@haposoft/cafekit 0.15.3 → 0.16.0-rc.2

package/src/claude/skills/backend-development/SKILL.md

@@ -59,13 +59,13 @@ See: `references/backend-technologies.md` for detailed comparisons
 
 ## Key Best Practices (2025)
 
-**Security:** Argon2id passwords, parameterized queries (98% SQL injection reduction), OAuth 2.1 + PKCE, rate limiting, security headers
+**Security:** Argon2id passwords, parameterized queries prevent SQL injection, OAuth 2.1 + PKCE, rate limiting, security headers
 
-**Performance:** Redis caching (90% DB load reduction), database indexing (30% I/O reduction), CDN (50%+ latency cut), connection pooling
+**Performance:** Redis caching reduces DB load, database indexing reduces I/O, CDN cuts latency, connection pooling
 
-**Testing:** 70-20-10 pyramid (unit-integration-E2E), Vitest 50% faster than Jest, contract testing for microservices, 83% migrations fail without tests
+**Testing:** 70-20-10 pyramid (unit-integration-E2E), Vitest or Jest, contract testing for microservices, migration tests
 
-**DevOps:** Blue-green/canary deployments, feature flags (90% fewer failures), Kubernetes 84% adoption, Prometheus/Grafana monitoring, OpenTelemetry tracing
+**DevOps:** Blue-green/canary deployments, feature flags can reduce failures, Kubernetes, Prometheus/Grafana monitoring, OpenTelemetry tracing
 
 ## Quick Decision Matrix
 

package/src/claude/skills/backend-development/references/backend-architecture.md

@@ -218,7 +218,7 @@ Shipping Service
 
 ## Event-Driven Architecture
 
-**Impact:** 85% organizations recognize business value
+**Impact:** Organizations recognize business value
 
 ### Event Sourcing
 

package/src/claude/skills/backend-development/references/backend-devops.md

@@ -50,7 +50,7 @@ kubectl rollout resume deployment/api
 
 ### Feature Flags (Progressive Delivery)
 
-**Impact:** 90% fewer deployment failures when combined with canary
+**Impact:** Fewer deployment failures when combined with canary
 
 ```typescript
 import { LaunchDarkly } from 'launchdarkly-node-server-sdk';
@@ -105,7 +105,7 @@ CMD ["node", "dist/main.js"]
 ```
 
 **Benefits:**
-- Smaller image size (50-90% reduction)
+- Smaller image size
 - Faster deployments
 - Reduced attack surface
 

package/src/claude/skills/backend-development/references/backend-mindset.md

@@ -105,7 +105,7 @@ const users = await db.query(`
 
 ### Technical Debt Management
 
-**20-40% productivity increase** from addressing technical debt properly
+**Productivity increase** from addressing technical debt properly
 
 **Debt Quadrants:**
 1. **Reckless + Deliberate:** "We don't have time for design"
@@ -264,7 +264,7 @@ async function getUsers(limit?: number) {
 
 ### Testing Mindset (TDD/BDD)
 
-**70% happy-path tests drafted by AI, humans focus on edge cases**
+**AI drafts happy-path tests, humans focus on edge cases**
 
 **Test-Driven Development (TDD):**
 ```
@@ -287,7 +287,7 @@ Feature: User Registration
 
 ### Observability and Debugging Approach
 
-**100% median ROI, $500k average return** from observability investments
+**Positive ROI** from observability investments
 
 **Three Questions:**
 1. **Is it slow?** → Check metrics (response time, DB queries)

package/src/claude/skills/backend-development/references/backend-performance.md

@@ -8,7 +8,7 @@ Performance optimization strategies, caching patterns, and scalability best prac
 
 #### Indexing Strategies
 
-**Impact:** 30% disk I/O reduction, 10-100x query speedup
+**Impact:** Reduced disk I/O and faster queries
 
 ```sql
 -- Create index on frequently queried columns
@@ -88,7 +88,7 @@ const posts = await Post.findAll({
 
 ### Redis Caching
 
-**Impact:** 90% DB load reduction, 10-100x faster response
+**Impact:** Reduced DB load and faster responses
 
 #### Cache-Aside Pattern (Lazy Loading)
 
@@ -140,7 +140,7 @@ await redis.keys('user:*').then(keys => redis.del(...keys));
 
 ```
 Client
-  → CDN Cache (static assets, 50%+ latency reduction)
+  → CDN Cache (static assets, reduced latency)
   → API Gateway Cache (public endpoints)
   → Application Cache (Redis)
   → Database Query Cache
@@ -236,7 +236,7 @@ emailQueue.process('send-welcome', async (job) => {
 
 ## CDN (Content Delivery Network)
 
-**Impact:** 50%+ latency reduction for global users
+**Impact:** Reduced latency for global users
 
 ### Configuration
 
@@ -302,7 +302,7 @@ const users = await replicaDb.users.findAll();
 ```
 
 **Use Cases:**
-- Read-heavy workloads (90%+ reads)
+- Read-heavy workloads
 - Analytics queries
 - Reporting dashboards
 

package/src/claude/skills/backend-development/references/backend-security.md

@@ -11,7 +11,7 @@ Security best practices, OWASP Top 10 mitigation, and modern security standards
 ### Top Vulnerabilities & Mitigation
 
 #### 1. Broken Access Control
-**Risk:** Users access unauthorized resources (28% of vulnerabilities)
+**Risk:** Users access unauthorized resources
 
 **Mitigation:**
 - Implement RBAC (Role-Based Access Control)
@@ -52,7 +52,7 @@ ph.verify(hash, "password123")  # Verify password
 #### 3. Injection Attacks
 **Risk:** SQL injection, NoSQL injection, command injection (6x increase 2020-2024)
 
-**Mitigation (98% vulnerability reduction):**
+**Mitigation:** Parameterized queries prevent SQL injection.
 - Use parameterized queries ALWAYS
 - Input validation with allow-lists
 - Escape special characters
@@ -156,7 +156,7 @@ pip-audit --fix
 - Network segmentation
 - Disable unnecessary protocols (file://, gopher://)
 
-## Input Validation (Prevents 70%+ Vulnerabilities)
+## Input Validation (Prevents Vulnerabilities)
 
 ### Validation Strategies
 
@@ -257,6 +257,58 @@ const dbPassword = process.env.DB_PASSWORD;
 if (!dbPassword) throw new Error('DB_PASSWORD not set');
 ```
 
+## Critical Security Invariants (apply only when the task touches these surfaces)
+
+These invariants are lane-aware: enforce them for Critical tasks that touch the
+named surface; for Direct/Standard tasks that happen to touch it, apply the same
+checks with proportional evidence (targeted unit test + diff self-check for Direct,
+bounded suite for Standard). Do not impose a fixed heavy ceremony on every task.
+
+### Logging & Secret Redaction
+
+- Match secret names by exact token boundaries, not broad substrings. Never redact
+  by substring inside safe identifiers — e.g. names ending in `_file`, `_path`,
+  `_hint`, `_label` or containing `tokenizer` must stay intact. Preserve the
+  field/key name, replace only the value with `[REDACTED]` (use `[REDACTED-PEM]`
+  for PEM blocks, keeping the surrounding structure).
+- Leave public URLs and credential-free strings untouched. URL redaction applies
+  only when a credential is present in the URL (e.g. `user:pass@host`).
+- Authorization redaction is quote-aware and delimiter-safe: match schemes
+  `Bearer`/`Basic` case-insensitively, redact only the credential that follows,
+  preserve surrounding quotes and trailing delimiters (`,`, `;`, whitespace) outside
+  the redacted value, and never drop the closing quote.
+- Idempotence: `redact(redact(x)) === redact(x)`. The markers `[REDACTED]` /
+  `[REDACTED-PEM]` are stable and not re-wrapped or corrupted.
+- Verification guidance: cover true-positive credential cases, false-positive
+  safe-identifier and public-URL cases, quoted `Bearer`/`Basic` with trailing
+  delimiters, multi-line/PEM cases when relevant, and an idempotence round-trip.
+  Assert that no secret appears in error messages or completion reports and that
+  safe values are byte-identical after redaction.
+
+### Filesystem Write Boundary
+
+- Require an existing real directory as root. Reject before any mutation when
+  `targetPath` is empty or whitespace-only, contains a URI scheme, is absolute,
+  escapes via `..` segments, or escapes via sibling-prefix (`root` vs
+  `root-evil`).
+- Containment needs two checks: lexical containment of the resolved path
+  (`path.resolve(root, target)` inside root) **and** `realpath` containment of
+  the deepest existing parent directory. This blocks symlink-pointing-outside
+  and traversal that lexical check alone would miss. Never follow or overwrite a
+  symlink at the final target; never create parent directories outside root.
+- Perform atomic same-directory write: create a temporary file in the target
+  directory, write fully, then `rename` into place. Remove the temp file on any
+  error. Rejections must happen before creating or modifying anything outside root.
+- Return the canonical `realpath` of the target on success (e.g. macOS
+  `/var` → `/private/var` alias must resolve). Keep the public API otherwise
+  unchanged.
+- Verification guidance: nested success, traversal / absolute / URI / sibling-prefix
+  rejection, parent-symlink rejection, final-symlink rejection (do not follow or
+  overwrite), no-outside-mutation assertion (filesystem outside root unchanged on
+  failure), atomic temp cleanup, and canonical return-path equality. Critical runs
+  the full project suite; Direct/Standard use proportional lane evidence (targeted
+  unit test + diff self-check for Direct, bounded suite for Standard).
+
 ## API Security Checklist
 
 - [ ] Use HTTPS/TLS 1.3 only

package/src/claude/skills/backend-development/references/backend-technologies.md

@@ -22,7 +22,7 @@ Core technologies, frameworks, databases, and message queues for modern backend
 **When to Choose:** Team already using JavaScript/TypeScript, real-time features needed, rapid development priority
 
 ### Python
-**Market Position:** FastAPI adoption surge - 73% migrating from Flask
+**Market Position:** FastAPI adoption is increasing among Flask users
 
 **Best For:**
 - Data-heavy applications
@@ -54,7 +54,7 @@ Core technologies, frameworks, databases, and message queues for modern backend
 **When to Choose:** Microservices, high concurrency needs, DevOps tooling, simple deployment (single binary)
 
 ### Rust
-**Market Position:** 72% most admired language, 1.5x faster than Go
+**Market Position:** Highly admired language, faster than Go
 
 **Best For:**
 - Performance-critical systems
@@ -129,7 +129,7 @@ Core technologies, frameworks, databases, and message queues for modern backend
 - Rate limiting
 - Real-time leaderboards
 - Job queues (Bull, BullMQ)
-- Caching layer (90% DB load reduction)
+- Caching layer (reduces DB load)
 
 **When to Choose:** Need sub-millisecond latency, caching layer, session management
 
@@ -242,9 +242,9 @@ Millions msg/sec? → Yes → Kafka
 
 1. **Choosing NoSQL for relational data** - Use PostgreSQL if data has clear relationships
 2. **Not using connection pooling** - Implement pooling for 5-10x performance boost
-3. **Ignoring indexes** - Add indexes to frequently queried columns (30% I/O reduction)
+3. **Ignoring indexes** - Add indexes to frequently queried columns (reduces I/O)
 4. **Over-engineering with microservices** - Start monolith, split when needed
-5. **Not caching** - Redis caching provides 90% DB load reduction
+5. **Not caching** - Redis caching reduces DB load
 
 ## Resources
 

package/src/claude/skills/backend-development/references/backend-testing.md

@@ -24,7 +24,7 @@ Comprehensive testing approaches, frameworks, and quality assurance practices (2
 ### Frameworks by Language
 
 **TypeScript/JavaScript:**
-- **Vitest** - 50% faster than Jest in CI/CD, ESM native
+- **Vitest** - Faster than Jest in CI/CD, ESM native
 - **Jest** - Mature, large ecosystem, snapshot testing
 
 **Python:**
@@ -269,7 +269,7 @@ test('user can register and login', async ({ page }) => {
 
 ## Database Migration Testing
 
-**Critical:** 83% migrations fail without proper testing
+**Migrations fail without proper testing**
 
 ```typescript
 describe('Database Migrations', () => {

package/src/claude/skills/brainstorm/SKILL.md

@@ -59,7 +59,7 @@ If any item is vague, ask one more grounded question. Do not proceed with phrase
 | "This is too simple to need a design" | Simple projects = most wasted work from unexamined assumptions. |
 | "I already know the solution" | Then writing it down takes 30 seconds. Do it. |
 | "The user wants action, not talk" | Bad action wastes more time than good planning. |
-| "Let me explore the code first" | Brainstorming tells you HOW to explore. Follow the process. |
+| "I'll skip the scout summary and go straight to questions" | Gate order is scout → summarize findings → ask. Questions come from evidence. |
 | "I'll just prototype quickly" | Prototypes become production code. Design first. |
 
 ## Collaboration Tools
@@ -70,8 +70,7 @@ Leverage these specific tools or sub-agents to execute the workflow effectively:
 - `hapo:ai-multimodal`: Use this when analyzing visual materials and mockups.
 - `repomix --remote`: Use this bash command to summarize external Github repositories if a URL is provided.
 - `psql`: Query database schemas to understand existing data structures.
-- `brainstormer`: Call only for medium/high-complexity architecture trade-offs.
-- **Ecosystem Swarm (`SendMessage`):** Call `researcher` (validation), `docs-keeper` (architecture boundaries), or `project-manager` (scope warnings) for deeply complex specs.
+Call brainstormer only when 2+ architectures have material trade-offs after discovery; call researcher only for external/current facts the repo cannot answer.
 
 ## Discovery Question Framework
 

package/src/claude/skills/code-review/SKILL.md

@@ -24,6 +24,9 @@ Before executing any review, firmly grasp these two pillars:
 - `references/adversarial-review.md` (Stage 3 rules)
 
 ## Core Principles
+
+Executable policy source: `.claude/scripts/workflow-policy.cjs` (source: `src/claude/scripts/workflow-policy.cjs`). Review outputs and consumers must use its exact `PASS | FAIL | BLOCKED` verdict enum.
+
 1. **YAGNI**, **KISS**, **DRY** always prevail. 
 2. Technical correctness over social comfort. Be honest and straight to the point.
 3. If Specs are provided as PDF or Design Images, do not guess — use `hapo:ai-multimodal` to verify.
@@ -41,7 +44,7 @@ If invoked without explicit arguments, default to reviewing recent changes (pend
 
 ## 3-Stage Adversarial Protocol
 
-Ensure verification walks through these three stages before delivering a final score.
+Ensure verification walks through these three stages before delivering a final verdict.
 
 ### Stage 1 — Spec Compliance (with `ai-multimodal` injection)
 Does the code match what was requested?
@@ -61,18 +64,18 @@ Actively try to break the code.
 - Find false assumptions, resource exhaustion loops, and race conditions.
 - Find unhandled edge cases (e.g. empty strings, null pointers, negative integers). 
 
-## Output Scoring
+## Output
 
-Your report MUST return a score out of 10.
-- **PASS:** Score >= 9.5 and **0 Critical findings**.
-- **FAIL:** Score < 9.5 or > 0 Critical findings.
+Your report MUST classify every finding by severity and return exactly one verdict from `PASS | FAIL | BLOCKED`. Every review verdict/output consumer MUST accept only `PASS | FAIL | BLOCKED` and reject any other value.
+- **PASS:** no Critical findings, no High findings, at most one Medium.
+- **FAIL:** one or more Critical or High findings, or two or more Medium findings.
+- **BLOCKED:** missing execution proof, permission, environment, or user-owned decision prevents review completion. Stop without blind retry; report blocker and required input.
 
 Format:
 ```markdown
 # Code Review Results [hapo:code-review]
 
-**Score:** X.X / 10
-**Status:** PASS | FAIL
+**Verdict:** PASS | FAIL | BLOCKED
 **Target:** [PR | Commit | Path]
 
 ## Stage 1: Spec Compliance
@@ -83,7 +86,8 @@ Format:
 
 ## Stage 3: Adversarial Findings
 - [🔴 Critical] ...
-- [🟡 Warning] ...
+- [🟠 High] ...
+- [🟡 Medium] ...
 - [🔵 Suggestion] ...
 
 ## Fix Commands (Terminal ready)

package/src/claude/skills/code-review/references/verification-gate.md

@@ -8,7 +8,7 @@ description: The Iron Law of Proof. Prohibits reporting a 'PASS' status without
 In the Hapo ecosystem, words are cheap. Code that "looks right" to an AI can easily break in production. This reference defines the strictest, most uncompromising rule for Code Review.
 
 ## 1. The Iron Law
-**You MUST NOT issue a final score of PASS unless you hold concrete, verifiable execution proof.**
+**You MUST NOT issue a final verdict of PASS unless you hold concrete, verifiable execution proof.**
 
 ## 2. Hallucination Block
 Never use the following phrases or implications to assess code functionality:
@@ -28,6 +28,6 @@ To clear the Verification Gate, you must cite one of the following concrete proo
 - **Multimodal Visual Evidence:** `hapo:ai-multimodal` confirming that the visual rendering perfectly matches the design layout.
 
 ## 4. How to Handle Missing Proof
-If you are asked to review a PR or commit and no execution proof is available in the memory or context:
-1. **Demand Action:** Instruct the `god-developer` or `test-runner` to run the test suite and provide you with the terminal logs.
-2. **Issue an Incomplete PASS:** If you must proceed due to workflow limitations, explicitly state: *"Verdict is tentative. Cannot issue an unconditional PASS because execution logs were not provided."*
+If you are asked to review a PR or commit and no execution proof is available:
+1. **Return `BLOCKED`** and name missing commands, artifacts, permissions, or environment access.
+2. Do not issue `PASS`, do not downgrade to a tentative pass, and do not blind-retry. Resume only after proof arrives.

package/src/claude/skills/debug/SKILL.md

@@ -49,6 +49,8 @@ Do NOT recommend a fix until the root-cause contract is complete.
 Do NOT stop at the first plausible explanation. Test hypotheses against evidence.
 If 2+ hypotheses are refuted, change strategy before continuing.
 If evidence is insufficient, report `Root cause: unknown`, `Missing Evidence`, and `Next Diagnostic Action`; do not hand off to `hapo:hotfix` as ready.
+Answer each item in one concrete sentence.
+If any answer contains 'probably', 'I think', 'something with', or 'maybe' — it is not an answer; gather evidence instead.
 </ROOT-CAUSE-GATE>
 
 If the user asks to fix while still inside `hapo:debug`, finish the debug report first. Then hand off only the completed root-cause contract to `hapo:hotfix`.