feat(skills): cat-deps meta family (python, node, actions)

skills/cat-deps-actions/SKILL.md

@@ -0,0 +1,34 @@
+---
+name: cat-deps-actions
+description: Use when pinning or upgrading GitHub Actions in CAT workflows. Covers action version pins, permissions blocks, and Dependabot github-actions ecosystem. Trigger phrases include Actions pin, workflow dependencies, actions/checkout version, Dependabot github-actions.
+metadata:
+  version: "0.1.0"
+  status: active
+  owner: Coastal Alpine Tech
+  last_updated: "2026-08-22"
+  side_effect_class: local-write
+  min_hitl_level: L1
+  network_posture: none
+  resource_envelope: light
+  sovereignty_notes: Workflow changes can break estate CI; validate YAML before push
+---
+
+# CAT Deps — GitHub Actions
+
+## When to use
+
+- Bumping actions/checkout, setup-python, setup-node, etc.
+- Adding Dependabot for github-actions
+- Fixing missing permissions blocks
+
+## Standards
+
+1. Pin actions appropriately for sensitivity of the workflow.
+2. Every workflow declares **permissions:** (default contents: read) — see `build-ci-hygiene`.
+3. After workflow edits: YAML must parse; prefer green CI on a PR before merge.
+4. Do not grant write permissions on PR CI unless required and justified.
+5. Bulk action bumps: scoped PRs + `cat-lint-safe-edit` discipline.
+
+## Related
+
+- `cat-deps`, `build-ci-hygiene`, `ci-failure-triage`, `repo-recovery-sweep`, `branch-protection-rollout`

skills/cat-deps-node/SKILL.md

@@ -0,0 +1,44 @@
+---
+name: cat-deps-node
+description: Use when auditing, pinning, or upgrading Node/npm dependencies in CAT TypeScript hubs (Front_Line_Whanau, CAT-mail, scaffylads). Covers package.json, lockfiles, npm audit, and Dependabot npm. Trigger phrases include npm audit, package.json deps, Node dependencies, Next.js dependencies.
+metadata:
+  version: "0.1.0"
+  status: active
+  owner: Coastal Alpine Tech
+  last_updated: "2026-08-22"
+  side_effect_class: local-write
+  min_hitl_level: L1
+  network_posture: explicit-only
+  resource_envelope: light
+  sovereignty_notes: No analytics SDKs without opt-in labelled path
+---
+
+# CAT Deps — Node
+
+## When to use
+
+- package.json changes on TS/Next repos
+- npm audit / GHSA on JS ecosystem
+- Lockfile conflicts after merges
+
+## Standards
+
+1. **Commit the lockfile**.
+2. CI installs with **frozen lockfile** where supported (`npm ci`).
+3. Run **npm audit** on non-trivial upgrades; document accepted risks.
+4. After dep change: eslint + typecheck + **build** with placeholder env (`build-ci-hygiene`).
+5. Prefer dependencies that do not phone-home by default; label any telemetry.
+
+## Upgrade sequence
+
+```text
+1. Branch cat/deps-<package>
+2. Bump + refresh lockfile
+3. npm ci && npm audit
+4. lint + tsc + build
+5. PR via cat-pr-ship
+```
+
+## Related
+
+- `cat-deps`, `cat-code-quality`, `build-ci-hygiene`, `hub-nextjs-component`

skills/cat-deps-python/SKILL.md

@@ -0,0 +1,46 @@
+---
+name: cat-deps-python
+description: Use when auditing, pinning, or upgrading Python dependencies in CAT edge repos (Core, Weaver, stack, portals, harness). Covers pyproject.toml, requirements*.txt, uv/pip, pip-audit, and Dependabot pip. Trigger phrases include pip-audit, pyproject deps, Python dependencies, requirements upgrade.
+metadata:
+  version: "0.1.0"
+  status: active
+  owner: Coastal Alpine Tech
+  last_updated: "2026-08-22"
+  side_effect_class: local-write
+  min_hitl_level: L1
+  network_posture: explicit-only
+  resource_envelope: light
+  sovereignty_notes: Prefer deps that work offline; document any telemetry SDK
+---
+
+# CAT Deps — Python
+
+## When to use
+
+- Adding or upgrading a Python package on the edge stack
+- pip-audit / safety findings
+- Aligning pyproject vs requirements files
+
+## Standards
+
+1. Prefer **pyproject.toml** as source of truth when the repo already has it.
+2. Production/runtime deps stay **minimal** for edge/RPi targets.
+3. Dev deps in optional extras (`[dev]`, `[test]`).
+4. Run **pip-audit** (or estate SecOps equivalent) before merging non-trivial upgrades.
+5. After dep change: ruff + pytest on touched area (`cat-code-quality`).
+6. Do not add cloud-only SDKs to core edge paths without explicit profile flag.
+
+## Upgrade sequence
+
+```text
+1. Branch cat/deps-<package>-<version>
+2. Bump pin
+3. Install from lock/requirements
+4. pip-audit
+5. lint + tests
+6. PR via cat-pr-ship
+```
+
+## Related
+
+- `cat-deps`, `cat-code-quality`, `build-ci-hygiene`, `secops-ci-estate-scan`

skills/cat-deps/SKILL.md

@@ -0,0 +1,69 @@
+---
+name: cat-deps
+description: Meta skill for Coastal Alpine Tech dependency policy. Use when deciding how to audit, pin, upgrade, or Dependabot-cover Python, Node, or GitHub Actions deps across the estate. Routes to cat-deps-python, cat-deps-node, cat-deps-actions. Trigger phrases include dependencies, Dependabot, dep policy, upgrade policy, dependency family.
+metadata:
+  version: "0.1.0"
+  status: active
+  owner: Coastal Alpine Tech
+  last_updated: "2026-08-22"
+  side_effect_class: read-only
+  min_hitl_level: L1
+  network_posture: explicit-only
+  resource_envelope: light
+  sovereignty_notes: Policy only; upgrades that change production behaviour need L2
+---
+
+# CAT Deps (meta)
+
+Orchestrates dependency hygiene for the Kiwi Edge estate.
+
+## When to use
+
+- "What is our dep policy?"
+- Planning Dependabot or audit coverage
+- Choosing which specialist skill to load for a repo
+- Before multi-repo version bumps
+
+## Family map
+
+| Skill | Surface |
+|-------|--------|
+| `cat-deps-python` | pip / uv / pyproject / requirements, pip-audit |
+| `cat-deps-node` | npm / pnpm, package-lock, npm audit |
+| `cat-deps-actions` | GitHub Actions action pins, workflow perms |
+| `secops-ci-estate-scan` | Estate-wide audit report (read-only) |
+| `build-ci-hygiene` | Dependabot present + least-privilege CI |
+| `release-preflight` | Before publishing tags with new deps |
+
+## Estate policy (defaults)
+
+1. **Pin for reproducibility** — lockfiles committed where the ecosystem expects them.
+2. **Dependabot on by default** for `pip`, `npm`, and `github-actions` ecosystems present in the repo.
+3. **Prefer minor/patch auto-PRs**; **major bumps are HITL L2** with changelog skim.
+4. **No silent major upgrades** on Core / Weaver / portals without tests green.
+5. **Security advisories** — critical/high: triage within sprint cadence; do not ignore GHSA without written deferral.
+6. **Local-first** — avoid new runtime deps that force cloud phone-home without explicit justification.
+
+## Routing
+
+```text
+Python edge repo     → cat-deps-python
+TS / Next hub        → cat-deps-node
+Workflow-only change → cat-deps-actions
+Whole-org scan       → secops-ci-estate-scan
+PR ship              → cat-pr-ship + cat-code-quality
+```
+
+## Maturity
+
+| Tier | Dep expectation |
+|------|-----------------|
+| Gold | Lockfiles or pins; known install path |
+| Diamond | Dependabot + CI install from lockfile; Actions pinned |
+| Platinum | Audit in SecOps cadence; majors gated |
+| Platinum Edge | Lean dep trees; edge images stay small |
+
+## HITL
+
+- Major version bumps across shared Core: L2
+- Adding a dependency with network side effects: L2 + sovereignty note