@bovinphang/frontend-craft 2.8.0 → 3.0.0

package/localized/zh-CN/templates/shared/rules/fec-typescript.md

@@ -1,6 +1,6 @@
 # TypeScript / JavaScript 规则
 
-编写、修改或评审 `.ts`、`.tsx`、`.js`、`.jsx` 时应用本文件。本文只保留项目常驻硬约束；复杂类型建模、`tsconfig` 分层、声明产物、DTO / view model 边界、类型测试与发布入口设计，交给 `fec-typescript-project-standard` skill 或专项评审处理。注释风格另见 `fec-code-comments.md`；E2E 与校验流程另见 `fec-testing.md`。
+编写、修改或评审 `.ts`、`.tsx`、`.js`、`.jsx` 时应用本文件。本文只保留项目常驻硬约束；复杂类型建模、`tsconfig` 分层、声明产物、DTO / view model 边界、类型测试与发布入口设计，交给 `cc-typescript-project-standard` skill 或专项评审处理。注释风格另见 `fec-code-comments.md`；E2E 与校验流程另见 `fec-testing.md`。
 
 ## 类型与接口
 
@@ -11,7 +11,7 @@
 - 对**导出**的函数、共享工具函数、公开类方法，写明参数与返回值类型。
 - **局部**变量在类型显而易见时交给 TypeScript 推断，不为显而易见的中间变量重复标注。
 - 重复出现的内联对象形状抽成具名 `interface` 或 `type`，避免同一契约散落在多个签名中。
-- 外部数据、API DTO、路由参数、表单值与组件 props 的边界要显式命名；复杂建模分流到 `fec-typescript-project-standard`。
+- 外部数据、API DTO、路由参数、表单值与组件 props 的边界要显式命名；复杂建模分流到 `cc-typescript-project-standard`。
 
 ### `interface` 与 `type`
 
@@ -37,7 +37,7 @@
 - 用具名 `interface` 或 `type` 定义 props，复杂公共 props 分流到类型模块。
 - 回调 props 写清参数与返回值；事件 payload 不用裸对象长期内联。
 - 无特殊理由不使用 `React.FC`，避免隐式 `children` 等差异。
-- TSX 泛型、复杂组件 props 或外部 DTO 映射问题，交给 React 规则与 `fec-typescript-project-standard` 共同收敛。
+- TSX 泛型、复杂组件 props 或外部 DTO 映射问题，交给 React 规则与 `cc-typescript-project-standard` 共同收敛。
 
 ## 单文件规模与模块拆分
 
@@ -74,7 +74,7 @@
 
 - 外部输入（表单、API、URL 参数、localStorage、postMessage、第三方 SDK 回调等）必须在边界处校验或收窄。
 - 可使用 Zod、Valibot、Yup 或项目选用的同类 schema 工具；不要把具体库作为无条件新依赖引入。
-- schema 推导类型可作为输入类型单一真源；复杂 DTO、领域模型与 UI view model 的分层交给 `fec-typescript-project-standard`。
+- schema 推导类型可作为输入类型单一真源；复杂 DTO、领域模型与 UI view model 的分层交给 `cc-typescript-project-standard`。
 
 ## 类型资产分层与命名
 

package/localized/zh-CN/templates/shared/rules/references/common/source-driven-development.md

@@ -0,0 +1,19 @@
+# 以事实来源驱动开发
+
+使用项目事实、权威资料和对应版本的证据做工程决策。
+
+1. 明确问题、版本和本地契约。先读项目清单、配置、实现、调用方和测试；稳定的本地变换可依赖这些事实，运行时、依赖和公共 API 的变化假设需要权威核验。
+2. 收集实际版本的官方文档、源码、类型定义、发布记录、规范和迁移指南。第三方讨论只作线索。记录路径或链接、版本、日期和相关结论。
+3. 对照运行中的项目说明兼容性、维护成本、迁移范围和回退。通过小的适配边界隔离易变化的外部假设，不为追新直接推翻稳定约定。
+4. 使用项目现有校验或最小复现证明关键假设，按实际技术栈选择工具。记录命令和结果；无法验证时明确不确定性，不宣称支持。
+5. 公共接口、依赖或团队约定改变时同步轻量 ADR、迁移记录或事实文档，不复制大段外部资料。
+
+## 本地知识请求
+
+用户将来源限制在本地仓库或知识目录时，先检索指定来源，不用网络猜测补齐。使用明确路径，否则检查 `knowledge/` 是否存在；不存在则说明缺失来源，不虚构目录。
+
+有 `data_structure.md` 时先读导航并选择相关分支，渐进搜索而不加载全库。默认最多五轮关键词调整；记录文件、章节/页码/工作表、版本范围与证据缺口。PDF 和表格先选择合适提取工具。只有用户范围允许时才使用外部来源。
+
+## 证据优先级与交付
+
+实现、配置和测试确定本地契约；官方版本化文档与源码确定外部行为；规范确定平台约束；Issue 和文章仅作辅助。交付决策、来源、实现影响、验证结果及剩余不确定性，不能只说“已查文档”。

package/openclaw.plugin.json

@@ -2,10 +2,9 @@
     "id": "frontend-craft",
     "name": "Frontend Craft",
     "description": "Frontend team skills, OpenClaw workspace templates, optional init tool, exec safety hooks, and design MCP reference.",
-    "version": "2.8.0",
+    "version": "3.0.0",
     "skills": [
-        "skills",
-        "commands"
+        "skills"
     ],
     "configSchema": {
         "type": "object",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bovinphang/frontend-craft",
-  "version": "2.8.0",
+  "version": "3.0.0",
   "description": "Universal frontend plugin for Claude Code, Codex, Cursor, OpenCode, Gemini CLI, Qoder, Windsurf, Copilot, OpenClaw, and more — skills, agents, commands, hooks, and MCP templates.",
   "type": "module",
   "license": "MIT",
@@ -35,6 +35,7 @@
     "localized",
     "hooks",
     "templates",
+    "common-content.lock.json",
     ".mcp.json",
     ".claude-plugin",
     "openclaw.plugin.json",
@@ -52,35 +53,47 @@
     "docs"
   ],
   "scripts": {
+    "sync:common": "tsx scripts/sync-common.ts",
+    "check:common": "tsx scripts/sync-common.ts --check",
     "clean": "node scripts/clean-dist.mjs",
-    "typecheck": "npm run typecheck:ts && npm run typecheck:skill-scripts",
+    "typecheck": "pnpm run typecheck:ts && pnpm run typecheck:skill-scripts",
     "typecheck:ts": "tsc --noEmit -p tsconfig.json",
-    "typecheck:skill-scripts": "tsc --allowJs --checkJs --noEmit --strict --module NodeNext --moduleResolution NodeNext --target ES2022 skills/fec-ui-design/scripts/design-system.mjs skills/fec-image-generation/scripts/png-qa.mjs skills/fec-image-generation/scripts/tech-diagram-render.mjs skills/fec-image-generation/scripts/interactive-diagram-server.mjs skills/fec-image-generation/scripts/export-diagram.mjs",
-    "build": "npm run clean && npm run typecheck && tsx scripts/build-dist.ts",
-    "test:only": "node --import tsx --test --test-concurrency=1 tests/converters/codex-agents.test.ts tests/install/cli.test.ts tests/install/end-to-end.test.ts tests/install/update.test.ts tests/install/all-runtimes-dry.test.ts tests/install/metadata-consistency.test.ts tests/install/npm-pack.test.ts tests/install/skill-package.test.ts tests/install/ui-design-intelligence.test.ts tests/install/image-generation-skill.test.ts tests/install/drawio-studio-skill.test.ts tests/install/sync-version.test.ts tests/install/claude-cache.test.ts",
-    "test": "npm run build && npm run test:only",
+    "typecheck:skill-scripts": "tsc --allowJs --checkJs --noEmit --strict --module NodeNext --moduleResolution NodeNext --target ES2022 skills/fec-ui-design/scripts/design-system.mjs skills/cc-technical-diagrams/scripts/png-qa.mjs skills/cc-technical-diagrams/scripts/tech-diagram-render.mjs skills/cc-technical-diagrams/scripts/interactive-diagram-server.mjs skills/cc-technical-diagrams/scripts/export-diagram.mjs skills/cc-technical-diagrams/scripts/diagram-layout.mjs skills/cc-technical-diagrams/scripts/diagram-browser.mjs skills/cc-technical-diagrams/scripts/mermaid-render.mjs",
+    "build": "pnpm run clean && pnpm run typecheck && tsx scripts/build-dist.ts",
+    "test:only": "tsx scripts/run-tests.ts",
+    "test": "pnpm run build && pnpm run test:only",
     "build:openclaw:bundle": "tsx scripts/openclaw/build.ts",
-    "build:openclaw": "npm run build && npm run build:openclaw:bundle",
-    "audit:skills": "npm run build && tsx scripts/audit-skills.ts",
+    "build:openclaw": "pnpm run build && pnpm run build:openclaw:bundle",
+    "audit:skills": "pnpm run build && tsx scripts/audit-skills.ts",
     "typecheck:openclaw": "tsc --noEmit -p tsconfig.openclaw.json",
     "check:openclaw-dist": "tsx scripts/openclaw/verify-openclaw-dist.ts",
-    "pack:openclaw": "npm run build:openclaw && npm run check:openclaw-dist && tsx scripts/openclaw/pack-openclaw.ts",
-    "pack:skills": "npm run build && tsx scripts/pack-skills.ts",
-    "check:skills-publish": "npm run build && tsx scripts/check-skills-publish.ts",
-    "pack:all": "npm run build && npm run test:only && npm run build:openclaw:bundle && npm run check:openclaw-dist && tsx scripts/openclaw/pack-openclaw.ts && tsx scripts/pack-skills.ts && tsx scripts/check-skills-publish.ts",
-    "prepack": "npm run build",
+    "pack:openclaw": "pnpm run build:openclaw && pnpm run check:openclaw-dist && tsx scripts/openclaw/pack-openclaw.ts",
+    "pack:skills": "pnpm run build && tsx scripts/pack-skills.ts",
+    "check:skills-publish": "pnpm run build && tsx scripts/check-skills-publish.ts",
+    "pack:all": "pnpm run build && pnpm run test:only && pnpm run build:openclaw:bundle && pnpm run check:openclaw-dist && tsx scripts/openclaw/pack-openclaw.ts && tsx scripts/pack-skills.ts && tsx scripts/check-skills-publish.ts",
+    "prepack": "pnpm run build",
     "sync:version": "tsx scripts/sync-version.ts",
-    "version": "npm run sync:version && git add package.json package-lock.json .claude-plugin/plugin.json .claude-plugin/marketplace.json openclaw.plugin.json skills/metadata.json",
-    "prepublishOnly": "npm run sync:version && npm test"
+    "version": "pnpm run sync:version",
+    "prepublishOnly": "pnpm run sync:version && pnpm test",
+    "check:content": "tsx scripts/check-content.ts",
+    "lint:code": "eslint bin src scripts tests eslint.config.mjs --max-warnings=0",
+    "lint": "pnpm run lint:code && pnpm run check:content",
+    "format:check": "tsx scripts/check-format.ts",
+    "verify:engineering": "tsx scripts/verify-engineering.ts"
   },
   "devDependencies": {
+    "@eslint/js": "9.39.5",
     "@sinclair/typebox": "^0.34.49",
     "@types/node": "^22.19.15",
     "esbuild": "^0.28.0",
+    "eslint": "9.39.4",
+    "globals": "17.12.0",
     "openclaw": "^2026.4.20",
     "prettier": "^3.5.0",
     "tsx": "^4.22.3",
-    "typescript": "^5.7.3"
+    "typescript": "^5.7.3",
+    "typescript-eslint": "8.70.1",
+    "yaml": "2.9.0"
   },
   "keywords": [
     "frontend",
@@ -98,5 +111,9 @@
     "i18n",
     "playwright",
     "eslint"
-  ]
+  ],
+  "packageManager": "pnpm@12.4.1",
+  "dependencies": {
+    "@bovinphang/craft-common": "2.0.0"
+  }
 }

package/skills/cc-c-project-standard/SKILL.md

@@ -0,0 +1,25 @@
+---
+name: cc-c-project-standard
+description: "Use when Pure C module interfaces, ownership contracts, error-code cleanup paths, build conventions or C engineering validation need design or review."
+---
+
+# C project engineering
+
+Apply to libraries, CLI tools, desktop cores and services. Determine the application role from the actual project; a frontend/backend product name does not constrain the language.
+
+Read the existing C standard, compiler flags, build system and exported ABI. Preserve symbol visibility, calling conventions and error codes.
+
+## Apply the workflow
+
+1. Locate the actual project, task boundary and existing contracts; load only the language and domain material needed now.
+2. Apply the [specialist checks](references/practice.md), establishing the input evidence before selecting the smallest change.
+3. Verify affected behavior with existing repository tools. Explicitly report missing tools, environments or execution; a plan is not a passing result.
+4. Deliver scope, specialist decisions, actual verification and remaining risk. A review-only task stays read-only.
+
+## Task boundary
+
+C++ resource abstractions and exceptions are not a replacement for a pure C contract; cross-language memory incidents have a dedicated specialty.
+
+## Engineering practices
+
+Read the [local engineering decisions](references/engineering-practices.md) for this task and follow their links to relevant shared principles. Apply levels and exceptions against actual project contracts; product frontend/backend labels do not constrain language or role.

package/skills/cc-c-project-standard/examples/engineering/README.md

@@ -0,0 +1,7 @@
+# Pure C size and cleanup contract — EP-C-01
+
+In a writable copy compile `cc -std=c11 -Wall -Wextra -Werror boundary.c boundary_test.c -o boundary-test`. Run the executable with CRAFT_ENGINEERING_DEFECTIVE=1 and then =0 (default). POSIX: `CRAFT_ENGINEERING_DEFECTIVE=1 ./boundary-test`; PowerShell sets `$env:CRAFT_ENGINEERING_DEFECTIVE` and invokes the built executable. A missing compiler is MISSING; use the explicitly prepared Docker verifier if needed.
+
+Two named test bodies perform always-active checks, including when NDEBUG is defined. The allocator uses actual malloc/free and records ownership, rejects huge requests, and cleans remaining test allocations. Overflow is checked before allocation; partial second-allocation failure releases the first header; success transfers only the payload. Valid output slots are initialized even on invalid arguments. The defect intentionally omits overflow/partial-cleanup protection. Its unsigned wrap is defined C behavior; no unstable UB crash is needed to observe the error.
+
+C11 is this isolated sample target, not a project upgrade or a demand to use C++. No SAL, external library, parent source or database is required. The case does not prove sanitizer coverage, arbitrary foreign-buffer validity or every ABI/platform; run those checks explicitly when relevant. Keep executable/log output outside the source directory.

package/skills/cc-c-project-standard/examples/engineering/boundary.c

@@ -0,0 +1,26 @@
+#include "boundary.h"
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+
+int build_payload(size_t count, size_t width, const Allocator *allocator,
+                  unsigned char **output, size_t *output_size) {
+  if (output) *output = NULL;
+  if (output_size) *output_size = 0;
+  if (!output || !output_size || !allocator || !allocator->allocate || !allocator->release) return -1;
+  const char *switch_value = getenv("CRAFT_ENGINEERING_DEFECTIVE");
+  const int defective = switch_value && strcmp(switch_value, "1") == 0;
+  if (!count || !width || (!defective && count > SIZE_MAX / width)) return -1;
+  const size_t bytes = count * width; /* Unsigned wrap is defined, but not a valid allocation contract. */
+  void *header = allocator->allocate(allocator->context, 16);
+  if (!header) return -1;
+  unsigned char *payload = allocator->allocate(allocator->context, bytes);
+  if (!payload) {
+    if (!defective) allocator->release(allocator->context, header);
+    return -1;
+  }
+  allocator->release(allocator->context, header);
+  *output = payload;
+  *output_size = bytes;
+  return 0;
+}

package/skills/cc-c-project-standard/examples/engineering/boundary.h

@@ -0,0 +1,15 @@
+#ifndef ENGINEERING_BOUNDARY_H
+#define ENGINEERING_BOUNDARY_H
+#include <stddef.h>
+
+typedef struct {
+  void *context;
+  void *(*allocate)(void *context, size_t bytes);
+  void (*release)(void *context, void *pointer);
+} Allocator;
+
+/* On failure, valid output slots are NULL/0. Success transfers only *output.
+ * Release success output with this same allocator; caller retains input ownership. */
+int build_payload(size_t count, size_t width, const Allocator *allocator,
+                  unsigned char **output, size_t *output_size);
+#endif

package/skills/cc-c-project-standard/examples/engineering/boundary_test.c

@@ -0,0 +1,73 @@
+#include "boundary.h"
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+typedef struct {
+  void *live[8];
+  int calls;
+  int releases;
+  int fail_at;
+} Probe;
+
+static void *allocate(void *context, size_t bytes) {
+  Probe *probe = context;
+  ++probe->calls;
+  if (probe->calls == probe->fail_at || bytes > 1024) return NULL;
+  void *pointer = malloc(bytes ? bytes : 1);
+  for (size_t i = 0; i < 8; ++i) if (!probe->live[i]) { probe->live[i] = pointer; return pointer; }
+  free(pointer);
+  return NULL;
+}
+static void release(void *context, void *pointer) {
+  Probe *probe = context;
+  for (size_t i = 0; i < 8; ++i) if (probe->live[i] == pointer && pointer) {
+    probe->live[i] = NULL; ++probe->releases; free(pointer); return;
+  }
+}
+static int active(const Probe *probe) {
+  int count = 0;
+  for (size_t i = 0; i < 8; ++i) if (probe->live[i]) ++count;
+  return count;
+}
+static void cleanup(Probe *probe) {
+  for (size_t i = 0; i < 8; ++i) if (probe->live[i]) release(probe, probe->live[i]);
+}
+static int check(int condition, const char *message) {
+  if (!condition) fprintf(stderr, "CRAFT_ASSERTION: EP-C-01 %s\n", message);
+  return condition; /* Never compiled away by NDEBUG. */
+}
+static int overflow_and_partial_cleanup(void) {
+  Probe probe = {0};
+  Allocator allocator = { &probe, allocate, release };
+  unsigned char *output = NULL;
+  size_t size = 99;
+  int status = build_payload(SIZE_MAX / 2 + 1, 2, &allocator, &output, &size);
+  int ok = check(status != 0 && output == NULL && size == 0 && probe.calls == 0, "overflow rejected before allocation");
+  cleanup(&probe); /* Keep even the intentionally faulty run free of unobserved survivors. */
+  probe = (Probe){0}; probe.fail_at = 2;
+  status = build_payload(4, 2, &allocator, &output, &size);
+  ok = check(status != 0 && output == NULL && size == 0 && active(&probe) == 0 && probe.releases == 1, "partial failure releases acquired header") && ok;
+  cleanup(&probe);
+  return ok;
+}
+static int valid_input_and_outputs(void) {
+  Probe probe = {0};
+  Allocator allocator = { &probe, allocate, release };
+  unsigned char *output = NULL; size_t size = 0;
+  int status = build_payload(4, 2, &allocator, &output, &size);
+  int ok = check(status == 0 && output != NULL && size == 8 && active(&probe) == 1, "successful transfer exposes one owned payload");
+  if (output) release(&probe, output);
+  ok = check(active(&probe) == 0 && probe.releases == 2, "allocator pair releases all acquired memory") && ok;
+  ok = check(build_payload(4, 2, &allocator, NULL, &size) != 0 && size == 0, "valid output slot initialized on invalid arguments") && ok;
+  cleanup(&probe); return ok;
+}
+int main(void) {
+  int passed = 0, failed = 0;
+  int result = overflow_and_partial_cleanup(); passed += result; failed += !result;
+  printf("CRAFT_TEST {\"name\":\"overflow_and_partial_cleanup\",\"status\":\"%s\"}\n", result ? "pass" : "fail");
+  result = valid_input_and_outputs(); passed += result; failed += !result;
+  printf("CRAFT_TEST {\"name\":\"valid_input_and_outputs\",\"status\":\"%s\"}\n", result ? "pass" : "fail");
+  printf("CRAFT_SUMMARY {\"total\":2,\"passed\":%d,\"failed\":%d,\"skipped\":0}\n", passed, failed);
+  return failed ? 1 : 0;
+}

package/skills/cc-c-project-standard/references/common/engineering-practices.md

@@ -0,0 +1,237 @@
+# Engineering practices
+
+Read project contracts first, then only the relevant core sections and local language/scenario cards. These are project-native decisions informed by the linked primary sources, not certification by those organizations. `required` protects stated correctness/safety contracts; `recommended` is a default with reasoned alternatives; `conditional` activates only when its stated predicate holds. Project safety/compatibility and actual toolchain facts take priority over corporate style.
+
+<a id="ENG-CONTRACT"></a>
+## ENG-CONTRACT — Contracts before representation
+
+Level: required
+
+### Risk
+An accepted input can still violate the caller’s operation or output contract.
+
+### Applies
+Applies at public APIs, files, IPC and serialized input. Internal trusted values can rely on a proven invariant; rechecking everything is not the goal.
+
+### Decision
+Name the caller, accepted values, units, failure/output state and compatibility promise. Validate unknown data once at the boundary before effects; keep protocol mapping outside pure domain logic.
+
+### Exceptions
+If a trusted upstream validator owns the invariant, record its scope instead of adding a second schema. Type assertions and generated types alone provide no runtime guarantee.
+
+### Examples
+Better: reject a malformed amount before charging. Worse: cast JSON and let a partial effect reveal invalid input.
+
+### Verification
+Check invalid, boundary and successful inputs, plus effects/output state; exercise a real packed consumer when shipping a package.
+
+### Sources
+- [Publishing declaration files](https://www.typescriptlang.org/docs/handbook/declaration-files/publishing.html) (typescript-publishing)
+- [Rust API Guidelines](https://rust-lang.github.io/api-guidelines/) (rust-api)
+
+Case evidence IDs: EP-TS-01, EP-SVC-01. Identifiers are not cross-entry file dependencies; consult local examples and the coverage report for execution status.
+
+<a id="ENG-ERROR"></a>
+## ENG-ERROR — Observable failure
+
+Level: required
+
+### Risk
+A fallback can erase the cause or report success after partial work.
+
+### Applies
+Applies when a failure crosses an abstraction or process boundary. Expected absence may use an explicit optional result rather than an exception.
+
+### Decision
+Preserve the cause and operation context, return a typed/declared failure, and let the owning boundary choose recovery. Cleanup failure must not silently replace the primary failure.
+
+### Exceptions
+Translate sensitive internal details into a safe public error while preserving a correlation path in permitted diagnostics. Do not log credentials or raw private payloads.
+
+### Examples
+Better: failure plus original cause and released owned resources. Worse: catch everything and return an empty successful object.
+
+### Verification
+Inject a downstream failure; assert the caller observes failure, its cause and the agreed cleanup outcome.
+
+### Sources
+- [Try-with-resources](https://docs.oracle.com/javase/tutorial/essential/exceptions/tryResourceClose.html) (oracle-resources)
+- [Go Style Guide](https://github.com/uber-go/guide/blob/master/style.md) (uber-go)
+
+Case evidence IDs: EP-RS-01, EP-JAVA-01. Identifiers are not cross-entry file dependencies; consult local examples and the coverage report for execution status.
+
+<a id="ENG-RESOURCE"></a>
+## ENG-RESOURCE — Own the full lifecycle
+
+Level: required
+
+### Risk
+Partial acquisition, borrowed handles and teardown create leaks or double release.
+
+### Applies
+Applies when code acquires files, allocations, tasks, subscriptions or external handles. Pure value transformations need no invented resource manager.
+
+### Decision
+Identify acquire/use/transfer/release owners. Release acquired resources on every exit, in dependency order; borrowed values stay with their owner. Importing a library should not acquire unrelated external resources.
+
+### Exceptions
+A documented transfer or process-lifetime resource needs an explicit recipient or lifetime contract. Finalizers and process exit alone do not prove orderly shutdown.
+
+### Examples
+Better: fail the second allocation and release only the first owned allocation. Worse: free the caller’s borrowed buffer.
+
+### Verification
+Count acquisitions/releases under each failure point and successful transfer. Record untested drivers, GUI shutdown and sanitizer coverage separately.
+
+### Sources
+- [MEM00-C allocation and release](https://cmu-sei.github.io/secure-coding-standards/sei-cert-c-coding-standard/recommendations/memory-management-mem/mem00-c/) (cert-c)
+- [C++ Core Guidelines](https://isocpp.github.io/CppCoreGuidelines/CppCoreGuidelines) (cpp-core)
+
+Case evidence IDs: EP-C-01, EP-CPP-01, EP-PY-01. Identifiers are not cross-entry file dependencies; consult local examples and the coverage report for execution status.
+
+<a id="ENG-CONCURRENCY"></a>
+## ENG-CONCURRENCY — Cancellation and completion differ
+
+Level: conditional
+
+### Risk
+Detached work can outlive owners; an old result may overwrite current state.
+
+### Applies
+Applies if the unit starts concurrent work or receives asynchronous results. Sequential pure code need not gain a scheduler.
+
+### Decision
+Keep completion handles, cancellation ownership and bounded in-flight work. Stop accepting work, request cancellation/drain, then observe termination. Check request identity/liveness before publishing results.
+
+### Exceptions
+Some blocking operations ignore cancellation; expose incomplete shutdown or a caller-owned forced-exit policy. Arc, channel capacity and an abort request are not completion evidence.
+
+### Examples
+Better: controlled B-before-A responses keep B visible. Worse: a timed-out caller frees resources while workers still use them.
+
+### Verification
+Use barriers/events and controlled futures for cancellation, saturation and late results; arbitrary sleeps are not ordering proof.
+
+### Sources
+- [context package](https://pkg.go.dev/context) (go-context)
+- [JoinHandle](https://docs.rs/tokio/latest/tokio/task/struct.JoinHandle.html) (tokio-join)
+- [Coroutines and tasks](https://docs.python.org/3/library/asyncio-task.html) (python-asyncio)
+
+Case evidence IDs: EP-GO-01, EP-IPC-01, EP-UI-01. Identifiers are not cross-entry file dependencies; consult local examples and the coverage report for execution status.
+
+<a id="ENG-BOUNDARY"></a>
+## ENG-BOUNDARY — Trust is established at an actual boundary
+
+Level: required
+
+### Risk
+A frontend/backend label can hide privileged operations or untrusted callers.
+
+### Applies
+Applies to external input, authorization and privilege changes across UI, IPC, library and service roles. A private pure helper is not a new authentication layer.
+
+### Decision
+Verify sender/identity through the actual trusted mechanism, validate operation-specific data and scope permissions. A renderer-provided role or hidden button is not authority.
+
+### Exceptions
+Offline/local-only tools still have a caller and data boundary. Do not add network authentication where the contract needs only a constrained local capability.
+
+### Examples
+Better: expose one validated IPC operation with sender checks. Worse: expose arbitrary filesystem methods to a renderer.
+
+### Verification
+Exercise denied and allowed calls and zero effects after rejection. Native permission activation/signing needs its own actual environment evidence.
+
+### Sources
+- [Security](https://www.electronjs.org/docs/latest/tutorial/security) (electron-security)
+- [Permissions](https://v2.tauri.app/security/permissions/) (tauri-permissions)
+
+Case evidence IDs: EP-TS-01, EP-IPC-01. Identifiers are not cross-entry file dependencies; consult local examples and the coverage report for execution status.
+
+<a id="ENG-DEPENDENCY"></a>
+## ENG-DEPENDENCY — Ship a usable consumer contract
+
+Level: recommended
+
+### Risk
+Working inside a repository can conceal undeclared dependencies or incompatible artifacts.
+
+### Applies
+Applies when publishing, upgrading dependencies or changing exported APIs. A content-only note does not require changing every tool version.
+
+### Decision
+Read manifests, locks, supported targets and exports first. Keep dependencies explicit, changes scoped and migration reversible; validate the artifact from an independent consumer.
+
+### Exceptions
+Adopt a dependency or compiler change only for an evidenced need and compatible policy. A corporate guide’s preferred build system is not such evidence.
+
+### Examples
+Better: declarations resolve with the packed files and declared dependencies. Worse: publish types that only resolve through adjacent source aliases.
+
+### Verification
+Inspect real archive bytes, install away from sibling sources and run supported consumer checks; record the exact version/integrity and untested platforms.
+
+### Sources
+- [Publishing declaration files](https://www.typescriptlang.org/docs/handbook/declaration-files/publishing.html) (typescript-publishing)
+- [Code review standard](https://google.github.io/eng-practices/review/reviewer/standard.html) (google-review)
+
+Case evidence IDs: EP-TS-01. Identifiers are not cross-entry file dependencies; consult local examples and the coverage report for execution status.
+
+<a id="ENG-VERIFICATION"></a>
+## ENG-VERIFICATION — Evidence matches the claimed behavior
+
+Level: required
+
+### Risk
+A green structural check or missing tool can be mistaken for behavioral proof.
+
+### Applies
+Applies to implementation, review and delivery claims. Read-only advice can state proposed checks without pretending execution.
+
+### Decision
+Choose tests by risk and observable boundaries. Separate environment preparation from execution; keep fixed assertions for faulty/fixed variants and report actual commands, counts and limitations.
+
+### Exceptions
+When tools are absent, report MISSING; when intentionally unexecuted, NOT RUN. Compile errors and zero/all-skipped suites do not prove business RED/GREEN.
+
+### Examples
+Better: failure injection breaks a named effect assertion, then the fixed version passes it. Worse: only grep for a PASS string.
+
+### Verification
+Retain raw output, input/tool hashes and scope. Structure, native behavior and model-task decisions are distinct evidence.
+
+### Sources
+- [Test planning](https://microsoft.github.io/code-with-engineering-playbook/automated-testing/test-planning/) (ms-playbook)
+- [Fault injection testing](https://microsoft.github.io/code-with-engineering-playbook/automated-testing/fault-injection-testing/) (ms-faults)
+- [Code review standard](https://google.github.io/eng-practices/review/reviewer/standard.html) (google-review)
+
+Case evidence IDs: EP-TS-01, EP-C-01, EP-SVC-01. Identifiers are not cross-entry file dependencies; consult local examples and the coverage report for execution status.
+
+<a id="ENG-OPERABILITY"></a>
+## ENG-OPERABILITY — Make recovery explicit and bounded
+
+Level: conditional
+
+### Risk
+Partial failure, retry amplification and unsafe diagnostics can worsen an incident.
+
+### Applies
+Applies where this unit owns an external operation, background lifecycle or recovery decision. Libraries should expose signals, not force service dashboards or HTTP layers.
+
+### Decision
+Classify failure and commit uncertainty; make operation intent, total timeout/retry budget and recovery owner explicit. Use a stable idempotency contract for writes before replay. Emit safe correlation and actionable failure state.
+
+### Exceptions
+Without server-side safety, leave a write pending confirmation and offer reconciliation. A timeout/cancel is not proof that no effect occurred; 429/5xx alone do not authorize replay.
+
+### Examples
+Better: repeat the same key/intent and reuse the committed result. Worse: generate a new key after a payment timeout.
+
+### Verification
+Inject failure after commit but before response, replay concurrently and reject a changed intent; separate process-local tests from database or distributed guarantees.
+
+### Sources
+- [Timeouts, retries and backoff with jitter](https://aws.amazon.com/builders-library/timeouts-retries-and-backoff-with-jitter/) (aws-retry)
+- [Making retries safe with idempotent APIs](https://aws.amazon.com/builders-library/making-retries-safe-with-idempotent-APIs/) (aws-idempotency)
+
+Case evidence IDs: EP-SVC-01, EP-UI-01. Identifiers are not cross-entry file dependencies; consult local examples and the coverage report for execution status.