refactor: restructure skills/ into .ai/{knowledge,skills,prompts}

skills/best-practices/architecture.md → .ai/knowledge/architecture.md

@@ -1,6 +1,6 @@
 # Best Practice: Architecture
 
-Patterns from `Grand.Infrastructure`, `Grand.Business.*`, `Grand.Domain`. Complementary to `skills/reviews/architecture-review/SKILL.md`.
+Patterns from `Grand.Infrastructure`, `Grand.Business.*`, `Grand.Domain`. Complementary to `.ai/skills/architecture-review.md`.
 
 ---
 

skills/best-practices/security.md → .ai/knowledge/security.md

@@ -1,6 +1,6 @@
 # Best Practice: Security
 
-Patterns from `Grand.Web`, `Grand.Module.Api`, `Grand.Business.*`. Complementary to `skills/reviews/security-review/SKILL.md`.
+Patterns from `Grand.Web`, `Grand.Module.Api`, `Grand.Business.*`. Complementary to `.ai/skills/security-review.md`.
 
 ---
 

.ai/prompts/review-change.md

@@ -0,0 +1,27 @@
+# Prompt: Review Change
+
+## Purpose
+Review a pull request or diff against repository conventions before it is accepted.
+
+## Inputs Required
+- Repository root.
+- Change set or diff to review (files changed, additions, deletions).
+- Stated feature goal or pull request summary.
+
+## Steps
+
+1. Read `AGENTS.md` to identify which skills apply to the change.
+2. Load the relevant skills from `.ai/skills/`.
+3. Load relevant knowledge from `.ai/knowledge/` as needed (architecture rules, repository map, coding patterns).
+4. Review the change against the mandatory rules defined in each loaded skill.
+5. Report findings grouped by skill, listing only high-confidence issues.
+
+## Output Format
+
+For each finding:
+- **File and line**: exact location.
+- **Rule violated**: which mandatory rule from which skill.
+- **Impact**: what goes wrong if the issue is not fixed.
+- **Suggested fix**: concrete, minimal change.
+
+Omit style, formatting, and preference feedback unless a mandatory rule is violated.

skills/admin-area-changes/SKILL.md → .ai/skills/admin-area-changes.md

@@ -28,7 +28,7 @@ Do not use this skill as the primary review for MongoDB query safety, template m
 
 ### Mandatory Rules
 1. Identify whether the change belongs to Admin, Store Owner, Vendor, AdminShared, or multiple areas.
-2. Read `references/admin-areas.md` before creating or changing an admin workflow.
+2. Read `.ai/knowledge/admin-areas.md` before creating or changing an admin workflow.
 3. Locate matching controllers in `src/Web/Grand.Web.Admin/Controllers`, `src/Web/Grand.Web.Store/Controllers`, and `src/Web/Grand.Web.Vendor/Controllers`.
 4. Locate matching views in `src/Web/Grand.Web.Admin/Areas/Admin/Views`, `src/Web/Grand.Web.Store/Areas/Store/Views`, and `src/Web/Grand.Web.Vendor/Areas/Vendor/Views`.
 5. Locate shared models, validators, and mapper profiles in `src/Web/Grand.Web.AdminShared`.

skills/plugins/plugin-module/SKILL.md → .ai/skills/plugin-module.md

@@ -27,8 +27,8 @@ Do not use this skill as the primary review for payment correctness, tenant isol
 ### Mandatory Rules
 1. Identify whether the work is a plugin under `src/Plugins` or a module under `src/Modules`.
 2. Identify the closest existing implementation and follow its folder, namespace, project, startup, controller, view, setting, and test patterns.
-3. Read `references/plugin-types.md` before creating or changing a plugin.
-4. Read `references/module-types.md` before creating or changing a module.
+3. Read `.ai/knowledge/plugin-types.md` before creating or changing a plugin.
+4. Read `.ai/knowledge/module-types.md` before creating or changing a module.
 5. Use a stable system name that matches the repository convention, such as `Payments.X`, `Shipping.X`, `Tax.X`, `Widgets.X`, `Authentication.X`, `DiscountRules.X`, `ExchangeRate.X`, or `Theme.X`.
 6. Add or update `Manifest.cs` for plugins with `[assembly: PluginInfo(...)]`.
 7. Add or update a plugin class that derives from `BasePlugin` when install, uninstall, or configuration behavior is required.

skills/project-structure/SKILL.md → .ai/skills/project-structure.md

@@ -23,7 +23,7 @@ Do not use this skill as a replacement for domain-specific skills such as plugin
 ## Instructions
 
 ### Mandatory Rules
-1. Read `references/repository-map.md` before making structural decisions.
+1. Read `.ai/knowledge/repository-map.md` before making structural decisions.
 2. Identify the requested change type: domain, business service, data access, web UI, admin UI, API, plugin, module, frontend asset, test, build, or deployment.
 3. Locate the closest existing feature with the same entity or workflow.
 4. Follow the existing folder, namespace, dependency, registration, model, mapper, validator, controller, view, and test patterns.

skills/template-creation/SKILL.md → .ai/skills/template-creation.md

@@ -26,7 +26,7 @@ Do not use this skill as the primary review for payment correctness, security, M
 
 ### Mandatory Rules
 1. Identify the template type before editing.
-2. Read `references/template-types.md` before creating a new template or changing an unfamiliar template type.
+2. Read `.ai/knowledge/template-types.md` before creating a new template or changing an unfamiliar template type.
 3. Locate the closest existing template in the same area and follow its folder, naming, model, layout, localization, tag helper, JavaScript, and CSS conventions.
 4. Keep templates in the owning project or plugin; do not place plugin-owned views directly in `Grand.Web`.
 5. Use the existing view location convention for the target area.

AGENTS.md

@@ -4,34 +4,34 @@
 Provide model-agnostic operating instructions for AI agents working in this repository.
 
 ## When To Use
-Use this file before making or reviewing repository changes. Use the review skills in `skills/` when the task matches their domain.
+Use this file before making or reviewing repository changes. Use the skills in `.ai/skills/` when the task matches their domain. Use `.ai/knowledge/` for shared context and coding rules. Use `.ai/prompts/review-change.md` to run a structured review against all applicable skills.
 
 ## Skill Routing
-- Use `skills/reviews/architecture-review/SKILL.md` for design, layering, dependency, module boundary, public contract, and maintainability reviews.
-- Use `skills/reviews/security-review/SKILL.md` for authentication, authorization, input handling, secrets, cryptography, sensitive data, and trust-boundary reviews.
-- Use `skills/reviews/dotnet-review/SKILL.md` for C#, .NET, ASP.NET Core, MongoDB repository usage, NuGet, MSBuild, and .NET test reviews.
-- Use `skills/reviews/database-review/SKILL.md` for migrations, schema, indexes, queries, transactions, ORM mappings, and data integrity reviews.
-- Use `skills/reviews/mongodb-review/SKILL.md` for MongoDB collections, filters, projections, indexes, repository queries, aggregations, updates, and data migrations.
-- Use `skills/plugins/plugin-module/SKILL.md` for GrandNode plugins and modules, including provider plugins, themes, API modules, migrations, and installer behavior.
-- Use `skills/plugins/plugin-shipping/SKILL.md` for shipping rate calculation plugins (IShippingRateCalculationProvider), GetShippingOptions, ShippingOption, ShippingRateCalculationType, and IShipmentTracker.
-- Use `skills/plugins/plugin-payment/SKILL.md` for payment method plugins (IPaymentProvider), Standard vs Redirection flow, ProcessPayment, Capture, Refund, Void, and PaymentTransaction status.
-- Use `skills/plugins/plugin-widget/SKILL.md` for widget plugins (IWidgetProvider), GetWidgetZones, view components, widget zone names, and GDPR consent gating.
-- Use `skills/plugins/plugin-discount-rules/SKILL.md` for discount rule plugins (IDiscountProvider, IDiscountRule), CheckRequirement, DiscountRule.Metadata, and rule configuration controllers.
-- Use `skills/template-creation/SKILL.md` for Razor views, layouts, partials, view components, plugin views, theme overrides, Vue-in-Razor templates, PDF templates, and DotLiquid message templates.
-- Use `skills/frontend-bundle-workflow/SKILL.md` for Vue/Vite build, theme CSS changes, when to run `npm run build`, bundle output files, and committing bundles alongside source.
-- Use `skills/admin-area-changes/SKILL.md` for admin-facing changes that may affect Main Admin, Store Owner, Vendor, shared admin models, permissions, navigation, validation, or scoped data access.
-- Use `skills/project-structure/SKILL.md` to understand repository structure, technology ownership, layer responsibilities, and how to expand GrandNode consistently.
-- Use `skills/settings-and-localization/SKILL.md` for settings classes, store-scoped overrides, ISettingService, localization resources, ITranslationService, IPluginTranslateResource, localized domain entities, and localized admin models.
-- Use `skills/message-notification/SKILL.md` for message templates, DotLiquid tokens and drops, IMessageProviderService, queued email lifecycle, LiquidObjectBuilder, MessageTokensAddedEvent plugin extension, and domain event notification handlers.
-- Use `skills/scheduled-task/SKILL.md` for scheduled task classes, IScheduleTask, AddKeyedScoped registration, ScheduleTask seed, multi-instance distributed locking, error handling, and task migrations.
-- Use `skills/permission-navigation/SKILL.md` for permissions, PermissionSystemName, PermissionActionName, StandardPermission, PermissionProvider, controller authorization attributes, AdminSiteMap entries, and permission or navigation migrations.
-- Use `skills/best-practices/async.md` for async/await patterns, CancellationToken, Task vs ValueTask, and blocking anti-patterns.
-- Use `skills/best-practices/mongodb.md` for IRepository<T> usage, query patterns, partial updates, and write conventions.
-- Use `skills/best-practices/performance.md` for ICacheBase, CacheKey constants, cache invalidation, pagination, and partial field writes.
-- Use `skills/best-practices/security.md` for authorization checks, FluentValidation patterns, guard clauses, HTML encoding, and safe MongoDB queries.
-- Use `skills/best-practices/architecture.md` for layering rules, DI lifetimes, MediatR commands/queries, and domain events.
-- Use `skills/best-practices/tests.md` for MSTest + Moq patterns, test structure, validator testing, and controller test setup.
-- Use `skills/best-practices/dotnet.md` for C# idioms: records, guard clauses, result objects, pattern matching, nullable types, and configuration binding.
+- Use `.ai/skills/architecture-review.md` for design, layering, dependency, module boundary, public contract, and maintainability reviews.
+- Use `.ai/skills/security-review.md` for authentication, authorization, input handling, secrets, cryptography, sensitive data, and trust-boundary reviews.
+- Use `.ai/skills/dotnet-review.md` for C#, .NET, ASP.NET Core, MongoDB repository usage, NuGet, MSBuild, and .NET test reviews.
+- Use `.ai/skills/database-review.md` for migrations, schema, indexes, queries, transactions, ORM mappings, and data integrity reviews.
+- Use `.ai/skills/mongodb-review.md` for MongoDB collections, filters, projections, indexes, repository queries, aggregations, updates, and data migrations.
+- Use `.ai/skills/plugin-module.md` for GrandNode plugins and modules, including provider plugins, themes, API modules, migrations, and installer behavior.
+- Use `.ai/skills/plugin-shipping.md` for shipping rate calculation plugins (IShippingRateCalculationProvider), GetShippingOptions, ShippingOption, ShippingRateCalculationType, and IShipmentTracker.
+- Use `.ai/skills/plugin-payment.md` for payment method plugins (IPaymentProvider), Standard vs Redirection flow, ProcessPayment, Capture, Refund, Void, and PaymentTransaction status.
+- Use `.ai/skills/plugin-widget.md` for widget plugins (IWidgetProvider), GetWidgetZones, view components, widget zone names, and GDPR consent gating.
+- Use `.ai/skills/plugin-discount-rules.md` for discount rule plugins (IDiscountProvider, IDiscountRule), CheckRequirement, DiscountRule.Metadata, and rule configuration controllers.
+- Use `.ai/skills/template-creation.md` for Razor views, layouts, partials, view components, plugin views, theme overrides, Vue-in-Razor templates, PDF templates, and DotLiquid message templates.
+- Use `.ai/skills/frontend-bundle-workflow.md` for Vue/Vite build, theme CSS changes, when to run `npm run build`, bundle output files, and committing bundles alongside source.
+- Use `.ai/skills/admin-area-changes.md` for admin-facing changes that may affect Main Admin, Store Owner, Vendor, shared admin models, permissions, navigation, validation, or scoped data access.
+- Use `.ai/skills/project-structure.md` to understand repository structure, technology ownership, layer responsibilities, and how to expand GrandNode consistently.
+- Use `.ai/skills/settings-and-localization.md` for settings classes, store-scoped overrides, ISettingService, localization resources, ITranslationService, IPluginTranslateResource, localized domain entities, and localized admin models.
+- Use `.ai/skills/message-notification.md` for message templates, DotLiquid tokens and drops, IMessageProviderService, queued email lifecycle, LiquidObjectBuilder, MessageTokensAddedEvent plugin extension, and domain event notification handlers.
+- Use `.ai/skills/scheduled-task.md` for scheduled task classes, IScheduleTask, AddKeyedScoped registration, ScheduleTask seed, multi-instance distributed locking, error handling, and task migrations.
+- Use `.ai/skills/permission-navigation.md` for permissions, PermissionSystemName, PermissionActionName, StandardPermission, PermissionProvider, controller authorization attributes, AdminSiteMap entries, and permission or navigation migrations.
+- Use `.ai/knowledge/async.md` for async/await patterns, CancellationToken, Task vs ValueTask, and blocking anti-patterns.
+- Use `.ai/knowledge/mongodb.md` for IRepository<T> usage, query patterns, partial updates, and write conventions.
+- Use `.ai/knowledge/performance.md` for ICacheBase, CacheKey constants, cache invalidation, pagination, and partial field writes.
+- Use `.ai/knowledge/security.md` for authorization checks, FluentValidation patterns, guard clauses, HTML encoding, and safe MongoDB queries.
+- Use `.ai/knowledge/architecture.md` for layering rules, DI lifetimes, MediatR commands/queries, and domain events.
+- Use `.ai/knowledge/tests.md` for MSTest + Moq patterns, test structure, validator testing, and controller test setup.
+- Use `.ai/knowledge/dotnet.md` for C# idioms: records, guard clauses, result objects, pattern matching, nullable types, and configuration binding.
 - Use multiple skills when a change crosses domains.
 
 ## Operating Rules