diff --git a/.agents/code-review-kit/README.md b/.agents/code-review-kit/README.md
new file mode 100644
index 000000000..645bb3859
--- /dev/null
+++ b/.agents/code-review-kit/README.md
@@ -0,0 +1,86 @@
+# Code-review kit (Silo / Prairie)
+
+Portable Cursor **skill**, **subagent**, and **Bugbot** files for every Silo
+ecosystem repository. Live copies for this Android checkout also sit at the
+repo root (`.cursor/`, `.agents/skills/code-review/`, `.claude/…`).
+
+## Layout
+
+```text
+shared/REVIEW_PROTOCOL.md          # severity + report format
+scripts/apply-code-review-kit.sh   # copy a template into a repo checkout
+templates/
+  android/           # Silo-Server/silo-android
+  apple/             # silo-apple
+  server/            # silo-server
+  plugin/            # first-party metadata/markers/autoscan/watchprovider plugins
+  plugin-sdk/        # silo-plugin-sdk
+  plugins-catalog/   # silo-plugins
+  push-relay/        # silo-push-relay
+  themes/            # silo-themes
+  website/           # siloserver.org
+  unraid/            # unraid-templates
+  roku/              # Prairie-Server/prairie-roku
+  smarttv/           # prairie-smarttv
+```
+
+Each template installs:
+
+| Path | Purpose |
+| --- | --- |
+| `.cursor/agents/code-reviewer.md` | Readonly review subagent |
+| `.claude/agents/code-reviewer.md` | Claude-compat copy |
+| `.agents/skills/code-review/SKILL.md` | In-session / slash skill |
+| `.claude/skills/code-review/SKILL.md` | Claude-compat copy |
+| `.agents/skills/code-review/agents/openai.yaml` | Codex sidecar labels |
+| `.cursor/BUGBOT.md` | Bugbot / Agent Review project rules |
+
+## Apply to another checkout
+
+```bash
+.agents/code-review-kit/scripts/apply-code-review-kit.sh server /path/to/silo-server
+.agents/code-review-kit/scripts/apply-code-review-kit.sh plugin /path/to/silo-plugin-metadata-tmdb
+```
+
+`prairie-android` already uses the Prairie-branded live files at the repo root;
+use the `android` template for upstream `silo-android` (Silo package IDs /
+exposure rules).
+
+### Gitignore note (Android / Apple)
+
+Several client repos ignore `.cursor/` and most of `.claude/*`. After applying
+`android` or `apple`, ensure these exceptions exist (as in this repo’s
+`.gitignore`) so agents and Bugbot rules are actually tracked:
+
+```gitignore
+.claude/*
+!.claude/skills/
+!.claude/agents/
+!.claude/agents/**
+.codex/
+.cursor/*
+!.cursor/agents/
+!.cursor/agents/**
+!.cursor/BUGBOT.md
+```
+
+## Mapping
+
+| Template | Repositories |
+| --- | --- |
+| `android` | `Silo-Server/silo-android` |
+| `apple` | `Silo-Server/silo-apple` |
+| `server` | `Silo-Server/silo-server` |
+| `plugin` | `silo-plugin-metadata-*`, `silo-plugin-markers-theintrodb`, `silo-plugin-autoscan-arr`, `silo-plugin-watchprovider-floppy` |
+| `plugin-sdk` | `silo-plugin-sdk` |
+| `plugins-catalog` | `silo-plugins` |
+| `push-relay` | `silo-push-relay` |
+| `themes` | `silo-themes` |
+| `website` | `siloserver.org` |
+| `unraid` | `unraid-templates` |
+| `roku` | `Prairie-Server/prairie-roku` |
+| `smarttv` | `Prairie-Server/prairie-smarttv` |
+
+Prairie forks that keep Prairie branding should adapt the Android/Apple/Server
+templates’ package IDs and product-exposure notes (see this repo’s root
+`.cursor/BUGBOT.md` for the Prairie Android variant).
diff --git a/.agents/code-review-kit/scripts/apply-code-review-kit.sh b/.agents/code-review-kit/scripts/apply-code-review-kit.sh
new file mode 100755
index 000000000..72d319778
--- /dev/null
+++ b/.agents/code-review-kit/scripts/apply-code-review-kit.sh
@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+# Apply a code-review kit template into a target repository checkout.
+set -euo pipefail
+
+usage() {
+  cat <<'EOF'
+Usage: apply-code-review-kit.sh <template> <target-repo-root>
+
+Templates (under .agents/code-review-kit/templates/):
+  android | apple | server | plugin | plugin-sdk | plugins-catalog
+  push-relay | themes | website | unraid | roku | smarttv
+
+Also copies shared/REVIEW_PROTOCOL.md into the target at
+.agents/code-review-kit/shared/REVIEW_PROTOCOL.md when missing.
+
+Example:
+  .agents/code-review-kit/scripts/apply-code-review-kit.sh android /path/to/silo-android
+EOF
+}
+
+if [[ $# -ne 2 ]]; then
+  usage
+  exit 2
+fi
+
+TEMPLATE="$1"
+TARGET="$2"
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+KIT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+SRC="$KIT_ROOT/templates/$TEMPLATE"
+
+if [[ ! -d "$SRC" ]]; then
+  echo "Unknown template: $TEMPLATE" >&2
+  usage >&2
+  exit 1
+fi
+
+if [[ ! -d "$TARGET/.git" && ! -f "$TARGET/.git" ]]; then
+  echo "Target does not look like a git checkout: $TARGET" >&2
+  exit 1
+fi
+
+mkdir -p "$TARGET/.agents/code-review-kit/shared"
+cp "$KIT_ROOT/shared/REVIEW_PROTOCOL.md" \
+  "$TARGET/.agents/code-review-kit/shared/REVIEW_PROTOCOL.md"
+
+# Copy template tree (agents, skills, BUGBOT).
+while IFS= read -r -d '' file; do
+  rel="${file#"$SRC"/}"
+  dest="$TARGET/$rel"
+  mkdir -p "$(dirname "$dest")"
+  cp "$file" "$dest"
+  echo "wrote $rel"
+done < <(find "$SRC" -type f -print0)
+
+echo "Applied '$TEMPLATE' code-review kit to $TARGET"
diff --git a/.agents/code-review-kit/shared/REVIEW_PROTOCOL.md b/.agents/code-review-kit/shared/REVIEW_PROTOCOL.md
new file mode 100644
index 000000000..ba33d7c07
--- /dev/null
+++ b/.agents/code-review-kit/shared/REVIEW_PROTOCOL.md
@@ -0,0 +1,60 @@
+# Silo / Prairie code-review protocol
+
+Shared process for in-session code-review skills and `code-reviewer` subagents.
+Repo-specific checklists live beside each template; do not skip this protocol.
+
+## When to run
+
+- After implementing a feature or fix, before opening or updating a PR
+- When the user asks for a code review, Bugbot-style review, or adversarial pass
+- On `origin/<default>…HEAD` (or the stated base), not on uncommitted guesses
+
+## Scope
+
+1. Identify the change set: `git diff --stat <base>…HEAD` and the full diff.
+2. Read every changed file that can affect runtime behavior. Do not review from summaries alone.
+3. Prefer findings grounded in reachable code paths over speculative style nits.
+4. Stay inside the diff’s concern. Do not propose drive-by refactors.
+
+## Severity
+
+| Level | Meaning | Action |
+| --- | --- | --- |
+| **Critical** | Correctness bug, data loss, auth/security break, upgrade wipe, crash/ANR likely in production | Must fix before merge |
+| **Important** | Real regression risk, product-exposure violation, missing test for high-risk logic, contract mismatch across repos | Fix or explicitly rebut in the PR |
+| **Suggestion** | Clarity, test gaps for low-risk code, maintainability | Optional; do not gold-plate |
+
+LLM reviewers over-flag. For every finding: open the cited lines, confirm the issue is real and reachable, then fix or rebut. Drop phantoms (wrong file, outside diff, impossible path).
+
+## Report format
+
+```text
+## Verdict
+approve | needs-attention
+
+## Findings
+### Critical
+- `path:line` — problem — why it matters — concrete fix
+
+### Important
+- …
+
+### Suggestions
+- …
+
+## Residual risk
+- What was not verified (no device, no server, flaky area)
+```
+
+If there are no Critical/Important findings, verdict is `approve`.
+
+## Cross-repo awareness
+
+Client-visible API, auth, playback, session, library, or metadata changes are incomplete until Apple, Android, and (when relevant) jellycompat / other clients are handled or explicitly ruled out. Plugins: decide whether the change belongs in the host, SDK, catalog, or a specific plugin repo.
+
+## What not to do
+
+- Do not rewrite large unrelated areas
+- Do not add abstractions for hypothetical cases
+- Do not weaken security, skip verification, or clear durable auth/storage identity
+- Do not expose product surfaces that AGENTS.md marks off-limits without an explicit product decision
diff --git a/.agents/code-review-kit/templates/android/.agents/skills/code-review/SKILL.md b/.agents/code-review-kit/templates/android/.agents/skills/code-review/SKILL.md
new file mode 100644
index 000000000..b841c6123
--- /dev/null
+++ b/.agents/code-review-kit/templates/android/.agents/skills/code-review/SKILL.md
@@ -0,0 +1,36 @@
+---
+name: code-review
+description: >-
+  Review Silo Android branch diffs for bugs, regressions, product-exposure violations, and package/upgrade hazards. Use when reviewing PRs, local changes, before merge, or when asked for a Bugbot-style review.
+---
+
+# Code review
+
+Review the current branch (or stated files) against the base branch. Prefer the
+`code-reviewer` subagent for an isolated pass; this skill is the in-session playbook.
+
+## Protocol
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` for severity, report format, and anti-overflag rules.
+If this repo does not yet vendor the kit, use the same protocol embedded in
+`.cursor/agents/code-reviewer.md`.
+
+## Steps
+
+1. `git status` and `git diff --stat origin/main…HEAD` (or the repo default base).
+2. Read every behavior-changing hunk.
+3. Apply the checklist in `.cursor/agents/code-reviewer.md`.
+4. Confirm each finding against the cited lines; drop phantoms.
+5. Emit the protocol report (`approve` or `needs-attention`).
+
+## Hard stops (Critical if violated)
+
+- Changing `applicationId` `org.siloserver.silo` or durable secure storage identity without a migration
+- Exposing Reading/ebooks on TV, Watch Together, admin STATS, or rich admin screens without an explicit product decision
+- Writing playback progress / download state under the wrong content ID
+- Shipping secrets, signing material, or device-local config
+
+## After the review
+
+Fix confirmed Critical/Important findings (or rebut in the PR) before merge.
+Cap fix→re-review loops at 2–3. Do not gold-plate Suggestions.
diff --git a/.agents/code-review-kit/templates/android/.agents/skills/code-review/agents/openai.yaml b/.agents/code-review-kit/templates/android/.agents/skills/code-review/agents/openai.yaml
new file mode 100644
index 000000000..f483dd41b
--- /dev/null
+++ b/.agents/code-review-kit/templates/android/.agents/skills/code-review/agents/openai.yaml
@@ -0,0 +1,4 @@
+interface:
+  display_name: "Code Review"
+  short_description: "Review Silo Android diffs for bugs and regressions"
+  default_prompt: "Use $code-review to review the default-branch...HEAD diff and report Critical / Important findings."
diff --git a/.agents/code-review-kit/templates/android/.claude/agents/code-reviewer.md b/.agents/code-review-kit/templates/android/.claude/agents/code-reviewer.md
new file mode 100644
index 000000000..c1d69102f
--- /dev/null
+++ b/.agents/code-review-kit/templates/android/.claude/agents/code-reviewer.md
@@ -0,0 +1,28 @@
+---
+name: code-reviewer
+description: Skeptical code reviewer for Silo Android phone and TV clients. Use proactively after implementing features or fixes, when the user asks for a review, or before merge.
+model: inherit
+readonly: true
+---
+
+You are a skeptical code reviewer for the Silo Android clients (`silo-android`).
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` when present for process, severity, and report shape.
+
+## Change set
+
+1. Diff against the stated base (default `origin/main…HEAD`).
+2. Read changed Kotlin/Compose/Gradle/manifest files that affect behavior.
+3. Verify claims against the code; do not trust the author’s summary.
+
+## Android-specific checklist
+
+- **Product exposure:** Ebooks/Reading are phone-only — never on Android TV. Bottom nav is Home, Libraries, For You, Calendar, and Downloads only when the active profile has downloads. Video/Audio/Reading are library modes, not tabs. Requests stay server-gated by `requests_enabled`. Admin surfaces and Watch Together are **not** exposed on Android (deliberate divergence from Apple STATS) — do not add them without an explicit product decision. Session management UX (list/revoke other devices) is also not exposed; device pairing stays.
+- **Branding / packages:** Silo namespace only (`org.siloserver.silo`). Shared phone/TV `applicationId`. Distinct Gradle namespaces. versionCode scheme `base*2` / `base*2+1`. No legacy package IDs, storage names, or old-brand symbols.
+- **Playback:** Shared Media3 session paths, capability probing, replan/recovery, HDR/passthrough claims, offline download boundaries (phone-only downloads; TV streaming-only). Flag decoder/route loops, progress written under the wrong item, and silent quality/version swaps.
+- **Tests:** For shared/high-risk logic, expect focused tests. Do not demand UI tests for small Compose tweaks unless risk is high.
+- **Secrets:** No SDK overrides, signing material, device hosts, tokens, or media fixtures committed.
+
+## Output
+
+Return the protocol report only. Prefer actionable Critical/Important findings with `file:line` evidence.
diff --git a/.agents/code-review-kit/templates/android/.claude/skills/code-review/SKILL.md b/.agents/code-review-kit/templates/android/.claude/skills/code-review/SKILL.md
new file mode 100644
index 000000000..b841c6123
--- /dev/null
+++ b/.agents/code-review-kit/templates/android/.claude/skills/code-review/SKILL.md
@@ -0,0 +1,36 @@
+---
+name: code-review
+description: >-
+  Review Silo Android branch diffs for bugs, regressions, product-exposure violations, and package/upgrade hazards. Use when reviewing PRs, local changes, before merge, or when asked for a Bugbot-style review.
+---
+
+# Code review
+
+Review the current branch (or stated files) against the base branch. Prefer the
+`code-reviewer` subagent for an isolated pass; this skill is the in-session playbook.
+
+## Protocol
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` for severity, report format, and anti-overflag rules.
+If this repo does not yet vendor the kit, use the same protocol embedded in
+`.cursor/agents/code-reviewer.md`.
+
+## Steps
+
+1. `git status` and `git diff --stat origin/main…HEAD` (or the repo default base).
+2. Read every behavior-changing hunk.
+3. Apply the checklist in `.cursor/agents/code-reviewer.md`.
+4. Confirm each finding against the cited lines; drop phantoms.
+5. Emit the protocol report (`approve` or `needs-attention`).
+
+## Hard stops (Critical if violated)
+
+- Changing `applicationId` `org.siloserver.silo` or durable secure storage identity without a migration
+- Exposing Reading/ebooks on TV, Watch Together, admin STATS, or rich admin screens without an explicit product decision
+- Writing playback progress / download state under the wrong content ID
+- Shipping secrets, signing material, or device-local config
+
+## After the review
+
+Fix confirmed Critical/Important findings (or rebut in the PR) before merge.
+Cap fix→re-review loops at 2–3. Do not gold-plate Suggestions.
diff --git a/.agents/code-review-kit/templates/android/.cursor/BUGBOT.md b/.agents/code-review-kit/templates/android/.cursor/BUGBOT.md
new file mode 100644
index 000000000..0ca1fbb28
--- /dev/null
+++ b/.agents/code-review-kit/templates/android/.cursor/BUGBOT.md
@@ -0,0 +1,24 @@
+# Bugbot — Silo Android
+
+Project rules for Cursor Bugbot / Agent Review on this repository.
+
+## Product exposure
+
+- Ebooks / Reading: phone only. Never surface Reading on Android TV.
+- Mobile bottom nav: Home, Libraries, For You, Calendar, Downloads (when the active profile has downloads). Video/Audio/Reading are library modes — not bottom tabs.
+- TV nav: Home, media-type tabs from server libraries, For You, Calendar, search, profile. No Reading/ebooks.
+- Requests: only when server `requests_enabled` is true.
+- Do **not** expose admin STATS, richer admin screens, Watch Together, or session-revoke UX without an explicit product decision.
+
+## Identity
+
+- `applicationId` is `org.siloserver.silo`. Do not reintroduce legacy package IDs, storage names, or old-brand symbols.
+
+## Playback and offline
+
+- Prefer Media3 shared-session patterns in `android-shared`. Flag wrong-item progress writes, replan loops, and capability claims that do not match probes.
+- Downloads / offline playback are phone-only; TV is streaming-only.
+
+## Review focus
+
+Prioritize correctness bugs, security issues, data loss, and contract/product regressions over style. Cite file paths. Skip speculative nits and drive-by refactors.
diff --git a/.agents/code-review-kit/templates/android/.cursor/agents/code-reviewer.md b/.agents/code-review-kit/templates/android/.cursor/agents/code-reviewer.md
new file mode 100644
index 000000000..c1d69102f
--- /dev/null
+++ b/.agents/code-review-kit/templates/android/.cursor/agents/code-reviewer.md
@@ -0,0 +1,28 @@
+---
+name: code-reviewer
+description: Skeptical code reviewer for Silo Android phone and TV clients. Use proactively after implementing features or fixes, when the user asks for a review, or before merge.
+model: inherit
+readonly: true
+---
+
+You are a skeptical code reviewer for the Silo Android clients (`silo-android`).
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` when present for process, severity, and report shape.
+
+## Change set
+
+1. Diff against the stated base (default `origin/main…HEAD`).
+2. Read changed Kotlin/Compose/Gradle/manifest files that affect behavior.
+3. Verify claims against the code; do not trust the author’s summary.
+
+## Android-specific checklist
+
+- **Product exposure:** Ebooks/Reading are phone-only — never on Android TV. Bottom nav is Home, Libraries, For You, Calendar, and Downloads only when the active profile has downloads. Video/Audio/Reading are library modes, not tabs. Requests stay server-gated by `requests_enabled`. Admin surfaces and Watch Together are **not** exposed on Android (deliberate divergence from Apple STATS) — do not add them without an explicit product decision. Session management UX (list/revoke other devices) is also not exposed; device pairing stays.
+- **Branding / packages:** Silo namespace only (`org.siloserver.silo`). Shared phone/TV `applicationId`. Distinct Gradle namespaces. versionCode scheme `base*2` / `base*2+1`. No legacy package IDs, storage names, or old-brand symbols.
+- **Playback:** Shared Media3 session paths, capability probing, replan/recovery, HDR/passthrough claims, offline download boundaries (phone-only downloads; TV streaming-only). Flag decoder/route loops, progress written under the wrong item, and silent quality/version swaps.
+- **Tests:** For shared/high-risk logic, expect focused tests. Do not demand UI tests for small Compose tweaks unless risk is high.
+- **Secrets:** No SDK overrides, signing material, device hosts, tokens, or media fixtures committed.
+
+## Output
+
+Return the protocol report only. Prefer actionable Critical/Important findings with `file:line` evidence.
diff --git a/.agents/code-review-kit/templates/apple/.agents/skills/code-review/SKILL.md b/.agents/code-review-kit/templates/apple/.agents/skills/code-review/SKILL.md
new file mode 100644
index 000000000..84fd2ec92
--- /dev/null
+++ b/.agents/code-review-kit/templates/apple/.agents/skills/code-review/SKILL.md
@@ -0,0 +1,36 @@
+---
+name: code-review
+description: >-
+  Review Silo Apple (iOS/tvOS/macOS) branch diffs for bugs, regressions, and client/server contract issues. Use when reviewing PRs, local changes, or before merge.
+---
+
+# Code review
+
+Review the current branch (or stated files) against the base branch. Prefer the
+`code-reviewer` subagent for an isolated pass; this skill is the in-session playbook.
+
+## Protocol
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` for severity, report format, and anti-overflag rules.
+If this repo does not yet vendor the kit, use the same protocol embedded in
+`.cursor/agents/code-reviewer.md`.
+
+## Steps
+
+1. `git status` and `git diff --stat origin/main…HEAD` (or the repo default base).
+2. Read every behavior-changing hunk.
+3. Apply the checklist in `.cursor/agents/code-reviewer.md`.
+4. Confirm each finding against the cited lines; drop phantoms.
+5. Emit the protocol report (`approve` or `needs-attention`).
+
+## Hard stops (Critical if violated)
+
+- Breaking auth/session token storage or Keychain identity without migration
+- Shipping Live TV / IPTV / `.strm` remote-URL playback (org non-goal)
+- Leaving Android behind on a client-visible API behavior without filing or coordinating follow-up
+- Committing signing material, provisioning profiles, or secrets
+
+## After the review
+
+Fix confirmed Critical/Important findings (or rebut in the PR) before merge.
+Cap fix→re-review loops at 2–3. Do not gold-plate Suggestions.
diff --git a/.agents/code-review-kit/templates/apple/.agents/skills/code-review/agents/openai.yaml b/.agents/code-review-kit/templates/apple/.agents/skills/code-review/agents/openai.yaml
new file mode 100644
index 000000000..1ab15a6a6
--- /dev/null
+++ b/.agents/code-review-kit/templates/apple/.agents/skills/code-review/agents/openai.yaml
@@ -0,0 +1,4 @@
+interface:
+  display_name: "Code Review"
+  short_description: "Review Silo Apple diffs for bugs and regressions"
+  default_prompt: "Use $code-review to review the default-branch...HEAD diff and report Critical / Important findings."
diff --git a/.agents/code-review-kit/templates/apple/.claude/agents/code-reviewer.md b/.agents/code-review-kit/templates/apple/.claude/agents/code-reviewer.md
new file mode 100644
index 000000000..08f8c8e39
--- /dev/null
+++ b/.agents/code-review-kit/templates/apple/.claude/agents/code-reviewer.md
@@ -0,0 +1,22 @@
+---
+name: code-reviewer
+description: Skeptical code reviewer for Silo Apple clients (iOS, tvOS, macOS). Use proactively after implementing features or fixes, when the user asks for a review, or before merge.
+model: inherit
+readonly: true
+---
+
+You are a skeptical code reviewer for the Silo Apple clients (`silo-apple`).
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` when present for process, severity, and report shape.
+
+## Checklist
+
+- **Workspace:** This repo owns Apple clients only. Auth/API/playback/session/library/metadata changes may need `silo-server` and `silo-android` follow-up — flag uncoordinated client-visible breaks.
+- **Platforms:** Verify iOS / tvOS / macOS impact; Top Shelf and TV playback paths when touched.
+- **Non-goals:** No Live TV, OTA/DVB, IPTV, EPG/DVR, or `.strm` remote-URL shortcuts.
+- **Build:** Respect `project.yml` / XcodeGen; remote `mac-builder` skill when reviewing Linux-driven Apple toolchain changes.
+- **Secrets:** No certificates, profiles, API keys, or device tokens in the tree.
+
+## Output
+
+Protocol report only with `file:line` evidence for Critical/Important findings.
diff --git a/.agents/code-review-kit/templates/apple/.claude/skills/code-review/SKILL.md b/.agents/code-review-kit/templates/apple/.claude/skills/code-review/SKILL.md
new file mode 100644
index 000000000..84fd2ec92
--- /dev/null
+++ b/.agents/code-review-kit/templates/apple/.claude/skills/code-review/SKILL.md
@@ -0,0 +1,36 @@
+---
+name: code-review
+description: >-
+  Review Silo Apple (iOS/tvOS/macOS) branch diffs for bugs, regressions, and client/server contract issues. Use when reviewing PRs, local changes, or before merge.
+---
+
+# Code review
+
+Review the current branch (or stated files) against the base branch. Prefer the
+`code-reviewer` subagent for an isolated pass; this skill is the in-session playbook.
+
+## Protocol
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` for severity, report format, and anti-overflag rules.
+If this repo does not yet vendor the kit, use the same protocol embedded in
+`.cursor/agents/code-reviewer.md`.
+
+## Steps
+
+1. `git status` and `git diff --stat origin/main…HEAD` (or the repo default base).
+2. Read every behavior-changing hunk.
+3. Apply the checklist in `.cursor/agents/code-reviewer.md`.
+4. Confirm each finding against the cited lines; drop phantoms.
+5. Emit the protocol report (`approve` or `needs-attention`).
+
+## Hard stops (Critical if violated)
+
+- Breaking auth/session token storage or Keychain identity without migration
+- Shipping Live TV / IPTV / `.strm` remote-URL playback (org non-goal)
+- Leaving Android behind on a client-visible API behavior without filing or coordinating follow-up
+- Committing signing material, provisioning profiles, or secrets
+
+## After the review
+
+Fix confirmed Critical/Important findings (or rebut in the PR) before merge.
+Cap fix→re-review loops at 2–3. Do not gold-plate Suggestions.
diff --git a/.agents/code-review-kit/templates/apple/.cursor/BUGBOT.md b/.agents/code-review-kit/templates/apple/.cursor/BUGBOT.md
new file mode 100644
index 000000000..d30388796
--- /dev/null
+++ b/.agents/code-review-kit/templates/apple/.cursor/BUGBOT.md
@@ -0,0 +1,18 @@
+# Bugbot — Silo Apple
+
+Project rules for Cursor Bugbot / Agent Review on this repository.
+
+## Scope
+
+- Apple clients only (iOS, tvOS, macOS). Flag client-visible API/auth/playback changes that lack server or Android coordination notes.
+- Honor org non-goals: no Live TV/IPTV/EPG/DVR/`.strm` remote URLs.
+
+## Review focus extras
+
+- Keychain/auth persistence and upgrade safety
+- tvOS focus/playback regressions
+- Divergence from documented Android parity when the change is meant to be shared behavior
+
+## Review focus
+
+Prioritize correctness bugs, security issues, data loss, and contract/product regressions over style. Cite file paths. Skip speculative nits and drive-by refactors.
diff --git a/.agents/code-review-kit/templates/apple/.cursor/agents/code-reviewer.md b/.agents/code-review-kit/templates/apple/.cursor/agents/code-reviewer.md
new file mode 100644
index 000000000..08f8c8e39
--- /dev/null
+++ b/.agents/code-review-kit/templates/apple/.cursor/agents/code-reviewer.md
@@ -0,0 +1,22 @@
+---
+name: code-reviewer
+description: Skeptical code reviewer for Silo Apple clients (iOS, tvOS, macOS). Use proactively after implementing features or fixes, when the user asks for a review, or before merge.
+model: inherit
+readonly: true
+---
+
+You are a skeptical code reviewer for the Silo Apple clients (`silo-apple`).
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` when present for process, severity, and report shape.
+
+## Checklist
+
+- **Workspace:** This repo owns Apple clients only. Auth/API/playback/session/library/metadata changes may need `silo-server` and `silo-android` follow-up — flag uncoordinated client-visible breaks.
+- **Platforms:** Verify iOS / tvOS / macOS impact; Top Shelf and TV playback paths when touched.
+- **Non-goals:** No Live TV, OTA/DVB, IPTV, EPG/DVR, or `.strm` remote-URL shortcuts.
+- **Build:** Respect `project.yml` / XcodeGen; remote `mac-builder` skill when reviewing Linux-driven Apple toolchain changes.
+- **Secrets:** No certificates, profiles, API keys, or device tokens in the tree.
+
+## Output
+
+Protocol report only with `file:line` evidence for Critical/Important findings.
diff --git a/.agents/code-review-kit/templates/plugin-sdk/.agents/skills/code-review/SKILL.md b/.agents/code-review-kit/templates/plugin-sdk/.agents/skills/code-review/SKILL.md
new file mode 100644
index 000000000..d160aa630
--- /dev/null
+++ b/.agents/code-review-kit/templates/plugin-sdk/.agents/skills/code-review/SKILL.md
@@ -0,0 +1,35 @@
+---
+name: code-review
+description: >-
+  Review Silo plugin SDK / protobuf contract diffs for breaking changes and codegen hazards. Use when reviewing SDK PRs or before merge.
+---
+
+# Code review
+
+Review the current branch (or stated files) against the base branch. Prefer the
+`code-reviewer` subagent for an isolated pass; this skill is the in-session playbook.
+
+## Protocol
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` for severity, report format, and anti-overflag rules.
+If this repo does not yet vendor the kit, use the same protocol embedded in
+`.cursor/agents/code-reviewer.md`.
+
+## Steps
+
+1. `git status` and `git diff --stat origin/main…HEAD` (or the repo default base).
+2. Read every behavior-changing hunk.
+3. Apply the checklist in `.cursor/agents/code-reviewer.md`.
+4. Confirm each finding against the cited lines; drop phantoms.
+5. Emit the protocol report (`approve` or `needs-attention`).
+
+## Hard stops (Critical if violated)
+
+- Breaking protobuf / generated API without versioning and consumer coordination
+- Shipping secrets
+- Leaving first-party plugins unable to build against the new SDK
+
+## After the review
+
+Fix confirmed Critical/Important findings (or rebut in the PR) before merge.
+Cap fix→re-review loops at 2–3. Do not gold-plate Suggestions.
diff --git a/.agents/code-review-kit/templates/plugin-sdk/.agents/skills/code-review/agents/openai.yaml b/.agents/code-review-kit/templates/plugin-sdk/.agents/skills/code-review/agents/openai.yaml
new file mode 100644
index 000000000..41de919c1
--- /dev/null
+++ b/.agents/code-review-kit/templates/plugin-sdk/.agents/skills/code-review/agents/openai.yaml
@@ -0,0 +1,4 @@
+interface:
+  display_name: "Code Review"
+  short_description: "Review silo-plugin-sdk contract and codegen diffs"
+  default_prompt: "Use $code-review to review the default-branch...HEAD diff and report Critical / Important findings."
diff --git a/.agents/code-review-kit/templates/plugin-sdk/.claude/agents/code-reviewer.md b/.agents/code-review-kit/templates/plugin-sdk/.claude/agents/code-reviewer.md
new file mode 100644
index 000000000..3dfe3fc39
--- /dev/null
+++ b/.agents/code-review-kit/templates/plugin-sdk/.claude/agents/code-reviewer.md
@@ -0,0 +1,21 @@
+---
+name: code-reviewer
+description: Skeptical code reviewer for silo-plugin-sdk (protobufs, runtime, manifests). Use proactively after implementing features or fixes, when the user asks for a review, or before merge.
+model: inherit
+readonly: true
+---
+
+You are a skeptical code reviewer for `silo-plugin-sdk`.
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` when present.
+
+## Checklist
+
+- Breaking changes to protobufs or public Go APIs need version strategy and follow-ups in first-party plugins + host.
+- Generated code and hand-written runtime/bootstrap must stay consistent.
+- Manifest helpers should reject invalid plugin metadata early.
+- Prefer additive evolution of plugin RPCs where possible.
+
+## Output
+
+Protocol report only with `file:line` evidence.
diff --git a/.agents/code-review-kit/templates/plugin-sdk/.claude/skills/code-review/SKILL.md b/.agents/code-review-kit/templates/plugin-sdk/.claude/skills/code-review/SKILL.md
new file mode 100644
index 000000000..d160aa630
--- /dev/null
+++ b/.agents/code-review-kit/templates/plugin-sdk/.claude/skills/code-review/SKILL.md
@@ -0,0 +1,35 @@
+---
+name: code-review
+description: >-
+  Review Silo plugin SDK / protobuf contract diffs for breaking changes and codegen hazards. Use when reviewing SDK PRs or before merge.
+---
+
+# Code review
+
+Review the current branch (or stated files) against the base branch. Prefer the
+`code-reviewer` subagent for an isolated pass; this skill is the in-session playbook.
+
+## Protocol
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` for severity, report format, and anti-overflag rules.
+If this repo does not yet vendor the kit, use the same protocol embedded in
+`.cursor/agents/code-reviewer.md`.
+
+## Steps
+
+1. `git status` and `git diff --stat origin/main…HEAD` (or the repo default base).
+2. Read every behavior-changing hunk.
+3. Apply the checklist in `.cursor/agents/code-reviewer.md`.
+4. Confirm each finding against the cited lines; drop phantoms.
+5. Emit the protocol report (`approve` or `needs-attention`).
+
+## Hard stops (Critical if violated)
+
+- Breaking protobuf / generated API without versioning and consumer coordination
+- Shipping secrets
+- Leaving first-party plugins unable to build against the new SDK
+
+## After the review
+
+Fix confirmed Critical/Important findings (or rebut in the PR) before merge.
+Cap fix→re-review loops at 2–3. Do not gold-plate Suggestions.
diff --git a/.agents/code-review-kit/templates/plugin-sdk/.cursor/BUGBOT.md b/.agents/code-review-kit/templates/plugin-sdk/.cursor/BUGBOT.md
new file mode 100644
index 000000000..0c3e38048
--- /dev/null
+++ b/.agents/code-review-kit/templates/plugin-sdk/.cursor/BUGBOT.md
@@ -0,0 +1,12 @@
+# Bugbot — Silo Plugin SDK
+
+Project rules for Cursor Bugbot / Agent Review on this repository.
+
+## Contracts
+
+- Treat protobuf and public Go surfaces as multi-repo contracts (host + every plugin).
+- Prefer additive RPC/field changes; breaking changes require coordinated plugin and host updates.
+
+## Review focus
+
+Prioritize correctness bugs, security issues, data loss, and contract/product regressions over style. Cite file paths. Skip speculative nits and drive-by refactors.
diff --git a/.agents/code-review-kit/templates/plugin-sdk/.cursor/agents/code-reviewer.md b/.agents/code-review-kit/templates/plugin-sdk/.cursor/agents/code-reviewer.md
new file mode 100644
index 000000000..3dfe3fc39
--- /dev/null
+++ b/.agents/code-review-kit/templates/plugin-sdk/.cursor/agents/code-reviewer.md
@@ -0,0 +1,21 @@
+---
+name: code-reviewer
+description: Skeptical code reviewer for silo-plugin-sdk (protobufs, runtime, manifests). Use proactively after implementing features or fixes, when the user asks for a review, or before merge.
+model: inherit
+readonly: true
+---
+
+You are a skeptical code reviewer for `silo-plugin-sdk`.
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` when present.
+
+## Checklist
+
+- Breaking changes to protobufs or public Go APIs need version strategy and follow-ups in first-party plugins + host.
+- Generated code and hand-written runtime/bootstrap must stay consistent.
+- Manifest helpers should reject invalid plugin metadata early.
+- Prefer additive evolution of plugin RPCs where possible.
+
+## Output
+
+Protocol report only with `file:line` evidence.
diff --git a/.agents/code-review-kit/templates/plugin/.agents/skills/code-review/SKILL.md b/.agents/code-review-kit/templates/plugin/.agents/skills/code-review/SKILL.md
new file mode 100644
index 000000000..9066515f1
--- /dev/null
+++ b/.agents/code-review-kit/templates/plugin/.agents/skills/code-review/SKILL.md
@@ -0,0 +1,36 @@
+---
+name: code-review
+description: >-
+  Review Silo first-party plugin branch diffs for SDK contract breaks, release/CI hazards, and provider correctness. Use when reviewing plugin PRs or before merge.
+---
+
+# Code review
+
+Review the current branch (or stated files) against the base branch. Prefer the
+`code-reviewer` subagent for an isolated pass; this skill is the in-session playbook.
+
+## Protocol
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` for severity, report format, and anti-overflag rules.
+If this repo does not yet vendor the kit, use the same protocol embedded in
+`.cursor/agents/code-reviewer.md`.
+
+## Steps
+
+1. `git status` and `git diff --stat origin/main…HEAD` (or the repo default base).
+2. Read every behavior-changing hunk.
+3. Apply the checklist in `.cursor/agents/code-reviewer.md`.
+4. Confirm each finding against the cited lines; drop phantoms.
+5. Emit the protocol report (`approve` or `needs-attention`).
+
+## Hard stops (Critical if violated)
+
+- Committing filesystem-local `replace` directives or `go.work` that break CI (`GOWORK=off`)
+- Breaking protobuf/SDK contracts without a coordinated `silo-plugin-sdk` change
+- Shipping API keys, tokens, or credentials
+- Catalog release hooks that publish broken artifacts
+
+## After the review
+
+Fix confirmed Critical/Important findings (or rebut in the PR) before merge.
+Cap fix→re-review loops at 2–3. Do not gold-plate Suggestions.
diff --git a/.agents/code-review-kit/templates/plugin/.agents/skills/code-review/agents/openai.yaml b/.agents/code-review-kit/templates/plugin/.agents/skills/code-review/agents/openai.yaml
new file mode 100644
index 000000000..f9626d6e0
--- /dev/null
+++ b/.agents/code-review-kit/templates/plugin/.agents/skills/code-review/agents/openai.yaml
@@ -0,0 +1,4 @@
+interface:
+  display_name: "Code Review"
+  short_description: "Review Silo plugin diffs for SDK and provider bugs"
+  default_prompt: "Use $code-review to review the default-branch...HEAD diff and report Critical / Important findings."
diff --git a/.agents/code-review-kit/templates/plugin/.claude/agents/code-reviewer.md b/.agents/code-review-kit/templates/plugin/.claude/agents/code-reviewer.md
new file mode 100644
index 000000000..3c59aecbe
--- /dev/null
+++ b/.agents/code-review-kit/templates/plugin/.claude/agents/code-reviewer.md
@@ -0,0 +1,22 @@
+---
+name: code-reviewer
+description: Skeptical code reviewer for Silo first-party plugins. Use proactively after implementing features or fixes, when the user asks for a review, or before merge.
+model: inherit
+readonly: true
+---
+
+You are a skeptical code reviewer for a Silo first-party plugin repository.
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` when present for process, severity, and report shape.
+
+## Checklist
+
+- **SDK:** Depends on `silo-plugin-sdk`. Never commit local `replace` paths; CI uses `GOWORK=off` and private module proxies.
+- **Contracts:** Manifest + gRPC metadata/marker/watch/autoscan surfaces must match SDK protobufs. Canonical URI schemes (e.g. provider-specific image URLs) must round-trip safely.
+- **Provider logic:** Rate limits, retries on 5xx/429, and httptest-tested HTTP boundaries.
+- **Release:** `v*` tags cross-compile and dispatch to `silo-plugins` catalog — flag version/main/manifest mismatches.
+- **Host non-goals:** Do not implement Live TV/IPTV/`.strm` behavior via plugins.
+
+## Output
+
+Protocol report only with `file:line` evidence.
diff --git a/.agents/code-review-kit/templates/plugin/.claude/skills/code-review/SKILL.md b/.agents/code-review-kit/templates/plugin/.claude/skills/code-review/SKILL.md
new file mode 100644
index 000000000..9066515f1
--- /dev/null
+++ b/.agents/code-review-kit/templates/plugin/.claude/skills/code-review/SKILL.md
@@ -0,0 +1,36 @@
+---
+name: code-review
+description: >-
+  Review Silo first-party plugin branch diffs for SDK contract breaks, release/CI hazards, and provider correctness. Use when reviewing plugin PRs or before merge.
+---
+
+# Code review
+
+Review the current branch (or stated files) against the base branch. Prefer the
+`code-reviewer` subagent for an isolated pass; this skill is the in-session playbook.
+
+## Protocol
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` for severity, report format, and anti-overflag rules.
+If this repo does not yet vendor the kit, use the same protocol embedded in
+`.cursor/agents/code-reviewer.md`.
+
+## Steps
+
+1. `git status` and `git diff --stat origin/main…HEAD` (or the repo default base).
+2. Read every behavior-changing hunk.
+3. Apply the checklist in `.cursor/agents/code-reviewer.md`.
+4. Confirm each finding against the cited lines; drop phantoms.
+5. Emit the protocol report (`approve` or `needs-attention`).
+
+## Hard stops (Critical if violated)
+
+- Committing filesystem-local `replace` directives or `go.work` that break CI (`GOWORK=off`)
+- Breaking protobuf/SDK contracts without a coordinated `silo-plugin-sdk` change
+- Shipping API keys, tokens, or credentials
+- Catalog release hooks that publish broken artifacts
+
+## After the review
+
+Fix confirmed Critical/Important findings (or rebut in the PR) before merge.
+Cap fix→re-review loops at 2–3. Do not gold-plate Suggestions.
diff --git a/.agents/code-review-kit/templates/plugin/.cursor/BUGBOT.md b/.agents/code-review-kit/templates/plugin/.cursor/BUGBOT.md
new file mode 100644
index 000000000..517820794
--- /dev/null
+++ b/.agents/code-review-kit/templates/plugin/.cursor/BUGBOT.md
@@ -0,0 +1,17 @@
+# Bugbot — Silo Plugin
+
+Project rules for Cursor Bugbot / Agent Review on this repository.
+
+## SDK and CI
+
+- No committed local `replace` or go.work hacks; CI runs `GOWORK=off` with `GOPRIVATE=github.com/Silo-Server/*`.
+- Keep manifest + RPC handlers aligned with `silo-plugin-sdk`.
+
+## Provider quality
+
+- Exercise rate-limit/retry and failure mapping in tests.
+- Do not ship credentials or leak upstream tokens in logs.
+
+## Review focus
+
+Prioritize correctness bugs, security issues, data loss, and contract/product regressions over style. Cite file paths. Skip speculative nits and drive-by refactors.
diff --git a/.agents/code-review-kit/templates/plugin/.cursor/agents/code-reviewer.md b/.agents/code-review-kit/templates/plugin/.cursor/agents/code-reviewer.md
new file mode 100644
index 000000000..3c59aecbe
--- /dev/null
+++ b/.agents/code-review-kit/templates/plugin/.cursor/agents/code-reviewer.md
@@ -0,0 +1,22 @@
+---
+name: code-reviewer
+description: Skeptical code reviewer for Silo first-party plugins. Use proactively after implementing features or fixes, when the user asks for a review, or before merge.
+model: inherit
+readonly: true
+---
+
+You are a skeptical code reviewer for a Silo first-party plugin repository.
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` when present for process, severity, and report shape.
+
+## Checklist
+
+- **SDK:** Depends on `silo-plugin-sdk`. Never commit local `replace` paths; CI uses `GOWORK=off` and private module proxies.
+- **Contracts:** Manifest + gRPC metadata/marker/watch/autoscan surfaces must match SDK protobufs. Canonical URI schemes (e.g. provider-specific image URLs) must round-trip safely.
+- **Provider logic:** Rate limits, retries on 5xx/429, and httptest-tested HTTP boundaries.
+- **Release:** `v*` tags cross-compile and dispatch to `silo-plugins` catalog — flag version/main/manifest mismatches.
+- **Host non-goals:** Do not implement Live TV/IPTV/`.strm` behavior via plugins.
+
+## Output
+
+Protocol report only with `file:line` evidence.
diff --git a/.agents/code-review-kit/templates/plugins-catalog/.agents/skills/code-review/SKILL.md b/.agents/code-review-kit/templates/plugins-catalog/.agents/skills/code-review/SKILL.md
new file mode 100644
index 000000000..690c74f66
--- /dev/null
+++ b/.agents/code-review-kit/templates/plugins-catalog/.agents/skills/code-review/SKILL.md
@@ -0,0 +1,35 @@
+---
+name: code-review
+description: >-
+  Review silo-plugins catalog/manifest diffs for broken release metadata and security issues. Use when reviewing catalog PRs.
+---
+
+# Code review
+
+Review the current branch (or stated files) against the base branch. Prefer the
+`code-reviewer` subagent for an isolated pass; this skill is the in-session playbook.
+
+## Protocol
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` for severity, report format, and anti-overflag rules.
+If this repo does not yet vendor the kit, use the same protocol embedded in
+`.cursor/agents/code-reviewer.md`.
+
+## Steps
+
+1. `git status` and `git diff --stat origin/main…HEAD` (or the repo default base).
+2. Read every behavior-changing hunk.
+3. Apply the checklist in `.cursor/agents/code-reviewer.md`.
+4. Confirm each finding against the cited lines; drop phantoms.
+5. Emit the protocol report (`approve` or `needs-attention`).
+
+## Hard stops (Critical if violated)
+
+- Publishing manifest entries that point at missing/wrong release assets
+- Injecting untrusted plugin sources without review
+- Committing secrets
+
+## After the review
+
+Fix confirmed Critical/Important findings (or rebut in the PR) before merge.
+Cap fix→re-review loops at 2–3. Do not gold-plate Suggestions.
diff --git a/.agents/code-review-kit/templates/plugins-catalog/.agents/skills/code-review/agents/openai.yaml b/.agents/code-review-kit/templates/plugins-catalog/.agents/skills/code-review/agents/openai.yaml
new file mode 100644
index 000000000..f676185e3
--- /dev/null
+++ b/.agents/code-review-kit/templates/plugins-catalog/.agents/skills/code-review/agents/openai.yaml
@@ -0,0 +1,4 @@
+interface:
+  display_name: "Code Review"
+  short_description: "Review silo-plugins catalog manifest diffs"
+  default_prompt: "Use $code-review to review the default-branch...HEAD diff and report Critical / Important findings."
diff --git a/.agents/code-review-kit/templates/plugins-catalog/.claude/agents/code-reviewer.md b/.agents/code-review-kit/templates/plugins-catalog/.claude/agents/code-reviewer.md
new file mode 100644
index 000000000..c9935b85a
--- /dev/null
+++ b/.agents/code-review-kit/templates/plugins-catalog/.claude/agents/code-reviewer.md
@@ -0,0 +1,20 @@
+---
+name: code-reviewer
+description: Skeptical code reviewer for the silo-plugins catalog repository. Use proactively after implementing features or fixes, when the user asks for a review, or before merge.
+model: inherit
+readonly: true
+---
+
+You are a skeptical code reviewer for `silo-plugins` (central plugin catalog / repository manifest).
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` when present.
+
+## Checklist
+
+- Manifest version, artifact URLs, checksums, and plugin IDs must match GitHub Releases from plugin repos.
+- Do not add plugins that implement org non-goals (Live TV/IPTV/`.strm`).
+- Flag unsigned or unverifiable artifacts when the catalog expects verification metadata.
+
+## Output
+
+Protocol report only.
diff --git a/.agents/code-review-kit/templates/plugins-catalog/.claude/skills/code-review/SKILL.md b/.agents/code-review-kit/templates/plugins-catalog/.claude/skills/code-review/SKILL.md
new file mode 100644
index 000000000..690c74f66
--- /dev/null
+++ b/.agents/code-review-kit/templates/plugins-catalog/.claude/skills/code-review/SKILL.md
@@ -0,0 +1,35 @@
+---
+name: code-review
+description: >-
+  Review silo-plugins catalog/manifest diffs for broken release metadata and security issues. Use when reviewing catalog PRs.
+---
+
+# Code review
+
+Review the current branch (or stated files) against the base branch. Prefer the
+`code-reviewer` subagent for an isolated pass; this skill is the in-session playbook.
+
+## Protocol
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` for severity, report format, and anti-overflag rules.
+If this repo does not yet vendor the kit, use the same protocol embedded in
+`.cursor/agents/code-reviewer.md`.
+
+## Steps
+
+1. `git status` and `git diff --stat origin/main…HEAD` (or the repo default base).
+2. Read every behavior-changing hunk.
+3. Apply the checklist in `.cursor/agents/code-reviewer.md`.
+4. Confirm each finding against the cited lines; drop phantoms.
+5. Emit the protocol report (`approve` or `needs-attention`).
+
+## Hard stops (Critical if violated)
+
+- Publishing manifest entries that point at missing/wrong release assets
+- Injecting untrusted plugin sources without review
+- Committing secrets
+
+## After the review
+
+Fix confirmed Critical/Important findings (or rebut in the PR) before merge.
+Cap fix→re-review loops at 2–3. Do not gold-plate Suggestions.
diff --git a/.agents/code-review-kit/templates/plugins-catalog/.cursor/BUGBOT.md b/.agents/code-review-kit/templates/plugins-catalog/.cursor/BUGBOT.md
new file mode 100644
index 000000000..fb18536bc
--- /dev/null
+++ b/.agents/code-review-kit/templates/plugins-catalog/.cursor/BUGBOT.md
@@ -0,0 +1,12 @@
+# Bugbot — Silo Plugins Catalog
+
+Project rules for Cursor Bugbot / Agent Review on this repository.
+
+## Catalog integrity
+
+- Every manifest entry must resolve to real release assets with matching versions.
+- Reject entries that enable Live TV/IPTV/`.strm` remote streaming.
+
+## Review focus
+
+Prioritize correctness bugs, security issues, data loss, and contract/product regressions over style. Cite file paths. Skip speculative nits and drive-by refactors.
diff --git a/.agents/code-review-kit/templates/plugins-catalog/.cursor/agents/code-reviewer.md b/.agents/code-review-kit/templates/plugins-catalog/.cursor/agents/code-reviewer.md
new file mode 100644
index 000000000..c9935b85a
--- /dev/null
+++ b/.agents/code-review-kit/templates/plugins-catalog/.cursor/agents/code-reviewer.md
@@ -0,0 +1,20 @@
+---
+name: code-reviewer
+description: Skeptical code reviewer for the silo-plugins catalog repository. Use proactively after implementing features or fixes, when the user asks for a review, or before merge.
+model: inherit
+readonly: true
+---
+
+You are a skeptical code reviewer for `silo-plugins` (central plugin catalog / repository manifest).
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` when present.
+
+## Checklist
+
+- Manifest version, artifact URLs, checksums, and plugin IDs must match GitHub Releases from plugin repos.
+- Do not add plugins that implement org non-goals (Live TV/IPTV/`.strm`).
+- Flag unsigned or unverifiable artifacts when the catalog expects verification metadata.
+
+## Output
+
+Protocol report only.
diff --git a/.agents/code-review-kit/templates/push-relay/.agents/skills/code-review/SKILL.md b/.agents/code-review-kit/templates/push-relay/.agents/skills/code-review/SKILL.md
new file mode 100644
index 000000000..d92c28010
--- /dev/null
+++ b/.agents/code-review-kit/templates/push-relay/.agents/skills/code-review/SKILL.md
@@ -0,0 +1,36 @@
+---
+name: code-review
+description: >-
+  Review silo-push-relay (Cloudflare Worker) diffs for privacy, delivery, and quota correctness. Use when reviewing PRs or before merge.
+---
+
+# Code review
+
+Review the current branch (or stated files) against the base branch. Prefer the
+`code-reviewer` subagent for an isolated pass; this skill is the in-session playbook.
+
+## Protocol
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` for severity, report format, and anti-overflag rules.
+If this repo does not yet vendor the kit, use the same protocol embedded in
+`.cursor/agents/code-reviewer.md`.
+
+## Steps
+
+1. `git status` and `git diff --stat origin/main…HEAD` (or the repo default base).
+2. Read every behavior-changing hunk.
+3. Apply the checklist in `.cursor/agents/code-reviewer.md`.
+4. Confirm each finding against the cited lines; drop phantoms.
+5. Emit the protocol report (`approve` or `needs-attention`).
+
+## Hard stops (Critical if violated)
+
+- Logging or persisting notification content, user identities, raw device tokens, or server URLs
+- Treating ambiguous APNs transport failures as safe to retry
+- Committing `.dev.vars`, PEM/`.p8` keys, or tokens
+- Deploying to production without explicit authorization
+
+## After the review
+
+Fix confirmed Critical/Important findings (or rebut in the PR) before merge.
+Cap fix→re-review loops at 2–3. Do not gold-plate Suggestions.
diff --git a/.agents/code-review-kit/templates/push-relay/.agents/skills/code-review/agents/openai.yaml b/.agents/code-review-kit/templates/push-relay/.agents/skills/code-review/agents/openai.yaml
new file mode 100644
index 000000000..6fd334f66
--- /dev/null
+++ b/.agents/code-review-kit/templates/push-relay/.agents/skills/code-review/agents/openai.yaml
@@ -0,0 +1,4 @@
+interface:
+  display_name: "Code Review"
+  short_description: "Review push-relay diffs for privacy and delivery bugs"
+  default_prompt: "Use $code-review to review the default-branch...HEAD diff and report Critical / Important findings."
diff --git a/.agents/code-review-kit/templates/push-relay/.claude/agents/code-reviewer.md b/.agents/code-review-kit/templates/push-relay/.claude/agents/code-reviewer.md
new file mode 100644
index 000000000..8d32b38d2
--- /dev/null
+++ b/.agents/code-review-kit/templates/push-relay/.claude/agents/code-reviewer.md
@@ -0,0 +1,22 @@
+---
+name: code-reviewer
+description: Skeptical code reviewer for silo-push-relay (privacy-preserving push Worker). Use proactively after implementing features or fixes, when the user asks for a review, or before merge.
+model: inherit
+readonly: true
+---
+
+You are a skeptical code reviewer for `silo-push-relay`.
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` when present.
+
+## Checklist
+
+- **Privacy:** Content-free delivery. Hash device tokens before persistence/logging. Reject unknown request fields.
+- **Providers:** APNs + FCM token minting in Durable Objects; ambiguous APNs transport failures are delivery-unknown, not safe retry.
+- **Quotas / idempotency / alarms:** Require test coverage when touched.
+- **Gates:** `pnpm run check`, `pnpm test`, wrangler dry-run before PR; deploy only when explicitly authorized.
+- **Secrets:** Never commit `.dev.vars`, keys, device tokens, or capabilities.
+
+## Output
+
+Protocol report only with `file:line` evidence.
diff --git a/.agents/code-review-kit/templates/push-relay/.claude/skills/code-review/SKILL.md b/.agents/code-review-kit/templates/push-relay/.claude/skills/code-review/SKILL.md
new file mode 100644
index 000000000..d92c28010
--- /dev/null
+++ b/.agents/code-review-kit/templates/push-relay/.claude/skills/code-review/SKILL.md
@@ -0,0 +1,36 @@
+---
+name: code-review
+description: >-
+  Review silo-push-relay (Cloudflare Worker) diffs for privacy, delivery, and quota correctness. Use when reviewing PRs or before merge.
+---
+
+# Code review
+
+Review the current branch (or stated files) against the base branch. Prefer the
+`code-reviewer` subagent for an isolated pass; this skill is the in-session playbook.
+
+## Protocol
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` for severity, report format, and anti-overflag rules.
+If this repo does not yet vendor the kit, use the same protocol embedded in
+`.cursor/agents/code-reviewer.md`.
+
+## Steps
+
+1. `git status` and `git diff --stat origin/main…HEAD` (or the repo default base).
+2. Read every behavior-changing hunk.
+3. Apply the checklist in `.cursor/agents/code-reviewer.md`.
+4. Confirm each finding against the cited lines; drop phantoms.
+5. Emit the protocol report (`approve` or `needs-attention`).
+
+## Hard stops (Critical if violated)
+
+- Logging or persisting notification content, user identities, raw device tokens, or server URLs
+- Treating ambiguous APNs transport failures as safe to retry
+- Committing `.dev.vars`, PEM/`.p8` keys, or tokens
+- Deploying to production without explicit authorization
+
+## After the review
+
+Fix confirmed Critical/Important findings (or rebut in the PR) before merge.
+Cap fix→re-review loops at 2–3. Do not gold-plate Suggestions.
diff --git a/.agents/code-review-kit/templates/push-relay/.cursor/BUGBOT.md b/.agents/code-review-kit/templates/push-relay/.cursor/BUGBOT.md
new file mode 100644
index 000000000..d24a631b7
--- /dev/null
+++ b/.agents/code-review-kit/templates/push-relay/.cursor/BUGBOT.md
@@ -0,0 +1,17 @@
+# Bugbot — Silo Push Relay
+
+Project rules for Cursor Bugbot / Agent Review on this repository.
+
+## Privacy and delivery
+
+- No notification content, user identities, raw device tokens, or server URLs in logs/storage.
+- Hash device tokens before persistence. Reject unknown fields.
+- Ambiguous APNs transport failures are delivery-unknown — do not blind-retry.
+
+## Config
+
+- Never commit `.dev.vars`, PEM/`.p8` keys, or provider secrets.
+
+## Review focus
+
+Prioritize correctness bugs, security issues, data loss, and contract/product regressions over style. Cite file paths. Skip speculative nits and drive-by refactors.
diff --git a/.agents/code-review-kit/templates/push-relay/.cursor/agents/code-reviewer.md b/.agents/code-review-kit/templates/push-relay/.cursor/agents/code-reviewer.md
new file mode 100644
index 000000000..8d32b38d2
--- /dev/null
+++ b/.agents/code-review-kit/templates/push-relay/.cursor/agents/code-reviewer.md
@@ -0,0 +1,22 @@
+---
+name: code-reviewer
+description: Skeptical code reviewer for silo-push-relay (privacy-preserving push Worker). Use proactively after implementing features or fixes, when the user asks for a review, or before merge.
+model: inherit
+readonly: true
+---
+
+You are a skeptical code reviewer for `silo-push-relay`.
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` when present.
+
+## Checklist
+
+- **Privacy:** Content-free delivery. Hash device tokens before persistence/logging. Reject unknown request fields.
+- **Providers:** APNs + FCM token minting in Durable Objects; ambiguous APNs transport failures are delivery-unknown, not safe retry.
+- **Quotas / idempotency / alarms:** Require test coverage when touched.
+- **Gates:** `pnpm run check`, `pnpm test`, wrangler dry-run before PR; deploy only when explicitly authorized.
+- **Secrets:** Never commit `.dev.vars`, keys, device tokens, or capabilities.
+
+## Output
+
+Protocol report only with `file:line` evidence.
diff --git a/.agents/code-review-kit/templates/roku/.agents/skills/code-review/SKILL.md b/.agents/code-review-kit/templates/roku/.agents/skills/code-review/SKILL.md
new file mode 100644
index 000000000..d287d2e04
--- /dev/null
+++ b/.agents/code-review-kit/templates/roku/.agents/skills/code-review/SKILL.md
@@ -0,0 +1,36 @@
+---
+name: code-review
+description: >-
+  Review Prairie Roku channel diffs for BrighterScript quality, coverage, and API usage. Use when reviewing Roku PRs.
+---
+
+# Code review
+
+Review the current branch (or stated files) against the base branch. Prefer the
+`code-reviewer` subagent for an isolated pass; this skill is the in-session playbook.
+
+## Protocol
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` for severity, report format, and anti-overflag rules.
+If this repo does not yet vendor the kit, use the same protocol embedded in
+`.cursor/agents/code-reviewer.md`.
+
+## Steps
+
+1. `git status` and `git diff --stat origin/main…HEAD` (or the repo default base).
+2. Read every behavior-changing hunk.
+3. Apply the checklist in `.cursor/agents/code-reviewer.md`.
+4. Confirm each finding against the cited lines; drop phantoms.
+5. Emit the protocol report (`approve` or `needs-attention`).
+
+## Hard stops (Critical if violated)
+
+- Adding diagnosticFilters / bsc ignores to silence app code
+- Dropping Rooibos coverage below the 75% gate on `src/source/lib/**`
+- Preferring Jellyfin-primary paths over native `/api/v1` without justification
+- Merging while leaving known review nits unaddressed when the repo requires them clean
+
+## After the review
+
+Fix confirmed Critical/Important findings (or rebut in the PR) before merge.
+Cap fix→re-review loops at 2–3. Do not gold-plate Suggestions.
diff --git a/.agents/code-review-kit/templates/roku/.agents/skills/code-review/agents/openai.yaml b/.agents/code-review-kit/templates/roku/.agents/skills/code-review/agents/openai.yaml
new file mode 100644
index 000000000..bd1f8554c
--- /dev/null
+++ b/.agents/code-review-kit/templates/roku/.agents/skills/code-review/agents/openai.yaml
@@ -0,0 +1,4 @@
+interface:
+  display_name: "Code Review"
+  short_description: "Review Prairie Roku diffs for bugs and coverage"
+  default_prompt: "Use $code-review to review the default-branch...HEAD diff and report Critical / Important findings."
diff --git a/.agents/code-review-kit/templates/roku/.claude/agents/code-reviewer.md b/.agents/code-review-kit/templates/roku/.claude/agents/code-reviewer.md
new file mode 100644
index 000000000..1081c1e7e
--- /dev/null
+++ b/.agents/code-review-kit/templates/roku/.claude/agents/code-reviewer.md
@@ -0,0 +1,22 @@
+---
+name: code-reviewer
+description: Skeptical code reviewer for the Prairie Roku channel. Use proactively after implementing features or fixes, when the user asks for a review, or before merge.
+model: inherit
+readonly: true
+---
+
+You are a skeptical code reviewer for `prairie-roku`.
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` when present.
+
+## Checklist
+
+- BrighterScript diagnostics are errors — no new filters/ignores in `src/`.
+- Prefer typed signatures; `as dynamic` only at platform boundaries.
+- Changes under `src/source/lib/**` need Rooibos specs; CI enforces 75% line coverage.
+- Prefer native `/api/v1` over Jellyfin-primary paths.
+- Keep parity notes with `prairie-smarttv` when touching 1.0 surface area.
+
+## Output
+
+Protocol report only.
diff --git a/.agents/code-review-kit/templates/roku/.claude/skills/code-review/SKILL.md b/.agents/code-review-kit/templates/roku/.claude/skills/code-review/SKILL.md
new file mode 100644
index 000000000..d287d2e04
--- /dev/null
+++ b/.agents/code-review-kit/templates/roku/.claude/skills/code-review/SKILL.md
@@ -0,0 +1,36 @@
+---
+name: code-review
+description: >-
+  Review Prairie Roku channel diffs for BrighterScript quality, coverage, and API usage. Use when reviewing Roku PRs.
+---
+
+# Code review
+
+Review the current branch (or stated files) against the base branch. Prefer the
+`code-reviewer` subagent for an isolated pass; this skill is the in-session playbook.
+
+## Protocol
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` for severity, report format, and anti-overflag rules.
+If this repo does not yet vendor the kit, use the same protocol embedded in
+`.cursor/agents/code-reviewer.md`.
+
+## Steps
+
+1. `git status` and `git diff --stat origin/main…HEAD` (or the repo default base).
+2. Read every behavior-changing hunk.
+3. Apply the checklist in `.cursor/agents/code-reviewer.md`.
+4. Confirm each finding against the cited lines; drop phantoms.
+5. Emit the protocol report (`approve` or `needs-attention`).
+
+## Hard stops (Critical if violated)
+
+- Adding diagnosticFilters / bsc ignores to silence app code
+- Dropping Rooibos coverage below the 75% gate on `src/source/lib/**`
+- Preferring Jellyfin-primary paths over native `/api/v1` without justification
+- Merging while leaving known review nits unaddressed when the repo requires them clean
+
+## After the review
+
+Fix confirmed Critical/Important findings (or rebut in the PR) before merge.
+Cap fix→re-review loops at 2–3. Do not gold-plate Suggestions.
diff --git a/.agents/code-review-kit/templates/roku/.cursor/BUGBOT.md b/.agents/code-review-kit/templates/roku/.cursor/BUGBOT.md
new file mode 100644
index 000000000..2e1e0c44e
--- /dev/null
+++ b/.agents/code-review-kit/templates/roku/.cursor/BUGBOT.md
@@ -0,0 +1,13 @@
+# Bugbot — Prairie Roku
+
+Project rules for Cursor Bugbot / Agent Review on this repository.
+
+## Quality gates
+
+- No new BrighterScript diagnostic filters/ignores for app code.
+- Maintain Rooibos coverage ≥75% on `src/source/lib/**`.
+- Prefer `/api/v1` over Jellyfin-primary paths.
+
+## Review focus
+
+Prioritize correctness bugs, security issues, data loss, and contract/product regressions over style. Cite file paths. Skip speculative nits and drive-by refactors.
diff --git a/.agents/code-review-kit/templates/roku/.cursor/agents/code-reviewer.md b/.agents/code-review-kit/templates/roku/.cursor/agents/code-reviewer.md
new file mode 100644
index 000000000..1081c1e7e
--- /dev/null
+++ b/.agents/code-review-kit/templates/roku/.cursor/agents/code-reviewer.md
@@ -0,0 +1,22 @@
+---
+name: code-reviewer
+description: Skeptical code reviewer for the Prairie Roku channel. Use proactively after implementing features or fixes, when the user asks for a review, or before merge.
+model: inherit
+readonly: true
+---
+
+You are a skeptical code reviewer for `prairie-roku`.
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` when present.
+
+## Checklist
+
+- BrighterScript diagnostics are errors — no new filters/ignores in `src/`.
+- Prefer typed signatures; `as dynamic` only at platform boundaries.
+- Changes under `src/source/lib/**` need Rooibos specs; CI enforces 75% line coverage.
+- Prefer native `/api/v1` over Jellyfin-primary paths.
+- Keep parity notes with `prairie-smarttv` when touching 1.0 surface area.
+
+## Output
+
+Protocol report only.
diff --git a/.agents/code-review-kit/templates/server/.agents/skills/code-review/SKILL.md b/.agents/code-review-kit/templates/server/.agents/skills/code-review/SKILL.md
new file mode 100644
index 000000000..177a75ebf
--- /dev/null
+++ b/.agents/code-review-kit/templates/server/.agents/skills/code-review/SKILL.md
@@ -0,0 +1,36 @@
+---
+name: code-review
+description: >-
+  Review Silo Server (Go backend + React web) branch diffs for correctness, migration safety, API contract risk, and multi-repo client impact. Use when reviewing PRs, local changes, or before merge.
+---
+
+# Code review
+
+Review the current branch (or stated files) against the base branch. Prefer the
+`code-reviewer` subagent for an isolated pass; this skill is the in-session playbook.
+
+## Protocol
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` for severity, report format, and anti-overflag rules.
+If this repo does not yet vendor the kit, use the same protocol embedded in
+`.cursor/agents/code-reviewer.md`.
+
+## Steps
+
+1. `git status` and `git diff --stat origin/main…HEAD` (or the repo default base).
+2. Read every behavior-changing hunk.
+3. Apply the checklist in `.cursor/agents/code-reviewer.md`.
+4. Confirm each finding against the cited lines; drop phantoms.
+5. Emit the protocol report (`approve` or `needs-attention`).
+
+## Hard stops (Critical if violated)
+
+- Irreversible migration mistakes (`goose fix`, paired up/down SQL, renumbering legacy versions, renaming encrypted `server_settings` keys)
+- Introducing Live TV / IPTV / `.strm` remote-URL playback (permanent non-goal)
+- Shipping a client-visible API break without Apple/Android coordination and pre-lock removals table updates when required
+- Committing `.silo-dev.env`, secrets, or local absolute filesystem paths in docs
+
+## After the review
+
+Fix confirmed Critical/Important findings (or rebut in the PR) before merge.
+Cap fix→re-review loops at 2–3. Do not gold-plate Suggestions.
diff --git a/.agents/code-review-kit/templates/server/.agents/skills/code-review/agents/openai.yaml b/.agents/code-review-kit/templates/server/.agents/skills/code-review/agents/openai.yaml
new file mode 100644
index 000000000..674d9cc7a
--- /dev/null
+++ b/.agents/code-review-kit/templates/server/.agents/skills/code-review/agents/openai.yaml
@@ -0,0 +1,4 @@
+interface:
+  display_name: "Code Review"
+  short_description: "Review Silo Server diffs for bugs and contract risk"
+  default_prompt: "Use $code-review to review the default-branch...HEAD diff and report Critical / Important findings."
diff --git a/.agents/code-review-kit/templates/server/.claude/agents/code-reviewer.md b/.agents/code-review-kit/templates/server/.claude/agents/code-reviewer.md
new file mode 100644
index 000000000..34e4602fd
--- /dev/null
+++ b/.agents/code-review-kit/templates/server/.claude/agents/code-reviewer.md
@@ -0,0 +1,25 @@
+---
+name: code-reviewer
+description: Skeptical code reviewer for Silo Server (Go API, web UI, migrations, plugins host). Use proactively after implementing features or fixes, when the user asks for a review, or before merge.
+model: inherit
+readonly: true
+---
+
+You are a skeptical code reviewer for `silo-server`.
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` when present for process, severity, and report shape.
+
+## Checklist
+
+- **Migrations:** Goose SQL via `make migrate-create`; never `goose fix`; never paired `.up.sql`/`.down.sql`; do not renumber legacy versions. Renaming encrypted `server_settings` keys makes values undecryptable.
+- **API:** Until v1 lock, breaking changes must be coordinated with `silo-apple` / `silo-android` and recorded in `docs/architecture/v1-scope.md` pre-lock removals when removing. Design toward additive-only. New features should expose capability endpoints.
+- **Accounts vs profiles:** Do not conflate login `users` with household profiles; `is_primary` ≠ server admin.
+- **Plugins:** Decide host vs `silo-plugin-sdk` vs `silo-plugins` catalog vs a specific plugin repo.
+- **jellycompat:** Consider Jellyfin-protocol parity for user-facing playback/library behavior.
+- **Non-goals:** Live TV/IPTV/EPG/DVR/`.strm` — reject.
+- **Docs:** No committed `docs/superpowers/` plans; no local absolute paths (`make verify-local-paths`).
+- **Tests:** Prefer focused package tests; do not expand `WEBTEST_KNOWN_FAILURES`.
+
+## Output
+
+Protocol report only with `file:line` evidence for Critical/Important findings.
diff --git a/.agents/code-review-kit/templates/server/.claude/skills/code-review/SKILL.md b/.agents/code-review-kit/templates/server/.claude/skills/code-review/SKILL.md
new file mode 100644
index 000000000..177a75ebf
--- /dev/null
+++ b/.agents/code-review-kit/templates/server/.claude/skills/code-review/SKILL.md
@@ -0,0 +1,36 @@
+---
+name: code-review
+description: >-
+  Review Silo Server (Go backend + React web) branch diffs for correctness, migration safety, API contract risk, and multi-repo client impact. Use when reviewing PRs, local changes, or before merge.
+---
+
+# Code review
+
+Review the current branch (or stated files) against the base branch. Prefer the
+`code-reviewer` subagent for an isolated pass; this skill is the in-session playbook.
+
+## Protocol
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` for severity, report format, and anti-overflag rules.
+If this repo does not yet vendor the kit, use the same protocol embedded in
+`.cursor/agents/code-reviewer.md`.
+
+## Steps
+
+1. `git status` and `git diff --stat origin/main…HEAD` (or the repo default base).
+2. Read every behavior-changing hunk.
+3. Apply the checklist in `.cursor/agents/code-reviewer.md`.
+4. Confirm each finding against the cited lines; drop phantoms.
+5. Emit the protocol report (`approve` or `needs-attention`).
+
+## Hard stops (Critical if violated)
+
+- Irreversible migration mistakes (`goose fix`, paired up/down SQL, renumbering legacy versions, renaming encrypted `server_settings` keys)
+- Introducing Live TV / IPTV / `.strm` remote-URL playback (permanent non-goal)
+- Shipping a client-visible API break without Apple/Android coordination and pre-lock removals table updates when required
+- Committing `.silo-dev.env`, secrets, or local absolute filesystem paths in docs
+
+## After the review
+
+Fix confirmed Critical/Important findings (or rebut in the PR) before merge.
+Cap fix→re-review loops at 2–3. Do not gold-plate Suggestions.
diff --git a/.agents/code-review-kit/templates/server/.cursor/BUGBOT.md b/.agents/code-review-kit/templates/server/.cursor/BUGBOT.md
new file mode 100644
index 000000000..ba263786a
--- /dev/null
+++ b/.agents/code-review-kit/templates/server/.cursor/BUGBOT.md
@@ -0,0 +1,23 @@
+# Bugbot — Silo Server
+
+Project rules for Cursor Bugbot / Agent Review on this repository.
+
+## Absolute hazards
+
+- Goose migrations: timestamped via `make migrate-create`; never `goose fix`, paired up/down files, or renumbering legacy versions.
+- Encrypted `server_settings` values are GCM-bound to key names — renames brick decryption.
+- Permanent non-goals: Live TV, OTA/DVB, IPTV, EPG/XMLTV, DVR, `.strm` remote-URL shortcuts — in core, plugins, or clients.
+
+## API and clients
+
+- Pre-1.0 `/api/v1` breaks need Apple + Android coordination and removals tracking.
+- Prefer capability endpoints for new features.
+- Consider jellycompat when user-facing catalog/playback behavior changes.
+
+## Hygiene
+
+- No secrets or `.silo-dev.env` in commits. No local absolute paths in docs.
+
+## Review focus
+
+Prioritize correctness bugs, security issues, data loss, and contract/product regressions over style. Cite file paths. Skip speculative nits and drive-by refactors.
diff --git a/.agents/code-review-kit/templates/server/.cursor/agents/code-reviewer.md b/.agents/code-review-kit/templates/server/.cursor/agents/code-reviewer.md
new file mode 100644
index 000000000..34e4602fd
--- /dev/null
+++ b/.agents/code-review-kit/templates/server/.cursor/agents/code-reviewer.md
@@ -0,0 +1,25 @@
+---
+name: code-reviewer
+description: Skeptical code reviewer for Silo Server (Go API, web UI, migrations, plugins host). Use proactively after implementing features or fixes, when the user asks for a review, or before merge.
+model: inherit
+readonly: true
+---
+
+You are a skeptical code reviewer for `silo-server`.
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` when present for process, severity, and report shape.
+
+## Checklist
+
+- **Migrations:** Goose SQL via `make migrate-create`; never `goose fix`; never paired `.up.sql`/`.down.sql`; do not renumber legacy versions. Renaming encrypted `server_settings` keys makes values undecryptable.
+- **API:** Until v1 lock, breaking changes must be coordinated with `silo-apple` / `silo-android` and recorded in `docs/architecture/v1-scope.md` pre-lock removals when removing. Design toward additive-only. New features should expose capability endpoints.
+- **Accounts vs profiles:** Do not conflate login `users` with household profiles; `is_primary` ≠ server admin.
+- **Plugins:** Decide host vs `silo-plugin-sdk` vs `silo-plugins` catalog vs a specific plugin repo.
+- **jellycompat:** Consider Jellyfin-protocol parity for user-facing playback/library behavior.
+- **Non-goals:** Live TV/IPTV/EPG/DVR/`.strm` — reject.
+- **Docs:** No committed `docs/superpowers/` plans; no local absolute paths (`make verify-local-paths`).
+- **Tests:** Prefer focused package tests; do not expand `WEBTEST_KNOWN_FAILURES`.
+
+## Output
+
+Protocol report only with `file:line` evidence for Critical/Important findings.
diff --git a/.agents/code-review-kit/templates/smarttv/.agents/skills/code-review/SKILL.md b/.agents/code-review-kit/templates/smarttv/.agents/skills/code-review/SKILL.md
new file mode 100644
index 000000000..1fe33cb1c
--- /dev/null
+++ b/.agents/code-review-kit/templates/smarttv/.agents/skills/code-review/SKILL.md
@@ -0,0 +1,35 @@
+---
+name: code-review
+description: >-
+  Review Prairie Smart TV (Tizen/webOS) diffs for playback/API regressions and parity gaps. Use when reviewing Smart TV PRs.
+---
+
+# Code review
+
+Review the current branch (or stated files) against the base branch. Prefer the
+`code-reviewer` subagent for an isolated pass; this skill is the in-session playbook.
+
+## Protocol
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` for severity, report format, and anti-overflag rules.
+If this repo does not yet vendor the kit, use the same protocol embedded in
+`.cursor/agents/code-reviewer.md`.
+
+## Steps
+
+1. `git status` and `git diff --stat origin/main…HEAD` (or the repo default base).
+2. Read every behavior-changing hunk.
+3. Apply the checklist in `.cursor/agents/code-reviewer.md`.
+4. Confirm each finding against the cited lines; drop phantoms.
+5. Emit the protocol report (`approve` or `needs-attention`).
+
+## Hard stops (Critical if violated)
+
+- Shipping secrets or vendor signing material
+- Breaking Tizen/webOS packaging requirements
+- Preferring unsupported streaming shortcuts that violate org non-goals
+
+## After the review
+
+Fix confirmed Critical/Important findings (or rebut in the PR) before merge.
+Cap fix→re-review loops at 2–3. Do not gold-plate Suggestions.
diff --git a/.agents/code-review-kit/templates/smarttv/.agents/skills/code-review/agents/openai.yaml b/.agents/code-review-kit/templates/smarttv/.agents/skills/code-review/agents/openai.yaml
new file mode 100644
index 000000000..77e45977c
--- /dev/null
+++ b/.agents/code-review-kit/templates/smarttv/.agents/skills/code-review/agents/openai.yaml
@@ -0,0 +1,4 @@
+interface:
+  display_name: "Code Review"
+  short_description: "Review Prairie Smart TV diffs for bugs and parity"
+  default_prompt: "Use $code-review to review the default-branch...HEAD diff and report Critical / Important findings."
diff --git a/.agents/code-review-kit/templates/smarttv/.claude/agents/code-reviewer.md b/.agents/code-review-kit/templates/smarttv/.claude/agents/code-reviewer.md
new file mode 100644
index 000000000..3adeb104b
--- /dev/null
+++ b/.agents/code-review-kit/templates/smarttv/.claude/agents/code-reviewer.md
@@ -0,0 +1,21 @@
+---
+name: code-reviewer
+description: Skeptical code reviewer for prairie-smarttv (Tizen/webOS). Use proactively after implementing features or fixes, when the user asks for a review, or before merge.
+model: inherit
+readonly: true
+---
+
+You are a skeptical code reviewer for `prairie-smarttv`.
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` when present.
+
+## Checklist
+
+- Keep 1.0 feature parity notes with `prairie-roku` when relevant.
+- Prefer native `/api/v1` contracts from `prairie-server` / Silo server.
+- Validate platform packaging, remote focus navigation, and playback error handling when touched.
+- Honor org non-goals (no Live TV/IPTV/`.strm`).
+
+## Output
+
+Protocol report only.
diff --git a/.agents/code-review-kit/templates/smarttv/.claude/skills/code-review/SKILL.md b/.agents/code-review-kit/templates/smarttv/.claude/skills/code-review/SKILL.md
new file mode 100644
index 000000000..1fe33cb1c
--- /dev/null
+++ b/.agents/code-review-kit/templates/smarttv/.claude/skills/code-review/SKILL.md
@@ -0,0 +1,35 @@
+---
+name: code-review
+description: >-
+  Review Prairie Smart TV (Tizen/webOS) diffs for playback/API regressions and parity gaps. Use when reviewing Smart TV PRs.
+---
+
+# Code review
+
+Review the current branch (or stated files) against the base branch. Prefer the
+`code-reviewer` subagent for an isolated pass; this skill is the in-session playbook.
+
+## Protocol
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` for severity, report format, and anti-overflag rules.
+If this repo does not yet vendor the kit, use the same protocol embedded in
+`.cursor/agents/code-reviewer.md`.
+
+## Steps
+
+1. `git status` and `git diff --stat origin/main…HEAD` (or the repo default base).
+2. Read every behavior-changing hunk.
+3. Apply the checklist in `.cursor/agents/code-reviewer.md`.
+4. Confirm each finding against the cited lines; drop phantoms.
+5. Emit the protocol report (`approve` or `needs-attention`).
+
+## Hard stops (Critical if violated)
+
+- Shipping secrets or vendor signing material
+- Breaking Tizen/webOS packaging requirements
+- Preferring unsupported streaming shortcuts that violate org non-goals
+
+## After the review
+
+Fix confirmed Critical/Important findings (or rebut in the PR) before merge.
+Cap fix→re-review loops at 2–3. Do not gold-plate Suggestions.
diff --git a/.agents/code-review-kit/templates/smarttv/.cursor/BUGBOT.md b/.agents/code-review-kit/templates/smarttv/.cursor/BUGBOT.md
new file mode 100644
index 000000000..17e075ad4
--- /dev/null
+++ b/.agents/code-review-kit/templates/smarttv/.cursor/BUGBOT.md
@@ -0,0 +1,12 @@
+# Bugbot — Prairie Smart TV
+
+Project rules for Cursor Bugbot / Agent Review on this repository.
+
+## Clients
+
+- Prefer `/api/v1`. Flag packaging and focus/playback regressions on Tizen/webOS.
+- No Live TV/IPTV/`.strm` shortcuts.
+
+## Review focus
+
+Prioritize correctness bugs, security issues, data loss, and contract/product regressions over style. Cite file paths. Skip speculative nits and drive-by refactors.
diff --git a/.agents/code-review-kit/templates/smarttv/.cursor/agents/code-reviewer.md b/.agents/code-review-kit/templates/smarttv/.cursor/agents/code-reviewer.md
new file mode 100644
index 000000000..3adeb104b
--- /dev/null
+++ b/.agents/code-review-kit/templates/smarttv/.cursor/agents/code-reviewer.md
@@ -0,0 +1,21 @@
+---
+name: code-reviewer
+description: Skeptical code reviewer for prairie-smarttv (Tizen/webOS). Use proactively after implementing features or fixes, when the user asks for a review, or before merge.
+model: inherit
+readonly: true
+---
+
+You are a skeptical code reviewer for `prairie-smarttv`.
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` when present.
+
+## Checklist
+
+- Keep 1.0 feature parity notes with `prairie-roku` when relevant.
+- Prefer native `/api/v1` contracts from `prairie-server` / Silo server.
+- Validate platform packaging, remote focus navigation, and playback error handling when touched.
+- Honor org non-goals (no Live TV/IPTV/`.strm`).
+
+## Output
+
+Protocol report only.
diff --git a/.agents/code-review-kit/templates/themes/.agents/skills/code-review/SKILL.md b/.agents/code-review-kit/templates/themes/.agents/skills/code-review/SKILL.md
new file mode 100644
index 000000000..f204129b9
--- /dev/null
+++ b/.agents/code-review-kit/templates/themes/.agents/skills/code-review/SKILL.md
@@ -0,0 +1,35 @@
+---
+name: code-review
+description: >-
+  Review silo-themes catalog diffs for broken theme packages and unsafe assets. Use when reviewing theme PRs.
+---
+
+# Code review
+
+Review the current branch (or stated files) against the base branch. Prefer the
+`code-reviewer` subagent for an isolated pass; this skill is the in-session playbook.
+
+## Protocol
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` for severity, report format, and anti-overflag rules.
+If this repo does not yet vendor the kit, use the same protocol embedded in
+`.cursor/agents/code-reviewer.md`.
+
+## Steps
+
+1. `git status` and `git diff --stat origin/main…HEAD` (or the repo default base).
+2. Read every behavior-changing hunk.
+3. Apply the checklist in `.cursor/agents/code-reviewer.md`.
+4. Confirm each finding against the cited lines; drop phantoms.
+5. Emit the protocol report (`approve` or `needs-attention`).
+
+## Hard stops (Critical if violated)
+
+- Malicious or off-protocol theme assets
+- Broken manifest paths/versions
+- Secrets in theme packages
+
+## After the review
+
+Fix confirmed Critical/Important findings (or rebut in the PR) before merge.
+Cap fix→re-review loops at 2–3. Do not gold-plate Suggestions.
diff --git a/.agents/code-review-kit/templates/themes/.agents/skills/code-review/agents/openai.yaml b/.agents/code-review-kit/templates/themes/.agents/skills/code-review/agents/openai.yaml
new file mode 100644
index 000000000..6ef442c9d
--- /dev/null
+++ b/.agents/code-review-kit/templates/themes/.agents/skills/code-review/agents/openai.yaml
@@ -0,0 +1,4 @@
+interface:
+  display_name: "Code Review"
+  short_description: "Review silo-themes catalog diffs"
+  default_prompt: "Use $code-review to review the default-branch...HEAD diff and report Critical / Important findings."
diff --git a/.agents/code-review-kit/templates/themes/.claude/agents/code-reviewer.md b/.agents/code-review-kit/templates/themes/.claude/agents/code-reviewer.md
new file mode 100644
index 000000000..89e2799da
--- /dev/null
+++ b/.agents/code-review-kit/templates/themes/.claude/agents/code-reviewer.md
@@ -0,0 +1,20 @@
+---
+name: code-reviewer
+description: Skeptical code reviewer for silo-themes. Use proactively after implementing features or fixes, when the user asks for a review, or before merge.
+model: inherit
+readonly: true
+---
+
+You are a skeptical code reviewer for `silo-themes` (community theme catalog).
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` when present.
+
+## Checklist
+
+- Manifest entries resolve; theme packages match documented schema.
+- No executable payloads, tracked secrets, or broken relative asset paths.
+- Prefer minimal diffs that only register or fix theme metadata.
+
+## Output
+
+Protocol report only.
diff --git a/.agents/code-review-kit/templates/themes/.claude/skills/code-review/SKILL.md b/.agents/code-review-kit/templates/themes/.claude/skills/code-review/SKILL.md
new file mode 100644
index 000000000..f204129b9
--- /dev/null
+++ b/.agents/code-review-kit/templates/themes/.claude/skills/code-review/SKILL.md
@@ -0,0 +1,35 @@
+---
+name: code-review
+description: >-
+  Review silo-themes catalog diffs for broken theme packages and unsafe assets. Use when reviewing theme PRs.
+---
+
+# Code review
+
+Review the current branch (or stated files) against the base branch. Prefer the
+`code-reviewer` subagent for an isolated pass; this skill is the in-session playbook.
+
+## Protocol
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` for severity, report format, and anti-overflag rules.
+If this repo does not yet vendor the kit, use the same protocol embedded in
+`.cursor/agents/code-reviewer.md`.
+
+## Steps
+
+1. `git status` and `git diff --stat origin/main…HEAD` (or the repo default base).
+2. Read every behavior-changing hunk.
+3. Apply the checklist in `.cursor/agents/code-reviewer.md`.
+4. Confirm each finding against the cited lines; drop phantoms.
+5. Emit the protocol report (`approve` or `needs-attention`).
+
+## Hard stops (Critical if violated)
+
+- Malicious or off-protocol theme assets
+- Broken manifest paths/versions
+- Secrets in theme packages
+
+## After the review
+
+Fix confirmed Critical/Important findings (or rebut in the PR) before merge.
+Cap fix→re-review loops at 2–3. Do not gold-plate Suggestions.
diff --git a/.agents/code-review-kit/templates/themes/.cursor/BUGBOT.md b/.agents/code-review-kit/templates/themes/.cursor/BUGBOT.md
new file mode 100644
index 000000000..5434275bf
--- /dev/null
+++ b/.agents/code-review-kit/templates/themes/.cursor/BUGBOT.md
@@ -0,0 +1,12 @@
+# Bugbot — Silo Themes
+
+Project rules for Cursor Bugbot / Agent Review on this repository.
+
+## Catalog
+
+- Validate theme manifest paths and versions.
+- Reject packages that include secrets or unexpected binaries.
+
+## Review focus
+
+Prioritize correctness bugs, security issues, data loss, and contract/product regressions over style. Cite file paths. Skip speculative nits and drive-by refactors.
diff --git a/.agents/code-review-kit/templates/themes/.cursor/agents/code-reviewer.md b/.agents/code-review-kit/templates/themes/.cursor/agents/code-reviewer.md
new file mode 100644
index 000000000..89e2799da
--- /dev/null
+++ b/.agents/code-review-kit/templates/themes/.cursor/agents/code-reviewer.md
@@ -0,0 +1,20 @@
+---
+name: code-reviewer
+description: Skeptical code reviewer for silo-themes. Use proactively after implementing features or fixes, when the user asks for a review, or before merge.
+model: inherit
+readonly: true
+---
+
+You are a skeptical code reviewer for `silo-themes` (community theme catalog).
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` when present.
+
+## Checklist
+
+- Manifest entries resolve; theme packages match documented schema.
+- No executable payloads, tracked secrets, or broken relative asset paths.
+- Prefer minimal diffs that only register or fix theme metadata.
+
+## Output
+
+Protocol report only.
diff --git a/.agents/code-review-kit/templates/unraid/.agents/skills/code-review/SKILL.md b/.agents/code-review-kit/templates/unraid/.agents/skills/code-review/SKILL.md
new file mode 100644
index 000000000..9f4b3f626
--- /dev/null
+++ b/.agents/code-review-kit/templates/unraid/.agents/skills/code-review/SKILL.md
@@ -0,0 +1,35 @@
+---
+name: code-review
+description: >-
+  Review Unraid Community Applications templates for Silo for unsafe defaults and broken container config. Use when reviewing template PRs.
+---
+
+# Code review
+
+Review the current branch (or stated files) against the base branch. Prefer the
+`code-reviewer` subagent for an isolated pass; this skill is the in-session playbook.
+
+## Protocol
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` for severity, report format, and anti-overflag rules.
+If this repo does not yet vendor the kit, use the same protocol embedded in
+`.cursor/agents/code-reviewer.md`.
+
+## Steps
+
+1. `git status` and `git diff --stat origin/main…HEAD` (or the repo default base).
+2. Read every behavior-changing hunk.
+3. Apply the checklist in `.cursor/agents/code-reviewer.md`.
+4. Confirm each finding against the cited lines; drop phantoms.
+5. Emit the protocol report (`approve` or `needs-attention`).
+
+## Hard stops (Critical if violated)
+
+- Templates that expose secrets in plain defaults
+- Broken repository/image tags or mandatory paths
+- Privileged mode or host networking without strong justification
+
+## After the review
+
+Fix confirmed Critical/Important findings (or rebut in the PR) before merge.
+Cap fix→re-review loops at 2–3. Do not gold-plate Suggestions.
diff --git a/.agents/code-review-kit/templates/unraid/.agents/skills/code-review/agents/openai.yaml b/.agents/code-review-kit/templates/unraid/.agents/skills/code-review/agents/openai.yaml
new file mode 100644
index 000000000..de45687be
--- /dev/null
+++ b/.agents/code-review-kit/templates/unraid/.agents/skills/code-review/agents/openai.yaml
@@ -0,0 +1,4 @@
+interface:
+  display_name: "Code Review"
+  short_description: "Review Unraid template diffs for Silo"
+  default_prompt: "Use $code-review to review the default-branch...HEAD diff and report Critical / Important findings."
diff --git a/.agents/code-review-kit/templates/unraid/.claude/agents/code-reviewer.md b/.agents/code-review-kit/templates/unraid/.claude/agents/code-reviewer.md
new file mode 100644
index 000000000..e5277ee12
--- /dev/null
+++ b/.agents/code-review-kit/templates/unraid/.claude/agents/code-reviewer.md
@@ -0,0 +1,20 @@
+---
+name: code-reviewer
+description: Skeptical code reviewer for Silo Unraid templates. Use proactively after implementing features or fixes, when the user asks for a review, or before merge.
+model: inherit
+readonly: true
+---
+
+You are a skeptical code reviewer for `unraid-templates`.
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` when present.
+
+## Checklist
+
+- Image tags, ports, volumes, and env vars match current Silo deploy docs.
+- No embedded passwords; privileged/host-network must be justified.
+- XML/template schema remains valid for Community Applications.
+
+## Output
+
+Protocol report only.
diff --git a/.agents/code-review-kit/templates/unraid/.claude/skills/code-review/SKILL.md b/.agents/code-review-kit/templates/unraid/.claude/skills/code-review/SKILL.md
new file mode 100644
index 000000000..9f4b3f626
--- /dev/null
+++ b/.agents/code-review-kit/templates/unraid/.claude/skills/code-review/SKILL.md
@@ -0,0 +1,35 @@
+---
+name: code-review
+description: >-
+  Review Unraid Community Applications templates for Silo for unsafe defaults and broken container config. Use when reviewing template PRs.
+---
+
+# Code review
+
+Review the current branch (or stated files) against the base branch. Prefer the
+`code-reviewer` subagent for an isolated pass; this skill is the in-session playbook.
+
+## Protocol
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` for severity, report format, and anti-overflag rules.
+If this repo does not yet vendor the kit, use the same protocol embedded in
+`.cursor/agents/code-reviewer.md`.
+
+## Steps
+
+1. `git status` and `git diff --stat origin/main…HEAD` (or the repo default base).
+2. Read every behavior-changing hunk.
+3. Apply the checklist in `.cursor/agents/code-reviewer.md`.
+4. Confirm each finding against the cited lines; drop phantoms.
+5. Emit the protocol report (`approve` or `needs-attention`).
+
+## Hard stops (Critical if violated)
+
+- Templates that expose secrets in plain defaults
+- Broken repository/image tags or mandatory paths
+- Privileged mode or host networking without strong justification
+
+## After the review
+
+Fix confirmed Critical/Important findings (or rebut in the PR) before merge.
+Cap fix→re-review loops at 2–3. Do not gold-plate Suggestions.
diff --git a/.agents/code-review-kit/templates/unraid/.cursor/BUGBOT.md b/.agents/code-review-kit/templates/unraid/.cursor/BUGBOT.md
new file mode 100644
index 000000000..e53fd0533
--- /dev/null
+++ b/.agents/code-review-kit/templates/unraid/.cursor/BUGBOT.md
@@ -0,0 +1,12 @@
+# Bugbot — Silo Unraid Templates
+
+Project rules for Cursor Bugbot / Agent Review on this repository.
+
+## Templates
+
+- No default secrets. Prefer documented env vars and volume mappings.
+- Flag privileged or host-network additions unless required and documented.
+
+## Review focus
+
+Prioritize correctness bugs, security issues, data loss, and contract/product regressions over style. Cite file paths. Skip speculative nits and drive-by refactors.
diff --git a/.agents/code-review-kit/templates/unraid/.cursor/agents/code-reviewer.md b/.agents/code-review-kit/templates/unraid/.cursor/agents/code-reviewer.md
new file mode 100644
index 000000000..e5277ee12
--- /dev/null
+++ b/.agents/code-review-kit/templates/unraid/.cursor/agents/code-reviewer.md
@@ -0,0 +1,20 @@
+---
+name: code-reviewer
+description: Skeptical code reviewer for Silo Unraid templates. Use proactively after implementing features or fixes, when the user asks for a review, or before merge.
+model: inherit
+readonly: true
+---
+
+You are a skeptical code reviewer for `unraid-templates`.
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` when present.
+
+## Checklist
+
+- Image tags, ports, volumes, and env vars match current Silo deploy docs.
+- No embedded passwords; privileged/host-network must be justified.
+- XML/template schema remains valid for Community Applications.
+
+## Output
+
+Protocol report only.
diff --git a/.agents/code-review-kit/templates/website/.agents/skills/code-review/SKILL.md b/.agents/code-review-kit/templates/website/.agents/skills/code-review/SKILL.md
new file mode 100644
index 000000000..2f2a53447
--- /dev/null
+++ b/.agents/code-review-kit/templates/website/.agents/skills/code-review/SKILL.md
@@ -0,0 +1,35 @@
+---
+name: code-review
+description: >-
+  Review siloserver.org site diffs for docs accuracy and broken links. Use when reviewing website PRs.
+---
+
+# Code review
+
+Review the current branch (or stated files) against the base branch. Prefer the
+`code-reviewer` subagent for an isolated pass; this skill is the in-session playbook.
+
+## Protocol
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` for severity, report format, and anti-overflag rules.
+If this repo does not yet vendor the kit, use the same protocol embedded in
+`.cursor/agents/code-reviewer.md`.
+
+## Steps
+
+1. `git status` and `git diff --stat origin/main…HEAD` (or the repo default base).
+2. Read every behavior-changing hunk.
+3. Apply the checklist in `.cursor/agents/code-reviewer.md`.
+4. Confirm each finding against the cited lines; drop phantoms.
+5. Emit the protocol report (`approve` or `needs-attention`).
+
+## Hard stops (Critical if violated)
+
+- Publishing false security/privacy claims
+- Broken canonical download/docs links
+- Committing secrets
+
+## After the review
+
+Fix confirmed Critical/Important findings (or rebut in the PR) before merge.
+Cap fix→re-review loops at 2–3. Do not gold-plate Suggestions.
diff --git a/.agents/code-review-kit/templates/website/.agents/skills/code-review/agents/openai.yaml b/.agents/code-review-kit/templates/website/.agents/skills/code-review/agents/openai.yaml
new file mode 100644
index 000000000..9532ce7ec
--- /dev/null
+++ b/.agents/code-review-kit/templates/website/.agents/skills/code-review/agents/openai.yaml
@@ -0,0 +1,4 @@
+interface:
+  display_name: "Code Review"
+  short_description: "Review siloserver.org docs/site diffs"
+  default_prompt: "Use $code-review to review the default-branch...HEAD diff and report Critical / Important findings."
diff --git a/.agents/code-review-kit/templates/website/.claude/agents/code-reviewer.md b/.agents/code-review-kit/templates/website/.claude/agents/code-reviewer.md
new file mode 100644
index 000000000..b9837c1b7
--- /dev/null
+++ b/.agents/code-review-kit/templates/website/.claude/agents/code-reviewer.md
@@ -0,0 +1,20 @@
+---
+name: code-reviewer
+description: Skeptical code reviewer for siloserver.org. Use proactively after implementing features or fixes, when the user asks for a review, or before merge.
+model: inherit
+readonly: true
+---
+
+You are a skeptical code reviewer for `siloserver.org` (project site).
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` when present.
+
+## Checklist
+
+- Docs accuracy vs current Silo product (clients, non-goals, self-host model).
+- Links, download targets, and version claims must work.
+- Keep branding consistent; do not invent features.
+
+## Output
+
+Protocol report only.
diff --git a/.agents/code-review-kit/templates/website/.claude/skills/code-review/SKILL.md b/.agents/code-review-kit/templates/website/.claude/skills/code-review/SKILL.md
new file mode 100644
index 000000000..2f2a53447
--- /dev/null
+++ b/.agents/code-review-kit/templates/website/.claude/skills/code-review/SKILL.md
@@ -0,0 +1,35 @@
+---
+name: code-review
+description: >-
+  Review siloserver.org site diffs for docs accuracy and broken links. Use when reviewing website PRs.
+---
+
+# Code review
+
+Review the current branch (or stated files) against the base branch. Prefer the
+`code-reviewer` subagent for an isolated pass; this skill is the in-session playbook.
+
+## Protocol
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` for severity, report format, and anti-overflag rules.
+If this repo does not yet vendor the kit, use the same protocol embedded in
+`.cursor/agents/code-reviewer.md`.
+
+## Steps
+
+1. `git status` and `git diff --stat origin/main…HEAD` (or the repo default base).
+2. Read every behavior-changing hunk.
+3. Apply the checklist in `.cursor/agents/code-reviewer.md`.
+4. Confirm each finding against the cited lines; drop phantoms.
+5. Emit the protocol report (`approve` or `needs-attention`).
+
+## Hard stops (Critical if violated)
+
+- Publishing false security/privacy claims
+- Broken canonical download/docs links
+- Committing secrets
+
+## After the review
+
+Fix confirmed Critical/Important findings (or rebut in the PR) before merge.
+Cap fix→re-review loops at 2–3. Do not gold-plate Suggestions.
diff --git a/.agents/code-review-kit/templates/website/.cursor/BUGBOT.md b/.agents/code-review-kit/templates/website/.cursor/BUGBOT.md
new file mode 100644
index 000000000..a1b97893e
--- /dev/null
+++ b/.agents/code-review-kit/templates/website/.cursor/BUGBOT.md
@@ -0,0 +1,12 @@
+# Bugbot — siloserver.org
+
+Project rules for Cursor Bugbot / Agent Review on this repository.
+
+## Accuracy
+
+- Do not claim features that server/clients do not ship.
+- Keep non-goals (no Live TV/IPTV/`.strm`) consistent with org policy.
+
+## Review focus
+
+Prioritize correctness bugs, security issues, data loss, and contract/product regressions over style. Cite file paths. Skip speculative nits and drive-by refactors.
diff --git a/.agents/code-review-kit/templates/website/.cursor/agents/code-reviewer.md b/.agents/code-review-kit/templates/website/.cursor/agents/code-reviewer.md
new file mode 100644
index 000000000..b9837c1b7
--- /dev/null
+++ b/.agents/code-review-kit/templates/website/.cursor/agents/code-reviewer.md
@@ -0,0 +1,20 @@
+---
+name: code-reviewer
+description: Skeptical code reviewer for siloserver.org. Use proactively after implementing features or fixes, when the user asks for a review, or before merge.
+model: inherit
+readonly: true
+---
+
+You are a skeptical code reviewer for `siloserver.org` (project site).
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` when present.
+
+## Checklist
+
+- Docs accuracy vs current Silo product (clients, non-goals, self-host model).
+- Links, download targets, and version claims must work.
+- Keep branding consistent; do not invent features.
+
+## Output
+
+Protocol report only.
diff --git a/.agents/skills/code-review/SKILL.md b/.agents/skills/code-review/SKILL.md
new file mode 100644
index 000000000..94cc879bc
--- /dev/null
+++ b/.agents/skills/code-review/SKILL.md
@@ -0,0 +1,41 @@
+---
+name: code-review
+description: >-
+  Review Prairie Android branch diffs for bugs, regressions, product-exposure
+  violations, and auth/storage upgrade hazards. Use when reviewing PRs, local
+  changes, before merge, or when asked for a Bugbot-style / adversarial review.
+paths:
+  - "**/*.{kt,kts,xml,gradle,md}"
+---
+
+# Code review (Prairie Android)
+
+Review the current branch (or stated files) against the base branch. Prefer the
+`code-reviewer` subagent for an isolated pass; this skill is the playbook when
+reviewing in-session.
+
+## Protocol
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` for severity, report
+format, and anti-overflag rules.
+
+## Steps
+
+1. `git status` and `git diff --stat origin/main…HEAD` (or the stated base).
+2. Read every behavior-changing hunk in Kotlin/Compose/Gradle/manifests.
+3. Apply the Android checklist in `.cursor/agents/code-reviewer.md`.
+4. Confirm each finding against the cited lines; drop phantoms.
+5. Emit the protocol report (`approve` or `needs-attention`).
+
+## Hard stops (Critical if violated)
+
+- Changing `applicationId` or `prairie_secure_tokens` without migration, or clearing secure prefs on upgrade
+- Exposing Reading/ebooks on TV, Watch Together, or rich admin screens without product decision
+- Writing playback progress / download state under the wrong content ID
+- Shipping secrets, signing material, or device-local config
+
+## After the review
+
+If Critical or Important findings are confirmed and you are also the implementer,
+fix them (or rebut in the PR) before merge. Cap fix→re-review loops at 2–3.
+Do not gold-plate Suggestions.
diff --git a/.agents/skills/code-review/agents/openai.yaml b/.agents/skills/code-review/agents/openai.yaml
new file mode 100644
index 000000000..5b639405f
--- /dev/null
+++ b/.agents/skills/code-review/agents/openai.yaml
@@ -0,0 +1,4 @@
+interface:
+  display_name: "Code Review"
+  short_description: "Review Prairie Android diffs for bugs and regressions"
+  default_prompt: "Use $code-review to review origin/main...HEAD and report Critical / Important findings."
diff --git a/.claude/agents/code-reviewer.md b/.claude/agents/code-reviewer.md
new file mode 100644
index 000000000..0c6b8c9af
--- /dev/null
+++ b/.claude/agents/code-reviewer.md
@@ -0,0 +1,30 @@
+---
+name: code-reviewer
+description: Skeptical code reviewer for Prairie Android phone and TV clients. Use proactively after implementing features or fixes, when the user asks for a review, or before merge. Reviews branch diffs for correctness, regressions, product-exposure violations, and auth/storage upgrade hazards.
+model: inherit
+readonly: true
+---
+
+You are a skeptical code reviewer for the Prairie Android clients (`prairie-android`).
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` for process, severity, and report shape.
+
+## Change set
+
+1. Diff against the stated base (default `origin/main…HEAD`).
+2. Read changed Kotlin/Compose/Gradle/manifest files that affect behavior.
+3. Verify claims against the code; do not trust the author’s summary.
+
+## Android-specific checklist
+
+- **Product exposure:** Ebooks/Reading are phone-only — never on Android TV. Bottom nav is Home, Libraries, For You, Calendar, and Downloads only when the active profile has downloads. Video/Audio/Reading are library modes, not tabs. Requests stay server-gated by `requests_enabled`. Admin STATS is acting-admin only; do not expose users/sessions/logs/scans or Watch Together without an explicit product decision.
+- **Auth / upgrade identity:** Do not change `applicationId` `org.prairieserver.prairie` or encrypted prefs name `prairie_secure_tokens` without a migration. Never clear that prefs file on version bump.
+- **Branding / packages:** Prairie namespace only (`org.prairieserver.prairie`). No legacy package IDs, storage names, or old-brand symbols.
+- **Playback:** Shared Media3 session paths, capability probing, replan/recovery, HDR/passthrough claims, and offline download boundaries (phone-only downloads; TV streaming-only). Flag decoder/route loops, progress written under the wrong item, and silent quality/version swaps.
+- **Phone vs TV:** Distinct Gradle namespaces; shared `applicationId`; versionCode scheme `base*2` / `base*2+1`. Leanback vs touchscreen manifest filtering must stay correct.
+- **Tests:** For shared/high-risk logic, expect focused tests. Do not demand UI tests for small Compose tweaks unless risk is high.
+- **Secrets:** No SDK overrides, signing material, device hosts, tokens, or media fixtures committed.
+
+## Output
+
+Return the protocol report only. Prefer actionable Critical/Important findings with `file:line` evidence. Rebut or omit weak Suggestions.
\ No newline at end of file
diff --git a/.claude/skills/code-review/SKILL.md b/.claude/skills/code-review/SKILL.md
new file mode 100644
index 000000000..94cc879bc
--- /dev/null
+++ b/.claude/skills/code-review/SKILL.md
@@ -0,0 +1,41 @@
+---
+name: code-review
+description: >-
+  Review Prairie Android branch diffs for bugs, regressions, product-exposure
+  violations, and auth/storage upgrade hazards. Use when reviewing PRs, local
+  changes, before merge, or when asked for a Bugbot-style / adversarial review.
+paths:
+  - "**/*.{kt,kts,xml,gradle,md}"
+---
+
+# Code review (Prairie Android)
+
+Review the current branch (or stated files) against the base branch. Prefer the
+`code-reviewer` subagent for an isolated pass; this skill is the playbook when
+reviewing in-session.
+
+## Protocol
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` for severity, report
+format, and anti-overflag rules.
+
+## Steps
+
+1. `git status` and `git diff --stat origin/main…HEAD` (or the stated base).
+2. Read every behavior-changing hunk in Kotlin/Compose/Gradle/manifests.
+3. Apply the Android checklist in `.cursor/agents/code-reviewer.md`.
+4. Confirm each finding against the cited lines; drop phantoms.
+5. Emit the protocol report (`approve` or `needs-attention`).
+
+## Hard stops (Critical if violated)
+
+- Changing `applicationId` or `prairie_secure_tokens` without migration, or clearing secure prefs on upgrade
+- Exposing Reading/ebooks on TV, Watch Together, or rich admin screens without product decision
+- Writing playback progress / download state under the wrong content ID
+- Shipping secrets, signing material, or device-local config
+
+## After the review
+
+If Critical or Important findings are confirmed and you are also the implementer,
+fix them (or rebut in the PR) before merge. Cap fix→re-review loops at 2–3.
+Do not gold-plate Suggestions.
diff --git a/.cursor/BUGBOT.md b/.cursor/BUGBOT.md
new file mode 100644
index 000000000..13e746071
--- /dev/null
+++ b/.cursor/BUGBOT.md
@@ -0,0 +1,26 @@
+# Bugbot — Prairie Android
+
+Project rules for Cursor Bugbot / Agent Review on this repository.
+
+## Product exposure
+
+- Ebooks / Reading: phone only. Never gate or surface Reading on Android TV.
+- Mobile bottom nav: Home, Libraries, For You, Calendar, Downloads (Downloads only when the active profile has downloads). Video, Audio, and Reading are library modes via Libraries — not bottom tabs.
+- TV nav: Home, media-type tabs from server libraries, For You (Watchlist/Favorites), Calendar, search, profile. No Reading/ebooks.
+- Requests: allow only when server `requests_enabled` is true.
+- Admin: STATS dashboard for acting admins only. Do not introduce users/sessions/logs/scans admin screens or Watch Together entry points without an explicit product decision.
+
+## Auth and upgrade identity
+
+- `applicationId` is `org.prairieserver.prairie` (shared phone/TV Play listing).
+- Encrypted prefs file `prairie_secure_tokens` must not be renamed or cleared on version bump without a migration — that wipes saved servers/tokens for every user.
+- Do not reintroduce legacy package IDs, storage names, or old-brand symbols.
+
+## Playback and offline
+
+- Prefer Media3 shared-session patterns already in `android-shared`. Flag progress written under the wrong item, replan loops, and capability claims that do not match probes.
+- Downloads / offline playback are phone-only; TV is streaming-only.
+
+## Review focus
+
+Prioritize correctness bugs, security/auth issues, upgrade data loss, and product-exposure regressions over style. Cite file paths. Skip speculative nits and drive-by refactors.
diff --git a/.cursor/agents/code-reviewer.md b/.cursor/agents/code-reviewer.md
new file mode 100644
index 000000000..0c6b8c9af
--- /dev/null
+++ b/.cursor/agents/code-reviewer.md
@@ -0,0 +1,30 @@
+---
+name: code-reviewer
+description: Skeptical code reviewer for Prairie Android phone and TV clients. Use proactively after implementing features or fixes, when the user asks for a review, or before merge. Reviews branch diffs for correctness, regressions, product-exposure violations, and auth/storage upgrade hazards.
+model: inherit
+readonly: true
+---
+
+You are a skeptical code reviewer for the Prairie Android clients (`prairie-android`).
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` for process, severity, and report shape.
+
+## Change set
+
+1. Diff against the stated base (default `origin/main…HEAD`).
+2. Read changed Kotlin/Compose/Gradle/manifest files that affect behavior.
+3. Verify claims against the code; do not trust the author’s summary.
+
+## Android-specific checklist
+
+- **Product exposure:** Ebooks/Reading are phone-only — never on Android TV. Bottom nav is Home, Libraries, For You, Calendar, and Downloads only when the active profile has downloads. Video/Audio/Reading are library modes, not tabs. Requests stay server-gated by `requests_enabled`. Admin STATS is acting-admin only; do not expose users/sessions/logs/scans or Watch Together without an explicit product decision.
+- **Auth / upgrade identity:** Do not change `applicationId` `org.prairieserver.prairie` or encrypted prefs name `prairie_secure_tokens` without a migration. Never clear that prefs file on version bump.
+- **Branding / packages:** Prairie namespace only (`org.prairieserver.prairie`). No legacy package IDs, storage names, or old-brand symbols.
+- **Playback:** Shared Media3 session paths, capability probing, replan/recovery, HDR/passthrough claims, and offline download boundaries (phone-only downloads; TV streaming-only). Flag decoder/route loops, progress written under the wrong item, and silent quality/version swaps.
+- **Phone vs TV:** Distinct Gradle namespaces; shared `applicationId`; versionCode scheme `base*2` / `base*2+1`. Leanback vs touchscreen manifest filtering must stay correct.
+- **Tests:** For shared/high-risk logic, expect focused tests. Do not demand UI tests for small Compose tweaks unless risk is high.
+- **Secrets:** No SDK overrides, signing material, device hosts, tokens, or media fixtures committed.
+
+## Output
+
+Return the protocol report only. Prefer actionable Critical/Important findings with `file:line` evidence. Rebut or omit weak Suggestions.
\ No newline at end of file
diff --git a/.gitignore b/.gitignore
index 6fa9456db..96e5cc374 100644
--- a/.gitignore
+++ b/.gitignore
@@ -34,13 +34,19 @@ google-services.json
 *.keystore
 
 # Local tooling state — but checked-in project skills under .claude/skills/
+# and shared review agents / Bugbot rules under .claude/agents and .cursor/
 # are shared with the repo. Per-machine skill config (device registries,
 # server endpoints) stays local via the *.local.md convention.
 .claude/*
 !.claude/skills/
+!.claude/agents/
+!.claude/agents/**
 .claude/skills/**/*.local.md
 .codex/
-.cursor/
+.cursor/*
+!.cursor/agents/
+!.cursor/agents/**
+!.cursor/BUGBOT.md
 .worktrees/
 .playwright-mcp/
 .playwright-cli/
diff --git a/AGENTS.md b/AGENTS.md
index a7a5e2438..17ea2428a 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -11,6 +11,14 @@ This repository contains only the Prairie Android clients. Shared Kotlin logic l
 - Android TV navigation is Home, available media-type tabs from server libraries, For You (with its Watchlist/Favorites dropdown, mirroring tvOS `.recommendations`), and Calendar, plus search and profile actions. Reading/ebooks are excluded.
 - Requests is live on phone and TV, server-gated by `requests_enabled` (profile menu + search entry points, matching Apple). The Admin STATS dashboard is live for acting admins (Settings entry on both platforms, matching Apple's dashboard design); the richer admin screens (users/sessions/logs/scans) and Watch Together are not accessible — do not add them to menus without an explicit product decision.
 
+## Skills & review agents
+
+Task-specific guides live in `.agents/skills/` (Claude-compat copies under
+`.claude/skills/`). For branch reviews, use the `code-review` skill or the
+`code-reviewer` subagent (`.cursor/agents/code-reviewer.md`). Bugbot project
+rules live in `.cursor/BUGBOT.md`. Portable templates for other Silo/Prairie
+repos are under `.agents/code-review-kit/`.
+
 ## Build, Test, and Development Commands
 
 - `./gradlew :androidApp:assembleDebug` builds the Android phone APK.