Fix SKILL.md limit, audit rules/memory, add framework + network-performance rules, CI checks, and slash commands

[b3sty191]

Summary

This PR has five commits.

1. SKILL.md description was over the 1024-char limit. The frontmatter description was 1185 characters, which failed skill-creator quick_validate.py. It is now under the limit and keeps every trigger keyword. scripts/validate_b3sty_skill.py now enforces the limit. The README was also tidied.

2. Content audit. I audited skills/, memory/, references/server.cfg.example and the packaging docs. Before any fix, a separate skeptic checked each finding against the native references and the FXServer, oxmysql and ox_lib sources. A second review then checked the resulting diff for regressions and contradictions between files.

3. Framework rules and two slash commands.

   • skills/common/frameworks.md covers ESX, QBCore, Qbox, VORP and RSG: player lookup, character IDs, overdraft-safe money handling, items, jobs, lifecycle events, and a minimal server bridge. Each API was checked against the framework's current source.
   • /b3sty-review reviews a resource and reports findings by severity.
   • /b3sty-new-resource scaffolds a resource that follows the rules.
   • Both ship as plugin commands in commands/. A nested SKILL.md would break single-skill upload, and the validator now rejects one.

4. CI checks for Lua examples and native references.

   • scripts/check_lua_examples.py compiles every lua block with Lua 5.4. It first rewrites the CfxLua compound operators and backtick hashes. CI installs lua5.4 and runs it.
   • The validator now requires every native hash and CAPS native name cited in the rules to exist in references/natives/. This check caught one native that does not exist, and the example was fixed.

5. Network performance rules and /b3sty-perf.

   • skills/common/network-performance.md covers:
     • the net event cost model
     • FXServer rate limiters and what each does when exceeded (drop vs kick)
     • latent events: per-target bps and reassembly
     • payload shape
     • snapshot-then-deltas caching
     • picking the smallest audience
     • state bag cost
   • debugging.md now covers netEventLog, netgraph, cl_drawPerf, the developer-mode gate, and server vs network thread hitches. It also corrects an earlier claim: server resmon exists only in the Windows GUI.
   • New CPU hot-path rules: GetGamePool scans, per-frame allocations, GetHashKey in loops, and yielding long server loops.
   • /b3sty-perf runs a performance pass and reports each figure as measured or estimated.
   • These facts were checked against the citizenfx/fivem source and fivem-docs.

Notable corrections (commit 2)

• Security
  • The buy example granted items even when the conditional debit matched 0 rows.
  • explosionEvent compared a string sender with a number.
  • The in-flight lock leaked when a call errored.
  • math.floor(nil) crashed input validation.
  • The server-origin source guard now checks "", not 65535.
  • weaponType is an unsigned hash.
  • Corrected the convar descriptions.
  • Bans now prefer license2.
• Natives
  • BOOL results come back as 1/false.
  • Int-returning hash calls need ResultAsInteger().
  • Float coercion is required for named calls too.
  • Corrected PointerValue* behavior and RDR3 struct packing.
  • Server-side build gates use sv_enforceGameBuild.
• NUI / networking
  • SetNuiFocus(hasFocus, hasCursor).
  • A missing cb makes the NUI request time out.
  • Built-in events that exist only on FiveM are now marked as such.
  • Corrected routing-bucket inheritance.
  • NetworkGetEntityOwner can return -1.
  • Documented the sv_filterRequestControl modes.
• Runtime / database / style
  • ensure vs start.
  • The exports proxy is never nil.
  • Stock require cannot load resource files.
  • oxmysql error semantics.
  • ^= is XOR.
• Memory: onResourceStop flush does not yield, the save-failure path is reachable, and the ammo wrapper is corrected.
• server.cfg.example: secrets are exec'd first, semicolons are removed from comments, and the sv_master1, sv_endpointPrivacy and sv_filterRequestControl 4 notes are corrected.

Verification

• python scripts/validate_b3sty_skill.py passes locally and in CI.
• python scripts/check_lua_examples.py passes all 45 blocks, locally and in CI.
• skill-creator quick_validate.py . reports Skill is valid!.
• The Lua example check covers syntax only. Runtime behavior of the examples, and the slash commands on a real resource, have not been exercised.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VSf2U7JNwmAocuwkaxZQyP