docs: Added documentation on the new transactional-integrity skill

Agents.md

@@ -850,15 +850,22 @@ Coyote comes packaged with some useful built-in agents:
    worktree-based parallel task execution.
 * `coder`: An agent to assist you with all your coding tasks
 * `code-reviewer`: A [CodeRabbit](https://coderabbit.ai)-style code reviewer that spawns per-file reviewers using the 
-   teammate messaging pattern
+   teammate messaging pattern and synthesizes their findings into a severity-tagged report. Includes an optional
+   operational-history lane (via the `incident-prior-art` skill): git archaeology on guards the diff deletes or
+   weakens, plus, when the `prior_art_agent` variable names an incident-historian agent, a sweep of your incident
+   record for past outages the change risks reintroducing.
 * `demo`: An example agent to use for reference when learning to create your own agents
 * `deep-research`: A graph-based agent designed to perform deep web research 
 * `explore`: An agent designed to help you explore and understand your codebase
-* `file-reviewer`: An agent designed to perform code-review on a single file (used by the `code-reviewer` agent)
+* `file-reviewer`: An agent designed to perform code-review on a single file (used by the `code-reviewer` agent).
+   Reviews with the `code-review` and `ai-slop-remover` skills, and additionally loads the `transactional-integrity`
+   skill when the diff touches state-changing code (e.g. DB writes, transactions, queue/webhook/job handlers, retries, or
+   external side effects, etc.) to catch atomicity gaps, read-modify-write races, non-idempotent handlers of at-least-once
+   inputs, and dual-writes with no reconciliation.
 * `gatekeeper`: A plan self-containedness gate (via the `plan-gatekeeping` skill). Audits a plan against
-   the "sealed container" standard — every question a context-free implementer will hit is either answered
+   the "sealed container" standard, meaning every question a context-free implementer will hit is either answered
    inline or delegated via a VERIFIED pointer to the exact code/docs that answer it (where infra code goes,
-   what DB tech, which layout to mirror, exact test commands) — and returns a blocking
+   what DB tech, which layout to mirror, exact test commands), and returns a blocking
    `PLAN_GATE: SEALED`/`LEAKY` verdict with the missing questions. The pre-implementation context
    counterpart to `plan-review` (executability) and `adversary` (post-implementation conformance).
    Designed to be delegated to by `architect`.
@@ -868,11 +875,18 @@ Coyote comes packaged with some useful built-in agents:
 * `oracle`: An agent for high-level architecture, design decisions, complex debugging, and reviewing implementation 
    plans before execution (via the `plan-review` skill, returning a `PLAN_REVIEW: OKAY`/`REJECT` verdict)
 * `report-writer`: An agent to polish research findings into clear, citation-preserving final reports
+* `security-reviewer`: A security analyst for code changes (via the `security-review` skill). Traces untrusted data
+   from sources to dangerous sinks (injection, committed secrets, authn/authz gaps, path traversal, SSRF, unsafe
+   deserialization, supply chain), then returns a posture-gated `SECURITY_REVIEW: PASS`/`FAIL` verdict. The
+   `security_posture` variable (`prototype`/`standard`/`hardened`) sets the blocking threshold so POCs aren't held to
+   production strictness, while Critical findings (leaked credentials, host-endangering code) block in every posture.
+   Designed to be delegated to by `sisyphus` alongside `code-reviewer` and `adversary`.
 * `sisyphus`: A powerhouse orchestrator agent for writing complex code and acting as a natural language interface for 
    your codebase (similar to ClaudeCode, Gemini CLI, Codex, or OpenCode). Uses sub-agent spawning to delegate to 
-   `explore`, `librarian`, `coder`, `oracle`, `code-reviewer`, `adversary`, and `step-runner`. On non-trivial work it 
-   runs two complementary independent review passes — `code-reviewer` for code quality and `adversary` for plan 
-   conformance. Also supports plan-driven workflows: authoring phased implementation plans (via the `plan-authoring` 
+   `explore`, `librarian`, `coder`, `oracle`, `code-reviewer`, `adversary`, `security-reviewer`, and `step-runner`. On 
+   non-trivial work it runs three complementary independent review passes: `code-reviewer` for code quality, 
+   `adversary` for plan conformance, and `security-reviewer` for exploitability when the change touches attack 
+   surface. Also supports plan-driven workflows: authoring phased implementation plans (via the `plan-authoring` 
    skill), having `oracle` review them, and executing them one reviewed step at a time.
 * `sql`: A universal SQL agent that enables you to talk to any relational database in natural language
 * `step-runner`: A graph-based agent that executes ONE step of a phased implementation plan (a `plans/` repo authored 

Skills.md

@@ -11,7 +11,8 @@ their declared MCP servers get acquired automatically.
 
 Common uses:
 
-- **Methodology overlays** ("how to do git surgery", "how to review code").
+- **Methodology overlays** ("how to do git surgery", "how to review code", "how to review state-changing code for
+  transactional integrity"; see the bundled `transactional-integrity` skill).
 - **Toolkit unlocks** that grant a small bundle of tools or MCP servers without changing the active role.
 - **One-shot helpers** that auto-unload after the model finishes a task (see [auto_unload](#auto-unload)).