skill-workflows · diff

git:20260910.2cc3ce5 to git:20260923.cf348bd

47 added, 196 removed. Audit A to A.

---

description: >-

- Capabilities catalog for cursor-kenji skills. Routes requests to the right

- skill or bundled workflow. Always-on routing index — the agent consults this

- to pick between individual skills and bundled workflows.

+ Skill routing index for cursor-kenji. Consult when choosing between an

+ individual skill and a bundled workflow, when a request spans multiple

+ phases (spec + build + test, launch + verify + iterate), or when entering

+ a closure mode (complete-everything, burndown-full).

globs:

- alwaysApply: true

+ alwaysApply: false

---

- # Skill Routing Index

- ## Bundled workflows (use these first — they chain multiple skills)

- | Intent | Workflow skill |

- |--------|----------------|

- | Build a new feature end-to-end | `workflow-build-feature` |

- | Fix a bug and ship it | `workflow-fix-and-ship` |

- | Pre-release quality check | `workflow-quality-gate` |

- | Local working tree → merge-ready PR (do not merge) | `workflow-release-prep` |

- | Full launch preparation | `workflow-launch-ready` |

- | Orient to a new codebase | `workflow-onboard` |

- | Close post-launch feedback loop | `iterate-post-launch` |

- | Disciplined feature-flag rollout | `workflow-feature-flag` |

- | Finish a partial burndown to 100% coverage | `burndown-full` |

- | Close a plan with no connected deferrals | `complete-everything` |

- | Green the whole repository (authorized debt cleanup) | `workflow-green-repo` |

- | Deploy to production and watch it | `workflow-ship-and-observe` |

- | Turn feedback into tracked, verified-closed tickets | `workflow-feedback-to-closure` |

- | Preflight the environment before a long run | `workflow-environment-ready` |

- | Turn an agent failure into a durable guard | `iterate-agent-harness` |

- `complete-everything` and `burndown-full` are explicit closure modes: persist

- their state files and continue through phase checkpoints. Before either claims

- completion, apply `verification-before-completion` and invoke the

- `completion-judge` subagent. The packaged Cursor stop hook continues only

- actionable unchecked state; Claude Code 2.1.139+ can enforce the same condition

- with `/goal`.

- ## When to use a bundled workflow vs individual skill

- - **Use a bundle** when the user's request spans multiple phases (spec + build + test, or launch + verify + iterate)

- - **Use an individual skill** when the request is scoped to one phase ("just run the security audit", "just write tests", "just write the PR")

- - **Bundles call individual skills** — they never duplicate instructions; they sequence them

- ## Individual skill quick-reference

- ### Testing & quality

- | Task | Skill |

- |------|-------|

- | Adversarial full-app sweep | `test-red-team` |

- | Drive app as real user, fix inline | `test-playwright` |

- | Comprehensive QA with CRUD verification | `test-qa` |

- | Unscripted guest vs logged-in wander + diff | `test-exploratory` |

- | Write unit/integration tests | `test-unit` |

- | Mutation testing — do tests actually assert? | `test-mutation` |

- | Screenshot baselines / CI pixel diffs | `test-visual-regression` |

- | k6/Artillery breaking point (never unsigned prod) | `test-load` |

- ### Audits

- `audit-*` is findings-first. **Audit-and-fix exceptions:** `audit-responsive`, `audit-code-quality`, `audit-performance`, `audit-security`, `audit-i18n`, `audit-bundle-size`. `enhance-email-deliverability` is also audit-and-fix.

- | Task | Skill |

- |------|-------|

- | Linearized desktop / breakpoint layout (audit-and-fix) | `audit-responsive` |

- | Empty / loading / error / overflow states | `audit-ui-states` |

- | Pack coherence (skills vs skills) | `audit-skill-conflicts` |

- | LLM quality / Langfuse traces | `audit-langfuse-llm` |

- | OWASP LLM Top 10 (app-facing) | `audit-llm-security` |

- | Analytics taxonomy / consent-gated events | `audit-analytics` |

- | Hosting / egress spend | `audit-infra-cost` |

- | Env/config parity across deploys | `audit-env-parity` |

- | Mobile IAP / subscriptions | `audit-monetization-iap` |

- | Static security review (OWASP; may fix) | `audit-security` |

- | App-layer auth flows (route×gate, getSession, middleware-as-only-gate) | `audit-auth-flows` |

- | CI/CD cost, speed & safety (GitHub Actions bill) | `audit-cicd` |

- | CI gate *logic* (silent bypass, ratchet gaming, required-but-not, archaeology) | `audit-gate-logic` |

- | Custom lint/ratchet *doctrine* (is the rule right, not merely enforced) | `audit-doctrine` |

- | Codemod / bulk-transform behavior-preservation | `audit-codemod-safety` |

- | JS bundle analysis & reduction | `audit-bundle-size` |

- | Core Web Vitals & performance | `audit-performance` |

- | Database schema health | `audit-db-schema` |

- | Translation quality & hardcoded strings | `audit-i18n` |

- | UX heuristics audit | `audit-ux` |

- | User-story completion, IA & navigation, cross-page journeys | `audit-ux-journeys` |

- | Accessibility (WCAG 2.2) | `audit-accessibility` |

- | Design system compliance | `audit-uiux-design-system` |

- | Full-stack parity/conformance vs the RealWorld reference | `audit-realworld` |

- | Production resilience — timeouts/retries/idempotency/rate limits/PII (the "80%" NFRs) | `audit-resilience` |

- | Backend architecture — audit + decide which pattern to adopt (gateway, BFF, outbox, saga, cache-aside, db-per-service, sync/async; start-simple, topology-gated) | `audit-backend-architecture` |

- | Payment/money-movement correctness — idempotency, double-entry ledger, webhooks, reconciliation, 3DS/PCI (scope-gated P0/P1/P2) | `audit-payment-system` |

- ### Enhancement

- | Task | Skill |

- |------|-------|

- | SEO (meta, OG, JSON-LD, sitemap) | `enhance-web-seo` |

- | Instant in-site nav (Speculation Rules, bfcache, Early Hints) | `enhance-web-instant-nav` |

- | Information design / reading measure (CPL, Gestalt) | `enhance-readability` |

- | PWA (manifest, service worker, offline) | `enhance-pwa` |

- | UI polish & layout | `enhance-web-ui` |

- | UX & information architecture | `enhance-web-ux` |

- | Cross-surface (web + mobile) consistency | `enhance-capacitor-ui` |

- | Coherent motion on an existing design system (2026 stack) | `enhance-motion` |

- | Consolidate a drifted design system into one token SSOT | `housekeep-design` |

- | Consolidate accreted CI gates into one aggregator | `housekeep-gates` |

- | Delete proven-dead code by category, then ratchet it | `housekeep-dead-code` |

- | Inventory parked work into a living BACKLOG.md (do not implement) | `housekeep-backlog` |

- | Mechanically-enforced architecture boundaries | `enhance-arch-boundaries` |

- | Production-quality forms (a11y, validation, states, multi-step) | `enhance-web-forms` |

- | Install agent guardrails-as-code (rules, hooks, CI gates, lint) | `enhance-agent-guardrails` |

- | Inbox placement — SPF/DKIM/DMARC (audit-and-fix) | `enhance-email-deliverability` |

- | Upgrade an existing SKILL.md prompt (T1–T6), not its behavior | `enhance-skill-prompts` |

- | Current-year docs + gap analysis before a non-trivial change (no implement) | `research` |

- ### Plan (audit → approve → execute)

- | Task | Skill |

- |------|-------|

- | UI/UX + design-system unification plan (no fixes) | `plan-uiux-unification` |

- | Stub/dead-link/fake-component audit + wiring plan (no fixes) | `plan-stub-checker` |

- | Performance audit + optimization plan (no fixes) | `plan-perf-audit` |

- | Security/OWASP hardening plan (no fixes; RLS → `plan-rls-audit`) | `plan-security-audit` |

- | Backup / restore capability + RPO/RTO (no infra edits) | `plan-backup-dr` |

- | Privacy policy vs real collection (GDPR/APPI/labels) | `plan-privacy-compliance` |

- | App Store / Play listing ASO (no metadata edits) | `plan-aso` |

- | Docs drift audit + sync plan (no rewrites) | `plan-docs-sync` |

- | Architecture Decision Records (why, rejected alternatives) | `docs-adr` |

- | User-story test coverage plan (no tests written) | `plan-test-coverage` |

- | AI slop / authenticity / voice audit + de-slop burndown (no rewrites) | `plan-antislop` |

- | RLS & Supabase access-control audit + remediation plan (no SQL) | `plan-rls-audit` |

- | Error-handling & observability audit (Sentry + Langfuse, no fixes) | `plan-error-handling` |

- | Input-validation & trust-boundary audit (no hardening) | `plan-input-validation` |

- | Secrets & key-scope audit (rotate vs relocate, no rotation) | `plan-secrets-audit` |

- | Data-integrity & destructive-op audit (no migrations/tokens) | `plan-data-integrity` |

- | Dependency provenance & slopsquatting audit (no install) | `plan-dependency-provenance` |

- | Dead-code audit — Knip config, baseline, ratchet plan (no deletions) | `plan-dead-code` |

- | LLM cost guardrails & quota-abuse audit (no limits added) | `plan-llm-cost-guardrails` |

- | Answer-engine / AEO citation readiness audit (no edits) | `plan-aeo-readiness` |

- | App Store / Play submission readiness audit (no manifest edits) | `plan-mobile-readiness` |

- | Capacitor native-layer security audit (no config edits) | `plan-capacitor-hardening` |

- **Six-skill plan loop:** see `docs/PLAN-LOOPS.md` —

- `plan-uiux-unification` → `plan-stub-checker` → `plan-test-coverage` → `plan-perf-audit` / `plan-security-audit` → `plan-docs-sync`

- Optional: **pre-launch hardening** · **observability & spend** · **launch gates** · `plan-antislop` — see `docs/PLAN-LOOPS.md`

- **Pre-launch hardening (layered):**

- `plan-input-validation` → `plan-secrets-audit` → `plan-rls-audit` → `plan-data-integrity` → `plan-dependency-provenance`

- **Observability & spend:** `plan-error-handling` + `plan-llm-cost-guardrails`

- **Launch gates:** `plan-capacitor-hardening` → `plan-mobile-readiness` · `plan-aeo-readiness`

- ### Deploy & operate

- | Task | Skill |

- |------|-------|

- | Post-deploy smoke test | `deploy-verify` |

- | npm package release | `deploy-npm` |

- | Deploy an app, verify the live revision, observe, roll back | `workflow-ship-and-observe` |

- | Drive the whole repo to green (typecheck/lint/test/build) | `workflow-green-repo` |

- | Feedback → deduped tickets → verified closure | `workflow-feedback-to-closure` |

- | Prove the environment can build/test/reach services first | `workflow-environment-ready` |

- | Convert an agent failure into a regression guard | `iterate-agent-harness` |

- ### Debug

- | Task | Skill |

- |------|-------|

- | Debug any error | `debug-error` |

- | Triage & fix Sentry issues | `debug-sentry-monitor` |

- | FE-BE integration mismatches | `debug-fe-be-integration` |

- ## Skill chaining diagram

- ```

- workflow-build-feature

- └─ workflow-spec-tdd → test-unit → test-playwright → workflow-pr

+ # Skill Routing

- workflow-fix-and-ship

- └─ debug-error → test-playwright → workflow-pr → deploy-verify

+ Skills load on demand and self-describe — never inline skill content into a

+ rule. Full catalog: each skill's own description, plus `docs/PLAN-LOOPS.md`

+ for the plan-loop sequences.

- workflow-quality-gate

- └─ (optional) test-exploratory → test-red-team → audit-security → audit-bundle-size → audit-performance → test-unit

+ ## Use a bundled workflow when the request spans phases

- workflow-release-prep

- └─ snapshot tree → audit-code-review + release lens → split-to-prs?

- → workflow-git-commit → workflow-pr → babysit (stop before merge)

+ - Build a feature end-to-end → `workflow-build-feature`

+ - Fix a bug and ship it → `workflow-fix-and-ship`

+ - Pre-release quality check → `workflow-quality-gate`

+ - Local working tree → merge-ready PR (do not merge) → `workflow-release-prep`

+ - Full launch preparation → `workflow-launch-ready`

+ - Take a shipped product to market / grow traffic and visibility → `workflow-gtm` (strategy only → `plan-gtm`)

+ - Orient to a new codebase → `workflow-onboard`

+ - Post-launch feedback loop → `iterate-post-launch`

+ - Deploy and observe / roll back → `workflow-ship-and-observe`

+ - Drive the whole repo to green → `workflow-green-repo`

+ - Finish a partial burndown to 100% → `burndown-full`

+ - Close a plan with zero deferrals → `complete-everything`

+ - Inventory parked work into a living BACKLOG.md → `housekeep-backlog`

+ - Current-year docs + gap analysis before a non-trivial change → `research`

+ - Preflight the environment → `workflow-environment-ready`

+ - Feedback to durable tickets → `workflow-feedback-to-closure`

+ - Feature-flag rollout → `workflow-feature-flag`

+ - Convert an agent failure into a guard → `iterate-agent-harness`

- test-exploratory → workflow-feedback-to-closure → test-playwright

- └─ guest+authed wander → durable tickets → lock the worst bugs

+ Highest-impact prove combo: `test-exploratory` → `workflow-feedback-to-closure` → `test-playwright`. Optional pre-gate: `test-exploratory` then `workflow-quality-gate`. Pre-release trio: `housekeep-backlog` → `workflow-release-prep` → `docs-adr`. Doctrine vs enforcement: `audit-doctrine` (is the rule right) × `audit-gate-logic` (is it enforced) → `housekeep-gates` / `housekeep-backlog`.

- workflow-launch-ready

- └─ enhance-web-seo → enhance-pwa → audit-bundle-size → audit-i18n

- → workflow-quality-gate → deploy-verify → iterate-post-launch

+ ## Use an individual skill when scoped to one phase

- iterate-post-launch

- └─ debug-sentry-monitor → deploy-verify → test-playwright

+ Names are predictable: `plan-*` (audit → approved burndown, no fixes),

+ `audit-*` (findings; default present-then-stop), `enhance-*` (apply

+ improvements), `test-*`, `debug-*`, `deploy-*`, `design-*`, `backend-*`,

+ `mobile-*`. Upgrade *how* an existing skill instructs (not what it does) →

+ `enhance-skill-prompts`. State the task; the matching skill self-selects by

+ description.

- complete-everything

- └─ durable closure set → conditional specialist skills → full verification

- → completion-judge

+ **Audit-and-fix exceptions** (report, then implement): `audit-responsive`,

+ `audit-code-quality`, `audit-performance`, `audit-security`, `audit-i18n`,

+ `audit-bundle-size`. `enhance-email-deliverability` is also audit-and-fix.

+ Do not treat those as present-then-stop.

- workflow-ship-and-observe

- └─ preflight (green) → deploy → verify live revision → observe window

- → stable OR rollback/hotfix

+ ## Closure modes

- workflow-feedback-to-closure

- └─ gather → dedupe → durable tickets → fix (workflow-fix-and-ship /

- complete-everything) → verify live → close

- ```

+ `complete-everything` and `burndown-full` persist their state files and

+ continue through phase checkpoints. Before either claims completion, apply

+ `verification-before-completion` and invoke the `completion-judge` subagent.

- ## Rules vs Skills

+ ## Rules vs skills

- - **Rules** (this file, `full-stack-ship-discipline.mdc`, etc.) = always-on policies, guardrails, routing

- - **Skills** = activated on demand when a task matches the description

- - Never put task-specific workflows in rules — they waste context on unrelated tasks

+ Rules are always-on policy and routing only; skills are on-demand

+ procedures. Never promote a skill's workflow into an always-on rule.