chore(deps): update oh-my-agent skills

.agents/agents/architecture-reviewer.md

@@ -12,6 +12,7 @@ You are an Architecture Specialist. Diagnose the architectural concern before re
 Follow the vendor-specific execution protocol:
 - Write results to project root `.agents/results/result-architecture.md` (orchestrated: `result-architecture-{sessionId}.md`)
 - Include: status, recommendation summary, tradeoffs, risks, validation steps, artifacts created
+- `result-architecture.md` is the run report; durable artifacts (ADRs, recommendations) are saved separately under `.agents/results/architecture/` and linked from the report — the report does not replace them
 
 <!-- CHARTER_CHECK_BEGIN -->
 
@@ -41,4 +42,4 @@ CHARTER_CHECK:
 4. Surface assumptions, risks, and validation steps in every recommendation
 5. Save ADRs or architecture notes under `.agents/results/architecture/` when material
 6. Only modify code when the task explicitly requires implementation, not just review
-7. Never modify `.agents/` files
+7. Never modify `.agents/` files (SSOT) — run outputs under `.agents/results/` and `.agents/state/memories/` are the only exceptions

.agents/agents/backend-engineer.md

@@ -44,8 +44,9 @@ Router (HTTP) → Service (Business Logic) → Repository (Data Access) → Mode
 3. Follow Repository → Service → Router pattern (no business logic in routes)
 4. Validate all inputs with the project's validation library
 5. Parameterized queries only (no string interpolation in SQL)
-6. JWT + bcrypt for auth
+6. JWT + Argon2id for auth (bcrypt acceptable for legacy compatibility)
 7. Async/await consistently
 8. Custom exceptions via centralized error module
-9. Document out-of-scope dependencies for other agents
-10. Never modify `.agents/` files
+9. DB migrations: reversible steps, single migration head; schema design questions route to db-engineer
+10. Document out-of-scope dependencies for other agents
+11. Never modify `.agents/` files (SSOT) — run outputs under `.agents/results/` and `.agents/state/memories/` are the only exceptions

.agents/agents/db-engineer.md

@@ -27,6 +27,10 @@ CHARTER_CHECK:
 - Success criteria: {measurable criteria}
 - Assumptions: {defaults applied}
 ```
+
+- LOW: proceed with assumptions
+- MEDIUM: list options, proceed with most likely
+- HIGH: set status blocked, list questions, DO NOT write code
 <!-- CHARTER_CHECK_END -->
 
 ## Rules
@@ -39,5 +43,7 @@ CHARTER_CHECK:
 6. Integrity as first-class: entity, domain, referential, business-rule
 7. Concurrency never implicit — define transaction boundaries, locking, isolation level
 8. Vector DBs: retrieval infrastructure, not source-of-truth; default to hybrid retrieval
-9. Deliverables: schema design, data standards table, glossary, capacity estimation
-10. Never modify `.agents/` files
+9. Migrations: reversible by default; keep a single migration head — resolve forks with a merge revision before handoff
+10. Boundary: schema design, ERD, data standards, and query tuning live here; application-level migration wiring and ORM integration belong to backend-engineer
+11. Deliverables: schema design, data standards table, glossary, capacity estimation
+12. Never modify `.agents/` files (SSOT) — run outputs under `.agents/results/` and `.agents/state/memories/` are the only exceptions

.agents/agents/debug-investigator.md

@@ -49,4 +49,4 @@ CHARTER_CHECK:
 4. Every fix gets a regression test
 5. Search for similar patterns after fixing
 6. Document out-of-scope findings for other agents
-7. Never modify `.agents/` files
+7. Never modify `.agents/` files (SSOT) — run outputs under `.agents/results/` and `.agents/state/memories/` are the only exceptions

.agents/agents/docs-curator.md

@@ -53,7 +53,7 @@ This agent is a write-capable peer of `backend-engineer` / `frontend-engineer`.
 1. Stay in scope — only update docs related to the assigned diff range or acceptance criteria
 2. Minimal edits — change only what the diff invalidates, never reformat or restructure unrelated text
 3. Never modify code (`*.ts`, `*.tsx`, `*.py`, `*.go`, etc.) — surface mismatches for `backend-engineer` / `frontend-engineer` instead
-4. Never modify `.agents/` files — SSOT protection
+4. Never modify `.agents/` files (SSOT) — run outputs under `.agents/results/` and `.agents/state/memories/` are the only exceptions
 5. Never touch secret-bearing files even if surfaced in diffs (`.env*`, `*.pem`, `*.key`, `id_rsa*`)
 6. Re-run `oma docs verify --json` after applying patches; record before/after counts in the result file
 7. ARB-based localization (`packages/i18n/`): edit ARB source, never regenerate localization code

.agents/agents/frontend-engineer.md

@@ -1,12 +1,12 @@
 ---
 name: frontend-engineer
-description: React/Next.js/TypeScript frontend implementation. Use for UI, components, styling work.
+description: React/Next.js/Angular/TypeScript frontend implementation. Use for UI, components, styling work.
 skills:
   - oma-frontend
   - oma-design
 ---
 
-You are a Frontend Specialist.
+You are a Frontend Specialist. Detect the project's framework and existing conventions (package.json, lockfile, existing components) before writing code — established project choices win over the defaults below.
 
 ## Execution Protocol
 
@@ -28,6 +28,10 @@ CHARTER_CHECK:
 - Success criteria: {measurable criteria}
 - Assumptions: {defaults applied}
 ```
+
+- LOW: proceed with assumptions
+- MEDIUM: list options, proceed with most likely
+- HIGH: set status blocked, list questions, DO NOT write code
 <!-- CHARTER_CHECK_END -->
 
 ## Architecture
@@ -41,8 +45,8 @@ FSD-lite: root `src/` + feature `src/features/*/`
 3. Server Components default, Client Components only for interactivity
 4. Accessibility mandatory (semantic HTML, ARIA, keyboard nav)
 5. TailwindCSS v4 for styling, design tokens 1:1 mapping
-6. Libraries: luxon (dates), ahooks (hooks), es-toolkit (utils), jotai (client state), TanStack Query (server state)
+6. Library defaults (greenfield; existing project choices win): luxon (dates), ahooks (hooks), es-toolkit (utils), jotai (client state), TanStack Query (server state)
 7. Absolute imports with `@/`
 8. Write tests for custom logic (>90% coverage target)
 9. Document out-of-scope dependencies for other agents
-10. Never modify `.agents/` files
+10. Never modify `.agents/` files (SSOT) — run outputs under `.agents/results/` and `.agents/state/memories/` are the only exceptions

.agents/agents/mobile-engineer.md

@@ -1,6 +1,6 @@
 ---
 name: mobile-engineer
-description: Flutter/React Native mobile implementation. Use for mobile app, widgets, platform feature work.
+description: Flutter/React Native/Swift native mobile implementation. Use for mobile app, widgets, SwiftUI, platform feature work.
 skills:
   - oma-mobile
 ---
@@ -27,20 +27,26 @@ CHARTER_CHECK:
 - Success criteria: {measurable criteria}
 - Assumptions: {defaults applied}
 ```
+
+- LOW: proceed with assumptions
+- MEDIUM: list options, proceed with most likely
+- HIGH: set status blocked, list questions, DO NOT write code
 <!-- CHARTER_CHECK_END -->
 
 ## Architecture
 
-Clean Architecture: domain → data → presentation
+Clean Architecture: domain → data → presentation (Swift native: App/Core/Features/Shared)
 
 ## Rules
 
 1. Stay in scope — only work on assigned mobile tasks
-2. Riverpod/Bloc for state management
+2. State management per variant — Flutter: Riverpod/Bloc; React Native: Zustand + TanStack Query; Swift: `@MainActor @Observable`
 3. Material Design 3 (Android) + iOS HIG (iOS)
-4. All controllers disposed properly
-5. Dio with interceptors, offline-first architecture
-6. 60fps target performance
-7. Write widget tests and integration tests
-8. Document out-of-scope dependencies for other agents
-9. Never modify `.agents/` files
+4. Dispose controllers / cancel structured tasks properly
+5. Transport client with interceptors (Dio / axios / generated Client) + repository-layer response cache, offline-first architecture
+6. Secrets in secure storage only — never plain prefs or MMKV
+7. 60fps target performance
+8. Write widget/component tests and integration tests
+9. ARB-based localization: edit ARB source files only, never generated localization code
+10. Document out-of-scope dependencies for other agents
+11. Never modify `.agents/` files (SSOT) — run outputs under `.agents/results/` and `.agents/state/memories/` are the only exceptions

.agents/agents/pm-planner.md

@@ -38,17 +38,18 @@ CHARTER_CHECK:
 1. **Gather**: Requirements (users, features, constraints, deployment target)
 2. **Analyze**: Technical feasibility using codebase analysis
 3. **Contracts**: Define API contracts using template `.agents/skills/_shared/core/api-contracts/template.md`; save the generated contract to `.agents/results/api-contracts/` (run artifact) or `docs/plans/contracts/` (durable spec)
-4. **Decompose**: Break into tasks with agent, title, acceptance criteria, priority (P0-P3), dependencies
-5. **Output**: Save to `.agents/results/plan-{sessionId}.json`
+4. **Decompose**: Break into tasks with agent, title, acceptance criteria, priority tier, dependencies, scope
+5. **Output**: Save to `.agents/results/plan-{sessionId}.json` (manual non-orchestrated runs: `plan.json`)
 
 ## Task Format
 
 Each task must include:
 - `agent`: assigned domain agent
 - `title`: what to do
 - `acceptance_criteria`: testable conditions
-- `priority`: P0 (critical) to P3 (nice-to-have)
+- `priority`: execution tier — 1 = independent (runs first), 2 = depends on tier 1, etc. (lower runs first)
 - `dependencies`: task IDs that must complete first
+- `scope`: directory prefixes this task's agent may modify (used to detect boundary violations in parallel runs)
 
 ## Rules
 
@@ -57,4 +58,4 @@ Each task must include:
 3. Minimize dependencies for maximum parallelism
 4. Security and testing are part of every task (not separate)
 5. Each task completable by a single agent
-6. Never modify `.agents/` files
+6. Never modify `.agents/` files (SSOT) — run outputs under `.agents/results/` and `.agents/state/memories/` are the only exceptions

.agents/agents/qa-reviewer.md

@@ -27,6 +27,10 @@ CHARTER_CHECK:
 - Must NOT do: modify source code, skip severity levels, report unverified findings
 - Success criteria: {all files reviewed, findings with file:line references}
 ```
+
+- LOW: proceed with assumptions
+- MEDIUM: list options, proceed with most likely
+- HIGH: set status blocked, list questions, DO NOT start the review
 <!-- CHARTER_CHECK_END -->
 
 ## Review Priority Order
@@ -60,11 +64,11 @@ Report findings with severity levels:
 
 1. Every finding: file:line, description, fix
 2. Severity: CRITICAL, HIGH, MEDIUM, LOW
-3. Run automated tools first (`npm audit`, lint, type-check)
+3. Run automated tools first (lint, type-check, plus `npm audit` / `bandit` / `lighthouse` as applicable to the stack)
 4. No false positives — verify each finding
 5. Provide remediation code, not just descriptions
 6. PASS verdict: zero CRITICAL, HIGH, and MEDIUM issues
 7. WARNING verdict: zero CRITICAL and HIGH, but MEDIUM issues exist
 8. FAIL verdict: any CRITICAL or HIGH issue found
 9. Never modify source code — review only
-10. Never modify `.agents/` files
+10. Never modify `.agents/` files (SSOT) — run outputs under `.agents/results/` and `.agents/state/memories/` are the only exceptions

.agents/agents/refactor-engineer.md

@@ -52,4 +52,4 @@ CHARTER_CHECK:
 6. Convention/pattern changes require an ADR — route to architecture-reviewer; follow the existing coding guide otherwise
 7. Destination is the language idiom and codebase convention, not a pattern catalog diagram
 8. Document out-of-scope findings for other agents
-9. Never modify `.agents/` files
+9. Never modify `.agents/` files (SSOT) — run outputs under `.agents/results/` and `.agents/state/memories/` are the only exceptions

.agents/agents/research-explorer.md

@@ -61,4 +61,4 @@ CHARTER_CHECK:
 6. Coverage transparency: when sources fail, annotate coverage (N/M sources)
 7. Read-only toward the codebase; local code context comes through search tools only
 8. Document out-of-scope findings for other agents
-9. Never modify `.agents/` files
+9. Never modify `.agents/` files (SSOT) — run outputs under `.agents/results/` and `.agents/state/memories/` are the only exceptions

.agents/agents/tf-infra-engineer.md

@@ -42,4 +42,4 @@ CHARTER_CHECK:
 5. Do not hardcode secrets in `.tf` files or examples
 6. Document cost, drift, rollback, and continuity considerations for production changes
 7. Never run destructive operations without explicit user approval
-8. Never modify `.agents/` files
+8. Never modify `.agents/` files (SSOT) — run outputs under `.agents/results/` and `.agents/state/memories/` are the only exceptions

.agents/agents/variants/claude.json

@@ -41,6 +41,9 @@
     "docs-curator": {
       "tools": "Read, Write, Edit, Bash, Grep, Glob",
       "maxTurns": 15
+    },
+    "research-explorer": {
+      "tools": "Read, Write, Edit, Bash, Grep, Glob, WebSearch, WebFetch"
     }
   }
 }

.agents/hooks/core/agentmemory-client.ts

@@ -6,10 +6,6 @@ import https from "node:https";
 import { homedir } from "node:os";
 import { basename, join } from "node:path";
 
-// AgentMemory's published version line moved from 0.11/0.12 (original design
-// target) to 0.9.x service builds; accept 0.9.x and the 0.1x.x range.
-const SUPPORTED = /^0\.(9|1\d)\./;
-
 function endpointUrl(): string | null {
   if (process.env.OMA_NO_AGENTMEMORY === "1") return null;
   if (process.env.AGENTMEMORY_URL) return process.env.AGENTMEMORY_URL;
@@ -106,36 +102,12 @@ export async function isAgentMemoryReachable(): Promise<boolean> {
 
   try {
     const response = await requestAgentMemory(url, "/agentmemory/health");
-    if (response.statusCode < 200 || response.statusCode >= 300) {
-      reachable = false;
-      return reachable;
-    }
-    const headerVersion = response.headers["x-agentmemory-version"];
-    const version = Array.isArray(headerVersion)
-      ? headerVersion[0]
-      : headerVersion;
-    // Recent AgentMemory releases expose the version only in the health body,
-    // not the `x-agentmemory-version` header.
-    let isAgentMemory = false;
-    let bodyVersion: string | undefined;
-    try {
-      const parsed = JSON.parse(response.body) as {
-        service?: unknown;
-        status?: unknown;
-        version?: unknown;
-      };
-      isAgentMemory =
-        parsed.service === "agentmemory" ||
-        parsed.status === "healthy" ||
-        parsed.status === "ok";
-      if (typeof parsed.version === "string") bodyVersion = parsed.version;
-    } catch {
-      // Non-JSON body — fall back to the header check below.
-    }
-    const resolvedVersion = version ?? bodyVersion;
-    reachable =
-      isAgentMemory ||
-      (resolvedVersion !== undefined && SUPPORTED.test(resolvedVersion));
+    // Capability-based acceptance: any 2xx health response from the
+    // explicitly configured endpoint counts as reachable. Version pinning
+    // proved brittle (the published line already jumped from 0.11/0.12
+    // design targets to 0.9.x service builds), so payload shape and version
+    // are no longer gating.
+    reachable = response.statusCode >= 200 && response.statusCode < 300;
     return reachable;
   } catch {
     reachable = false;