refactor(kyberforge): move audit guidance out of the per-run rubric load

skill-audit loaded roughly 4,268 words of rubric on every run, most of it
criteria for findings a clean skill never triggers. The auditing guidance moves
into finding-criteria.md, read only when a finding is actually raised, cutting
a clean audit to about 999 words. The named-skill exemption is replaced with
properties, so the rubric stops carrying a list that ages the moment a skill
is renamed.

apm-workflow's `type:` trap sat in one flow while biting several, so it is
promoted to a common gate reachable from all of them; its claim to be
self-contained was untrue once it started routing to apm-install. skill-author's
contract had drifted from body-discipline.md and is realigned, and agent-audit's
field inventory is brought in line with the same split.

plugins/kyberforge/skills/apm-workflow/README.md

@@ -4,7 +4,7 @@ Authors, scaffolds, compiles, and audits apm packages and marketplaces.
 
 ## What it does
 
-Covers the apm.yml lifecycle a session moves through repeatedly: configuring/scaffolding a package manifest, resolving/fetching its declared dependencies, building or registering a marketplace, compiling/packing/publishing a distributable, and validating integrity via apm audit. Dispatches by requested action to one of five reference files, each self-contained for its concern.
+Covers the apm.yml lifecycle a session moves through repeatedly: configuring/scaffolding a package manifest, resolving/fetching its declared dependencies, building or registering a marketplace, compiling/packing/publishing a distributable, and validating integrity via apm audit. Dispatches on the resolved flow to one of five reference files; each carries that flow's traps and names a sibling file where one flow genuinely depends on another's detail.
 
 ## Before you start
 
@@ -24,7 +24,7 @@ Requires the `apm` binary and (for runtime-driven scripts) an agent runtime alre
 
 | File | Purpose |
 |------|---------|
-| `SKILL.md` | Dispatch table and the two gotchas common to every branch (MCP secret indirection, the `experimental enable registries` precondition) |
+| `SKILL.md` | Dispatch table and the three gotchas common to every branch (MCP secret indirection, the `experimental enable registries` precondition, the unchecked `type:` field) |
 | `references/configure.md` | apm.yml schema, apm plugin init, dependency forms, MCP secrets, `includes:`, registries; `type:` and `experimental enable registries` traps |
 | `references/install.md` | apm install, apm install [PACKAGE_REF], --update, --target agent-skills |
 | `references/marketplace.md` | Building/registering a marketplace, `marketplace add` vs `package add`, package registration, versioning, Claude Code reserved-name/publish-confirm gotchas |

plugins/kyberforge/skills/apm-workflow/SKILL.md

@@ -1,11 +1,10 @@
 ---
 name: apm-workflow
 description: >
-  Use when the user wants to author, scaffold, install, compile, publish, or
-  audit an apm package, an apm.yml manifest, or an apm marketplace, or register
-  someone else's to consume — even when they do not say "apm"
-  explicitly, e.g. "set up the package manifest". Not the apm binary itself or
-  an agent runtime -> `apm-install`.
+  Use when managing an apm package, its apm.yml manifest, or an apm
+  marketplace — authoring through publishing — even when the user does not say
+  "apm", e.g. "set up the package manifest". Not the apm binary or an agent
+  runtime -> `apm-install`.
 metadata:
   category: apm
   source_keys:
@@ -16,18 +15,19 @@ metadata:
 
 - MCP server secrets in `apm.yml` (headers, env vars) must use `${VAR}` indirection, never literal values, so they resolve at install or runtime and are never committed.
 - `apm experimental enable registries` must run before a `registries:` block or `registry.*` config takes effect anywhere — configure, install or publish. Without it, declaring one silently does nothing: no error, no warning.
+- `apm.yml`'s `type:` selects which primitives are processed and is never checked against what `.apm/` holds, so `apm install` and `apm compile` can exit 0 having shipped none of the ones you expected. Set it to cover every primitive the package ships, and confirm the deployed output, not the exit code. Mechanics: `references/configure.md`.
 
 ## Step 1 — Dispatch
 
-| Invocation | Action | Reference |
+| Condition | Flow | Reference |
 |---|---|---|
-| `/apm-workflow configure` | Author/edit `apm.yml`; scaffold a new package (`apm plugin init`) | `references/configure.md` |
-| `/apm-workflow install` | Resolve/fetch dependencies declared in `apm.yml` (`apm install`, `apm install [PACKAGE_REF]`) | `references/install.md` |
-| `/apm-workflow marketplace` | Build a marketplace, register packages into it (local: hand-edit `apm.yml`; remote: `apm marketplace package add`), or register a marketplace as a consumer (`apm marketplace init/check/package add/add`) | `references/marketplace.md` |
-| `/apm-workflow compile` | Generate per-target output, bundle, or publish (`apm compile`, `apm pack`, `apm publish`) | `references/compile.md` |
-| `/apm-workflow audit` | Validate integrity/policy or wire a CI gate (`apm audit`, `apm audit --ci`) | `references/audit.md` |
+| Author or edit `apm.yml`, or scaffold a new package (`apm plugin init`) | configure | `references/configure.md` |
+| Resolve or fetch the dependencies `apm.yml` declares (`apm install`, `apm install [PACKAGE_REF]`) | install | `references/install.md` |
+| Build a marketplace, register a package into it (local: hand-edit `apm.yml`; remote: `apm marketplace package add`), or register someone else's as a consumer (`apm marketplace init/check/package add/add`) | marketplace | `references/marketplace.md` |
+| Generate per-target output, bundle, or publish (`apm compile`, `apm pack`, `apm publish`) | compile | `references/compile.md` |
+| Validate integrity/policy or wire a CI gate (`apm audit`, `apm audit --ci`) | audit | `references/audit.md` |
 
-Read only the reference file matching the requested action — each is self-contained for its concern, and each carries the traps specific to its flow.
+Read the reference file matching the resolved flow — it carries that flow's own traps, and names a sibling file wherever one flow genuinely depends on another's detail.
 
 ## Step 2 — Execute
 

plugins/kyberforge/skills/apm-workflow/references/compile.md

@@ -51,7 +51,7 @@ apm publish --package acme/my-skill
 
 Publishes a producer package (root containing `apm.yml`, `.apm/`, and optionally a `registries:` block) to a registry. Always dry-run with `-v` first — publishing is not trivially reversible once a version tag is claimed on a registry.
 
-Publishing to a named registry requires `apm experimental enable registries` to have already run — see `references/configure.md`'s Gotchas for the full precondition and its silent-no-op failure mode.
+Publishing to a named registry requires `apm experimental enable registries` to have already run — see `SKILL.md`'s Gotchas for the precondition and its silent-no-op failure mode.
 
 ## Run
 

plugins/kyberforge/skills/apm-workflow/references/configure.md

@@ -35,8 +35,6 @@ version: 1.0.0
 - `registries` — named registry endpoints for shorthand dependency resolution
 - `marketplace` — owner + packages list; see `references/marketplace.md` for the full marketplace workflow
 
-See `docs/research/docs/microsoft-apm/configuration.md` for the complete annotated schema.
-
 ## Bumping a package's own version (repo policy)
 
 apm ships no version-bump command, so `version:` in a package's own `apm.yml` is a hand edit.

plugins/kyberforge/skills/apm-workflow/references/install.md

@@ -19,4 +19,4 @@ With no arguments, resolves and installs everything declared under `dependencies
 
 `--target agent-skills` generates the vendor-neutral output directory instead of a Claude/Copilot-specific one — for IDE-agnostic tool support.
 
-If a `PACKAGE_REF` resolves through a named registry rather than a plain git source, `apm experimental enable registries` must already have been run — see `references/configure.md`'s Gotchas for the full precondition and its silent-no-op failure mode.
+If a `PACKAGE_REF` resolves through a named registry rather than a plain git source, `apm experimental enable registries` must already have been run — see `SKILL.md`'s Gotchas for the precondition and its silent-no-op failure mode.