skill-workflows · diff
git:20260828.284b0b3 to git:20260910.2cc3ce5
2 added, 0 removed. Audit A to A.
---
description: >-
Capabilities catalog for cursor-kenji skills. Routes requests to the right
skill or bundled workflow. Always-on routing index — the agent consults this
to pick between individual skills and bundled workflows.
globs:
alwaysApply: true
---
# Skill Routing Index
## Bundled workflows (use these first — they chain multiple skills)
| Intent | Workflow skill |
|--------|----------------|
| Build a new feature end-to-end | `workflow-build-feature` |
| Fix a bug and ship it | `workflow-fix-and-ship` |
| Pre-release quality check | `workflow-quality-gate` |
| Local working tree → merge-ready PR (do not merge) | `workflow-release-prep` |
| Full launch preparation | `workflow-launch-ready` |
| Orient to a new codebase | `workflow-onboard` |
| Close post-launch feedback loop | `iterate-post-launch` |
| Disciplined feature-flag rollout | `workflow-feature-flag` |
| Finish a partial burndown to 100% coverage | `burndown-full` |
| Close a plan with no connected deferrals | `complete-everything` |
| Green the whole repository (authorized debt cleanup) | `workflow-green-repo` |
| Deploy to production and watch it | `workflow-ship-and-observe` |
| Turn feedback into tracked, verified-closed tickets | `workflow-feedback-to-closure` |
| Preflight the environment before a long run | `workflow-environment-ready` |
| Turn an agent failure into a durable guard | `iterate-agent-harness` |
`complete-everything` and `burndown-full` are explicit closure modes: persist
their state files and continue through phase checkpoints. Before either claims
completion, apply `verification-before-completion` and invoke the
`completion-judge` subagent. The packaged Cursor stop hook continues only
actionable unchecked state; Claude Code 2.1.139+ can enforce the same condition
with `/goal`.
## When to use a bundled workflow vs individual skill
- **Use a bundle** when the user's request spans multiple phases (spec + build + test, or launch + verify + iterate)
- **Use an individual skill** when the request is scoped to one phase ("just run the security audit", "just write tests", "just write the PR")
- **Bundles call individual skills** — they never duplicate instructions; they sequence them
## Individual skill quick-reference
### Testing & quality
| Task | Skill |
|------|-------|
| Adversarial full-app sweep | `test-red-team` |
| Drive app as real user, fix inline | `test-playwright` |
| Comprehensive QA with CRUD verification | `test-qa` |
| Unscripted guest vs logged-in wander + diff | `test-exploratory` |
| Write unit/integration tests | `test-unit` |
| Mutation testing — do tests actually assert? | `test-mutation` |
| Screenshot baselines / CI pixel diffs | `test-visual-regression` |
| k6/Artillery breaking point (never unsigned prod) | `test-load` |
### Audits
`audit-*` is findings-first. **Audit-and-fix exceptions:** `audit-responsive`, `audit-code-quality`, `audit-performance`, `audit-security`, `audit-i18n`, `audit-bundle-size`. `enhance-email-deliverability` is also audit-and-fix.
| Task | Skill |
|------|-------|
| Linearized desktop / breakpoint layout (audit-and-fix) | `audit-responsive` |
| Empty / loading / error / overflow states | `audit-ui-states` |
| Pack coherence (skills vs skills) | `audit-skill-conflicts` |
| LLM quality / Langfuse traces | `audit-langfuse-llm` |
| OWASP LLM Top 10 (app-facing) | `audit-llm-security` |
| Analytics taxonomy / consent-gated events | `audit-analytics` |
| Hosting / egress spend | `audit-infra-cost` |
| Env/config parity across deploys | `audit-env-parity` |
| Mobile IAP / subscriptions | `audit-monetization-iap` |
| Static security review (OWASP; may fix) | `audit-security` |
| App-layer auth flows (route×gate, getSession, middleware-as-only-gate) | `audit-auth-flows` |
| CI/CD cost, speed & safety (GitHub Actions bill) | `audit-cicd` |
| CI gate *logic* (silent bypass, ratchet gaming, required-but-not, archaeology) | `audit-gate-logic` |
| Custom lint/ratchet *doctrine* (is the rule right, not merely enforced) | `audit-doctrine` |
| Codemod / bulk-transform behavior-preservation | `audit-codemod-safety` |
| JS bundle analysis & reduction | `audit-bundle-size` |
| Core Web Vitals & performance | `audit-performance` |
| Database schema health | `audit-db-schema` |
| Translation quality & hardcoded strings | `audit-i18n` |
| UX heuristics audit | `audit-ux` |
| User-story completion, IA & navigation, cross-page journeys | `audit-ux-journeys` |
| Accessibility (WCAG 2.2) | `audit-accessibility` |
| Design system compliance | `audit-uiux-design-system` |
| Full-stack parity/conformance vs the RealWorld reference | `audit-realworld` |
| Production resilience — timeouts/retries/idempotency/rate limits/PII (the "80%" NFRs) | `audit-resilience` |
| Backend architecture — audit + decide which pattern to adopt (gateway, BFF, outbox, saga, cache-aside, db-per-service, sync/async; start-simple, topology-gated) | `audit-backend-architecture` |
| Payment/money-movement correctness — idempotency, double-entry ledger, webhooks, reconciliation, 3DS/PCI (scope-gated P0/P1/P2) | `audit-payment-system` |
### Enhancement
| Task | Skill |
|------|-------|
| SEO (meta, OG, JSON-LD, sitemap) | `enhance-web-seo` |
| Instant in-site nav (Speculation Rules, bfcache, Early Hints) | `enhance-web-instant-nav` |
| Information design / reading measure (CPL, Gestalt) | `enhance-readability` |
| PWA (manifest, service worker, offline) | `enhance-pwa` |
| UI polish & layout | `enhance-web-ui` |
| UX & information architecture | `enhance-web-ux` |
| Cross-surface (web + mobile) consistency | `enhance-capacitor-ui` |
| Coherent motion on an existing design system (2026 stack) | `enhance-motion` |
| Consolidate a drifted design system into one token SSOT | `housekeep-design` |
| Consolidate accreted CI gates into one aggregator | `housekeep-gates` |
+ | Delete proven-dead code by category, then ratchet it | `housekeep-dead-code` |
| Inventory parked work into a living BACKLOG.md (do not implement) | `housekeep-backlog` |
| Mechanically-enforced architecture boundaries | `enhance-arch-boundaries` |
| Production-quality forms (a11y, validation, states, multi-step) | `enhance-web-forms` |
| Install agent guardrails-as-code (rules, hooks, CI gates, lint) | `enhance-agent-guardrails` |
| Inbox placement — SPF/DKIM/DMARC (audit-and-fix) | `enhance-email-deliverability` |
| Upgrade an existing SKILL.md prompt (T1–T6), not its behavior | `enhance-skill-prompts` |
| Current-year docs + gap analysis before a non-trivial change (no implement) | `research` |
### Plan (audit → approve → execute)
| Task | Skill |
|------|-------|
| UI/UX + design-system unification plan (no fixes) | `plan-uiux-unification` |
| Stub/dead-link/fake-component audit + wiring plan (no fixes) | `plan-stub-checker` |
| Performance audit + optimization plan (no fixes) | `plan-perf-audit` |
| Security/OWASP hardening plan (no fixes; RLS → `plan-rls-audit`) | `plan-security-audit` |
| Backup / restore capability + RPO/RTO (no infra edits) | `plan-backup-dr` |
| Privacy policy vs real collection (GDPR/APPI/labels) | `plan-privacy-compliance` |
| App Store / Play listing ASO (no metadata edits) | `plan-aso` |
| Docs drift audit + sync plan (no rewrites) | `plan-docs-sync` |
| Architecture Decision Records (why, rejected alternatives) | `docs-adr` |
| User-story test coverage plan (no tests written) | `plan-test-coverage` |
| AI slop / authenticity / voice audit + de-slop burndown (no rewrites) | `plan-antislop` |
| RLS & Supabase access-control audit + remediation plan (no SQL) | `plan-rls-audit` |
| Error-handling & observability audit (Sentry + Langfuse, no fixes) | `plan-error-handling` |
| Input-validation & trust-boundary audit (no hardening) | `plan-input-validation` |
| Secrets & key-scope audit (rotate vs relocate, no rotation) | `plan-secrets-audit` |
| Data-integrity & destructive-op audit (no migrations/tokens) | `plan-data-integrity` |
| Dependency provenance & slopsquatting audit (no install) | `plan-dependency-provenance` |
+ | Dead-code audit — Knip config, baseline, ratchet plan (no deletions) | `plan-dead-code` |
| LLM cost guardrails & quota-abuse audit (no limits added) | `plan-llm-cost-guardrails` |
| Answer-engine / AEO citation readiness audit (no edits) | `plan-aeo-readiness` |
| App Store / Play submission readiness audit (no manifest edits) | `plan-mobile-readiness` |
| Capacitor native-layer security audit (no config edits) | `plan-capacitor-hardening` |
**Six-skill plan loop:** see `docs/PLAN-LOOPS.md` —
`plan-uiux-unification` → `plan-stub-checker` → `plan-test-coverage` → `plan-perf-audit` / `plan-security-audit` → `plan-docs-sync`
Optional: **pre-launch hardening** · **observability & spend** · **launch gates** · `plan-antislop` — see `docs/PLAN-LOOPS.md`
**Pre-launch hardening (layered):**
`plan-input-validation` → `plan-secrets-audit` → `plan-rls-audit` → `plan-data-integrity` → `plan-dependency-provenance`
**Observability & spend:** `plan-error-handling` + `plan-llm-cost-guardrails`
**Launch gates:** `plan-capacitor-hardening` → `plan-mobile-readiness` · `plan-aeo-readiness`
### Deploy & operate
| Task | Skill |
|------|-------|
| Post-deploy smoke test | `deploy-verify` |
| npm package release | `deploy-npm` |
| Deploy an app, verify the live revision, observe, roll back | `workflow-ship-and-observe` |
| Drive the whole repo to green (typecheck/lint/test/build) | `workflow-green-repo` |
| Feedback → deduped tickets → verified closure | `workflow-feedback-to-closure` |
| Prove the environment can build/test/reach services first | `workflow-environment-ready` |
| Convert an agent failure into a regression guard | `iterate-agent-harness` |
### Debug
| Task | Skill |
|------|-------|
| Debug any error | `debug-error` |
| Triage & fix Sentry issues | `debug-sentry-monitor` |
| FE-BE integration mismatches | `debug-fe-be-integration` |
## Skill chaining diagram
```
workflow-build-feature
└─ workflow-spec-tdd → test-unit → test-playwright → workflow-pr
workflow-fix-and-ship
└─ debug-error → test-playwright → workflow-pr → deploy-verify
workflow-quality-gate
└─ (optional) test-exploratory → test-red-team → audit-security → audit-bundle-size → audit-performance → test-unit
workflow-release-prep
└─ snapshot tree → audit-code-review + release lens → split-to-prs?
→ workflow-git-commit → workflow-pr → babysit (stop before merge)
test-exploratory → workflow-feedback-to-closure → test-playwright
└─ guest+authed wander → durable tickets → lock the worst bugs
workflow-launch-ready
└─ enhance-web-seo → enhance-pwa → audit-bundle-size → audit-i18n
→ workflow-quality-gate → deploy-verify → iterate-post-launch
iterate-post-launch
└─ debug-sentry-monitor → deploy-verify → test-playwright
complete-everything
└─ durable closure set → conditional specialist skills → full verification
→ completion-judge
workflow-ship-and-observe
└─ preflight (green) → deploy → verify live revision → observe window
→ stable OR rollback/hotfix
workflow-feedback-to-closure
└─ gather → dedupe → durable tickets → fix (workflow-fix-and-ship /
complete-everything) → verify live → close
```
## Rules vs Skills
- **Rules** (this file, `full-stack-ship-discipline.mdc`, etc.) = always-on policies, guardrails, routing
- **Skills** = activated on demand when a task matches the description
- Never put task-specific workflows in rules — they waste context on unrelated tasks