@martinffx/atelier 1.0.2 → 1.2.0

package/skills/code-debug/references/bug-patterns.md

@@ -0,0 +1,71 @@
+# Common Bug Patterns
+
+Quick reference for recognising and fixing recurring bug categories.
+
+---
+
+## Null/Undefined Errors
+
+**Symptoms:** Cannot read property X of undefined
+
+**Debug approach:**
+1. Find where the value becomes undefined
+2. Trace back where it should come from
+3. Add guard or fix source
+
+**Fix patterns:**
+```javascript
+// Before
+const name = user.profile.name;
+
+// After
+const name = user?.profile?.name ?? 'Unknown';
+// or
+if (!user?.profile) return;
+const name = user.profile.name;
+```
+
+---
+
+## Race Conditions
+
+**Symptoms:** Intermittent failures, flaky tests
+
+**Debug approach:**
+1. Identify async operations
+2. Find timing dependencies
+3. Add delays or force ordering to confirm
+
+**Fix patterns:**
+- Use async/await properly
+- Add proper synchronization
+- Consider immutable state
+
+---
+
+## Logic Errors
+
+**Symptoms:** Wrong output, wrong behaviour
+
+**Debug approach:**
+1. Trace through the logic manually
+2. Compare expected vs actual at each step
+3. Find the first step that diverges
+
+**Fix patterns:**
+- Fix the condition
+- Correct the calculation
+- Update the state correctly
+
+---
+
+## Performance Issues
+
+**Symptoms:** Slow, memory leaks, timeouts
+
+**Debug approach:**
+1. Measure first (don't guess)
+2. Identify hot paths
+3. Optimize the bottleneck
+
+**See also:** Phase 4 "Perf branch" in SKILL.md for the disciplined approach.

package/skills/code-debug/references/techniques.md

@@ -13,8 +13,8 @@
 **Do:**
 - Print at function entry/exit to trace execution
 - Print variable values at key decision points
-- Use descriptive labels: console.log('userId:', userId)
-- Print full objects for inspection: console.log(JSON.stringify(data, null, 2))
+- Use descriptive labels: `console.log('userId:', userId)`
+- Print full objects for inspection: `console.log(JSON.stringify(data, null, 2))`
 
 **Don't:**
 - Leave print statements in production code
@@ -22,9 +22,25 @@
 - Over-print (noise obscures signal)
 - Print in tight loops (use breakpoints instead)
 
-### Structured Logging
+### Tagged Debug Logs
 
-Better than console.log for production:
+When instrumenting during a debugging session, tag every temporary log with a
+unique prefix so cleanup is trivial:
+
+```javascript
+console.log('[DEBUG-a4f2] userId:', userId);
+console.log('[DEBUG-a4f2] payload:', payload);
+```
+
+Cleanup: `grep -r '\[DEBUG-' .` → delete all matches.
+
+Untagged logs survive; tagged logs die.
+
+---
+
+## Structured Logging
+
+Better than `console.log` for production:
 
 ```javascript
 const logger = {
@@ -115,3 +131,27 @@ logger.error('Request failed', {
 | INFO | Normal operation events |
 | WARN | Something unexpected, but handled |
 | ERROR | Operation failed |
+
+---
+
+## Performance Regression Techniques
+
+### The Perf Branch
+
+For performance regressions, logs are usually wrong. Instead:
+
+1. **Establish a baseline measurement** using one of:
+   - Timing harness around the suspect code path
+   - `performance.now()` in browser / `process.hrtime()` in Node
+   - CPU profiler (Chrome DevTools, `node --prof`, py-spy, etc.)
+   - Database query planner (`EXPLAIN ANALYZE`)
+
+2. **Bisect** — narrow down which commit / change introduced the regression.
+
+3. **Measure first, fix second.** Do not optimise without data.
+
+### Hot Path Identification
+
+- Profile before guessing
+- Look for O(n²) algorithms, unnecessary renders, blocking operations
+- Check for N+1 queries, unbounded caches, recursive without memoisation

package/skills/code-handoff/SKILL.md

@@ -0,0 +1,16 @@
+---
+name: code-handoff
+description: Compact the current conversation into a handoff document for another agent to pick up.
+argument-hint: "What will the next session be used for?"
+user-invocable: true
+---
+
+Write a handoff document summarising the current conversation so a fresh agent can continue the work. Save to the temporary directory of the user's OS - not the current workspace.
+
+Include a "suggested skills" section in the document, which suggests skills that the agent should invoke.
+
+Do not duplicate content already captured in other artifacts (PRDs, plans, ADRs, issues, commits, diffs). Reference them by path or URL instead.
+
+Redact any sensitive information, such as API keys, passwords, or personally identifiable information.
+
+If the user passed arguments, treat them as a description of what the next session will focus on and tailor the doc accordingly.

package/skills/code-review/references/reviewers.md

@@ -97,8 +97,6 @@ Output findings in this format:
 - **Pre-existing**: Yes/No (check if existed before this PR)
 ```
 
-Loads: `code-security` (if exists)
-
 ---
 
 ### Performance Reviewer
@@ -128,8 +126,6 @@ Output findings in this format:
 - **Pre-existing**: Yes/No
 ```
 
-Loads: `code-perf` (if exists)
-
 ---
 
 ### Correctness Reviewer
@@ -532,8 +528,6 @@ Each reviewer should load relevant skills before reviewing:
 
 | Reviewer Type | Skills to Load |
 |---------------|----------------|
-| Security | `code-security` |
-| Performance | `code-perf` |
 | Correctness | Language-specific (`typescript-testing`, `python-testing`, etc.) |
 | Maintainability | Testing skills |
 | Architecture | `oracle-architect` |
@@ -580,10 +574,9 @@ prompt: |
 
   YOUR FIRST TASK - LOAD SKILLS:
   As a Security Reviewer, you should load relevant skills before reviewing:
-  1. Load `skill: code-security` - Use the `skill` tool
-  2. Load `skill: typescript-testing` (if available) - Use the `skill` tool
+  1. Load `skill: typescript-testing` (if available) - Use the `skill` tool
 
-  These skills contain security patterns and TypeScript testing guidance that will help you identify issues.
+  This skill contains TypeScript testing guidance that will help you identify issues.
 
   Focus areas after loading skills:
   - Authentication and authorization flaws
@@ -663,8 +656,7 @@ prompt: |
 
   YOUR FIRST TASK - LOAD SKILLS:
   As a PerformanceOperator Reviewer, you should load relevant skills before reviewing:
-  1. Load `skill: code-perf` (if available) - Use the `skill` tool
-  2. Load `skill: typescript-testing` (if available) - Use the `skill` tool
+  1. Load `skill: typescript-testing` (if available) - Use the `skill` tool
 
   Focus areas after loading skills:
   - Performance issues that matter in prod

package/skills/code-review/references/rq.md

@@ -62,8 +62,7 @@ prompt: |
   4. **Identify skills to load** based on detected language/framework:
      - TypeScript → typescript-testing, typescript-fastify (if fastify framework)
      - Python → python-testing, python-fastapi (if fastapi framework)
-     - Security concerns → code-security
-     - Performance concerns → code-perf
+     
 
   Return ONLY valid JSON (no markdown, no code blocks):
   {
@@ -73,7 +72,7 @@ prompt: |
       "domain": "web-api|frontend|database|..."
     },
     "reviewers": ["Security", "Correctness"],
-    "skills_to_load": ["typescript-testing", "code-security"]
+    "skills_to_load": ["typescript-testing"]
   }
 ```
 
@@ -83,7 +82,7 @@ prompt: |
 {
   "context": { "language": "typescript", "framework": "fastify", "domain": "web-api" },
   "reviewers": ["Security", "Correctness", "PerformanceOperator"],
-  "skills_to_load": ["typescript-testing", "code-security"]
+  "skills_to_load": ["typescript-testing"]
 }
 ```
 
@@ -102,7 +101,7 @@ prompt: |
 Before dispatching reviewers, the detected skills are passed to each reviewer:
 ```json
 {
-  "skills_to_load": ["typescript-testing", "code-security"]
+  "skills_to_load": ["typescript-testing"]
 }
 ```
 

package/skills/oracle-architect/SKILL.md

@@ -6,6 +6,24 @@ user-invocable: false
 
 # Architect Skill
 
+## Glossary
+
+Precise vocabulary for every architectural decision. Use these terms exactly — consistency is the point.
+
+- **Module** — anything with an interface and an implementation (function, class, package, layer). Router, Service, Entity, and Repository are all modules.
+- **Interface** — everything a caller must know to use the module: types, invariants, error modes, ordering, config. Not just the type signature.
+- **Seam** — where a module's interface lives; a place behaviour can be altered without editing in place. The functional core / effectful edge boundary is the primary seam.
+- **Depth** — leverage at the interface. A module is **deep** when a lot of behaviour sits behind a small interface. A module is **shallow** when the interface is nearly as complex as the implementation.
+- **Adapter** — a concrete thing satisfying an interface at a seam. A Postgres repository is an adapter; an in-memory fake for testing is another adapter at the same seam.
+- **Leverage** — what callers get from depth: more capability per unit of interface they learn.
+- **Locality** — what maintainers get from depth: change, bugs, and knowledge concentrate in one place.
+
+Key principles (apply to every decision):
+
+- **The deletion test.** Imagine deleting the module. If complexity vanishes, it was a pass-through. If complexity reappears across N callers, it was earning its keep.
+- **The interface is the test surface.** Callers and tests cross the same seam. If you want to test past the interface, the module is probably the wrong shape.
+- **One adapter = hypothetical seam. Two adapters = real seam.** Don't introduce a seam unless something actually varies across it.
+
 Domain-Driven Design and hexagonal architecture with functional core pattern for feature design.
 
 ## Architecture Model
@@ -25,6 +43,68 @@ Unified view of functional core and effectful edge:
 
 **Key Principle:** Business logic lives in the functional core (Service + Entity). IO operations live in the effectful edge. Core defines interfaces; edge implements them (dependency inversion).
 
+## Evaluating Architecture Decisions
+
+Before creating a new module, run these checks:
+
+### Deletion Test
+
+> *Imagine deleting the module. If complexity vanishes, it was a pass-through. If complexity reappears across N callers, it was earning its keep.*
+
+**When to apply:** Before extracting a new Service, Repository, or utility class.
+
+**Example:**
+```
+❌ Shallow: OrderFormatterService with 1 method per field
+   → Deleting it just moves 6 lines into the Router
+   → Interface is as complex as implementation
+
+✅ Deep: OrderService with validate → reserve → save → publish
+   → Deleting it replicates orchestration across N handlers
+   → Small interface (createOrder), large implementation
+```
+
+### Interface as Test Surface
+
+> *Callers and tests cross the same seam. If you want to test past the interface, the module is probably the wrong shape.*
+
+**Implication:**
+- Unit tests for Entities test the public interface (validate, transform)
+- Unit tests for Services test through the seam with stub repositories
+- Integration tests for Repositories test the actual adapter
+- If you find yourself testing "internal" methods, the module needs redrawing
+
+### Adapter Rule
+
+> *One adapter = hypothetical seam. Two adapters = real seam.*
+
+**When to apply:** Deciding whether to extract an interface.
+
+**Examples:**
+```typescript
+// ❌ Hypothetical seam — only one adapter exists
+interface IEmailClient { send(email: Email): Promise<void>; }
+class SendgridClient implements IEmailClient { ... }
+// No second adapter. The interface adds indirection without value.
+
+// ✅ Real seam — two adapters exist
+interface IOrderRepository { save(order: Order): Promise<Order>; }
+class PostgresOrderRepository implements IOrderRepository { ... }
+class InMemoryOrderRepository implements IOrderRepository { ... } // for tests
+// The seam earns its keep because callers vary (production vs test).
+```
+
+### Depth Check
+
+Prefer deep modules over shallow ones:
+
+| Module | Interface Size | Implementation | Depth |
+|--------|--------------|----------------|-------|
+| `OrderValidator` | 3 methods (validate, validateItems, validateAddress) | 30 lines each | Shallow |
+| `Order` (entity) | 4 methods (fromRequest, toRecord, toResponse, validate) | 200 lines of rules, transforms, invariants | **Deep** |
+
+**Rule of thumb:** A module's interface should hide at least 3x the complexity it exposes.
+
 ## Functional Core
 
 Pure, deterministic components containing all business logic.
@@ -241,6 +321,7 @@ The testing skill uses architectural structure to determine:
 
 For detailed patterns and examples:
 
-- **See [references/ddd-patterns.md](references/ddd-patterns.md)** - Aggregates, Value Objects, Domain Events, Bounded Contexts, composition patterns
+- **See [references/ddd-patterns.md](references/ddd-patterns.md)** - Aggregates, Value Objects, Domain Events, Bounded Contexts, composition patterns, seam placement
 - **See [references/data-modeling.md](references/data-modeling.md)** - Entity design principles, schema patterns, access pattern optimization, data transformation
 - **See [references/api-design.md](references/api-design.md)** - REST conventions, request/response contracts, error handling, versioning patterns
+- **See [references/interface-design.md](references/interface-design.md)** - Designing module interfaces, "Design It Twice" pattern, depth heuristics, dependency categories, anti-patterns

package/skills/oracle-architect/references/ddd-patterns.md

@@ -245,3 +245,104 @@ Bounded Context: "Orders"
 3. **Aggregate → Repository**: Service uses repository to persist aggregate
 4. **Service → Producer**: Service publishes domain events after state change
 5. **Consumer → Service**: Events from other contexts trigger service operations
+
+## Seam Placement
+
+Where you put the seam matters as much as what goes behind it.
+
+### Core/Edge Seam
+
+The primary seam runs between the functional core and the effectful edge:
+
+```
+┌─────────────────────────────────┐
+│  Functional Core (pure)         │
+│  ┌──────────────────────────┐   │
+│  │ OrderService             │   │
+│  │   createOrder() ────────┼───┼──▶ (seam)
+│  │   processPayment()       │   │
+│  └──────────────────────────┘   │
+└─────────────────────────────────┘
+              │
+              ▼ seam
+┌─────────────────────────────────┐
+│  Effectful Edge (IO)            │
+│  ┌──────────────────────────┐   │
+│  │ PostgresOrderRepository  │◀──┼── adapter
+│  │ HttpPaymentClient        │   │   adapter
+│  │ InMemoryOrderRepository  │   │   adapter (test)
+│  └──────────────────────────┘   │
+└─────────────────────────────────┘
+```
+
+**Rules:**
+- Core defines the interface; edge implements it (dependency inversion)
+- The seam must have **at least two adapters** to be real (production + test)
+- Core never imports edge code; edge imports core interfaces
+
+### Internal Seams
+
+A deep module can have **internal seams** — private to its implementation, used by its own tests:
+
+```typescript
+class Order {
+  // External seam (public interface)
+  validate(): Result<Order> { ... }
+
+  // Internal seam (private, tested directly)
+  private calculateTax(subtotal: number): Money { ... }
+}
+```
+
+Internal seams let you test complex logic without exposing it in the public interface.
+
+### When to Create a Seam
+
+Use the **adapter rule**: one adapter = hypothetical; two = real.
+
+| Scenario | Action |
+|----------|--------|
+| One database implementation, no test fake | No seam needed. Direct dependency is simpler. |
+| One database implementation, test fake exists | Extract interface. The fake is the second adapter. |
+| Multiple database implementations (Postgres + DynamoDB) | Extract interface. The implementations are the adapters. |
+| External API with one client | Direct dependency. Introduce seam only when you need a mock/stub for testing. |
+
+### Anti-Patterns
+
+**Seam at every dependency:**
+```typescript
+// ❌ Too many seams — every dependency gets an interface
+interface IValidator { ... }
+interface IFormatter { ... }
+interface IConverter { ... }
+// Each has one adapter. Indirection without value.
+```
+
+**No seam at the core/edge boundary:**
+```typescript
+// ❌ Core imports edge directly
+import { db } from '../edge/postgres';
+class OrderService {
+  async createOrder(req) {
+    await db.orders.create(...); // Core knows about Postgres
+  }
+}
+```
+
+**Leaky seam:**
+```typescript
+// ❌ Interface exposes implementation details
+interface OrderRepository {
+  queryRaw(sql: string): Promise<Row[]>; // Caller knows SQL
+  beginTransaction(): Promise<Transaction>; // Caller manages transactions
+}
+// The seam leaks. Callers become coupled to the database.
+```
+
+### Seam Placement Checklist
+
+Before introducing a new seam, verify:
+- [ ] At least two adapters will exist (production + test, or multiple production)
+- [ ] The interface hides implementation details (no SQL, no HTTP, no framework types)
+- [ ] The core doesn't import edge code
+- [ ] Deleting the module would re-appear complexity across N callers

package/skills/oracle-architect/references/interface-design.md

@@ -0,0 +1,203 @@
+# Interface Design Reference
+
+Patterns for designing module interfaces that maximize depth, leverage, and locality.
+
+Based on "Design It Twice" (Ousterhout) — your first idea is unlikely to be the best.
+
+## Design It Twice
+
+Before committing to a module's interface, sketch at least two alternatives with different trade-offs.
+
+### Process
+
+1. **Frame the problem space**
+   - List constraints any interface must satisfy
+   - Identify dependencies and which category they fall into
+   - Write a rough illustrative code sketch to ground the constraints
+
+2. **Sketch alternatives**
+   - Alternative A: Minimize the interface (1–3 entry points max)
+   - Alternative B: Maximize flexibility (support many use cases)
+   - Alternative C: Optimize for the most common caller (default case trivial)
+
+3. **Compare by depth**
+   - Which alternative has the smallest interface for the most behaviour?
+   - Which concentrates the most knowledge in one place?
+   - Which has the best test surface?
+
+### Example: Order Creation Interface
+
+**Problem:** Design the interface for creating an order.
+
+**Alternative A — Minimal interface:**
+```typescript
+interface OrderService {
+  createOrder(request: CreateOrderRequest): Promise<Result<Order>>;
+}
+```
+- **Pros:** Tiny surface. One seam. Easy to mock.
+- **Cons:** All complexity hidden inside. Hard to test partial flows (e.g. validation without persistence).
+- **Depth:** Very deep. High leverage, high locality.
+
+**Alternative B — Flexible interface:**
+```typescript
+interface OrderService {
+  validate(request: CreateOrderRequest): Promise<Result<Order>>;
+  reserveInventory(order: Order): Promise<Result<Order>>;
+  save(order: Order): Promise<Result<Order>>;
+  publishEvents(order: Order): Promise<void>;
+}
+```
+- **Pros:** Callers compose their own flows. Easy to test each step.
+- **Cons:** Interface is as complex as implementation. Callers must know ordering constraints (reserve before save).
+- **Depth:** Shallow. Low leverage — callers replicate orchestration.
+
+**Alternative C — Optimized for common case:**
+```typescript
+interface OrderService {
+  createOrder(request: CreateOrderRequest): Promise<Result<Order>>;
+  createOrderDraft(request: CreateOrderRequest): Promise<Result<Order>>; // no inventory check
+  confirmOrder(orderId: string): Promise<Result<Order>>; // draft → confirmed
+}
+```
+- **Pros:** Common case (createOrder) is trivial. Draft pattern supports async workflows.
+- **Cons:** More surface area than Alternative A. Callers must understand draft vs confirmed.
+- **Depth:** Moderate. Good leverage for the common case.
+
+**Recommendation:** Alternative C. It balances depth with real workflow needs. The draft/confirm split is a real seam (two callers: interactive vs batch).
+
+## Interface Size Heuristics
+
+### The Rule of Three
+
+A module's public interface should have no more than 3 primary entry points for each responsibility:
+
+```typescript
+// ❌ Too wide
+interface OrderService {
+  createOrder(...): Promise<Order>;
+  updateOrder(...): Promise<Order>;
+  deleteOrder(...): Promise<void>;
+  getOrder(...): Promise<Order>;
+  listOrders(...): Promise<Order[]>;
+  searchOrders(...): Promise<Order[]>;
+  cancelOrder(...): Promise<Order>;
+  shipOrder(...): Promise<Order>;
+  refundOrder(...): Promise<Order>;
+}
+
+// ✅ Split by responsibility (2 modules, each with ~3 methods)
+interface OrderLifecycleService {
+  create(...): Promise<Order>;
+  cancel(...): Promise<Order>;
+  ship(...): Promise<Order>;
+}
+
+interface OrderQueryService {
+  get(id: string): Promise<Order>;
+  list(filters: OrderFilters): Promise<Order[]>;
+  search(query: string): Promise<Order[]>;
+}
+```
+
+### Invariants in the Interface
+
+The interface includes not just types, but everything a caller must know:
+
+```typescript
+interface PaymentService {
+  // ❌ Interface hides invariants
+  processPayment(orderId: string, amount: number): Promise<Receipt>;
+  // Caller must discover: amount must match order total, order must be confirmed,
+  // can't process twice, throws if payment gateway is down.
+
+  // ✅ Interface encodes invariants in types
+  processPayment(
+    order: ConfirmedOrder, // type encodes "must be confirmed"
+    payment: PaymentMethod  // type encodes valid methods
+  ): Promise<Result<Receipt, PaymentError>>;
+  // Error mode explicit in return type. Ordering implicit in input types.
+```
+
+## Dependency Categories
+
+The shape of an interface depends on what it depends on.
+
+| Category | Description | Interface Impact |
+|----------|-------------|------------------|
+| **In-process** | Same memory space, no serialization | Can pass rich types, callbacks, streams |
+| **Local-substitutable** | Same interface, different implementations (real vs test) | Seam is real. Interface must hide implementation |
+| **Ports & adapters** | Crosses a real boundary (DB, HTTP, message queue) | Interface must be narrow. Errors are part of the contract |
+| **Mock** | Test-only dependency, no production equivalent | Don't create a seam. Test the real module |
+
+## Common Interface Anti-Patterns
+
+### Leaky Abstraction
+
+```typescript
+// ❌ Interface exposes implementation
+interface UserRepository {
+  query(sql: string, params: any[]): Promise<Row[]>;
+}
+
+// ✅ Interface hides implementation
+interface UserRepository {
+  findByEmail(email: Email): Promise<User | null>;
+  save(user: User): Promise<User>;
+}
+```
+
+### Pass-Through Interface
+
+```typescript
+// ❌ Every method delegates 1:1 to another module
+class OrderService {
+  async findById(id: string) { return this.repo.findById(id); }
+  async save(order: Order) { return this.repo.save(order); }
+  async delete(id: string) { return this.repo.delete(id); }
+}
+// Deletion test: delete OrderService → complexity doesn't reappear.
+// It's a pass-through. Remove it and call repo directly.
+```
+
+### God Interface
+
+```typescript
+// ❌ One module does everything
+interface PlatformService {
+  createUser(...): Promise<User>;
+  sendEmail(...): Promise<void>;
+  processPayment(...): Promise<Receipt>;
+  generateReport(...): Promise<PDF>;
+}
+// No cohesion. Deleting it would reappear complexity, but in unrelated places.
+// Split by domain responsibility instead.
+```
+
+### Chatty Interface
+
+```typescript
+// ❌ Many small methods that must be called in sequence
+interface OrderBuilder {
+  setCustomer(customerId: string): this;
+  addItem(item: OrderItem): this;
+  setShipping(address: Address): this;
+  setPayment(method: PaymentMethod): this;
+  validate(): Result<void>;
+  build(): Order;
+}
+// Callers must know ordering. State machine hidden in method calls.
+// Better: single method that takes a complete request.
+```
+
+## Decision Checklist
+
+Before finalizing an interface:
+
+- [ ] Run the deletion test — does complexity reappear across N callers?
+- [ ] Check depth — is the interface at least 3x smaller than the implementation?
+- [ ] Verify seam — are there at least two adapters?
+- [ ] Encode invariants — are error modes, ordering, and constraints visible in types?
+- [ ] Test surface — can you test all behaviour through the public interface?
+- [ ] Hide details — does the interface leak SQL, HTTP, frameworks, or implementation?
+- [ ] Common case — is the most frequent caller's experience trivial?