@hybridlabor-api/aos 4.6.6 → 4.7.1

package/.agents/agents.md

@@ -21,8 +21,12 @@ next. This file defines *what each agent is*, not *what calls what*.
 - **MCP Servers**:
   - `openwiki-skill`
   - `memb_mcp`
-- **Output Artifact**: `production_artifacts/00_execution_plan.md`
-- **Reads**: `state.goal` · **Writes**: `state.artifacts.plan`, `state.phase: plan`
+- **Output Artifacts**: `production_artifacts/00_execution_plan.md`, `production_artifacts/00_architecture.json` (editable Archify specification), `production_artifacts/00_architecture.html` (read-only `archify deliver` artifact)
+- **Reads**: `state.goal` · **Writes**: `state.artifacts.plan`, `state.artifacts.architecture`, `state.phase: plan`
+- The plan uses the agenttrail component convention (`## Name {#id}`, `needs:`, `files:`, tasks `- [ ] ... {#id}`).
+- The Architect authors the architecture as Archify `architecture` JSON to `production_artifacts/00_architecture.json`, runs `aos-archify validate architecture <spec> --quality showcase --json` during repair and `aos-archify deliver architecture <spec> production_artifacts/00_architecture.html --quality showcase --json` once for final acceptance, and records `state.artifacts.architecture` only on a passing showcase receipt (9/9 checks, 0 errors). A failed validate/deliver preserves the previous HTML and escalates at the Architect→TechLead boundary instead of proceeding silently.
+- The relevant plan component links the delivered diagram with a `url: production_artifacts/00_architecture.html` line so the live map opens it from the card.
+- Plan-canvas reviews that HTML too via the existing path as fixed argv `aos-plan-canvas open production_artifacts/00_architecture.html --no-open` with `shell: false` from the repo root (no new port, single open, no shell interpolation). A missing or unavailable canvas never invalidates the verified architecture; the `url:` line and the `aos-trail . --plan production_artifacts/00_execution_plan.md --no-open` map stay authoritative.
 
 ---
 
@@ -36,7 +40,8 @@ next. This file defines *what each agent is*, not *what calls what*.
 - **MCP Servers**:
   - `memb_mcp`
 - **Output Artifact**: capability-map approval recorded in `state.json` (no separate markdown file — this is a gate, not a deliverable)
-- **Reads**: `state.artifacts.plan` · **Writes**: plan-approval decision, `state.phase: build` (or back to `plan`)
+- **Reads**: `state.artifacts.plan`, `state.artifacts.architecture` · **Writes**: plan-approval decision, `state.phase: build` (or back to `plan`)
+- TechLead rejects the plan when the architecture gate fails: `production_artifacts/00_architecture.json` and `production_artifacts/00_architecture.html` are missing, the `url: production_artifacts/00_architecture.html` link is absent from the plan, or the deliver receipt is not a passing showcase receipt (9/9 checks, 0 errors). A failed receipt preserves the previous HTML and sends the run back to Architect.
 
 ---
 
@@ -170,6 +175,7 @@ Ported from [affaan-m/ECC](https://github.com/affaan-m/ECC) (MIT) — see
   - `systematic-debugging`
   - `clean-code`
   - `api-design-principles`
+  - `bdb-security-audit`
 - **Output Artifact**: findings returned inline (writes no file)
 
 ---

package/.agents/nodes.json

@@ -14,7 +14,8 @@
       "skills": [
         "bdbrainstorm",
         "planning-with-files",
-        "concise-planning"
+        "concise-planning",
+        "archify"
       ],
       "instructions": null
     },
@@ -45,6 +46,8 @@
       "optional": false,
       "skills": [
         "godmode-ui-ux",
+        "bdbdesignpro",
+        "editable-design",
         "senior-frontend",
         "landing-page-generator",
         "shadcn",
@@ -125,12 +128,14 @@
       "optional": false,
       "skills": [
         "godmode-shipping",
+        "brag",
         "webapp-testing",
         "seo-audit",
         "wcag-audit-patterns",
         "github-repo",
         "clean-code",
-        "bdbresilience"
+        "bdbresilience",
+        "bdb-security-audit"
       ],
       "instructions": null
     }

package/.agents/state.schema.json

@@ -24,6 +24,7 @@
       "description": "Paths to the human-readable markdown artifacts nodes produce. state.json is what edges evaluate; these stay the readable payload. Known keys are documented below; additionalProperties stays a typed string-or-null (not fully open) so a registry-driven build domain beyond these can validate without making this object permissive to arbitrary JSON.",
       "properties": {
         "plan": { "type": ["string", "null"] },
+        "architecture": { "type": ["string", "null"] },
         "frontend": { "type": ["string", "null"] },
         "backend": { "type": ["string", "null"] },
         "media": { "type": ["string", "null"] },
@@ -60,7 +61,8 @@
         "typecheck": { "type": "string", "enum": ["pass", "fail", "skip"] },
         "tests": { "type": "string", "enum": ["pass", "fail", "skip"] },
         "a11y": { "type": "string", "enum": ["pass", "fail", "skip"] },
-        "seo": { "type": "string", "enum": ["pass", "fail", "skip"] }
+        "seo": { "type": "string", "enum": ["pass", "fail", "skip"] },
+        "security": { "type": "string", "enum": ["pass", "fail", "skip"] }
       },
       "additionalProperties": false
     },
@@ -95,6 +97,29 @@
       "default": [],
       "description": "Skill names the user required via /startcycle-graph's --skill=<name> flag (repeatable), validated to exist before the run proceeds. Empty when the user didn't ask for one. Build nodes (and Architect) are told to actually apply these, not just have them available; Reviewer checks the resulting artifacts for evidence they were used and flags a contract-misread finding if not. See .agents/graph.md's 'Mandatory Skill Injection' section."
     },
+    "pipeline": {
+      "type": "string",
+      "description": "AO scaffold metadata: which pipeline bootstrapped this run, e.g. startcycle-graph."
+    },
+    "planCanvasRequired": {
+      "type": "boolean",
+      "description": "AO scaffold metadata: whether the plan-canvas review is required before build."
+    },
+    "roles": {
+      "type": "object",
+      "description": "AO scaffold metadata: per-role enablement flags.",
+      "additionalProperties": { "type": "boolean" }
+    },
+    "models": {
+      "type": "object",
+      "description": "AO scaffold metadata: per-role model routing labels.",
+      "additionalProperties": { "type": "string" }
+    },
+    "harnesses": {
+      "type": "object",
+      "description": "AO scaffold metadata: per-role harness assignments.",
+      "additionalProperties": { "type": "string" }
+    },
     "needs_human": {
       "type": "boolean",
       "default": false,

package/.agents/vendor-manifest.json

@@ -0,0 +1,56 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "version": "1.0.0",
+  "description": "Pinned upstream vendor repositories tracked for AOS skills and tools",
+  "updated_at": "2026-09-24T07:27:44Z",
+  "vendors": {
+    "superdesign-skill": {
+      "upstream": "https://github.com/superdesigndev/superdesign-skill",
+      "pinned_commit": "f9f05cd988c247dce6c072eaf9ac6b162f2ffc4b",
+      "purpose": "Design tokens, typography hierarchy, spacing scale, component patterns, dsh",
+      "target_skill": "godmode-ui-ux"
+    },
+    "taste-skill": {
+      "upstream": "https://github.com/Leonxlnx/taste-skill",
+      "pinned_commit": "c184364c58658b2f131b4ae8bd3d206cabb3deee",
+      "purpose": "Aesthetic archetypes (Swiss, Minimalist, Luxury, Soft, Tactical) and taste injection",
+      "target_skill": "godmode-ui-ux"
+    },
+    "anti-slop": {
+      "upstream": "https://github.com/miqdadbadjuber/anti-slop",
+      "pinned_commit": "0e384b7bff3301c8ec56dea300330772fed28e6a",
+      "purpose": "Strict negative rules, banned buzzwords, banned generic patterns, touch zones",
+      "target_skill": "godmode-ui-ux, reviewer"
+    },
+    "editable-design": {
+      "upstream": "https://github.com/yejy53/Editable-Design",
+      "pinned_commit": "42ab412fec1d5f32cb86c107430e9fb69674200f",
+      "purpose": "Fixed-canvas visual design, interactive editor.html, exploded layer inspection",
+      "target_skill": "editable-design"
+    },
+    "brag": {
+      "upstream": "https://github.com/latent-spaces/brag",
+      "pinned_commit": "57ce4c9bb912f01a0078b154318bf67c5cbf780f",
+      "purpose": "Hyperframes project-to-launch-video generator",
+      "target_skill": "brag (post-shipping release hook)"
+    },
+    "skylos": {
+      "upstream": "https://github.com/duriantaco/skylos",
+      "pinned_commit": "0c95b002424453983d5c96708cf7865939745d98",
+      "purpose": "Diff-based AST and static security analyzer for shipping gate",
+      "target_skill": "bdb-security-audit, godmode-shipping"
+    },
+    "claude-red": {
+      "upstream": "https://github.com/SnailSploit/claude-red",
+      "pinned_commit": "739512a8588b28ff3b554e669391c22508602878",
+      "purpose": "Defensive audit heuristics and vulnerability checklists (offensive exploits stripped)",
+      "target_skill": "bdb-security-audit, security-reviewer"
+    },
+    "ecc-store": {
+      "upstream": "https://github.com/affaan-m/ECC",
+      "pinned_commit": "e482e579415fde18357cafce70f177ae19fd7f03",
+      "purpose": "Markdown-only fallback store for skills and auxiliary subagents",
+      "target": "lib/ecc-store-index.json"
+    }
+  }
+}

package/.agents/workflows/startcycle-graph.md

@@ -58,8 +58,8 @@ agents calling agents; see `audit-agents.md` F-17 for why that's corrected.
 
 | Node | Role | Reads | Writes |
 |---|---|---|---|
-| **Architect** | Turns the goal into a system plan | `state.goal` | `state.artifacts.plan` |
-| **TechLead** | Approves/rejects the plan's capability map | `state.artifacts.plan` | plan approval, `state.phase` |
+| **Architect** | Turns the goal into a system plan | `state.goal` | `state.artifacts.plan`, `state.artifacts.architecture` (`production_artifacts/00_architecture.json` + `production_artifacts/00_architecture.html` via `aos-archify deliver`, linked with a `url:` line) |
+| **TechLead** | Approves/rejects the plan's capability map | `state.artifacts.plan` | plan approval, `state.phase` (rejects on a failed architecture gate: missing spec/HTML, missing `url:` link, or no passing showcase receipt) |
 | **Godmode_UI_UX** | Frontend implementation | plan, own findings | `state.artifacts.frontend` |
 | **Godmode_Engineering** | Backend implementation | plan, own findings | `state.artifacts.backend` |
 | **Godmode_Media_EventTech** | Media/show-control implementation (if the goal needs it) | plan, own findings | `state.artifacts.media` |

package/.claude/agents/architect.md

@@ -5,8 +5,13 @@ model: opus
 ---
 Turns the user's goal (or `/bdbrainstorm` / `/grill-me` output) into a system plan. Reads existing architecture before proposing changes. Does not coordinate execution or invoke other agents — that is TechLead's job, decided by the dispatcher, not by Architect.
 
-**Primary skills:** bdbrainstorm, planning-with-files, concise-planning
+**Primary skills:** bdbrainstorm, planning-with-files, concise-planning, archify
 
 **MCP servers used:** openwiki-skill, memb_mcp
 
-**Output artifact(s):** `production_artifacts/00_execution_plan.md`
+**Output artifact(s):** `production_artifacts/00_execution_plan.md`, `production_artifacts/00_architecture.json`, `production_artifacts/00_architecture.html`
+
+- The plan uses the agenttrail component convention (`## Name {#id}`, `needs:`, `files:`, tasks `- [ ] ... {#id}`).
+- The Architect authors the architecture as Archify `architecture` JSON to `production_artifacts/00_architecture.json`, runs `aos-archify validate architecture <spec> --quality showcase --json` during repair and `aos-archify deliver architecture <spec> production_artifacts/00_architecture.html --quality showcase --json` once for final acceptance, and records `state.artifacts.architecture` only on a passing showcase receipt (9/9 checks, 0 errors). A failed validate/deliver preserves the previous HTML and escalates at the Architect→TechLead boundary.
+- The relevant plan component links the delivered diagram with a `url: production_artifacts/00_architecture.html` line so the live map opens it from the card.
+- Plan-canvas reviews that HTML too via the existing path as fixed argv `aos-plan-canvas open production_artifacts/00_architecture.html --no-open` with `shell: false` from the repo root (no new port, single open, no shell interpolation). A missing or unavailable canvas never invalidates the verified architecture; the `url:` line and the `aos-trail . --plan production_artifacts/00_execution_plan.md --no-open` map stay authoritative.

package/.claude/agents/security-reviewer.md

@@ -5,6 +5,6 @@ model: sonnet
 ---
 Security vulnerability detection and remediation. Use after writing code that handles user input, authentication, API endpoints, or sensitive data. Flags secrets, SSRF, injection, unsafe crypto, and OWASP Top 10.
 
-**Primary skills:** systematic-debugging, clean-code, api-design-principles
+**Primary skills:** systematic-debugging, clean-code, api-design-principles, bdb-security-audit
 
 **Output artifact(s):** findings returned inline (writes no file)

package/.claude/agents/techlead.md

@@ -10,3 +10,5 @@ Reviews Architect's plan for a capability map (module boundaries, dependency dir
 **MCP servers used:** memb_mcp
 
 **Output artifact(s):** capability-map approval recorded in `state.json` (no separate markdown file — this is a gate, not a deliverable)
+
+- TechLead rejects the plan when the architecture gate fails: `production_artifacts/00_architecture.json` and `production_artifacts/00_architecture.html` are missing, the `url: production_artifacts/00_architecture.html` link is absent from the plan, or the deliver receipt is not a passing showcase receipt (9/9 checks, 0 errors). A failed receipt preserves the previous HTML and sends the run back to Architect.