@kensaurus/skills 0.0.0-stage → 2.1.0

package/skills/test-load/SKILL.md

@@ -0,0 +1,126 @@
+---
+name: test-load
+description: >
+  Design and run a k6 or Artillery load profile: throughput, latency
+  percentiles, error rate, breaking point. Use when "load test this", "will it
+  handle launch traffic", or "find the breaking point". Code-level resilience
+  → audit-resilience.
+license: MIT
+---
+
+# test-load — Measured concurrency, not a guess
+
+**Degree of freedom: MIXED** — journey design `[HIGH freedom]`; env choice
+and profile order `[LOW freedom]`. **Never production without explicit
+sign-off and rate caps.**
+
+Turn "I think it'll hold" into numbers: at N concurrent users, p95 is X, error
+rate is Y, it falls over at Z.
+
+**`audit-resilience` tells you retries exist; this proves whether they save you
+when 500 people arrive at once.**
+
+## This skill vs neighbors
+
+| Skill | Owns |
+|---|---|
+| **test-load** (this) | Concurrent traffic profiles + measured SLO |
+| `audit-resilience` | Timeouts/retries/idempotency *in code* |
+| `audit-infra-cost` | Consumes these capacity numbers to right-size |
+| `audit-performance` | Single-user Web Vitals / bundle |
+| `backend-db-performance` | Query/index fixes after this names the bottleneck |
+| `plan-llm-cost-guardrails` | Model-token spend, not HTTP concurrency |
+
+Load against production only with explicit sign-off and rate caps — an uncapped run is a self-inflicted outage. Prefer prod-like staging.
+
+## How to reason
+
+1. **Observe** — profile, VUs, p95/p99, error types, host/DB metrics
+2. **Interpret** — SLO miss vs capacity vs cascade (pool / limiter / memory)
+3. **Classify** — pass / degrade / breaking-point / invalid (unsigned prod)
+4. **Severity** — named failing resource + whether failure is graceful
+
+## Worked example
+
+> **Observe:** load profile 200 VU, p95 2.4s (SLO 500ms), 8% 529s; DB
+> `remaining connections = 0`.
+> **Interpret:** pool exhaustion, not the Node process.
+> **Classify:** SLO fail; breaking resource = DB pool.
+> **Handoff:** `backend-db-performance` (pool + queries); numbers → `audit-infra-cost`.
+
+---
+
+## Phase 0 — Detect stack and set targets  [HIGH freedom]
+
+- Tool: **k6** preferred (scriptable, CI-friendly); Artillery as fallback
+- Target env + auth method
+- **Goal first** (without it the test is noise):
+  - Expected peak concurrency (ads / launch)
+  - Acceptable p95/p99 and max error rate (SLO)
+  - Capacity (hold at peak) vs breaking point (where it fails)
+
+---
+
+## Phase 1 — Model realistic load  [HIGH freedom]
+
+- **Journeys, not one URL** — signup → browse → action, with think-time
+- **Mix** — weight by real traffic (mostly reads)
+- **Data variety** — pool of users/inputs, not one cached row
+- **Auth** — real login or pre-provisioned tokens (unauthenticated misses RLS cost)
+
+---
+
+## Phase 2 — Graduated profiles  [LOW freedom — smoke → load → stress → spike]
+
+1. **Smoke** — few VUs; script + baseline healthy
+2. **Load** — ramp to expected peak, soak several minutes (SLO pass/fail)
+3. **Stress** — past peak until degrade; name the failing resource
+4. **Spike** — instant jump (viral ad); does it recover?
+5. Optional **soak** — 30+ min for leaks / pool exhaustion
+
+---
+
+## Phase 3 — Measure the right things  [HIGH freedom]
+
+- Latency **percentiles** (p50/p95/p99) — averages hide pain
+- Error rate **and types** (timeout vs 5xx vs refused)
+- Throughput (req/s) per level
+- Bottleneck: DB pool, function concurrency, rate limiter, memory, cold start
+- Correlate Supabase / Sentry / host metrics during the run
+
+Keep the reusable script in the repo as a reviewable change (commit only when asked). Hand capacity numbers to `audit-infra-cost`.
+
+---
+
+## Definition of Done
+
+- [ ] Tool + env chosen; prod excluded or signed + capped
+- [ ] SLO stated before running
+- [ ] Journeys weighted, think-time, varied data, real auth
+- [ ] Smoke → load → stress → spike run
+- [ ] Percentiles, errors, throughput captured
+- [ ] Breaking point + failing resource named
+- [ ] SLO verdict + fix handoff
+- [ ] Script in the repo, ready to commit
+
+## Self-critique before reporting  [LOW freedom — do not skip]
+
+1. **SLO stated first** — a run without a target is noise
+2. **Not unsigned prod** — if only prod exists, stop
+3. **Percentiles, not averages**
+4. **Breaking resource named** — not "it got slow"
+5. **Journeys, not one URL**
+
+## Output format
+
+1. **Design** — SLO, journeys, env, profiles
+2. **Results** — profile | VUs | throughput | p50/p95/p99 | errors | vs SLO
+3. **Breaking point** — where, why, graceful vs cascade
+4. **Handoff** — `backend-db-performance`, `backend-patterns`, `audit-resilience`, `audit-infra-cost`
+
+## Related
+
+- `audit-resilience` — code-level NFRs
+- `audit-infra-cost` — right-size from these numbers
+- `backend-db-performance` / `backend-patterns` — fix the named bottleneck
+- `audit-performance` — single-user frontend

package/skills/test-mutation/SKILL.md

@@ -0,0 +1,160 @@
+---
+name: test-mutation
+description: >
+  Run mutation testing (StrykerJS, mutmut) to measure whether tests assert
+  behavior, not just execute lines. Use when "add mutation testing", "are our
+  tests real", "can our test suite be gamed", or after an agent bulk-generated
+  tests.
+license: MIT
+---
+
+# test-mutation — Coverage proves the test ran; mutants prove it would notice
+
+**Degree of freedom: MIXED** — scope and triage `[HIGH freedom]`; first run
+and CI floor `[LOW freedom — measure, then ratchet]`. Never start with the
+whole repo.
+
+Install and run the gate coverage cannot close. **Coverage proves the test
+*ran* the code; mutation testing proves the test would *notice* if the
+code were wrong.** The tool makes hundreds of small deliberate bugs
+(mutants) — flip `>` to `>=`, delete a statement, replace a return — and
+reruns the tests. Survivors mark code the tests execute but verify
+nothing.
+
+This is the specific counter to agent-generated suites: an agent can
+trivially produce 90% coverage with no meaningful assertions, and every
+coverage ratchet will wave them through. Mutants do not care about
+coverage theater.
+
+## This skill vs neighbors
+
+| Skill | Owns |
+|---|---|
+| **test-mutation** (this) | Install / run / triage mutation testing; score ratchet |
+| `plan-test-coverage` | What *should* be tested — plan only, no harness |
+| `test-unit` | Write the tests |
+| `audit-gate-logic` / `housekeep-gates` | Ratchet policy this score plugs into |
+| `enhance-agent-guardrails` | Wording of the agent-rule hook |
+
+## How to reason (every survivor)
+
+1. **Observe** — mutant (operator/line) and which tests still passed
+2. **Interpret** — missing assertion, untested branch, dead code, or equivalent?
+3. **Classify** — the four triage classes in Phase 2
+4. **Severity** — blast radius: entitlements/auth/money outrank formatters
+
+## Worked example
+
+> **Observe:** Stryker flipped `>` to `>=` in `entitlements.ts` expiry check;
+> suite green; mutation score 62% on a 94% coverage file.
+> **Interpret:** tests execute the line but never assert the boundary.
+> **Classify:** missing assertion.
+> **Severity:** high — paid access could extend a day.
+> **Fix:** assert expired-at-exact-boundary is denied; then re-run incremental.
+
+---
+
+## Phase 0 — Detect stack and scope deliberately  [HIGH freedom]
+
+Identify the runner and pick the tool: **StrykerJS** (Jest / Vitest /
+Mocha, TS-aware), **mutmut** / cosmic-ray (Python), or the ecosystem
+built-in. Then scope — this step decides whether mutation testing
+*survives* in the repo:
+
+**Never start with the whole repo.** Each mutant is a test run. A 6-hour
+first run gets the tool deleted. Scope the first pass to where a silent
+bug costs most: money movement, auth, entitlements, data mutation, core
+business logic. Explicitly exclude: generated code, config, type-only
+files, UI glue better covered by `test-visual-regression`, and third-party
+wrappers.
+
+Record the suite's baseline runtime. Mutation runtime ≈ (mutants ×
+affected-test runtime). Turn on per-test coverage analysis from day one
+so only tests covering the mutated line rerun.
+
+---
+
+## Phase 1 — Configure for signal, not noise  [HIGH freedom]
+
+- **Mutate patterns:** scoped critical paths only, via `mutate:` globs.
+- **Incremental mode on** (Stryker `--incremental`): later runs only
+  re-test mutants in changed code — this is what makes per-PR runs
+  feasible.
+- **Thresholds:** `high` / `low` for reporting, and `break` (CI-failing
+  floor) at or slightly below the *measured* first score. Never invent an
+  aspirational floor; measure, then ratchet. Same
+  auto-tighten-with-reviewed-resets policy as `housekeep-gates`.
+- **Timeouts:** mutants that loop are killed by timeout — keep the factor
+  sane or runs balloon.
+- **Reporters:** HTML for humans (each survivor in context), JSON for the
+  ratchet.
+
+---
+
+## Phase 2 — First run and triage the survivors  [LOW freedom — classify every survivor]
+
+Run, then classify every surviving mutant — this triage **is** the
+deliverable:
+
+1. **Missing assertion** — the test executes the line but asserts nothing
+   about its effect. Fix: strengthen the test. Each of these is a hole a
+   bug could walk through today.
+2. **Untested branch** — no test reaches the mutated logic despite
+   file-level coverage. Fix: add the case (hand to `plan-test-coverage`).
+3. **Dead / vestigial code** — the mutant survives because the code has
+   no observable effect. Fix: delete the code, not add a test
+   (`workflow-housekeep`).
+4. **Equivalent mutant** — the mutation does not change behavior (e.g.
+   `<` vs `<=` on a boundary that cannot occur). No test can kill it;
+   mark ignored with a comment. Expect a small percentage; a large one
+   means the mutator is mutating the wrong things.
+
+Prioritize by blast radius: a survivor in `entitlements.ts` outranks
+fifty in a formatting helper.
+
+---
+
+## Phase 3 — Wire into CI (sustainably)  [HIGH freedom; floor from measured score = LOW]
+
+- **Per-PR:** incremental mutation on changed files only, as a job wired
+  into the aggregator gate (`housekeep-gates`).
+- **Scheduled full run** (nightly / weekly) over the mutated scope;
+  publishes the score, updates the ratchet floor upward per policy, and
+  files the new-survivor list.
+- **Score ratchet:** `break` rises as the score does (flake tolerance);
+  lowering it is a separate reviewed PR, never bundled.
+- **Agent-rule hook:** bulk-generated tests must pass a mutation run over
+  the touched files before "done" counts. `enhance-agent-guardrails`
+  installs the wording.
+
+---
+
+## Definition of Done
+
+- [ ] Tool chosen for the stack; per-test coverage analysis enabled
+- [ ] Scope limited to critical paths with exclusions recorded; whole-repo explicitly deferred
+- [ ] Incremental mode on; timeouts and reporters configured
+- [ ] First run complete; baseline mutation score recorded
+- [ ] Every survivor triaged into missing-assertion / untested-branch / dead-code / equivalent, with fixes filed by class
+- [ ] `break` threshold set from the measured score and wired to auto-tighten; resets require a separate reviewed PR
+- [ ] Per-PR incremental job in the aggregator gate; scheduled full run publishing the score
+- [ ] Agent-rule hook added: generated tests validated by mutation before done
+- [ ] Total added CI time measured and reported
+
+## Self-critique before reporting  [LOW freedom — do not skip]
+
+1. **Scope was narrow** — whole-repo first run is a failure mode, not a flex
+2. **Every survivor classified** — no "look at the HTML later"
+3. **Floor measured** — `break` from the first score, not an aspiration
+4. **Right owner** — write the missing test → `test-unit`; delete dead code → `plan-dead-code` → `housekeep-dead-code`
+5. **Strengthen tests only on approval**
+
+## Output format
+
+1. **Scope & config** — mutated paths | exclusions | tool + modes
+2. **Score report** — baseline mutation score | per-module breakdown | coverage-vs-mutation gap (high coverage + low mutation score = assertion theater)
+3. **Survivor triage** — mutant | file:line | class | fix filed
+4. **CI wiring** — PR job, scheduled run, ratchet policy
+
+Implement the harness and triage. Strengthen tests only on approval —
+each fix is a reviewable change.

package/skills/test-playwright/SKILL.md

@@ -0,0 +1,354 @@
+---
+name: test-playwright
+description: >
+  Close the PDCA loop on this session's diff. Headed playwright-cli, fix as
+  you go. Use when "test my changes", "PDCA this". Pixel diffs →
+  test-visual-regression. Story CRUD → test-qa. Monkey / guest vs logged-in
+  → test-exploratory.
+license: MIT
+---
+
+# test-playwright — Develop → Test → Fix (PDCA)
+
+**Degree of freedom: MIXED** — blast-radius and UX judgment `[HIGH freedom]`;
+session, anti-stall, and live re-test after each fix `[LOW freedom — run exactly]`.
+Driver is **playwright-cli**, never Playwright MCP.
+
+The job is not done when the code compiles. It is done when you have driven the live app as a user, found what's broken or clunky, and **fixed it** — Check and Act are the deliverable.
+
+> **Plan** = the change you just made. **Do** = already in the code.
+> **Check** = drive the live app (this skill). **Act** = fix every pain
+> point in the same turn.
+
+Your turn ends after Phase 7, or at a BLOCKED item that needs the user's decision — not with PAIN found and unfixed, and not with a fix that has not been re-driven live.
+
+Read `protocol-browser-anti-stall` before any browser action — Rule 0
+(manual & headed), navigation guard, ≤3s waits, fresh `snapshot` after every
+state change, max-4-attempts-per-goal, tab discipline, and persisted auth
+(`references/playwright-session-coordination.md`).
+
+## This skill vs neighbors
+
+| Skill | Owns |
+|:------|:-----|
+| **test-playwright** (this) | This-diff + blast radius; **fix as you go** |
+| `test-qa` | Full-app story/CRUD smoke — not this session's diff |
+| `test-exploratory` | Unscripted **guest vs authed** wander (do not reclaim) |
+| `test-red-team` | Hostile feature×dimension matrix; report first |
+| `test-visual-regression` | Pixel baselines |
+
+## How to reason (each surface)
+
+1. **Observe** — screenshot + console + network vs this session's diff
+2. **Interpret** — broken / data-wrong / pipeline / friction / visual / a11y
+3. **Classify** — PASS / PAIN (fix now) / BLOCKED (needs decision)
+4. **Severity** — ship-blocker vs polish; Act now unless risky/out-of-scope
+
+## Worked example
+
+> **Observe:** create item → toast "Saved"; `requests` shows POST 500; list
+> empty after `reload`. Diff touched the create action.
+> **Interpret:** optimistic UI over a failed write.
+> **Classify:** PAIN — pipeline lie. Fix the action, then re-drive.
+> **Severity:** ship-blocker.
+> **Act:** fix the handler; re-test until 2xx + persist + clean console.
+
+## Core principles
+
+- **Drive a visible browser by hand, never a script.** Headed (never
+  `--headless`). One real action at a time. `eval` / `run-code`
+  inspection-only; no `*.spec.ts`, no `npx playwright test`.
+- **Test only what this session changed — plus its blast radius.** Not a
+  full-app crawl (`test-qa`). Not guest-vs-logged-in wander
+  (`test-exploratory`).
+- **Fix as you go — full-stack.** Bug, 500, dead button, ugly layout →
+  root cause now, then re-test. Don't batch "later".
+- **Evidence or it didn't happen.** Finding = screenshot + console +
+  network. Fix = live re-test against the real backend.
+- **Red-team your own work.** Assume the change is subtly wrong. Try to
+  break it.
+
+---
+
+## Workflow checklist
+
+```
+PDCA Progress:
+- [ ] Phase 1: Scope — what did this session change? (blast radius)
+- [ ] Phase 2: Environment — dev server up, app loads, authenticated
+- [ ] Phase 3: Walk the changed flows as a real user
+- [ ] Phase 4: Fix pain points + errors as you find them (full-stack)
+- [ ] Phase 5: Backend truth-check (Sentry / Supabase / logs)
+- [ ] Phase 6: Red-team + critique + enhancement ideas
+- [ ] Phase 7: Re-test everything you fixed; report
+```
+
+---
+
+## Phase 1: Scope the session changes  [HIGH freedom]
+
+Scope is this session's diff plus its blast radius; full-app coverage belongs to `test-qa`.
+
+1. **Get the diff** (each workspace repo root if needed):
+
+```bash
+git status --short
+git diff --stat HEAD
+git diff HEAD --name-only
+```
+
+2. **Map files → user-facing surfaces.**
+   - Page/route → test that page.
+   - Shared component/hook/util → every importer (`grep -rl "ComponentName" src/`) — the **blast radius**.
+   - API / controller / service → every UI flow that calls it.
+   - Migration / schema / RLS → read AND write paths, as the client's role.
+   - Config / env / pricing / prompt → the feature it drives.
+
+3. **Stack & dev URL** (only what you need): `scripts.dev` port; auth +
+   test credentials (`.env.local`, `.env.test`, README — ask once if none);
+   backend MCPs this session: Supabase, Sentry, Firecrawl.
+
+4. **Write the test plan** before opening the browser:
+
+```
+SESSION SCOPE:
+- Repos touched: [list]
+- Changed surfaces (pages/flows): [list]
+- Blast radius (shared code → consumers): [list]
+- Backend paths touched (APIs/tables/RPCs): [list]
+- Dev URL: http://localhost:[port] Auth: [method / test account]
+- User journeys to drive: [ordered list of 2–6 real flows]
+```
+
+---
+
+## Phase 2: Environment verification  [LOW freedom — session exact]
+
+Read `protocol-browser-anti-stall/references/playwright-session-coordination.md`
+before opening the browser.
+
+```bash
+PW="npx --yes @playwright/cli@latest"
+```
+
+1. Check `terminals/` for a running dev server. If none, start it
+   (`block_until_ms` sized to startup) or tell the user and stop.
+2. Name the session after the task (`-s=qa-<feature>`). Never reuse another
+   agent's name.
+3. `$PW -s=qa-<feature> open --headed <dev-url>` — add
+   `--persistent --profile "$HOME/.playwright-cli-profiles/<app>"` when
+   login is needed.
+4. Anti-stall: `sleep 2` → `snapshot` → verify content rendered.
+5. `console` + `requests` → baseline before the changed feature.
+6. **Auth (log in once, by hand — it persists):**
+   - Protected route → already signed in? continue. `--persistent --profile`
+     survives turns.
+   - Else complete login **in the visible window**. Verify a protected route.
+   - **Google accounts cannot sign in from a Playwright-launched browser** —
+     one-time real-Chrome login in the coordination reference.
+   - Lighter alternative: `state-save` / `state-load`
+     `.playwright-mcp/auth/<host>.json`.
+   - Do **not** log out unless testing logout.
+7. `$PW -s=qa-<feature> close` when the run is done.
+
+---
+
+## Phase 3: Walk the changed flows as a real user  [HIGH freedom; cycle = LOW]
+
+For each Phase 1 journey, live it. Per step (anti-stall throughout):
+
+```bash
+S="-s=qa-<feature>"
+$PW $S goto "<url>"
+sleep 2 && $PW $S snapshot
+$PW $S screenshot --filename ".playwright-mcp/<step>.png"
+$PW $S click <ref>          # one action: click / type / fill / select / …
+$PW $S snapshot             # FRESH refs after every interaction
+$PW $S console
+$PW $S requests
+```
+
+Then judge: WORK + feel GOOD? PASS or PAIN POINT.
+
+| Category | Look for |
+|----------|----------|
+| **Broken** | Blank, error boundary, 404/500, stuck spinner, dead button, no-op submit |
+| **Data wrong** | `undefined` / `null` / `NaN` / `[object Object]` / `Invalid Date`, bad totals, stale after mutation |
+| **Pipeline** | UI shows change but API failed; create missing until refresh; deleted item returns; optimistic never confirms |
+| **Validation** | Empty/invalid submit silent; no inline errors; silent backend reject |
+| **UX friction** | Confusing copy, no loading/success/error, hidden primary, too many clicks |
+| **Visual** | Overflow, cramped/wasted space, broken images/icons, dark-mode, layout shift |
+| **A11y basics** | Unlabeled inputs, unnamed controls, invisible focus, low contrast |
+
+**Mutations E2E:** after create/update/delete confirm (a) network 2xx, (b) UI
+reflects it, (c) survives hard `reload`, (d) if Supabase MCP — the row
+changed. Prefix test data `QA-TEST-` and clean it up.
+
+---
+
+## Phase 4: Fix pain points and errors — as you go  [HIGH freedom; re-test = LOW]
+
+Fix the root cause before moving on.
+
+1. **Diagnose to root cause** — don't patch symptoms.
+   - Frontend → component/hook/state.
+   - 4xx/5xx → payload + backend log; controller/service/validation.
+     FE↔BE mismatch → `debug-fe-be-integration` mindset.
+   - `relation does not exist` / missing column → migration not deployed.
+     **Deploy via Supabase MCP** (`apply_migration` for DDL, `execute_sql`
+     for data) AND keep the versioned file on disk. (`full-stack-ship-discipline`
+     — requested schema ships; `DELETE`/`UPDATE`/`TRUNCATE` on real rows asks.)
+   - RLS → verify as the client's role (`SET ROLE anon;` / `authenticated;`),
+     fix policy, re-verify.
+   - Config/env/CORS → fix and note other environments.
+2. **Apply** surgically — change the lines the fix needs, not whole files. Run diagnostics on the files you edited (`ReadLints` in Cursor; the repo's lint/typecheck in Claude Code).
+3. **Re-drive the same flow** — green console, 2xx, correct UI, persisted
+   data. A fix is not done until re-tested live.
+4. Genuinely out of scope or risky → STOP and surface it; don't silently
+   ship a broken flow.
+
+```
+FIX LOG:
+- [surface] [symptom] → root cause: [...] → fix: [file(s)] → re-test: PASS/▢
+```
+
+---
+
+## Phase 5: Backend truth-check (full-stack)  [HIGH freedom]
+
+Don't trust the UI alone. Look up MCP schemas first.
+
+**Sentry** — new/related production errors on touched surfaces:
+
+```json
+sentry:search_issues
+{
+ "organizationSlug": "<ORG>", "query": "unresolved issues in the last 7 days",
+ "projectSlugOrId": "<PROJECT>", "regionUrl": "<REGION_URL>", "limit": 25
+}
+```
+
+`analyze_issue_with_seer` on anything that maps to your change. Resolve
+(`update_issue`) only AFTER a verified fix; it needs the Triage skill on the
+Sentry MCP connection, so resolve in the Sentry UI if the tool is missing.
+
+**Supabase** — `list_tables`, `execute_sql`, `query_logs` (API:
+`source = 'edge_logs'`; Postgres: `source = 'postgres_logs'`), `get_advisors`.
+New ERROR advisors from your change are in scope. Confirm
+deployed migrations on the remote (`information_schema` / `pg_proc` / `pg_policies`).
+
+**App logs / terminal** — server stack traces that never reached the browser.
+
+---
+
+## Phase 6: Red-team and critique  [HIGH freedom]
+
+Skeptical reviewer + demanding user, **on the changed surfaces only**.
+Full-app hostile matrix → `test-red-team`. Guest wander → `test-exploratory`.
+
+- **Break it:** double-submit, rapid toggle, back/forward, deep links, empty
+  states, huge inputs, special chars (`<script>`, `'; DROP TABLE`, emoji),
+  slow/failed network.
+- **Question the UX:** primary action obvious in 3s? Feedback immediate?
+  Would a real user get stuck? Deep polish → `enhance-web-ux` / `enhance-web-ui`.
+- **Question the design:** match existing tokens/patterns, or drift?
+- **Research when unsure:** Firecrawl `firecrawl_search` for current
+  pattern/feature best practices; map back to concrete changes.
+
+Capture **enhancement ideas** — concrete: what, why, effort. Distinguish
+"fix now" (Phase 4) from "suggested next" (report).
+
+---
+
+## Phase 7: Re-test and report  [LOW freedom — do not skip]
+
+1. Re-drive every fixed flow end to end. Confirm green.
+2. Clean up `QA-TEST-` data; reset settings; verify cleanup in DB if applicable.
+3. Report:
+
+```markdown
+## PDCA Test Report — [feature / session summary]
+
+### Scope (what this session changed)
+- Repos: [...] Surfaces tested: [...] Backend paths: [...]
+- Dev URL: [...] Auth: [...]
+
+### Flows driven (as a user)
+| # | Journey | Result | Evidence |
+|---|---------|--------|----------|
+| 1 | [...] | PASS / FIXED / BLOCKED | [screenshot/console/network] |
+
+### Fixed this turn (Act)
+| # | Surface | Symptom | Root cause | Fix (files) | Re-tested |
+|---|---------|---------|-----------|-------------|-----------|
+| 1 | [...] | [...] | [FE/BE/DB/config] | [...] | ✅ |
+
+### Still broken / out of scope (needs decision)
+| # | Surface | Finding | Why not fixed | Recommendation |
+|---|---------|-------|---------------|----------------|
+
+### Backend truth-check
+- Sentry: [new/related issues + status]
+- Supabase: [schema/data/logs/advisors — migration deployed? Y/N]
+
+### Red-team findings
+| # | Surface | Severity | Finding | Evidence |
+|---|---------|----------|---------|----------|
+
+### Enhancement suggestions (Plan the next cycle)
+1. [concrete idea] — why it helps — rough effort
+
+### Verdict
+**Ship / Ship after fixes / Not ready** — [1–2 sentence justification]
+Console clean: [Y/N] · All flows green on re-test: [Y/N] · Test data cleaned: [Y/N]
+```
+
+## Self-critique before reporting  [LOW freedom — do not skip]
+
+1. **Scope** — this-diff + blast radius, not full-app (`test-qa`) or guest wander
+2. **Driver** — playwright-cli, headed, named session; never Playwright MCP
+3. **Act** — every PAIN fixed or explicitly blocked; live re-test after each fix
+4. **Evidence** — finding = screenshot+console+network; fix = green re-drive
+5. **Honest verdict** — red console or unfixed PAIN ≠ Ship
+
+---
+
+## playwright-cli commands
+
+`PW="npx --yes @playwright/cli@latest"`, then `$PW -s=<session> <command>`.
+Snapshot/ref-based; sessions are isolated — re-`snapshot` after each state
+change. **Headless by default — pass `--headed` on `open`.**
+
+**Drive:** `open --headed`, `goto`, `go-back`, `click`, `type`, `fill`,
+`select`, `check`, `uncheck`, `hover`, `drag`, `drop`, `press`, `upload`,
+`dialog-accept`, `resize`.
+
+**Observe:** `snapshot`, `find`, `screenshot --filename .playwright-mcp/<name>.png`,
+`console`, `requests`, `request <n>`.
+
+**Wait:** `sleep N` (shell, ≤3s) or
+`run-code "async (page) => { await page.getByText('X').first().waitFor({ timeout: 5000 }); }"`.
+
+**Inspection-only:** `eval`, `run-code`.
+
+Old MCP → CLI map: `protocol-browser-anti-stall/references/mcp-to-cli-map.md`.
+
+---
+
+## Guardrails
+
+1. **Manual & headed, never scripted** — visible browser; no `*.spec.ts`,
+   no `npx playwright test`. Anti-stall Rule 0.
+2. **Scope discipline** — session changes + blast radius. Full-app → `test-qa`.
+3. **Own your session** — every command `-s=<task>`; never `close-all` /
+   `kill-all` sessions you didn't open.
+4. **Auth reuse** — log in once into `--persistent --profile`; don't log out
+   unless testing logout.
+5. **Anti-stall always** — never block >3s; max 4 attempts; `[TIMEOUT]` and skip.
+6. **Fix the root cause, full-stack** — UI, API, DB, config; re-test live.
+7. **Schema in sync** — MCP changes get a versioned migration file; verify remote.
+8. **Ask before mutating real data** — requested DDL ships; prod row
+   `DELETE`/`UPDATE`/`TRUNCATE` asks first.
+9. **No secrets in chat** — `.env*` by name only.
+10. **Evidence** — screenshot + console + network + a green re-test.
+11. **Honest verdict** — don't declare done with a red console or unfixed PAIN.