PyPI - coding-os - Versions diffs - 0.3.2__py3-none-any.whl - Mend

coding-os 0.3.2__py3-none-any.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1304) hide show

adapters/claude/README.md +6 -0
adapters/claude/_install_helpers/extract_stacks.py +43 -0
adapters/claude/_install_helpers/update_mcp_json.py +75 -0
adapters/claude/adapter.yaml +164 -0
adapters/claude/hooks/README.md +40 -0
adapters/claude/hooks/agent_memory_sync.py +131 -0
adapters/claude/hooks/ensure-agent-memory-link.sh +36 -0
adapters/claude/hooks/sync-agent-memory.sh +21 -0
adapters/claude/install.sh +86 -0
adapters/claude/sdk_dispatcher.py +871 -0
adapters/claude/settings.local.template.json +31 -0
adapters/claude/settings.template.json +808 -0
adapters/claude/update_mcp_json.py +85 -0
adapters/codex/adapter.yaml +254 -0
adapters/codex/chat_provider.py +230 -0
adapters/codex/commands/formula-f1.md +129 -0
adapters/codex/commands/formula-f10.md +100 -0
adapters/codex/commands/formula-f11.md +123 -0
adapters/codex/commands/formula-f2.md +139 -0
adapters/codex/commands/formula-f3.md +127 -0
adapters/codex/commands/formula-f4.md +101 -0
adapters/codex/commands/formula-f5.md +135 -0
adapters/codex/commands/formula-f6.md +147 -0
adapters/codex/commands/formula-f7.md +111 -0
adapters/codex/commands/formula-f8.md +133 -0
adapters/codex/commands/formula-f9.md +112 -0
adapters/codex/enable_codex_hooks.py +94 -0
adapters/codex/ensure_codex_mcp.py +124 -0
adapters/codex/hooks/codex-merge-hook-output.py +72 -0
adapters/codex/hooks/codex-normalize-edit.py +96 -0
adapters/codex/hooks/codex-postedit-dispatch.sh +75 -0
adapters/codex/hooks/codex-posttool-dispatch.sh +70 -0
adapters/codex/hooks/codex-preedit-dispatch.sh +83 -0
adapters/codex/hooks/codex-pretool-dispatch.sh +82 -0
adapters/codex/hooks/codex-sessionend-dispatch.sh +20 -0
adapters/codex/hooks/codex-sessionstart-dispatch.sh +68 -0
adapters/codex/hooks/codex-stop-dispatch.sh +73 -0
adapters/codex/hooks/codex-userpromptsubmit-dispatch.sh +74 -0
adapters/codex/hooks.template.json +208 -0
adapters/codex/install.sh +83 -0
adapters/codex/sdk_dispatcher.py +449 -0
board_os/__init__.py +39 -0
board_os/_agent_runtime.py +256 -0
board_os/config.py +421 -0
board_os/git_coherence.py +107 -0
board_os/hub_adapter_manifest.py +140 -0
board_os/mcp_tools.py +3228 -0
board_os/migration.py +166 -0
board_os/parser.py +317 -0
board_os/presence.py +156 -0
board_os/sync.py +320 -0
board_os/transition_gates.py +224 -0
board_os/transition_gates_cli.py +272 -0
board_os/transition_gates_validator.py +551 -0
board_os/verify_suites.py +126 -0
board_os/verify_suites_cli.py +328 -0
board_os/workflow.py +967 -0
cli/__init__.py +0 -0
cli/_data_types.py +248 -0
cli/_init_helpers.py +587 -0
cli/_resources.py +100 -0
cli/adapter_registry.py +239 -0
cli/add_stack.py +315 -0
cli/aggregator.py +438 -0
cli/board_commands.py +1218 -0
cli/brain_commands.py +255 -0
cli/cognition.py +345 -0
cli/config_composer.py +349 -0
cli/core_version.py +41 -0
cli/cron_commands.py +278 -0
cli/db_reset.py +298 -0
cli/doc_commands.py +111 -0
cli/doctor.py +2953 -0
cli/doctor_board.py +365 -0
cli/doctor_extras.py +1121 -0
cli/doctor_graph.py +608 -0
cli/doctor_tokens.py +254 -0
cli/graph_commands.py +1265 -0
cli/hook_renderer.py +393 -0
cli/hub_commands.py +580 -0
cli/list_adapters.py +79 -0
cli/list_stacks.py +105 -0
cli/logs_commands.py +89 -0
cli/main.py +3070 -0
cli/materialize_file.py +65 -0
cli/mcp_start.py +153 -0
cli/module_commands.py +513 -0
cli/pr_commands.py +2024 -0
cli/preset_commands.py +126 -0
cli/preset_registry.py +171 -0
cli/project_overrides.py +119 -0
cli/registry.py +365 -0
cli/remove_stack.py +492 -0
cli/renderer.py +620 -0
cli/setup.py +464 -0
cli/skill_commands.py +689 -0
cli/skill_registry.py +235 -0
cli/skills_list.py +332 -0
cli/stack_lint.py +351 -0
cli/stack_registry.py +688 -0
cli/subsystems.py +335 -0
cli/sync_all.py +310 -0
cli/tail_command.py +410 -0
cli/update.py +608 -0
cli/verify_since_edit.py +439 -0
coding_os-0.3.2.dist-info/METADATA +508 -0
coding_os-0.3.2.dist-info/RECORD +1304 -0
coding_os-0.3.2.dist-info/WHEEL +5 -0
coding_os-0.3.2.dist-info/entry_points.txt +5 -0
coding_os-0.3.2.dist-info/licenses/LICENSE +201 -0
coding_os-0.3.2.dist-info/top_level.txt +10 -0
core/__init__.py +0 -0
core/board_os/__init__.py +39 -0
core/board_os/_agent_runtime.py +256 -0
core/board_os/config.py +421 -0
core/board_os/git_coherence.py +107 -0
core/board_os/hub_adapter_manifest.py +140 -0
core/board_os/mcp_tools.py +3228 -0
core/board_os/migration.py +166 -0
core/board_os/parser.py +317 -0
core/board_os/presence.py +156 -0
core/board_os/sync.py +320 -0
core/board_os/transition-gates.yaml +176 -0
core/board_os/transition_gates.py +224 -0
core/board_os/transition_gates_cli.py +272 -0
core/board_os/transition_gates_validator.py +551 -0
core/board_os/verify-suites.yaml +113 -0
core/board_os/verify_suites.py +126 -0
core/board_os/verify_suites_cli.py +328 -0
core/board_os/workflow.py +967 -0
core/commands/board.md +27 -0
core/commands/classify.md +23 -0
core/commands/compose.md +23 -0
core/commands/daily.md +31 -0
core/commands/diagnose.md +7 -0
core/commands/memory-search.md +23 -0
core/commands/new-project.md +33 -0
core/commands/retro.md +38 -0
core/commands/review.md +14 -0
core/commands/task.md +17 -0
core/commands/verify.md +34 -0
core/docs/thinking_os-final-edition.md +1449 -0
core/doctor-config.yaml +74 -0
core/graph_os/__init__.py +29 -0
core/graph_os/backend.py +233 -0
core/graph_os/backends/__init__.py +13 -0
core/graph_os/backends/sqlite_backend.py +1053 -0
core/graph_os/bench/__init__.py +17 -0
core/graph_os/bench/fixtures.py +56 -0
core/graph_os/bench/harness.py +95 -0
core/graph_os/bench/persian_precision.py +142 -0
core/graph_os/bench/scale_500k.py +120 -0
core/graph_os/bench/token_cost.py +170 -0
core/graph_os/bench/viewer_fps.py +110 -0
core/graph_os/communities.py +410 -0
core/graph_os/enterprise.py +218 -0
core/graph_os/entry_points.py +226 -0
core/graph_os/extractors/__init__.py +25 -0
core/graph_os/extractors/code_generic.py +914 -0
core/graph_os/extractors/code_go.py +1422 -0
core/graph_os/extractors/code_json.py +340 -0
core/graph_os/extractors/code_php.py +979 -0
core/graph_os/extractors/code_python.py +1454 -0
core/graph_os/extractors/code_shell.py +538 -0
core/graph_os/extractors/code_toml.py +302 -0
core/graph_os/extractors/code_ts.py +1665 -0
core/graph_os/extractors/code_yaml.py +394 -0
core/graph_os/extractors/contracts.py +1592 -0
core/graph_os/extractors/md_links.py +890 -0
core/graph_os/extractors/task_deps.py +345 -0
core/graph_os/groups/__init__.py +22 -0
core/graph_os/groups/cross_repo.py +156 -0
core/graph_os/groups/manifest.py +141 -0
core/graph_os/ingest/__init__.py +19 -0
core/graph_os/ingest/base.py +306 -0
core/graph_os/ingest/github.py +112 -0
core/graph_os/ingest/zip.py +95 -0
core/graph_os/toolchain.py +393 -0
core/graph_os/tools/__init__.py +9 -0
core/graph_os/tools/graph.py +5573 -0
core/graph_os/tools/reindex_dispatch.py +730 -0
core/graph_os/tree_sitter_overlay.py +235 -0
core/graph_os/types.py +252 -0
core/graph_os/vec_index.py +277 -0
core/graph_os/viewer/__init__.py +12 -0
core/graph_os/viewer/exporter.py +93 -0
core/graph_os/viewer/template.py +189 -0
core/hooks/_helpers/_paths.py +40 -0
core/hooks/_helpers/advance_role.py +72 -0
core/hooks/_helpers/auto_compose.py +228 -0
core/hooks/_helpers/auto_validate_lessons.py +55 -0
core/hooks/_helpers/branch_guard_check.py +796 -0
core/hooks/_helpers/check_commit_message.py +108 -0
core/hooks/_helpers/check_dangerous_rm.py +80 -0
core/hooks/_helpers/check_git_bypass.py +154 -0
core/hooks/_helpers/check_git_destructive.py +77 -0
core/hooks/_helpers/check_settings_write.py +97 -0
core/hooks/_helpers/consume_override.py +51 -0
core/hooks/_helpers/context_budget.py +77 -0
core/hooks/_helpers/cos_say_json.py +103 -0
core/hooks/_helpers/destructive_edit_check.py +163 -0
core/hooks/_helpers/detect_status_transition.py +82 -0
core/hooks/_helpers/digest_regen.py +56 -0
core/hooks/_helpers/doc_sync_check.py +498 -0
core/hooks/_helpers/drain_embedding_outbox.py +52 -0
core/hooks/_helpers/extract_additional_context.py +51 -0
core/hooks/_helpers/extract_commit_msg_arg.py +74 -0
core/hooks/_helpers/git_command_parse.py +424 -0
core/hooks/_helpers/git_settings_fields.py +47 -0
core/hooks/_helpers/graph_context_match.py +37 -0
core/hooks/_helpers/graph_marker_check.py +70 -0
core/hooks/_helpers/jit_recall.py +56 -0
core/hooks/_helpers/json_field.py +41 -0
core/hooks/_helpers/narrative_signal.py +59 -0
core/hooks/_helpers/observation_count.py +31 -0
core/hooks/_helpers/pre_commit_batch.py +177 -0
core/hooks/_helpers/pre_commit_fake_input.py +42 -0
core/hooks/_helpers/presence_gc.py +102 -0
core/hooks/_helpers/presence_write.py +167 -0
core/hooks/_helpers/recover_indirect.py +35 -0
core/hooks/_helpers/routing_evolution.py +104 -0
core/hooks/_helpers/session_recap.py +72 -0
core/hooks/_helpers/skill_primer.py +229 -0
core/hooks/_helpers/task_sync.py +59 -0
core/hooks/_helpers/tool_failure_capture.py +147 -0
core/hooks/_helpers/trajectory_autosnap.py +278 -0
core/hooks/_helpers/trajectory_startup.py +62 -0
core/hooks/_helpers/turn_summary.py +82 -0
core/hooks/_helpers/validate_task_frontmatter.py +98 -0
core/hooks/_helpers/wip_limit_check.py +103 -0
core/hooks/_helpers/wip_lines.py +53 -0
core/hooks/_helpers/work_log_append.py +89 -0
core/hooks/_helpers/wrap_dispatch_output.py +82 -0
core/hooks/advance-role.sh +48 -0
core/hooks/agent-presence.sh +179 -0
core/hooks/auto-brain-decay.sh +184 -0
core/hooks/auto-compose-roles.sh +83 -0
core/hooks/auto-graph-reconcile-shell.sh +119 -0
core/hooks/auto-regen-doc-index.sh +120 -0
core/hooks/auto-reindex-docs.sh +130 -0
core/hooks/auto-task-sync.sh +56 -0
core/hooks/auto-trace-rotate.sh +88 -0
core/hooks/block-bad-patterns.sh +212 -0
core/hooks/block-dangerous-commands.sh +182 -0
core/hooks/block-hardcoded-literals.sh +90 -0
core/hooks/block-migration-conflict.sh +114 -0
core/hooks/block-protected-files.sh +129 -0
core/hooks/block-secrets.sh +185 -0
core/hooks/block-shared-tree-edit.sh +75 -0
core/hooks/block-uv-heredoc.sh +78 -0
core/hooks/branch-guard.sh +122 -0
core/hooks/capture-observation.sh +76 -0
core/hooks/capture-tool-failure.sh +24 -0
core/hooks/capture-work-log.sh +89 -0
core/hooks/check-agents-md-refs.sh +75 -0
core/hooks/check-agents-md-size.sh +49 -0
core/hooks/check-capture-worked.sh +148 -0
core/hooks/check-doc-size.sh +61 -0
core/hooks/check-mcp-extras.sh +92 -0
core/hooks/check-state.sh +87 -0
core/hooks/classify-task-mode.sh +103 -0
core/hooks/cos-env.sh +1301 -0
core/hooks/drain-embedding-outbox.sh +24 -0
core/hooks/enforce-anti-ambiguity.sh +74 -0
core/hooks/enforce-commit-message.sh +73 -0
core/hooks/enforce-doc-anchor.sh +224 -0
core/hooks/enforce-doc-sync.sh +206 -0
core/hooks/enforce-graph-context.sh +89 -0
core/hooks/enforce-graph-first-read.sh +94 -0
core/hooks/enforce-memory-check.sh +128 -0
core/hooks/enforce-rename-plan.sh +78 -0
core/hooks/enforce-scaffold-boundary.sh +68 -0
core/hooks/enforce-skill.sh +125 -0
core/hooks/enforce-task-body.sh +52 -0
core/hooks/enforce-task-start.sh +81 -0
core/hooks/enforce-task-transition.sh +75 -0
core/hooks/enforce-template.sh +143 -0
core/hooks/enforce-verify.sh +112 -0
core/hooks/enforce-wip-limit.sh +43 -0
core/hooks/enforce-zoom.sh +69 -0
core/hooks/ensure-hub-up.sh +67 -0
core/hooks/inject-mcp-caller-session.sh +70 -0
core/hooks/jit-recall.sh +65 -0
core/hooks/link-commit-to-task.sh +143 -0
core/hooks/lint-task.sh +40 -0
core/hooks/nudge-docs-first.sh +71 -0
core/hooks/nudge-git-mode.sh +29 -0
core/hooks/nudge-graph-os.sh +118 -0
core/hooks/nudge-learn-narrative.sh +36 -0
core/hooks/nudge-model-routing.sh +32 -0
core/hooks/nudge-reentry.sh +101 -0
core/hooks/nudge-reuse-first.sh +68 -0
core/hooks/nudge-task-discovery.sh +81 -0
core/hooks/nudge-thinking-os.sh +109 -0
core/hooks/pr-reap.sh +23 -0
core/hooks/reclaim-sweep.sh +58 -0
core/hooks/record-verify-auto.sh +77 -0
core/hooks/record-verify.sh +74 -0
core/hooks/regen-reminder.sh +104 -0
core/hooks/registry.yaml +1262 -0
core/hooks/remind-daily.sh +27 -0
core/hooks/remind-dogfood.sh +70 -0
core/hooks/remind-learn-validate.sh +94 -0
core/hooks/rules-primer.sh +50 -0
core/hooks/search-enforce-inventory.sh +108 -0
core/hooks/search-verify-remaining.sh +132 -0
core/hooks/session-context.sh +729 -0
core/hooks/session-end.sh +145 -0
core/hooks/session-skill-primer.sh +43 -0
core/hooks/snapshot-transcript.sh +56 -0
core/hooks/sync-task-current.sh +85 -0
core/hooks/test-first-reminder.sh +120 -0
core/hooks/test-governor.sh +173 -0
core/hooks/thinking_os-gate.sh +52 -0
core/hooks/track-backtrack.sh +35 -0
core/hooks/track-discovery.sh +121 -0
core/hooks/track-skill.sh +53 -0
core/hooks/validate-task-frontmatter.sh +49 -0
core/hooks/verify-rename-callers.sh +119 -0
core/hooks/warn-abandoned-task.sh +99 -0
core/hooks/warn-destructive-edit.sh +64 -0
core/hooks/warn-diff-size.sh +43 -0
core/hooks/warn-graph-empty.sh +81 -0
core/hooks/warn-mcp-down.sh +190 -0
core/hooks/write-state.sh +55 -0
core/logging_os/__init__.py +33 -0
core/logging_os/api.py +127 -0
core/logging_os/bridge.py +80 -0
core/logging_os/config.py +172 -0
core/logging_os/fingerprint.py +25 -0
core/logging_os/redact.py +53 -0
core/logging_os/render.py +83 -0
core/logging_os/sinks.py +164 -0
core/rules/anti-overengineering.md +44 -0
core/rules/api-contract-discipline.md +41 -0
core/rules/dimension-registry.md +155 -0
core/rules/git-workflow.md +57 -0
core/rules/memory.md +46 -0
core/rules/model-routing.md +22 -0
core/rules/skill-enforcement.md +75 -0
core/rules/test-discipline.md +38 -0
core/rules/thinking_os.md +48 -0
core/rules/transparency-banner.md +37 -0
core/runtime_paths.yaml +36 -0
core/scaffold_manifest.json +14430 -0
core/scheduled/__init__.py +0 -0
core/scheduled/_activity.py +126 -0
core/scheduled/_state.py +113 -0
core/scheduled/config.py +86 -0
core/scheduled/dep_reconcile.py +135 -0
core/scheduled/error_sweep.py +137 -0
core/scheduled/nightly.py +930 -0
core/scheduled/responsive_extract.py +65 -0
core/schemas/adapter.schema.json +269 -0
core/schemas/preset.schema.json +50 -0
core/schemas/skill.schema.json +81 -0
core/schemas/stack.schema.json +404 -0
core/scripts/_lib.sh +9 -0
core/scripts/docs-lint.sh +228 -0
core/scripts/docs-nav-fix.sh +133 -0
core/scripts/docs-staleness-check.sh +154 -0
core/scripts/install-adapter.sh +266 -0
core/scripts/link-stack-skills.sh +52 -0
core/scripts/log-latest.sh +106 -0
core/scripts/log-search.sh +89 -0
core/scripts/log-write.sh +134 -0
core/scripts/ref-resolve.sh +71 -0
core/skills/a11y/SKILL.md +305 -0
core/skills/a11y/assets/a11y-checklist.md +137 -0
core/skills/a11y/references/aria-and-focus.md +247 -0
core/skills/a11y/references/rn-accessibility.md +343 -0
core/skills/a11y/references/screen-reader-testing.md +190 -0
core/skills/agent-memory/SKILL.md +191 -0
core/skills/agent-memory/assets/memory-checklist.md +21 -0
core/skills/agent-memory/references/memory-recipes.md +57 -0
core/skills/api-design/SKILL.md +232 -0
core/skills/api-design/assets/api-design-checklist.md +110 -0
core/skills/api-design/references/error-envelope.md +381 -0
core/skills/api-design/references/idempotency-pagination.md +312 -0
core/skills/api-design/references/rest-contracts.md +426 -0
core/skills/auth-patterns/SKILL.md +352 -0
core/skills/auth-patterns/assets/auth-checklist.md +118 -0
core/skills/auth-patterns/references/jwt-and-service-tokens.md +343 -0
core/skills/auth-patterns/references/passkeys-2fa.md +289 -0
core/skills/auth-patterns/references/sessions-vs-jwt.md +230 -0
core/skills/auth-patterns/scripts/cookie-flag-check.py +146 -0
core/skills/backend-fundamentals/SKILL.md +238 -0
core/skills/backend-fundamentals/assets/backend-checklist.md +27 -0
core/skills/backend-fundamentals/references/backend-patterns.md +56 -0
core/skills/backend-fundamentals/scripts/check_layering.py +83 -0
core/skills/clean-code/SKILL.md +642 -0
core/skills/clean-code/scripts/audit-fail-closed.py +167 -0
core/skills/codebase-explorer/SKILL.md +89 -0
core/skills/codebase-explorer/assets/reading-checklist.md +24 -0
core/skills/codebase-explorer/references/reading-strategies.md +52 -0
core/skills/codebase-explorer/scripts/outline.py +99 -0
core/skills/db-design/SKILL.md +327 -0
core/skills/db-design/assets/migration-template.sql +49 -0
core/skills/db-design/references/migration-discipline.md +290 -0
core/skills/db-design/references/postgres-patterns.md +340 -0
core/skills/db-design/scripts/migration-safety.sh +150 -0
core/skills/deployment-cicd/SKILL.md +260 -0
core/skills/deployment-cicd/assets/deploy-checklist.md +26 -0
core/skills/deployment-cicd/references/pipeline-and-release.md +54 -0
core/skills/deployment-cicd/scripts/lint_workflow.py +79 -0
core/skills/docker/SKILL.md +114 -0
core/skills/docker/assets/dockerfile-checklist.md +31 -0
core/skills/docker/references/compose-patterns.md +66 -0
core/skills/docker/references/dockerfile-optimization.md +64 -0
core/skills/docker/scripts/lint_dockerfile.sh +48 -0
core/skills/docker/versions.json +16 -0
core/skills/end-to-end-testing/SKILL.md +101 -0
core/skills/end-to-end-testing/assets/e2e-checklist.md +23 -0
core/skills/end-to-end-testing/references/maestro.md +63 -0
core/skills/end-to-end-testing/references/playwright.md +68 -0
core/skills/end-to-end-testing/scripts/lint_e2e.py +88 -0
core/skills/end-to-end-testing/versions.json +16 -0
core/skills/frontend-design/SKILL.md +76 -0
core/skills/frontend-design/assets/design-checklist.md +29 -0
core/skills/frontend-design/references/design-principles.md +65 -0
core/skills/frontend-design/scripts/check_contrast.py +89 -0
core/skills/frontend-fundamentals/SKILL.md +213 -0
core/skills/frontend-fundamentals/assets/frontend-checklist.md +25 -0
core/skills/frontend-fundamentals/references/rendering-and-state.md +66 -0
core/skills/frontend-fundamentals/scripts/check_frontend.py +86 -0
core/skills/graph-explorer/SKILL.md +215 -0
core/skills/graph-explorer/scripts/explain-impact.sh +64 -0
core/skills/graphql/SKILL.md +187 -0
core/skills/grpc-microservices/SKILL.md +174 -0
core/skills/hexagonal-architecture/SKILL.md +199 -0
core/skills/hexagonal-architecture/assets/folder-scaffold.md +233 -0
core/skills/hexagonal-architecture/references/anti-patterns.md +129 -0
core/skills/hexagonal-architecture/references/go-fiber-layout.md +429 -0
core/skills/hexagonal-architecture/references/python-fastapi-layout.md +453 -0
core/skills/hexagonal-architecture/references/react-native-layout.md +428 -0
core/skills/i18n/SKILL.md +126 -0
core/skills/incident-response/SKILL.md +225 -0
core/skills/incident-response/assets/incident-checklist.md +29 -0
core/skills/incident-response/references/severity-and-runbook.md +53 -0
core/skills/incident-response/scripts/classify_severity.py +86 -0
core/skills/linux-sysadmin/SKILL.md +115 -0
core/skills/linux-sysadmin/assets/hardening-checklist.md +29 -0
core/skills/linux-sysadmin/references/ssh-hardening.md +62 -0
core/skills/linux-sysadmin/references/systemd-and-services.md +77 -0
core/skills/linux-sysadmin/scripts/triage.sh +50 -0
core/skills/linux-sysadmin/versions.json +17 -0
core/skills/llm-patterns/SKILL.md +410 -0
core/skills/llm-patterns/assets/llm-feature-checklist.md +26 -0
core/skills/llm-patterns/references/rag-and-evals.md +59 -0
core/skills/llm-patterns/scripts/estimate_tokens.py +75 -0
core/skills/messaging-queues/SKILL.md +142 -0
core/skills/mobile-fundamentals/SKILL.md +406 -0
core/skills/mobile-fundamentals/assets/mobile-launch-checklist.md +130 -0
core/skills/mobile-fundamentals/references/navigation-and-deep-links.md +337 -0
core/skills/mobile-fundamentals/references/offline-sync.md +339 -0
core/skills/node-backend/SKILL.md +114 -0
core/skills/node-backend/assets/node-checklist.md +25 -0
core/skills/node-backend/references/async-and-errors.md +67 -0
core/skills/node-backend/references/event-loop.md +65 -0
core/skills/node-backend/scripts/check_package.py +78 -0
core/skills/node-backend/versions.json +17 -0
core/skills/observability/SKILL.md +289 -0
core/skills/observability/assets/observability-checklist.md +27 -0
core/skills/observability/references/instrumentation.md +57 -0
core/skills/observability/scripts/lint_logging.py +77 -0
core/skills/payments/SKILL.md +102 -0
core/skills/performance/SKILL.md +305 -0
core/skills/performance/assets/perf-checklist.md +143 -0
core/skills/performance/references/mobile-performance.md +249 -0
core/skills/performance/references/web-vitals.md +209 -0
core/skills/php/SKILL.md +116 -0
core/skills/php/assets/php-checklist.md +26 -0
core/skills/php/references/modern-php.md +64 -0
core/skills/php/references/security.md +72 -0
core/skills/php/scripts/scan_php_smells.py +99 -0
core/skills/php/versions.json +9 -0
core/skills/pr-mode-driver/SKILL.md +65 -0
core/skills/realtime-websockets/SKILL.md +152 -0
core/skills/redis/SKILL.md +105 -0
core/skills/redis/assets/redis-checklist.md +27 -0
core/skills/redis/references/operations.md +66 -0
core/skills/redis/references/patterns.md +62 -0
core/skills/redis/scripts/analyze_info.py +101 -0
core/skills/redis/versions.json +9 -0
core/skills/search/SKILL.md +91 -0
core/skills/search/references/grep.md +76 -0
core/skills/search/scripts/verify-count.sh +73 -0
core/skills/search-infra/SKILL.md +109 -0
core/skills/security-mobile/SKILL.md +394 -0
core/skills/security-mobile/assets/mobile-security-checklist.md +117 -0
core/skills/security-mobile/references/masvs-l1-checklist.md +127 -0
core/skills/security-web/SKILL.md +217 -0
core/skills/security-web/assets/security-web-checklist.md +167 -0
core/skills/security-web/references/owasp-top-10.md +551 -0
core/skills/security-web/references/supply-chain.md +179 -0
core/skills/security-web/scripts/csp-check.sh +153 -0
core/skills/shell-scripting/SKILL.md +128 -0
core/skills/shell-scripting/assets/script-checklist.md +33 -0
core/skills/shell-scripting/references/argument-parsing.md +84 -0
core/skills/shell-scripting/references/bash-robustness.md +78 -0
core/skills/shell-scripting/scripts/lint_script.sh +53 -0
core/skills/shell-scripting/scripts/new_script.py +131 -0
core/skills/shell-scripting/versions.json +23 -0
core/skills/sql-authoring/SKILL.md +104 -0
core/skills/sql-authoring/assets/query-review-checklist.md +26 -0
core/skills/sql-authoring/references/query-patterns.md +89 -0
core/skills/sql-authoring/references/reading-explain.md +52 -0
core/skills/sql-authoring/scripts/analyze_plan.py +100 -0
core/skills/sql-authoring/versions.json +17 -0
core/skills/state-management/SKILL.md +428 -0
core/skills/state-management/references/tanstack-query-recipes.md +301 -0
core/skills/state-management/references/zustand-recipes.md +364 -0
core/skills/supabase/SKILL.md +108 -0
core/skills/supabase/assets/supabase-checklist.md +26 -0
core/skills/supabase/references/realtime-and-storage.md +55 -0
core/skills/supabase/references/rls-and-auth.md +65 -0
core/skills/supabase/scripts/check_rls.py +88 -0
core/skills/supabase/versions.json +9 -0
core/skills/task-driver/SKILL.md +272 -0
core/skills/task-driver/scripts/task-lint.sh +163 -0
core/skills/technical-writing/SKILL.md +85 -0
core/skills/technical-writing/assets/doc-checklist.md +29 -0
core/skills/technical-writing/references/doc-anatomy.md +53 -0
core/skills/technical-writing/references/writing-craft.md +59 -0
core/skills/technical-writing/scripts/new_doc.py +81 -0
core/skills/terraform-k8s/SKILL.md +133 -0
core/skills/testing-strategy/SKILL.md +266 -0
core/skills/testing-strategy/assets/test-review-checklist.md +25 -0
core/skills/testing-strategy/references/test-types.md +52 -0
core/skills/testing-strategy/scripts/coverage_gate.py +79 -0
core/skills/thinking_os/SKILL.md +288 -0
core/skills/thinking_os/scripts/classify.sh +122 -0
core/skills/typescript/SKILL.md +110 -0
core/skills/typescript/assets/typescript-checklist.md +24 -0
core/skills/typescript/references/strictness.md +53 -0
core/skills/typescript/references/type-system.md +86 -0
core/skills/typescript/scripts/check_tsconfig.py +92 -0
core/skills/typescript/versions.json +9 -0
core/subsystems.yaml +202 -0
core/thinking_os/__init__.py +1 -0
core/thinking_os/_agent_markers.py +32 -0
core/thinking_os/agents/README.md +71 -0
core/thinking_os/agents/analyst.md +139 -0
core/thinking_os/agents/architect.md +127 -0
core/thinking_os/agents/debugger.md +111 -0
core/thinking_os/agents/deployer.md +112 -0
core/thinking_os/agents/distiller.md +28 -0
core/thinking_os/agents/documenter.md +101 -0
core/thinking_os/agents/implementer.md +135 -0
core/thinking_os/agents/internal/session_observer.md +39 -0
core/thinking_os/agents/observer.md +100 -0
core/thinking_os/agents/onboarder.md +81 -0
core/thinking_os/agents/refactorer.md +123 -0
core/thinking_os/agents/repairer.md +47 -0
core/thinking_os/agents/researcher.md +129 -0
core/thinking_os/agents/reviewer.md +147 -0
core/thinking_os/agents/security_auditor.md +133 -0
core/thinking_os/background.py +405 -0
core/thinking_os/bootstrap_outcomes.py +200 -0
core/thinking_os/budget.py +302 -0
core/thinking_os/capture.py +495 -0
core/thinking_os/cognition.py +516 -0
core/thinking_os/cognition_schemas.py +517 -0
core/thinking_os/compress.py +192 -0
core/thinking_os/concepts.py +233 -0
core/thinking_os/dashboard.py +159 -0
core/thinking_os/database.py +2883 -0
core/thinking_os/decay.py +393 -0
core/thinking_os/digest.py +295 -0
core/thinking_os/dispatcher.py +192 -0
core/thinking_os/dispatcher_helpers.py +48 -0
core/thinking_os/dispatchers/__init__.py +3 -0
core/thinking_os/dispatchers/default.py +47 -0
core/thinking_os/distill.py +192 -0
core/thinking_os/doc_indexer.py +905 -0
core/thinking_os/embeddings.py +943 -0
core/thinking_os/formula_composer.py +556 -0
core/thinking_os/gate_marker.py +75 -0
core/thinking_os/graph.py +296 -0
core/thinking_os/graph_indexer.py +360 -0
core/thinking_os/health_check.py +517 -0
core/thinking_os/impact.py +119 -0
core/thinking_os/memory_gc.py +356 -0
core/thinking_os/migrator_embeddings.py +318 -0
core/thinking_os/precision.py +194 -0
core/thinking_os/presets/registry.yaml +127 -0
core/thinking_os/record_outcome.py +399 -0
core/thinking_os/repair.py +105 -0
core/thinking_os/retrieval_quality.py +239 -0
core/thinking_os/roles/analyst.yaml +83 -0
core/thinking_os/roles/architect.yaml +88 -0
core/thinking_os/roles/debugger.yaml +71 -0
core/thinking_os/roles/deployer.yaml +71 -0
core/thinking_os/roles/documenter.yaml +72 -0
core/thinking_os/roles/implementer.yaml +83 -0
core/thinking_os/roles/observer.yaml +70 -0
core/thinking_os/roles/refactorer.yaml +71 -0
core/thinking_os/roles/researcher.yaml +72 -0
core/thinking_os/roles/reviewer.yaml +79 -0
core/thinking_os/roles/security_auditor.yaml +83 -0
core/thinking_os/roles_state.py +168 -0
core/thinking_os/sanitizer.py +320 -0
core/thinking_os/server.py +3160 -0
core/thinking_os/session_enrich.py +272 -0
core/thinking_os/session_observe_worker.py +111 -0
core/thinking_os/session_startup.py +74 -0
core/thinking_os/session_summary.py +245 -0
core/thinking_os/situations/registry.yaml +99 -0
core/thinking_os/task_analyzer.py +462 -0
core/thinking_os/task_parser.py +342 -0
core/thinking_os/task_sync.py +73 -0
core/thinking_os/tools/__init__.py +6 -0
core/thinking_os/tools/_shared.py +947 -0
core/thinking_os/tools/cognition.py +1867 -0
core/thinking_os/tools/docs.py +770 -0
core/thinking_os/tools/learning.py +2078 -0
core/thinking_os/tools/logs.py +79 -0
core/thinking_os/tools/memory.py +840 -0
core/thinking_os/tools/metrics.py +200 -0
core/thinking_os/tools/retrieve.py +415 -0
core/thinking_os/tools/routing.py +658 -0
core/thinking_os/tools/tasks.py +449 -0
core/thinking_os/tools/trajectory.py +181 -0
core/thinking_os/tracing.py +235 -0
core/web/__init__.py +5 -0
core/web/_cache.py +118 -0
core/web/_deps.py +56 -0
core/web/_envelope.py +85 -0
core/web/_project_context.py +140 -0
core/web/chat_providers.py +108 -0
core/web/init_jobs.py +216 -0
core/web/routes/__init__.py +25 -0
core/web/routes/_bounded_read.py +76 -0
core/web/routes/board.py +1089 -0
core/web/routes/cognition.py +1838 -0
core/web/routes/config.py +635 -0
core/web/routes/graph.py +513 -0
core/web/routes/health.py +180 -0
core/web/routes/hooks.py +288 -0
core/web/routes/hub.py +1219 -0
core/web/routes/logs.py +374 -0
core/web/routes/metrics.py +43 -0
core/web/routes/observability.py +400 -0
core/web/routes/patterns.py +227 -0
core/web/routes/presence.py +609 -0
core/web/routes/roles.py +446 -0
core/web/routes/scheduled.py +261 -0
core/web/routes/search.py +238 -0
core/web/routes/sessions.py +220 -0
core/web/routes/settings.py +363 -0
core/web/routes/stream.py +547 -0
core/web/security.py +157 -0
core/web/server.py +283 -0
graph_os/__init__.py +29 -0
graph_os/backend.py +233 -0
graph_os/backends/__init__.py +13 -0
graph_os/backends/sqlite_backend.py +1053 -0
graph_os/communities.py +410 -0
graph_os/enterprise.py +218 -0
graph_os/entry_points.py +226 -0
graph_os/extractors/__init__.py +25 -0
graph_os/extractors/code_generic.py +914 -0
graph_os/extractors/code_go.py +1422 -0
graph_os/extractors/code_json.py +340 -0
graph_os/extractors/code_php.py +979 -0
graph_os/extractors/code_python.py +1454 -0
graph_os/extractors/code_shell.py +538 -0
graph_os/extractors/code_toml.py +302 -0
graph_os/extractors/code_ts.py +1665 -0
graph_os/extractors/code_yaml.py +394 -0
graph_os/extractors/contracts.py +1592 -0
graph_os/extractors/md_links.py +890 -0
graph_os/extractors/task_deps.py +345 -0
graph_os/groups/__init__.py +22 -0
graph_os/groups/cross_repo.py +156 -0
graph_os/groups/manifest.py +141 -0
graph_os/ingest/__init__.py +19 -0
graph_os/ingest/base.py +306 -0
graph_os/ingest/github.py +112 -0
graph_os/ingest/zip.py +95 -0
graph_os/toolchain.py +393 -0
graph_os/tools/__init__.py +9 -0
graph_os/tools/graph.py +5573 -0
graph_os/tools/reindex_dispatch.py +730 -0
graph_os/tree_sitter_overlay.py +235 -0
graph_os/types.py +252 -0
graph_os/vec_index.py +277 -0
graph_os/viewer/__init__.py +12 -0
graph_os/viewer/exporter.py +93 -0
graph_os/viewer/template.py +189 -0
scheduled/__init__.py +0 -0
scheduled/_activity.py +126 -0
scheduled/_state.py +113 -0
scheduled/config.py +86 -0
scheduled/dep_reconcile.py +135 -0
scheduled/error_sweep.py +137 -0
scheduled/nightly.py +930 -0
scheduled/responsive_extract.py +65 -0
scripts/__init__.py +4 -0
scripts/_commit_msg_body.sh +31 -0
scripts/_post_commit_body.sh +49 -0
scripts/_pre_commit_body.sh +121 -0
scripts/_prepare_commit_msg_body.sh +53 -0
scripts/audit_mcp_tools.py +693 -0
scripts/bench_sdk_dispatcher.py +177 -0
scripts/capture_golden.py +169 -0
scripts/check_graph_phantoms.py +75 -0
scripts/dev/audit_doc_links.py +359 -0
scripts/dev/audit_scaffold_module_tags.py +107 -0
scripts/dev/backfill_doc_headers.py +328 -0
scripts/dev/backfill_nav_lines.py +119 -0
scripts/dev/fix_nav_placement.py +106 -0
scripts/dev/inspect_sdk_options.py +45 -0
scripts/dev/migrate_check_ids.py +170 -0
scripts/dev/strip_purpose_blocks.py +154 -0
scripts/dump_openapi.py +66 -0
scripts/e2e_dispatch_tool.py +195 -0
scripts/generate_manifest.py +166 -0
scripts/golden_sections.py +20 -0
scripts/graph_demo.py +161 -0
scripts/install-git-hooks.sh +47 -0
scripts/migrate_embeddings_minilm_to_bge_m3.py +84 -0
scripts/operational_eval.py +445 -0
scripts/probe_agent_session_resolver.py +59 -0
scripts/prune_deleted_path.py +127 -0
scripts/refactor_agent_dual_mode.py +171 -0
scripts/refresh_skill_versions.py +302 -0
scripts/regen_doc_index.py +209 -0
scripts/regen_doctor_schema.py +62 -0
scripts/regen_rules.py +94 -0
scripts/rename_formulas_to_semantic.py +241 -0
scripts/smoke_db_connections.py +183 -0
scripts/smoke_doc_header.py +72 -0
scripts/smoke_graph_e2e.py +374 -0
scripts/smoke_sdk_dispatch.py +84 -0
scripts/smoke_uid_resolver.py +164 -0
scripts/verify_dispatchers.py +244 -0
scripts/verify_phase_c_e2e.py +436 -0
templates/__init__.py +6 -0
templates/_base/Makefile.base +353 -0
templates/_base/base.yaml +59 -0
templates/_base/coding-os.yaml.template +39 -0
templates/_base/dimension-registry.template.md +68 -0
templates/_base/domain-config.template.json +46 -0
templates/_base/fragments/anatomy-map.md.tmpl +11 -0
templates/_base/fragments/context-discipline.md.tmpl +3 -0
templates/_base/fragments/core-loop.md.tmpl +52 -0
templates/_base/fragments/engineering-routing.md.tmpl +3 -0
templates/_base/fragments/header.md.tmpl +6 -0
templates/_base/fragments/identity.md.tmpl +3 -0
templates/_base/fragments/principles.md.tmpl +3 -0
templates/_base/fragments/retrieval-routing.md.tmpl +23 -0
templates/_base/fragments/session-handoff.md.tmpl +3 -0
templates/_base/fragments/skills.md.tmpl +3 -0
templates/_base/fragments/ssot-map.md.tmpl +3 -0
templates/_base/fragments/stop-conditions.md.tmpl +3 -0
templates/_base/fragments/subagent-dispatch.md.tmpl +3 -0
templates/_base/fragments/task-authoring.md.tmpl +69 -0
templates/_base/fragments/task-logging.md.tmpl +8 -0
templates/_base/fragments/tool-routing.md.tmpl +9 -0
templates/_base/fragments/verification-matrix.md.tmpl +12 -0
templates/_base/lang/dart/analysis_options.yaml +7 -0
templates/_base/lang/php/phpcs.xml.dist +10 -0
templates/_base/lang/python/pyproject.toml +19 -0
templates/_base/lang/rust/clippy.toml +5 -0
templates/_base/lang/rust/rustfmt.toml +3 -0
templates/_base/lang/typescript/eslint.config.js +26 -0
templates/_base/lang/typescript/tsconfig.json +15 -0
templates/_base/lang/typescript/vitest.config.ts +10 -0
templates/_base/scaffold/changes.log +1 -0
templates/_base/scaffold/docs/00-index.md +55 -0
templates/_base/scaffold/docs/_meta/feature-dependency-tree.md +30 -0
templates/_base/scaffold/docs/_meta/foundation-map.md +56 -0
templates/_base/scaffold/docs/_meta/questions.md +8 -0
templates/_base/scaffold/docs/_meta/roadmap.md +33 -0
templates/_base/scaffold/docs/api-contracts/00-index.md +58 -0
templates/_base/scaffold/docs/api-contracts/error-format.md +58 -0
templates/_base/scaffold/docs/architecture/00-index.md +42 -0
templates/_base/scaffold/docs/architecture/adr/00-index.md +39 -0
templates/_base/scaffold/docs/engineering/00-index.md +9 -0
templates/_base/scaffold/docs/governance/00-index.md +55 -0
templates/_base/scaffold/docs/governance/_templates/doc-cheat-sheet.md +202 -0
templates/_base/scaffold/docs/governance/_templates/playbook-template.md +81 -0
templates/_base/scaffold/docs/governance/_templates/post-mortem-template.md +85 -0
templates/_base/scaffold/docs/governance/_templates/runbook-template.md +88 -0
templates/_base/scaffold/docs/governance/_templates/security-review-template.md +111 -0
templates/_base/scaffold/docs/governance/_templates/task-detail.md +61 -0
templates/_base/scaffold/docs/governance/agent-workflow.md +101 -0
templates/_base/scaffold/docs/governance/anatomy-contract.md +150 -0
templates/_base/scaffold/docs/governance/critical-rules.md +224 -0
templates/_base/scaffold/docs/governance/decision-records.md +58 -0
templates/_base/scaffold/docs/governance/docs-first-protocol.md +157 -0
templates/_base/scaffold/docs/governance/docs-system.md +151 -0
templates/_base/scaffold/docs/governance/gdpr-compliance.md +66 -0
templates/_base/scaffold/docs/governance/mcp-tool-inventory.md +112 -0
templates/_base/scaffold/docs/governance/risk-register.md +26 -0
templates/_base/scaffold/docs/governance/scaffold-boundary-contract.md +161 -0
templates/_base/scaffold/docs/governance/task-lifecycle.md +125 -0
templates/_base/scaffold/docs/governance/wrapper-derivation.md +50 -0
templates/_base/scaffold/docs/insights/00-index.md +17 -0
templates/_base/scaffold/docs/ops/00-index.md +59 -0
templates/_base/scaffold/docs/ops/runbooks/00-index.md +9 -0
templates/_base/scaffold/docs/playbooks/00-index.md +12 -0
templates/_base/scaffold/docs/playbooks/research-validation.md +29 -0
templates/_base/scaffold/docs/playbooks/security-review.md +41 -0
templates/_base/scaffold/docs/prd/00-index.md +43 -0
templates/_base/scaffold/docs/prd/01-snapshot-vision.md +56 -0
templates/_base/scaffold/docs/workflow/workflow-guide.md +138 -0
templates/_base/scaffold/src/shared/README.md +23 -0
templates/_base/skill-enforcement.template.md +14 -0
templates/_base/task-detail.template.md +61 -0
templates/_presets/ai-saas.yaml +9 -0
templates/_presets/django-next.yaml +8 -0
templates/_presets/dotnet-react.yaml +8 -0
templates/_presets/flutter-baas.yaml +8 -0
templates/_presets/go-react.yaml +8 -0
templates/_presets/hexagonal-product.yaml +16 -0
templates/_presets/jamstack.yaml +8 -0
templates/_presets/laravel-vue.yaml +8 -0
templates/_presets/mean.yaml +8 -0
templates/_presets/mern.yaml +9 -0
templates/_presets/nest-angular.yaml +8 -0
templates/_presets/nextjs-fastapi.yaml +10 -0
templates/_presets/nuxt-fullstack.yaml +9 -0
templates/_presets/pern.yaml +9 -0
templates/_presets/rails-react.yaml +8 -0
templates/_presets/rn-api.yaml +8 -0
templates/_presets/rust-svelte.yaml +8 -0
templates/_presets/spring-react.yaml +8 -0
templates/_presets/t3-style.yaml +9 -0
templates/_presets/tall.yaml +8 -0
templates/_presets/wordpress-cms.yaml +8 -0
templates/angular/rules/frontend.md +19 -0
templates/angular/scaffold/docs/engineering/accessibility.md +46 -0
templates/angular/scaffold/docs/engineering/angular-rules.md +35 -0
templates/angular/scaffold/docs/playbooks/angular-app.md +42 -0
templates/angular/scaffold/src/frontend/angular.json +52 -0
templates/angular/scaffold/src/frontend/package.json +28 -0
templates/angular/scaffold/src/frontend/src/app/app.component.ts +19 -0
templates/angular/scaffold/src/frontend/src/app/app.config.ts +22 -0
templates/angular/scaffold/src/frontend/src/app/app.routes.ts +8 -0
templates/angular/scaffold/src/frontend/src/app/core/global-error-handler.ts +12 -0
templates/angular/scaffold/src/frontend/src/app/health/health.component.ts +14 -0
templates/angular/scaffold/src/frontend/src/app/health/health.service.spec.ts +16 -0
templates/angular/scaffold/src/frontend/src/app/health/health.service.ts +10 -0
templates/angular/scaffold/src/frontend/src/index.html +11 -0
templates/angular/scaffold/src/frontend/src/main.ts +9 -0
templates/angular/scaffold/src/frontend/src/styles.css +14 -0
templates/angular/scaffold/src/frontend/tsconfig.app.json +8 -0
templates/angular/scaffold/src/frontend/tsconfig.json +27 -0
templates/angular/scaffold/src/frontend/tsconfig.spec.json +8 -0
templates/angular/scaffold-boundary.yaml +27 -0
templates/angular/skills/angular/SKILL.md +79 -0
templates/angular/skills/angular/references/anatomy.md +69 -0
templates/angular/stack.yaml +75 -0
templates/aspnet-core/rules/backend.md +20 -0
templates/aspnet-core/scaffold/docs/engineering/aspnet-core-rules.md +36 -0
templates/aspnet-core/scaffold/docs/playbooks/aspnet-core-service.md +40 -0
templates/aspnet-core/scaffold/src/backend/Backend.csproj +11 -0
templates/aspnet-core/scaffold/src/backend/Backend.sln +27 -0
templates/aspnet-core/scaffold/src/backend/Common/ExceptionHandlingMiddleware.cs +35 -0
templates/aspnet-core/scaffold/src/backend/Features/Health/HealthEndpoints.cs +10 -0
templates/aspnet-core/scaffold/src/backend/Features/Health/HealthService.cs +9 -0
templates/aspnet-core/scaffold/src/backend/Program.cs +22 -0
templates/aspnet-core/scaffold/src/backend/tests/Backend.Tests/Backend.Tests.csproj +22 -0
templates/aspnet-core/scaffold/src/backend/tests/Backend.Tests/HealthServiceTests.cs +15 -0
templates/aspnet-core/scaffold-boundary.yaml +24 -0
templates/aspnet-core/skills/aspnet-core/SKILL.md +80 -0
templates/aspnet-core/skills/aspnet-core/references/anatomy.md +65 -0
templates/aspnet-core/stack.yaml +68 -0
templates/astro/rules/frontend.md +20 -0
templates/astro/scaffold/docs/engineering/astro-rules.md +40 -0
templates/astro/scaffold/docs/playbooks/astro-app.md +57 -0
templates/astro/scaffold/docs/playbooks/content-seo.md +37 -0
templates/astro/scaffold/src/frontend/astro.config.mjs +10 -0
templates/astro/scaffold/src/frontend/package.json +23 -0
templates/astro/scaffold/src/frontend/src/components/Greeting.astro +13 -0
templates/astro/scaffold/src/frontend/src/content/posts/hello.md +10 -0
templates/astro/scaffold/src/frontend/src/content.config.ts +19 -0
templates/astro/scaffold/src/frontend/src/lib/problem.test.ts +39 -0
templates/astro/scaffold/src/frontend/src/lib/problem.ts +30 -0
templates/astro/scaffold/src/frontend/src/pages/api/health.ts +13 -0
templates/astro/scaffold/src/frontend/src/pages/index.astro +21 -0
templates/astro/scaffold/src/frontend/tsconfig.json +9 -0
templates/astro/scaffold/src/frontend/vitest.config.ts +10 -0
templates/astro/scaffold-boundary.yaml +28 -0
templates/astro/skills/astro/SKILL.md +71 -0
templates/astro/skills/astro/references/anatomy.md +66 -0
templates/astro/stack.yaml +75 -0
templates/csharp-plain/scaffold/src/backend/Backend.csproj +12 -0
templates/csharp-plain/scaffold/src/backend/Program.cs +1 -0
templates/csharp-plain/scaffold-boundary.yaml +23 -0
templates/csharp-plain/stack.yaml +50 -0
templates/django/rules/backend.md +18 -0
templates/django/scaffold/docs/engineering/anti-ambiguity.md +74 -0
templates/django/scaffold/docs/engineering/backend-rules.md +133 -0
templates/django/scaffold/docs/engineering/glossary.md +51 -0
templates/django/scaffold/docs/engineering/logging-standards.md +107 -0
templates/django/scaffold/docs/engineering/naming-conventions.md +68 -0
templates/django/scaffold/docs/engineering/secrets-rotation-runbook.md +142 -0
templates/django/scaffold/docs/playbooks/backend-api.md +119 -0
templates/django/scaffold/src/backend/config/__init__.py +0 -0
templates/django/scaffold/src/backend/config/settings.py +31 -0
templates/django/scaffold/src/backend/config/urls.py +11 -0
templates/django/scaffold/src/backend/config/wsgi.py +6 -0
templates/django/scaffold/src/backend/manage.py +14 -0
templates/django/scaffold/src/backend/pyproject.toml +37 -0
templates/django/scaffold/src/backend/tests/test_health.py +4 -0
templates/django/scaffold-boundary.yaml +25 -0
templates/django/skills/python-django/SKILL.md +450 -0
templates/django/skills/python-django/references/anatomy.md +117 -0
templates/django/skills/python-django/scripts/new_endpoint.py +89 -0
templates/django/stack.yaml +73 -0
templates/fastapi/rules/backend.md +18 -0
templates/fastapi/scaffold/docs/engineering/fastapi-rules.md +37 -0
templates/fastapi/scaffold/docs/playbooks/fastapi-service.md +30 -0
templates/fastapi/scaffold/src/backend/app/__init__.py +0 -0
templates/fastapi/scaffold/src/backend/app/main.py +8 -0
templates/fastapi/scaffold/src/backend/pyproject.toml +39 -0
templates/fastapi/scaffold/src/backend/tests/test_health.py +11 -0
templates/fastapi/scaffold-boundary.yaml +25 -0
templates/fastapi/skills/python-fastapi/SKILL.md +75 -0
templates/fastapi/skills/python-fastapi/references/anatomy.md +117 -0
templates/fastapi/skills/python-fastapi/scripts/new_endpoint.py +101 -0
templates/fastapi/stack.yaml +57 -0
templates/flutter/rules/mobile.md +26 -0
templates/flutter/scaffold/docs/engineering/flutter-rules.md +35 -0
templates/flutter/scaffold/docs/playbooks/flutter-app.md +45 -0
templates/flutter/scaffold/src/mobile/lib/core/error_mapper.dart +17 -0
templates/flutter/scaffold/src/mobile/lib/core/router.dart +13 -0
templates/flutter/scaffold/src/mobile/lib/main.dart +22 -0
templates/flutter/scaffold/src/mobile/lib/screens/health_screen.dart +32 -0
templates/flutter/scaffold/src/mobile/lib/services/health_service.dart +11 -0
templates/flutter/scaffold/src/mobile/lib/state/health_provider.dart +13 -0
templates/flutter/scaffold/src/mobile/pubspec.yaml +22 -0
templates/flutter/scaffold/src/mobile/test/health_provider_test.dart +90 -0
templates/flutter/scaffold-boundary.yaml +28 -0
templates/flutter/skills/flutter/SKILL.md +76 -0
templates/flutter/skills/flutter/references/anatomy.md +64 -0
templates/flutter/stack.yaml +70 -0
templates/go/rules/backend.md +19 -0
templates/go/scaffold/docs/engineering/go-rules.md +45 -0
templates/go/scaffold/docs/playbooks/go-service.md +30 -0
templates/go/scaffold/src/backend/cmd/api/main.go +22 -0
templates/go/scaffold/src/backend/cmd/api/main_test.go +20 -0
templates/go/scaffold/src/backend/go.mod +3 -0
templates/go/scaffold-boundary.yaml +25 -0
templates/go/skills/go-patterns/SKILL.md +68 -0
templates/go/skills/go-patterns/assets/go-checklist.md +29 -0
templates/go/skills/go-patterns/references/anatomy.md +115 -0
templates/go/skills/go-patterns/references/go-2026-idioms.md +92 -0
templates/go/skills/go-patterns/scripts/new_endpoint.py +117 -0
templates/go/skills/go-patterns/versions.json +16 -0
templates/go/stack.yaml +54 -0
templates/go-fiber/rules/backend.md +20 -0
templates/go-fiber/scaffold/docs/engineering/fiber-rules.md +97 -0
templates/go-fiber/scaffold/docs/playbooks/fiber-service.md +149 -0
templates/go-fiber/scaffold/src/backend/cmd/api/main.go +21 -0
templates/go-fiber/scaffold/src/backend/cmd/api/main_test.go +17 -0
templates/go-fiber/scaffold/src/backend/go.mod +23 -0
templates/go-fiber/scaffold/src/backend/go.sum +49 -0
templates/go-fiber/scaffold-boundary.yaml +26 -0
templates/go-fiber/skills/go-fiber/SKILL.md +203 -0
templates/go-fiber/skills/go-fiber/assets/fiber-checklist.md +26 -0
templates/go-fiber/skills/go-fiber/references/anatomy.md +116 -0
templates/go-fiber/skills/go-fiber/references/fiber-v3-patterns.md +89 -0
templates/go-fiber/skills/go-fiber/scripts/new_endpoint.py +107 -0
templates/go-fiber/skills/go-fiber/versions.json +16 -0
templates/go-fiber/stack.yaml +59 -0
templates/go-plain/scaffold/src/backend/go.mod +3 -0
templates/go-plain/scaffold/src/backend/main.go +7 -0
templates/go-plain/scaffold-boundary.yaml +22 -0
templates/go-plain/stack.yaml +51 -0
templates/java-plain/scaffold/src/backend/mvnw +302 -0
templates/java-plain/scaffold/src/backend/pom.xml +41 -0
templates/java-plain/scaffold/src/backend/src/main/java/com/example/app/Main.java +10 -0
templates/java-plain/scaffold-boundary.yaml +23 -0
templates/java-plain/stack.yaml +51 -0
templates/laravel/rules/backend.md +20 -0
templates/laravel/scaffold/docs/engineering/laravel-rules.md +28 -0
templates/laravel/scaffold/docs/playbooks/laravel-service.md +28 -0
templates/laravel/scaffold/src/backend/app/Exceptions/Handler.php +27 -0
templates/laravel/scaffold/src/backend/app/Http/Controllers/HealthController.php +15 -0
templates/laravel/scaffold/src/backend/app/Support/HealthStatus.php +14 -0
templates/laravel/scaffold/src/backend/composer.json +24 -0
templates/laravel/scaffold/src/backend/phpunit.xml +10 -0
templates/laravel/scaffold/src/backend/public/index.php +8 -0
templates/laravel/scaffold/src/backend/routes/api.php +7 -0
templates/laravel/scaffold/src/backend/tests/Unit/HealthStatusTest.php +16 -0
templates/laravel/scaffold-boundary.yaml +23 -0
templates/laravel/skills/laravel/SKILL.md +56 -0
templates/laravel/skills/laravel/references/anatomy.md +65 -0
templates/laravel/stack.yaml +66 -0
templates/meta/rules/graph-first.md +27 -0
templates/meta/rules/hook-author.md +19 -0
templates/meta/rules/mcp-tool-author.md +18 -0
templates/meta/rules/meta-engineering.md +17 -0
templates/meta/scaffold-boundary.yaml +55 -0
templates/meta/skills/claude-sdk-integration/SKILL.md +163 -0
templates/meta/skills/claude-sdk-integration/assets/sdk-checklist.md +27 -0
templates/meta/skills/claude-sdk-integration/scripts/check_model_ids.py +97 -0
templates/meta/skills/graph-os-authoring/SKILL.md +278 -0
templates/meta/skills/graph-os-authoring/assets/graph-os-checklist.md +25 -0
templates/meta/skills/graph-os-authoring/scripts/new_extractor.py +76 -0
templates/meta/skills/hook-authoring/SKILL.md +292 -0
templates/meta/skills/hook-authoring/assets/hook-checklist.md +30 -0
templates/meta/skills/hook-authoring/scripts/new_hook.sh +75 -0
templates/meta/skills/mcp-tool-authoring/SKILL.md +301 -0
templates/meta/skills/mcp-tool-authoring/assets/mcp-tool-checklist.md +29 -0
templates/meta/skills/mcp-tool-authoring/scripts/new_tool.py +74 -0
templates/meta/skills/meta-engineering/SKILL.md +151 -0
templates/meta/skills/meta-engineering/assets/meta-edit-checklist.md +28 -0
templates/meta/skills/meta-engineering/scripts/which_layer.py +61 -0
templates/meta/skills/python-meta-server/SKILL.md +162 -0
templates/meta/skills/python-meta-server/assets/meta-server-checklist.md +28 -0
templates/meta/skills/python-meta-server/scripts/check_envelope.py +91 -0
templates/meta/skills/react-vite-hub/SKILL.md +140 -0
templates/meta/skills/react-vite-hub/assets/hub-ui-checklist.md +23 -0
templates/meta/skills/react-vite-hub/scripts/check_vite_env.py +73 -0
templates/meta/stack.yaml +119 -0
templates/nestjs/rules/backend.md +20 -0
templates/nestjs/scaffold/docs/engineering/nestjs-rules.md +33 -0
templates/nestjs/scaffold/docs/playbooks/nestjs-service.md +39 -0
templates/nestjs/scaffold/src/backend/nest-cli.json +5 -0
templates/nestjs/scaffold/src/backend/package.json +28 -0
templates/nestjs/scaffold/src/backend/src/app.module.ts +9 -0
templates/nestjs/scaffold/src/backend/src/common/all-exceptions.filter.ts +59 -0
templates/nestjs/scaffold/src/backend/src/health/health.controller.ts +14 -0
templates/nestjs/scaffold/src/backend/src/health/health.module.ts +10 -0
templates/nestjs/scaffold/src/backend/src/health/health.service.spec.ts +21 -0
templates/nestjs/scaffold/src/backend/src/health/health.service.ts +9 -0
templates/nestjs/scaffold/src/backend/src/main.ts +26 -0
templates/nestjs/scaffold/src/backend/tsconfig.json +16 -0
templates/nestjs/scaffold/src/backend/vitest.config.ts +9 -0
templates/nestjs/scaffold-boundary.yaml +25 -0
templates/nestjs/skills/nestjs/SKILL.md +67 -0
templates/nestjs/skills/nestjs/references/anatomy.md +65 -0
templates/nestjs/stack.yaml +68 -0
templates/nextjs/rules/frontend.md +18 -0
templates/nextjs/scaffold/docs/design/00-index.md +23 -0
templates/nextjs/scaffold/docs/design/colors-tokens.md +141 -0
templates/nextjs/scaffold/docs/design/components-patterns.md +159 -0
templates/nextjs/scaffold/docs/design/motion-accessibility.md +137 -0
templates/nextjs/scaffold/docs/design/typography-spacing.md +107 -0
templates/nextjs/scaffold/docs/engineering/accessibility-web.md +56 -0
templates/nextjs/scaffold/docs/engineering/copywriting-standard.md +102 -0
templates/nextjs/scaffold/docs/engineering/formatting-rules.md +89 -0
templates/nextjs/scaffold/docs/engineering/frontend-rendering-rules.md +80 -0
templates/nextjs/scaffold/docs/engineering/frontend-rules.md +183 -0
templates/nextjs/scaffold/docs/engineering/i18n-policy.md +99 -0
templates/nextjs/scaffold/docs/pages-content-spec/00-index.md +78 -0
templates/nextjs/scaffold/docs/playbooks/content-seo.md +55 -0
templates/nextjs/scaffold/docs/playbooks/docs-governance.md +51 -0
templates/nextjs/scaffold/docs/playbooks/frontend-ui.md +63 -0
templates/nextjs/scaffold/src/frontend/app/layout.tsx +14 -0
templates/nextjs/scaffold/src/frontend/app/page.tsx +3 -0
templates/nextjs/scaffold/src/frontend/eslint.config.js +17 -0
templates/nextjs/scaffold/src/frontend/lib/greeting.test.ts +9 -0
templates/nextjs/scaffold/src/frontend/lib/greeting.ts +3 -0
templates/nextjs/scaffold/src/frontend/package.json +28 -0
templates/nextjs/scaffold/src/frontend/tsconfig.json +18 -0
templates/nextjs/scaffold/src/frontend/vitest.config.ts +10 -0
templates/nextjs/scaffold-boundary.yaml +30 -0
templates/nextjs/skills/nextjs-react/SKILL.md +485 -0
templates/nextjs/skills/nextjs-react/references/anatomy.md +116 -0
templates/nextjs/skills/nextjs-react/scripts/new_component.py +72 -0
templates/nextjs/stack.yaml +81 -0
templates/node-express/rules/backend.md +20 -0
templates/node-express/scaffold/docs/engineering/express-rules.md +30 -0
templates/node-express/scaffold/docs/playbooks/express-service.md +35 -0
templates/node-express/scaffold/src/backend/package.json +24 -0
templates/node-express/scaffold/src/backend/src/index.ts +17 -0
templates/node-express/scaffold/src/backend/src/middleware/error-handler.ts +12 -0
templates/node-express/scaffold/src/backend/src/routes/health.test.ts +33 -0
templates/node-express/scaffold/src/backend/src/routes/health.ts +7 -0
templates/node-express/scaffold/src/backend/tsconfig.json +15 -0
templates/node-express/scaffold/src/backend/types/express-bootstrap.d.ts +21 -0
templates/node-express/scaffold-boundary.yaml +25 -0
templates/node-express/skills/node-express/SKILL.md +70 -0
templates/node-express/skills/node-express/references/anatomy.md +63 -0
templates/node-express/stack.yaml +63 -0
templates/python/scaffold/docs/engineering/python-rules.md +27 -0
templates/python/scaffold/docs/playbooks/python-library.md +35 -0
templates/python/stack.yaml +60 -0
templates/rails/rules/backend.md +10 -0
templates/rails/scaffold/docs/engineering/rails-rules.md +33 -0
templates/rails/scaffold/docs/playbooks/rails-service.md +42 -0
templates/rails/scaffold/src/backend/Gemfile +12 -0
templates/rails/scaffold/src/backend/app/controllers/application_controller.rb +26 -0
templates/rails/scaffold/src/backend/app/controllers/health_controller.rb +6 -0
templates/rails/scaffold/src/backend/app/models/health.rb +6 -0
templates/rails/scaffold/src/backend/config/application.rb +12 -0
templates/rails/scaffold/src/backend/config/boot.rb +3 -0
templates/rails/scaffold/src/backend/config/routes.rb +4 -0
templates/rails/scaffold/src/backend/config.ru +5 -0
templates/rails/scaffold/src/backend/spec/rails_helper.rb +18 -0
templates/rails/scaffold/src/backend/spec/requests/health_spec.rb +24 -0
templates/rails/scaffold-boundary.yaml +25 -0
templates/rails/skills/rails/SKILL.md +62 -0
templates/rails/skills/rails/references/anatomy.md +71 -0
templates/rails/stack.yaml +72 -0
templates/react-native/rules/mobile.md +26 -0
templates/react-native/scaffold/docs/engineering/accessibility-mobile.md +95 -0
templates/react-native/scaffold/docs/engineering/mobile-rules.md +56 -0
templates/react-native/scaffold/docs/engineering/offline-first.md +61 -0
templates/react-native/scaffold/docs/playbooks/mobile-app.md +49 -0
templates/react-native/scaffold/src/mobile/App.tsx +9 -0
templates/react-native/scaffold/src/mobile/eslint.config.js +17 -0
templates/react-native/scaffold/src/mobile/package.json +23 -0
templates/react-native/scaffold/src/mobile/src/greeting.test.ts +9 -0
templates/react-native/scaffold/src/mobile/src/greeting.ts +3 -0
templates/react-native/scaffold/src/mobile/tsconfig.json +17 -0
templates/react-native/scaffold/src/mobile/vitest.config.ts +10 -0
templates/react-native/scaffold-boundary.yaml +30 -0
templates/react-native/skills/react-native-mobile/SKILL.md +119 -0
templates/react-native/skills/react-native-mobile/assets/rn-mobile-checklist.md +28 -0
templates/react-native/skills/react-native-mobile/references/anatomy.md +140 -0
templates/react-native/skills/react-native-mobile/references/rn-2026-practices.md +54 -0
templates/react-native/skills/react-native-mobile/scripts/new_screen.py +73 -0
templates/react-native/skills/react-native-mobile/versions.json +16 -0
templates/react-native/skills/react-native-patterns/SKILL.md +512 -0
templates/react-native/skills/react-native-patterns/assets/rn-review-checklist.md +26 -0
templates/react-native/skills/react-native-patterns/references/anatomy.md +62 -0
templates/react-native/skills/react-native-patterns/references/list-performance.md +70 -0
templates/react-native/skills/react-native-patterns/scripts/scan_rn_perf.py +77 -0
templates/react-native/stack.yaml +70 -0
templates/ruby-plain/scaffold/src/backend/Gemfile +8 -0
templates/ruby-plain/scaffold/src/backend/main.rb +3 -0
templates/ruby-plain/scaffold-boundary.yaml +23 -0
templates/ruby-plain/stack.yaml +50 -0
templates/rust-axum/rules/backend.md +20 -0
templates/rust-axum/scaffold/docs/engineering/rust-axum-rules.md +35 -0
templates/rust-axum/scaffold/docs/playbooks/rust-axum-service.md +43 -0
templates/rust-axum/scaffold/src/backend/Cargo.toml +20 -0
templates/rust-axum/scaffold/src/backend/src/app.rs +12 -0
templates/rust-axum/scaffold/src/backend/src/error.rs +48 -0
templates/rust-axum/scaffold/src/backend/src/main.rs +24 -0
templates/rust-axum/scaffold/src/backend/src/routes/health.rs +37 -0
templates/rust-axum/scaffold/src/backend/src/routes/mod.rs +2 -0
templates/rust-axum/scaffold-boundary.yaml +25 -0
templates/rust-axum/skills/rust/SKILL.md +73 -0
templates/rust-axum/skills/rust/references/anatomy.md +63 -0
templates/rust-axum/stack.yaml +65 -0
templates/rust-plain/scaffold/src/backend/Cargo.toml +6 -0
templates/rust-plain/scaffold/src/backend/src/main.rs +3 -0
templates/rust-plain/scaffold-boundary.yaml +23 -0
templates/rust-plain/stack.yaml +51 -0
templates/spring-boot/rules/backend.md +20 -0
templates/spring-boot/scaffold/docs/engineering/spring-boot-rules.md +35 -0
templates/spring-boot/scaffold/docs/playbooks/spring-boot-service.md +45 -0
templates/spring-boot/scaffold/src/backend/mvnw +302 -0
templates/spring-boot/scaffold/src/backend/pom.xml +69 -0
templates/spring-boot/scaffold/src/backend/src/main/java/com/example/app/Application.java +16 -0
templates/spring-boot/scaffold/src/backend/src/main/java/com/example/app/common/GlobalExceptionHandler.java +31 -0
templates/spring-boot/scaffold/src/backend/src/main/java/com/example/app/health/HealthController.java +22 -0
templates/spring-boot/scaffold/src/backend/src/main/java/com/example/app/health/HealthService.java +12 -0
templates/spring-boot/scaffold/src/backend/src/main/java/com/example/app/health/HealthStatus.java +4 -0
templates/spring-boot/scaffold/src/backend/src/test/java/com/example/app/health/HealthServiceTest.java +15 -0
templates/spring-boot/scaffold-boundary.yaml +26 -0
templates/spring-boot/skills/spring-boot/SKILL.md +84 -0
templates/spring-boot/skills/spring-boot/references/anatomy.md +63 -0
templates/spring-boot/stack.yaml +65 -0
templates/svelte-sveltekit/rules/frontend.md +20 -0
templates/svelte-sveltekit/scaffold/docs/engineering/svelte-sveltekit-rules.md +37 -0
templates/svelte-sveltekit/scaffold/docs/playbooks/svelte-sveltekit-app.md +36 -0
templates/svelte-sveltekit/scaffold/src/frontend/package.json +22 -0
templates/svelte-sveltekit/scaffold/src/frontend/src/app.html +12 -0
templates/svelte-sveltekit/scaffold/src/frontend/src/hooks.server.ts +14 -0
templates/svelte-sveltekit/scaffold/src/frontend/src/lib/components/Greeting.svelte +6 -0
templates/svelte-sveltekit/scaffold/src/frontend/src/lib/stores/count.test.ts +26 -0
templates/svelte-sveltekit/scaffold/src/frontend/src/lib/stores/count.ts +4 -0
templates/svelte-sveltekit/scaffold/src/frontend/src/routes/+layout.svelte +24 -0
templates/svelte-sveltekit/scaffold/src/frontend/src/routes/+page.svelte +9 -0
templates/svelte-sveltekit/scaffold/src/frontend/src/routes/+page.ts +7 -0
templates/svelte-sveltekit/scaffold/src/frontend/src/routes/health/+server.ts +7 -0
templates/svelte-sveltekit/scaffold/src/frontend/svelte.config.js +10 -0
templates/svelte-sveltekit/scaffold/src/frontend/tsconfig.json +7 -0
templates/svelte-sveltekit/scaffold/src/frontend/vite.config.ts +7 -0
templates/svelte-sveltekit/scaffold/src/frontend/vitest.config.ts +11 -0
templates/svelte-sveltekit/scaffold-boundary.yaml +29 -0
templates/svelte-sveltekit/skills/svelte/SKILL.md +90 -0
templates/svelte-sveltekit/skills/svelte/references/anatomy.md +62 -0
templates/svelte-sveltekit/stack.yaml +70 -0
templates/typescript-plain/scaffold/src/index.ts +3 -0
templates/typescript-plain/scaffold/tsconfig.json +13 -0
templates/typescript-plain/scaffold-boundary.yaml +22 -0
templates/typescript-plain/stack.yaml +44 -0
templates/vue-nuxt/rules/frontend.md +19 -0
templates/vue-nuxt/scaffold/docs/engineering/nuxt-rules.md +30 -0
templates/vue-nuxt/scaffold/docs/playbooks/nuxt-app.md +29 -0
templates/vue-nuxt/scaffold/src/frontend/app.vue +3 -0
templates/vue-nuxt/scaffold/src/frontend/nuxt.config.ts +11 -0
templates/vue-nuxt/scaffold/src/frontend/package.json +20 -0
templates/vue-nuxt/scaffold/src/frontend/pages/index.test.ts +19 -0
templates/vue-nuxt/scaffold/src/frontend/pages/index.vue +11 -0
templates/vue-nuxt/scaffold/src/frontend/vitest.config.ts +12 -0
templates/vue-nuxt/scaffold-boundary.yaml +26 -0
templates/vue-nuxt/skills/vue-nuxt/SKILL.md +57 -0
templates/vue-nuxt/skills/vue-nuxt/references/anatomy.md +60 -0
templates/vue-nuxt/stack.yaml +61 -0
templates/wordpress/rules/backend.md +19 -0
templates/wordpress/scaffold/docs/engineering/wordpress-rules.md +28 -0
templates/wordpress/scaffold/docs/playbooks/wordpress-service.md +29 -0
templates/wordpress/scaffold/src/backend/composer.json +17 -0
templates/wordpress/scaffold/src/backend/phpcs.xml.dist +11 -0
templates/wordpress/scaffold/src/backend/phpunit.xml +10 -0
templates/wordpress/scaffold/src/backend/plugin/inc/health.php +8 -0
templates/wordpress/scaffold/src/backend/plugin/plugin.php +28 -0
templates/wordpress/scaffold/src/backend/tests/HealthStatusTest.php +15 -0
templates/wordpress/scaffold/src/backend/theme/functions.php +18 -0
templates/wordpress/scaffold/src/backend/theme/style.css +11 -0
templates/wordpress/scaffold-boundary.yaml +23 -0
templates/wordpress/skills/wordpress/SKILL.md +110 -0
templates/wordpress/skills/wordpress/assets/wp-checklist.md +28 -0
templates/wordpress/skills/wordpress/references/wp-development.md +75 -0
templates/wordpress/skills/wordpress/references/wp-security.md +68 -0
templates/wordpress/skills/wordpress/scripts/scan_wp_smells.py +91 -0
templates/wordpress/skills/wordpress/versions.json +16 -0
templates/wordpress/stack.yaml +60 -0
thinking_os/__init__.py +1 -0
thinking_os/_agent_markers.py +32 -0
thinking_os/background.py +405 -0
thinking_os/bootstrap_outcomes.py +200 -0
thinking_os/budget.py +302 -0
thinking_os/capture.py +495 -0
thinking_os/cognition.py +516 -0
thinking_os/cognition_schemas.py +517 -0
thinking_os/compress.py +192 -0
thinking_os/concepts.py +233 -0
thinking_os/dashboard.py +159 -0
thinking_os/database.py +2883 -0
thinking_os/decay.py +393 -0
thinking_os/digest.py +295 -0
thinking_os/dispatcher.py +192 -0
thinking_os/dispatcher_helpers.py +48 -0
thinking_os/dispatchers/__init__.py +3 -0
thinking_os/dispatchers/default.py +47 -0
thinking_os/distill.py +192 -0
thinking_os/doc_indexer.py +905 -0
thinking_os/embeddings.py +943 -0
thinking_os/formula_composer.py +556 -0
thinking_os/gate_marker.py +75 -0
thinking_os/graph.py +296 -0
thinking_os/graph_indexer.py +360 -0
thinking_os/health_check.py +517 -0
thinking_os/impact.py +119 -0
thinking_os/memory_gc.py +356 -0
thinking_os/migrator_embeddings.py +318 -0
thinking_os/precision.py +194 -0
thinking_os/record_outcome.py +399 -0
thinking_os/repair.py +105 -0
thinking_os/retrieval_quality.py +239 -0
thinking_os/roles_state.py +168 -0
thinking_os/sanitizer.py +320 -0
thinking_os/server.py +3160 -0
thinking_os/session_enrich.py +272 -0
thinking_os/session_observe_worker.py +111 -0
thinking_os/session_startup.py +74 -0
thinking_os/session_summary.py +245 -0
thinking_os/task_analyzer.py +462 -0
thinking_os/task_parser.py +342 -0
thinking_os/task_sync.py +73 -0
thinking_os/tools/__init__.py +6 -0
thinking_os/tools/_shared.py +947 -0
thinking_os/tools/cognition.py +1867 -0
thinking_os/tools/docs.py +770 -0
thinking_os/tools/learning.py +2078 -0
thinking_os/tools/logs.py +79 -0
thinking_os/tools/memory.py +840 -0
thinking_os/tools/metrics.py +200 -0
thinking_os/tools/retrieve.py +415 -0
thinking_os/tools/routing.py +658 -0
thinking_os/tools/tasks.py +449 -0
thinking_os/tools/trajectory.py +181 -0
thinking_os/tracing.py +235 -0
web/__init__.py +5 -0
web/_cache.py +118 -0
web/_deps.py +56 -0
web/_envelope.py +85 -0
web/_project_context.py +140 -0
web/chat_providers.py +108 -0
web/init_jobs.py +216 -0
web/routes/__init__.py +25 -0
web/routes/_bounded_read.py +76 -0
web/routes/board.py +1089 -0
web/routes/cognition.py +1838 -0
web/routes/config.py +635 -0
web/routes/graph.py +513 -0
web/routes/health.py +180 -0
web/routes/hooks.py +288 -0
web/routes/hub.py +1219 -0
web/routes/logs.py +374 -0
web/routes/metrics.py +43 -0
web/routes/observability.py +400 -0
web/routes/patterns.py +227 -0
web/routes/presence.py +609 -0
web/routes/roles.py +446 -0
web/routes/scheduled.py +261 -0
web/routes/search.py +238 -0
web/routes/sessions.py +220 -0
web/routes/settings.py +363 -0
web/routes/stream.py +547 -0
web/security.py +157 -0
web/server.py +283 -0

core/skills/performance/references/web-vitals.md ADDED Viewed

@@ -0,0 +1,209 @@
+# Web Vitals — Per-Metric Optimization
+The four metrics Google uses for ranking + user-experience scoring. Each has distinct optimizations; conflating them wastes effort.
+## LCP — Largest Contentful Paint
+When the largest above-fold element renders. Almost always a hero image or large headline.
+**Target**: ≤ 2.5s at the 75th percentile of users.
+### Find the LCP Element
+Chrome DevTools → Performance tab → "Web Vitals" lane → click the LCP marker → see the highlighted element.
+Or in code:
+```javascript
+import { onLCP } from 'web-vitals';
+onLCP((metric) => {
+  console.log('LCP element:', metric.entries[0]?.element);
+  console.log('LCP value:', metric.value);
+});
+```
+### Optimization Tactics (in order of impact)
+1. **Preload the LCP image**:
+   ```html
+   <link rel="preload" as="image" href="/hero.avif" fetchpriority="high">
+   ```
+2. **Set `fetchpriority="high"`** on the LCP `<img>`:
+   ```html
+   <img src="/hero.avif" fetchpriority="high" alt="Hero" />
+   ```
+3. **Don't lazy-load the LCP image** — it's above the fold; serve immediately.
+4. **Compress + modern format** — AVIF / WebP, `srcset` for resolution.
+5. **Self-host critical fonts** + preload — text-LCP blocked on font.
+6. **Reduce render-blocking JS** — every blocking script delays the first paint.
+7. **Server response time (TTFB) < 800ms** — LCP is bounded by TTFB + render time.
+8. **Use a CDN** for static assets — cuts download time.
+9. **Inline critical CSS** for the above-fold; defer the rest.
+### Common LCP Killers
+- 4MB hero image, no compression.
+- Blocking third-party script (cookie banner, A/B test) loaded synchronously in `<head>`.
+- Server response > 1s due to slow query.
+- `font-display: block` or no `font-display` (default = block).
+- LCP image inside a JS-rendered component (delays until React hydrates).
+## INP — Interaction to Next Paint
+Replaced FID in March 2024. Measures the worst input latency in the session — click, tap, key press.
+**Target**: ≤ 200ms.
+### How It's Measured
+Browser tracks every interaction's latency from input event to next paint. INP = the worst (or 98th percentile for sessions with many interactions).
+### Optimization Tactics
+1. **Break up long tasks** (> 50ms) — scheduler.yield() or `setTimeout(...)`:
+   ```javascript
+   async function processBigList(items) {
+     for (const item of items) {
+       processItem(item);
+       if (typeof scheduler !== 'undefined' && scheduler.yield) {
+         await scheduler.yield();   // yield to browser between items
+       }
+     }
+   }
+   ```
+2. **Use `useDeferredValue` / `useTransition`** in React 18+ for low-priority updates that shouldn't block input.
+3. **Move heavy computation off the main thread** — Web Workers.
+4. **Avoid synchronous event handlers** that do too much. Defer non-critical work.
+5. **Audit third-party scripts** — they often hog the main thread (analytics, A/B test).
+6. **Avoid layout-thrashing reads/writes** in event handlers.
+7. **Reduce React re-render cost** — memoize, virtualize lists.
+### Profile with Chrome DevTools
+Performance tab → record while clicking the slow interaction → look for:
+- "Long Task" annotations in the Main thread track.
+- Interaction → "Pointer down" → "Click" markers — see the gap to "Paint".
+### Common INP Killers
+- Synchronous JSON parse / large array operations in click handler.
+- Re-render of a giant tree on every input change.
+- Blocking analytics on click.
+- Third-party scripts that yield the thread badly.
+## CLS — Cumulative Layout Shift
+Visual stability — how much elements move around as the page loads / interactions happen.
+**Target**: ≤ 0.1.
+### What Causes Shifts
+- Image without explicit dimensions → reflow when image loads.
+- Web font swap → reflow when font loads (`font-display: swap` is good but causes a small shift; that's OK).
+- Ads / embeds inserted dynamically without reserved space.
+- Cookie banner appearing and pushing content down.
+### Fix Tactics
+1. **`width` + `height` (or `aspect-ratio`)** on every image:
+   ```html
+   <img src="/hero.avif" width="1200" height="600" />
+   <!-- Browser reserves space; no shift on load. -->
+   ```
+   ```css
+   img { aspect-ratio: 2/1; }
+   ```
+2. **`min-height`** on containers that load async content (lists, embeds).
+3. **`size-adjust`, `ascent-override`** on `@font-face` to match fallback font metrics — minimizes swap shift.
+4. **Insert dynamic UI without pushing content** — overlay (modal / toast) instead of inline.
+5. **Skeleton loaders** that match the final content's dimensions.
+6. **Reserve space for ads** — fixed-size containers; no "shrink to fit" after ad loads.
+### Profile
+Lighthouse → "Avoid large layout shifts" → lists every shift with the element + visualizing the movement.
+### Common CLS Killers
+- Hero `<img>` without width/height.
+- Cookie banner appearing 2 seconds in, pushing content.
+- Auto-loading more items at the top of an infinite list.
+- Embedded YouTube / map iframe loaded without dimensions.
+## TTFB — Time to First Byte
+Server response time. Bound for LCP.
+**Target**: ≤ 800ms.
+### Optimization
+- **Cache hot endpoints** at the CDN.
+- **Optimize the slow query** (per `db-design`).
+- **Async I/O** done concurrently, not serially.
+- **Edge functions** for region-relevant content (Cloudflare Workers, Vercel Edge).
+- **Connection: keep-alive** + HTTP/2 / HTTP/3 — reduces handshake cost.
+- **Faster runtime** (V8/Hermes/Bun for JS, Pypy/Cython for hot Python paths).
+## INP-Specific React Patterns
+### useTransition for "stale OK" updates
+```typescript
+import { useTransition, useState } from 'react';
+const [isPending, startTransition] = useTransition();
+const [filter, setFilter] = useState('');
+const onChange = (e) => {
+  // High priority: update the input value.
+  setFilter(e.target.value);
+  // Low priority: filter the list — can be deferred.
+  startTransition(() => {
+    setFilteredList(computeFilteredList(e.target.value));
+  });
+};
+```
+### useDeferredValue for derived expensive UI
+```typescript
+const deferredQuery = useDeferredValue(query);
+const results = useMemo(() => searchHeavy(deferredQuery), [deferredQuery]);
+```
+### Memo + Virtual Lists
+For lists > 100 items, virtualize (`@tanstack/react-virtual`). Recycles DOM nodes; renders only visible.
+```typescript
+import { useVirtualizer } from '@tanstack/react-virtual';
+const rowVirtualizer = useVirtualizer({
+  count: items.length,
+  estimateSize: () => 48,
+  getScrollElement: () => parentRef.current,
+});
+// Render only rowVirtualizer.getVirtualItems().
+```
+## Tools
+| Tool | Use |
+|---|---|
+| **Lighthouse** (Chrome DevTools or `@lhci/cli`) | Per-page audit, CI integration |
+| **PageSpeed Insights** | Real-user CrUX data + lab Lighthouse |
+| **WebPageTest** | More detail than Lighthouse, real device options |
+| **Chrome DevTools Performance** | Frame-by-frame trace |
+| **`web-vitals` JS lib** | Real-user monitoring beacon |
+| **DebugBear / SpeedCurve** | Continuous monitoring + alerting |
+## Source Material
+- *web.dev — Core Web Vitals*: <https://web.dev/articles/vitals>
+- *web.dev — INP* (deep dive): <https://web.dev/articles/inp>
+- *web.dev — Optimize LCP*: <https://web.dev/articles/optimize-lcp>
+- *web.dev — Optimize CLS*: <https://web.dev/articles/optimize-cls>
+- *Smashing Magazine — Front-End Performance Checklist 2025*.
+- *Addy Osmani — Optimize INP* talks.

core/skills/php/SKILL.md ADDED Viewed

@@ -0,0 +1,116 @@
+---
+name: php
+tier: stack
+domain: [backend]
+description: Write modern, secure PHP 8.x — typed properties, enums, readonly, match, constructor promotion, PSR standards, Composer — and avoid the legacy footguns (SQL injection, XSS, unsafe deserialization, eval). Use when writing or reviewing PHP, modernizing a legacy codebase, setting up Composer/autoloading, hardening request handling, or escaping output. Targets PHP 8.3+ and PSR-12. Triggers — "PHP", "Composer", "Laravel", "WordPress plugin", "$_POST", "PDO", "this PHP is insecure", any `*.php`. Pairs with sql-authoring (parameterized queries), security-web (OWASP), wordpress (the CMS layer), api-design (the contract).
+globs: ""
+paths: []
+last_reviewed: "2026-06-04"
+versions_ref: versions.json
+---
+# Modern PHP
+PHP earned its insecure reputation from a decade of `mysql_query("...$_GET...")`. Modern PHP (8.3+) is a typed, fast, well-tooled language — the craft is using its type system and PDO, and never trusting `$_GET`/`$_POST`/`$_REQUEST` near a query, a shell, or output.
+> Scan PHP for the classic dangerous patterns:
+> `python3 scripts/scan_php_smells.py src/**/*.php`
+## Use the 8.x type system
+```php
+// Wrong — untyped, mutable, verbose, no guarantees
+class Money {
+  public $amount;
+  public $currency;
+  function __construct($amount, $currency) { $this->amount = $amount; $this->currency = $currency; }
+}
+// Correct — typed, readonly, promoted constructor params, enum
+enum Currency: string { case USD = 'USD'; case EUR = 'EUR'; }
+final class Money {
+  public function __construct(
+    public readonly int $amount,            // promoted + readonly = immutable
+    public readonly Currency $currency,
+  ) {}
+}
+```
+`declare(strict_types=1);` at the top of every file makes type declarations
+enforced, not coerced. Use `readonly` for value objects, `enum` for fixed sets,
+`match` (exhaustive, strict `===`) over `switch`, and union/nullable types. Detail
+→ [references/modern-php.md](references/modern-php.md).
+## Never build SQL from request data
+```php
+// Wrong — SQL injection, the canonical PHP breach
+$id = $_GET['id'];
+$db->query("SELECT * FROM users WHERE id = $id");
+// Correct — PDO prepared statement; the value never touches the SQL text
+$stmt = $pdo->prepare('SELECT * FROM users WHERE id = ?');
+$stmt->execute([$_GET['id']]);
+```
+Use PDO with prepared statements (or an ORM) for **every** query. The legacy
+`mysql_*` functions are removed; `mysqli` without bound params is the same hole.
+Query craft (parameterization, joins, plans) is owned by
+[sql-authoring](../sql-authoring/SKILL.md).
+## Escape on output, validate on input
+```php
+// Wrong — reflected XSS
+echo "<p>Hello {$_GET['name']}</p>";
+// Correct — escape for the output context
+echo '<p>Hello ' . htmlspecialchars($_GET['name'], ENT_QUOTES, 'UTF-8') . '</p>';
+```
+Validate + sanitize input at the boundary (`filter_input`, a validation library);
+escape at output for the **context** (`htmlspecialchars` for HTML, `json_encode`
+for JS, parameterized for SQL). Never `echo` raw request data. Server-side
+hardening is owned by [security-web](../security-web/SKILL.md).
+## Composer + autoloading + tooling
+```json
+{ "require": { "php": ">=8.3" },
+  "autoload": { "psr-4": { "App\\": "src/" } } }
+```
+PSR-4 autoloading via Composer (`composer dump-autoload`), never manual
+`require` chains. Run the toolchain: **PHPStan**/**Psalm** (static analysis at max
+level), **PHP-CS-Fixer** (PSR-12 formatting), **PHPUnit** (tests),
+**Rector** (automated upgrades). A modern PHP project is statically analyzed —
+treat PHPStan level 9 as the target.
+## The dangerous-function shortlist (never on user data)
+| Function | Risk | Instead |
+|---|---|---|
+| `eval()` | arbitrary code execution | redesign — almost never needed |
+| `extract($_POST)` | variable injection | read keys explicitly |
+| `system/exec/shell_exec/passthru` w/ input | command injection | `escapeshellarg`, or avoid the shell |
+| `unserialize()` on request data | object-injection RCE | `json_decode` |
+| `include`/`require` with a request path | local/remote file inclusion | an allow-list |
+| `md5`/`sha1` for passwords | trivially cracked | `password_hash()` (bcrypt/argon2) |
+## Anti-patterns (reject on sight)
+- Request data concatenated into a query / shell / `include` path.
+- `mysql_*` or unbound `mysqli` — use PDO prepared statements.
+- `echo`ing raw `$_GET`/`$_POST` without context escaping.
+- `==` where `===` is meant (loose comparison: `"0e1" == "0e2"` is true).
+- `eval` / `extract($_...)` / `unserialize($_...)` on user data.
+- No `declare(strict_types=1)` → types silently coerce.
+- `md5`/`sha1` for passwords → `password_hash`.
+## See also
+- [references/modern-php.md](references/modern-php.md) — 8.x features, PSR, Composer, the toolchain.
+- [references/security.md](references/security.md) — injection, XSS, deserialization, sessions, the dangerous functions.
+- [assets/php-checklist.md](assets/php-checklist.md) — the review gate.
+- [sql-authoring](../sql-authoring/SKILL.md) · [security-web](../security-web/SKILL.md) · [wordpress](../wordpress/SKILL.md).

core/skills/php/assets/php-checklist.md ADDED Viewed

@@ -0,0 +1,26 @@
+<!-- domain:BACKEND | layer:asset | ssot:false | updated:2026-06-04 -->
+# PHP Review Checklist
+Run before merging PHP.
+## Language
+- [ ] `declare(strict_types=1);` at the top of every file.
+- [ ] Types on every parameter, property, and return (no implicit `mixed`).
+- [ ] `readonly` value objects, `enum` for fixed sets, `match` over `switch`.
+- [ ] `===` not `==` (no loose comparison surprises).
+## Security
+- [ ] Every query is a PDO prepared statement (`ERRMODE_EXCEPTION`, `EMULATE_PREPARES=false`).
+- [ ] Output escaped for its context (`htmlspecialchars`/`json_encode`) or via an auto-escaping template.
+- [ ] No request data in `system/exec/include/require/unserialize/eval`.
+- [ ] Passwords via `password_hash`/`password_verify` — never `md5`/`sha1`.
+- [ ] Sessions: httponly + secure + samesite cookies; `session_regenerate_id` on privilege change.
+- [ ] CSRF token on state-changing forms.
+- [ ] `python3 scripts/scan_php_smells.py <files>` → `clean`.
+## Tooling
+- [ ] Composer PSR-4 autoload; `composer.lock` committed; CI uses `composer install`.
+- [ ] PHPStan/Psalm at max level — clean.
+- [ ] PHP-CS-Fixer (PSR-12) — formatted.
+- [ ] PHPUnit/Pest tests for the change.
+- [ ] `make skills-check-versions` — PHP version pin current.

core/skills/php/references/modern-php.md ADDED Viewed

@@ -0,0 +1,64 @@
+<!-- domain:BACKEND | layer:reference | ssot:true | updated:2026-06-04 -->
+# Modern PHP — 8.x Features, PSR, Tooling
+> P: The PHP 8.x language features and toolchain that make PHP a typed, safe, maintainable language.
+> R: Writing new PHP or modernizing legacy code.
+> S: Security footguns — see [security.md](security.md).
+> N: [SKILL.md](../SKILL.md), [php-checklist.md](../assets/php-checklist.md)
+> Nav: [Skill](../SKILL.md)
+## Always start strict
+```php
+<?php
+declare(strict_types=1);   // first line of EVERY file — enforces types, no coercion
+```
+Without it, `function f(int $x)` happily accepts `"5"` (coerced). With it, that's
+a `TypeError` — bugs surface at the boundary, not three layers deep.
+## The features that change how you write
+| Feature | Replaces | Example |
+|---|---|---|
+| constructor promotion | boilerplate assignments | `public function __construct(public readonly int $id) {}` |
+| `readonly` | manual immutability | `public readonly string $name;` |
+| `enum` | class constants / magic strings | `enum Status: string { case Active = 'active'; }` |
+| `match` | `switch` (no fallthrough, strict `===`, returns) | `$x = match($s) { 'a' => 1, default => 0 };` |
+| named args | positional-arg guessing | `new Money(amount: 100, currency: Currency::USD)` |
+| nullsafe `?->` | nested null checks | `$user?->address?->city` |
+| first-class callable | `Closure::fromCallable` | `$fn = strlen(...);` |
+| union/intersection types | `mixed` | `function f(int\|string $x): User&Loggable` |
+`match` is strict (`===`) and exhaustive (throws on no match) — prefer it to
+`switch` for value mapping. Enums make illegal states unrepresentable, like a
+discriminated union.
+## Composer & autoloading
+```json
+{
+  "require": { "php": ">=8.3" },
+  "require-dev": { "phpstan/phpstan": "^2", "friendsofphp/php-cs-fixer": "^3" },
+  "autoload": { "psr-4": { "App\\": "src/" } }
+}
+```
+PSR-4 maps a namespace prefix to a directory; `composer dump-autoload -o`
+generates an optimized classmap for production. Never hand-write `require`
+chains. Commit `composer.lock`; CI runs `composer install` (lockfile-exact), not
+`update`.
+## The toolchain (a modern project runs all of these in CI)
+| Tool | Job | Target |
+|---|---|---|
+| PHPStan / Psalm | static analysis | level 9 / errorLevel 1 |
+| PHP-CS-Fixer | formatting | PSR-12 |
+| PHPUnit / Pest | tests | the [testing-strategy](../../testing-strategy/SKILL.md) pyramid |
+| Rector | automated refactors / version upgrades | run on upgrade |
+PSR standards worth knowing: PSR-4 (autoloading), PSR-12 (style), PSR-7
+(HTTP messages), PSR-15 (middleware), PSR-3 (logging). Frameworks (Laravel,
+Symfony) build on these — learn the PSR, not just the framework helper.

core/skills/php/references/security.md ADDED Viewed

@@ -0,0 +1,72 @@
+<!-- domain:BACKEND | layer:reference | ssot:true | updated:2026-06-04 -->
+# PHP Security — Injection, XSS, Deserialization, Sessions
+> P: The PHP-specific exploit classes and the exact defensive idiom for each.
+> R: Handling any request data, output, file path, or session in PHP.
+> S: General server-side OWASP — that's [security-web](../../security-web/SKILL.md) (SSOT).
+> N: [SKILL.md](../SKILL.md), [modern-php.md](modern-php.md)
+> Nav: [Skill](../SKILL.md)
+The OWASP rules are owned by [security-web](../../security-web/SKILL.md); this is
+the PHP-syntax application of them.
+## SQL injection → PDO prepared statements
+```php
+$stmt = $pdo->prepare('SELECT * FROM users WHERE email = :email');
+$stmt->execute(['email' => $email]);
+$user = $stmt->fetch(PDO::FETCH_ASSOC);
+```
+Set `PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION` and
+`PDO::ATTR_EMULATE_PREPARES => false` so prepares are real (server-side), not
+string-built emulations.
+## XSS → escape for the output context
+| Context | Escape |
+|---|---|
+| HTML body | `htmlspecialchars($s, ENT_QUOTES, 'UTF-8')` |
+| HTML attribute | `htmlspecialchars` (with quotes) |
+| JavaScript | `json_encode($s, JSON_HEX_TAG \| JSON_HEX_AMP)` |
+| URL | `rawurlencode($s)` |
+A template engine (Twig, Blade) auto-escapes by default — prefer it to manual
+`echo`. Set a strict `Content-Security-Policy` header as defense-in-depth.
+## Command injection → avoid the shell, or escape
+```php
+// if you MUST shell out, escape each argument
+$out = shell_exec('convert ' . escapeshellarg($input) . ' out.png');
+```
+Better: use a library/extension instead of shelling out. Never pass request data
+to `system`/`exec`/`shell_exec`/`passthru`/`popen` unescaped.
+## Object injection → never unserialize request data
+`unserialize($_POST['x'])` lets an attacker instantiate arbitrary classes and
+trigger magic methods (`__wakeup`, `__destruct`) → RCE. Use `json_decode` for
+request data. If you must `unserialize`, pass `['allowed_classes' => false]`.
+## File inclusion → allow-list paths
+```php
+// Wrong — ?page=../../etc/passwd
+include $_GET['page'] . '.php';
+// Correct — map to a fixed allow-list
+$pages = ['home' => 'home.php', 'about' => 'about.php'];
+include $pages[$_GET['page']] ?? '404.php';
+```
+## Passwords & sessions
+- `password_hash($pw, PASSWORD_DEFAULT)` to store, `password_verify` to check —
+  never `md5`/`sha1`. `password_needs_rehash` on login to upgrade the cost.
+- Session cookies: `session.cookie_httponly=1`, `cookie_secure=1`,
+  `cookie_samesite=Lax`; `session_regenerate_id(true)` on privilege change to
+  stop fixation.
+- CSRF: a per-session token in every state-changing form, verified server-side.

core/skills/php/scripts/scan_php_smells.py ADDED Viewed

@@ -0,0 +1,99 @@
+"""Scan PHP source for classic dangerous patterns (injection, RCE, weak hash).
+PURPOSE:      Surface the high-risk PHP footguns in one pass so a reviewer reads
+              a short findings list instead of every file.
+INPUT:        one or more .php file paths. [--json]
+OUTPUT:       Findings (file:line) on stderr; "clean"/"N finding(s)" on stdout.
+              Exit 0 clean, 1 if findings, 2 usage.
+DEPENDENCIES: stdlib only. Static regex scan — no PHP runtime needed.
+NOTES:        Heuristic (regex, not a parser) — necessary not sufficient; pairs
+              with PHPStan/Psalm. Pure scan_text() is unit-testable.
+              Spec: docs/playbooks/skill-authoring.md; craft: ../SKILL.md.
+"""
+from __future__ import annotations
+import argparse
+import json
+import re
+import sys
+from pathlib import Path
+REQUEST = r"\$_(GET|POST|REQUEST|COOKIE)"
+# (compiled pattern, message) — each flags a high-risk construct.
+RULES: list[tuple[re.Pattern, str]] = [
+    (re.compile(r"\beval\s*\("), "eval() — arbitrary code execution"),
+    (re.compile(rf"\bextract\s*\(\s*{REQUEST}"), "extract() on request data — variable injection"),
+    (
+        re.compile(rf"\b(system|exec|shell_exec|passthru|popen)\s*\([^)]*{REQUEST}"),
+        "shell exec with request data — command injection",
+    ),
+    (
+        re.compile(rf"\bunserialize\s*\([^)]*{REQUEST}"),
+        "unserialize() on request data — object-injection RCE",
+    ),
+    (
+        re.compile(rf"\b(include|require)(_once)?\s*[^;]*{REQUEST}"),
+        "include/require with request path — file inclusion",
+    ),
+    (
+        re.compile(r"\bmysql_query\s*\("),
+        "mysql_query() — removed/legacy; use PDO prepared statements",
+    ),
+    (
+        re.compile(rf"->query\s*\([^)]*{REQUEST}"),
+        "request data concatenated into a query — SQL injection",
+    ),
+    (
+        re.compile(rf"\becho\s+[^;]*{REQUEST}[^;]*;"),
+        "echo of raw request data — XSS; escape with htmlspecialchars",
+    ),
+    (
+        re.compile(r"\b(md5|sha1)\s*\(\s*\$(pass|pwd|password)", re.IGNORECASE),
+        "md5/sha1 for a password — use password_hash()",
+    ),
+]
+STRICT_TYPES = re.compile(r"declare\s*\(\s*strict_types\s*=\s*1\s*\)")
+def scan_text(text: str, *, filename: str = "?") -> list[str]:
+    findings: list[str] = []
+    lines = text.splitlines()
+    for n, line in enumerate(lines, 1):
+        if line.lstrip().startswith(("//", "*", "#")):
+            continue
+        for pattern, msg in RULES:
+            if pattern.search(line):
+                findings.append(f"{filename}:{n}: {msg}")
+    if "<?php" in text and not STRICT_TYPES.search(text):
+        findings.append(f"{filename}: no declare(strict_types=1) — types coerce silently")
+    return findings
+def main(argv: list[str]) -> int:
+    parser = argparse.ArgumentParser(description=__doc__.split("\n")[0])
+    parser.add_argument("files", nargs="+")
+    parser.add_argument("--json", action="store_true", dest="as_json")
+    args = parser.parse_args(argv)
+    all_findings: list[str] = []
+    for path in args.files:
+        try:
+            all_findings.extend(scan_text(Path(path).read_text(encoding="utf-8"), filename=path))
+        except FileNotFoundError:
+            print(f"error: {path} not found", file=sys.stderr)
+            return 2
+    for f in all_findings:
+        print(f"  ✗ {f}", file=sys.stderr)
+    if args.as_json:
+        print(json.dumps({"findings": all_findings, "count": len(all_findings)}))
+    else:
+        print("clean" if not all_findings else f"{len(all_findings)} finding(s)")
+    return 1 if all_findings else 0
+if __name__ == "__main__":
+    raise SystemExit(main(sys.argv[1:]))

core/skills/php/versions.json ADDED Viewed

@@ -0,0 +1,9 @@
+{
+  "php": {
+    "ecosystem": "endoflife",
+    "package": "php",
+    "version": "8.5.7",
+    "source": "https://endoflife.date/php",
+    "checked": "2026-06-04"
+  }
+}

core/skills/pr-mode-driver/SKILL.md ADDED Viewed

@@ -0,0 +1,65 @@
+---
+name: pr-mode-driver
+tier: workflow
+domain: [infra]
+description: Drive the pr-mode autonomous git loop for a consumer repo (COS_GIT_WORKFLOW=pr). Use after `cos pr submit` to poll CI and act on the result. Triggers — "drive the PR", "CI is red", "is the PR merged", "retry the failing check", "pr-mode loop", any turn waiting on an agent PR's CI.
+phase: L
+last_reviewed: "2026-06-24"
+---
+# pr-mode Driver Skill
+You are driving the **pr-mode autonomous loop** for a consumer repo (`COS_GIT_WORKFLOW=pr`). One agent owns one task → one `agents/*` branch → one worktree → one PR. After `cos pr submit`, your job is to poll CI and act — never merge by hand, never spin in-process.
+> Skip entirely in trunk mode (coding-os itself, and any default repo — pr-mode is consumer-only, default OFF). Full spec: [pr-workflow.md](../../../docs/playbooks/pr-workflow.md) §§ 4–10.
+## The one signal
+```bash
+cos pr status --branch "$BRANCH" --json    # → {"ci_rollup": "merged|red|queued|pending|passing|passing-unarmed|closed|none"}
+```
+`ci_rollup` collapses `gh`'s `statusCheckRollup` + PR state + whether auto-merge is actually armed into one value. Branch on it — nothing else; the STOP decision needs no memory of the prior `cos pr submit`.
+## The loop — ONE pass per turn (never busy-wait)
+| `ci_rollup` | Action |
+|---|---|
+| `merged` | `cos pr cleanup --task "$TASK"` — removes the worktree + branch. **Done.** |
+| `red` | Heal (below). |
+| `passing` | Green AND auto-merge is armed — it will land itself. Re-poll next turn; do nothing else. |
+| `passing-unarmed` | Green but nothing will auto-land it (autonomy=draft, no required check, or a draft PR). **STOP** — needs a human merge (below). |
+| `pending` | Checks still running. Re-poll next turn. |
+| `queued` | In the GitHub merge queue — the queue will land it (or eject it) on its own. Re-poll next turn; do **not** re-submit or re-arm. An ejected PR surfaces as `red` (only that PR is healed; followers keep merging). |
+| `none` | No PR yet → `cos pr submit` (or `cos pr open` if there's no worktree). |
+| `closed` | Closed unmerged (human/abandoned). Stop and surface to the user; do not auto-reopen. |
+**`passing-unarmed` → STOP, don't spin.** The signal itself says nothing will land this PR on its own — you do NOT need to recall the prior `cos pr submit`, so this holds across `/clear`, `/compact`, and a reaper-recovered fresh session. Do NOT re-poll — at autonomy=draft that would loop forever. Stop and tell the user: *"PR #N is green and needs a human merge (auto-merge isn't armed — autonomy=draft, or no required status check on the integration branch) — merge it, or set autonomy_level=auto_merge with a required check in Hub Config→Git."*
+`passing` / `pending` / `queued` mean **yield the turn and check again later**, not sleep-loop. Hooks and the turn loop drive this, not a daemon (Rule 21).
+## Heal — the red branch
+```bash
+cos pr heal --task "$TASK"     # charges the self-heal budget; escalates to `blocked` when spent
+```
+1. Run `cos pr heal`. If it reports the budget is **spent / escalated**, STOP — the task is now `blocked` with the failure recorded; do not retry.
+2. Diagnose: read the failing check (`gh pr checks "$BRANCH"`, `gh run view <id> --log-failed`) and reproduce with the repo's own validate command **inside the worktree**.
+3. Fix in the worktree, then re-publish with `cos pr submit` (it rebases onto the integration head, lease-pushes, and CI re-runs).
+4. Next turn: poll `cos pr status --branch` again.
+A check that **cannot** run (quota exhausted, no runner — see `cos pr preflight`) is not a red to heal forever: surface it and stop.
+## Invariants (never violate)
+- Never `gh pr merge` by hand or push to the integration/protected branch — branch-guard blocks it; auto-merge lands a green PR itself.
+- Never `cos pr cleanup` a non-merged branch without `--force` — it refuses, to protect unmerged work (TASK-530).
+- Never loop in-process waiting on CI — one status check per turn.
+- While your session is alive you own cleanup; the reaper only GCs a worktree whose owner has died.
+## See also
+- [pr-workflow.md](../../../docs/playbooks/pr-workflow.md) — the full loop, branch-guard policy, reaper, self-heal budget.
+- `cos pr preflight` — capability gate (remote · gh · required check) before relying on auto-merge.