Add three agent-workflow skills: worktree discipline, phase PR review loop, guarded DB migration

[dirtybits]

What

Three authored skills distilled from the workflow that shipped the AgentVouch Base port (plan-PR-per-phase, multi-agent worktrees, guarded Neon migrations). Each is written generically so any repo/agent stack can use it; no secrets, machine paths, or localhost-only steps.

1. multi-agent-worktree-discipline

Session bootstrap in fresh worktrees (toolchain pinning, lockfile installs, symlinked node_modules), shared-feature-branch + per-agent-scratch topology, the lost-work protocol (git branch -a --contains before redoing anything), lockfile/dependency commit discipline, signed commits in headless shells, and gh account-identity checks. Ends with a failure-mode quick-reference table.

2. phase-pr-review-loop

Plan reviewed as a PR before implementation, one phase = one PR with an honest verified/not-verified split, reviewer briefings, findings as inline threads, per-thread fix verification with evidence before resolving, the gh mechanics that trip agents up (can't approve own PRs, GraphQL reviewThreads vs top-level comments, reply endpoints), and the phase status ledger rules.

3. guarded-db-migration

The additive-runtime-DDL vs guarded-one-shot-script split, the preflight/migrate script pattern with a non-bypassable EXPECTED_DATABASE_HOST guard, disposable-branch rehearsal copied from production (Neon-style), post-run catalog + API-smoke verification, and a copy-paste migration PR checklist.

Validation

• npm run kb:format applied (frontmatter + indexes regenerated).
• npm run validate green: validated 17 skills with OKF-style KB checks.
• Registry entries added with origin: authored, license: MIT, publish_decision: candidate (free repo-backed listing default per repo rules).

🤖 Generated with Claude Code

---

Note

Low Risk
Documentation-only skill additions and registry/index updates; no runtime, auth, or application code changes.

Overview
Adds three authored MIT skill packages to the knowledge bundle, each with SKILL.md, index.md, and LICENSE.txt, and wires them into registry.json (origin: authored, publish_decision: candidate) and the generated skills/index.md. The root bundle index.md timestamp is bumped.

multi-agent-worktree-discipline documents safe parallel-agent work in git worktrees: session bootstrap (worktree/branch identity, per-invocation toolchain PATH, lockfile installs, shared node_modules pitfalls, gh identity), shared feature branch vs per-agent scratch branches, a lost-work recovery protocol before redoing commits, lockfile/branch-switch hygiene, signed commits in headless shells, and a symptom→fix table.

phase-pr-review-loop defines a one-PR-per-phase loop: plan-as-PR before implementation, honest verified/not-verified PR descriptions, reviewer briefings and inline threads, per-thread fix evidence before resolve, GitHub/gh mechanics (self-approve limits, GraphQL reviewThreads, reply APIs), and phase status ledger rules paired with plan-writing.

guarded-db-migration encodes production Postgres migration safety: additive runtime DDL vs guarded one-shot scripts, preflight/migrate with a non-bypassable EXPECTED_DATABASE_HOST guard, disposable production-branch rehearsal, catalog + API smoke verification, design rules, and a migration PR checklist.

^{Reviewed by Cursor Bugbot for commit 944c196. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_31a7f1ee-d975-4945-9d5c-cbc586f0278c)