feat(artifacts)!: replace prompts with skills and migrate managed installs

.github/agents/architect.agent.md

@@ -227,4 +227,4 @@ Keep this list lean. Use additional installed domain skills only when needed.
 - `@#threat-model` — design-time threat modeling (STRIDE-first, with DREAD/PASTA as needed)
 
 <!-- AUTO-GENERATED — maintained by vstack, do not edit directly -->
-<!-- VSTACK-META: {"artifact_name":"architect","artifact_type":"agent","artifact_version":"20260514001","generator":"vstack","vstack_version":"3.6.0"} -->
+<!-- VSTACK-META: {"artifact_name":"architect","artifact_type":"agent","artifact_version":"20260514001","generator":"vstack","vstack_version":"3.7.8"} -->

.github/agents/designer.agent.md

@@ -241,4 +241,4 @@ Keep this list lean. Use additional installed domain skills only when needed.
 - `@#simplify` — simplify proposals and designs while preserving required outcomes
 
 <!-- AUTO-GENERATED — maintained by vstack, do not edit directly -->
-<!-- VSTACK-META: {"artifact_name":"designer","artifact_type":"agent","artifact_version":"20260514001","generator":"vstack","vstack_version":"3.6.0"} -->
+<!-- VSTACK-META: {"artifact_name":"designer","artifact_type":"agent","artifact_version":"20260514001","generator":"vstack","vstack_version":"3.7.8"} -->

.github/agents/engineer.agent.md

@@ -228,4 +228,4 @@ Keep this list lean. Use additional installed domain skills only when needed.
 - `@#verify` — run tests, fix issues, re-verify loop
 
 <!-- AUTO-GENERATED — maintained by vstack, do not edit directly -->
-<!-- VSTACK-META: {"artifact_name":"engineer","artifact_type":"agent","artifact_version":"20260514001","generator":"vstack","vstack_version":"3.6.0"} -->
+<!-- VSTACK-META: {"artifact_name":"engineer","artifact_type":"agent","artifact_version":"20260514001","generator":"vstack","vstack_version":"3.7.8"} -->

.github/agents/planner.agent.md

@@ -291,4 +291,4 @@ that requires changes to upstream items, flag it and trigger a reverse handoff.
 - `@#simplify` - simplify stage plans and handoffs while preserving gate requirements
 
 <!-- AUTO-GENERATED — maintained by vstack, do not edit directly -->
-<!-- VSTACK-META: {"artifact_name":"planner","artifact_type":"agent","artifact_version":"20260514001","generator":"vstack","vstack_version":"3.6.0"} -->
+<!-- VSTACK-META: {"artifact_name":"planner","artifact_type":"agent","artifact_version":"20260514001","generator":"vstack","vstack_version":"3.7.8"} -->

.github/agents/product.agent.md

@@ -213,4 +213,4 @@ Keep this list lean. Use additional installed domain skills only when needed.
 - `@#vision` — vision document writing and review
 
 <!-- AUTO-GENERATED — maintained by vstack, do not edit directly -->
-<!-- VSTACK-META: {"artifact_name":"product","artifact_type":"agent","artifact_version":"20260514001","generator":"vstack","vstack_version":"3.6.0"} -->
+<!-- VSTACK-META: {"artifact_name":"product","artifact_type":"agent","artifact_version":"20260514001","generator":"vstack","vstack_version":"3.7.8"} -->

.github/agents/release.agent.md

@@ -203,4 +203,4 @@ Keep this list lean. Use additional installed domain skills only when needed.
 - `@#simplify` — simplify release scope and release steps while preserving controls
 
 <!-- AUTO-GENERATED — maintained by vstack, do not edit directly -->
-<!-- VSTACK-META: {"artifact_name":"release","artifact_type":"agent","artifact_version":"20260514001","generator":"vstack","vstack_version":"3.6.0"} -->
+<!-- VSTACK-META: {"artifact_name":"release","artifact_type":"agent","artifact_version":"20260514001","generator":"vstack","vstack_version":"3.7.8"} -->

.github/agents/tester.agent.md

@@ -220,4 +220,4 @@ Keep this list lean. Use additional installed domain skills only when needed.
 - `@#threat-model` — structured threat analysis and mitigation prioritization
 
 <!-- AUTO-GENERATED — maintained by vstack, do not edit directly -->
-<!-- VSTACK-META: {"artifact_name":"tester","artifact_type":"agent","artifact_version":"20260514001","generator":"vstack","vstack_version":"3.6.0"} -->
+<!-- VSTACK-META: {"artifact_name":"tester","artifact_type":"agent","artifact_version":"20260514001","generator":"vstack","vstack_version":"3.7.8"} -->

.github/copilot-instructions.md

@@ -17,23 +17,22 @@ vstack provides structured skills for backend/microservice development, executab
 - Agents are for roles and handoffs.
 - Skills are for reusable procedures.
 - Instructions are for always-on policies.
-- Prompts are for one-shot task framing.
 - Hooks are for repository-level automation.
 
 When proposals span multiple artifact types, split them into small independent changes.
 
 ## Reasoning & Critical Thinking
 
-Evidence-based reasoning is available as an explicit opt-in framework via `prompt/reasoning`.
+Evidence-based reasoning is available as an explicit opt-in framework via `skill/reasoning`.
 
-When `prompt/reasoning` is invoked, apply these principles:
+When `skill/reasoning` is invoked, apply these principles:
 - **Truth > agreement** — evaluate correctness, not user preference
 - **Evidence > opinion** — support claims with facts, logic, or explicit assumptions
 - **Critical thinking > people-pleasing** — challenge premises before accepting them
 
-For structured adversarial review workflows, agents invoke `skill/advise`, which can reference `prompt/reasoning` when deeper critical analysis is needed.
+For structured adversarial review workflows, agents invoke `skill/advise`, which can reference `skill/reasoning` when deeper critical analysis is needed.
 
-**For downstream users:** Add `prompt/reasoning` to your vstack installation (in your `.vstack/vstack.json` manifest or via your preferred vstack distribution mechanism), then run `vstack install` to generate `.github/prompts/reasoning.prompt.md` in your repository. Agents and skills can invoke it by reference.
+**For downstream users:** Run `vstack install` to generate `.github/skills/reasoning/SKILL.md`, then invoke `/reasoning` explicitly when needed. The install manifest is generated state, not a hand-edited selection file.
 
 ## System Structure
 
@@ -47,24 +46,26 @@ src/vstack/_templates/
 ├── agents/<name>/
 │   ├── template.md             ← agent instructions body
 │   └── config.yaml             ← agent frontmatter fields
-├── instructions/<name>/
-│   ├── template.md             ← instruction file body
-│   └── config.yaml
-└── prompts/<name>/
-    ├── template.md             ← prompt file body
+└── instructions/<name>/
+    ├── template.md             ← instruction file body
     └── config.yaml
 docs/            ← overview.md, design.md, skills.md, workflow.md, roadmap.md, adr/
-.github/         ← generated output (never edit directly*)
+.github/         ← generated output plus hand-authored exceptions*
 ├── skills/<name>/SKILL.md
 ├── agents/<name>.agent.md
-├── instructions/<name>.instructions.md
-└── prompts/<name>.prompt.md
+└── instructions/<name>.instructions.md
 .vstack/         ← project-scope vstack state and config
 └── vstack.json                 ← install manifest (generated)
 ```
 
 *Hand-authored exceptions in `.github/`: `copilot-instructions.md`, `CODEOWNERS`,
-`PULL_REQUEST_TEMPLATE/`, `ISSUE_TEMPLATE/`, `workflows/`.
+`PULL_REQUEST_TEMPLATE/`, `ISSUE_TEMPLATE/`, `workflows/`, and repository-only skills
+such as `skills/artifact-integrity/SKILL.md`.
+
+Repository-only skills live directly in `.github/skills/<name>/SKILL.md`.
+They have no template under `src/vstack/_templates/`, no generation footer, and no
+entry in `.vstack/vstack.json`. They are not packaged or installed for consumers.
+Edit these files directly; the template-first rules apply only to distributed artifacts.
 
 Generated files are written to `.github/` at install time:
 
@@ -76,22 +77,22 @@ python3 -m vstack install
 
 When vstack is installed inside its own repo (`.github/agents/` and `.github/skills/` exist):
 
-**Source of truth is always in `src/vstack/_templates/`.** After every change:
+**Source of truth for distributed artifacts is in `src/vstack/_templates/`.**
+Repository-only skills are hand-authored exceptions. After every template change:
 
 | What changed | Command to run |
 |---|---|
 | `src/vstack/_templates/agents/<name>/config.yaml` or `template.md` | `python3 -m vstack install` |
 | `src/vstack/_templates/skills/<name>/template.md` or `_partials/*.md` | `python3 -m vstack install` |
 | `src/vstack/_templates/instructions/<name>/template.md` | `python3 -m vstack install` |
-| `src/vstack/_templates/prompts/<name>/template.md` | `python3 -m vstack install` |
 
 A single command handles all artifact types:
 
 ```bash
 python3 -m vstack install
 ```
 
-Never edit `.github/agents/`, `.github/skills/`, `.github/instructions/`, or `.github/prompts/` directly — changes will be overwritten.
+Never edit generated files in `.github/agents/`, `.github/skills/`, or `.github/instructions/` directly — changes will be overwritten. Repository-only skills are edited directly and remain outside manifest ownership. Legacy managed prompts are retired by install/init only when safe.
 
 ## Execution Model
 

.github/instructions/git.instructions.md

@@ -41,4 +41,4 @@ Use these Git and release hygiene conventions.
 1. Prefer local verification before pushing release-impacting changes.
 
 <!-- AUTO-GENERATED — maintained by vstack, do not edit directly -->
-<!-- VSTACK-META: {"artifact_name":"git","artifact_type":"instruction","artifact_version":"20260421001","generator":"vstack","vstack_version":"3.6.0"} -->
+<!-- VSTACK-META: {"artifact_name":"git","artifact_type":"instruction","artifact_version":"20260421001","generator":"vstack","vstack_version":"3.7.8"} -->

.github/instructions/helm.instructions.md

@@ -45,4 +45,4 @@ Use these Helm conventions.
 - [Helm chart best practices](https://helm.sh/docs/chart_best_practices/)
 
 <!-- AUTO-GENERATED — maintained by vstack, do not edit directly -->
-<!-- VSTACK-META: {"artifact_name":"helm","artifact_type":"instruction","artifact_version":"20260502040","generator":"vstack","vstack_version":"3.6.0"} -->
+<!-- VSTACK-META: {"artifact_name":"helm","artifact_type":"instruction","artifact_version":"20260502040","generator":"vstack","vstack_version":"3.7.8"} -->

.github/instructions/java.instructions.md

@@ -56,4 +56,4 @@ Use these Java conventions.
 1. Do not suppress static analysis warnings without a documented, task-specific reason.
 
 <!-- AUTO-GENERATED — maintained by vstack, do not edit directly -->
-<!-- VSTACK-META: {"artifact_name":"java","artifact_type":"instruction","artifact_version":"20260502001","generator":"vstack","vstack_version":"3.6.0"} -->
+<!-- VSTACK-META: {"artifact_name":"java","artifact_type":"instruction","artifact_version":"20260502001","generator":"vstack","vstack_version":"3.7.8"} -->

.github/instructions/k8s.instructions.md

@@ -51,4 +51,4 @@ Use these Kubernetes conventions.
 - [Kubernetes API reference](https://kubernetes.io/docs/reference/kubernetes-api/)
 
 <!-- AUTO-GENERATED — maintained by vstack, do not edit directly -->
-<!-- VSTACK-META: {"artifact_name":"k8s","artifact_type":"instruction","artifact_version":"20260502039","generator":"vstack","vstack_version":"3.6.0"} -->
+<!-- VSTACK-META: {"artifact_name":"k8s","artifact_type":"instruction","artifact_version":"20260502039","generator":"vstack","vstack_version":"3.7.8"} -->

.github/instructions/markdown.instructions.md

@@ -51,4 +51,4 @@ Use these Markdown conventions.
 1. Keep examples accurate and runnable.
 
 <!-- AUTO-GENERATED — maintained by vstack, do not edit directly -->
-<!-- VSTACK-META: {"artifact_name":"markdown","artifact_type":"instruction","artifact_version":"20260502002","generator":"vstack","vstack_version":"3.6.0"} -->
+<!-- VSTACK-META: {"artifact_name":"markdown","artifact_type":"instruction","artifact_version":"20260502002","generator":"vstack","vstack_version":"3.7.8"} -->

.github/instructions/python.instructions.md

@@ -42,4 +42,4 @@ Use these Python conventions.
 1. Do not silence lint/type errors unless there is a documented, task-specific reason.
 
 <!-- AUTO-GENERATED — maintained by vstack, do not edit directly -->
-<!-- VSTACK-META: {"artifact_name":"python","artifact_type":"instruction","artifact_version":"20260421002","generator":"vstack","vstack_version":"3.6.0"} -->
+<!-- VSTACK-META: {"artifact_name":"python","artifact_type":"instruction","artifact_version":"20260421002","generator":"vstack","vstack_version":"3.7.8"} -->

.github/instructions/rancher.instructions.md

@@ -44,4 +44,4 @@ Use these Rancher conventions.
 - [Fleet docs](https://fleet.rancher.io/)
 
 <!-- AUTO-GENERATED — maintained by vstack, do not edit directly -->
-<!-- VSTACK-META: {"artifact_name":"rancher","artifact_type":"instruction","artifact_version":"20260502041","generator":"vstack","vstack_version":"3.6.0"} -->
+<!-- VSTACK-META: {"artifact_name":"rancher","artifact_type":"instruction","artifact_version":"20260502041","generator":"vstack","vstack_version":"3.7.8"} -->

.github/instructions/security.instructions.md

@@ -42,4 +42,4 @@ Use these security policies.
 1. Keep privileged logic minimal, auditable, and separate from business logic.
 
 <!-- AUTO-GENERATED — maintained by vstack, do not edit directly -->
-<!-- VSTACK-META: {"artifact_name":"security","artifact_type":"instruction","artifact_version":"20260502003","generator":"vstack","vstack_version":"3.6.0"} -->
+<!-- VSTACK-META: {"artifact_name":"security","artifact_type":"instruction","artifact_version":"20260502003","generator":"vstack","vstack_version":"3.7.8"} -->

.github/instructions/terraform.instructions.md

@@ -60,4 +60,4 @@ Use these Terraform conventions.
 - [tfsec](https://aquasecurity.github.io/tfsec/) · [checkov](https://www.checkov.io/)
 
 <!-- AUTO-GENERATED — maintained by vstack, do not edit directly -->
-<!-- VSTACK-META: {"artifact_name":"terraform","artifact_type":"instruction","artifact_version":"20260502034","generator":"vstack","vstack_version":"3.6.0"} -->
+<!-- VSTACK-META: {"artifact_name":"terraform","artifact_type":"instruction","artifact_version":"20260502034","generator":"vstack","vstack_version":"3.7.8"} -->

.github/instructions/terragrunt.instructions.md

@@ -57,4 +57,4 @@ Use these Terragrunt conventions.
 - [Terragrunt CLI reference](https://terragrunt.gruntwork.io/docs/reference/cli-options/)
 
 <!-- AUTO-GENERATED — maintained by vstack, do not edit directly -->
-<!-- VSTACK-META: {"artifact_name":"terragrunt","artifact_type":"instruction","artifact_version":"20260502035","generator":"vstack","vstack_version":"3.6.0"} -->
+<!-- VSTACK-META: {"artifact_name":"terragrunt","artifact_type":"instruction","artifact_version":"20260502035","generator":"vstack","vstack_version":"3.7.8"} -->

.github/instructions/testing.instructions.md

@@ -43,4 +43,4 @@ Use these testing conventions.
 1. Treat flaky tests as bugs.
 
 <!-- AUTO-GENERATED — maintained by vstack, do not edit directly -->
-<!-- VSTACK-META: {"artifact_name":"testing","artifact_type":"instruction","artifact_version":"20260502004","generator":"vstack","vstack_version":"3.6.0"} -->
+<!-- VSTACK-META: {"artifact_name":"testing","artifact_type":"instruction","artifact_version":"20260502004","generator":"vstack","vstack_version":"3.7.8"} -->

.github/instructions/typescript.instructions.md

@@ -49,4 +49,4 @@ Use these TypeScript conventions.
 1. Do not suppress lint or type errors with inline disable comments unless there is a documented, task-specific reason.
 
 <!-- AUTO-GENERATED — maintained by vstack, do not edit directly -->
-<!-- VSTACK-META: {"artifact_name":"typescript","artifact_type":"instruction","artifact_version":"20260502005","generator":"vstack","vstack_version":"3.6.0"} -->
+<!-- VSTACK-META: {"artifact_name":"typescript","artifact_type":"instruction","artifact_version":"20260502005","generator":"vstack","vstack_version":"3.7.8"} -->