voidmachine 0.0.0 → 4.0.0

package/core-assets/hooks/secret-in-content.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+# Compatibility adapter; native manifests invoke the same Node bundle directly.
+set -uo pipefail
+HOOK_DIR="${BASH_SOURCE[0]%/*}"
+NODE_BIN=$(command -v node 2>/dev/null || true)
+if [[ -z "$NODE_BIN" ]]; then
+  printf 'HOOK_RUNNER_FAILED: Node.js is required for enforcement\n' >&2
+  exit 2
+fi
+exec "$NODE_BIN" "$HOOK_DIR/_void-hook.mjs" enforce secret-content

package/core-assets/hooks/sessionstart-context.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+# Compatibility adapter; native manifests invoke the same Node bundle directly.
+set -uo pipefail
+HOOK_DIR="${BASH_SOURCE[0]%/*}"
+NODE_BIN=$(command -v node 2>/dev/null || true)
+if [[ -z "$NODE_BIN" ]]; then
+  exit 0
+fi
+exec "$NODE_BIN" "$HOOK_DIR/_void-hook.mjs" lifecycle context-continuity "${VOID_AGENT_RUNTIME:-unknown}"

package/core-assets/hooks/stop-typecheck.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+# Compatibility adapter; native manifests invoke the same Node bundle directly.
+set -uo pipefail
+HOOK_DIR="${BASH_SOURCE[0]%/*}"
+NODE_BIN=$(command -v node 2>/dev/null || true)
+if [[ -z "$NODE_BIN" ]]; then
+  exit 0
+fi
+exec "$NODE_BIN" "$HOOK_DIR/_void-hook.mjs" lifecycle typecheck "${VOID_AGENT_RUNTIME:-unknown}"

package/core-assets/hooks/tdd-guard.md

@@ -0,0 +1,90 @@
+# `tdd-guard` hook
+
+PreToolUse hook on `Edit` / `Write`. Materializes the `void-tdd` skill's Iron Law mechanically: blocks edits to production paths that add behavior without a corresponding test change in the same staged change set, unless a legitimate bypass applies.
+
+In `strict` mode: blocks (exit 1).
+In `souple` mode: warns (exit 2).
+In `exploratory` mode: no-op (exit 0).
+
+See `docs/plans/skill-audits/void-tdd.md` for the Iron Law and the bypass rationale. See Section 0bis.3 of `docs/plans/2026-05-29-void-harness-design.md` for the list of legitimate bypasses.
+
+## Configuration
+
+Read from `.void/config.json` of the consumer project:
+
+```json
+{
+  "modes": { "tdd": "auto" },
+  "paths": {
+    "business": "apps/*/src/**",
+    "tests": "apps/*/src/**/*.test.{ts,tsx}",
+    "spikes": "apps/*/scripts/spike-*"
+  }
+}
+```
+
+If `.void/config.json` is absent, sensible defaults are used (see hook source).
+
+## Bypasses applied (in order)
+
+1. Doc-only changes (`.md`, `.mdx`, `.txt`, files under `docs/`)
+2. Config and build files (`package.json`, `tsconfig.json`, `vitest.config.*`, `next.config.*`, `tailwind.config.*`, `drizzle.config.*`, `biome.json`, `eslint.config.*`)
+3. Test fixtures and seed data (`tests/fixtures/**`, `**/__tests__/fixtures/**`, `**/seed/**`)
+4. DB migrations (`**/migrations/**`, `drizzle/meta/**`) — covered by `void-migrations` skill
+5. Spike paths (consumer-defined; default `apps/*/scripts/spike-*`)
+6. Codemods (`**/codemods/**`)
+7. Type-only changes (`*.d.ts`)
+8. Generated code (`**/__generated__/**` or `@generated` marker in the first 3 lines)
+9. The test file itself (`*.test.ts`, `*.test.tsx`, `*.spec.ts`, `*.spec.tsx`)
+10. Per-file exploratory marker (`// tdd-mode: exploratory` in the first 5 lines)
+
+## Content bypass: a module that only re-exports
+
+The ten bypasses above are properties of the **path**. One is a property of the **content**: a module whose every top-level statement is a re-export (`export … from`, `export *`, `export {}`) carries no behaviour, so the test one would write for it would assert that an export exists, which the compiler already proves. A comment, a `'use client'` directive and a type-only import do not break the detection; anything else does.
+
+Both the file as it stands and the fragment being written must hold, so a barrel that gains one line of logic is covered again on that same edit. Malformed content (an unterminated string or block comment) is undecidable and stays covered.
+
+Without it the hook blocked a one-line barrel in a consumer where 51 barrels out of 51 have no sibling test by convention, and the edit went out through `sed`, outside the traced tools: the guard did not protect, and it pushed the work out of its own field of vision.
+
+## Pure-deletion bypass
+
+If the staged diff for the file contains only deletions (no `+` non-marker lines), the hook allows. Pure deletion does not require a new failing test.
+
+## Override
+
+- Per-file: add `// tdd-mode: exploratory` (or `strict` / `souple`) at the top of the file.
+- Per-repo: set `.void/config.json` `modes.tdd` to `strict` / `souple` / `exploratory`.
+- Per-session: set env `VOIDCORP_MODE_TDD=souple` (not yet wired — open question).
+
+## Inputs (env vars set by the runner)
+
+- `VOIDCORP_HOOK_FILE` — absolute path of the file
+- `VOIDCORP_HOOK_TOOL` — `Edit` / `Write`
+- `VOIDCORP_HOOK_PHASE` — `pre` / `post` (this hook only runs on `pre`)
+- `VOIDCORP_HOOK_DIFF` — optional, the staged diff content
+- `VOIDCORP_CONFIG` — optional, defaults to `.void/config.json`
+
+## Exit codes
+
+- `0` — allow
+- `1` — block (message on stderr)
+- `2` — warn (allow, message on stderr)
+
+## Test fixtures (for `test/tdd-guard/`)
+
+The skill test suite must cover at least:
+
+- `strict` mode + production edit without sibling test → block
+- `strict` mode + production edit WITH sibling test in same staged set → allow
+- `souple` mode + production edit without sibling test → warn
+- `exploratory` mode + any edit → allow
+- Each of the 10 bypasses → allow
+- Pure deletion → allow
+- Override marker `// tdd-mode: exploratory` in file → allow
+
+## Open questions
+
+- Per-session env override (`VOIDCORP_MODE_TDD`) — wire it up in the hook or rely on `.void/config.json` only? Lean wire (faster iteration during work).
+- Glob matching for `paths.business` — current `case` statement is shell glob, fine for simple patterns but not full minimatch. Defer until a consumer needs `**` patterns more complex than `apps/*/src/**`.
+- Auto-detection of the test runner (vitest vs jest) for the sibling-test naming convention. Currently assumes `.test.ts(x)`. Make configurable in Phase D.
+- Performance — `git diff --cached --name-only` runs every edit. Cache for the duration of a session? Defer; measure first.

package/core-assets/hooks/tdd-guard.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+# Compatibility adapter; native manifests invoke the same Node bundle directly.
+set -uo pipefail
+HOOK_DIR="${BASH_SOURCE[0]%/*}"
+NODE_BIN=$(command -v node 2>/dev/null || true)
+if [[ -z "$NODE_BIN" ]]; then
+  printf 'HOOK_RUNNER_FAILED: Node.js is required for enforcement\n' >&2
+  exit 2
+fi
+exec "$NODE_BIN" "$HOOK_DIR/_void-hook.mjs" enforce tdd-order

package/core-assets/hooks/test-name-lint.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+# Compatibility adapter; native manifests invoke the same Node bundle directly.
+set -uo pipefail
+HOOK_DIR="${BASH_SOURCE[0]%/*}"
+NODE_BIN=$(command -v node 2>/dev/null || true)
+if [[ -z "$NODE_BIN" ]]; then
+  printf 'HOOK_RUNNER_FAILED: Node.js is required for enforcement\n' >&2
+  exit 2
+fi
+exec "$NODE_BIN" "$HOOK_DIR/_void-hook.mjs" enforce test-name

package/core-assets/hooks/tidying-commit-prefix.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+# tidying-commit-prefix — commit-msg hook
+#
+# Warns (does NOT block) when a `refactor:` commit subject is paired with
+# behavior-change keywords in the body (feat, fix, implement, add). The
+# Two-Hat principle says: Tidyings and Behavior Changes never share a commit.
+#
+# Composed with the `refactor` skill.
+#
+# Inputs: $1 = path to the commit message file.
+# Exit codes: 0 allow, 2 warn.
+
+set -euo pipefail
+
+MSG_FILE="${1:-}"
+[[ -z "$MSG_FILE" || ! -f "$MSG_FILE" ]] && exit 0
+
+SUBJECT=$(head -1 "$MSG_FILE")
+BODY=$(tail -n +2 "$MSG_FILE")
+
+# Only check refactor: commits
+echo "$SUBJECT" | grep -qE '^refactor[(:]' || exit 0
+
+# Look for behavior-change keywords in body
+if printf "%s" "$BODY" | grep -qiE '\b(feat|feature|fix|bug|implement|add a new|adds a new)\b'; then
+  cat >&2 <<EOF
+tidying-commit-prefix (warn): 'refactor:' subject paired with behavior-change keywords in body.
+
+The Two-Hat principle (Beck "Tidy First?" 2023) says Tidyings and Behavior Changes
+never share a commit. If this commit does both, split it:
+  refactor: <named Fowler move>
+  feat: <new behavior>
+
+If the body is descriptive of the structural change only, ignore this warning.
+EOF
+  exit 2
+fi

package/core-assets/hooks/trim-large-output.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+# Compatibility adapter; native manifests invoke the same Node bundle directly.
+set -uo pipefail
+HOOK_DIR="${BASH_SOURCE[0]%/*}"
+NODE_BIN=$(command -v node 2>/dev/null || true)
+if [[ -z "$NODE_BIN" ]]; then
+  exit 0
+fi
+exec "$NODE_BIN" "$HOOK_DIR/_void-hook.mjs" lifecycle trim "${VOID_AGENT_RUNTIME:-unknown}"

package/core-assets/hooks/tsc-noemit-precommit.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# tsc-noemit-precommit — pre-commit hook
+#
+# Runs `tsc --noEmit` (or pack-configured equivalent) and blocks the commit on
+# any type error. Composed with the `typescript-strict` skill.
+#
+# Reads command from .void/config.json -> commands.typecheck, defaults to
+# the local tsconfig via npx tsc --noEmit.
+#
+# Exit codes: 0 allow, 1 block (type errors printed).
+
+set -euo pipefail
+
+CONFIG="${VOIDCORP_CONFIG:-.void/config.json}"
+CMD=$(jq -r '.commands.typecheck // empty' "$CONFIG" 2>/dev/null || true)
+[[ -z "$CMD" ]] && CMD="npx tsc --noEmit"
+
+if ! eval "$CMD" 2>&1; then
+  printf "\ntsc-noemit-precommit: type errors detected. Commit blocked.\n" >&2
+  printf "Fix the type errors above, or run '%s' manually to iterate.\n" "$CMD" >&2
+  exit 1
+fi

package/core-assets/hooks/ubiquitous-language-lint.sh

@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+# ubiquitous-language-lint — informational pre-commit hook
+#
+# Composed with the `domain-driven-design` skill. Maintains a per-context
+# glossary at docs/DOMAIN.md (or per-context docs/<context>/DOMAIN.md).
+# Flags drift between code identifiers and glossary terms.
+#
+# This hook is INFORMATIONAL. It never blocks. The user decides whether
+# to update the glossary or rename the code.
+#
+# Output: a summary report of terms present in code but missing from
+# DOMAIN.md, and vice versa.
+#
+# Exit codes: always 0 (informational only).
+
+set -euo pipefail
+
+GLOSSARY_PATHS=()
+[[ -f docs/DOMAIN.md ]] && GLOSSARY_PATHS+=(docs/DOMAIN.md)
+while IFS= read -r f; do
+  [[ -n "$f" ]] && GLOSSARY_PATHS+=("$f")
+done < <(find docs -path 'docs/*/DOMAIN.md' -type f 2>/dev/null || true)
+
+[[ ${#GLOSSARY_PATHS[@]} -eq 0 ]] && exit 0   # no glossary, skip silently
+
+STAGED=$(git diff --cached --name-only --diff-filter=ACMR | grep -E '\.(ts|tsx)$' || true)
+[[ -z "$STAGED" ]] && exit 0
+
+# Extract glossary terms (lines starting with `- ` or `## ` followed by a noun)
+GLOSSARY_TERMS=$(cat "${GLOSSARY_PATHS[@]}" 2>/dev/null \
+  | grep -oE '^(- |## )[A-Z][A-Za-z]+' \
+  | sed -E 's/^(- |## )//' \
+  | sort -u || true)
+
+# Extract identifier terms from staged TS files
+CODE_TERMS=""
+for FILE in $STAGED; do
+  CODE_TERMS+=$'\n'$(git show ":$FILE" 2>/dev/null \
+    | grep -oE '\b[A-Z][A-Za-z]{3,}\b' \
+    | sort -u || true)
+done
+CODE_TERMS=$(printf "%s" "$CODE_TERMS" | sort -u)
+
+# Set diff: terms in glossary but not in code, and vice versa
+MISSING_IN_CODE=$(comm -23 <(printf "%s\n" "$GLOSSARY_TERMS") <(printf "%s\n" "$CODE_TERMS"))
+MISSING_IN_GLOSSARY=$(comm -13 <(printf "%s\n" "$GLOSSARY_TERMS") <(printf "%s\n" "$CODE_TERMS") | head -20)
+
+if [[ -n "$MISSING_IN_CODE" || -n "$MISSING_IN_GLOSSARY" ]]; then
+  printf "ubiquitous-language-lint (informational):\n" >&2
+  [[ -n "$MISSING_IN_GLOSSARY" ]] && {
+    printf "  Code identifiers not in DOMAIN.md (top 20):\n%s\n" "$MISSING_IN_GLOSSARY" >&2
+  }
+  [[ -n "$MISSING_IN_CODE" ]] && {
+    printf "  DOMAIN.md terms not used in code:\n%s\n" "$MISSING_IN_CODE" >&2
+  }
+fi
+
+exit 0

package/core-assets/hooks/viewport-screenshot-gate.sh

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+# viewport-screenshot-gate — pre-push hook
+#
+# Warns if a PR touching UI code lacks both mobile and desktop screenshots
+# in the PR body. Composed with the `accessibility` and
+# `frontend-design` skills (mobile-first dual-quality invariant).
+#
+# UI paths: read from .void/config.json .paths.ui, default to
+# **/{components,app,pages}/** and **/*.{tsx,jsx}
+#
+# Heuristic: PR body must reference both "mobile" and "desktop" markdown
+# images (e.g. ![mobile](...) and ![desktop](...)) or be tagged with
+# "no-ui-change: <reason>" in the body for non-UI PRs that happen to
+# touch tsx files.
+#
+# Exit codes: 0 allow, 2 warn.
+
+set -euo pipefail
+
+CONFIG="${VOIDCORP_CONFIG:-.void/config.json}"
+
+BASE=$(gh pr view --json baseRefName --jq .baseRefName 2>/dev/null || echo "")
+[[ -z "$BASE" ]] && exit 0
+
+BASE_SHA=$(git merge-base "HEAD" "origin/$BASE" 2>/dev/null || echo "")
+[[ -z "$BASE_SHA" ]] && exit 0
+
+TOUCHED_UI=$(git diff --name-only "$BASE_SHA"..HEAD | grep -E '\.(tsx|jsx)$' | grep -vE '/__tests__/|\.(test|spec)\.' || true)
+[[ -z "$TOUCHED_UI" ]] && exit 0
+
+BODY=$(gh pr view --json body --jq .body 2>/dev/null || echo "")
+[[ -z "$BODY" ]] && { printf "viewport-screenshot-gate: no open PR found, skipping.\n" >&2; exit 0; }
+
+# Bypass marker for non-UI changes that happen to touch tsx files
+if printf "%s" "$BODY" | grep -qiE 'no-ui-change:'; then
+  exit 0
+fi
+
+HAS_MOBILE=$(printf "%s" "$BODY" | grep -qiE '!\[[^]]*mobile[^]]*\]|mobile[[:space:]]*screenshot|mobile[[:space:]]*viewport' && echo "1" || echo "0")
+HAS_DESKTOP=$(printf "%s" "$BODY" | grep -qiE '!\[[^]]*desktop[^]]*\]|desktop[[:space:]]*screenshot|desktop[[:space:]]*viewport' && echo "1" || echo "0")
+
+if [[ "$HAS_MOBILE" == "0" || "$HAS_DESKTOP" == "0" ]]; then
+  printf "viewport-screenshot-gate (warn): PR touches UI but lacks both mobile and desktop screenshots.\n" >&2
+  printf "  has_mobile=%s  has_desktop=%s\n" "$HAS_MOBILE" "$HAS_DESKTOP" >&2
+  printf "\nAdd both viewports to the PR body. Mobile starts at 360–390px (iPhone 12 mini–15 Pro).\n" >&2
+  printf "If this PR has no UI change despite touching tsx, add 'no-ui-change: <reason>' to the body.\n" >&2
+  exit 2
+fi

package/core-assets/packs/pack-mobile/skills/void-eas-build-profile/.source

@@ -0,0 +1,7 @@
+Sources for `void-eas-build-profile` skill (see `docs/plans/skill-audits/void-eas-build-profile.md` for the full audit):
+
+- Expo / EAS Build official documentation — no URL recorded in the audit — distilled the documented 3-profile eas.json convention (development/preview/production) and the per-option motivation that the docs scatter; added the void-machine defaults (APP_VARIANT side-by-side installs, secrets via `eas secret`, autoIncrement).
+
+No external skill ships this verbatim; authored by distilling the official EAS Build docs into the void-machine eas.json convention.
+
+Strategy: distill. Extract the load-bearing why behind each profile option and ship the void-machine 3-profile template, rather than copy a stale scaffold.

package/core-assets/packs/pack-mobile/skills/void-eas-build-profile/SKILL.md

@@ -0,0 +1,164 @@
+---
+name: void-eas-build-profile
+description: Configure eas.json profiles (development, preview, production) with the right env, bundle ID, signing, distribution. The 3-profile structure that fits 95% of Expo apps.
+---
+
+# eas-build-profile
+
+Use when configuring EAS Build for an Expo app. The default `eas.json` Expo scaffolds is fine to start; this skill ships the void-machine convention for the 3 standard profiles + the why behind each option.
+
+## The 3-profile structure
+
+```jsonc
+{
+  "cli": { "version": ">= 12.0.0" },
+  "build": {
+    "development": {
+      "developmentClient": true,
+      "distribution": "internal",
+      "ios": { "simulator": true },
+      "android": { "buildType": "apk" },
+      "env": { "APP_VARIANT": "dev" }
+    },
+    "preview": {
+      "distribution": "internal",
+      "ios": { "simulator": false },
+      "android": { "buildType": "apk" },
+      "env": { "APP_VARIANT": "preview" }
+    },
+    "production": {
+      "distribution": "store",
+      "autoIncrement": true,
+      "env": { "APP_VARIANT": "prod" }
+    }
+  },
+  "submit": {
+    "production": {
+      "ios": { "appleId": "team@voidcorp.io", "ascAppId": "1234567890", "appleTeamId": "ABCD1234" },
+      "android": { "serviceAccountKeyPath": "./google-play.json", "track": "internal" }
+    }
+  }
+}
+```
+
+## Each profile, in plain words
+
+### `development`
+
+- **Use case**: dev on simulator + device with hot reload, Metro bundler attached
+- **`developmentClient: true`** → builds a dev client (custom Expo Go) embedding your native deps. Without it, `expo-router` and custom modules don't work in Expo Go.
+- **`distribution: "internal"`** → not for App Store; for your team
+- **`ios.simulator: true`** → produces a `.app` runnable in iOS Simulator; runs `xcodebuild -sdk iphonesimulator`
+- **`android.buildType: "apk"`** → APK (not AAB); apk is easier to install ad-hoc
+
+Builds with `eas build -p ios --profile development` then `eas build:run -p ios` to install.
+
+### `preview`
+
+- **Use case**: TestFlight equivalents, stakeholder testing, QA
+- **`distribution: "internal"`** → shareable link from EAS dashboard; no store submission
+- **`ios.simulator: false`** → real device build
+- **`android.buildType: "apk"`** → APK still (easier for stakeholders)
+- Identical to production except distribution channel and variant env
+
+### `production`
+
+- **Use case**: App Store / Play Store submission
+- **`distribution: "store"`** → signed for store distribution
+- **`autoIncrement: true`** → bumps `buildNumber` (iOS) and `versionCode` (Android) per build; required by stores
+- **Default `android.buildType: "aab"`** (App Bundle) — required by Play Store
+
+## Env per profile
+
+The `env` block in each profile sets vars **at build time** (baked into the JS bundle for `EXPO_PUBLIC_*`, available via `process.env.X` in `app.config.ts`).
+
+Pattern: `APP_VARIANT` env switches the bundle ID, name, and API URL via `app.config.ts`:
+
+```ts
+// app.config.ts
+const variant = process.env.APP_VARIANT ?? 'dev';
+const apiUrls = {
+  dev:     'https://api-dev.voidcorp.io',
+  preview: 'https://api-preview.voidcorp.io',
+  prod:    'https://api.voidcorp.io',
+};
+
+export default ({ config }) => ({
+  ...config,
+  name: variant === 'prod' ? 'Solaar' : `Solaar ${variant}`,
+  ios: { bundleIdentifier: `io.voidcorp.solaar.${variant}` },
+  android: { package: `io.voidcorp.solaar.${variant}` },
+  extra: { apiUrl: apiUrls[variant] },
+});
+```
+
+This pattern installs all 3 variants on one device — useful for QA comparing prod-vs-preview behavior.
+
+## Secrets — never in eas.json
+
+The `env` block in `eas.json` ships in the bundle. **NEVER** put secrets there. For server-side secrets needed during build (e.g., to pull private deps):
+
+```bash
+eas secret:create --scope project --name NPM_TOKEN --value "..."
+```
+
+EAS injects secrets into the build environment; they don't end up in the JS bundle.
+
+## Signing and credentials
+
+Run once per profile:
+
+```bash
+eas credentials
+```
+
+Walks you through: iOS Distribution Certificate, Provisioning Profile, Push Notification Key, Android Keystore. Expo stores them encrypted on their servers.
+
+For team setups: `eas credentials:configure` syncs across team members so anyone can build.
+
+## `submit` config — for one-command store submission
+
+After a production build, submit with:
+
+```bash
+eas submit -p ios --latest
+eas submit -p android --latest
+```
+
+`submit` config in `eas.json` saves you from re-entering app store credentials each time. iOS requires Apple Team ID + ASC App ID; Android requires a service account JSON from Google Cloud (delegated rights for Play Store API).
+
+## Channel-based OTA (`expo-updates`)
+
+EAS Build embeds an `updates.channel` per build profile:
+
+```jsonc
+"production": {
+  "channel": "production",
+  // ...
+}
+```
+
+`expo-updates` then fetches OTA updates from the matching channel. See `void-ota-update-strategy` for the full pattern.
+
+## Anti-patterns
+
+- ✗ **Same bundle ID across variants** — can't install dev + prod on same device
+- ✗ **Same signing config across variants** — staging users get prod data leaks
+- ✗ **`env` for secrets** — leaks into bundle
+- ✗ **Manual version bumping** — `autoIncrement` exists for a reason
+- ✗ **5+ profiles** — usually means you haven't clarified variant strategy. 3 is enough.
+
+## Verification
+
+```bash
+eas build --profile preview --platform ios --local      # local build (no EAS minutes spent)
+```
+
+If local build succeeds, EAS will too. If it fails, the error is identical — debug locally before pushing to EAS.
+
+## Composition
+
+- `void-expo-config-plugins` — plugins define what's IN the binary; profiles define HOW it's built
+- `void-ota-update-strategy` — channel-based OTA aligns with profile names
+- `void-expo-router-pattern` — expo-router needs `developmentClient: true` in dev profile
+- `void-env-validation` — runtime env via `extra` validated with same Zod discipline

package/core-assets/packs/pack-mobile/skills/void-eas-build-profile/harness.yaml

@@ -0,0 +1,14 @@
+# Harness metadata for this skill. Not part of the Agent Skills
+# specification, and never copied into a consumer project: the SKILL.md
+# beside it stays portable and validates against the official six fields.
+# Read by this repository's graph, and by the installer for `runtimes`.
+kind: standard
+owner: folpe
+runtimes: [claude, codex]
+enforcement:
+  floor: ci
+  inline:
+    claude: active
+    codex: active
+    hermes: ci-only
+eval_targets: [claude/anthropic/opus]

package/core-assets/packs/pack-mobile/skills/void-expo-config-plugins/.source

@@ -0,0 +1,7 @@
+Sources for `void-expo-config-plugins` skill (see `docs/plans/skill-audits/void-expo-config-plugins.md` for the full audit):
+
+- Expo config plugins / Expo Modules official documentation — no URL recorded in the audit — distilled the "Expo way" (config plugin OR Expo Module covers ~95% of native needs) into a decision tree (Expo module → community plugin → custom config plugin → Expo Module → eject) plus the common-modules table and a concrete custom-plugin example.
+
+No external skill ships this verbatim; authored by distilling the official Expo docs into the void-machine "never eject by default" doctrine.
+
+Strategy: distill. Frame ejecting as a one-way door and keep projects on Expo tooling via plugins, rather than restating the docs option-by-option.