Feat/workflow contract

.github/agents/architect.agent.md

@@ -10,20 +10,21 @@ tools:
   - read
   - search
   - edit
+  - execute
   - web
   - vscode
   - todo
   - agent
 agents:
-  - *
+  - '*'
 model:
   - Claude Sonnet 4.6 (copilot)
   - GPT-5.3-Codex (copilot)
   - Claude Opus 4.7 (copilot)
 user-invocable: true
 target: vscode
 handoffs:
-  - label: 'Go to next stage: Design'
+  - label: 'Go to next stage: Designer'
     agent: designer
     prompt: >-
       Architecture outputs are approved. Assess the current state and produce design specifications as
@@ -150,6 +151,15 @@ what work is needed:
 | `docs/architecture/overview.md` |
 | `docs/architecture/adr/*.md`    |
 
+### baseline docs you maintain
+
+Keep these files current. Update them whenever the relevant scope, design, or implementation changes — do not let them go stale.
+
+| Artifact                        |
+| ------------------------------- |
+| `docs/architecture/overview.md` |
+| `docs/architecture/adr/*.md`    |
+
 Agents do not write to artifacts owned by other roles. If you discover something
 that requires changes to upstream artifacts, flag it and trigger a reverse handoff.
 

.github/agents/designer.agent.md

@@ -9,19 +9,20 @@ tools:
   - read
   - search
   - edit
+  - execute
   - web
   - vscode
   - todo
   - agent
 agents:
-  - *
+  - '*'
 model:
   - Claude Sonnet 4.6 (copilot)
   - GPT-5.3-Codex (copilot)
 user-invocable: true
 target: vscode
 handoffs:
-  - label: 'Go to next stage: Engineering'
+  - label: 'Go to next stage: Engineer'
     agent: engineer
     prompt: >-
       Design outputs are approved. Assess the current state and implement code and tests as needed. If
@@ -165,6 +166,15 @@ what work is needed:
 | `docs/design/ux.md`       | frontend/fullstack scope only                                                           |
 | `docs/design/**/*.md`     | additional detail docs per component, model, system, or domain (when scope warrants it) |
 
+### baseline docs you maintain
+
+Keep these files current. Update them whenever the relevant scope, design, or implementation changes — do not let them go stale.
+
+| Artifact                  | Notes                         |
+| ------------------------- | ----------------------------- |
+| `docs/design/overview.md` |                               |
+| `docs/design/ux.md`       | frontend/fullstack scope only |
+
 Agents do not write to artifacts owned by other roles. If you discover something
 that requires changes to upstream artifacts, flag it and trigger a reverse handoff.
 

.github/agents/engineer.agent.md

@@ -15,14 +15,14 @@ tools:
   - todo
   - agent
 agents:
-  - *
+  - '*'
 model:
   - GPT-5.3-Codex (copilot)
   - Claude Sonnet 4.6 (copilot)
 user-invocable: true
 target: vscode
 handoffs:
-  - label: 'Go to next stage: Verification'
+  - label: 'Go to next stage: Tester'
     agent: tester
     prompt: >-
       Implementation is approved. Assess the current state and verify the implementation as needed — run
@@ -160,6 +160,8 @@ what work is needed:
 | `issues/{id}-{slug}-rca.md`        | when working on an issue               |
 | `issues/{id}-{slug}-postmortem.md` | when stakeholder impact is significant |
 
+
+
 Agents do not write to artifacts owned by other roles. If you discover something
 that requires changes to upstream artifacts, flag it and trigger a reverse handoff.
 

.github/agents/product.agent.md

@@ -9,20 +9,21 @@ tools:
   - read
   - search
   - edit
+  - execute
   - web
   - vscode
   - todo
   - agent
 agents:
-  - *
+  - '*'
 model:
   - Claude Sonnet 4.6 (copilot)
   - GPT-5.3-Codex (copilot)
   - Claude Opus 4.7 (copilot)
 user-invocable: true
 target: vscode
 handoffs:
-  - label: 'Go to next stage: Architecture'
+  - label: 'Go to next stage: Architect'
     agent: architect
     prompt: >-
       Product outputs are approved. Assess the current state and produce or update the architecture as
@@ -133,6 +134,16 @@ Handoffs you own:
 | `docs/product/changes/*.md`    |
 | `docs/product/issues/*.md`     |
 
+### baseline docs you maintain
+
+Keep these files current. Update them whenever the relevant scope, design, or implementation changes — do not let them go stale.
+
+| Artifact                       |
+| ------------------------------ |
+| `docs/product/vision.md`       |
+| `docs/product/requirements.md` |
+| `docs/product/roadmap.md`      |
+
 Agents do not write to artifacts owned by other roles. If you discover something
 that requires changes to upstream artifacts, flag it and trigger a reverse handoff.
 

.github/agents/release.agent.md

@@ -11,11 +11,12 @@ tools:
   - search
   - edit
   - execute
+  - web
   - vscode
   - todo
   - agent
 agents:
-  - *
+  - '*'
 model:
   - Claude Sonnet 4.6 (copilot)
   - GPT-5.3-Codex (copilot)
@@ -123,6 +124,8 @@ and wait for explicit user routing decisions.
 | -------------------- | ------------------------------------------ |
 | `docs/releases/*.md` | includes release notes and sign-off record |
 
+
+
 Agents do not write to artifacts owned by other roles. If you discover something
 that requires changes to upstream artifacts, flag it and trigger a reverse handoff.
 

.github/agents/tester.agent.md

@@ -15,14 +15,14 @@ tools:
   - todo
   - agent
 agents:
-  - *
+  - '*'
 model:
   - Claude Sonnet 4.6 (copilot)
   - GPT-5.3-Codex (copilot)
 user-invocable: true
 target: vscode
 handoffs:
-  - label: 'Go to next stage: Release readiness'
+  - label: 'Go to next stage: Release'
     agent: release
     prompt: >-
       Verification outputs are approved. Assess the current state and prepare the release as needed.
@@ -145,6 +145,8 @@ what work is needed:
 | `docs/reports/**/*.md` |
 | `tests/**/*`           |
 
+
+
 Agents do not write to artifacts owned by other roles. If you discover something
 that requires changes to upstream artifacts, flag it and trigger a reverse handoff.
 

.github/skills/adr/SKILL.md

@@ -6,6 +6,7 @@ compatibility: 'Requires a skills-compatible agent with repository file access a
 metadata:
   owner: vstack
   maturity: stable
+allowed-tools: 'execute read search edit'
 argument-hint: '[decision to record]'
 user-invocable: true
 disable-model-invocation: false

.github/skills/analyse/SKILL.md

@@ -6,6 +6,7 @@ compatibility: 'Requires a skills-compatible agent with repository file access a
 metadata:
   owner: vstack
   maturity: stable
+allowed-tools: 'execute read search'
 argument-hint: '[topic, change, or question to analyse]'
 user-invocable: true
 disable-model-invocation: false

.github/skills/architecture/SKILL.md

@@ -6,6 +6,7 @@ compatibility: 'Requires a skills-compatible agent with repository file access a
 metadata:
   owner: vstack
   maturity: stable
+allowed-tools: 'execute read search edit'
 argument-hint: '[plan or system to review]'
 user-invocable: true
 disable-model-invocation: false

.github/skills/aws-cli/SKILL.md

@@ -6,6 +6,7 @@ compatibility: 'Requires AWS CLI v2 installed and configured (aws configure or e
 metadata:
   owner: vstack
   maturity: stable
+allowed-tools: 'execute read search edit web'
 argument-hint: '[service: iam | ec2 | s3 | rds | ecs | lambda | cloudwatch | ssm | secrets]'
 user-invocable: true
 disable-model-invocation: false

.github/skills/cicd/SKILL.md

@@ -6,6 +6,7 @@ compatibility: 'Requires a skills-compatible agent with repository file access a
 metadata:
   owner: vstack
   maturity: stable
+allowed-tools: 'execute read search edit'
 argument-hint: '[service or workflow to configure]'
 user-invocable: true
 disable-model-invocation: false

.github/skills/cloudformation/SKILL.md

@@ -6,6 +6,7 @@ compatibility: 'Requires a skills-compatible agent with repository file access.
 metadata:
   owner: vstack
   maturity: stable
+allowed-tools: 'execute read search edit'
 argument-hint: '[resource type or stack name, e.g. VPC | RDS | ECS service | Lambda function]'
 user-invocable: true
 disable-model-invocation: false

.github/skills/code-review/SKILL.md

@@ -6,6 +6,7 @@ compatibility: 'Requires a skills-compatible agent with repository file access a
 metadata:
   owner: vstack
   maturity: stable
+allowed-tools: 'execute read search'
 argument-hint: '[files, PR, or change to review]'
 user-invocable: true
 disable-model-invocation: false

.github/skills/codeql/SKILL.md

@@ -6,6 +6,7 @@ compatibility: 'Requires a skills-compatible agent with repository file access a
 metadata:
   owner: vstack
   maturity: stable
+allowed-tools: 'execute read search edit web'
 argument-hint: '[languages and setup type: default or advanced]'
 user-invocable: true
 disable-model-invocation: false

.github/skills/concise/SKILL.md

@@ -6,6 +6,7 @@ compatibility: 'Requires a skills-compatible agent with session memory and repos
 metadata:
   owner: vstack
   maturity: stable
+allowed-tools: 'execute read search'
 argument-hint: '[normal|compact|ultra|status|on|off]'
 user-invocable: true
 disable-model-invocation: false

.github/skills/consult/SKILL.md

@@ -6,6 +6,7 @@ compatibility: 'Requires a skills-compatible agent with repository file access a
 metadata:
   owner: vstack
   maturity: stable
+allowed-tools: 'execute read search'
 argument-hint: '[API, tool, or workflow to consult]'
 user-invocable: true
 disable-model-invocation: false

.github/skills/container/SKILL.md

@@ -6,6 +6,7 @@ compatibility: 'Requires a skills-compatible agent with repository file access a
 metadata:
   owner: vstack
   maturity: stable
+allowed-tools: 'execute read search edit'
 argument-hint: '[service to containerise]'
 user-invocable: true
 disable-model-invocation: false

.github/skills/conventional-commit/SKILL.md

@@ -6,6 +6,7 @@ compatibility: 'Requires a skills-compatible agent with repository file access a
 metadata:
   owner: vstack
   maturity: stable
+allowed-tools: 'execute read search edit'
 argument-hint: '[changes to commit and desired release intent]'
 user-invocable: true
 disable-model-invocation: false

.github/skills/debug/SKILL.md

@@ -6,6 +6,7 @@ compatibility: 'Requires a skills-compatible agent with repository file access a
 metadata:
   owner: vstack
   maturity: stable
+allowed-tools: 'execute read search edit'
 argument-hint: '[issue or error to debug]'
 user-invocable: true
 disable-model-invocation: false

.github/skills/dependabot/SKILL.md

@@ -6,6 +6,7 @@ compatibility: 'Requires a skills-compatible agent with repository file access.
 metadata:
   owner: vstack
   maturity: stable
+allowed-tools: 'execute read search edit'
 argument-hint: '[repository type: library | service | monorepo, and ecosystems to cover]'
 user-invocable: true
 disable-model-invocation: false

.github/skills/dependency/SKILL.md

@@ -6,6 +6,7 @@ compatibility: 'Requires a skills-compatible agent with repository file access a
 metadata:
   owner: vstack
   maturity: stable
+allowed-tools: 'execute read search edit web'
 argument-hint: '[project or package manifest to audit]'
 user-invocable: true
 disable-model-invocation: false

.github/skills/design/SKILL.md

@@ -6,6 +6,7 @@ compatibility: 'Requires a skills-compatible agent with repository file access a
 metadata:
   owner: vstack
   maturity: stable
+allowed-tools: 'execute read search edit'
 argument-hint: '[API or service to design]'
 user-invocable: true
 disable-model-invocation: false

.github/skills/docs/SKILL.md

@@ -6,6 +6,7 @@ compatibility: 'Requires a skills-compatible agent with repository file access a
 metadata:
   owner: vstack
   maturity: stable
+allowed-tools: 'execute read search edit'
 argument-hint: '[release or change to document]'
 user-invocable: true
 disable-model-invocation: false

.github/skills/explore/SKILL.md

@@ -6,6 +6,7 @@ compatibility: 'Requires a skills-compatible agent with repository file access a
 metadata:
   owner: vstack
   maturity: stable
+allowed-tools: 'execute read search'
 argument-hint: '[repository or system to explore]'
 user-invocable: true
 disable-model-invocation: false

.github/skills/gdpr/SKILL.md

@@ -6,6 +6,7 @@ compatibility: 'Requires a skills-compatible agent with repository file access.'
 metadata:
   owner: vstack
   maturity: stable
+allowed-tools: 'execute read search edit'
 argument-hint: '[component or feature: data model | API | logging | retention | erasure | infra | PR review]'
 user-invocable: true
 disable-model-invocation: false

.github/skills/gh-issues/SKILL.md

@@ -6,6 +6,7 @@ compatibility: 'Requires a skills-compatible agent with terminal command executi
 metadata:
   owner: vstack
   maturity: stable
+allowed-tools: 'execute read search edit web'
 argument-hint: '[what to create or which issue number to update]'
 user-invocable: true
 disable-model-invocation: false

.github/skills/gh-release/SKILL.md

@@ -6,6 +6,7 @@ compatibility: 'Requires a skills-compatible agent with repository file access,
 metadata:
   owner: vstack
   maturity: stable
+allowed-tools: 'execute read search edit web'
 argument-hint: '[version/tag and release notes source]'
 user-invocable: true
 disable-model-invocation: false

.github/skills/guardrails/SKILL.md

@@ -6,6 +6,7 @@ compatibility: 'Requires a skills-compatible agent with repository file access a
 metadata:
   owner: vstack
   maturity: stable
+allowed-tools: 'execute read search edit'
 argument-hint: '[task]'
 user-invocable: true
 disable-model-invocation: true

.github/skills/helm/SKILL.md

@@ -6,6 +6,7 @@ compatibility: 'Requires a skills-compatible agent with repository file access.
 metadata:
   owner: vstack
   maturity: stable
+allowed-tools: 'execute read search edit'
 argument-hint: '[chart path, release name, namespace, and scope: chart review | install | upgrade | rollback]'
 user-invocable: true
 disable-model-invocation: false

.github/skills/incident/SKILL.md

@@ -6,6 +6,7 @@ compatibility: 'Requires a skills-compatible agent with repository file access a
 metadata:
   owner: vstack
   maturity: stable
+allowed-tools: 'execute read search edit'
 argument-hint: '[incident or outage to analyse]'
 user-invocable: true
 disable-model-invocation: false

.github/skills/inspect/SKILL.md

@@ -6,6 +6,7 @@ compatibility: 'Requires a skills-compatible agent with repository file access a
 metadata:
   owner: vstack
   maturity: stable
+allowed-tools: 'execute read search'
 argument-hint: '[component or service to inspect]'
 user-invocable: true
 disable-model-invocation: false