chore: point module skills to installed provider guidance

Teach module maintenance skills to load installed shared provider, framework, database, SDK, and platform skills before changing provider-specific behavior.

Author: jesseoue

docs/maintenance.md

@@ -16,12 +16,12 @@ These files teach maintainers:
 
 This is a core part of the product, not an afterthought.
 
-## Shared Technology Skills
+## Shared Provider And Technology Skills
 
-Technology guidance that applies to multiple modules lives in:
+Provider, framework, database, SDK, and platform guidance that applies to multiple modules lives in:
 
 ```text
-registry/skills/<technology>/SKILL.md
+registry/skills/<name>/SKILL.md
 ```
 
 Reference shared skills from `module.json` in `maintenance.skills`:
@@ -36,6 +36,8 @@ Reference shared skills from `module.json` in `maintenance.skills`:
 
 By default, a skill named the same as the module is read from `skill/SKILL.md`. Other skill names are read from `registry/skills/<name>/SKILL.md`.
 
+Module skills should not duplicate provider API guidance. They should point maintainers to the installed shared skill, for example `.stackfoundry/skills/stripe/SKILL.md`, and keep the module skill focused on ownership, installed files, environment variables, deployment checks, and module-specific invariants.
+
 For modules that need a custom source or install location, use an object entry:
 
 ```json
@@ -51,15 +53,15 @@ For modules that need a custom source or install location, use an object entry:
 
 ## Installed Location
 
-When a module is installed, module and technology skills are copied to:
+When a module is installed, module and shared skills are copied to:
 
 ```text
 .stackfoundry/skills/<skill>/SKILL.md
 ```
 
 Generated registry blocks also embed `maintenanceSkills`, so installs from `https://stackfoundry.dev/r/<module>.json` carry the same maintenance guidance as local module installs.
 
-Module skills should explain the files owned by the module, required environment variables, deployment checks, and invariants that future maintainers must preserve. Shared technology skills should stay provider- or framework-level and avoid repeating module-specific instructions.
+Module skills should explain the files owned by the module, required environment variables, deployment checks, and invariants that future maintainers must preserve. Shared skills should stay provider-, framework-, database-, SDK-, or platform-level and avoid repeating module-specific instructions.
 
 ## Provider Adapter Blocks
 
@@ -72,4 +74,4 @@ Provider adapter modules should include:
 - smoke-test routes or helpers when possible
 - rules for keeping secrets server-only
 
-Run `pnpm registry:doctor` to verify module skills, shared technology skills, custom skill targets, and manifest references.
+Run `pnpm registry:doctor` to verify module skills, shared provider and technology skills, custom skill targets, and manifest references.

docs/modules.md

@@ -21,6 +21,8 @@ The registry now includes core modules, provider adapter examples, and registry-
 - maintenance guidance
 - install metadata for diff/update safety
 
+Module-specific skills stay focused on ownership, installed files, environment variables, deployment checks, and invariants. Provider, framework, database, SDK, and platform guidance lives in shared skills such as `.stackfoundry/skills/stripe/SKILL.md`, copied from `registry/skills/stripe/SKILL.md` during install.
+
 ## Module Families
 
 ### Foundation

public/r/account-deletion.json

@@ -33,17 +33,17 @@
     {
       "name": "account-deletion",
       "target": ".stackfoundry/skills/account-deletion/SKILL.md",
-      "content": "---\nname: account-deletion\ndescription: Maintain the Account Deletion module installed by StackFoundry.\n---\n\n# Account Deletion Maintenance Instructions\n\n- Preserve the ownership and setup guidance in `docs.md`.\n- Keep source templates small and provider-neutral.\n- Update `tests/checklist.md` with behavior changes.\n- Do not commit secrets, local state, or generated machine metadata.\n- Keep Drizzle schema exports synchronized with `module.json`.\n"
+      "content": "---\nname: account-deletion\ndescription: Maintain the Account Deletion module installed by StackFoundry.\n---\n\n# Account Deletion Maintenance Instructions\n\n- Preserve the ownership and setup guidance in `docs.md`.\n- Keep source templates small and provider-neutral.\n- Update `tests/checklist.md` with behavior changes.\n- Do not commit secrets, local state, or generated machine metadata.\n- Keep Drizzle schema exports synchronized with `module.json`.\n\n## Shared Skills\n\nWhen provider, framework, or database behavior changes, load the installed shared skill before editing implementation details:\n\n- `.stackfoundry/skills/nextjs/SKILL.md` (source: `registry/skills/nextjs/SKILL.md`)\n- `.stackfoundry/skills/drizzle/SKILL.md` (source: `registry/skills/drizzle/SKILL.md`)\n\nKeep this module skill focused on ownership, installed files, env vars, deployment checks, and module-specific invariants.\n\n"
     },
     {
       "name": "nextjs",
       "target": ".stackfoundry/skills/nextjs/SKILL.md",
-      "content": "---\nname: nextjs\ndescription: Maintain Next.js App Router code installed by StackFoundry modules.\n---\n\n# Next.js Operating Instructions\n\n- Keep server-only data access out of Client Components.\n- Put route handlers under `app/api` and UI routes under the relevant App Router segment.\n- Prefer Server Components for data loading and add `\"use client\"` only for interactivity.\n- Keep public environment variables prefixed with `NEXT_PUBLIC_`; keep secrets server-only.\n- Re-run typecheck and build after changing route handlers, layouts, or shared app configuration.\n"
+      "content": "---\nname: nextjs\ndescription: Maintain Next.js App Router code installed by StackFoundry modules.\n---\n\n# Next.js Operating Instructions\n\n## Installed Location\n\n- Installed target: `.stackfoundry/skills/nextjs/SKILL.md`\n- Registry source: `registry/skills/nextjs/SKILL.md`\n\nAgents maintaining an installed module should load this shared skill from the installed target when provider, framework, database, SDK, or platform behavior is involved. Keep provider-specific API details here instead of duplicating them inside module maintenance skills.\n\n- Keep server-only data access out of Client Components.\n- Put route handlers under `app/api` and UI routes under the relevant App Router segment.\n- Prefer Server Components for data loading and add `\"use client\"` only for interactivity.\n- Keep public environment variables prefixed with `NEXT_PUBLIC_`; keep secrets server-only.\n- Re-run typecheck and build after changing route handlers, layouts, or shared app configuration.\n"
     },
     {
       "name": "drizzle",
       "target": ".stackfoundry/skills/drizzle/SKILL.md",
-      "content": "---\nname: drizzle\ndescription: Maintain Drizzle ORM and Postgres code installed by StackFoundry modules.\n---\n\n# Drizzle Operating Instructions\n\n- Keep database access in server-only code.\n- Add schema changes under `packages/db/src/schema` and export shared tables from the schema barrel.\n- Generate and commit migrations when schema changes are intended.\n- Use typed query helpers instead of raw SQL unless the query needs a documented escape hatch.\n- Include tenant, organization, or user scope in queries and cache tags whenever data is not global.\n"
+      "content": "---\nname: drizzle\ndescription: Maintain Drizzle ORM and Postgres code installed by StackFoundry modules.\n---\n\n# Drizzle Operating Instructions\n\n## Installed Location\n\n- Installed target: `.stackfoundry/skills/drizzle/SKILL.md`\n- Registry source: `registry/skills/drizzle/SKILL.md`\n\nAgents maintaining an installed module should load this shared skill from the installed target when provider, framework, database, SDK, or platform behavior is involved. Keep provider-specific API details here instead of duplicating them inside module maintenance skills.\n\n- Keep database access in server-only code.\n- Add schema changes under `packages/db/src/schema` and export shared tables from the schema barrel.\n- Generate and commit migrations when schema changes are intended.\n- Use typed query helpers instead of raw SQL unless the query needs a documented escape hatch.\n- Include tenant, organization, or user scope in queries and cache tags whenever data is not global.\n"
     }
   ],
   "envVars": {},

public/r/account-modes.json

@@ -35,17 +35,17 @@
     {
       "name": "account-modes",
       "target": ".stackfoundry/skills/account-modes/SKILL.md",
-      "content": "---\nname: account-modes\ndescription: Maintain the Account Modes module installed by StackFoundry.\n---\n\n# Account Modes Skill\n\n- Do not mix personal and organization data without an explicit active account context.\n- Hide organization invitations, roles, and seat billing when the app is personal-only.\n- Keep billing customer ownership aligned with the active account mode.\n- Make account switching explicit and auditable.\n- Update onboarding, navigation, and settings together when the account mode changes.\n"
+      "content": "---\nname: account-modes\ndescription: Maintain the Account Modes module installed by StackFoundry.\n---\n\n# Account Modes Skill\n\n- Do not mix personal and organization data without an explicit active account context.\n- Hide organization invitations, roles, and seat billing when the app is personal-only.\n- Keep billing customer ownership aligned with the active account mode.\n- Make account switching explicit and auditable.\n- Update onboarding, navigation, and settings together when the account mode changes.\n\n## Shared Skills\n\nWhen provider, framework, or database behavior changes, load the installed shared skill before editing implementation details:\n\n- `.stackfoundry/skills/nextjs/SKILL.md` (source: `registry/skills/nextjs/SKILL.md`)\n- `.stackfoundry/skills/drizzle/SKILL.md` (source: `registry/skills/drizzle/SKILL.md`)\n\nKeep this module skill focused on ownership, installed files, env vars, deployment checks, and module-specific invariants.\n\n"
     },
     {
       "name": "nextjs",
       "target": ".stackfoundry/skills/nextjs/SKILL.md",
-      "content": "---\nname: nextjs\ndescription: Maintain Next.js App Router code installed by StackFoundry modules.\n---\n\n# Next.js Operating Instructions\n\n- Keep server-only data access out of Client Components.\n- Put route handlers under `app/api` and UI routes under the relevant App Router segment.\n- Prefer Server Components for data loading and add `\"use client\"` only for interactivity.\n- Keep public environment variables prefixed with `NEXT_PUBLIC_`; keep secrets server-only.\n- Re-run typecheck and build after changing route handlers, layouts, or shared app configuration.\n"
+      "content": "---\nname: nextjs\ndescription: Maintain Next.js App Router code installed by StackFoundry modules.\n---\n\n# Next.js Operating Instructions\n\n## Installed Location\n\n- Installed target: `.stackfoundry/skills/nextjs/SKILL.md`\n- Registry source: `registry/skills/nextjs/SKILL.md`\n\nAgents maintaining an installed module should load this shared skill from the installed target when provider, framework, database, SDK, or platform behavior is involved. Keep provider-specific API details here instead of duplicating them inside module maintenance skills.\n\n- Keep server-only data access out of Client Components.\n- Put route handlers under `app/api` and UI routes under the relevant App Router segment.\n- Prefer Server Components for data loading and add `\"use client\"` only for interactivity.\n- Keep public environment variables prefixed with `NEXT_PUBLIC_`; keep secrets server-only.\n- Re-run typecheck and build after changing route handlers, layouts, or shared app configuration.\n"
     },
     {
       "name": "drizzle",
       "target": ".stackfoundry/skills/drizzle/SKILL.md",
-      "content": "---\nname: drizzle\ndescription: Maintain Drizzle ORM and Postgres code installed by StackFoundry modules.\n---\n\n# Drizzle Operating Instructions\n\n- Keep database access in server-only code.\n- Add schema changes under `packages/db/src/schema` and export shared tables from the schema barrel.\n- Generate and commit migrations when schema changes are intended.\n- Use typed query helpers instead of raw SQL unless the query needs a documented escape hatch.\n- Include tenant, organization, or user scope in queries and cache tags whenever data is not global.\n"
+      "content": "---\nname: drizzle\ndescription: Maintain Drizzle ORM and Postgres code installed by StackFoundry modules.\n---\n\n# Drizzle Operating Instructions\n\n## Installed Location\n\n- Installed target: `.stackfoundry/skills/drizzle/SKILL.md`\n- Registry source: `registry/skills/drizzle/SKILL.md`\n\nAgents maintaining an installed module should load this shared skill from the installed target when provider, framework, database, SDK, or platform behavior is involved. Keep provider-specific API details here instead of duplicating them inside module maintenance skills.\n\n- Keep database access in server-only code.\n- Add schema changes under `packages/db/src/schema` and export shared tables from the schema barrel.\n- Generate and commit migrations when schema changes are intended.\n- Use typed query helpers instead of raw SQL unless the query needs a documented escape hatch.\n- Include tenant, organization, or user scope in queries and cache tags whenever data is not global.\n"
     }
   ],
   "envVars": {},

public/r/account-settings.json

@@ -25,12 +25,12 @@
     {
       "name": "account-settings",
       "target": ".stackfoundry/skills/account-settings/SKILL.md",
-      "content": "---\nname: account-settings\ndescription: Maintain the Account Settings module installed by StackFoundry.\n---\n\n# Account Settings Maintenance Instructions\n\n- Preserve the module boundary described in `docs.md`.\n- Keep public APIs small and typed.\n- Update tests/checklist.md when behavior changes.\n- Do not introduce secrets, generated machine metadata, or provider lock-in.\n"
+      "content": "---\nname: account-settings\ndescription: Maintain the Account Settings module installed by StackFoundry.\n---\n\n# Account Settings Maintenance Instructions\n\n- Preserve the module boundary described in `docs.md`.\n- Keep public APIs small and typed.\n- Update tests/checklist.md when behavior changes.\n- Do not introduce secrets, generated machine metadata, or provider lock-in.\n\n## Shared Skills\n\nWhen provider, framework, or database behavior changes, load the installed shared skill before editing implementation details:\n\n- `.stackfoundry/skills/nextjs/SKILL.md` (source: `registry/skills/nextjs/SKILL.md`)\n\nKeep this module skill focused on ownership, installed files, env vars, deployment checks, and module-specific invariants.\n\n"
     },
     {
       "name": "nextjs",
       "target": ".stackfoundry/skills/nextjs/SKILL.md",
-      "content": "---\nname: nextjs\ndescription: Maintain Next.js App Router code installed by StackFoundry modules.\n---\n\n# Next.js Operating Instructions\n\n- Keep server-only data access out of Client Components.\n- Put route handlers under `app/api` and UI routes under the relevant App Router segment.\n- Prefer Server Components for data loading and add `\"use client\"` only for interactivity.\n- Keep public environment variables prefixed with `NEXT_PUBLIC_`; keep secrets server-only.\n- Re-run typecheck and build after changing route handlers, layouts, or shared app configuration.\n"
+      "content": "---\nname: nextjs\ndescription: Maintain Next.js App Router code installed by StackFoundry modules.\n---\n\n# Next.js Operating Instructions\n\n## Installed Location\n\n- Installed target: `.stackfoundry/skills/nextjs/SKILL.md`\n- Registry source: `registry/skills/nextjs/SKILL.md`\n\nAgents maintaining an installed module should load this shared skill from the installed target when provider, framework, database, SDK, or platform behavior is involved. Keep provider-specific API details here instead of duplicating them inside module maintenance skills.\n\n- Keep server-only data access out of Client Components.\n- Put route handlers under `app/api` and UI routes under the relevant App Router segment.\n- Prefer Server Components for data loading and add `\"use client\"` only for interactivity.\n- Keep public environment variables prefixed with `NEXT_PUBLIC_`; keep secrets server-only.\n- Re-run typecheck and build after changing route handlers, layouts, or shared app configuration.\n"
     }
   ],
   "envVars": {},

public/r/admin-console.json

@@ -27,12 +27,12 @@
     {
       "name": "admin-console",
       "target": ".stackfoundry/skills/admin-console/SKILL.md",
-      "content": "---\nname: admin-console\ndescription: Maintain the Admin Console module installed by StackFoundry.\n---\n\n# Admin Console Maintenance Instructions\n\n- Preserve the module ownership described in `docs.md`.\n- Keep default source templates compact, typed, and provider-neutral.\n- Update `tests/checklist.md` when behavior changes.\n- Do not commit secrets, local state, or generated machine metadata.\n"
+      "content": "---\nname: admin-console\ndescription: Maintain the Admin Console module installed by StackFoundry.\n---\n\n# Admin Console Maintenance Instructions\n\n- Preserve the module ownership described in `docs.md`.\n- Keep default source templates compact, typed, and provider-neutral.\n- Update `tests/checklist.md` when behavior changes.\n- Do not commit secrets, local state, or generated machine metadata.\n\n## Shared Skills\n\nWhen provider, framework, or database behavior changes, load the installed shared skill before editing implementation details:\n\n- `.stackfoundry/skills/nextjs/SKILL.md` (source: `registry/skills/nextjs/SKILL.md`)\n\nKeep this module skill focused on ownership, installed files, env vars, deployment checks, and module-specific invariants.\n\n"
     },
     {
       "name": "nextjs",
       "target": ".stackfoundry/skills/nextjs/SKILL.md",
-      "content": "---\nname: nextjs\ndescription: Maintain Next.js App Router code installed by StackFoundry modules.\n---\n\n# Next.js Operating Instructions\n\n- Keep server-only data access out of Client Components.\n- Put route handlers under `app/api` and UI routes under the relevant App Router segment.\n- Prefer Server Components for data loading and add `\"use client\"` only for interactivity.\n- Keep public environment variables prefixed with `NEXT_PUBLIC_`; keep secrets server-only.\n- Re-run typecheck and build after changing route handlers, layouts, or shared app configuration.\n"
+      "content": "---\nname: nextjs\ndescription: Maintain Next.js App Router code installed by StackFoundry modules.\n---\n\n# Next.js Operating Instructions\n\n## Installed Location\n\n- Installed target: `.stackfoundry/skills/nextjs/SKILL.md`\n- Registry source: `registry/skills/nextjs/SKILL.md`\n\nAgents maintaining an installed module should load this shared skill from the installed target when provider, framework, database, SDK, or platform behavior is involved. Keep provider-specific API details here instead of duplicating them inside module maintenance skills.\n\n- Keep server-only data access out of Client Components.\n- Put route handlers under `app/api` and UI routes under the relevant App Router segment.\n- Prefer Server Components for data loading and add `\"use client\"` only for interactivity.\n- Keep public environment variables prefixed with `NEXT_PUBLIC_`; keep secrets server-only.\n- Re-run typecheck and build after changing route handlers, layouts, or shared app configuration.\n"
     }
   ],
   "envVars": {},