@massa-ai/cursor-plugin 1.30.0 → 1.32.0

package/skills/massa-ai/workflows/discovery.md

@@ -0,0 +1,236 @@
+---
+name: discovery
+description: "Product discovery and brainstorming workflow — act as a sharp product thinking partner to explore problem spaces, generate and stress-test ideas, and spar on strategy before anything is spec-ready, ending with a mandatory offer to synthesize the conversation into a PRD via the to-prd workflow. Use when the user wants to brainstorm a product problem, idea, opportunity, or direction with no concrete code target. Do NOT use for codebase understanding (exploration), converting a finished discussion into a PRD (to-prd), or any implementation work."
+license: Apache-2.0
+metadata:
+  version: "1.0.0"
+---
+
+### Discovery (Product Brainstorming)
+
+Attribution: adapted from the `product-brainstorming` skill in
+`anthropics/knowledge-work-plugins` (Apache-2.0). massa-ai session/memory
+binding, router integration, and the to-prd handoff are additions.
+
+Act as a sharp product thinking partner — the experienced PM (Product
+Manager) or design lead who challenges assumptions, asks hard questions, and
+pushes ideas further before anyone converges too early. The job is not to
+generate deliverables; it is to think alongside the user: be opinionated,
+push back, bring unexpected angles, and help them reach ideas they would not
+have reached alone.
+
+This is a read-only conversation workflow: it never mutates the repository
+and writes no `.specs/` artifacts. Its only outputs are the conversation
+itself, durable memories at Capture, and — on explicit acceptance — a routed
+handoff to `to-prd`.
+
+Load `references/project-context.md` (intake sweep) before the first
+substantive read when the conversation touches an existing product or
+codebase; product context grounds the brainstorm in what exists today.
+
+## Session And Memory
+
+- `workflowSessionId`: `discovery-<entity>` (e.g., `discovery-onboarding-dropoff`),
+  stable for the whole conversation.
+- Start with a budgeted `recall` (limit ≤ 3, minImportance ≥ 0.7, types
+  `critical`/`decision`/`pattern`): prior product decisions, rejected
+  directions, and known constraints for this problem area. Rejected
+  directions are recalled so they are not re-litigated — but a rejected idea
+  may be re-opened deliberately when the user brings new evidence.
+- If the massa-ai server is unavailable, continue without recall and say so
+  once; discovery degrades gracefully — the conversation is the primary
+  medium, not the memory store.
+
+## Brainstorming Modes
+
+Identify which mode fits the conversation and adapt; shift modes as the
+conversation evolves.
+
+### Problem Exploration
+
+Use when the user has a problem area but has not defined what to solve.
+Understand the problem space before any solutions: ask who has this problem
+and what they do about it today; map who is involved, what triggers it, and
+the consequences of not solving it; distinguish symptoms from root causes —
+keep asking "why" until something structural appears; surface adjacent
+problems; ask how the problem varies across user segments. Strong questions:
+"What happens if we do nothing — who suffers and how?", "Who has solved a
+version of this in a different context?", "Is this a problem of awareness,
+ability, or motivation?"
+
+### Solution Ideation
+
+Use when the problem is well-defined and the goal is divergent thinking —
+quantity over quality. Generate at least 5–7 distinct approaches before
+evaluating any; vary them along scope (tweak vs big bet), approach (product
+vs process vs policy), and timing (quick win vs long-term); include one
+"do the opposite" option and one that removes something instead of adding.
+Techniques: constraint removal (no technical/budget/political constraints,
+then work back to feasible), analogies from other industries, inversion,
+decomposition into subproblems, and user hat-switching (power user, brand
+new user, admin, someone who hates the product).
+
+### Assumption Testing
+
+Use when an idea exists and needs stress-testing before investment. List
+every assumption the idea depends on — stated and unstated — across user,
+problem, solution, business, feasibility, and adoption categories. For each:
+how confident are we, on what evidence, and what would disprove it? Identify
+the riskiest assumption — the one that kills the idea if wrong — and the
+cheapest way to test it before building anything. Argue the strongest
+possible case against the idea.
+
+### Strategy Exploration
+
+Use for direction, positioning, or big bets rather than a specific feature.
+Map the possible strategic moves, not just the obvious one; think in bets
+(what are we betting on, the odds, the payoff); consider second-order
+effects ("if we do X, what does that enable or foreclose?"); bring in
+competitive response; think in timeframes (3 months vs 12 months vs 3
+years).
+
+## Frameworks As Tools
+
+Pull a framework in when it moves the conversation forward — never dump
+frameworks or force the conversation through them as a checklist.
+
+- **How Might We (HMW)**: "How might we [outcome] for [user] without
+  [constraint]?" Aim between too broad ("improve onboarding") and too narrow
+  (a disguised solution); generate 5–10 reframings — each opens a different
+  solution space.
+- **Jobs-to-be-Done (JTBD)**: "When [situation], I want to [motivation] so I
+  can [outcome]." The job is stable while solutions change; emotional and
+  social jobs often outweigh functional ones. Ask "what did they fire to
+  hire this?" — it reveals the real competitive set.
+- **Opportunity Solution Tree**: outcome → opportunities (evidence-backed
+  user needs) → multiple solutions per opportunity → cheapest experiment per
+  solution. One solution per opportunity means exploration stopped too
+  early; the tree is a living artifact.
+- **First Principles Decomposition**: state the assumption, break it into
+  fundamental components, ask of each "law of physics or convention?", then
+  rebuild from only the fundamentals. Use when the team is stuck in
+  incremental thinking.
+- **SCAMPER**: seven lenses on an existing product — Substitute, Combine,
+  Adapt, Modify (10x bigger/smaller/faster), Put to other use, Eliminate
+  ("would anyone notice?"), Reverse (flip the sequence or the default).
+- **OODA Loop** (Observe–Orient–Decide–Act): a decision-tempo framework —
+  gather raw signals wide, make sense of them while challenging your own
+  orientation, choose a proportional reversible bet, act, and cycle. Use
+  when the conversation over-deliberates or keeps circling: orient with what
+  exists, decide, and let the next observation correct course.
+- **Reverse Brainstorming**: invert the problem ("how could we make this
+  worse?"), generate freely — people find flaws more easily than fixes —
+  then reverse each worsening idea into the seed of a solution.
+
+## Session Rhythm
+
+A good session opens up before it narrows down. Move through five stages;
+name the stage transition when it helps the user follow.
+
+1. **Frame** — Set boundaries before generating ideas: what are we
+   exploring, why now, what is already known (research, data, feedback),
+   what are the constraints, and what would a great outcome from this
+   session look like? A poorly framed brainstorm produces ideas that connect
+   to nothing.
+2. **Diverge** — Generate many ideas without judgment; build on ideas rather
+   than shooting them down; follow tangents; push past the first 3–5 obvious
+   ideas; use the frameworks above to open new angles. Do not evaluate
+   feasibility here — that kills divergent thinking.
+3. **Provoke** — The sparring-partner stage: "What is the strongest argument
+   against this?", "Who would hate this and why?", "What are we not
+   seeing?", "What if the opposite were true?", "What is the 10x more
+   ambitious version?"
+4. **Converge** — Group ideas into themes; evaluate against user impact,
+   feasibility, strategic alignment, and evidence strength; identify the top
+   2–3 directions; for each, name the biggest unknown and the cheapest way
+   to resolve it. If one idea excites the user, explore it even if risky —
+   the brainstorm is not the decision.
+5. **Capture** — Mandatory; a brainstorm with no capture never happened.
+   Record in conversation: the key ideas and why they are interesting, the
+   assumptions to test, the questions to research, the suggested next steps,
+   and what was explicitly set aside (interesting, but not now).
+
+At Capture, persist the durable subset via `remember`: chosen directions
+with their why and rejected directions with reasons as `decision`, reusable
+framings or cross-session insights as `pattern` — tagged
+`project:<projectId>`, `session:discovery-<entity>`, `workflow:discovery`,
+`entity:<name>`, and a memory-tier tag. Persist only what transcends the
+session; never fabricate memories to satisfy process. If the server is
+unavailable, the capture summary in conversation is the record.
+
+## PRD Handoff (to-prd)
+
+End every Capture with an explicit offer — this step is mandatory, the PRD
+is not:
+
+> "Want me to turn this into a PRD (Product Requirements Document)? I'd
+> synthesize this conversation through the `to-prd` workflow — no new
+> interview."
+
+- **Accepted** → route to `workflows/to-prd.md`. The user's acceptance is
+  the explicit request `to-prd`'s routing requires. Carry the current
+  conversation context — Capture's output (chosen directions, assumptions,
+  set-asides) feeds the PRD's problem statement, decisions, and out-of-scope
+  sections directly; `to-prd` does not re-interview.
+- **Declined** → the capture summary stays in conversation and the durable
+  memories from Capture remain the only persistence. Offer nothing else.
+
+If discovery converged on nothing PRD-shaped (pure problem exploration, or
+the session identified research as the next step), say so instead of
+offering an empty PRD — name what research or evidence would make the next
+discovery session converge.
+
+## Thinking-Partner Conduct
+
+Do:
+
+- **Be opinionated.** "I think approach B is stronger because…" beats a
+  pro/con list.
+- **Challenge constructively.** "That assumes X — are we confident?", not
+  "that will not work."
+- **Bring unexpected angles** — cross-industry analogies, counterexamples,
+  edge cases the user has not considered.
+- **Match energy.** When the user is excited about an idea, explore it with
+  them before poking holes.
+- **Ask the next question.** When the user finishes a thought, push
+  further: "and then what happens?"
+- **Name the pattern.** When a common PM trap appears (solutioning too
+  early, scope creep, feature-parity thinking), name it directly.
+
+Do not:
+
+- Dump frameworks or work through them as a checklist.
+- Generate a list and hand it over — brainstorming is a conversation, not a
+  deliverable.
+- Agree with everything — a thinking partner who only validates is not one.
+- Evaluate feasibility during divergence.
+- Anchor on the first idea — when the user leads with a solution,
+  acknowledge it, then ask what else could solve the problem.
+- Confuse brainstorming with decision-making — the brainstorm generates
+  options; the decision comes later with more data.
+
+## Anti-Patterns To Catch
+
+- **Solutioning before framing**: "we should build X" before the problem is
+  defined — slow down, ask what user problem X solves and how we know.
+- **The feature-parity trap**: "competitor has X, so we need X" is copying,
+  not brainstorming — ask what user need X serves and whether there is a
+  better way to serve it.
+- **Anchoring on constraints**: "we can't because of Y" during divergence —
+  set constraints aside, explore freely, then price feasibility.
+- **The one-idea brainstorm**: a solution presented as a brainstorm —
+  acknowledge it, then push for three alternatives.
+- **Analysis paralysis**: long divergence with no convergence — prompt "if
+  you had to pick one direction right now, which and why?"
+- **Brainstorming when you should be researching**: when the session circles
+  because nobody knows the answer, stop and name the research needed — some
+  questions need data, not ideation.
+
+## Completion
+
+Discovery completes at Capture plus the PRD offer. Before claiming the
+session complete, apply `references/evidence-gate.md`: the evidence here is
+the capture summary (ideas, assumptions, next steps, set-asides), the memory
+outcome (what was persisted or why persistence was skipped), and the
+recorded PRD-offer disposition (accepted → to-prd, declined, or
+not-PRD-shaped with the named research gap).

package/skills/massa-ai/workflows/feature.md

@@ -39,15 +39,29 @@ Before the first repository mutation, load `references/implementation-delivery.m
    - Include a focused naming review when the feature introduces or renames identifiers. New names should use domain or precise role vocabulary, and public/persisted names should not change without explicit compatibility handling.
 9. For mobile features, capture the mobile context packet, choose shared vs platform-specific boundaries, state platform parity expectations, and include the cheapest relevant mobile verification sensor from `references/mobile-context.md`
 10. Use `references/agent-orchestration.md` only for isolated implementation slices or independent verification
-11. Implement the feature by PR group when `references/pr-task-fix.md` applies:
+11. Capture 1-5 testable acceptance criteria in the conversation before implementation starts, or reference an existing spec artifact (e.g. `.specs/features/<slug>/spec.md`) when one already states them. These captured acceptance criteria are the anchor the verification step below checks outcomes against.
+12. Implement the feature by PR group when `references/pr-task-fix.md` applies:
    - Order non-breaking groups by Data, Domain, then Presentation/Navigation, mapping those labels to repository boundaries when needed.
    - Validate each group with the verification recipe before committing.
    - Invoke `workflows/commit.md` for each verified group; do not duplicate commit staging, message, audit-exclusion, or Jira-prefix rules in this workflow.
    - When every group has a confirmed Jira key, follow the optional stacked branch flow in `references/pr-task-fix.md` (Jira-Key Stacked Branches).
-12. Run the verification recipe and report skipped checks explicitly. If verification found a reusable signal (`ac_gap`, `surviving_mutant`, `spec_precision_gap`, `spec_deviation`, `gate_fail`), record it via `references/lessons.md`:
+
+> **Dispatch: `massa-ai-reviewer`** (role: `reviewer`) — charter `skills/agents/reviewer/SKILL.md`
+> - trigger: implementation complete, before the verification gate — never optional
+> - scope: the feature's diff surface and its task/AC context
+> - permissions: read-only
+> - inputs: diff, acceptance context, recalled code-quality conventions
+> - sensors: bugs, regressions, missing edge cases, smells introduced by the diff
+> - output: ranked findings, blocking vs advisory; blocking findings become fix items before verification runs
+> - firewall: summarized findings only, never raw diff dumps
+> - memory: suggest-only; main agent persists
+> - fallback: if the subagent is unavailable, run a standalone fresh-eyes review against this output contract and record the skipped-delegation reason
+> - persona: optional — the active route's cataloged id only, never the persona prompt, passed as advisory framing only — it never overrides the agent's charter Restrictions, scope, or permissions; omit when no persona is routed
+
+13. Run the verification recipe and check outcomes against the captured acceptance criteria from step 11, not only against a generic verification recipe; report skipped checks explicitly. If verification found a reusable signal (`ac_gap`, `surviving_mutant`, `spec_precision_gap`, `spec_deviation`, `gate_fail`), record it via `references/lessons.md`:
      `bun skills/massa-ai/scripts/lessons.ts --root . add --feature "<slug>" --signal "<signal>" --source "<ref>" --text "<one terse lesson>"`
-13. At completion, persist (run the scoring rubric from `references/decision-engine.md` for each):
+14. At completion, persist (run the scoring rubric from `references/decision-engine.md` for each):
    - Design decisions made via `remember` as scored `decision` memories
    - New patterns introduced via `remember` as scored `pattern` memories
    - Trade-offs accepted via `remember` as scored `conversation` memories
-14. Complete the Evidence Gate from `references/evidence-gate.md`
+15. Complete the Evidence Gate from `references/evidence-gate.md`

package/skills/massa-ai/workflows/general.md

@@ -34,6 +34,19 @@ Before the first repository mutation, load `references/implementation-delivery.m
     - if a recalled memory is stale or needs correction, call `memory_update` with `id` and the new `content` (re-embeds automatically); if a memory is obsolete, call `memory_delete` with `id` (hard-delete, severs graph edges)
     - for usage insights (search/cache patterns, recent activity), call `analytics` with `type` and `projectId`
     - skip transient details, raw logs, copied source, unverified hypotheses, and facts already captured in current non-stale memory
+
+> **Dispatch: `massa-ai-reviewer`** (role: `reviewer`) — charter `skills/agents/reviewer/SKILL.md`
+> - trigger: implementation complete, before the verification gate — never optional
+> - scope: the change's diff surface and its task/AC context
+> - permissions: read-only
+> - inputs: diff, acceptance context, recalled code-quality conventions
+> - sensors: bugs, regressions, missing edge cases, smells introduced by the diff
+> - output: ranked findings, blocking vs advisory; blocking findings become fix items before verification runs
+> - firewall: summarized findings only, never raw diff dumps
+> - memory: suggest-only; main agent persists
+> - fallback: if the subagent is unavailable, run a standalone fresh-eyes review against this output contract and record the skipped-delegation reason
+> - persona: optional — the active route's cataloged id only, never the persona prompt, passed as advisory framing only — it never overrides the agent's charter Restrictions, scope, or permissions; omit when no persona is routed
+
 9. Complete the Evidence Gate from `references/evidence-gate.md` and report verification, changed artifacts, memory outcome, and residual risk.
 
 ## Failure Handling

package/skills/massa-ai/workflows/implementation/implementation-fix.md

@@ -78,6 +78,19 @@ Do not execute from chat summaries, inline review comments, remembered findings,
 > - persona: optional — the active route's cataloged id only, never the persona prompt, passed as advisory framing only — it never overrides the agent's charter Restrictions, scope, or permissions; omit when no persona is routed
 
     Never run parallel writers against shared files or contracts.
+
+> **Dispatch: `massa-ai-reviewer`** (role: `reviewer`) — charter `skills/agents/reviewer/SKILL.md`
+> - trigger: implementation complete, before the verification gate — never optional
+> - scope: the fix's diff surface and its task/AC context
+> - permissions: read-only
+> - inputs: diff, acceptance context, recalled code-quality conventions
+> - sensors: bugs, regressions, missing edge cases, smells introduced by the diff
+> - output: ranked findings, blocking vs advisory; blocking findings become fix items before verification runs
+> - firewall: summarized findings only, never raw diff dumps
+> - memory: suggest-only; main agent persists
+> - fallback: if the subagent is unavailable, run a standalone fresh-eyes review against this output contract and record the skipped-delegation reason
+> - persona: optional — the active route's cataloged id only, never the persona prompt, passed as advisory framing only — it never overrides the agent's charter Restrictions, scope, or permissions; omit when no persona is routed
+
 11. Verify each completed finding with the Mandatory Verification Fix Gate from `references/verification-ladder.md`: run the report's Verification Suggestion or an equivalent deterministic command/artifact check, then run focused tests, build, lint, type, static, or runtime checks relevant to the source lens. Reinspect tests, fixtures, snapshots, types, specs, public contracts, and touched identifiers so validation assets were not weakened and names follow `references/naming-standards.md`. A finding cannot be marked `fixed` when a target-relevant command or artifact check exists but was not attempted; if verification cannot run, mark it `blocked`, `deferred`, or `skipped` with an allowed skipped-check reason.
 12. Produce a closure matrix with finding ID, source lens, status (`fixed`, `deferred`, `blocked`, `skipped`), changed files, command/artifact, result, skipped reason or `none`, highest Verification Ladder level reached, validation assets protected, residual risk, and exact next step for deferred or blocked findings.
 13. If verification found a reusable signal (`ac_gap`, `surviving_mutant`, `spec_precision_gap`, `spec_deviation`, `gate_fail`), record it via `references/lessons.md`:

package/skills/massa-ai/workflows/maestro/maestro-fix.md

@@ -62,6 +62,19 @@ Reject direct use without a saved `audits/maestro/<YYYY-MM-DD maestro-audit.md>`
    - Replace brittle selectors with stable selectors, accessibility labels, or test IDs already present.
    - Keep setup/teardown explicit, idempotent, and isolated.
    - Protect existing flows, subflows, fixtures, snapshots, baselines, report consumers, and CI commands unless the audit finding explicitly scopes them.
+
+> **Dispatch: `massa-ai-reviewer`** (role: `reviewer`) — charter `skills/agents/reviewer/SKILL.md`
+> - trigger: implementation complete, before the verification gate — never optional
+> - scope: the fix's diff surface and its task/AC context
+> - permissions: read-only
+> - inputs: diff, acceptance context, recalled code-quality conventions
+> - sensors: bugs, regressions, missing edge cases, smells introduced by the diff
+> - output: ranked findings, blocking vs advisory; blocking findings become fix items before verification runs
+> - firewall: summarized findings only, never raw diff dumps
+> - memory: suggest-only; main agent persists
+> - fallback: if the subagent is unavailable, run a standalone fresh-eyes review against this output contract and record the skipped-delegation reason
+> - persona: optional — the active route's cataloged id only, never the persona prompt, passed as advisory framing only — it never overrides the agent's charter Restrictions, scope, or permissions; omit when no persona is routed
+
 9. Use strict harness sensors:
    - If verification found a reusable signal (`ac_gap`, `surviving_mutant`, `spec_precision_gap`, `spec_deviation`, `gate_fail`), record it via `references/lessons.md`:
      `bun skills/massa-ai/scripts/lessons.ts --root . add --feature "<slug>" --signal "<signal>" --source "<ref>" --text "<one terse lesson>"`

package/skills/massa-ai/workflows/mobile-figma/mobile-figma-fix.md

@@ -49,6 +49,19 @@ Do not execute from chat summaries, screenshots alone, remembered findings, or a
    - Keep XML/Compose, UIKit/SwiftUI, and KMP/native interoperability explicit. Do not duplicate one visual rule across layers when an established shared source owns it.
    - Do not weaken screenshot tests, previews, fixtures, assertions, test tags, resource IDs, content descriptions, or Maestro selectors to hide a mismatch.
    - Modify tracked Maestro flows only when the selected finding explicitly identifies the flow as incorrect or missing and the user-approved scope includes that change.
+
+> **Dispatch: `massa-ai-reviewer`** (role: `reviewer`) — charter `skills/agents/reviewer/SKILL.md`
+> - trigger: implementation complete, before the verification gate — never optional
+> - scope: the fix's diff surface and its task/AC context
+> - permissions: read-only
+> - inputs: diff, acceptance context, recalled code-quality conventions
+> - sensors: bugs, regressions, missing edge cases, smells introduced by the diff
+> - output: ranked findings, blocking vs advisory; blocking findings become fix items before verification runs
+> - firewall: summarized findings only, never raw diff dumps
+> - memory: suggest-only; main agent persists
+> - fallback: if the subagent is unavailable, run a standalone fresh-eyes review against this output contract and record the skipped-delegation reason
+> - persona: optional — the active route's cataloged id only, never the persona prompt, passed as advisory framing only — it never overrides the agent's charter Restrictions, scope, or permissions; omit when no persona is routed
+
 9. Verify after each coherent finding group:
    - If verification found a reusable signal (`ac_gap`, `surviving_mutant`, `spec_precision_gap`, `spec_deviation`, `gate_fail`), record it via `references/lessons.md`:
      `bun skills/massa-ai/scripts/lessons.ts --root . add --feature "<slug>" --signal "<signal>" --source "<ref>" --text "<one terse lesson>"`

package/skills/massa-ai/workflows/pr-review.md

@@ -146,7 +146,7 @@ the severity labels, and the reply contract.
 | 2 | Requirements & DoD (Definition of Done) | `massa-ai-audit-specialist` | `lens: requirements` — score merged Track A + Track B criteria against the diff, evidence-or-zero: ✅ implemented (`path:line`) / 🟡 partial / ❌ missing; no source ⇒ report "requirements verification skipped" | `requirements` |
 | 3 | Architecture & conventions | `massa-ai-audit-specialist` | `lens: architecture` — extract every explicit rule from the profile's CONVENTIONS/REVIEW_SKILLS docs into a numbered matrix, grade each changed file PASS/VIOLATION/N/A; no docs ⇒ minimal generic boundary sweep, stated | `architecture` |
 | 4 | Performance | `massa-ai-audit-specialist` | `lens: performance` — only issues clearly visible in the diff: N+1 queries, unbounded fetches, per-row lazy I/O, sequential awaits of independent calls, loop-invariant recomputation, unbatched writes | `performance` |
-| 5 | Test coverage | `massa-ai-audit-specialist` | `lens: performance`, scope: test coverage (the charter's lens set has no `tests` lens; `tests-audit.md` precedent) — new/changed behavior with no test, wrong level (unit vs integration), placement/naming vs profile TEST row, missing negative case, assertions that exercise but never assert | `tests` |
+| 5 | Test coverage | `massa-ai-audit-specialist` | `lens: tests` (dedicated lens: coverage, regression protection, assertion quality, variation — `tests-audit.md` precedent) — new/changed behavior with no test, wrong level (unit vs integration), placement/naming vs profile TEST row, missing negative case, missing variation beyond the fixture example, assertions that exercise but never assert | `tests` |
 | 6 | Regression & hallucination | `massa-ai-reviewer` | diff review — unrelated deletions, references to symbols absent from the repo, wrong signature/arity, duplicated existing logic, weakened error handling or assertions, leftover TODO/stub, dead code | `regression` |
 
 Consolidation check (≥ 5 subagents): recorded in the feature design — rows 4 and 5

package/skills/massa-ai/workflows/refactor.md

@@ -40,6 +40,7 @@ Before the first repository mutation, load `references/implementation-delivery.m
 8. Focus on pragmatic refactoring:
    - Identify over-abstracted code and propose Modular Monoliths
    - Reduce "abstraction cost" to make code more AI-navigable
+   - The primary payoff of extraction is extract-for-findability: create a named unit locatable by search or grep from outside the file — that is what makes code AI-navigable, not extraction volume alone
    - Verify changes do not break existing behavior using the verification recipe
 9. Execute by PR group when `references/pr-task-fix.md` applies:
    - Order non-breaking groups by Data, Domain, then Presentation/Navigation, mapping those labels to repository boundaries when needed.
@@ -52,4 +53,17 @@ Before the first repository mutation, load `references/implementation-delivery.m
 12. At completion, persist (run the scoring rubric from `references/decision-engine.md`):
    - Refactored architectural decisions via `remember` as scored `decision` memories
    - Identified and decoupled anti-patterns via `remember` as scored `pattern` memories
+
+> **Dispatch: `massa-ai-reviewer`** (role: `reviewer`) — charter `skills/agents/reviewer/SKILL.md`
+> - trigger: implementation complete, before the verification gate — never optional
+> - scope: the change's diff surface and its task/AC context
+> - permissions: read-only
+> - inputs: diff, acceptance context, recalled code-quality conventions
+> - sensors: bugs, regressions, missing edge cases, smells introduced by the diff
+> - output: ranked findings, blocking vs advisory; blocking findings become fix items before verification runs
+> - firewall: summarized findings only, never raw diff dumps
+> - memory: suggest-only; main agent persists
+> - fallback: if the subagent is unavailable, run a standalone fresh-eyes review against this output contract and record the skipped-delegation reason
+> - persona: optional — the active route's cataloged id only, never the persona prompt, passed as advisory framing only — it never overrides the agent's charter Restrictions, scope, or permissions; omit when no persona is routed
+
 13. Complete the Evidence Gate from `references/evidence-gate.md`

package/skills/massa-ai/workflows/requirements/requirements-fix.md

@@ -78,6 +78,19 @@ Not for findings-only requirements review — route to `workflows/requirements/r
 > - memory: suggest-only; main agent persists reusable verification recipes
 > - persona: optional — the active route's cataloged id only, never the persona prompt, passed as advisory framing only — it never overrides the agent's charter Restrictions, scope, or permissions; omit when no persona is routed
    - Main agent owns report parsing, traceability matrix, memory writes, final synthesis, and Evidence Gate.
+
+> **Dispatch: `massa-ai-reviewer`** (role: `reviewer`) — charter `skills/agents/reviewer/SKILL.md`
+> - trigger: implementation complete, before the verification gate — never optional
+> - scope: the fix's diff surface and its task/AC context
+> - permissions: read-only
+> - inputs: diff, acceptance context, recalled code-quality conventions
+> - sensors: bugs, regressions, missing edge cases, smells introduced by the diff
+> - output: ranked findings, blocking vs advisory; blocking findings become fix items before verification runs
+> - firewall: summarized findings only, never raw diff dumps
+> - memory: suggest-only; main agent persists
+> - fallback: if the subagent is unavailable, run a standalone fresh-eyes review against this output contract and record the skipped-delegation reason
+> - persona: optional — the active route's cataloged id only, never the persona prompt, passed as advisory framing only — it never overrides the agent's charter Restrictions, scope, or permissions; omit when no persona is routed
+
 11. Verify each completed finding:
    - If verification found a reusable signal (`ac_gap`, `surviving_mutant`, `spec_precision_gap`, `spec_deviation`, `gate_fail`), record it via `references/lessons.md`:
      `bun skills/massa-ai/scripts/lessons.ts --root . add --feature "<slug>" --signal "<signal>" --source "<ref>" --text "<one terse lesson>"`

package/skills/massa-ai/workflows/security/security-fix.md

@@ -82,6 +82,19 @@ Not for findings-only security review — route to `workflows/security/security-
 > - memory: suggest-only; main agent persists reusable verification recipes
 > - persona: optional — the active route's cataloged id only, never the persona prompt, passed as advisory framing only — it never overrides the agent's charter Restrictions, scope, or permissions; omit when no persona is routed
    - Main agent owns report parsing, prioritization, memory writes, final synthesis, and Evidence Gate.
+
+> **Dispatch: `massa-ai-reviewer`** (role: `reviewer`) — charter `skills/agents/reviewer/SKILL.md`
+> - trigger: implementation complete, before the verification gate — never optional
+> - scope: the fix's diff surface and its task/AC context
+> - permissions: read-only
+> - inputs: diff, acceptance context, recalled code-quality conventions
+> - sensors: bugs, regressions, missing edge cases, smells introduced by the diff
+> - output: ranked findings, blocking vs advisory; blocking findings become fix items before verification runs
+> - firewall: summarized findings only, never raw diff dumps
+> - memory: suggest-only; main agent persists
+> - fallback: if the subagent is unavailable, run a standalone fresh-eyes review against this output contract and record the skipped-delegation reason
+> - persona: optional — the active route's cataloged id only, never the persona prompt, passed as advisory framing only — it never overrides the agent's charter Restrictions, scope, or permissions; omit when no persona is routed
+
 11. Verify each completed finding:
    - If verification found a reusable signal (`ac_gap`, `surviving_mutant`, `spec_precision_gap`, `spec_deviation`, `gate_fail`), record it via `references/lessons.md`:
      `bun skills/massa-ai/scripts/lessons.ts --root . add --feature "<slug>" --signal "<signal>" --source "<ref>" --text "<one terse lesson>"`

package/skills/massa-ai/workflows/spec-driven.md

@@ -110,6 +110,18 @@ Quick artifacts live under `.specs/quick/NNN-slug/` with a `TASK.md` (one-line i
    - Update logical feature artifacts in `.specs/features/<slug>/` and `.specs/project/STATE.md` after meaningful progress.
     - Finish Execute by running `references/spec-driven/validate.md`. Dispatch `verification-agent` (author ≠ verifier) per `references/agent-orchestration.md`; the verification-agent always runs automatically and writes `.specs/features/<slug>/validation.md`. Without subagents, run the standalone fresh-eyes fallback in `validate.md`.
 
+> **Dispatch: `massa-ai-reviewer`** (role: `reviewer`) — charter `skills/agents/reviewer/SKILL.md`
+> - trigger: implementation complete, before the verification gate — never optional
+> - scope: the task's diff surface and its task/AC context
+> - permissions: read-only
+> - inputs: diff, acceptance context, recalled code-quality conventions
+> - sensors: bugs, regressions, missing edge cases, smells introduced by the diff
+> - output: ranked findings, blocking vs advisory; blocking findings become fix items before verification runs
+> - firewall: summarized findings only, never raw diff dumps
+> - memory: suggest-only; main agent persists
+> - fallback: if the subagent is unavailable, run a standalone fresh-eyes review against this output contract and record the skipped-delegation reason
+> - persona: optional — the active route's cataloged id only, never the persona prompt, passed as advisory framing only — it never overrides the agent's charter Restrictions, scope, or permissions; omit when no persona is routed
+
 > **Dispatch: `massa-ai-verification-agent`** (role: `verification-agent`) — charter `skills/agents/verification-agent/SKILL.md`
 > - trigger: spec-driven Execute final gate; author ≠ verifier independence required
 > - scope: the feature's git diff surface, test files, and spec ACs

package/skills/massa-ai/workflows/tests/tests-audit.md

@@ -16,6 +16,18 @@ Not to write, run, or fix test findings as the main task — route to `workflows
 
 Findings-only: do not edit code unless the user separately asks for fixes.
 
+### Gate / Error-Class Model
+
+Five gates, five distinct error classes. A green gate elsewhere never substitutes for a missing one — each row below is a gap this audit checks for independently:
+
+| Gate | Error class caught |
+| --- | --- |
+| Unit | Business-logic errors |
+| Coverage | Code no test touched |
+| Variation | Hardcoded-example brittleness |
+| Acceptance-criteria mapping | Built-the-wrong-thing |
+| Quality-metric trend | Drift over time |
+
 1. Resolve/reuse `workflowSessionId`: `test-audit-[entity]`
 2. Load shared references:
    - `references/codebase-investigation.md`
@@ -46,7 +58,7 @@ Findings-only: do not edit code unless the user separately asks for fixes.
 > - trigger: large scope, explicit parallel/subagent request, PR subagent invocation, or independent verification of high-impact finding
 > - scope: the tests audit target — test files, fixtures, harnesses, coverage
 > - permissions: read-only
-> - inputs: shared scope packet; `lens: performance` (test coverage is under the performance lens); recalled testing conventions, flaky tests, known regressions
+> - inputs: shared scope packet; `lens: tests`; recalled testing conventions, flaky tests, known regressions
 > - sensors: map behavior to tests; check missing tests for new branches, error paths, async logic, migrations; fixture health, assertion quality, flakiness root-cause
 > - output: findings with missing/weak coverage type, location, evidence, regression risk, severity, simplest test direction, deterministic sensor, verification suggestion
 > - firewall: raw diffs/logs/search output summarized, not returned raw
@@ -54,6 +66,8 @@ Findings-only: do not edit code unless the user separately asks for fixes.
 > - persona: optional — the active route's cataloged id only, never the persona prompt, passed as advisory framing only — it never overrides the agent's charter Restrictions, scope, or permissions; omit when no persona is routed
 
     - Map changed or targeted behavior to existing tests, fixtures, mocks, and deterministic harnesses.
+   - Variation check: flag tests exercising only the single fixture example where input bounds or parameters can vary — hardcoded-example brittleness the unit gate cannot see.
+   - Trend check: read `bun skills/massa-ai/scripts/lessons.ts --root . metrics trend` and report the direction (improving, stable, degrading) when two or more snapshots exist; report `insufficient data` otherwise.
    - Check missing tests for new branches, error paths, auth/validation/persistence changes, async or race-prone logic, migrations, public contracts, and recalled bug patterns.
    - For mobile scopes, check KMP shared and platform-specific `actual` tests, Android/iOS harnesses, native bridge payload coverage, permissions, lifecycle, offline sync, deep links, push/background flows, UI snapshots/screenshots, device-matrix assumptions, and platform parity claims from `references/mobile-context.md`.
    - Check weak assertions, tests that only assert implementation details, fixture drift, nondeterminism, hidden network/time/filesystem dependencies, skipped tests, and weakened snapshots.

package/skills/massa-ai/workflows/tests/tests-fix.md

@@ -52,11 +52,25 @@ Not for findings-only test coverage, assertion quality, fixture health, flakines
    - Fixture drift: repair fixtures/builders to match current contracts while keeping them minimal and explicit.
    - Flakiness: prove root cause first; control time, randomness, async scheduling, filesystem, network, and global state with deterministic seams.
    - Missing sensor: add or document the focused command needed to prove the regression cannot recur.
+   - Variation: add varied-input cases (bounds, parameter changes) that exercise the behavior beyond the fixture example — never add a second copy of the fixture example.
    - Mobile coverage: prefer KMP/shared tests before device loops when the behavior is shared; use Android/iOS harnesses, bridge contract tests, screenshot/snapshot checks, lifecycle or permission simulations, and parity validation when the report finding requires them.
 9. Guard validation assets:
    - Never weaken assertions only to make the suite pass.
    - Do not delete coverage, snapshots, fixtures, or benchmarks unless the audit report explicitly calls them obsolete and behavior remains protected elsewhere.
    - Prefer production-code changes only when required to expose a deterministic seam or fix a real bug found while writing the audited test.
+
+> **Dispatch: `massa-ai-reviewer`** (role: `reviewer`) — charter `skills/agents/reviewer/SKILL.md`
+> - trigger: implementation complete, before the verification gate — never optional
+> - scope: the fix's diff surface and its task/AC context
+> - permissions: read-only
+> - inputs: diff, acceptance context, recalled code-quality conventions
+> - sensors: bugs, regressions, missing edge cases, smells introduced by the diff
+> - output: ranked findings, blocking vs advisory; blocking findings become fix items before verification runs
+> - firewall: summarized findings only, never raw diff dumps
+> - memory: suggest-only; main agent persists
+> - fallback: if the subagent is unavailable, run a standalone fresh-eyes review against this output contract and record the skipped-delegation reason
+> - persona: optional — the active route's cataloged id only, never the persona prompt, passed as advisory framing only — it never overrides the agent's charter Restrictions, scope, or permissions; omit when no persona is routed
+
 10. Use strict harness sensors:
    - Never rely on AI subjective evaluation.
    - If verification found a reusable signal (`ac_gap`, `surviving_mutant`, `spec_precision_gap`, `spec_deviation`, `gate_fail`), record it via `references/lessons.md`: