v1.0.1: Quality, Packaging & skills.sh Readiness

.agents/skills/00-orchestration/fivem-audit/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: fivem-audit
-description: Perform a comprehensive FiveM resource audit across architecture, security, networking, performance, persistence, UI, framework compatibility, lifecycle, testing, and release readiness.
+description: 'Perform a comprehensive FiveM resource audit across architecture, security, networking, performance, persistence, UI, framework compatibility, lifecycle, testing, and release readiness.'
 ---
 # fivem-audit
 ## Purpose
@@ -16,20 +16,11 @@ Review an existing resource systematically and prioritize findings by exploitabi
 7. Audit resource restart, player disconnect, missing dependency, and partial-failure behavior.
 8. Report findings as BLOCKER/HIGH/MEDIUM/LOW with file/line evidence, impact, and remediation.
 
-## Non-negotiable engineering rules
-
-- Treat every client and NUI payload as untrusted input. Security-sensitive state is server authoritative.
-- Target current CfxLua / Lua 5.4. Do not add `lua54 'yes'`; it is deprecated and unnecessary.
-- Prefer `fxmanifest.lua` with `fx_version 'cerulean'` for modern resources unless compatibility evidence requires otherwise.
-- Never invent natives, exports, events, framework APIs, SQL columns, or configuration keys. Verify uncertain APIs against project code or authoritative documentation.
-- Keep client, server, shared, UI, persistence, and framework-adapter responsibilities explicit.
-- Minimize polling and frame loops. `Wait(0)` is reserved for work that genuinely must execute every rendered frame.
-- Across network boundaries, use network-safe identifiers and validate existence/ownership/state before mutation.
-- Design every entity workflow for create → network/own → use → migration → cleanup/delete, including resource stop and player disconnect.
-- NUI callbacks must always return a response; use JSON-encodable contracts and explicit error shapes.
-- Prefer small, typed/validated event payloads over large replicated blobs or implicit shared state.
-- Do not refactor unrelated code during a focused fix. Preserve existing architecture unless a change is necessary and justified.
-- Completion means verification: syntax/static checks, relevant tests, runtime/restart cases, security review, and performance checks proportional to the change.
+## Standalone safety
+
+- Treat client/NUI input as untrusted. Security-sensitive state is server-authoritative.
+- Never invent natives, framework APIs, events, exports, or schema. Verify against project code or official docs.
+- Completion requires verification proportional to risk.
 
 ## Skill-specific guardrails
 - Do not report style preferences as security findings.
@@ -47,4 +38,4 @@ When this skill materially affects a task, leave a concise implementation/review
 
 ## Reference policy
 
-Use project source and authoritative documentation before relying on memory for version-sensitive APIs. Start with `references/official-sources.md` in this package. When documentation and installed project code disagree, target the installed version and document the compatibility constraint.
+Prefer project source and authoritative documentation over memory for version-sensitive APIs. When documentation and installed project code disagree, target the installed version.

.agents/skills/00-orchestration/fivem-build/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: fivem-build
-description: Execute a production-minded BUILD workflow for a new FiveM feature or resource. Use when implementing new functionality end-to-end.
+description: 'Execute a production-minded BUILD workflow for a new FiveM feature or resource. Use when implementing new functionality end-to-end.'
 ---
 # fivem-build
 ## Purpose
@@ -15,20 +15,11 @@ Coordinate design, implementation, integration, and verification for a new featu
 6. Run static checks, focused tests, restart/disconnect scenarios, security review, and performance checks.
 7. Document configuration, dependencies, exports/events, and operational notes.
 
-## Non-negotiable engineering rules
-
-- Treat every client and NUI payload as untrusted input. Security-sensitive state is server authoritative.
-- Target current CfxLua / Lua 5.4. Do not add `lua54 'yes'`; it is deprecated and unnecessary.
-- Prefer `fxmanifest.lua` with `fx_version 'cerulean'` for modern resources unless compatibility evidence requires otherwise.
-- Never invent natives, exports, events, framework APIs, SQL columns, or configuration keys. Verify uncertain APIs against project code or authoritative documentation.
-- Keep client, server, shared, UI, persistence, and framework-adapter responsibilities explicit.
-- Minimize polling and frame loops. `Wait(0)` is reserved for work that genuinely must execute every rendered frame.
-- Across network boundaries, use network-safe identifiers and validate existence/ownership/state before mutation.
-- Design every entity workflow for create → network/own → use → migration → cleanup/delete, including resource stop and player disconnect.
-- NUI callbacks must always return a response; use JSON-encodable contracts and explicit error shapes.
-- Prefer small, typed/validated event payloads over large replicated blobs or implicit shared state.
-- Do not refactor unrelated code during a focused fix. Preserve existing architecture unless a change is necessary and justified.
-- Completion means verification: syntax/static checks, relevant tests, runtime/restart cases, security review, and performance checks proportional to the change.
+## Standalone safety
+
+- Treat client/NUI input as untrusted. Security-sensitive state is server-authoritative.
+- Never invent natives, framework APIs, events, exports, or schema. Verify against project code or official docs.
+- Completion requires verification proportional to risk.
 
 ## Skill-specific guardrails
 - Do not build speculative abstractions without a current use case.
@@ -46,4 +37,4 @@ When this skill materially affects a task, leave a concise implementation/review
 
 ## Reference policy
 
-Use project source and authoritative documentation before relying on memory for version-sensitive APIs. Start with `references/official-sources.md` in this package. When documentation and installed project code disagree, target the installed version and document the compatibility constraint.
+Prefer project source and authoritative documentation over memory for version-sensitive APIs. When documentation and installed project code disagree, target the installed version.

.agents/skills/00-orchestration/fivem-fix/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: fivem-fix
-description: Run a root-cause-first FIX workflow for FiveM bugs. Use for errors, regressions, desync, NUI failures, event failures, entity issues, database problems, or performance regressions.
+description: 'Run a root-cause-first FIX workflow for FiveM bugs. Use for errors, regressions, desync, NUI failures, event failures, entity issues, database problems, or performance regressions.'
 ---
 # fivem-fix
 ## Purpose
@@ -15,20 +15,11 @@ Reproduce and isolate before patching. Prefer the smallest correction that fixes
 6. Verify resource restart, player reconnect, and ownership/state transitions when relevant.
 7. Run security/performance review if the failure path is externally triggerable or hot.
 
-## Non-negotiable engineering rules
-
-- Treat every client and NUI payload as untrusted input. Security-sensitive state is server authoritative.
-- Target current CfxLua / Lua 5.4. Do not add `lua54 'yes'`; it is deprecated and unnecessary.
-- Prefer `fxmanifest.lua` with `fx_version 'cerulean'` for modern resources unless compatibility evidence requires otherwise.
-- Never invent natives, exports, events, framework APIs, SQL columns, or configuration keys. Verify uncertain APIs against project code or authoritative documentation.
-- Keep client, server, shared, UI, persistence, and framework-adapter responsibilities explicit.
-- Minimize polling and frame loops. `Wait(0)` is reserved for work that genuinely must execute every rendered frame.
-- Across network boundaries, use network-safe identifiers and validate existence/ownership/state before mutation.
-- Design every entity workflow for create → network/own → use → migration → cleanup/delete, including resource stop and player disconnect.
-- NUI callbacks must always return a response; use JSON-encodable contracts and explicit error shapes.
-- Prefer small, typed/validated event payloads over large replicated blobs or implicit shared state.
-- Do not refactor unrelated code during a focused fix. Preserve existing architecture unless a change is necessary and justified.
-- Completion means verification: syntax/static checks, relevant tests, runtime/restart cases, security review, and performance checks proportional to the change.
+## Standalone safety
+
+- Treat client/NUI input as untrusted. Security-sensitive state is server-authoritative.
+- Never invent natives, framework APIs, events, exports, or schema. Verify against project code or official docs.
+- Completion requires verification proportional to risk.
 
 ## Skill-specific guardrails
 - Do not apply random defensive guards without explaining the root cause.
@@ -46,4 +37,4 @@ When this skill materially affects a task, leave a concise implementation/review
 
 ## Reference policy
 
-Use project source and authoritative documentation before relying on memory for version-sensitive APIs. Start with `references/official-sources.md` in this package. When documentation and installed project code disagree, target the installed version and document the compatibility constraint.
+Prefer project source and authoritative documentation over memory for version-sensitive APIs. When documentation and installed project code disagree, target the installed version.

.agents/skills/00-orchestration/fivem-project-inspector/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: fivem-project-inspector
-description: Inspect an existing FiveM project before modification. Use to identify framework, dependencies, resource boundaries, events, exports, database access, NUI stack, conventions, and risk areas.
+description: 'Inspect an existing FiveM project before modification. Use to identify framework, dependencies, resource boundaries, events, exports, database access, NUI stack, conventions, and risk areas.'
 ---
 # fivem-project-inspector
 ## Purpose
@@ -15,20 +15,11 @@ Build a factual project map before changing code. Prefer repository evidence ove
 6. Record existing naming, error, logging, config, localization, and test conventions.
 7. Produce a concise change-impact map: files to touch, contracts affected, migrations, restart risks, and verification commands.
 
-## Non-negotiable engineering rules
-
-- Treat every client and NUI payload as untrusted input. Security-sensitive state is server authoritative.
-- Target current CfxLua / Lua 5.4. Do not add `lua54 'yes'`; it is deprecated and unnecessary.
-- Prefer `fxmanifest.lua` with `fx_version 'cerulean'` for modern resources unless compatibility evidence requires otherwise.
-- Never invent natives, exports, events, framework APIs, SQL columns, or configuration keys. Verify uncertain APIs against project code or authoritative documentation.
-- Keep client, server, shared, UI, persistence, and framework-adapter responsibilities explicit.
-- Minimize polling and frame loops. `Wait(0)` is reserved for work that genuinely must execute every rendered frame.
-- Across network boundaries, use network-safe identifiers and validate existence/ownership/state before mutation.
-- Design every entity workflow for create → network/own → use → migration → cleanup/delete, including resource stop and player disconnect.
-- NUI callbacks must always return a response; use JSON-encodable contracts and explicit error shapes.
-- Prefer small, typed/validated event payloads over large replicated blobs or implicit shared state.
-- Do not refactor unrelated code during a focused fix. Preserve existing architecture unless a change is necessary and justified.
-- Completion means verification: syntax/static checks, relevant tests, runtime/restart cases, security review, and performance checks proportional to the change.
+## Standalone safety
+
+- Treat client/NUI input as untrusted. Security-sensitive state is server-authoritative.
+- Never invent natives, framework APIs, events, exports, or schema. Verify against project code or official docs.
+- Completion requires verification proportional to risk.
 
 ## Deterministic helper
 
@@ -50,4 +41,4 @@ When this skill materially affects a task, leave a concise implementation/review
 
 ## Reference policy
 
-Use project source and authoritative documentation before relying on memory for version-sensitive APIs. Start with `references/official-sources.md` in this package. When documentation and installed project code disagree, target the installed version and document the compatibility constraint.
+Prefer project source and authoritative documentation over memory for version-sensitive APIs. When documentation and installed project code disagree, target the installed version.

.agents/skills/00-orchestration/fivem-project-inspector/scripts/scan_project.py

@@ -1,34 +1,72 @@
 #!/usr/bin/env python3
+"""
+Scans an existing FiveM project for structural signals, dependencies, and architecture.
+"""
+import argparse
+import re
+import json
 from pathlib import Path
-import re, json, argparse
-p=argparse.ArgumentParser(); p.add_argument('root', nargs='?', default='.'); a=p.parse_args()
-root=Path(a.root).resolve()
-files=[x for x in root.rglob('*') if x.is_file() and '.git' not in x.parts and 'node_modules' not in x.parts]
-manifest=[str(x.relative_to(root)) for x in files if x.name=='fxmanifest.lua']
-lua=[x for x in files if x.suffix=='.lua']
-texts={}
-for f in lua:
-    try: texts[f]=f.read_text(encoding='utf-8',errors='ignore')
-    except: pass
-patterns={
- 'net_events': r"RegisterNetEvent\s*\(\s*['\"]([^'\"]+)",
- 'server_triggers': r"TriggerServerEvent\s*\(\s*['\"]([^'\"]+)",
- 'client_triggers': r"TriggerClientEvent\s*\(\s*['\"]([^'\"]+)",
- 'exports': r"exports(?:\s*\[?\s*['\"]?[^\n]*|\s*\()",
- 'nui_callbacks': r"RegisterNuiCallback|RegisterNUICallback",
- 'nui_messages': r"SendNUIMessage\s*\(",
- 'statebags': r"(?:Entity|Player)\s*\([^\)]*\)\.state|GlobalState",
- 'wait0': r"Wait\s*\(\s*0\s*\)|Citizen\.Wait\s*\(\s*0\s*\)",
-}
-report={'root':str(root),'manifests':manifest,'lua_files':len(lua),'signals':{}}
-for k,pat in patterns.items():
-    hits=[]
-    rx=re.compile(pat)
-    for f,t in texts.items():
-        ms=rx.findall(t)
-        if ms: hits.append({'file':str(f.relative_to(root)),'count':len(ms),'examples':ms[:10] if isinstance(ms[0] if ms else '',str) else []})
-    report['signals'][k]=hits
-# dependency hints
-alltext='\n'.join(texts.values()).lower()
-report['framework_hints']={k:(k in alltext) for k in ['qbx_core','qb-core','es_extended','ox_lib','oxmysql','ox_target','ox_inventory']}
-print(json.dumps(report, indent=2))
+
+def main():
+    parser = argparse.ArgumentParser(description="Inspect FiveM project architecture")
+    parser.add_argument("root", nargs="?", default=".", help="Project root directory")
+    args = parser.parse_args()
+
+    root = Path(args.root).resolve()
+
+    files = [x for x in root.rglob("*") if x.is_file() and ".git" not in x.parts and "node_modules" not in x.parts]
+    manifests = [str(x.relative_to(root)) for x in files if x.name in ("fxmanifest.lua", "__resource.lua")]
+    lua_files = [x for x in files if x.suffix == ".lua"]
+
+    texts = {}
+    for f in lua_files:
+        try:
+            texts[f] = f.read_text(encoding="utf-8", errors="ignore")
+        except:
+            pass
+
+    patterns = {
+        "net_events": r"RegisterNetEvent\s*\(\s*['\"]([^'\"]+)",
+        "server_triggers": r"TriggerServerEvent\s*\(\s*['\"]([^'\"]+)",
+        "client_triggers": r"TriggerClientEvent\s*\(\s*['\"]([^'\"]+)",
+        "exports": r"exports(?:\s*\[?\s*['\"]?[^\n]*|\s*\()",
+        "nui_callbacks": r"Register(?:Nui|NUI)Callback",
+        "nui_messages": r"SendNUIMessage\s*\(",
+        "statebags": r"(?:Entity|Player)\s*\([^\)]*\)\.state|GlobalState",
+        "wait0": r"(?:Citizen\.)?Wait\s*\(\s*0\s*\)",
+    }
+
+    report = {
+        "root": str(root),
+        "manifests": manifests,
+        "lua_files_count": len(lua_files),
+        "signals": {}
+    }
+
+    for key, pat in patterns.items():
+        hits = []
+        rx = re.compile(pat)
+        for f, t in texts.items():
+            matches = rx.findall(t)
+            if matches:
+                # Some regexes capture groups, some don't.
+                examples = matches[:5] if matches and isinstance(matches[0], str) else []
+                hits.append({
+                    "file": str(f.relative_to(root)),
+                    "count": len(matches),
+                    "examples": examples
+                })
+        report["signals"][key] = hits
+
+    # Dependency / framework heuristics
+    all_text = "\n".join(texts.values()).lower()
+    frameworks = ["qbx_core", "qb-core", "es_extended", "ox_lib", "oxmysql", "ox_target", "ox_inventory"]
+
+    report["framework_hints"] = {
+        fw: (fw in all_text) for fw in frameworks
+    }
+
+    print(json.dumps(report, indent=2))
+
+if __name__ == "__main__":
+    main()