the judge as a component you
+design and validate:
+
+- **Rubric, not vibes**: decompose "good" into the Step-1 criteria, each scored
+  separately with a binary or 3-point scale — never a bare 1–10 overall score.
+- **Known biases, known counters**: position bias (swap A/B order and re-judge),
+  self-preference (judge with a different model family than the one being
+  judged), verbosity bias (instruct the judge to ignore length; cap output length).
+- **Reduce noise**: majority-of-k voting for important comparisons.
+- **Calibrate**: score 20–30 cases with both the judge and a human; if agreement
+  is poor, fix the rubric before trusting any judge-derived number.
+
+### Step 5: Gate Changes in CI
+
+An eval suite that runs once before launch rots immediately. Run it on every
+change to prompts, retrieval, or model version — like a test suite:
+
+- Gate on **regression vs the last accepted baseline** (metric dropped), not an
+  absolute threshold — absolute judge scores drift; movement is the signal.
+- Keep the CI subset small and fast (the golden set, k=1); run the full suite
+  nightly or pre-release with voting.
+- Log eval runs in the experiment tracker (`ml-experiment-tracking`) so results
+  are comparable over time.
+
+### Step 6: Close the Loop Online
+
+Offline evals predict; production confirms. Once users exist: lightweight
+feedback (thumbs up/down + optional reason), A/B test significant changes on the
+primary metric, and mine failures — every confirmed production failure becomes a
+new golden-set case (Step 2).
+
+## Principles Applied
+
+- **YAGNI**: 30 golden cases + one tool + one judge rubric beats a
+  six-metric dashboard nobody trusts. Add metrics when a decision needs them.
+- **KISS**: prefer binary per-criterion judgments over fine-grained scales —
+  humans and judges both agree more on yes/no.
+- **Measure movement, not absolutes**: judge scores are comparable only within
+  the same dataset + rubric + judge version; gate on deltas.
+
+## Cross-Skill References
+
+- `llm-app-engineering` — designing the system this skill measures
+- `ml-experiment-tracking` — recording and comparing the eval runs over time
+- `ml-model-deployment` — online monitoring and drift detection in production
+- `cicd-pipeline` — wiring the eval gate into CI
+- `metrics-and-okrs` — tying eval metrics to product-level success metrics