feat: harden release governance and workflows

.agents/skills/agent-core/SKILL.md

@@ -0,0 +1,84 @@
+# SKILL.md
+# Agent Core Profile
+
+## Requirements Covered
+
+### Governance Requirements
+- REQ-012: Least-Privilege Agent Permissions
+- REQ-217: Agent Permissions Check
+- REQ-220: Policy Guardrails
+- REQ-244: Context Window Sizing
+- REQ-245: Live Context Fill Indicator
+- REQ-246: Auto Context Compression
+- REQ-247: Hard Context Ceiling
+
+## Core Principle
+The agent-core profile defines the fundamental capabilities and governance rules that all Specsmith agents must follow. This profile ensures that agents operate within the bounds of the Specsmith governance framework while maintaining the flexibility to adapt to different project contexts.
+
+## Profile Characteristics
+
+### Minimal Required Skills
+- preflight-gate
+- governed-agent-loop
+- requirement-author
+- testcase-author
+- traceability-auditor
+- context-pack-compiler
+- token-budget-auditor
+- skill-composer
+
+### Governance Compliance
+All agents using this profile must:
+1. Run preflight checks before any action that could have side effects
+2. Follow the governed-agent-loop execution pattern
+3. Maintain traceability between requirements, tests, and code changes
+4. Compose skills dynamically based on context
+5. Track token usage and budget efficiency
+
+## Implementation Details
+
+### Core Loop Execution
+1. Detect Specsmith project context
+2. Run session bootstrap procedures
+3. Emit governance anchor
+4. Classify user intent (read-only, change, release, destructive, research, planning)
+5. For non-read-only actions, run preflight
+6. Load only required context and skills
+7. Execute smallest scoped action
+8. Run verification gates
+9. Record evidence
+10. Save through Specsmith
+
+### Context Management
+- Build minimal context packs from project state, requirements, work items, ESDB records, and relevant skills
+- Never inject the whole repository when a scoped context is sufficient
+- Prefer requirement IDs, test IDs, recent WIs, and relevant files
+- Exclude stale, low-confidence, tombstoned, or contradicted ESDB records
+- Include stop conditions and known hazards
+- Track token budget and context utilization
+
+## Configuration
+
+### Default Behavior
+By default, the agent-core profile:
+- Enforces strict preflight checks for all non-read-only operations
+- Maintains minimal skill set for efficiency
+- Applies context-aware optimization
+- Tracks all actions for audit purposes
+
+### Override Options
+- Allow manual skill composition for advanced users
+- Support skill exclusion for specific scenarios
+- Enable temporary skill overrides with proper preflight
+
+## Security Considerations
+- All actions must pass preflight validation
+- Skill compositions must be traceable to valid work items
+- Unauthorized skill combinations are blocked
+- Skill composition history is tracked for audit purposes
+
+## Compliance Requirements
+- Every action must be traceable to a valid work item or requirement
+- All skill compositions must comply with the project's permission model
+- Token usage must be tracked and reported
+- Audit trails must be maintained for all operations

.agents/skills/ai-app-governed/SKILL.md

@@ -0,0 +1,85 @@
+# SKILL.md
+# AI App Governed Profile
+
+## Requirements Covered
+
+### Governance Requirements
+- REQ-012: Least-Privilege Agent Permissions
+- REQ-217: Agent Permissions Check
+- REQ-220: Policy Guardrails
+- REQ-244: Context Window Sizing
+- REQ-245: Live Context Fill Indicator
+- REQ-246: Auto Context Compression
+- REQ-247: Hard Context Ceiling
+
+## Core Principle
+The ai-app-governed profile is designed for agents operating within AI application development environments. It ensures compliance with Specsmith governance while managing the unique constraints and capabilities of AI application development.
+
+## Profile Characteristics
+
+### Required Skills
+- preflight-gate
+- governed-agent-loop
+- requirement-author
+- testcase-author
+- traceability-auditor
+- context-pack-compiler
+- token-budget-auditor
+- skill-composer
+- execution
+- git
+- release
+- playwright-testing
+- testing-configuration
+- testing-environment-isolation
+- testing-artifact-management
+- testing-report-generation
+- testing-cicd-integration
+- testing-parallel-execution
+- testing-coverage-reporting
+
+### Environment-Specific Features
+- AI application development environment integration
+- Context window optimization for AI app constraints
+- Compliance with AI application development policies
+- Integration with AI application testing frameworks
+
+## Implementation Details
+
+### AI App-Specific Execution
+1. Leverage AI application development capabilities for model training and deployment
+2. Optimize context windows to fit AI application development constraints
+3. Apply Specsmith governance rules within AI application environments
+4. Maintain traceability between AI app actions and Specsmith requirements
+
+### Context Management
+- Optimize context for AI application development requirements
+- Apply AI app-specific compression techniques
+- Ensure context fits within AI app constraints while maintaining traceability
+- Track AI application development usage and performance metrics
+
+## Configuration
+
+### Default Behavior
+By default, the ai-app-governed profile:
+- Integrates with AI application development tools and environments
+- Optimizes context for AI application development constraints
+- Maintains full Specsmith governance compliance
+- Tracks AI application development metrics
+
+### Override Options
+- Allow AI app-specific skill overrides
+- Support AI application development environment customization
+- Enable AI app-specific context optimization
+
+## Security Considerations
+- All AI application development actions must pass preflight validation
+- AI app-specific skill compositions must be traceable
+- AI application development environment compliance must be maintained
+- AI application development usage must be tracked and audited
+
+## Compliance Requirements
+- Every AI application development action must be traceable to a valid work item or requirement
+- AI application development integration must comply with development environment policies
+- All skill compositions must follow Specsmith governance
+- AI application development usage must be reported and audited

.agents/skills/aider-integration/SKILL.md

@@ -22,7 +22,7 @@ aider --read AGENTS.md       --read .agents/skills/specsmith-session-governance/
 ## Every Aider session — mandatory protocol
 1. Run before starting aider:
 ```bash
-specsmith kill-session 2>/dev/null || true
+specsmith kill-session  # idempotent; safe when no processes exist
 specsmith audit --project-dir .
 specsmith sync  --project-dir .
 specsmith checkpoint --project-dir .

.agents/skills/claude-code-governed/SKILL.md

@@ -0,0 +1,75 @@
+# SKILL.md
+# Claude Code Governed Profile
+
+## Requirements Covered
+
+### Governance Requirements
+- REQ-012: Least-Privilege Agent Permissions
+- REQ-217: Agent Permissions Check
+- REQ-220: Policy Guardrails
+- REQ-244: Context Window Sizing
+- REQ-245: Live Context Fill Indicator
+- REQ-246: Auto Context Compression
+- REQ-247: Hard Context Ceiling
+
+## Core Principle
+The claude-code-governed profile is designed for agents operating within the Claude Code environment. It ensures compliance with Specsmith governance while leveraging Claude's specific capabilities and constraints.
+
+## Profile Characteristics
+
+### Required Skills
+- preflight-gate
+- governed-agent-loop
+- requirement-author
+- testcase-author
+- traceability-auditor
+- context-pack-compiler
+- token-budget-auditor
+- skill-composer
+- claude-code-integration
+
+### Environment-Specific Features
+- Claude Code integration capabilities
+- Context window optimization for Claude's token limits
+- Compliance with Claude's usage policies
+- Integration with Claude's code editing features
+
+## Implementation Details
+
+### Claude-Specific Execution
+1. Leverage Claude Code's native capabilities for code editing
+2. Optimize context windows to fit Claude's token limits
+3. Apply Specsmith governance rules within Claude's environment
+4. Maintain traceability between Claude actions and Specsmith requirements
+
+### Context Management
+- Optimize context for Claude's 100K token limit
+- Apply Claude-specific compression techniques
+- Ensure context fits within Claude's constraints while maintaining traceability
+- Track Claude-specific token usage
+
+## Configuration
+
+### Default Behavior
+By default, the claude-code-governed profile:
+- Integrates with Claude Code's native editing features
+- Optimizes context for Claude's token limits
+- Maintains full Specsmith governance compliance
+- Tracks Claude-specific usage metrics
+
+### Override Options
+- Allow Claude-specific skill overrides
+- Support Claude Code environment customization
+- Enable Claude-specific context optimization
+
+## Security Considerations
+- All Claude Code actions must pass preflight validation
+- Claude-specific skill compositions must be traceable
+- Claude Code environment compliance must be maintained
+- Claude-specific token usage must be tracked
+
+## Compliance Requirements
+- Every Claude Code action must be traceable to a valid work item or requirement
+- Claude Code integration must comply with Claude's usage policies
+- All skill compositions must follow Specsmith governance
+- Claude-specific token usage must be reported

.agents/skills/claude-code-integration/SKILL.md

@@ -21,7 +21,7 @@ Or run: `specsmith mcp install-claude-code`
 ## Every Claude Code session — mandatory protocol
 1. Run at session start:
 ```bash
-specsmith kill-session 2>/dev/null || true
+specsmith kill-session  # idempotent; safe when no processes exist
 specsmith audit --project-dir .
 specsmith sync  --project-dir .
 specsmith checkpoint --project-dir .

.agents/skills/copilot-integration/SKILL.md

@@ -12,7 +12,7 @@ and hard rules.
 ## Every Copilot session — mandatory protocol
 1. Run at session start:
 ```bash
-specsmith kill-session 2>/dev/null || true
+specsmith kill-session  # idempotent; safe when no processes exist
 specsmith audit --project-dir .
 specsmith sync  --project-dir .
 specsmith checkpoint --project-dir .

.agents/skills/cursor-governed/SKILL.md

@@ -0,0 +1,75 @@
+# SKILL.md
+# Cursor Governed Profile
+
+## Requirements Covered
+
+### Governance Requirements
+- REQ-012: Least-Privilege Agent Permissions
+- REQ-217: Agent Permissions Check
+- REQ-220: Policy Guardrails
+- REQ-244: Context Window Sizing
+- REQ-245: Live Context Fill Indicator
+- REQ-246: Auto Context Compression
+- REQ-247: Hard Context Ceiling
+
+## Core Principle
+The cursor-governed profile is designed for agents operating within the Cursor IDE environment. It ensures compliance with Specsmith governance while leveraging Cursor's specific capabilities and constraints.
+
+## Profile Characteristics
+
+### Required Skills
+- preflight-gate
+- governed-agent-loop
+- requirement-author
+- testcase-author
+- traceability-auditor
+- context-pack-compiler
+- token-budget-auditor
+- skill-composer
+- cursor-integration
+
+### Environment-Specific Features
+- Cursor IDE integration capabilities
+- Context window optimization for Cursor's IDE constraints
+- Compliance with Cursor's IDE environment
+- Integration with Cursor's native IDE features
+
+## Implementation Details
+
+### Cursor-Specific Execution
+1. Leverage Cursor IDE's native capabilities for code editing
+2. Optimize context windows to fit Cursor's IDE constraints
+3. Apply Specsmith governance rules within Cursor's environment
+4. Maintain traceability between Cursor actions and Specsmith requirements
+
+### Context Management
+- Optimize context for Cursor's IDE environment
+- Apply Cursor-specific compression techniques
+- Ensure context fits within Cursor's constraints while maintaining traceability
+- Track Cursor-specific IDE usage
+
+## Configuration
+
+### Default Behavior
+By default, the cursor-governed profile:
+- Integrates with Cursor IDE's native features
+- Optimizes context for Cursor's IDE environment
+- Maintains full Specsmith governance compliance
+- Tracks Cursor-specific usage metrics
+
+### Override Options
+- Allow Cursor-specific skill overrides
+- Support Cursor IDE environment customization
+- Enable Cursor-specific context optimization
+
+## Security Considerations
+- All Cursor IDE actions must pass preflight validation
+- Cursor-specific skill compositions must be traceable
+- Cursor IDE environment compliance must be maintained
+- Cursor-specific IDE usage must be tracked
+
+## Compliance Requirements
+- Every Cursor IDE action must be traceable to a valid work item or requirement
+- Cursor IDE integration must comply with Cursor's usage policies
+- All skill compositions must follow Specsmith governance
+- Cursor-specific IDE usage must be reported

.agents/skills/cursor-integration/SKILL.md

@@ -18,7 +18,7 @@ For MCP in Cursor (Settings → MCP or `.cursor/mcp.json`):
 ## Every Cursor session — mandatory protocol
 1. Run at session start:
 ```bash
-specsmith kill-session 2>/dev/null || true
+specsmith kill-session  # idempotent; safe when no processes exist
 specsmith audit --project-dir .
 specsmith sync  --project-dir .
 specsmith checkpoint --project-dir .