@ericrisco/rsc 1.0.21 → 1.0.23

package/manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.0.21",
+  "version": "1.0.23",
   "counts": {
     "skills": 264
   },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ericrisco/rsc",
-  "version": "1.0.21",
+  "version": "1.0.23",
   "description": "Eric Risco's agent-skills catalog as a granular, self-recommending CLI installer.",
   "type": "module",
   "bin": {

package/scripts/install-apply.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { rmSync, existsSync, cpSync, mkdirSync, readFileSync, writeFileSync, appendFileSync } from 'node:fs';
-import { join, dirname } from 'node:path';
+import { join, dirname, basename } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { planInstall } from './install-plan.js';
 import { targetPaths, writeSkill, wireHook, unwireHook, baseDir, TARGET_IDS } from '../targets/index.js';
-import { targetHasAgents, writeDeveloperAgent, removeDeveloperAgent, developerAgentPath } from '../targets/agents.js';
+import { targetHasAgents, writeAgents, removeAgents, agentPath, agentNames } from '../targets/agents.js';
 import { readState, writeState } from './lib/state.js';
 import { createBackup } from './lib/backups.js';
 
@@ -70,7 +70,7 @@ function managedPathsForInstall({ skillIds, target, home, cwd }) {
   const paths = targetPaths(target, home, cwd);
   const plan = planInstall({ skillIds, target, home, cwd });
   const out = [paths.stateFile, versionFile(cwd), baseVersionsFile(cwd)];
-  if (targetHasAgents(target)) out.push(developerAgentPath(target, cwd), join(cwd, '.rsc', 'developer.json'));
+  if (targetHasAgents(target)) out.push(...agentNames().map((n) => agentPath(target, cwd, n)), join(cwd, '.rsc', 'developer.json'));
   for (const step of plan) {
     if (step.kind === 'skill') {
       out.push(step.to, baseDir(step.id, cwd));
@@ -103,11 +103,18 @@ export async function applyInstall({ skillIds, target, home, cwd = process.cwd()
     }
   }
   writeBaseVersions(cwd, baseVersions);
-  // Install the `developer` subagent for targets that support file-based agents (Claude
-  // Code, Cursor, OpenCode, Gemini, Copilot, Junie, Kiro, Codex). It runs at the balanced
-  // tier by default (never light/Haiku); the tier lives in .rsc/developer.json, set by
-  // `init` at onboarding and honored on every (re)install/sync.
-  if (targetHasAgents(target)) state.agents = writeDeveloperAgent(target, cwd).length ? ['developer'] : [];
+  // Install the catalog's subagents for targets that support file-based agents (Claude
+  // Code, Cursor, OpenCode, Gemini, Copilot, Junie, Kiro, Codex): `developer` plus the three
+  // adversarial refuter lenses `review` dispatches at tier 2. They run at the balanced tier
+  // by default (never light/Haiku); the tier lives in .rsc/developer.json, set by `init` at
+  // onboarding and honored on every (re)install/sync.
+  //
+  // The recorded names come from what was WRITTEN, not from a hardcoded list: a state entry
+  // naming an agent whose file never landed answers "you have it" for something absent.
+  if (targetHasAgents(target)) {
+    const written = writeAgents(target, cwd);
+    state.agents = written.map((f) => basename(f).split('.')[0]);
+  }
   state.version = CLI_VERSION;
   writeState(paths.stateFile, state);
   mkdirSync(dirname(versionFile(cwd)), { recursive: true });
@@ -214,9 +221,12 @@ export async function purge({ home, cwd = process.cwd(), withDocs = false, dryRu
     }
     // unwireHook mutates files, so only run it for real (dry runs skip it).
     if (!dryRun) removed.push(...unwireHook(target, paths));
-    // Remove the installed developer subagent (agent-capable targets only).
-    const agentFile = developerAgentPath(target, cwd);
-    if (agentFile) drop(agentFile);
+    // Remove the subagents this catalog installed — and only those. An uninstaller that takes
+    // an agent the user wrote by hand is worse than one that leaves residue.
+    for (const n of agentNames()) {
+      const agentFile = agentPath(target, cwd, n);
+      if (agentFile) drop(agentFile);
+    }
   }
   drop(join(cwd, '.rsc'), true);
   if (withDocs) drop(join(cwd, '02-DOCS'), true);

package/scripts/lib/capabilities.js

@@ -148,20 +148,39 @@ export function capabilities({ target, home, cwd = process.cwd(), full = false }
 // ONLY — it cannot tell a description from a paraphrase, and it does not pretend to.
 // The rule lives in skills/skill-scout/SKILL.md, where it is held by whoever writes.
 
+// `proposed-capability` added 2026-08-18: none of the original five could express "this needs an
+// executable capability, not a skill", which is the majority of what the repetition detector actually
+// finds. Without it the honest case had to be recorded as one of the other five, and all five would
+// have been false. Additive — the existing five keep validating unchanged.
 export const GAP_VERDICTS = [
   'covered-installed', 'covered-catalog', 'covered-agent',
-  'proposed-accepted', 'proposed-declined',
+  'proposed-accepted', 'proposed-declined', 'proposed-capability',
 ];
 
 export function gapLogPath(cwd = process.cwd()) {
   return join(cwd, '.rsc', 'automation-gaps.md');
 }
 
+/**
+ * The user-level log. A procedure repeated across three projects is STRONGER evidence that it should
+ * stop being manual, not weaker — and the per-repo log makes that pattern invisible by construction
+ * (clarify 2026-08-18). Nothing "wins" when the two disagree: they are summed, de-duplicated by
+ * date+procedure+verdict, so double-writing cannot double-count.
+ */
+export function globalGapLogPath(home = homedir()) {
+  return join(home, '.rsc', 'automation-gaps.md');
+}
+
+/** Repo name as it appears in a log line, so the offer can say WHERE it repeated. */
+export function repoNameOf(cwd = process.cwd()) {
+  return basename(resolve(cwd));
+}
+
 // Any whitespace run collapses, not just \n: a lone \r is a CommonMark line ending,
 // so it would render as an extra (forged, dated) entry while `cat` hid it.
 const oneLine = (s) => String(s || '').replace(/\s+/g, ' ').trim();
 
-export function appendGap({ procedure, verdict, cwd = process.cwd(), now }) {
+export function appendGap({ procedure, verdict, cwd = process.cwd(), now, home = homedir() }) {
   const text = oneLine(procedure);
   if (!text) throw new Error('gap-log: a procedure description is required. Recover: pass --procedure "<what you observed doing>" — your own description of the work, never the user\'s words.');
   if (!GAP_VERDICTS.includes(verdict)) {
@@ -177,6 +196,19 @@ export function appendGap({ procedure, verdict, cwd = process.cwd(), now }) {
   const d = now || new Date();
   const day = `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, '0')}-${String(d.getDate()).padStart(2, '0')}`;
   appendFileSync(p, `${header}- ${day} · ${text} · **${verdict}**\n`);
+
+  // Also record globally, tagged with the repo. Wrapped: a home directory that cannot be written must
+  // never take down the local record, which is the one the current repo depends on.
+  try {
+    const g = globalGapLogPath(home);
+    mkdirSync(dirname(g), { recursive: true });
+    let gHeader = true;
+    try { gHeader = statSync(g).size === 0; } catch { gHeader = true; }
+    const gh = gHeader
+      ? '# Huecos de automatización (global)\n\nAcumulado de todos los repos, para que un procedimiento repetido en varios proyectos sea visible.\nLo escribe `rsc capabilities gap-log`. Cada línea lleva `[repo:<nombre>]`. Fichero local: no lo commitees.\n\n'
+      : '';
+    appendFileSync(g, `${gh}- ${day} · ${text} · [repo:${repoNameOf(cwd)}] · **${verdict}**\n`);
+  } catch { /* the local log is what matters; a global failure is not fatal */ }
   return p;
 }
 

package/scripts/lib/repetition-report.js

@@ -0,0 +1,47 @@
+// repetition-report.js — the I/O half of the repetition detector.
+//
+// Kept apart from repetition.js on purpose: the deciding is pure and heavily tested, the reading of two
+// files is not. Mixing them would make the interesting logic need fixtures on disk.
+
+import { readFileSync, existsSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { gapLogPath, globalGapLogPath, capabilities } from './capabilities.js';
+import { parseGapLog, groupProcedures, decideOffer, mergeLogs, THRESHOLD } from './repetition.js';
+
+/**
+ * Read local + global logs, group, decide. FAILS CLOSED: an unreadable log yields `blocked`, never an
+ * invented count. countGaps() already sets the precedent of not taking `doctor` down over a malformed
+ * log; the difference here is that the degradation is announced instead of swallowed.
+ */
+export function repetitionReport({ cwd = process.cwd(), home = homedir(), target = 'claude' } = {}) {
+  const read = (p, label) => {
+    if (!existsSync(p)) return { entries: [], missing: true };
+    try { return { entries: parseGapLog(readFileSync(p, 'utf8')), missing: false }; }
+    catch (e) { return { error: `no se pudo leer el registro ${label} (${p}): ${e.message}` }; }
+  };
+  const local = read(gapLogPath(cwd), 'local');
+  const global = read(globalGapLogPath(home), 'global');
+  if (local.error || global.error) {
+    return { blocked: true, reason: local.error || global.error, offer: null, uncertain: [], entries: 0 };
+  }
+  const merged = mergeLogs(local.entries, global.entries);
+  if (!merged.length) {
+    return { blocked: false, offer: null, reason: 'no hay entradas registradas todavía', uncertain: [], entries: 0 };
+  }
+  const { groups, uncertain } = groupProcedures(merged);
+
+  // "Already covered" is answered by the command that reads the disk, never by memory — the decision
+  // capabilities.js already made and for the right reason.
+  let covered = false;
+  try {
+    const caps = capabilities({ target, cwd });
+    const top = [...groups].sort((a, b) => b.entries.length - a.entries.length)[0];
+    if (top) {
+      const words = top.key.toLowerCase();
+      covered = caps.installed.some((s) => words.includes(s.id)) || (caps.agents || []).some((a) => words.includes(a.id));
+    }
+  } catch { /* enumeration failing must not fabricate "covered" — leave it false */ }
+
+  const { offer, reason } = decideOffer({ groups, threshold: THRESHOLD, covered });
+  return { blocked: false, offer, reason, uncertain, entries: merged.length, groups: groups.length };
+}

package/scripts/lib/repetition.js

@@ -0,0 +1,186 @@
+// repetition.js — has this procedure been done before, and does it deserve to stop being manual?
+//
+// The always-on rule already asks "did you just deliver a repeatable PROCEDURE?" — a judgment about ONE
+// episode, made by the same agent that just performed it, at the moment it is most convinced its work
+// was special. Grepping the always-on layer for repeat|repetit|twice|recurr returns nothing: nothing
+// looks backwards.
+//
+// The registry that would allow it already exists. `rsc capabilities gap-log` writes one line per
+// observed procedure, and the only thing that consumes it is countGaps(), which returns a TOTAL for
+// `doctor` to display. The ledger is written and nobody interrogates it — the passive form of the same
+// P2 defect.
+//
+// The evidence is the session that wrote this: four manual mutation runs (8, 17, 12, 6 mutants) and
+// five identical score-then-rescore passes, none of which ever triggered the rule, because each episode
+// looked like one-off work on its own.
+//
+// Two decisions from clarify (2026-08-18): the count is GLOBAL with a per-repo breakdown (a procedure
+// repeated across projects is stronger signal, not weaker), and the threshold is THREE — a reasoned
+// bet, not a measurement, and it says so.
+
+import { tokenize } from './text-rank.js';
+
+export const THRESHOLD = 3;
+
+// Numerals and structural filler carry no information about WHICH procedure this is — "eight mutants"
+// and "twelve mutants" are the same work. Dropping them is what made the margin measurable at all.
+const FILLER = /^(uno|dos|tres|cuatro|cinco|seis|siete|ocho|nueve|diez|once|doce|trece|catorce|quince|dieciseis|diecisiet|dieciocho|diecinuev|veint|cada|por|sobr|un|una|one|two|three|four|five|six|seven|eight|nine|ten|each)$/;
+
+// CALIBRATED, NOT GUESSED. Three metrics were measured on real descriptions from the session that
+// motivated this (3 same-procedure pairs, 12 different-procedure pairs):
+//
+//   metric    same            different   margin
+//   jaccard   0.17–0.30       ≤0.09       0.08
+//   overlap   0.29–0.50       ≤0.20       0.09
+//   dice      0.29–0.46       ≤0.17       0.12   ← widest, so this is the one
+//
+// The first version used Jaccard at 0.6 and grouped nothing: the real case came out as four groups of
+// one. Guessing a threshold for a similarity metric is how you ship a detector that never fires.
+//
+// HONEST LIMIT: n=15 pairs from one session. This is calibration, not validation. If it groups wrongly
+// in practice the number moves, and the measurement above is the record of how it was chosen.
+export const GROUP_AT = 0.25;
+// The band where the answer is "maybe": it does NOT group, and it records what it refused to assume.
+// Grouping wrongly inflates the count and fires an offer about something that never repeated — the more
+// expensive of the two mistakes (P7: a system that nags in the harmless 80% gets switched off).
+export const UNCERTAIN_AT = 0.17;
+
+const LOG_LINE = /^- (\d{4}-\d{2}-\d{2}) · (.+?) · \*\*([a-z-]+)\*\*\s*$/;
+const REPO_TAG = /\s*·?\s*\[repo:([^\]]+)\]\s*$/;
+
+/** Parse a gap log. Malformed lines are skipped, not guessed at; the caller decides what silence means. */
+export function parseGapLog(text) {
+  const out = [];
+  const lines = String(text || '').split('\n');
+  for (let i = 0; i < lines.length; i++) {
+    const m = LOG_LINE.exec(lines[i]);
+    if (!m) continue;
+    let procedure = m[2];
+    let repo = null;
+    const tag = REPO_TAG.exec(procedure);
+    if (tag) { repo = tag[1]; procedure = procedure.slice(0, tag.index).trim(); }
+    out.push({ date: m[1], procedure, verdict: m[3], repo, line: i + 1 });
+  }
+  return out;
+}
+
+/** Significant tokens: text-rank's (accent-folded, stopworded, stemmed) minus numerals and filler. */
+export function terms(text) {
+  return new Set(tokenize(String(text || '')).filter((tk) => !FILLER.test(tk)));
+}
+
+/**
+ * Dice coefficient over significant tokens: 2|A∩B| / (|A|+|B|). Not cosine — that weights by IDF over a
+ * corpus and here there are just two sentences. Not Jaccard — measured narrower on real data (see the
+ * table above).
+ */
+export function similarity(a, b) {
+  const A = terms(a);
+  const B = terms(b);
+  if (!A.size || !B.size) return 0;
+  let inter = 0;
+  for (const tk of A) if (B.has(tk)) inter++;
+  return (2 * inter) / (A.size + B.size);
+}
+
+/**
+ * Group entries describing the same procedure. Deterministic: first entry of a group is its key, and a
+ * candidate joins only if it clears GROUP_AT against that key. Anything in the uncertain band is left
+ * ungrouped and recorded, so a human can see what the detector refused to assume.
+ */
+export function groupProcedures(entries, threshold = GROUP_AT) {
+  const groups = [];
+  const uncertain = [];
+  for (const e of entries) {
+    let best = null;
+    let bestScore = 0;
+    for (const g of groups) {
+      const s = similarity(e.procedure, g.key);
+      if (s > bestScore) { bestScore = s; best = g; }
+    }
+    if (best && bestScore >= threshold) {
+      best.entries.push(e);
+      if (e.repo) best.repos.set(e.repo, (best.repos.get(e.repo) || 0) + 1);
+      continue;
+    }
+    if (best && bestScore >= UNCERTAIN_AT) {
+      uncertain.push({ procedure: e.procedure, nearest: best.key, score: Number(bestScore.toFixed(2)) });
+    }
+    groups.push({
+      key: e.procedure,
+      entries: [e],
+      repos: new Map(e.repo ? [[e.repo, 1]] : []),
+    });
+  }
+  return { groups, uncertain };
+}
+
+const CAPABILITY_VERBS = /\b(plantar|plant|correr|ejecutar|run|contar|count|restaurar|restore|medir|measure|extraer|extract|puntuar|score|comparar|compare|generar|generate)\b/i;
+const AGENT_VERBS = /\b(revisar|review|refutar|refute|auditar|audit|verificar|verify|juzgar|judge|a ciegas|blind)\b/i;
+
+/**
+ * Which shape does this procedure want? Order matters: the first match wins, and capability comes
+ * first because it is the majority case observed and the one with no verdict until now. Writing a
+ * paragraph for something that needs a script is the failure the generalization gate already named.
+ */
+export function recommendKind(procedure) {
+  const p = String(procedure || '');
+  if (CAPABILITY_VERBS.test(p)) {
+    return {
+      kind: 'capability',
+      why: 'describe algo que hay que ejecutar y comparar; una skill escribiría un párrafo donde hace falta un script o un hook',
+    };
+  }
+  if (AGENT_VERBS.test(p)) {
+    return {
+      kind: 'agent',
+      why: 'describe mirar o juzgar sin arrastrar el contexto de quien lo pide, que es para lo que sirve un contexto fresco',
+    };
+  }
+  return { kind: 'skill', why: 'describe guía y disciplina sobre lo que ya se está haciendo en la conversación' };
+}
+
+const DECLINED = 'proposed-declined';
+
+/**
+ * Should anything be said? Silence is the default and the common case.
+ *
+ * Never offers when: below threshold, already covered, or previously declined. A "no" that has to be
+ * repeated every week is what makes someone switch the whole harness off.
+ */
+export function decideOffer({ groups, threshold = THRESHOLD, covered = false }) {
+  if (covered) return { offer: null, reason: 'ya cubierto por una skill o agente instalado' };
+  const ranked = [...groups].sort((a, b) => b.entries.length - a.entries.length);
+  for (const g of ranked) {
+    if (g.entries.length < threshold) continue;
+    // A decline anywhere in the group retires it permanently.
+    if (g.entries.some((e) => e.verdict === DECLINED)) continue;
+    const rec = recommendKind(g.key);
+    return {
+      offer: {
+        procedure: g.key,
+        seen: g.entries.length,
+        dates: g.entries.map((e) => e.date),
+        repos: [...g.repos.entries()].map(([repo, n]) => ({ repo, n })),
+        kind: rec.kind,
+        why: rec.why,
+        threshold,
+      },
+      reason: null,
+    };
+  }
+  return { offer: null, reason: `ningún procedimiento alcanza el umbral de ${threshold}` };
+}
+
+/** Merge local + global entries, de-duplicated by date+procedure+verdict, so double-writing cannot double-count. */
+export function mergeLogs(localEntries, globalEntries) {
+  const seen = new Set();
+  const out = [];
+  for (const e of [...localEntries, ...globalEntries]) {
+    const k = `${e.date}|${e.procedure}|${e.verdict}`;
+    if (seen.has(k)) continue;
+    seen.add(k);
+    out.push(e);
+  }
+  return out;
+}

package/scripts/rsc.js

@@ -352,6 +352,26 @@ async function main() {
         } catch (e) { say(e.message); process.exitCode = 1; }
         return;
       }
+      // `capabilities repetition` — read the ledger nobody was interrogating. It lives here and not in
+      // a new command because the enumeration and the writing already live here, and splitting them
+      // across two places is the parallel bookkeeping P3 forbids.
+      if (argv.includes('repetition')) {
+        const root = resolveRoot(process.cwd());
+        const { repetitionReport } = await import('./lib/repetition-report.js');
+        const rep = repetitionReport({ cwd: root });
+        if (argv.includes('--json')) return void say(JSON.stringify(rep, null, 2));
+        if (rep.blocked) { say(`⚠️  ${rep.reason}`); process.exitCode = 1; return; }
+        if (!rep.offer) { say(`# nada que ofrecer — ${rep.reason} (${rep.entries} entradas leídas)`); return; }
+        const o = rep.offer;
+        const where = o.repos.length ? ` · ${o.repos.map((r) => `${r.repo}×${r.n}`).join(', ')}` : '';
+        say(`🔁 «${o.procedure}» visto ${o.seen} veces (${o.dates.join(', ')})${where}`);
+        say(`   → ${o.kind}: ${o.why}`);
+        say(`   registra la decisión con: rsc capabilities gap-log --procedure "..." --verdict proposed-${o.kind === 'capability' ? 'capability' : 'accepted'}|proposed-declined`);
+        if (rep.uncertain.length) {
+          say(`   (${rep.uncertain.length} parecido(s) que NO se agruparon por debajo del umbral — deliberado)`);
+        }
+        return;
+      }
       const full = argv.includes('--full');
       const reports = targets.map((t) => capabilities({ target: t, full }));
       if (argv.includes('--json')) {

package/targets/agents.js

@@ -1,5 +1,10 @@
-// rsc developer agent — installed with the harness for every target that supports
-// file-based subagents with a per-agent model. The agent runs at the `balanced` tier
+// rsc agent registry — the agents installed with the harness for every target that supports
+// file-based subagents with a per-agent model.
+//
+// This file shipped ONE agent with its name, description and body as module constants. Adding a
+// second was therefore not "copy a block": it was turning the file into a registry without breaking
+// the `developer` installs already deployed to users. The registry is the work; the refuters are its
+// first client. See 02-DOCS/wiki/sdd/specs/refuter-agent.md. The agent runs at the `balanced` tier
 // (never `light`/Haiku): Sonnet for Anthropic-backed tools, the provider's mid model
 // elsewhere. The chosen tier (balanced default, or heavy) lives in `.rsc/developer.json`,
 // written by `init` at onboarding and read here so re-syncs honor it.
@@ -33,9 +38,31 @@ const AGENT_TARGETS = {
 export const AGENT_TARGET_IDS = Object.keys(AGENT_TARGETS);
 export function targetHasAgents(target) { return Boolean(AGENT_TARGETS[target]); }
 
-const NAME = 'developer';
-const DESC = 'Implementation worker: turns an approved spec+plan into working, tested code under strict TDD (red->green->refactor), one task at a time. The rsc SDD fan-out/implementation hand.';
-const BODY = `You are the **developer** subagent for this project — the hands of the rsc SDD chain. You execute a planned, approved task into working, tested code. You do NOT design features.
+// The contract every refuter shares, in ONE place. Three lens files each carry the lens inside them
+// (decided in clarify 2026-08-18: a lens passed as a parameter reintroduces the
+// does-anyone-remember dependency this whole spec exists to remove) — but P5 says length is a cost,
+// so the contract they share is composed, not written three times.
+const REFUTER_CONTRACT = `Your mandate is to **refute readiness**, not confirm it. A reviewer looking for confirmation finds confirmation; the asymmetry is the point.
+
+**You get exactly four inputs, and nothing else:**
+1. The task contract — the original request **plus every scope change a human explicitly approved since**. Without the approved changes, a legitimate scope revision reads as a spec gap and you will report a confident false positive.
+2. The approved spec.
+3. The exact source state (commit SHA, or a tree hash when git is absent). A verdict attaches to the state you saw, not to the project.
+4. The entry point — the one command that reruns the checks.
+
+**You do NOT get** the builder's conversation, reasoning, defences, or draft verdict. If a claim needs the builder's justification to stand, it is not proven.
+
+**Blind first, compare second.** Record what you attacked and what you found BEFORE you are shown the builder's conclusions. Only then may you compare and add findings; the blind record is append-only after that, never rewritten. Skip this and your fresh context is spent confirming their framing, which is the one thing it was bought to avoid.
+
+**The attack list is the deliverable, not just the findings.** "Nothing found" without saying where you looked is indistinguishable from not having looked.
+
+**A finding blocks only if it is caused by this change, is severe, and carries evidence** — a repro or a concrete failure scenario. A suspicion without one is a question, and questions do not block. You fix nothing: findings return through the normal loop, and a SPEC gap goes to the human, never to the builder to self-amend.`;
+
+const AGENTS = [
+  {
+    name: 'developer',
+    desc: 'Implementation worker: turns an approved spec+plan into working, tested code under strict TDD (red->green->refactor), one task at a time. The rsc SDD fan-out/implementation hand.',
+    body: `You are the **developer** subagent for this project — the hands of the rsc SDD chain. You execute a planned, approved task into working, tested code. You do NOT design features.
 
 - Work **test-first**: smallest failing test (RED), least code to pass it (GREEN), then refactor on green. A test that never failed proves nothing.
 - One task at a time; keep the diff to that task's scope — no "while I'm here".
@@ -43,7 +70,54 @@ const BODY = `You are the **developer** subagent for this project — the hands
 - If there is no approved spec + plan for non-trivial feature work, STOP and route to \`specify\` — do not write feature code.
 - Log non-obvious decisions to \`02-DOCS/wiki/sdd/decisions.md\`. Report your diff + test output at the end.
 
-Full discipline lives in the \`implement\` skill.`;
+Full discipline lives in the \`implement\` skill.`,
+  },
+  {
+    name: 'refuter-correctness',
+    desc: 'Adversarial reviewer, correctness lens: attacks a green diff for boundary and error-path defects, and demands that any home-grown gate prove it can both fail and pass. Fresh context, mandate to refute.',
+    body: `You are the **correctness** refuter for this project — one of three adversarial lenses ${'`review`'} dispatches at tier 2. What matters is not the number of lenses but their **diversity**: the worst defect this panel ever found was found by the privacy lens, which was not looking for it.
+
+${REFUTER_CONTRACT}
+
+**Your lens — correctness on the boundaries, not the happy path:** off-by-one, null/empty/zero, error paths swallowed, races, the wrong operator, a value that is correct in one function and unchecked in its twin.
+
+**And the lens this panel was missing:** when the change adds or touches a **gate, checker or guard**, ask it in BOTH directions.
+- Can it fail? Feed it a known-bad input and watch it fail. A gate nobody has seen fail is not a gate.
+- **Can it pass?** Feed it a known-good input and watch it pass. Over-blocking is not the safe side — a gate that fires on correct work gets muted, worked around, or wedges the pipeline that depends on it, and it is *harder* to notice because it arrives dressed as diligence.
+- Watch for a check that matches **text** where it should match **structure**: "the path appears in the string" is not "the write targets that location". That exact mistake shipped twice in one day here.`,
+  },
+  {
+    name: 'refuter-security',
+    desc: 'Adversarial reviewer, security and privacy lens: hunts untrusted input reaching a sink, authz gaps, leaked secrets and data escaping where it should not. Fresh context, mandate to refute.',
+    body: `You are the **security and privacy** refuter for this project — one of three adversarial lenses ${'`review`'} dispatches at tier 2. Your value is that you are not looking where the others look: the worst defect this panel ever found was found by this lens, chasing something else entirely.
+
+${REFUTER_CONTRACT}
+
+**Your lens:** untrusted input reaching a sink (injection, SSRF, path traversal), authorization gaps (authenticated is not authorized), secrets in the diff or in config, and **data leaving where it should not** — a log line, an error message, a file written outside its zone, a payload sent to a third party.
+
+**Follow the trail rather than the checklist.** When something looks merely untidy — a file in an odd place, a path that repeats — ask who else cares about that location before dismissing it. That is how this lens found the worst one.`,
+  },
+  {
+    name: 'refuter-tests',
+    desc: 'Adversarial reviewer, tests-as-evidence lens: tries to make the suite pass wrongly, invents mutants the builder did not choose, and checks the spec-to-test mapping in both directions. Fresh context, mandate to refute.',
+    body: `You are the **tests-as-evidence** refuter for this project — one of three adversarial lenses ${'`review`'} dispatches at tier 2.
+
+${REFUTER_CONTRACT}
+
+**Your lens — try to make the suite pass wrongly:** implementation keyed to test inputs, mocks swallowing the logic under test, assertions that cannot fail, coverage that touches lines without asserting anything.
+
+**Invent mutants the builder did not choose.** Their mutant list encodes their blind spots. Watch for tests that pin less than they claim — a boundary pinned in one function and not in its twin, a magnitude left free while its boundary is fixed, an assertion satisfied by a caller that never arrived. **Before reporting a surviving mutant, prove it diverges:** construct a concrete input where mutant and original disagree. A survivor you cannot make disagree is an equivalent mutant, and reporting it sends someone to write a test that asserts non-behaviour.
+
+**Check the mapping both ways:** every acceptance criterion needs a falsification procedure that can be made to fail, and every test should trace to something someone asked for.`,
+  },
+];
+
+// Back-compat: the tier file and its reader are named for `developer` because that is what they
+// configure. The refuters run at the same tier — a deliberate, reversible default: nobody has measured
+// whether a heavier model finds more here, and silently tripling tier-2 cost on an unmeasured hunch is
+// the wrong way to find out.
+const byName = (name) => AGENTS.find((a) => a.name === name);
+export const agentNames = () => AGENTS.map((a) => a.name);
 
 // `.rsc/developer.json` — the chosen tier (balanced default; never light). `init` writes
 // it on the onboarding answer; the installer reads it so every (re)install/sync matches.
@@ -60,39 +134,57 @@ export function writeDeveloperTier(cwd, tier) {
   return t;
 }
 
-function renderMd(spec, model) {
-  const fm = ['---', `name: ${NAME}`, `description: "${DESC}"`, `model: ${model}`];
+function renderMd(spec, model, agent) {
+  const fm = ['---', `name: ${agent.name}`, `description: "${agent.desc}"`, `model: ${model}`];
   if (spec.mode) fm.push(`mode: ${spec.mode}`);
   fm.push('---', '');
-  return `${fm.join('\n')}${BODY}\n`;
+  return `${fm.join('\n')}${agent.body}\n`;
 }
-const renderJson = (model) => `${JSON.stringify({ name: NAME, description: DESC, model, prompt: BODY }, null, 2)}\n`;
-function renderToml(model) {
+const renderJson = (model, agent) => `${JSON.stringify({ name: agent.name, description: agent.desc, model, prompt: agent.body }, null, 2)}\n`;
+function renderToml(model, agent) {
   const esc = (s) => s.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
   // body as a TOML multiline LITERAL string ('''…''') — no escape processing.
-  return `name = "${NAME}"\ndescription = "${esc(DESC)}"\nmodel = "${model}"\ndeveloper_instructions = '''\n${BODY}\n'''\n`;
+  return `name = "${agent.name}"\ndescription = "${esc(agent.desc)}"\nmodel = "${model}"\ndeveloper_instructions = '''\n${agent.body}\n'''\n`;
 }
 
-export function developerAgentPath(target, cwd) {
+export function agentPath(target, cwd, name = 'developer') {
   const spec = AGENT_TARGETS[target];
-  return spec ? join(cwd, ...spec.dir.split('/'), `${NAME}${spec.ext}`) : null;
+  return spec ? join(cwd, ...spec.dir.split('/'), `${name}${spec.ext}`) : null;
 }
 
-export function writeDeveloperAgent(target, cwd, tier = readDeveloperTier(cwd)) {
+export function writeAgents(target, cwd, tier = readDeveloperTier(cwd)) {
   const spec = AGENT_TARGETS[target];
   if (!spec) return [];
   const model = spec.model(tier);
-  const content = spec.format === 'json' ? renderJson(model)
-    : spec.format === 'toml' ? renderToml(model)
-      : renderMd(spec, model);
-  const path = developerAgentPath(target, cwd);
-  mkdirSync(dirname(path), { recursive: true });
-  writeFileSync(path, content);
-  return [path];
+  const written = [];
+  for (const agent of AGENTS) {
+    const content = spec.format === 'json' ? renderJson(model, agent)
+      : spec.format === 'toml' ? renderToml(model, agent)
+        : renderMd(spec, model, agent);
+    const path = agentPath(target, cwd, agent.name);
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, content);
+    written.push(path);
+  }
+  return written;
 }
 
-export function removeDeveloperAgent(target, cwd) {
-  const path = developerAgentPath(target, cwd);
-  if (path && existsSync(path)) { rmSync(path, { force: true }); return [path]; }
-  return [];
+/**
+ * Remove only the agents this catalog ships. An uninstaller that takes an agent the user wrote by hand
+ * is worse than one that leaves residue.
+ */
+export function removeAgents(target, cwd) {
+  const removed = [];
+  for (const agent of AGENTS) {
+    const path = agentPath(target, cwd, agent.name);
+    if (path && existsSync(path)) { rmSync(path, { force: true }); removed.push(path); }
+  }
+  return removed;
 }
+
+// ── back-compat aliases. Kept because `developer` is already installed in user repos and in
+// capabilities.js's spec derivation; renaming their imports is not worth breaking a deployed install.
+export const developerAgentPath = (target, cwd) => agentPath(target, cwd, 'developer');
+export const writeDeveloperAgent = (target, cwd, tier = readDeveloperTier(cwd)) => writeAgents(target, cwd, tier);
+export const removeDeveloperAgent = (target, cwd) => removeAgents(target, cwd);
+export { byName as agentByName };