SAN-1273 — Add the lightweight MDE skill router with S4 verification

.agents/skills/_template/SKILL.md

@@ -0,0 +1 @@
+../../../.claude/skills/_template/SKILL.md

.agents/skills/cloudinary/SKILL.md

@@ -0,0 +1 @@
+../../../.claude/skills/cloudinary/SKILL.md

.agents/skills/code-review/SKILL.md

@@ -0,0 +1 @@
+../../../.claude/skills/code-review/SKILL.md

.agents/skills/copilotkit/SKILL.md

@@ -0,0 +1 @@
+../../../.claude/skills/copilotkit/SKILL.md

.agents/skills/events/SKILL.md

@@ -0,0 +1 @@
+../../../.claude/skills/events/SKILL.md

.agents/skills/gemini/SKILL.md

@@ -0,0 +1 @@
+../../../.claude/skills/gemini/SKILL.md

.agents/skills/lean-dev-flow/SKILL.md

@@ -0,0 +1 @@
+../../../.claude/skills/lean-dev-flow/SKILL.md

.agents/skills/maps/SKILL.md

@@ -0,0 +1 @@
+../../../.claude/skills/maps/SKILL.md

.agents/skills/mastra/SKILL.md

@@ -0,0 +1 @@
+../../../.claude/skills/mastra/SKILL.md

.agents/skills/mde-maps/SKILL.md

@@ -0,0 +1 @@
+../../../.claude/skills/mde-maps/SKILL.md

.agents/skills/mde-real-estate/SKILL.md

@@ -0,0 +1 @@
+../../../.claude/skills/mde-real-estate/SKILL.md

.agents/skills/mde-supabase/SKILL.md

@@ -0,0 +1 @@
+../../../.claude/skills/mde-supabase/SKILL.md

.agents/skills/mde-vercel/SKILL.md

@@ -0,0 +1 @@
+../../../.claude/skills/mde-vercel/SKILL.md

.agents/skills/mde-worktree-pr-flow/SKILL.md

@@ -0,0 +1 @@
+../../../.claude/skills/mde-worktree-pr-flow/SKILL.md

.agents/skills/mermaid-diagrams/SKILL.md

@@ -0,0 +1 @@
+../../../.claude/skills/mermaid-diagrams/SKILL.md

.agents/skills/nextjs/SKILL.md

@@ -0,0 +1 @@
+../../../.claude/skills/nextjs/SKILL.md

.agents/skills/playwright-cli/SKILL.md

@@ -0,0 +1 @@
+../../../.claude/skills/playwright-cli/SKILL.md

.agents/skills/real-estate/SKILL.md

@@ -0,0 +1 @@
+../../../.claude/skills/real-estate/SKILL.md

.agents/skills/research/SKILL.md

@@ -0,0 +1 @@
+../../../.claude/skills/research/SKILL.md

.agents/skills/stripe/SKILL.md

@@ -0,0 +1 @@
+../../../.claude/skills/stripe/SKILL.md

.agents/skills/supabase/SKILL.md

@@ -0,0 +1 @@
+../../../.claude/skills/supabase/SKILL.md

.agents/skills/systematic-debugging/SKILL.md

@@ -0,0 +1 @@
+../../../.claude/skills/systematic-debugging/SKILL.md

.agents/skills/task-verifier/SKILL.md

@@ -0,0 +1 @@
+../../../.claude/skills/task-verifier/SKILL.md

.agents/skills/tasks/SKILL.md

@@ -0,0 +1 @@
+../../../.claude/skills/tasks/SKILL.md

.agents/skills/tdd/SKILL.md

@@ -0,0 +1 @@
+../../../.claude/skills/tdd/SKILL.md

.agents/skills/testing/SKILL.md

@@ -0,0 +1 @@
+../../../.claude/skills/testing/SKILL.md

.agents/skills/using-mde-skills/SKILL.md

@@ -0,0 +1 @@
+../../../.claude/skills/using-mde-skills/SKILL.md

.agents/skills/wireframe/SKILL.md

@@ -0,0 +1 @@
+../../../.claude/skills/wireframe/SKILL.md

.agents/skills/writing-skills/SKILL.md

@@ -0,0 +1 @@
+../../../.claude/skills/writing-skills/SKILL.md

.claude/skills/copilotkit/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: copilotkit
 description: >-
-  Use when MDE work involves CopilotKit, /api/copilotkit, CopilotKit v2 React hooks, generative UI, frontend tools or actions, shared agent state, AG-UI transport, runtime wiring, CLI verification, HITL, or the CopilotKit-to-Mastra bridge.
+  Use for any MDE request clearly involving CopilotKit, including implementation, configuration, /api/copilotkit, CopilotKit v2 React hooks, generative UI, frontend tools/actions, shared agent state, AG-UI transport, runtime wiring, CLI verification, HITL, CopilotKit-to-Mastra bridges, and CopilotKit-specific bugs/errors/failures. A known CopilotKit failure stays with this domain owner rather than generic systematic-debugging.
 metadata:
   mde-version: "2.0.0"
   upstream-commit: "8a7446186cd3e0d368ec885e61c5913f0918ef5d"
@@ -14,7 +14,7 @@ metadata:
 
 1. Inspect the installed MDE CopilotKit packages and current runtime/provider code.
 2. Read the pinned official CopilotKit core skill in `references/official/copilotkit/SKILL.md`.
-3. For wiring/debugging, also read `references/official/copilotkit-cli/SKILL.md` and run `npx copilotkit@latest verify --json` when safe and applicable.
+3. For wiring/debugging, also read `references/official/copilotkit-cli/SKILL.md` and run `npx copilotkit@4.10.0 verify --json` when safe and applicable.
 4. Use current official CopilotKit/AG-UI docs or source when the pinned skill directs you there.
 5. Apply the MDE-specific invariants below.
 

.claude/skills/copilotkit/references/official/copilotkit-cli/SKILL.md

@@ -1,13 +1,13 @@
 ---
 name: copilotkit-cli
-description: "Use for the CopilotKit CLI — `npx copilotkit@latest`. Covers proving a project's wiring with `verify` before debugging anything by hand, scaffolding with `create`, signing in and selecting a hosted Intelligence project, agent-assisted onboarding of an existing app, generating type-safe agent ids, and importing thread history. Reach for `verify` first whenever a CopilotKit app is not working."
+description: "Use for the CopilotKit CLI — `npx copilotkit@4.10.0`. Covers proving a project's wiring with `verify` before debugging anything by hand, scaffolding with `create`, signing in and selecting a hosted Intelligence project, agent-assisted onboarding of an existing app, generating type-safe agent ids, and importing thread history. Reach for `verify` first whenever a CopilotKit app is not working."
 version: 1.0.0
 ---
 
 # CopilotKit CLI
 
 ```bash
-npx copilotkit@latest <command>
+npx copilotkit@4.10.0 <command>
 ```
 
 `--help` on any command prints its flags. The commands below are the ones worth knowing
@@ -16,7 +16,7 @@ before you start reading someone's project by hand.
 ## `verify` — do this before debugging
 
 ```bash
-npx copilotkit@latest verify --json
+npx copilotkit@4.10.0 verify --json
 ```
 
 One command replaces the manual survey. It settles up to eleven things: a hosted project is
@@ -74,7 +74,7 @@ Reach past it only once it is clean.
 ## Starting a project
 
 ```bash
-npx copilotkit@latest init          # `create` is an alias for it
+npx copilotkit@4.10.0 init          # `create` is an alias for it
 ```
 
 Prompts for a name and framework, scaffolds a starter, signs you in when needed, and connects
@@ -86,7 +86,7 @@ To add CopilotKit to an existing app, either follow the [quickstart](/quickstart
 the job to your coding agent:
 
 ```bash
-npx copilotkit@latest onboard start
+npx copilotkit@4.10.0 onboard start
 ```
 
 That runs an agent-guided flow over the repository you are already in, with checkpoints and
@@ -96,11 +96,11 @@ an app that already has CopilotKit.
 ## Signing in and picking a project
 
 ```bash
-npx copilotkit@latest login --json   # agent-readable JSON lines, no browser launch
-npx copilotkit@latest login          # interactive: opens a browser
-npx copilotkit@latest whoami         # who is signed in, and the active organization
-npx copilotkit@latest project select # pick or create a hosted project for this directory
-npx copilotkit@latest project list --json
+npx copilotkit@4.10.0 login --json   # agent-readable JSON lines, no browser launch
+npx copilotkit@4.10.0 login          # interactive: opens a browser
+npx copilotkit@4.10.0 whoami         # who is signed in, and the active organization
+npx copilotkit@4.10.0 project select # pick or create a hosted project for this directory
+npx copilotkit@4.10.0 project list --json
 ```
 
 Use `login --json` when you are driving the CLI. Bare `login` tries to open a browser, which

.claude/skills/copilotkit/references/official/copilotkit/SKILL.md

@@ -85,7 +85,7 @@ Worth knowing so a search has somewhere to land:
 
 ## Before you debug anything
 
-Run the CLI's wiring check first — `npx copilotkit@latest verify --json`. It settles up to
+Run the CLI's wiring check first — `npx copilotkit@4.10.0 verify --json`. It settles up to
 eleven things in one command and is almost always faster than reading the project. See the
 `copilotkit-cli` skill.
 

.claude/skills/gemini/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: gemini
 description: >-
-  Use when MDE work changes or verifies Gemini models, Google AI SDK/provider usage, function calling, structured output, multimodal input/output, grounding, embeddings, research agents, streaming, or Gemini-specific failures. Do not use for generic Mastra orchestration, generic AI prompting, or Google Maps behavior unless Gemini is part of the implementation.
+  Use for any MDE request clearly involving Gemini, including models, Google AI SDK/provider usage, function calling, structured output, multimodal I/O, grounding, embeddings, research agents, streaming, and Gemini-specific bugs/errors/failures. A known Gemini failure stays with this domain owner rather than generic systematic-debugging; do not use for generic Mastra orchestration or unrelated Google Maps behavior.
 metadata:
   mde-version: "1.0.0"
   upstream-commit: "80dd31dda25bbe1410207df0adb3e0d591c2c634"

.claude/skills/mastra/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: mastra
 description: >-
-  Use when MDE work changes or diagnoses Mastra agents, tools, workflows, memory, storage, RequestContext, streaming, suspend/resume, HITL, evals, traces, or the CopilotKit-to-Mastra runtime bridge.
+  Use for any MDE request clearly involving Mastra, including agents, tools, workflows, memory, storage, RequestContext, streaming, suspend/resume, HITL, evals, traces, runtime bridges, and Mastra-specific bugs/errors/failures. A known Mastra failure stays with this domain owner rather than generic systematic-debugging.
 metadata:
   mde-version: "2.0.0"
   upstream-commit: "08428f9b47cdae1131d12cbd9f8e0886ff476211"

.claude/skills/supabase/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: supabase
 description: >-
-  Use when MDE work involves Supabase Database, Auth, RLS, migrations, RPC/functions, Realtime, Storage, pgvector, Edge Functions, logs, live database behavior, or Supabase-backed Postgres schema, SQL, indexes, locking, performance, and tenant isolation.
+  Use for any MDE request clearly involving Supabase, including Database, Auth, RLS, migrations, RPC/functions, Realtime, Storage, pgvector, Edge Functions, logs, live database behavior, Postgres schema/SQL/indexes/locking/performance/tenant isolation, and Supabase-specific bugs/errors/failures. Known Supabase/RLS failures stay with this domain owner rather than generic systematic-debugging.
 metadata:
   mde-version: "2.0.0"
   upstream-commit: "8331f910845103c08d51f6ca1d86ebb7d1f745e3"

.claude/skills/using-mde-skills/SKILL.md

@@ -0,0 +1,31 @@
+---
+name: using-mde-skills
+description: Route ambiguous, non-trivial MDE engineering requests to exactly one canonical execution owner while preserving S4 independent verification. Use only when ownership is genuinely ambiguous; do not use for simple S0 explanation, reading, or factual questions that can be answered directly.
+---
+
+# Using MDE Skills
+
+Use this skill only when ownership is ambiguous and the request is non-trivial. Simple S0 explanation, reading, or factual questions should be answered directly without invoking this router. If one canonical domain or workflow skill is clearly responsible, invoke that skill directly and bypass this router; S4 safety still applies, and the canonical execution owner must hand S4 work to `task-verifier` for independent verification before completion.
+
+## Routing contract
+
+The router chooses one owner and stops.
+
+- ambiguous substantial implementation → `tasks`
+- unknown failure → `systematic-debugging`
+- research/evidence → `research`
+- existing PR/diff → `code-review`
+- Done/merge/production proof → `task-verifier`
+- obvious domain/vendor request → invoke the matching canonical skill directly
+
+Do not plan implementation steps, choose support arrays, manage parallelization, manage Linear handoff, or duplicate domain/vendor instructions here.
+
+## S4 safety
+
+Treat payments/financial side effects, auth/RLS/tenant-boundary changes, secrets/security controls, destructive or irreversible production-data changes, and duplicate/retry-sensitive or irreversible external side effects as S4.
+
+S4 work requires independent verification. The execution owner cannot self-certify completion. If independent verification fails, return the work to the execution owner for correction and re-verification.
+
+## Retired behavior
+
+Do not restore the old eight-field routing schema, large deterministic support matrix, adaptive routing memory, or router-owned execution policy from PR #45.

.claude/skills/using-mde-skills/evals/routing-evals.json

@@ -0,0 +1,107 @@
+[
+  {
+    "name": "direct-owner",
+    "input": "Fix the CopilotKit generative UI rendering bug",
+    "expected_owner": "copilotkit",
+    "risk": "S2",
+    "requires_independent_verifier": false
+  },
+  {
+    "name": "ambiguous-implementation",
+    "input": "Implement the remaining SAN-1273 routing work across the repo",
+    "expected_owner": "tasks",
+    "risk": "S2",
+    "requires_independent_verifier": false
+  },
+  {
+    "name": "unknown-failure",
+    "input": "The build suddenly fails and we do not know why",
+    "expected_owner": "systematic-debugging",
+    "risk": "S2",
+    "requires_independent_verifier": false
+  },
+  {
+    "name": "research-only",
+    "input": "Research current official guidance for this dependency before changing code",
+    "expected_owner": "research",
+    "risk": "S1",
+    "requires_independent_verifier": false
+  },
+  {
+    "name": "pr-review",
+    "input": "Review this pull request diff for regressions",
+    "expected_owner": "code-review",
+    "risk": "S2",
+    "requires_independent_verifier": false
+  },
+  {
+    "name": "done-proof",
+    "input": "Verify this exact head is ready to merge",
+    "expected_owner": "task-verifier",
+    "risk": "S3",
+    "requires_independent_verifier": false
+  },
+  {
+    "name": "simple-s0",
+    "input": "Explain what this function does",
+    "expected_owner": "direct",
+    "risk": "S0",
+    "requires_independent_verifier": false
+  },
+  {
+    "name": "payment-s4",
+    "input": "Change Stripe payment retry behavior in production",
+    "expected_owner": "stripe",
+    "risk": "S4",
+    "requires_independent_verifier": true
+  },
+  {
+    "name": "auth-s4",
+    "input": "Change Supabase RLS tenant access rules",
+    "expected_owner": "supabase",
+    "risk": "S4",
+    "requires_independent_verifier": true
+  },
+  {
+    "name": "stale-owner",
+    "input": "Route this to mde-task-lifecycle",
+    "expected_owner": "__INVALID__",
+    "risk": "S1",
+    "requires_independent_verifier": false
+  },
+  {
+    "name": "copilotkit-known-failure",
+    "input": "CopilotKit generative UI is broken after the latest change",
+    "expected_owner": "copilotkit",
+    "risk": "S2",
+    "requires_independent_verifier": false
+  },
+  {
+    "name": "mastra-known-failure",
+    "input": "Mastra workflow streaming is failing",
+    "expected_owner": "mastra",
+    "risk": "S2",
+    "requires_independent_verifier": false
+  },
+  {
+    "name": "supabase-known-failure",
+    "input": "Supabase RLS is denying the wrong tenant",
+    "expected_owner": "supabase",
+    "risk": "S4",
+    "requires_independent_verifier": true
+  },
+  {
+    "name": "gemini-known-failure",
+    "input": "Gemini structured output API is returning invalid JSON",
+    "expected_owner": "gemini",
+    "risk": "S2",
+    "requires_independent_verifier": false
+  },
+  {
+    "name": "unknown-build-failure-adversarial",
+    "input": "The application build is failing and we do not know which subsystem is responsible",
+    "expected_owner": "systematic-debugging",
+    "risk": "S2",
+    "requires_independent_verifier": false
+  }
+]