@event4u/agent-config 8.7.0 → 8.8.0

package/dist/agent-src/rules/senior-engineering-discipline.md

@@ -0,0 +1,82 @@
+---
+type: "auto"
+tier: "2b"
+alwaysApply: false
+description: "Writing/generating code — generalize (no overfit or tautological tests), supply the invisible cross-cutting controls the prompt didn't name, never invent an API/field/package"
+triggers:
+  - intent: "writing or generating code"
+  - intent: "implementing a feature"
+  - keyword: "implement"
+  - keyword: "endpoint"
+  - keyword: "query"
+  - keyword: "migration"
+  - keyword: "component"
+  - keyword: "seeder"
+  - keyword: "dependency"
+  - keyword: "refactor"
+routes_to:
+  - "skill:ai-code-blindspots"
+  - "skill:frontend-render-security"
+  - "skill:supply-chain-intake"
+  - "skill:testing-anti-patterns"
+workspaces: [engineering]
+packs: [engineering-base]
+---
+
+# Senior Engineering Discipline
+
+Dominant failure mode of AI-written code isn't ignorance — **omission**. Model writes happy-path code satisfying the literal task + passing shallow tests, silently drops the invisible cross-cutting controls a senior supplies from unstated context. Baseline (2025 studies): a large share of AI-generated code ships a known vulnerability even at high syntax-correctness, and automation bias makes devs trust it *more* while it's *less* safe. Write like a senior: general not overfit; invisible controls present; verified against real sources, not memory. Act like a senior **owner**, not a passive typist — work in the interest of the product, the user, and the company, especially on security and quality; see a problem → react (fix it if small and task-aligned, else ask — per [`active-remediation`](active-remediation.md)) — never look away.
+
+## The Iron Law
+
+```
+CODE AND TESTS EXPRESS THE GENERAL RULE — NEVER OVERFIT TO A FIXED CASE.
+SUPPLY THE INVISIBLE CROSS-CUTTING CONTROLS THE PROMPT DID NOT NAME.
+NEVER INVENT AN API, FIELD, OR PACKAGE — VERIFY IT AGAINST A REAL SOURCE.
+THE HAPPY PATH THAT PASSES ONE TEST IS NOT A FINISHED CHANGE.
+```
+
+## Three obligations, every time you write code
+
+### 1. Generalize — never overfit
+
+- Implementation expresses the general rule, not a special case that happens to satisfy the example. Don't hardcode a derivable value; don't branch on one literal where a rule covers all inputs; don't paste a near-duplicate where an existing abstraction fits.
+- Tests assert **general behavior**, never a fixed value or narrow regex passing only for one crafted input. Derive expected from inputs + seeded/random data — never hardcode what the code emits. Cover happy **and** boundary (empty / null / max / Unicode) **and** error **and**, on security paths, an abuse case. Lone happy-path assertion = tautology. → `skill:testing-anti-patterns`.
+
+### 2. Cover the invisible controls for what you touched
+
+Before done, assert the unmentioned cross-cutting control is present, matched to surface:
+
+- **endpoint / route** → authorization + tenant scope + input validation + rate limit; state-changing → CSRF + audit. (`security-sensitive-stop` gates the sensitive ones.)
+- **database query / migration** → parameterized (never string-built), tenant-scoped, transaction around multi-step writes, reversible migration (expand-contract, never bare `DROP`), index on filtered / FK columns.
+- **user-controlled render** → output-encode; never `dangerouslySetInnerHTML` / `v-html` / `innerHTML` / `eval` on non-constant input; no secret / token in client code. → `skill:frontend-render-security`.
+- **file / outbound fetch** → path-confinement + SSRF allow-list; validate server-side, never client-only.
+- **infra / IaC** → least-privilege (no `Action:*` / `Resource:*`), encryption at rest, no `0.0.0.0/0` to mgmt / DB ports, no hardcoded creds; real scanner (Checkov / Trivy) is the backstop — `plan` succeeding isn't.
+- **new dependency** → verify it exists on the real registry before install (hallucinated / "slopsquatted" packages ~1 in 5 AI suggestions); pin + lockfile; CVE scan. → `skill:supply-chain-intake`.
+
+Full surface→controls table + backstop greps: → `skill:ai-code-blindspots`.
+
+### 3. Verify — never assert from memory
+
+No completion claim without exercising the real path (running endpoint / UI / test — not "the code looks right"). "Defined but not wired" (middleware written, never connected to the route) = **not done**. → `verify-before-complete`, `source-discovery-gate`.
+
+## When it fires
+
+Any turn that writes, generates, or modifies code — feature, endpoint, query, migration, component, test, seeder, dependency, infra resource.
+
+## When NOT to fire
+
+- Prose / docs / config-only edits, no code behavior.
+- One-line rename / typo / formatting.
+- User fenced the scope ("just this one line", "skip the checks").
+
+## Relationship to existing rules
+
+Cross-cutting **anchor**; depth lives elsewhere and this routes to it. Doesn't replace `security-sensitive-stop` (threat-model before editing auth / billing / tenant / secret paths), `minimal-safe-diff` (smallest change), `think-before-action` (analyze first), `downstream-changes` (update all callers), `output-discipline` (no placeholder / TODO code). When one fires it wins on its subject; this adds the "generalized + invisible controls?" gate on top.
+
+## See also
+
+- [`ai-code-blindspots`](../skills/ai-code-blindspots/SKILL.md) — surface→controls checklist + backstop greps.
+- [`frontend-render-security`](../skills/frontend-render-security/SKILL.md), [`supply-chain-intake`](../skills/supply-chain-intake/SKILL.md) — the two precision gaps.
+- [`testing-anti-patterns`](../skills/testing-anti-patterns/SKILL.md) — overfit / tautological assertions + test-data realism.
+- [`security-sensitive-stop`](security-sensitive-stop.md), [`engineering-safety-floor`](engineering-safety-floor.md), [`verify-before-complete`](verify-before-complete.md), [`source-discovery-gate`](source-discovery-gate.md).

package/dist/agent-src/skills/ai-code-blindspots/SKILL.md

@@ -0,0 +1,105 @@
+---
+model_tier: medium
+name: ai-code-blindspots
+description: "Before finishing any code (endpoint, query, migration, render, file, infra, dependency, test) — the senior pre-ship checklist of invisible cross-cutting controls AI omits, with backstop greps"
+domain: quality
+workspaces:
+  - engineering
+packs:
+  - engineering-base
+---
+
+# ai-code-blindspots
+
+AI writes the code the prompt literally asked for and stops. The controls a senior adds from unstated context — authorization, tenant scope, validation, transactions, encryption, rate limiting, output encoding, error handling, edge cases, package existence — are *invisible* to a single-file prompt, so they're the first thing dropped. They're also the classes pattern-linters miss. This skill is the pre-ship checklist: for the surface you wrote, assert the matching control is present, run the backstop grep, route to the deep skill when it needs more than a check.
+
+A **routing + verification** layer — doesn't re-teach what the deep skills own. The "did I supply the invisible controls?" gate `senior-engineering-discipline` points at.
+
+## When to use
+
+- You wrote (or are finishing) an endpoint, query, migration, UI render, file/network op, infra resource, dependency change, or test — before calling it done.
+- Reviewing an AI-authored diff, asking "what did it silently omit?".
+- The `senior-engineering-discipline` rule fired and routed here.
+
+Do NOT use when: change is prose/docs/config-only, or a one-line rename — no code surface to check.
+
+## The Iron Law
+
+```
+FOR EVERY SURFACE YOU TOUCHED, NAME THE INVISIBLE CONTROL AND CONFIRM IT IS PRESENT.
+"NOT MENTIONED IN THE PROMPT" IS EXACTLY WHY IT IS MISSING — CHECK IT ANYWAY.
+A CONTROL DEFINED BUT NOT WIRED IS ABSENT. A grep IS CHEAPER THAN A BREACH.
+```
+
+## Procedure
+
+1. List the surfaces this change touched (endpoint, query, migration, render, file/fetch, infra, dependency, test).
+2. For each surface, take its row below: assert every listed invisible control is present (with file:line), and run the matching backstop grep.
+3. For anything a grep flags or a check can't confirm, open the routed deep skill.
+4. Emit the per-surface confirmation (Output format); surface any unresolved gap to the user — never silently omit.
+
+## Surface → invisible controls → backstop
+
+Run the row(s) for what you touched. The grep is a fast authoring-time backstop (not a substitute for reading the code); zero results = pass, a hit = look.
+
+| Surface you wrote | Invisible controls to assert | Deep skill |
+|---|---|---|
+| **HTTP endpoint / route** | authorization (this principal may act on this resource — not just authenticated); tenant scope; **the three negative tests** (unauth→401, non-owner→403/404, cross-tenant→403/404); boundary input validation; rate limit actually wired; state-changing → CSRF + audit | `broken-access-control`, `authz-review`, `threat-modeling` |
+| **DB query / ORM** | parameterized, never string-built; tenant predicate present; no `SELECT *` across a serialization boundary; N+1 avoided (eager load) | `source-discovery`, `security` |
+| **Migration** | reversible (`down`); expand-contract for drop/rename (never a bare `DROP COLUMN` before code stops reading it); transaction; index on new FK/filter column | `engineering-safety-floor`, `migration-architect` |
+| **User-controlled render (FE)** | output-encoded; no `dangerouslySetInnerHTML`/`v-html`/`innerHTML`/`eval` on non-constant input; no secret/token in client code; token not in `localStorage` | `frontend-render-security` |
+| **File / outbound fetch** | path confined to an allowed base; SSRF allow-list + private-IP block on user-supplied URLs; size limit; server-side validation (never client-only) | `security`, `defense-in-depth` |
+| **Infra / IaC** | least-privilege (no `Action:*`/`Resource:*`); encryption at rest; no `0.0.0.0/0` to mgmt/DB ports; no hardcoded creds; scanner-verified, not `plan`-verified | `engineering-safety-floor`, `terraform`, `secrets-management` |
+| **New dependency** | exists on the real registry (not hallucinated); not typo-adjacent to a popular one; pinned + lockfile committed; CVE-scanned | `supply-chain-intake`, `dependency-upgrade` |
+| **Secrets/credentials** | never a literal in source; env / secret-manager reference; password columns use bcrypt/argon2, never MD5/SHA | `secrets-management`, `domain-safety-pii` |
+| **Test** | asserts general behavior; expected derived from inputs/seeded data, not hardcoded; boundary + error + abuse cases, not only happy path | `testing-anti-patterns`, `test-driven-development` |
+
+### Backstop greps (authoring-time, cross-stack)
+
+```bash
+# Frontend insecure render / client secrets (React + Vue + vanilla)
+rg -n 'dangerouslySetInnerHTML|v-html|\.innerHTML\s*=|\beval\(|new Function\('
+rg -n 'NEXT_PUBLIC_.*(SECRET|KEY|TOKEN)|VITE_.*(SECRET|KEY)|localStorage\.setItem\([^)]*[Tt]oken'
+# String-built SQL (concatenation / interpolation into a query)
+rg -n 'query\(.*(\+|\$\{|`).*\)|(SELECT|INSERT|UPDATE|DELETE).*(\+|\$\{)'
+# Hardcoded secrets / weak hashing
+rg -n 'AKIA[0-9A-Z]{16}|sk_live_|AIza[0-9A-Za-z_\-]{35}|password\s*=\s*["\x27]|md5\(|sha1\(' .
+# Infra: wildcard IAM / open ingress / disabled TLS
+rg -n '"Action"\s*:\s*"\*"|"Resource"\s*:\s*"\*"|0\.0\.0\.0/0|InsecureSkipVerify|verify=false|curl.*\| *bash' .
+```
+
+The greps name several ecosystems side by side on purpose: keep the ones for the stack in front of you; a hit means read that line, not auto-fix.
+
+## Output format
+
+1. A one-line per-surface confirmation for the change, e.g. `endpoint: authz ✓ tenant-scope ✓ rate-limit wired ✓ validation ✓`, naming file:line where each control lives (or `n/a — <reason>`).
+2. The backstop grep(s) run for the touched surface(s), with result (zero hits, or the hit + how resolved).
+3. For any control genuinely out of scope, an explicit note saying so — never a silent omission.
+
+## Gotcha
+
+- **Defined-but-not-wired** is the signature AI failure: rate-limit middleware or CSRF guard is *written* but never attached to the route. Check is "wired on THIS path?", not "exists somewhere?".
+- **Semantically-valid-but-ignored**: an IaC attribute the provider silently ignores (a made-up `encrypted = true` on a resource that doesn't support it) *reads* as a present control but does nothing — a scanner catches it, a code read doesn't.
+- A green grep is necessary, not sufficient — proves the obvious anti-pattern absent, not that the control is correct. Read the seam for anything security-sensitive.
+- Routes; doesn't replace the deep skill. For auth/billing/tenant/secret paths, `security-sensitive-stop` still requires a threat pass *before* editing.
+
+## Do NOT
+
+- Do NOT treat "the prompt didn't ask for it" as a reason to omit a control — that's the exact blind spot.
+- Do NOT mark a change done on a green happy-path test alone.
+- Do NOT auto-rewrite a grep hit without reading it — some are intentional and belong in an allow-list with a reason.
+- Do NOT duplicate the deep skills here — route to them.
+
+## Auto-trigger keywords
+
+- invisible controls
+- ai code blindspots
+- pre-ship checklist
+- what did the AI omit
+- cross-cutting controls
+
+## See also
+
+- [`senior-engineering-discipline`](../../rules/senior-engineering-discipline.md) — the anchor rule that routes here.
+- [`frontend-render-security`](../frontend-render-security/SKILL.md), [`supply-chain-intake`](../supply-chain-intake/SKILL.md), [`testing-anti-patterns`](../testing-anti-patterns/SKILL.md).
+- [`authz-review`](../authz-review/SKILL.md), [`threat-modeling`](../threat-modeling/SKILL.md), [`defense-in-depth`](../defense-in-depth/SKILL.md), [`source-discovery`](../source-discovery/SKILL.md), [`secrets-management`](../secrets-management/SKILL.md).

package/dist/agent-src/skills/ai-code-blindspots/evals/triggers.json

@@ -0,0 +1,52 @@
+{
+    "skill": "ai-code-blindspots",
+    "last_eval": "2026-07-09",
+    "description": "5 should-trigger + 5 should-not-trigger queries. Should-trigger covers DE + EN phrasings for the pre-ship 'what invisible cross-cutting controls did the AI omit?' checklist across code surfaces. Should-not-trigger covers near-miss neighbours (deep single-surface skills, prose/docs edits, adversarial config review) whose vocabulary overlaps.",
+    "queries": [
+        {
+            "q": "I just wrote this endpoint — what invisible controls did I forget before I call it done?",
+            "trigger": true
+        },
+        {
+            "q": "run the senior pre-ship checklist over this diff for cross-cutting controls",
+            "trigger": true
+        },
+        {
+            "q": "what does AI-generated code usually omit here — authz, tenant scope, validation?",
+            "trigger": true
+        },
+        {
+            "q": "prüf meinen Code auf die unsichtbaren Kontrollen, die die KI weglässt",
+            "trigger": true
+        },
+        {
+            "q": "before I finish this migration and query, what am I blind to?",
+            "trigger": true
+        },
+        {
+            "q": "review this React component specifically for XSS and client secrets",
+            "trigger": false,
+            "note": "single frontend surface → frontend-render-security"
+        },
+        {
+            "q": "is this npm package safe to add?",
+            "trigger": false,
+            "note": "dependency intake → supply-chain-intake"
+        },
+        {
+            "q": "threat-model this new payments endpoint before I build it",
+            "trigger": false,
+            "note": "pre-build threat model → threat-modeling / security-sensitive-stop"
+        },
+        {
+            "q": "fix the typo in this README",
+            "trigger": false,
+            "note": "prose/docs edit — no code surface"
+        },
+        {
+            "q": "red-team my agent's CLAUDE.md and MCP config",
+            "trigger": false,
+            "note": "agent-config adversarial review → agent-security-review"
+        }
+    ]
+}

package/dist/agent-src/skills/authz-review/SKILL.md

@@ -48,8 +48,10 @@ Do NOT use when:
   [`security-audit`](../security-audit/SKILL.md)
 * The concern is a diff ready for review — route to
   [`judge-security-auditor`](../judge-security-auditor/SKILL.md)
-* The concern is response/log leakage rather than access gating — route to
-  [`data-exposure-review`](../data-exposure-review/SKILL.md)
+* The concern is PII leakage into logs specifically — route to
+  [`data-flow-mapper`](../data-flow-mapper/SKILL.md). (Role-based field-level
+  output filtering IS access gating — it stays in scope here + the vertical-BOPLA
+  section of [`broken-access-control`](../../rules/broken-access-control.md).)
 * The concern is implementing a control once identified — route to
   [`security`](../security/SKILL.md)
 
@@ -71,8 +73,8 @@ For every entrypoint, analyze the authorization chain and record what you find:
 | Authentication gate | Is login enforced? By which middleware / guard? |
 | Authorization layer | Which policy, gate, voter, or check? Which action/ability? |
 | Data scope | Does the query filter by current user / tenant / owner? |
-| Response filter | Are sensitive fields stripped (resource/serializer/DTO)? |
-| Tests | Is there a negative test (other-tenant / lower-role returns 403/404)? |
+| Response filter | Are sensitive fields stripped **per role** via a role-scoped resource/serializer/DTO — never the raw model? (a driver role must not receive `price`) |
+| Tests | Are the three negative tests present — unauthenticated → 401, non-owner → 403/404, cross-tenant → 403/404 (404 hides existence)? |
 
 Record **what is there**, not what should be there. Use file:line citations.
 
@@ -160,6 +162,17 @@ Runtime confirmation (e.g. *"reproduce the cross-tenant read against staging"*,
   authorization. Still need the policy + scope.
 * **Generic advice without file:line** — reject your own finding if you cannot
   cite the exact location.
+* **The three negative tests are the security boundary.** Every protected
+  entrypoint needs unauthenticated → 401, authenticated-non-owner → 403/404,
+  and cross-tenant → 403/404. A happy-path 200 test proves nothing about access
+  control (this is BOLA / IDOR — OWASP API #1). Untested authz is also a
+  direct GDPR Art. 32 gap. See [`broken-access-control`](../../rules/broken-access-control.md).
+* **Defense-in-depth so one miss can't leak** — stack ≥2 layers on sensitive
+  data: query-level ownership scoping (base scope injects the predicate) + a
+  centralized default-deny policy layer (a route with no declared policy is
+  denied, not silently open) + DB row-level security (Postgres RLS `FORCE ROW
+  LEVEL SECURITY`, tenant var via `SET LOCAL`) as the backstop for a forgotten
+  `WHERE tenant_id`. A single layer is not enough.
 
 ## Do NOT
 
@@ -178,6 +191,10 @@ Runtime confirmation (e.g. *"reproduce the cross-tenant read against staging"*,
 - **OWASP Top 10 2021 — A01 Broken Access Control** — canonical failure modes
   (IDOR, missing function-level checks, forced browsing, metadata tampering).
   [owasp.org/Top10/A01_2021-Broken_Access_Control/](https://owasp.org/Top10/A01_2021-Broken_Access_Control/)
+- **OWASP API Security Top 10 2023 — API1 BOLA** (Broken Object Level
+  Authorization) and **API3 BOPLA** (property-level / mass assignment) — the
+  API-layer names for the same object-ownership failures.
+  [owasp.org/API-Security/editions/2023/en/0xa1-broken-object-level-authorization/](https://owasp.org/API-Security/editions/2023/en/0xa1-broken-object-level-authorization/)
 - **NIST SP 800-53 AC family** — AC-3 Access Enforcement, AC-6 Least Privilege
   — rubric for "minimum control" recommendations.
   [csrc.nist.gov/projects/risk-management/sp800-53-controls](https://csrc.nist.gov/projects/risk-management/sp800-53-controls/release-search#!/800-53)

package/dist/agent-src/skills/dependency-upgrade/SKILL.md

@@ -228,11 +228,26 @@ When `composer require` or `npm install` fails with conflicts:
 3. **Use `--dry-run`** first — `composer require vendor/pkg --dry-run`.
 4. **Never use `--ignore-platform-reqs`** in production — only for investigation.
 
+## Post-update malware & behavior audit
+
+CVE scanning (above) catches *known-vulnerable* versions. It does **not** catch a **compromised update**: a trusted package with a legitimate history ships a normal-looking version bump that quietly adds data-exfiltration or other harmful behavior. This is how the biggest supply-chain attacks landed — event-stream (wallet stealer as a new transitive dep), ua-parser-js (`preinstall` miner + credential stealer), @solana/web3.js (key exfil hidden inside expected network calls), chalk/debug + 16 (browser crypto-drainer, 2B weekly downloads), the self-propagating Shai-Hulud worm (added a `.github/workflows` + secret-scanning `postinstall`), xz-utils (backdoor in the released tarball, not the git repo). Routine updates slip through because the version looks normal and install runs scripts across the whole transitive tree silently — the exact [`lethal-trifecta-guard`](../../rules/lethal-trifecta-guard.md) egress shape.
+
+**Run this audit during/after any add or upgrade, then surface findings to the user and hold pending confirmation** (per [`active-remediation`](../../rules/active-remediation.md) — a live supply-chain risk is surfaced, never silently accepted):
+
+1. **Install without running scripts first** — `npm install --ignore-scripts` (npm v12 defaults to this), `composer install --no-scripts`, `pip install --only-binary :all:` (wheels only — no sdist build code) — so install-time code (the #1 RCE vector) can't run before inspection.
+2. **Diff the version delta old→new** — the `scripts` block (any newly-added `pre/post/install` hook), the dependency tree (any **new transitive dependency**), and where feasible the published tarball vs the git source (xz hid in the tarball).
+3. **Capability / behavior diff** — did the new version add a capability its job doesn't need: network egress (`fetch`/`net`/`dns`/`http`), `child_process`/shell, env/secret/credential reads, filesystem writes, obfuscated/minified blobs, a `.github/workflows` file? Use `socket` / `guarddog <eco> scan <pkg>@<ver>` if available; else read the delta.
+4. **Purpose-vs-behavior legitimacy check** — a Slack/HTTP client legitimately makes network calls; a date/string/color util does not. For each new capability ask: *does the package's stated purpose require this?* A network/secret capability with no purpose justification — or a **new outbound endpoint** even in a package that already uses the network — is high-risk.
+5. **Provenance + advisory feeds** — `npm audit signatures` (flag a dep that *had* provenance and lost it — a token-theft-publish hallmark); `osv-scanner --lockfile=…` and the GitHub Advisory / Socket / Snyk malware feeds against the newly-resolved versions.
+
+**Surface to the user** any: new install script · new transitive dep · new network endpoint / secret read · obfuscated blob · lost provenance · advisory/malware hit — with the version delta + the purpose-vs-behavior verdict, and hold the update until they decide. Never auto-accept a bump that introduced an unexplained capability.
+
 ## Output format
 
 1. Updated dependency with version constraint change
 2. Breaking changes addressed with code modifications
 3. Test results confirming compatibility
+4. Post-update audit result: capability delta old→new, purpose-vs-behavior verdict, provenance/advisory status — and any finding surfaced to the user for confirmation
 
 ## Auto-trigger keywords
 
@@ -240,9 +255,14 @@ When `composer require` or `npm install` fails with conflicts:
 - package update
 - breaking changes
 - changelog review
+- malicious package
+- supply chain
+- compromised update
 
 ## Gotcha
 
+- **A trusted package is not a safe version.** Every major supply-chain attack (event-stream, ua-parser-js, chalk/debug, xz) shipped through a *legitimate* package's normal-looking bump — maintainer-authored ≠ safe. Run the post-update behavior audit, not just `audit` for CVEs.
+- **`audit` (CVE) ≠ malware scan.** `npm/composer audit` only knows *published* vulnerabilities; a fresh compromised version has no CVE yet. The capability/behavior diff + purpose-vs-behavior check is what catches zero-hour malware.
 - Don't upgrade multiple major versions at once — one major version per upgrade cycle.
 - The model tends to skip reading the CHANGELOG — breaking changes hide in minor releases too.
 - Always run the full test suite after upgrading, not just the affected tests.

package/dist/agent-src/skills/frontend-render-security/SKILL.md

@@ -0,0 +1,104 @@
+---
+model_tier: medium
+name: frontend-render-security
+description: "Writing/reviewing client-side UI (React/Vue/vanilla) — insecure-render + client-trust gaps AI ships: XSS via innerHTML, client secrets, client-only auth, CORS wildcard, token in localStorage"
+domain: quality
+workspaces:
+  - engineering
+packs:
+  - engineering-base
+---
+
+# frontend-render-security
+
+AI optimizes for the shortest code producing the requested visible behavior and omits the invisible defensive layer — the sanitizer, origin check, server-side gate, security header. Large samples put XSS in a majority of AI frontend code, ~2.74× more than human; every agent in the Tenzai benchmark shipped client-side flaws. High-precision, grep-catchable patterns — stop them at authoring time.
+
+## When to use
+
+- Writing/modifying a component, template, or client-side script that renders data, calls an API, handles auth, or reads the URL / `postMessage`.
+- Reviewing an AI-authored frontend diff.
+- Editing `.tsx` / `.jsx` / `.vue` / `.svelte` / `.html` or client-side `.js` / `.ts`.
+
+Do NOT use when: change is server-only, CLI, or non-UI — route to `security` / `security-sensitive-stop`.
+
+## The Iron Law
+
+```
+NEVER RENDER NON-CONSTANT INPUT INTO AN HTML/JS SINK WITHOUT ENCODING OR SANITIZING.
+THE CLIENT IS UNTRUSTED — EVERY CLIENT GATE NEEDS A SERVER-SIDE TWIN.
+NO SECRET, PRIVILEGED KEY, OR SESSION TOKEN LIVES IN CLIENT CODE OR localStorage.
+```
+
+## Procedure
+
+1. Identify the sinks in the diff: HTML/JS render points, API calls, auth/role checks, URL / `postMessage` reads, secret/token usage.
+2. Run the backstop greps below; for each hit, apply the matching fix from the patterns table.
+3. For every client-side gate, confirm a server-side twin exists (the client is never the security boundary).
+4. Emit the per-diff verdict (Output format); surface any unresolved hit to the user.
+
+## The patterns AI ships by default
+
+| Pattern | Why dangerous | Do instead |
+|---|---|---|
+| `dangerouslySetInnerHTML` / `v-html` / `.innerHTML =` on non-constant value | Stored/DOM XSS (CWE-79) | render as text, or sanitize (DOMPurify) if HTML required |
+| Secret / API key inline or in `NEXT_PUBLIC_*` / `VITE_*` | Bundler inlines it into shipped JS (CWE-798) | call third party via backend-for-frontend proxy; only truly-public values get a public prefix |
+| Client-side-only auth / role / validation | Bypassable via dev tools or proxy (CWE-602) | client gate = UX only; enforce server-side |
+| `location.*` / query param → HTML or JS sink | DOM XSS (CWE-79) | `textContent`; never pass URL data into an HTML/exec sink |
+| CORS `origin: '*'` (esp. with credentials) | Any site reads authenticated responses (CWE-942) | explicit origin allow-list; never reflect `Origin` on credentialed routes |
+| Token / JWT in `localStorage` / `sessionStorage` | XSS-exfiltratable (CWE-522) | `HttpOnly; Secure; SameSite` cookie |
+| `addEventListener('message', …)` without `event.origin` check | Any embedder drives the handler (CWE-346) | strict-equality `event.origin` vs allow-list first |
+| `redirect` / `next` param → `location` / `router.push` | Open redirect / phishing (CWE-601) | relative-path or allow-listed-host only; reject external / non-http schemes |
+| `eval` / `new Function` / string-`setTimeout` on input | Eval injection / RCE (CWE-95) | a parser or explicit allow-list |
+| `target="_blank"` without `rel="noopener"` | Reverse tabnabbing (CWE-1022) | add `rel="noopener noreferrer"` |
+| Missing CSP; missing alt/label/contrast | No XSS second line of defense; a11y failures | strict CSP (no `unsafe-inline`); alt text, labels, AA contrast |
+
+## Backstop greps
+
+Run before committing frontend changes; each returns zero (or every hit is read + justified):
+
+```bash
+# Insecure render + eval sinks
+rg -n 'dangerouslySetInnerHTML|v-html|\.innerHTML\s*=|document\.write\(|\beval\(|new Function\('
+# Client secrets / token storage
+rg -n 'NEXT_PUBLIC_.*(SECRET|KEY|TOKEN|PASSWORD)|VITE_.*(SECRET|KEY)|localStorage\.setItem\([^)]*[Tt]oken'
+# Wildcard CORS + unchecked postMessage + open redirect
+rg -n "origin:\s*['\"]\*['\"]|Access-Control-Allow-Origin.*\*"
+rg -n "addEventListener\(\s*['\"]message['\"]" src/   # then confirm each checks event.origin
+# Unhardened external links
+rg -n 'target=["'\'']_blank["'\'']' src/   # then confirm rel="noopener" present
+```
+
+## Output format
+
+1. A per-diff verdict listing each pattern class checked + result (`clean` / `hit at file:line → fixed by <change>`).
+2. The backstop greps run, with results.
+3. For any client gate added, file:line of its **server-side twin** (or an explicit note the server check already exists + where).
+
+## Gotcha
+
+- Modern browsers default `_blank` to `noopener`, but legacy/embedded webviews don't — keep the `rel` for portability.
+- `NEXT_PUBLIC_`/`VITE_` on a *genuinely* public value (a publishable analytics ID) is fine; the violation is a *sensitive* name behind that prefix. Read the name, don't blanket-block the prefix.
+- A sanitizer (DOMPurify) is the fix only when HTML output is actually required; if plain text suffices, render text and skip the dependency.
+- Client-side validation isn't wrong — it's wrong *as the only* enforcement. Keep it for UX; add the server twin.
+
+## Do NOT
+
+- Do NOT render user/DB HTML through `dangerouslySetInnerHTML`/`v-html`/`innerHTML` without a sanitizer.
+- Do NOT put a secret, privileged key, or session token in client code or web storage.
+- Do NOT treat a client-side role/auth check as a security boundary.
+- Do NOT set `origin: '*'` on a credentialed endpoint.
+- Do NOT auto-strip a grep hit without reading it — some innerHTML uses are on constant, trusted markup.
+
+## Auto-trigger keywords
+
+- frontend security
+- XSS
+- dangerouslySetInnerHTML
+- client-side secret
+- insecure render
+
+## See also
+
+- [`ai-code-blindspots`](../ai-code-blindspots/SKILL.md) — the surface→controls checklist that routes here.
+- [`senior-engineering-discipline`](../../rules/senior-engineering-discipline.md) — anchor rule.
+- [`security`](../security/SKILL.md), [`defense-in-depth`](../defense-in-depth/SKILL.md), [`accessibility-auditor`](../accessibility-auditor/SKILL.md), [`secrets-management`](../secrets-management/SKILL.md).

package/dist/agent-src/skills/frontend-render-security/evals/triggers.json

@@ -0,0 +1,52 @@
+{
+    "skill": "frontend-render-security",
+    "last_eval": "2026-07-09",
+    "description": "5 should-trigger + 5 should-not-trigger queries. Should-trigger covers DE + EN phrasings for client-side insecure-render / client-trust patterns (XSS, client secrets, client-only auth, CORS, localStorage tokens). Should-not-trigger covers near-miss neighbours (server-side security, generic checklist, accessibility-only, dependency intake) whose vocabulary overlaps.",
+    "queries": [
+        {
+            "q": "is it safe to render this user content with dangerouslySetInnerHTML?",
+            "trigger": true
+        },
+        {
+            "q": "review this Vue component for XSS and any secrets in the bundle",
+            "trigger": true
+        },
+        {
+            "q": "I'm storing the JWT in localStorage — is that ok?",
+            "trigger": true
+        },
+        {
+            "q": "prüf mein Frontend auf unsichere Render-Muster und Client-Secrets",
+            "trigger": true
+        },
+        {
+            "q": "my CORS is set to origin '*' with credentials — problem?",
+            "trigger": true
+        },
+        {
+            "q": "review this API controller's authorization logic",
+            "trigger": false,
+            "note": "server-side authz → authz-review / security-sensitive-stop"
+        },
+        {
+            "q": "what invisible controls did I omit across this whole diff?",
+            "trigger": false,
+            "note": "cross-surface checklist → ai-code-blindspots"
+        },
+        {
+            "q": "make this form accessible — keyboard nav and contrast",
+            "trigger": false,
+            "note": "accessibility only → accessibility-auditor"
+        },
+        {
+            "q": "is this frontend npm dependency real and safe to install?",
+            "trigger": false,
+            "note": "dependency intake → supply-chain-intake"
+        },
+        {
+            "q": "help me center this div with flexbox",
+            "trigger": false,
+            "note": "layout/styling — no security surface"
+        }
+    ]
+}

package/dist/agent-src/skills/roadmap-writing/SKILL.md

@@ -61,6 +61,13 @@ in [`.agent-src.uncondensed/templates/roadmaps.md`](../../templates/roadmaps.md)
 Read it before authoring. Do not restate its rules in the roadmap
 body — link the template if a phase needs to override one.
 
+**Naming:** a lone roadmap is `road-to-<slug>.md`. When you create **≥2
+related** roadmaps in one pass (siblings split from one body of work, or
+a follow-up chain), give them a shared `road-to-<family>-<part>.md`
+prefix so relatedness is visible and the dashboard groups them — pick
+the `<family>` slug up front (template rule 21). Follow-ups additionally
+carry `parent_roadmap:` (rule 17).
+
 ### 2. Pick complexity tier honestly
 
 Default `lightweight` (≤ 6 phases, ≤ 600 lines). Only use

package/dist/agent-src/skills/supply-chain-intake/SKILL.md

@@ -0,0 +1,100 @@
+---
+model_tier: medium
+name: supply-chain-intake
+description: "Before adding/installing any dependency the agent named — verify the package exists (slopsquatting: ~1 in 5 AI suggestions are hallucinated), isn't typo-adjacent, is pinned + locked, and CVE-scanned"
+domain: devops
+workspaces:
+  - engineering
+packs:
+  - engineering-base
+---
+
+# supply-chain-intake
+
+An LLM generates a plausible-sounding package name token-by-token with no lookup against a real registry. ~19.7% of AI-recommended packages don't exist (576k-sample study); the same fake name recurs across runs, so attackers pre-register it as malware — "slopsquatting". The `huggingface-cli` PoC (an empty package matching a common hallucination) drew 30k+ downloads. Endor Labs: only ~1 in 5 AI-recommended dependency versions is both real *and* safe. A dependency the agent named is untrusted until verified — never install it just because the model produced the name.
+
+## When to use
+
+- About to add a dependency to `package.json` / `requirements.txt` / `go.mod` / `Cargo.toml` / `composer.json` / `pyproject.toml`, or run `npm/pnpm/yarn install`, `pip install`, `go get`, `cargo add`, `composer require`.
+- Reviewing an AI-authored diff touching a dependency manifest or lockfile.
+- An install command was suggested (especially `curl … | bash`).
+
+Do NOT use when: no dependency is added and no manifest/lockfile is touched.
+
+## The Iron Law
+
+```
+VERIFY THE PACKAGE EXISTS ON THE REAL REGISTRY BEFORE YOU INSTALL IT.
+A NAME THE MODEL PRODUCED IS A HYPOTHESIS, NOT A DEPENDENCY.
+PIN IT, LOCK IT, CVE-SCAN IT. NEVER PIPE A REMOTE SCRIPT STRAIGHT TO A SHELL.
+```
+
+## Procedure — intake gate (run in order before adding a dependency)
+
+1. **Existence** — confirm the exact string resolves on the real registry, published before your session, with real usage:
+   ```bash
+   npm view <pkg> version        # non-zero exit = does not exist (hallucination)
+   pip index versions <pkg>      # or: pip install <pkg>== to list
+   go list -m <module>@latest
+   cargo search <crate>
+   ```
+   Non-existent, brand-new (days old), or near-zero-download → **stop**, treat as hallucination/slopsquat.
+2. **Typo-adjacency** — name within 1–2 chars of a far-more-popular package (`python-dateutil` vs `dateutil`, `lodahs` vs `lodash`)? Probably want the popular one — confirm before installing.
+3. **Version safety** — the model's pin may predate a CVE fix (training-cutoff reintroduction). Take the current patched release, then scan:
+   ```bash
+   npm audit           # block on high/critical
+   pip-audit
+   osv-scanner -r .
+   ```
+4. **Pin + lock** — install exact + commit the lockfile; reject floating ranges (`^`, `latest`, no lockfile) on production deps.
+   ```bash
+   npm install --save-exact <pkg> && git add package-lock.json
+   ```
+5. **License** — confirm compatible with the project's declared license before it lands.
+6. **No pipe-to-shell** — never `curl … | bash` an install; download → inspect → execute over pinned HTTPS, or surface it to the user for confirmation.
+
+## Backstop greps
+
+```bash
+# Floating / unpinned production deps (npm)
+rg -n '"[^"]+":\s*"(\^|~|\*|latest)' package.json
+# Missing lockfile alongside a manifest
+[ -f package.json ] && [ ! -f package-lock.json ] && echo "no lockfile"
+# curl|bash install patterns anywhere in the change
+rg -n 'curl[^|]*\|\s*(bash|sh)|wget[^|]*\|\s*(bash|sh)' .
+```
+
+## Output format
+
+1. Per new dependency: name, resolved registry version, publish date / usage signal, and the existence-check command output (`npm view … → 4.17.21`) — proving it real.
+2. The lockfile diff staged, and the `audit` / `osv-scanner` result (`0 high/critical`, or the finding + resolution).
+3. For any suggested install command, confirmation it isn't `curl|bash` and the source is pinned HTTPS.
+
+## Gotcha
+
+- Hallucinated names are *repeatable* — re-prompting the same model yields the same fake name, so "it looked confident / consistent" isn't evidence it exists. Only the registry is.
+- Short, "obvious" variants (`X-cli`, `X-client`, `X-sdk`) are the prime hallucination shape — verify these hardest.
+- A package that exists but was published this week with 12 downloads is a slopsquat candidate, not a safe dep — weigh age + usage, not just existence.
+- Lockfile integrity is part of the threat model: an unhashed or floating entry can pull a freshly-poisoned release even when a lockfile is "present".
+
+## Do NOT
+
+- Do NOT run an install command for a package you haven't existence-checked this session.
+- Do NOT accept the model's version pin as authoritative — re-check against current CVEs.
+- Do NOT commit a manifest change without its lockfile.
+- Do NOT pipe a fetched script into an interpreter.
+- Do NOT inline code that duplicates a copyleft source without carrying its license.
+
+## Auto-trigger keywords
+
+- dependency intake
+- package hallucination
+- slopsquatting
+- add a dependency
+- npm install / pip install / go get
+
+## See also
+
+- [`ai-code-blindspots`](../ai-code-blindspots/SKILL.md) — the surface→controls checklist that routes here.
+- [`senior-engineering-discipline`](../../rules/senior-engineering-discipline.md) — anchor rule.
+- [`dependency-upgrade`](../dependency-upgrade/SKILL.md), [`secrets-management`](../secrets-management/SKILL.md), [`security`](../security/SKILL.md).