feat: v19 improve

.github/INVENTORY.md

@@ -53,7 +53,6 @@ This file is the exact path inventory for the live GitHub Copilot catalog in thi
 - `.github/skills/awesome-copilot-codeql/SKILL.md`
 - `.github/skills/awesome-copilot-dependabot/SKILL.md`
 - `.github/skills/awesome-copilot-secret-scanning/SKILL.md`
-- `.github/skills/graphify/SKILL.md`
 - `.github/skills/grill-me/SKILL.md`
 - `.github/skills/internal-agent-creator/SKILL.md`
 - `.github/skills/internal-agent-support-lane-change-engine/SKILL.md`

.github/agents/local-sync-external-resources.agent.md

@@ -74,7 +74,10 @@ retire, and anti-drift procedure in the paired core skill.
   `.github/skills/local-agent-sync-external-resources/references/managed-resource-scope.md`
   for the exact upstream family map, retained support-only office posture, and
   approved imported-override context.
-- Active `mattpocock/skills` imports in scope remain `caveman` -> `mattpocock-caveman` and `grill-me` -> `grill-me`; keep retired Matt Pocock imports out of the live managed scope.
+- Active `mattpocock/skills` imports in scope are `grill-me` -> `grill-me`
+  plus retained `caveman` -> `mattpocock-caveman` from the previous managed
+  snapshot while `caveman` is absent from current upstream; keep retired Matt
+  Pocock imports out of the live managed scope.
 - Do not add new prefixes, external families, compatibility aliases, or hidden
   imported forks unless the user explicitly expands scope.
 - When catalog meaning changes, re-check root `AGENTS.md`,
@@ -96,3 +99,12 @@ In `Outcome`, include:
 - `Validation`: commands run and remaining gaps.
 - `Remaining blockers or drift`: unresolved issues that prevent or narrow
   `apply`.
+
+Add the following outcome details when refresh execution is involved:
+
+- `Workspace guard`: where upstream snapshots were staged and whether the
+  bundled workspace guard passed.
+- `Graphify guard`: whether graphify ran after repo-local refresh leftovers
+  were absent.
+- `Scoped validation`: whether whitespace and diff checks were scoped away from
+  verbatim upstream content, with any accepted upstream notices named.

.github/skills/antigravity-api-design-principles/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: antigravity-api-design-principles
-description: "REST and GraphQL API design principles for resource modeling, contracts, pagination, versioning, errors, and developer experience. Use when designing or reviewing API interfaces, specifications, or public integration contracts."
+description: "Master REST and GraphQL API design principles to build intuitive, scalable, and maintainable APIs that delight developers and stand the test of time."
 risk: safe
 source: community
 date_added: "2026-02-27"

.github/skills/antigravity-golang-pro/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: antigravity-golang-pro
-description: Modern Go development for services, CLIs, concurrency patterns, profiling, and production readiness. Use when building or reviewing Go code, Go architecture, goroutine coordination, or Go performance work.
+description: Master Go 1.21+ with modern patterns, advanced concurrency, performance optimization, and production-ready microservices.
 risk: unknown
 source: community
 date_added: '2026-02-27'

.github/skills/awesome-copilot-agentic-eval/SKILL.md

@@ -40,24 +40,24 @@ Agent evaluates and improves its own output through self-critique.
 def reflect_and_refine(task: str, criteria: list[str], max_iterations: int = 3) -> str:
     """Generate with reflection loop."""
     output = llm(f"Complete this task:\n{task}")
-
+    
     for i in range(max_iterations):
         # Self-critique
         critique = llm(f"""
         Evaluate this output against criteria: {criteria}
         Output: {output}
         Rate each: PASS/FAIL with feedback as JSON.
         """)
-
+        
         critique_data = json.loads(critique)
         all_pass = all(c["status"] == "PASS" for c in critique_data.values())
         if all_pass:
             return output
-
+        
         # Refine based on critique
         failed = {k: v["feedback"] for k, v in critique_data.items() if v["status"] == "FAIL"}
         output = llm(f"Improve to address: {failed}\nOriginal: {output}")
-
+    
     return output
 ```
 
@@ -73,20 +73,20 @@ Separate generation and evaluation into distinct components for clearer responsi
 class EvaluatorOptimizer:
     def __init__(self, score_threshold: float = 0.8):
         self.score_threshold = score_threshold
-
+    
     def generate(self, task: str) -> str:
         return llm(f"Complete: {task}")
-
+    
     def evaluate(self, output: str, task: str) -> dict:
         return json.loads(llm(f"""
         Evaluate output for task: {task}
         Output: {output}
         Return JSON: {{"overall_score": 0-1, "dimensions": {{"accuracy": ..., "clarity": ...}}}}
         """))
-
+    
     def optimize(self, output: str, feedback: dict) -> str:
         return llm(f"Improve based on feedback: {feedback}\nOutput: {output}")
-
+    
     def run(self, task: str, max_iterations: int = 3) -> str:
         output = self.generate(task)
         for _ in range(max_iterations):
@@ -108,7 +108,7 @@ class CodeReflector:
     def reflect_and_fix(self, spec: str, max_iterations: int = 3) -> str:
         code = llm(f"Write Python code for: {spec}")
         tests = llm(f"Generate pytest tests for: {spec}\nCode: {code}")
-
+        
         for _ in range(max_iterations):
             result = run_tests(code, tests)
             if result["success"]:

.github/skills/awesome-copilot-azure-devops-cli/SKILL.md

@@ -92,3 +92,4 @@ Read the relevant reference file based on the user's task. Each file contains co
 | `references/org-and-security.md` | Projects, teams, users, permissions, wikis | Projects, Extensions, Teams, Users, Security groups/permissions, Service endpoints, Wikis, Admin |
 | `references/advanced-usage.md` | Output formatting, JMESPath queries | Output formats, JMESPath queries (basic + advanced), Global args, Common params, Git aliases |
 | `references/workflows-and-patterns.md` | Automation scripts, best practices, error handling | Common workflows, Best practices, Error handling, Scripting patterns, Real-world examples |
+| `references/long-comments-on-windows.md` | Long `--discussion`, `--description`, or `--content` values failing on Windows | The `cmd.exe` 8191 char cap on `az.cmd`, shell detection, and three verified workarounds (`azps.ps1`, native `--file-path`, `az devops invoke --in-file`) |

.github/skills/awesome-copilot-azure-devops-cli/references/boards-and-iterations.md

@@ -56,6 +56,10 @@ az boards work-item create \
   --type Bug \
   --discussion "Initial investigation completed"
 
+# For a long --discussion body on Windows, see references/long-comments-on-windows.md.
+# Short version: use azps.ps1 in PowerShell, or fall back to 'az devops invoke'
+# with --in-file when no native --file-path flag is available.
+
 # Open in browser after creation
 az boards work-item create --title "Bug" --type Bug --open
 ```
@@ -85,6 +89,14 @@ az boards work-item update \
   --id {work-item-id} \
   --discussion "Work in progress"
 
+# Long comment on Windows: read the body into a PowerShell variable and call
+# azps.ps1 instead of az.cmd, or fall back to 'az devops invoke' with --in-file.
+# Full guidance in references/long-comments-on-windows.md.
+#
+# PowerShell example:
+#   $body = Get-Content -Raw .\comment.md
+#   azps.ps1 boards work-item update --id 1234 --discussion $body
+
 # Update with custom fields
 az boards work-item update \
   --id {work-item-id} \

.github/skills/awesome-copilot-azure-devops-cli/references/long-comments-on-windows.md

@@ -0,0 +1,54 @@
+# Posting Long Comments and Bodies on Windows
+
+On Windows the `az` command resolves to `az.cmd`, a batch wrapper invoked by `cmd.exe`. The whole command line is capped at ~8191 characters, so a long `--discussion`, `--description`, or `--content` value can be silently truncated or fail. Detect the shell before composing a long argument and route accordingly. Skipping this is the most common reason the agent burns 3-5 turns falling back to raw token retrieval and REST calls.
+
+## Detect the shell first
+
+| Environment | Signal | Action |
+|---|---|---|
+| PowerShell on Windows | `$IsWindows -eq $true` and `$PSVersionTable.PSVersion` is set | Use `azps.ps1` (see below) |
+| PowerShell on macOS / Linux | `$IsWindows -eq $false` | Plain `az` is fine, no cmd.exe wrapper |
+| bash / zsh / sh | `$BASH_VERSION` or `$ZSH_VERSION` set, or `uname` works | Plain `az` is fine, no cmd.exe wrapper |
+| Windows `cmd.exe` | `%ComSpec%` ends in `cmd.exe`, no `$PSVersionTable` | Use `azps.ps1` if PowerShell is installed, otherwise see `az devops invoke` fallback below |
+
+## Option 1: `azps.ps1` (PowerShell on Windows)
+
+`azps.ps1` ships with the Azure CLI installer and invokes the Python entry point directly. No `cmd.exe` length cap.
+
+```powershell
+# Read the long body into a variable and pass it through. No quoting headaches.
+$body = Get-Content -Raw .\comment.md
+azps.ps1 boards work-item update --id 1234 --discussion $body
+```
+
+## Option 2: dedicated `--file-path` flag where Azure CLI offers one
+
+Some commands have a native file flag and you should prefer it over any inline body:
+
+- `az devops wiki page create` and `az devops wiki page update` take `--file-path` (with optional `--encoding`).
+- Use it on any shell, including Windows.
+
+```bash
+az devops wiki page create --path 'My page' --wiki myproject --file-path ./page.md --encoding utf-8
+```
+
+## Option 3: `az devops invoke` fallback
+
+When no `--file-path` exists (work-item `--discussion`, PR `--description`) and you're not in PowerShell, post the body via the underlying REST API. `az devops invoke` runs inside the Python entry point, so it isn't subject to the `cmd.exe` cap either, and it takes the request body from a file with `--in-file`:
+
+```bash
+# Post a long discussion comment to work item 1234.
+# REST: POST /{project}/_apis/wit/workItems/{id}/comments?api-version=7.0-preview.3
+az devops invoke \
+  --area wit --resource comments \
+  --route-parameters project={project} workItemId=1234 \
+  --api-version 7.0-preview.3 \
+  --http-method POST \
+  --in-file ./comment.json
+```
+
+Where `comment.json` is `{ "text": "<long markdown body>" }`. This is the universal escape hatch when neither `azps.ps1` nor `--file-path` is available. `az devops invoke` itself accepts `--in-file` natively.
+
+## Don't rely on `@<file>` for plain string args
+
+The Azure CLI `@<file>` convention is documented for JSON parameters (see [the official quoting guide](https://learn.microsoft.com/en-us/cli/azure/use-azure-cli-successfully-quoting)). It is not guaranteed to expand plain string args like `--discussion` or `--description`, so don't reach for it as a substitute for the three options above.

.github/skills/awesome-copilot-azure-resource-health-diagnose/SKILL.md

@@ -80,7 +80,7 @@ This workflow analyzes a specific Azure resource to assess its health status, di
    **General Error Analysis**:
    ```kql
    // Recent errors and exceptions
-   union isfuzzy=true
+   union isfuzzy=true 
        AzureDiagnostics,
        AppServiceHTTPLogs,
        AppServiceAppLogs,
@@ -109,7 +109,7 @@ This workflow analyzes a specific Azure resource to assess its health status, di
    | where success == false
    | summarize FailureCount=count() by resultCode, bin(timestamp, 1h)
    | order by timestamp desc
-
+   
    // Database - Connection failures
    AzureDiagnostics
    | where ResourceProvider == "MICROSOFT.SQL"
@@ -176,96 +176,96 @@ This workflow analyzes a specific Azure resource to assess its health status, di
 1. **Display Health Assessment Summary**:
    ```
    🏥 Azure Resource Health Assessment
-
+   
    📊 Resource Overview:
    • Resource: [Name] ([Type])
    • Status: [Healthy/Warning/Critical]
    • Location: [Region]
    • Last Analyzed: [Timestamp]
-
+   
    🚨 Issues Identified:
    • Critical: X issues requiring immediate attention
-   • High: Y issues affecting performance/reliability
+   • High: Y issues affecting performance/reliability  
    • Medium: Z issues for optimization
    • Low: N informational items
-
+   
    🔍 Top Issues:
    1. [Issue Type]: [Description] - Impact: [High/Medium/Low]
    2. [Issue Type]: [Description] - Impact: [High/Medium/Low]
    3. [Issue Type]: [Description] - Impact: [High/Medium/Low]
-
+   
    🛠️ Remediation Plan:
    • Immediate Actions: X items
-   • Short-term Fixes: Y items
+   • Short-term Fixes: Y items  
    • Long-term Improvements: Z items
    • Estimated Resolution Time: [Timeline]
-
+   
    ❓ Proceed with detailed remediation plan? (y/n)
    ```
 
 2. **Generate Detailed Report**:
    ```markdown
    # Azure Resource Health Report: [Resource Name]
-
-   **Generated**: [Timestamp]
-   **Resource**: [Full Resource ID]
+   
+   **Generated**: [Timestamp]  
+   **Resource**: [Full Resource ID]  
    **Overall Health**: [Status with color indicator]
-
+   
    ## 🔍 Executive Summary
    [Brief overview of health status and key findings]
-
+   
    ## 📊 Health Metrics
    - **Availability**: X% over last 24h
    - **Performance**: [Average response time/throughput]
    - **Error Rate**: X% over last 24h
    - **Resource Utilization**: [CPU/Memory/Storage percentages]
-
+   
    ## 🚨 Issues Identified
-
+   
    ### Critical Issues
    - **[Issue 1]**: [Description]
      - **Root Cause**: [Analysis]
      - **Impact**: [Business impact]
      - **Immediate Action**: [Required steps]
-
-   ### High Priority Issues
+   
+   ### High Priority Issues  
    - **[Issue 2]**: [Description]
      - **Root Cause**: [Analysis]
      - **Impact**: [Performance/reliability impact]
      - **Recommended Fix**: [Solution steps]
-
+   
    ## 🛠️ Remediation Plan
-
+   
    ### Phase 1: Immediate Actions (0-2 hours)
    ```bash
    # Critical fixes to restore service
    [Azure CLI commands with explanations]
    ```
-
+   
    ### Phase 2: Short-term Fixes (2-24 hours)
    ```bash
    # Performance and reliability improvements
    [Azure CLI commands with explanations]
    ```
-
+   
    ### Phase 3: Long-term Improvements (1-4 weeks)
    ```bash
    # Architectural and preventive measures
    [Azure CLI commands and configuration changes]
    ```
-
+   
    ## 📈 Monitoring Recommendations
    - **Alerts to Configure**: [List of recommended alerts]
    - **Dashboards to Create**: [Monitoring dashboard suggestions]
    - **Regular Health Checks**: [Recommended frequency and scope]
-
+   
    ## ✅ Validation Steps
    - [ ] Verify issue resolution through logs
    - [ ] Confirm performance improvements
    - [ ] Test application functionality
    - [ ] Update monitoring and alerting
    - [ ] Document lessons learned
-
+   
    ## 📝 Prevention Measures
    - [Recommendations to prevent similar issues]
    - [Process improvements]

.github/skills/awesome-copilot-codeql/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: awesome-copilot-codeql
-description: Configure and troubleshoot GitHub CodeQL scanning, query suites, SARIF uploads, workflow setup, and CodeQL CLI analysis. Use when working on code scanning workflows, GitHub Advanced Security analysis, CodeQL databases, or security query execution.
+description: Comprehensive guide for setting up and configuring CodeQL code scanning via GitHub Actions workflows and the CodeQL CLI. This skill should be used when users need help with code scanning configuration, CodeQL workflow files, CodeQL CLI commands, SARIF output, security analysis setup, or troubleshooting CodeQL analysis.
 ---
 
 # CodeQL Code Scanning
@@ -362,7 +362,6 @@ To enable detailed diagnostics:
 | SARIF results exceed limits | Split across multiple uploads with different `--sarif-category`; reduce query scope |
 | Two CodeQL workflows | Disable default setup if using advanced setup, or remove old workflow file |
 | Slow analysis | Enable dependency caching; use `--threads=0`; reduce query suite scope |
-| Green analysis job, failing aggregate check | A green CodeQL analysis job does not guarantee a green aggregate `CodeQL` PR check; when the top-level check fails, inspect the check-run annotations for new alerts in changed code before treating it as a workflow failure |
 
 > For comprehensive troubleshooting with detailed solutions, search `references/troubleshooting.md`.
 

.github/skills/awesome-copilot-dependabot/SKILL.md

@@ -1,6 +1,14 @@
 ---
 name: awesome-copilot-dependabot
-description: Use when configuring or reviewing `.github/dependabot.yml`, reducing Dependabot PR noise, grouping updates, setting multi-ecosystem updates, tuning schedules or ignore rules, enabling auto-triage, or aligning dependency-update policy with GitHub Advanced Security.
+description: >-
+  Comprehensive guide for configuring and managing GitHub Dependabot. Use this skill when
+  users ask about creating or optimizing dependabot.yml files, managing Dependabot pull requests,
+  configuring dependency update strategies, setting up grouped updates, monorepo patterns,
+  multi-ecosystem groups, security update configuration, auto-triage rules, or any GitHub
+  Advanced Security (GHAS) supply chain security topic related to Dependabot. For pre-commit
+  dependency vulnerability scanning in AI coding agents via the GitHub MCP Server, this skill
+  references the Advanced Security plugin (`advanced-security@copilot-plugins`). Use this skill
+  when an agent needs to scan dependencies for known vulnerabilities before committing.
 ---
 
 # Dependabot Configuration & Management
@@ -26,7 +34,8 @@ Scan the repository for dependency manifests. Look for:
 | Ecosystem | YAML Value | Manifest Files |
 |---|---|---|
 | npm/pnpm/yarn | `npm` | `package.json`, `package-lock.json`, `pnpm-lock.yaml`, `yarn.lock` |
-| pip/pipenv/poetry/uv | `pip` | `requirements.txt`, `Pipfile`, `pyproject.toml`, `setup.py` |
+| pip/pipenv/poetry | `pip` | `requirements.txt`, `Pipfile`, `pyproject.toml`, `setup.py` |
+| uv | `uv` | `pyproject.toml`, `uv.lock` |
 | Docker | `docker` | `Dockerfile` |
 | Docker Compose | `docker-compose` | `docker-compose.yml` |
 | GitHub Actions | `github-actions` | `.github/workflows/*.yml` |
@@ -49,7 +58,9 @@ Scan the repository for dependency manifests. Look for:
 | Git Submodules | `gitsubmodule` | `.gitmodules` |
 | Pre-commit | `pre-commit` | `.pre-commit-config.yaml` |
 
-Note: pnpm and yarn both use the `npm` ecosystem value.
+Notes:
+- pnpm and yarn both use the `npm` ecosystem value.
+- Prefer `uv` ecosystem value when `uv.lock` is present; otherwise use `pip`.
 
 ### Step 2: Map Directory Locations
 

.github/skills/awesome-copilot-secret-scanning/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: awesome-copilot-secret-scanning
-description: Use when enabling or tuning GitHub secret scanning, configuring push protection, custom patterns, delegated bypass, alert handling, leaked-credential remediation, blocked-push recovery, or pre-commit secret controls around GitHub Advanced Security.
+description: 'Guide for configuring and managing GitHub secret scanning, push protection, custom patterns, and secret alert remediation. For pre-commit secret scanning in AI coding agents via the GitHub MCP Server, this skill references the Advanced Security plugin (`advanced-security@copilot-plugins`). Use this skill when enabling secret scanning, setting up push protection, defining custom patterns, triaging alerts, resolving blocked pushes, or when an agent needs to scan code for secrets before committing.'
 ---
 
 # Secret Scanning