Skill kit refresh: fix audit findings, add routing, remove okf-bundle

README.md

@@ -59,7 +59,7 @@ Auto-trigger on matching tasks (all `user-invocable: false`):
 | `solid` | Generic SOLID for TS/Python/Go modules — strategy maps, discriminated unions, fat-interface splits, dependency injection |
 | `type-safety-discipline` | Branded/newtype IDs, discriminated unions, parse-don't-validate — TS primary; references for Rust/Kotlin/Python |
 
-Plus `write-skill`, `multi-tool-bridge` (CLAUDE.md ↔ AGENTS.md ↔ skills bridging), `zoom-out`, and `caveman` under `productivity/`.
+The `productivity/` category contains `context-tree`, `multi-tool-bridge`, `scaffold`, `skill-agent-pipeline`, `skill-maintenance`, `write-skill`, and `zoom-out`.
 
 ### Plan lifecycle (the `plan-lifecycle` plugin)
 

plugins/docks/skills/engineering/accessibility/SKILL.md

@@ -4,8 +4,8 @@ description: "Use when making UI accessible: focus trap + restore-on-close in mo
 user-invocable: false
 metadata:
   pattern: tool-wrapper
-  updated: "2026-07-05"
-  content_hash: "985675bbaf37ed2650caa40c4ea85e4f54a8cad1e973195471f250679408c579"
+  updated: "2026-08-25"
+  content_hash: "0f7879efd0b3f50143ee7b916576d681603f376e416cfb36c0babefcaaeb1e59"
 ---
 
 # Accessibility
@@ -47,7 +47,7 @@ Native-element decision line: navigates → `<a href>`; performs an action → `
 
 ## Focus management
 
-**Modals: prefer native `<dialog>` + `showModal()`.** It delivers the full APG dialog contract for free: `::backdrop`, everything outside made `inert`, Escape closes, implicit `aria-modal="true"`, initial focus moves inside, focus returns to the invoker on close (Baseline since 2022; verify: https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/dialog).
+**Modals: prefer native `<dialog>` + `showModal()`.** It supplies `::backdrop`, makes everything outside `inert`, closes on Escape, exposes modal semantics, and moves initial focus inside (Baseline since 2022; verify: https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/dialog). Focus restoration to the invoker is not guaranteed: capture the invoking element reference and restore focus explicitly on close.
 
 ```html
 <dialog id="confirm" aria-labelledby="confirm-title">

plugins/docks/skills/engineering/code-clarity/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: code-clarity
-description: "Use when code is hard to understand without narration; improving names, types, function boundaries, comments, docstrings, error messages, or test names; deciding what belongs in code versus documentation; or removing prose that merely restates mechanics. Not for structural dead-code/duplication/SOLID audits (use refactor), correctness/security review (use code-review), or type design alone (use type-safety-discipline)."
+description: "Use when code is hard to understand without narration; improving names, types, function boundaries, comments, docstrings, error messages, or test names; deciding what belongs in code versus documentation; or removing prose that merely restates mechanics. Not for dead-code/duplication sweeps (use refactor), demonstrated SOLID design patterns (use solid), correctness/security review (use code-review), or type design alone (use type-safety-discipline)."
 user-invocable: false
 metadata:
   pattern: tool-wrapper
-  updated: "2026-07-14"
-  content_hash: "d926bb858cddf15a5cad1bc03f293458212bcf042bcd895b1e02b1f71aaefa83"
+  updated: "2026-08-25"
+  content_hash: "84451e4b342b8bb8ff2fd3160c13d6298b0738ff0f5c03dcbb7bf7963c9a42f4"
 ---
 
 # Code Clarity

plugins/docks/skills/engineering/commit-discipline/SKILL.md

@@ -4,8 +4,8 @@ description: "Use when splitting work into small reviewable/atomic commits, deci
 user-invocable: false
 metadata:
   pattern: tool-wrapper
-  updated: "2026-07-05"
-  content_hash: "10cb9a6d895fa037bdfe8c12d29d0abb7ac5e5df16314b6255c6c95abf726937"
+  updated: "2026-08-25"
+  content_hash: "976d6d6824383ff2213244f57e58004fc0453c3eb487e5e4c2516aff46ca3f9b"
 ---
 
 # Commit & PR Discipline
@@ -33,10 +33,11 @@ into independently green commits, they are one commit, not two.
 </constraint>
 
 <constraint>
-Never rewrite history others may have built on. Fixup, autosquash, amend, and
-rebase are for your own not-yet-merged branch. Push rewritten history only with
-`git push --force-with-lease` (never bare `--force` — it silently discards a
-collaborator's or CI bot's newer commits), and only to your own PR branch.
+Never rewrite history others may have built on. Never force-push or rewrite any
+history without explicit user confirmation, even on your own PR branch. Once
+confirmed, amend, autosquash, and rebase are limited to your own not-yet-merged
+branch. Push rewritten history only with `git push --force-with-lease` (never
+bare `--force` — it silently discards a collaborator's or CI bot's newer commits).
 </constraint>
 
 ## When to use / when NOT
@@ -128,14 +129,15 @@ type or missed `!` mis-versions the next release.
 ## Fixup / autosquash — clean up before review, not after
 
 Address review feedback and self-caught mistakes as fixups while the PR is open,
-then fold them before merge (or let squash-merge do it — see the merge table):
+then, after explicit user confirmation, fold them before merge (or let
+squash-merge do it — see the merge table):
 
 ```bash
 git commit --fixup=<sha>            # fix goes into <sha> on autosquash
 git commit --fixup=amend:<sha>      # also reword <sha>'s message (editor opens)
 git commit --fixup=reword:<sha>     # reword ONLY — no content change
-git rebase -i --autosquash <base>   # reorders fixup! commits onto their targets
-git push --force-with-lease         # your own PR branch only (constraint above)
+git rebase -i --autosquash <base>   # explicit user confirmation required first
+git push --force-with-lease         # own PR branch; explicit confirmation required
 ```
 
 - `--autosquash` matches on the `fixup!`/`squash!` subject prefix against earlier
@@ -144,13 +146,18 @@ git push --force-with-lease         # your own PR branch only (constraint above)
 - `rebase.autoSquash=true` makes interactive rebases autosquash by default;
   whether your Git also applies it to non-interactive rebases varies by version
   (verify: `git rebase -h | grep -i autosquash`, or your installed `git-rebase(1)`).
-- Stacked branches: `git rebase --update-refs` force-updates the other branches
-  pointing at rebased commits (checked-out worktrees excluded).
+- After explicit user confirmation, stacked branches may use
+  `git rebase --update-refs` to force-update the other branches pointing at
+  rebased commits (checked-out worktrees excluded).
 - During review, PREFER pushing fixup commits over force-pushing rewrites:
   reviewers see what changed since their last pass; rewriting mid-review destroys
   their per-commit anchor points.
 
 ## PR hygiene
+Plan-lifecycle branches are excluded from the generic landing guidance below.
+Defer landing them to `plan-manager`, which must obtain fresh explicit user
+approval to "Merge now"; do not apply generic merge, squash, or rebase advice to
+those branches.
 
 GitHub's guidance (verified 2026-07-05; re-verify:
 <https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/getting-started/helping-others-review-your-changes>):
@@ -210,11 +217,11 @@ craft into the PR title/description, which become the squashed message.
 | Gotcha | Consequence | Right move |
 |---|---|---|
 | `git commit -am` as reflex | stages everything tracked — unrelated edits ride along | `git add -p`, review `git diff --cached`, then commit |
-| Amending or rebasing after pushing to a shared branch | collaborators' pulls diverge; their work needs manual rescue | rewrite only unpushed/own-PR-branch history; `--force-with-lease` |
+| Amending or rebasing after pushing to a shared branch | collaborators' pulls diverge; their work needs manual rescue | never rewrite shared history; on your own PR branch, rewrite only after explicit user confirmation and use `--force-with-lease` |
 | Conventional-commit type chosen by vibe (`chore` for a bug fix) | release tooling mis-versions or drops the change from the changelog | `fix`/`feat` per actual effect; check what the repo's tooling parses |
 | PR description = pasted commit list | reviewer gets no narrative, reads the diff cold | write the briefing (what/why, review order, verification) |
-| Force-pushing a rewrite mid-review | reviewer's inline comments detach; they re-review from scratch | push fixup commits during review; fold them at merge time |
-| Merging with "fixup!" commits still unfolded | noise commits land on the base branch permanently | `rebase -i --autosquash` before merge, or use squash-merge |
+| Force-pushing a rewrite mid-review | reviewer's inline comments detach; they re-review from scratch | push fixup commits during review; after explicit confirmation, fold them at merge time |
+| Merging with "fixup!" commits still unfolded | noise commits land on the base branch permanently | after explicit confirmation, `rebase -i --autosquash` before merge, or use squash-merge |
 | Splitting so far that a commit is not independently green | bisect lands on red commits; revert takes multiple steps | the green-tree constraint bounds the split |
 
 ## Verification
@@ -224,7 +231,7 @@ required (use the project's CI/validators too, if present):
 
 ```bash
 git log --oneline @{upstream}..     # each subject: imperative, one idea, no "and"
-git rebase -i --exec 'npm test' @{upstream}   # green at EVERY commit, not just HEAD
+git rebase -i --exec 'npm test' @{upstream}   # after confirmation; green at every commit
 git diff @{upstream}.. --stat       # size sanity: is this one reviewable unit?
 ```
 

plugins/docks/skills/engineering/dep-vuln-workflow/SKILL.md

@@ -4,8 +4,8 @@ description: Use when running bun/pnpm/npm/yarn audit, pip-audit, cargo audit, o
 user-invocable: false
 metadata:
   pattern: tool-wrapper
-  updated: "2026-08-20"
-  content_hash: "5c5d8cc137ca9ab04ced232c915cab1dd1597c2d03222e331661694f56760e26"
+  updated: "2026-08-25"
+  content_hash: "0e50c0d72dd4c8fae297e5a3875c6bed9411dda8303d3d13a146c2320d7445e7"
 ---
 
 # Dependency Vulnerability & Upgrade Workflow

plugins/docks/skills/engineering/dep-vuln-workflow/references/npm-pnpm-playbook.md

@@ -59,7 +59,7 @@ bun run lint && bun run typecheck && bun run build && bun audit
 pnpm lint && pnpm typecheck && pnpm build && pnpm audit
 ```
 
-Commit once: `chore(deps): bump X/Y/Z + patch CVE-XXXX-YYYY` with the advisory link in the body.
+Commit in at least two independently revertible units: the security bump stands alone with the advisory link in its body, and hygiene upgrades go in a separate commit.
 
 ## JS Major Upgrade Surprises
 

plugins/docks/skills/engineering/design-tokenization/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: design-tokenization
-description: "Use when working with colors, Tailwind classes, CSS variables, dark mode, semantic/brand tokens, or theming shadcn/ui, Base UI, or Radix components. Also audits hex literals, soft tints, paired foreground tokens, and Tailwind v4 @source. Preserve the project's bg-X/text-on-X or bg-X/text-X-foreground convention. Not for React composition/effects/RSC (use react-component-patterns) or spacing/motion/radius polish (use make-interfaces-feel-better)."
+description: "Use when working with colors, Tailwind classes, CSS variables, dark mode, semantic/brand tokens, or theming shadcn/ui, Base UI, or Radix components. Also audits hex literals, soft tints, paired foreground tokens, and Tailwind v4 @source. Preserve the project's bg-X/text-on-X or bg-X/text-X-foreground convention. Not for accessibility semantics/keyboard/ARIA (use accessibility), React composition/effects/RSC (use react-component-patterns), or spacing/motion/radius polish (use make-interfaces-feel-better)."
 user-invocable: false
 metadata:
   pattern: tool-wrapper
-  updated: "2026-07-24"
-  content_hash: "a1ee372206679472e3790b3af150bee2030a16e638f8659a006e5da38887c461"
+  updated: "2026-08-25"
+  content_hash: "dd48a1e744a7ce5044e4c42ac32e5cd6d1b3c8f658f8bee90b4abb385dcd57a2"
 ---
 
 # Design Tokenization
@@ -176,4 +176,4 @@ Four-step procedure. Don't skip the audit — proposing token names without seei
 - Tailwind v4 `@source` (automatic source detection + explicit registration): https://tailwindcss.com/docs/detecting-classes-in-source-files
 - shadcn/ui design tokens: https://ui.shadcn.com/docs/theming (uses the `*-foreground` convention)
 - Brandfetch / logo.dev — verify official hex before adding a brand token
-- Companion skills: `make-interfaces-feel-better` (visual polish), `lint-no-suppressions` (when CI greps feel "annoying" — fix the violation, don't disable)
+- Companion skills: `accessibility` (semantics, keyboard behavior, and ARIA), `make-interfaces-feel-better` (visual polish), `lint-no-suppressions` (when CI greps feel "annoying" — fix the violation, don't disable)

plugins/docks/skills/engineering/fix-workflow/SKILL.md

@@ -4,8 +4,8 @@ description: Use when fixing a specific bug, security finding, performance regre
 user-invocable: false
 metadata:
   pattern: tool-wrapper
-  updated: "2026-08-20"
-  content_hash: "4f92bd65d07cf1fe79dc6f103f6f78bfd03b2101b4c4d86786abdeb113216de7"
+  updated: "2026-08-25"
+  content_hash: "3c08cc3be5b2c17de11bc9ef12ef7f6be0b9810adcccbe41f57c73e801674766"
 ---
 
 # Fix Workflow
@@ -117,6 +117,9 @@ For each finding, fill in this template before writing any code:
 | Revert trigger | Specific test/lint that, if it flips, triggers `git restore` |
 | Blast radius | What else touches this code path |
 
+Normalize upstream findings into these fields before planning. For a `security` finding, map `location` plus `evidence` to **Files/Before**, `remediation` to **After**, `CWE` plus `exploitation` to **Why/Blast radius**, and derive **Test strategy/Revert trigger** from the exploitation path and its narrowest deterministic signal. For a `code-review` line (`SEVERITY / category / locator / defect / fix`), map `locator` plus `defect` to **Files/Before**, `fix` to **After**, `SEVERITY` plus `category` and `defect` to **Why/Blast radius**, and derive **Test strategy/Revert trigger** from the defect's observable behavior.
+
+Route any fix with non-local effects through the `plan-lifecycle` skill's `plan-manager`; do not treat the local fix table as approval to bypass that lifecycle.
 Show the user the table grouped by tier. If the plan contains any Tier 2/3 fix, print it as your final message and end the turn — do not call Edit/Write until the user approves (a Tier-1-only plan may proceed directly).
 
 **For finding-type-specific test strategies and revert triggers**, load the matching reference file from the routing table above.

plugins/docks/skills/engineering/fix-workflow/references/security-fix-templates.md

@@ -12,7 +12,7 @@ Before writing the Step 4 row for a security finding, run this checklist:
 | Advisory URL pinned | The "Why" field cites the advisory; no link = no traceable rationale |
 | Reachability confirmed | Build-time-only deps don't ship; if vuln isn't in runtime bundle, it's a hygiene fix not a security fix |
 | Fixed-version available | If upstream has no fix yet, plan a `replace` / `pnpm.overrides` / `[patch.crates-io]` workaround instead |
-| OWASP category tagged | Helps the commit message + future grep (`OWASP A03:2021` for injection, etc.) |
+| OWASP category tagged | Helps the commit message + future grep (`OWASP A05:2025` for injection, etc.) |
 
 ## Test-Strategy Template
 
@@ -54,5 +54,5 @@ The universal "if test X fails, revert" rule isn't enough for security. Add thes
 - `../SKILL.md` — universal 6-step procedure
 - `dep-vuln-workflow` skill — severity triage and ecosystem-readiness
 - `lint-no-suppressions` skill — never silence security linter output
-- OWASP Top 10 (2021): https://owasp.org/Top10/
+- OWASP Top 10 (2025): https://owasp.org/Top10/2025/
 - GitHub Advisory Database: https://github.com/advisories