feat(skills): add references/, pre-launch checklist, skill discovery guide (v0.1.39)

1. references/ directory with 4 standalone checklists:
   - accessibility-checklist.md (WCAG 2.1 AA)
   - performance-checklist.md (Core Web Vitals, backend, frontend)
   - security-checklist.md (OWASP Top 10, headers, secrets, deps)
   - testing-patterns.md (AAA, pyramid, anti-patterns, Prove-It)
   Cross-referenced from frontend-ui, security, and tdd skills.

2. Pre-launch checklist in close phase (flow-code-run + work phases.md):
   6-dimension gate: code quality, security, performance, accessibility,
   infrastructure, documentation. Skips non-applicable dimensions.

3. flow-code-guide meta-skill: skill selection flowchart, engineering
   skills table, reference checklist links, pipeline overview.
   Referenced from preamble startup sequence.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: z23cc

bin/flowctl

@@ -504,16 +504,25 @@ Context optimization. Each task gets fresh context:
 
 ---
 
-## Step 15: Quality
+## Step 15: Quality & Pre-Launch Checklist
 
 After all tasks complete (or periodically for large epics):
 
-- Run relevant tests
-- Run lint/format per repo
+- Run `$FLOWCTL guard` (lint + type + test must pass)
 - If change is large/risky, run the quality auditor subagent:
   - Task flow-code:quality-auditor("Review recent changes")
 - Fix critical issues
 
+**Pre-launch checklist** — verify all applicable dimensions before shipping:
+- **Code quality**: guard passes, no Critical/Important review findings open
+- **Security**: no secrets in code, input validated at boundaries (see `references/security-checklist.md`)
+- **Performance**: no N+1 queries, list endpoints paginated (see `references/performance-checklist.md`)
+- **Accessibility**: keyboard navigable, screen reader compatible (frontend changes — see `references/accessibility-checklist.md`)
+- **Infrastructure**: env vars documented, migrations reversible, feature flags configured
+- **Documentation**: README/CHANGELOG updated if user-facing, API docs match implementation
+
+Skip dimensions not applicable to the change (e.g., skip accessibility for backend-only epics).
+
 ## Step 16: Ship
 
 **Verify all tasks done**:

codex/skills/flow-code-work/phases.md

@@ -1,6 +1,6 @@
 [package]
 name = "flowctl-cli"
-version = "0.1.38"
+version = "0.1.39"
 description = "CLI entry point for flowctl"
 edition.workspace = true
 rust-version.workspace = true

flowctl/crates/flowctl-cli/Cargo.toml

@@ -0,0 +1,70 @@
+# Accessibility Checklist (WCAG 2.1 AA)
+
+Quick reference for `flow-code-frontend-ui` and code review. Every user-facing change should pass these checks.
+
+## Keyboard Navigation
+
+- [ ] All interactive elements reachable via Tab
+- [ ] Focus order follows visual reading order
+- [ ] Focus indicator visible on all focused elements
+- [ ] No keyboard traps (can Tab in AND out of every component)
+- [ ] Custom widgets handle Enter, Space, Escape, Arrow keys as expected
+- [ ] Skip-to-content link on pages with navigation
+
+## Screen Readers
+
+- [ ] All images have `alt` text (decorative images use `alt=""`)
+- [ ] Form inputs have associated `<label>` or `aria-label`
+- [ ] Icon-only buttons have `aria-label`
+- [ ] Page has one `<h1>`, heading levels don't skip (h1→h2→h3)
+- [ ] Landmark roles present: `<main>`, `<nav>`, `<header>`, `<footer>`
+- [ ] Dynamic content changes announced via `aria-live` regions
+- [ ] Tables have `<th>` headers with `scope` attributes
+
+## Color & Contrast
+
+- [ ] Text contrast ratio >= 4.5:1 (normal text), >= 3:1 (large text/UI components)
+- [ ] Color is NOT the sole indicator of state (add icons, text, or patterns)
+- [ ] UI is usable in high-contrast mode
+- [ ] Links distinguishable from body text without relying on color alone
+
+## Forms
+
+- [ ] Error messages associated with the field (via `aria-describedby` or `aria-errormessage`)
+- [ ] Required fields marked with `aria-required="true"` (not just `*`)
+- [ ] Autocomplete attributes on common fields (name, email, address)
+- [ ] Form validation errors summarized and focusable
+
+## Motion & Media
+
+- [ ] Animations respect `prefers-reduced-motion`
+- [ ] No content flashes more than 3 times per second
+- [ ] Video has captions; audio has transcripts
+- [ ] Auto-playing media has pause/stop control
+
+## Responsive & Touch
+
+- [ ] Touch targets >= 44x44px
+- [ ] Content readable at 200% zoom without horizontal scroll
+- [ ] Works in both portrait and landscape orientation
+- [ ] Pinch-to-zoom not disabled (`user-scalable=no` removed)
+
+## Testing Tools
+
+```bash
+# Browser extensions
+- axe DevTools (Deque)
+- WAVE (WebAIM)
+- Lighthouse accessibility audit
+
+# CLI
+npx axe-core <url>
+npx pa11y <url>
+```
+
+## Quick Test
+
+1. Unplug mouse, navigate with keyboard only
+2. Turn on VoiceOver (Mac: Cmd+F5) / NVDA (Windows), listen to the page
+3. Zoom browser to 200%, check layout
+4. Run axe DevTools scan, fix all Critical/Serious issues

references/accessibility-checklist.md

@@ -0,0 +1,73 @@
+# Performance Checklist
+
+Quick reference for `flow-code-performance` and code review. Measure first, optimize second.
+
+## Core Web Vitals Targets
+
+| Metric | Good | Needs Work | Poor |
+|--------|------|------------|------|
+| **LCP** (Largest Contentful Paint) | <= 2.5s | <= 4.0s | > 4.0s |
+| **INP** (Interaction to Next Paint) | <= 200ms | <= 500ms | > 500ms |
+| **CLS** (Cumulative Layout Shift) | <= 0.1 | <= 0.25 | > 0.25 |
+
+## Frontend
+
+- [ ] Images: use `<img loading="lazy">`, modern formats (WebP/AVIF), explicit `width`/`height`
+- [ ] Fonts: `font-display: swap`, preload critical fonts, subset unused glyphs
+- [ ] Bundle: code-split routes, tree-shake unused exports, analyze with `source-map-explorer`
+- [ ] CSS: no unused styles in critical path, `content-visibility: auto` for off-screen content
+- [ ] Scripts: defer non-critical JS, avoid render-blocking `<script>` tags
+- [ ] Caching: `Cache-Control` headers for static assets, service worker for repeat visits
+- [ ] Layout: no CLS from dynamic content (reserve space for images, ads, embeds)
+
+## React / Frontend Frameworks
+
+- [ ] No unnecessary re-renders (React DevTools Profiler)
+- [ ] `React.memo` only on measured bottlenecks (not everywhere)
+- [ ] `useMemo`/`useCallback` only when child components depend on referential equality
+- [ ] Lists use stable `key` props (not array index)
+- [ ] Large lists use virtualization (`react-window`, `@tanstack/virtual`)
+- [ ] Server components / SSR for data-heavy pages
+
+## Backend / API
+
+- [ ] No N+1 queries (use eager loading / `JOIN` / `DataLoader`)
+- [ ] List endpoints paginated (no unbounded `SELECT *`)
+- [ ] Database queries use indexes (check `EXPLAIN ANALYZE`)
+- [ ] Expensive computations cached (Redis, in-memory, HTTP cache headers)
+- [ ] Async operations don't block request thread (use queues for heavy work)
+- [ ] Connection pooling configured (DB, HTTP clients)
+- [ ] Response compression enabled (gzip/brotli)
+
+## Monitoring
+
+- [ ] Real User Monitoring (RUM) collecting Core Web Vitals
+- [ ] Server-side latency tracked (p50, p95, p99)
+- [ ] Error rate dashboards with alerting
+- [ ] Performance budget defined and enforced in CI
+
+## Testing Tools
+
+```bash
+# Lighthouse CI
+npx lhci autorun
+
+# Web Vitals library (in-app)
+import { onLCP, onINP, onCLS } from 'web-vitals';
+
+# Bundle analysis
+npx source-map-explorer dist/**/*.js
+
+# Database query analysis
+EXPLAIN ANALYZE SELECT ...;
+```
+
+## Anti-Patterns to Flag in Review
+
+- `SELECT *` without LIMIT
+- Synchronous file I/O in request handlers
+- Missing pagination on list endpoints
+- Image without width/height (causes CLS)
+- `JSON.parse` on megabyte-scale strings in hot path
+- Polling when WebSocket/SSE would work
+- Loading entire library for one utility function

references/performance-checklist.md

@@ -0,0 +1,95 @@
+# Security Checklist
+
+Quick reference for `flow-code-security` and code review. OWASP Top 10 prevention.
+
+## Input Validation
+
+- [ ] All user input validated with schema (Zod, Joi, Pydantic) at system boundary
+- [ ] SQL queries use parameterized statements (never string concatenation)
+- [ ] OS commands use `execFile` with argument arrays (never `exec` with template strings)
+- [ ] File paths validated and sandboxed (no path traversal: `../`)
+- [ ] Regular expressions tested for ReDoS (no catastrophic backtracking)
+
+## Authentication
+
+- [ ] Passwords hashed with bcrypt/scrypt/argon2 (never MD5/SHA1/plaintext)
+- [ ] Account lockout after 5 failed login attempts
+- [ ] Session tokens rotated after login
+- [ ] Session expiry configured (idle + absolute timeout)
+- [ ] Constant-time comparison for token/password verification
+- [ ] Multi-factor authentication available for sensitive operations
+
+## Authorization
+
+- [ ] Every endpoint checks both authentication AND authorization
+- [ ] Resource access verifies ownership (not just "is logged in")
+- [ ] Principle of least privilege for service accounts
+- [ ] Admin operations require elevated permissions (not just role check)
+
+## Data Protection
+
+- [ ] Sensitive data encrypted at rest (AES-256)
+- [ ] TLS 1.2+ for all data in transit (no mixed content)
+- [ ] PII masked in logs: `email: "j***@example.com"`
+- [ ] API responses return only needed fields (DTOs, not raw models)
+- [ ] `Cache-Control: no-store` for pages with sensitive data
+- [ ] No secrets in source code, environment variables, or logs
+
+## HTTP Security Headers
+
+```
+Content-Security-Policy: default-src 'self';
+X-Content-Type-Options: nosniff
+X-Frame-Options: DENY
+Strict-Transport-Security: max-age=31536000; includeSubDomains
+Referrer-Policy: strict-origin-when-cross-origin
+Permissions-Policy: camera=(), microphone=(), geolocation=()
+```
+
+## Cookies
+
+- [ ] Auth cookies: `httpOnly`, `secure`, `sameSite=Strict` (or `Lax`)
+- [ ] No session data in `localStorage` (vulnerable to XSS)
+- [ ] CSRF tokens on state-changing requests
+
+## File Uploads
+
+- [ ] MIME type validated from file content (not just extension)
+- [ ] Maximum file size enforced server-side
+- [ ] Filenames regenerated (never use user-provided names)
+- [ ] Files stored outside web root
+- [ ] `Content-Disposition: attachment` on downloads
+
+## Dependencies
+
+- [ ] `npm audit` / `cargo audit` / `pip audit` run in CI
+- [ ] Critical/High vulnerabilities in production deps fixed immediately
+- [ ] Dependency lockfile committed (`package-lock.json`, `Cargo.lock`)
+- [ ] No unused dependencies (attack surface reduction)
+
+## Secrets Management
+
+- [ ] `.env` in `.gitignore` (always)
+- [ ] `.env.example` with placeholder values committed
+- [ ] Secrets rotated immediately if ever committed to git
+- [ ] Production secrets in secrets manager (Vault, AWS SM, GCP SM)
+- [ ] No secrets in CI logs, error messages, or API responses
+
+## Rate Limiting
+
+- [ ] Auth endpoints: 5 attempts per minute per IP
+- [ ] API endpoints: appropriate limits per user/key
+- [ ] Public endpoints: DDoS protection (Cloudflare, WAF)
+- [ ] Rate limit headers returned: `X-RateLimit-Remaining`
+
+## Quick Audit
+
+```bash
+# Check for secrets in staged files
+git diff --cached | grep -iE '(password|secret|token|api_key|private_key)\s*='
+
+# Check for dangerous patterns
+grep -rn 'eval(' --include='*.ts' --include='*.js' src/
+grep -rn 'dangerouslySetInnerHTML' --include='*.tsx' --include='*.jsx' src/
+grep -rn 'innerHTML' --include='*.ts' --include='*.js' src/
+```