Account governance: publish local safeguards and workflow catalog

.agents/skills/access/SKILL.md

@@ -0,0 +1,13 @@
+---
+name: access
+description: Verify Database authentication, authorization, ownership, tenancy, grants, RLS, administrative boundaries, and conservative denial behavior. Use for auth changes, private routes, owner scope, cross-tenant risk, or permissions.
+---
+
+# Access
+
+1. Map actor, credential, resource owner, tenancy boundary, route guard, database policy, and service-role use.
+2. Test unauthenticated, wrong-owner, non-admin, stale-session, missing-record, and cross-tenant paths.
+3. Inspect RLS, grants, security-definer functions, public API keys, and server/client trust boundaries.
+4. Run focused local access-model, owner-scope, and private-route tests.
+5. Keep staging cross-tenant tests and live Supabase checks approval-gated.
+6. Report the authorization decision matrix, denial proof, bypass risk, and unverified live boundary.

.agents/skills/access/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Access"
+  short_description: "Verify Database auth and tenancy boundaries"
+  default_prompt: "Use $access to verify authentication, authorization, ownership, grants, RLS, and cross-tenant denial behavior."

.agents/skills/api/SKILL.md

@@ -0,0 +1,13 @@
+---
+name: api
+description: Review Database route and function contracts for validation, authentication, authorization, errors, retries, idempotency, compatibility, and safe provider boundaries. Use for API route, edge function, webhook, or public contract work.
+---
+
+# API
+
+1. Identify callers, request schema, authentication, authorization, response contract, status codes, and side effects.
+2. Test invalid, empty, oversized, duplicate, stale, unauthorized, timeout, retry, and dependency-failure cases.
+3. Check stable error envelopes, cache behavior, rate assumptions, idempotency, and backwards compatibility.
+4. Use route-unit tests and mocks locally; never send live requests without approval.
+5. Verify secrets and privileged clients remain server-only.
+6. Report contract changes, compatibility risk, focused proofs, and untested live integrations.

.agents/skills/api/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "API"
+  short_description: "Review Database API contracts and failure paths"
+  default_prompt: "Use $api to verify this Database route contract, validation, auth, errors, retries, and compatibility."

.agents/skills/audit/SKILL.md

@@ -0,0 +1,13 @@
+---
+name: audit
+description: Perform a deep evidence-backed Database repository audit and produce severity-ranked, reproducible findings without mutating code unless fixes are requested. Use for repo-wide audits, risk assessments, or exhaustive review requests.
+---
+
+# Audit
+
+1. Define scope, read `docs/codex-review-protocol.md`, and inspect the review ledger.
+2. Inventory architecture, trust boundaries, changed areas, tests, and documented controls.
+3. Trace realistic correctness, security, privacy, clinical, data-loss, and reliability failures.
+4. Prove findings with exact files, lines, triggers, impact, and focused checks.
+5. Rank findings by severity and distinguish confirmed defects from residual risk.
+6. Remain read-only unless the user explicitly asks for fixes; keep provider checks approval-gated.

.agents/skills/audit/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Audit"
+  short_description: "Audit the Database repository with concrete evidence"
+  default_prompt: "Use $audit to perform an evidence-backed Database audit with severity-ranked reproducible findings."

.agents/skills/catalog.json

@@ -0,0 +1,31 @@
+{
+  "version": 1,
+  "categories": [
+    {
+      "name": "Everyday",
+      "skills": ["skills", "plan", "run", "test", "fix", "review", "task", "handover", "health", "audit", "export"]
+    },
+    {
+      "name": "Clinical and app",
+      "skills": ["clinical", "ui", "rag", "sources", "ingest", "reindex", "documents"]
+    },
+    {
+      "name": "Database, API, and security",
+      "skills": ["migrate", "drift", "access", "security", "privacy", "api", "data"]
+    },
+    {
+      "name": "Operations and release",
+      "skills": ["release", "deploy", "operations", "incident", "recovery", "performance", "dependencies"]
+    }
+  ],
+  "aliases": {
+    "workflows": "skills",
+    "database-flightplan": "plan",
+    "verify-triage-fix": "fix",
+    "clinical-change-proof": "clinical",
+    "live-design-sweep": "ui",
+    "rag-change-lab": "rag",
+    "operator-closeout": "operations",
+    "session-lifecycle": "task"
+  }
+}

.agents/skills/clinical-change-proof/SKILL.md

@@ -1,20 +1,10 @@
 ---
 name: clinical-change-proof
-description: Build evidence for Database changes affecting clinical output, ingestion, retrieval, ranking, answers, citations, source rendering, privacy, owner scoping, document access, Supabase, or production behavior. Use for implementation, review, readiness, or handoff work that must satisfy clinical governance and conservative failure requirements.
+description: Compatibility alias for the clinical skill. Use only when the user explicitly invokes the older clinical-change-proof name; otherwise use clinical for safety and governance evidence.
 ---
 
-# Clinical Change Proof
+# Clinical Change Proof Alias
 
-1. Generate the scoped evidence plan:
-   `npm run workflow:clinical-proof -- --write-evidence`
-2. Read only the relevant sections of `.github/pull_request_template.md`, `docs/clinical-governance.md`, and the domain runbook selected by the change.
-3. Trace the full behavior boundary: input, authorization/owner scope, retrieval or write path, output contract, source evidence, logs, and failure fallback.
-4. Prove locally that:
-   - private or service-role data remains server-only and fail-closed;
-   - source-backed claims and conservative unknown/outdated behavior are preserved;
-   - demo data remains distinct from clinical sources;
-   - rollback or feature-disable behavior is documented;
-   - affected behavior has focused regression coverage.
-5. Run the local checks in the plan, narrowest first. The offline RAG contract is mandatory when retrieval or answer behavior is involved.
-6. Treat every command in the plan's `approvalRequired` list as an independent confirmation-required action, including retrieval, deployment, release, remote Git, hosted CI, Supabase, OpenAI, and production-readiness commands. Never bundle approvals, infer approval from another action, or execute one indirectly through a local gate or wrapper.
-7. Complete the Clinical Governance Preflight and report evidence, gaps, rollback, and any SaMD implication.
+1. Read and follow `.agents/skills/clinical/SKILL.md`.
+2. Use `clinical` in recommendations and new documentation.
+3. Do not maintain a second copy of the clinical proof procedure here.

.agents/skills/clinical-change-proof/agents/openai.yaml

@@ -1,4 +1,6 @@
 interface:
-  display_name: "Clinical Change Proof"
-  short_description: "Build clinical governance evidence"
-  default_prompt: "Use $clinical-change-proof to assess this clinical change and produce the required local evidence, governance checks, and provider approval gates."
+  display_name: "Clinical Alias"
+  short_description: "Compatibility alias for Database clinical proof"
+  default_prompt: "Use $clinical-change-proof only as a compatibility alias for $clinical."
+policy:
+  allow_implicit_invocation: false

.agents/skills/clinical/SKILL.md

@@ -0,0 +1,13 @@
+---
+name: clinical
+description: Assemble clinical safety, privacy, source-governance, rollback, and production-readiness evidence for Database changes. Use for answer generation, retrieval, ingestion, clinical content, source rendering, or other patient-safety-sensitive behavior.
+---
+
+# Clinical
+
+1. Run `npm run workflow:clinical-proof -- --write-evidence` for the affected paths.
+2. Trace the clinical claim path from source and retrieval through generation and rendering.
+3. Check conservative failure behavior, ownership, privacy, citations, metadata, and rollback.
+4. Add the smallest deterministic local safety proof and run relevant offline domain checks.
+5. Complete the governance checklist required by `.github/pull_request_template.md` for handoff.
+6. Keep live Supabase, OpenAI, production-readiness, and provider evaluations approval-gated.

.agents/skills/clinical/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Clinical"
+  short_description: "Prove clinical safety and source governance"
+  default_prompt: "Use $clinical to build local clinical safety, privacy, source, rollback, and verification evidence for this change."

.agents/skills/data/SKILL.md

@@ -0,0 +1,13 @@
+---
+name: data
+description: Validate Database imports, seeds, transformations, reconciliation, deduplication, integrity, provenance, and rollback controls. Use for dataset changes, bulk operations, registry content, or data migration logic.
+---
+
+# Data
+
+1. Identify source format, trust level, schema, identifiers, ownership, transformations, and destination constraints.
+2. Test malformed, missing, duplicate, conflicting, oversized, partial, and rerun inputs with local fixtures.
+3. Check deterministic normalization, idempotency, transactions, reconciliation, provenance, and rollback.
+4. Measure counts and invariants before and after local dry runs without exposing sensitive values.
+5. Treat live imports, seeds, backfills, database writes, and production exports as approval-required.
+6. Report accepted/rejected records, integrity proof, rollback, and remaining operator action.

.agents/skills/data/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Data"
+  short_description: "Validate Database imports and data integrity"
+  default_prompt: "Use $data to verify this Database import, seed, transformation, or reconciliation workflow safely."

.agents/skills/database-flightplan/SKILL.md

@@ -1,18 +1,10 @@
 ---
 name: database-flightplan
-description: Plan safe, risk-scoped work in the Database repository by inspecting the current diff, selecting the smallest local verification ladder, and separating provider-backed checks into explicit approval gates. Use before non-trivial source, config, test, UI, database, retrieval, clinical, dependency, CI, or deployment changes, or when the user asks what checks a change needs.
+description: Compatibility alias for the plan skill. Use only when the user explicitly invokes the older database-flightplan name; otherwise use plan for risk-scoped offline verification planning.
 ---
 
-# Database Flightplan
+# Database Flightplan Alias
 
-1. Run the repository task-start preflight if it has not run for the current task. Inspect branch and full Git status; preserve unrelated work.
-2. Generate the plan:
-   `npm run workflow:flightplan -- --write-evidence`
-   Use `--files pathA,pathB` when planning proposed paths before editing.
-3. Confirm the risk classes match the actual behavior, not only filenames. Add a focused check when the change crosses an unclassified boundary.
-4. Execute the narrowest relevant check first. Use `--run` only when running the full printed local/offline sequence is proportionate.
-5. Never execute anything listed under `approvalRequired` without explicit user confirmation. Treat indirect provider calls the same way.
-6. After fixes, run `npm run verify:pr-local` when the change is ready for handoff. Add UI or domain gates only when the plan selects them.
-7. Report changed files, checks and results, checks not run, approval gates, branch state, and residual risk.
-
-Keep the planner authoritative for deterministic selection. Do not reproduce its path tables in the skill.
+1. Read and follow `.agents/skills/plan/SKILL.md`.
+2. Use `plan` in recommendations and new documentation.
+3. Do not maintain a second copy of the planning procedure here.

.agents/skills/database-flightplan/agents/openai.yaml

@@ -1,4 +1,6 @@
 interface:
-  display_name: "Database Flightplan"
-  short_description: "Plan safe repo changes and verification"
-  default_prompt: "Use $database-flightplan to inspect the current Database repo change and produce a risk-scoped local verification and approval plan."
+  display_name: "Plan Alias"
+  short_description: "Compatibility alias for Database planning"
+  default_prompt: "Use $database-flightplan only as a compatibility alias for $plan."
+policy:
+  allow_implicit_invocation: false

.agents/skills/database-skills.md

@@ -1,20 +1,6 @@
 # Database skills catalog
 
-This repository has the following Database-specific skills.
+Run `npm run skills` to render the current categories from `catalog.json` and explanations from each canonical skill's frontmatter.
+Run `npm run check:skills` to prove that every canonical skill and compatibility alias has valid local metadata.
 
-## Workflow and repo orchestration skills
-
-- `database-flightplan` — create a risk-scoped verification plan before non-trivial work.
-- `verify-triage-fix` — diagnose and fix local verification failures with minimal repros.
-- `clinical-change-proof` — assemble clinical/medical safety and production-readiness evidence.
-- `live-design-sweep` — inspect the running app across routes, breakpoints, accessibility modes, and interactions.
-- `rag-change-lab` — validate retrieval/ranking/grounding changes with focused offline checks.
-- `operator-closeout` — turn operator/provisioning/debt tasks into an ordered, approval-gated execution plan.
-- `session-lifecycle` — manage safe task start/handoff/cleanup and merge-proof transitions.
-- `workflows` — this new skill: indexed reference describing each Database workflow skill and when to use it.
-
-## Notes
-
-- These are the skills currently present in `.agents/skills` for this Database worktree.
-- Use these skills as lightweight orchestration and evidence-first planning helpers.
-- The first step for most non-trivial tasks remains `start-codex-task.ps1` (as required by AGENTS instructions).
+The `skills` skill uses this generated view, explains each unique skill in the chat, and recommends the smallest useful set for the current request. Compatibility aliases remain callable but are not counted or displayed as separate skills.

.agents/skills/dependencies/SKILL.md

@@ -0,0 +1,13 @@
+---
+name: dependencies
+description: Maintain Database dependencies safely by checking compatible stable versions, release notes, peer and engine constraints, old API usage, lockfile integrity, security, and focused verification. Use for dependency updates or reviews.
+---
+
+# Dependencies
+
+1. Inspect branch, status, Node/npm versions, `package.json`, lockfile, npm configuration, and active repo processes.
+2. Compare direct dependencies with stable compatible releases and group risky ecosystems coherently.
+3. Read migration notes for framework, runtime, build, test, lint, database, and security-sensitive updates.
+4. Search for old APIs and make only the smallest compatibility changes.
+5. When an update is requested, regenerate the existing npm lockfile and verify install integrity, focused behavior, then broader local gates. Keep review-only requests read-only.
+6. Do not use force flags, switch package managers, publish, deploy, or call provider APIs without approval.

.agents/skills/dependencies/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Dependencies"
+  short_description: "Maintain Database dependencies safely"
+  default_prompt: "Use $dependencies to review or update Database dependencies with compatibility, lockfile, and verification discipline."

.agents/skills/deploy/SKILL.md

@@ -0,0 +1,13 @@
+---
+name: deploy
+description: Review Database deployment configuration, environment parity, build and boot behavior, workers, migrations, health checks, and rollback readiness. Use for deployment changes, hosting configuration, runtime failures, or production setup.
+---
+
+# Deploy
+
+1. Map web, worker, database, build, start, health, environment, migration, and rollback responsibilities.
+2. Inspect deployment manifests and environment contracts without printing secrets.
+3. Run static config, offline build/boot, and environment-parity checks selected by risk.
+4. Check ordering, zero-downtime compatibility, health timeouts, restart behavior, and rollback.
+5. Treat hosted deployments, provider dashboards, production health, secrets, and live databases as approval-required.
+6. Report configuration proof, blockers, rollback readiness, and exact gated deployment action.

.agents/skills/deploy/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Deploy"
+  short_description: "Review Database deployment and rollback readiness"
+  default_prompt: "Use $deploy to verify Database deployment configuration, environment parity, boot behavior, and rollback readiness."

.agents/skills/documents/SKILL.md

@@ -0,0 +1,13 @@
+---
+name: documents
+description: Verify Database document access, storage, signed images, metadata, extraction, labels, downloads, and lifecycle behavior. Use for private documents, image loading, signed URLs, document routes, or storage defects.
+---
+
+# Documents
+
+1. Trace document identity, owner scope, metadata, storage key, route authorization, and rendered state.
+2. Check private access, signed URL expiry, missing objects, image/page selection, downloads, deletion, and stale metadata.
+3. Reproduce with local fixtures and focused route or component tests.
+4. Verify no service-role secret or private object path reaches the client.
+5. Treat live Supabase storage, production documents, and signed-URL calls as approval-required.
+6. Report access proof, storage assumptions, failure behavior, and remaining live verification.

.agents/skills/documents/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Documents"
+  short_description: "Verify Database document and storage behavior"
+  default_prompt: "Use $documents to trace and verify this document access, storage, signed image, or metadata behavior."

.agents/skills/drift/SKILL.md

@@ -0,0 +1,13 @@
+---
+name: drift
+description: Detect Database schema, migration, type, environment, and generated-artifact drift offline, while keeping live Supabase comparison approval-gated. Use when schema sources disagree or deployment drift is suspected.
+---
+
+# Drift
+
+1. Compare repository migrations, `supabase/schema.sql`, generated database types, manifests, and migration references.
+2. Run static drift and consistency checks that do not contact a provider.
+3. Distinguish committed schema drift, stale generated output, missing migration history, and environment-only mismatch.
+4. Add a deterministic manifest or test when the mismatch can recur silently.
+5. Ask before `npm run check:supabase-project`, live schema inspection, CLI linking, pulling, or diffing.
+6. Report exact sources of truth, mismatch, remediation order, and remaining live comparison.

.agents/skills/drift/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Drift"
+  short_description: "Detect Database schema and migration drift"
+  default_prompt: "Use $drift to compare local Database schema sources and isolate drift before any approved live comparison."

.agents/skills/export/SKILL.md

@@ -0,0 +1,13 @@
+---
+name: export
+description: Create a review-safe Database codebase archive with a manifest while excluding secrets, dependencies, build output, caches, logs, and machine-local state. Use when the user asks to package or export the repository for review.
+---
+
+# Export
+
+1. Inspect tracked, untracked, ignored, sensitive, generated, and oversized paths without printing secrets.
+2. Stage the archive outside the repository and include `EXPORT_MANIFEST.md`.
+3. Include only review-relevant source, configuration, tests, and documentation.
+4. Exclude `.env*`, credentials, dependencies, builds, caches, logs, browser artifacts, and local state.
+5. Verify the archive opens, inspect its file list, and confirm its size before handoff.
+6. Do not alter the worktree, commit, push, upload, or send the archive without explicit authorization.

.agents/skills/export/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Export"
+  short_description: "Create a safe review archive of the Database repo"
+  default_prompt: "Use $export to create a verified review-safe Database archive with sensitive and generated files excluded."

.agents/skills/fix/SKILL.md

@@ -0,0 +1,13 @@
+---
+name: fix
+description: Diagnose and repair a local Database verification failure using the smallest reproducer and safest scoped change. Use when lint, typecheck, tests, builds, browser checks, or offline evaluations fail or hang.
+---
+
+# Fix
+
+1. Capture the exact failing command, output, duration, and environment context.
+2. Run `npm run workflow:triage -- --log <path> --write-evidence` when a saved failure log exists.
+3. Classify the cause as code, test, tooling, resource, race, or provider/configuration.
+4. Reproduce with the narrowest deterministic check before editing.
+5. Make the smallest safe fix, rerun that check, then widen proportionally.
+6. Do not run provider-backed remediation without explicit approval.

.agents/skills/fix/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Fix"
+  short_description: "Triage and repair local Database check failures"
+  default_prompt: "Use $fix to reproduce, classify, and minimally repair this local Database verification failure."