chore(harness): make repository agent-ready

Add concise routed context, task-aware agent roles, focused skills, and structured learning promotion.\n\nUnify local development and workspace tooling, add layered test and E2E verification, harden MCP authentication, and gate deployment behind verification and explicit production promotion.

.codex/skills/db-migration/SKILL.md

@@ -0,0 +1,18 @@
+---
+name: db-migration
+description: Create, review, and verify Sauci Supabase schema migrations. Use for tables, columns, functions, policies, indexes, triggers, or other database shape changes.
+---
+
+# Sauci database migration
+
+Read `apps/supabase/AGENTS.md` and `docs/operations/database-migrations.md`.
+
+1. Create the local file with `npm run db:migration:new -- <name>`.
+2. Edit only `apps/supabase/migrations/`; keep environment-specific URLs dynamic.
+3. Update affected shared/generated contracts and callers in the same task.
+4. Reset local Supabase, run function/RLS tests, and independently inspect the
+   resulting schema/behavior.
+5. Commit the migration file with dependent code. CI performs deployment.
+
+Never call remote `apply_migration`; never send DDL through MCP SQL execution;
+never use a remote project for local validation.

.codex/skills/dev-local/SKILL.md

@@ -0,0 +1,28 @@
+---
+name: dev-local
+description: Start, inspect, reset, or stop the complete local Sauci stack. Use for local development, service logs, port diagnosis, and full-stack test setup.
+---
+
+# Local Sauci stack
+
+Use `scripts/dev-local.sh`; do not manually mix remote and local services.
+
+| Service | Port |
+|---|---:|
+| web | 3000 |
+| admin | 3001 |
+| MCP | 3002 |
+| Expo Metro | 8081 |
+| Supabase API / DB / Studio | 54321 / 54322 / 54323 |
+
+Prerequisites: Node from `.nvmrc`, `npm ci`, tmux, Docker-compatible runtime, and
+the repository Supabase CLI dependency.
+
+- `scripts/dev-local.sh up` — idempotently start infra and services.
+- `status`, `logs <service>`, `restart <service>`, `attach` — inspect.
+- `reset` — local-only database reset plus deterministic fixtures.
+- `ios` / `android` — launch the native app against local Supabase.
+- `down`; `down --all` — stop services, optionally infrastructure.
+
+If a port is occupied, use `status` and inspect its owning process before stopping
+anything. If a tmux window exited, read its logs before restarting it.

.codex/skills/incident-triage/SKILL.md

@@ -0,0 +1,15 @@
+---
+name: incident-triage
+description: Diagnose a Sauci development, CI, backend, or production symptom with evidence. Use for failures, regressions, logs, or unexplained runtime behavior; diagnosis alone does not authorize a fix or deployment.
+---
+
+# Incident triage
+
+Establish environment, time window, expected behavior, and blast radius. Reproduce
+locally when safe, inspect the narrow relevant logs and data boundary, and separate
+product bugs from stale tests or environment failures. Preserve exact error text
+without exposing secrets.
+
+Return evidence, confirmed cause or ranked hypotheses, affected scope, and the
+smallest recommended next action. Do not mutate production, implement a fix, or
+deploy unless the request explicitly includes it.

.codex/skills/mobile-simulator/SKILL.md

@@ -0,0 +1,18 @@
+---
+name: mobile-simulator
+description: Build, launch, and verify Sauci on iOS or Android simulators with local backend wiring and captured evidence. Use for native UI, navigation, permissions, or device behavior.
+---
+
+# Mobile simulator verification
+
+Read `apps/mobile/AGENTS.md` and `apps/mobile/DESIGN.md` for UI work.
+
+1. Start/reset the local stack through the `dev-local` skill.
+2. Use `scripts/dev-local.sh ios` or `android`; do not embed remote credentials.
+3. Drive stable accessibility labels/test IDs. Use `maestro test e2e/maestro` for
+   committed flows and platform simulator tools for focused exploration.
+4. Capture the final visible state and relevant Metro/native logs under
+   `evidence/`.
+5. Report device/runtime, steps, expected versus observed, and artifact paths.
+
+Do not claim a native result from Expo web or component tests alone.

.codex/skills/promote-learning/SKILL.md

@@ -0,0 +1,14 @@
+---
+name: promote-learning
+description: Record or promote a reproduced Sauci agent lesson into durable documentation, a skill, fixture, or executable invariant. Use after repeated or confirmed workflow failures, not for speculative observations.
+---
+
+# Promote a learning
+
+Read `docs/agents/learnings.md` and copy `.agents/learnings/TEMPLATE.md` into the
+appropriate state directory. Include reproduction and verification evidence.
+
+Prefer one executable destination. Promotion requires review, a destination,
+and a review-after date; update the record to `promoted` only after that artifact
+exists and passes `npm run learn:check`. Never turn a transient provider failure or
+untested workaround into a golden rule.

.codex/skills/question-pack/SKILL.md

@@ -0,0 +1,20 @@
+---
+name: question-pack
+description: Create or review Sauci question-pack content and its local migration/seed representation. Use for pack generation, inverse pairs, intensity, targeting, or content quality.
+---
+
+# Sauci question packs
+
+Inspect existing packs before generating to avoid duplication.
+
+- Write proposals, not interview questions; use gender-neutral “your partner”.
+- Avoid time-bound words such as tonight, now, or today.
+- Symmetric activities have no partner text.
+- Every asymmetric activity has the reversed counterpart and a correct
+  `inverse_of` link; inverse pairs are not duplicates.
+- Intensity 1 is non-sexual bonding, 2 romantic/flirty, 3 light sexual, 4
+  explicit, and 5 advanced/BDSM. Check surrounding content before deciding.
+- Preserve targeting and required-prop semantics; do not infer them from wording.
+
+Return metadata, content, inverse/link validation, and distribution statistics.
+Database changes follow the `db-migration` skill and require local verification.

.codex/skills/release-mobile/SKILL.md

@@ -0,0 +1,15 @@
+---
+name: release-mobile
+description: Prepare and verify Sauci iOS or Android releases. Use for versioning, EAS/native builds, Fastlane upload, release notes, or store submission preparation.
+---
+
+# Mobile release
+
+Read `docs/releasing.md`, `apps/mobile/RELEASING.md` when present, and the mobile
+scoped instructions. Confirm target platform and release profile. Run repository
+verification plus a native acceptance pass before starting a release build.
+
+Use the package scripts in `apps/mobile/package.json`; preserve platform signing
+and versioning. Building or uploading to a store is an external mutation: obtain
+explicit authorization for the requested target, then report the build artifact,
+version/build number, upload result, and read-back state.

.codex/skills/verify/SKILL.md

@@ -0,0 +1,29 @@
+---
+name: verify
+description: Prove a completed Sauci engineering task works before a PR. Use when asked to verify, prove behavior, or open a PR with runtime evidence.
+---
+
+# Verify Sauci work
+
+Run locally on a non-default branch with the implementation committed.
+
+1. Start the stack once with `scripts/dev-local.sh up`; reset fixtures first when
+   the task changes durable state. Web is `http://127.0.0.1:3000`, admin is
+   `http://127.0.0.1:3001`, and MCP health is `http://127.0.0.1:3002/health`.
+2. Give a fresh read-only verifier the acceptance criteria. It drives browser
+   surfaces with the repository browser capability, native surfaces with Maestro
+   or the iOS simulator skill, and APIs with `curl`. Authentication fixtures are
+   described by `e2e/.auth/fixtures.json` after `dev-local.sh reset`.
+3. The verifier writes screenshots, traces, video, or response evidence under
+   `evidence/` and returns only expected, observed, evidence paths, and
+   `works|broken`. It never edits code.
+4. If broken, fix and use a fresh verifier. Stop after three failed rounds and
+   report the unresolved evidence.
+5. After the task works, run `npm run verify:fast`, affected E2E, and
+   `npm run verify:full` when local Supabase/Deno are available. Never weaken an
+   assertion just to pass.
+6. Open a PR only after both task verification and regression checks pass. Upload
+   evidence to the established CI artifact or `pr-evidence` prerelease and embed
+   the screenshot plus a video/trace link in the PR body.
+
+A green test suite without an independently observed task outcome is incomplete.