@meyverick/agentic 5.0.2

package/skills/check/SKILL.md

@@ -0,0 +1,108 @@
+---
+name: check
+description: >
+  Execute and interpret local workspace and submodule check-gates to verify project integrity before push.
+  Use when verifying code changes, running pre-flight gates, diagnosing check.sh failures, or confirming clean-clone buildability.
+  Do NOT use when only reading or exploring code without modifications, or when planning changes before implementation.
+allowed-tools: Bash(*)
+license: MIT
+compatibility: Requires bash and git.
+metadata:
+  author: agentic
+  version: "1.0.0"
+positive_triggers:
+  - "verify workspace integrity and run check gate"
+  - "execute check.sh and interpret gate failures"
+  - "run pre-flight check gate before completion"
+  - "diagnose clean-clone build or pointer desync failure"
+anti_triggers:
+  - "only reading or exploring code without modifying it"
+  - "planning a change before implementation begins"
+---
+
+# Check Gate Handbook
+
+A specialized reference manual and textbook instructing AI agents on how to execute local workspace check-gates, observe the two-speed verification protocol, interpret gate failure diagnostics, and apply autonomous self-healing recipes.
+
+## Activation Boundary
+
+**Consult this textbook when:**
+- Executing `./scripts/check.sh` during the Pre-response self-audit (`project/AGENTS.md` §10).
+- Diagnosing why a local check gate, clean-clone build, or submodule pointer verification failed.
+- Confirming that all subprojects and orchestrators pass before reporting task completion.
+
+**Do NOT consult when:**
+- Only reading, searching, or exploring the codebase without making mutations.
+- Authoring plans, proposals, or designs prior to implementation.
+
+## The Two-Speed Gate Protocol
+
+Local verification operates at two distinct speeds to balance development velocity with release hermeticity:
+
+```
+Fast Loop (--quick)                     Full Pre-Flight Gate (Default)
+Speed: 3 - 10 seconds                   Speed: 20 - 45 seconds
+When: Active development iteration      When: Task completion / Pre-push
+Runs:                                   Runs:
+  [1] Code format verification            [1] Code format verification
+  [2] Strict linter execution             [2] Strict linter execution
+  [3] Fast unit/integration tests         [3] Fast unit/integration tests
+  [4] Static cross-boundary contracts     [4] Static cross-boundary contracts
+  [5] Tracked compile-time includes       [5] Tracked compile-time includes
+                                          [6] Hermetic clean-clone sandbox
+                                          [7] Runtime smoke / browser test
+```
+
+### 1. The Fast Loop (`--quick`)
+Pass `--quick` as the first argument when validating intermediate code edits:
+```bash
+./scripts/check.sh --quick
+# Or for a specific submodule:
+./<submodule-path>/scripts/check.sh --quick
+```
+This executes all native linters, compilers, and static asset checks, but skips the clean-clone build and browser smoke tests, returning actionable feedback in seconds.
+
+### 2. The Full Pre-Flight Gate
+Always execute the unflagged gate before marking any code-modifying task `[Completed]`:
+```bash
+./scripts/check.sh
+```
+This runs the full 6-slot pipeline, including cloning the committed tree into an isolated temporary directory to prove that uncommitted local files are not masking build breakages.
+
+## Workspace vs Submodule Topology
+
+A check-gated repository organizes gates in a 2-tier hierarchy:
+
+1. **Workspace Root (`./scripts/check.sh`)**:
+   - Checks workspace-wide invariants: submodule pointer freshness (`git submodule status`) and tracked credential leaks (`git ls-files`).
+   - Loops over all registered submodules and dispatches `./$path/scripts/check.sh $QUICK`.
+2. **Submodule / Subproject (`./<submodule>/scripts/check.sh`)**:
+   - Executes the module's native toolchain (Rust, Bun, Go, Python).
+   - Validates compile-time asset tracking and performs the clean-clone test.
+
+## Diagnostic Matrix: The 7 Failure Classes
+
+When `./scripts/check.sh` exits non-zero, identify the failure class and apply its self-healing recipe:
+
+| Class | Observed Diagnostic | Root Cause | Autonomous Healing Action |
+| :--- | :--- | :--- | :--- |
+| **1. Pointer Stale** | `git submodule status` shows `+<sha>` | Submodule committed, but root gitlink was not updated | In workspace root: `git add <submodule> && git commit -m "chore: bump <submodule> pointer"` |
+| **2. Pointer Uninitialized** | `git submodule status` shows `-<sha>` | Submodule clone is missing or uninitialized | Run `git submodule update --init --recursive <submodule>` |
+| **3. Credential Leaked** | `tracked: .env` / `*.key` / `id_rsa` | Secret-shaped file added to Git index | `git rm --cached <file>`, ensure pattern is in `.gitignore`, and re-run check |
+| **4. Untracked Include** | `needs '<path>' but git does not track it` | `include_str!`, `include_bytes!`, or `//go:embed` references uncommitted file | Stage the missing asset: `git add <path>` and re-run check |
+| **5. Clean-Clone Failure** | Build passes locally, fails in `$tmp/clone` | Code depends on uncommitted file, or `.gitignore` default-deny blocked a test file | Run `git status`, inspect untracked files, add missing items to Git or adjust `.gitignore` allowlist |
+| **6. Cross-Boundary Breach** | Syntax error in embedded JS/DOM contract | Static frontend asset contains undeclared variable or broken handler | Fix the client-side JavaScript/HTML contract in the source file |
+| **7. Native Regression** | Compiler, clippy, eslint, or test failed | Code broke typecheck, linter rules, or unit test assertions | Read compiler diagnostic, fix code or formatting, and re-run |
+
+## Autonomous Self-Healing Playbook
+
+Do not halt or prompt the user for routine gate failures:
+1. **Never bypass failures with `--no-verify`**: If the gate fails, the change is incomplete.
+2. **Untracked build inputs**: Compare the error output with `git status`. If a newly created asset was forgotten, stage it immediately.
+3. **Submodule pointer bumps**: Always check `git submodule status` after committing inside a submodule. If a `+` appears, commit the gitlink in the parent orchestrator before finishing.
+4. **Re-verify after healing**: Always re-execute `./scripts/check.sh` after applying a fix to guarantee exit code 0.
+
+## Reference Depth
+
+- [Script Anatomy & 6-Slot Skeleton](references/script-anatomy.md): Detailed canonical bash patterns for orchestrators and submodules.
+- [Failure Diagnostic Matrix](references/diagnostic-matrix.md): Deep-dive failure scenarios and step-by-step remediation commands.

package/skills/check/evals/benchmark.json

@@ -0,0 +1,40 @@
+{
+  "skill": "check",
+  "generated": {
+    "by": "process:structural-stage/1.0",
+    "at": "2026-09-17T14:32:00Z"
+  },
+  "stage": "behavioral",
+  "structural": {
+    "validate_structure": {
+      "pass": true,
+      "note": "recorded at apply gate (task 2.3)"
+    },
+    "validate_routing": {
+      "checks_total": 6,
+      "positive_triggers": 4,
+      "anti_triggers": 2,
+      "single_responsibility": true
+    },
+    "evals": {
+      "count": 3,
+      "assertions": 9,
+      "anti_trigger_coverage": true
+    }
+  },
+  "behavioral_dxm": "1×0.33",
+  "ship_gate": {
+    "criterion": "d = +1 and m >= 0.2",
+    "applies_to": "behavioral stage"
+  },
+  "behavioral": {
+    "at": "2026-09-17T12:33:46.775Z",
+    "evals": 3,
+    "assertions": 9,
+    "baseline": 0.5556,
+    "with_skill": 0.8889,
+    "d": 1,
+    "m": 0.3333,
+    "ship": "pass"
+  }
+}

package/skills/check/evals/evals.json

@@ -0,0 +1,38 @@
+{
+  "skill_name": "check",
+  "evals": [
+    {
+      "id": 1,
+      "prompt": "I've just finished implementing the new Axum route and migration. Verify the workspace integrity and run the check gate to ensure nothing is broken.",
+      "expected_output": "Agent activates the check skill, executes `./scripts/check.sh`, evaluates the 6-slot gate results, and reports whether the workspace passed.",
+      "files": [],
+      "assertions": [
+        "Skill activates on workspace verification and check gate request",
+        "Agent executes `./scripts/check.sh`",
+        "All 6 slots or module lanes are verified"
+      ]
+    },
+    {
+      "id": 2,
+      "prompt": "Can you read through `references/check-orchestrator.sh` and explain what line 29 does?",
+      "expected_output": "Agent does NOT activate the check skill. Reading, exploring, or explaining existing script code does not trigger verification gates.",
+      "files": [],
+      "assertions": [
+        "Anti-trigger fires: request is read-only exploration and explanation",
+        "Check skill does not activate",
+        "No check scripts are executed"
+      ]
+    },
+    {
+      "id": 3,
+      "prompt": "The pre-push check failed with: `X src/lib.rs needs 'assets/logo.png' but git does not track it`. What is wrong and how do we resolve it?",
+      "expected_output": "Agent uses the check skill diagnostic matrix to diagnose Class 4 (untracked compile-time build input), explains that `logo.png` exists locally but is uncommitted, stages it with `git add assets/logo.png`, and re-runs the check gate.",
+      "files": [],
+      "assertions": [
+        "Agent correctly identifies Class 4 untracked compile-time build input",
+        "Autonomous self-healing action stages missing asset via `git add`",
+        "Agent instructs re-running the check gate after remediation"
+      ]
+    }
+  ]
+}

package/skills/check/references/diagnostic-matrix.md

@@ -0,0 +1,170 @@
+# Failure Diagnostic Matrix & Autonomous Self-Healing
+
+This reference handbook details the 7 canonical failure classes detected by local check-gates, their root causes, and the exact step-by-step autonomous self-healing actions an AI agent must take to resolve them.
+
+---
+
+## Class 1: Submodule Pointer Stale (`+`)
+
+### Symptoms
+`git submodule status` prints a leading `+`:
+```
++a1b2c3d4e5f6 crates/api (heads/main)
+FAIL: submodule pointer is stale (+) or uninitialized (-)
+```
+
+### Root Cause
+A commit was created inside the submodule (`crates/api`), advancing its HEAD beyond the `gitlink` SHA recorded in the workspace orchestrator. If pushed in this state, CI or deploy servers will check out the old commit.
+
+### Autonomous Remediation
+Run from the workspace root:
+```bash
+git add crates/api
+git commit -m "chore: bump crates/api submodule pointer"
+```
+
+---
+
+## Class 2: Submodule Pointer Uninitialized (`-`)
+
+### Symptoms
+`git submodule status` prints a leading `-`:
+```
+-a1b2c3d4e5f6 crates/worker (heads/main)
+FAIL: submodule pointer is stale (+) or uninitialized (-)
+```
+
+### Root Cause
+The submodule exists in `.gitmodules`, but the local repository clone has not initialized its working directory.
+
+### Autonomous Remediation
+Run from the workspace root:
+```bash
+git submodule update --init --recursive crates/worker
+```
+
+---
+
+## Class 3: Tracked Credential or Secret Leak
+
+### Symptoms
+The credential scanner detects sensitive file patterns:
+```
+== 2/3 tracked credential scan ==
+  X tracked: .env.local
+  X tracked: certs/server.key
+FAIL: credential-shaped file is tracked by git
+```
+
+### Root Cause
+A developer or agent ran `git add .` or staged an environment file, private key, or credential bundle. Once pushed, the secret is compromised regardless of whether CI fails.
+
+### Autonomous Remediation
+1. Unstage and remove from Git tracking without deleting local file:
+   ```bash
+   git rm --cached .env.local certs/server.key
+   ```
+2. Verify `.gitignore` ignores the pattern:
+   ```bash
+   echo ".env*" >> .gitignore
+   echo "*.key" >> .gitignore
+   git add .gitignore && git commit -m "chore: ignore local credentials and keys"
+   ```
+
+---
+
+## Class 4: Untracked Compile-Time Build Input
+
+### Symptoms
+Step 4 static scanner fails:
+```
+== 4/6 compile-time inputs are tracked ==
+  X src/main.rs needs 'src/assets/schema.json' but git does not track it
+FAIL: untracked compile-time build input (clone would fail)
+```
+
+### Root Cause
+Rust's `include_str!` / `include_bytes!` or Go's `//go:embed` references a file on disk that is not committed in Git. The current developer's machine builds fine because the local file exists, but any fresh clone or CI runner will immediately fail with `No such file or directory`.
+
+### Autonomous Remediation
+Stage the missing file:
+```bash
+git add src/assets/schema.json
+```
+
+---
+
+## Class 5: Clean-Clone Sandbox Divergence
+
+### Symptoms
+The code builds cleanly in the current directory, but step 5 fails:
+```
+== 5/6 clean-clone sandbox ==
+error[E0583]: file not found for module `types`
+  --> src/lib.rs:4:1
+   |
+ 4 | mod types;
+   | ^^^^^^^^^^
+```
+
+### Root Cause
+The build in the working tree succeeds only because uncommitted local files exist. When `git clone -q . "$tmp/clone"` creates a pure clone of committed state, the uncommitted files are absent. Another common cause is a default-deny `/*` `.gitignore` silently ignoring a required directory.
+
+### Autonomous Remediation
+1. Check untracked files:
+   ```bash
+   git status --short
+   ```
+2. Check if a required file is being ignored:
+   ```bash
+   git check-ignore -v src/types.rs
+   ```
+3. If blocked by `.gitignore`, add an allowlist exception:
+   ```bash
+   !src/types.rs
+   ```
+4. Stage the required file:
+   ```bash
+   git add src/types.rs
+   ```
+
+---
+
+## Class 6: Cross-Boundary Asset Contract Breach
+
+### Symptoms
+Static asset or script contract checks fail:
+```
+== 4/7 static asset checks ==
+checks/no_undef.mjs:
+  X static/js/widget.js:42 - undefined identifier `handleIncomingPayload`
+```
+
+### Root Cause
+A compiled backend (Rust, Go) embeds or serves frontend JavaScript/HTML. The backend compiles successfully because it treats assets as opaque strings/bytes, but the embedded asset contains a runtime JavaScript bug or broken contract.
+
+### Autonomous Remediation
+Open the client script (`static/js/widget.js`) and define the missing identifier, fix the function signature, or fix the markup handle.
+
+---
+
+## Class 7: Native Quality Regressions
+
+### Symptoms
+Step 1, 2, or 3 fails:
+- `cargo fmt --check` / `bun run format:check`
+- `cargo clippy -- -D warnings` / `eslint`
+- `cargo test` / `bun test`
+
+### Root Cause
+Code formatting divergence, strict linter warning, or a broken unit/integration test assertion.
+
+### Autonomous Remediation
+1. For formatting: run the language formatter:
+   ```bash
+   cargo fmt
+   # or: bun run format
+   # or: gofmt -w .
+   ```
+2. For linter / compiler: read the compiler diagnostics, apply surgical code fix, and re-run.
+3. For failing tests: inspect the test assertion failure, resolve the bug, and re-run.

package/skills/check/references/script-anatomy.md

@@ -0,0 +1,154 @@
+# Canonical Check Script Anatomy
+
+This reference document defines the standard 6-slot architecture for local pre-push gate scripts (`scripts/check.sh`) across workspace orchestrators and submodules.
+
+---
+
+## 1. The Two-Tier Gate Model
+
+In monorepos and submodule workspaces, gates are divided into two complementary tiers:
+1. **The Orchestrator Gate (`./scripts/check.sh`)**: Enforces workspace-level invariants (pointer synchronization and credential leaks across the entire tree) and dispatches to each module's gate.
+2. **The Submodule Gate (`./<module>/scripts/check.sh`)**: Enforces language-native compilation, linting, tests, asset tracking, and clean-clone hermeticity for that specific module.
+
+---
+
+## 2. Workspace Orchestrator Skeleton (`./scripts/check.sh`)
+
+The root gate coordinates all submodules and blocks credential leaks before any packet touches the network.
+
+```bash
+#!/usr/bin/env bash
+# Workspace Orchestrator Push Gate
+# Usage: scripts/check.sh [--quick]
+set -euo pipefail
+
+cd "$(dirname "$0")/.."
+QUICK="${1:-}"
+
+echo "== 1/3 submodule pointers =="
+status="$(git submodule status || true)"
+if [ -z "$status" ]; then
+    echo "  (no submodules registered)"
+else
+    echo "$status" | sed 's/^/  /'
+    if echo "$status" | grep -qE '^[+-]'; then
+        echo "FAIL: submodule pointer is stale (+) or uninitialized (-)"
+        echo "      commit updated pointer in orchestrator: git add <path> && git commit"
+        exit 1
+    fi
+fi
+
+echo "== 2/3 tracked credential scan =="
+leaks="$(git ls-files | grep -iE '(^|/)(\.env|\.env\..*|.*\.pem|.*\.key|.*\.p12|id_rsa.*|.*credentials?.*)$' || true)"
+if [ -n "$leaks" ]; then
+    echo "$leaks" | sed 's/^/  X tracked: /'
+    echo "FAIL: credential-shaped file is tracked by git"
+    exit 1
+fi
+echo "  no credential-shaped paths tracked"
+
+echo "== 3/3 submodule gates =="
+while read -r _sha path _rest; do
+    [ -n "$path" ] || continue
+    if [ -x "$path/scripts/check.sh" ]; then
+        echo "-- $path --"
+        (cd "$path" && ./scripts/check.sh $QUICK)
+    else
+        echo "-- $path: no scripts/check.sh, skipping --"
+    fi
+done < <(git submodule status | awk '{print $1, $2}')
+
+echo "workspace gate: OK"
+```
+
+---
+
+## 3. Submodule Gate Skeleton (`./<module>/scripts/check.sh`)
+
+The module gate implements the standard 6-slot pipeline with the `--quick` exit boundary.
+
+```bash
+#!/usr/bin/env bash
+# Submodule Pre-Push Gate
+# Usage: scripts/check.sh [--quick]
+set -euo pipefail
+
+cd "$(dirname "$0")/.."
+QUICK="${1:-}"
+
+# Slot 1: Format verification
+echo "== 1/6 format =="
+# Language native: cargo fmt --check | bun run format:check | gofmt -l .
+cargo fmt --check
+
+# Slot 2: Strict linting
+echo "== 2/6 linter =="
+# Language native: cargo clippy --all-targets -- -D warnings | eslint | ruff check .
+cargo clippy --all-targets -- -D warnings
+
+# Slot 3: Unit and integration tests
+echo "== 3/6 unit tests =="
+# Language native: cargo test | bun test | go test ./... | pytest
+cargo test
+
+# Slot 4: Compile-time asset tracking check
+echo "== 4/6 compile-time inputs are tracked =="
+# Scans source files for include_str!, include_bytes!, or //go:embed
+missing=0
+while IFS= read -r hit; do
+    file="${hit%%:*}"
+    literal="${hit#*:}"
+    literal="${literal#*\"}"
+    literal="${literal%%\"*}"
+    case "$literal" in
+    *'$'* | *'{'*) continue ;; # skip computed paths
+    esac
+    path="$(dirname "$file")/$literal"
+    if ! git ls-files --error-unmatch -- "$path" >/dev/null 2>&1; then
+        echo "  X $file needs '$path' but git does not track it"
+        missing=1
+    else
+        echo "  ok $path"
+    fi
+done < <(grep -rEn 'include_(bytes|str)!\("' src/ 2>/dev/null || true)
+[ "$missing" -eq 0 ] || {
+    echo "FAIL: untracked compile-time build input (clean clone would fail)"
+    exit 1
+}
+
+# --- Fast Loop Exit Boundary ---
+if [ "$QUICK" = "--quick" ]; then
+    echo "fast checks passed; clean-clone and smoke tests skipped (--quick)"
+    exit 0
+fi
+
+# Slot 5: Hermetic clean-clone test
+echo "== 5/6 clean-clone sandbox =="
+tmp="$(mktemp -d)"
+trap 'rm -rf "$tmp"' EXIT
+git clone -q . "$tmp/clone"
+(
+    cd "$tmp/clone"
+    # Prove that the committed tree builds and passes tests without local dirty state
+    cargo build --release
+    cargo test
+)
+echo "clean clone builds and tests: OK"
+
+# Slot 6: Smoke / browser test
+echo "== 6/6 smoke / runtime test =="
+# Run binary smoke test or headless browser check if applicable
+echo "smoke test: OK"
+
+echo "lane: OK"
+```
+
+---
+
+## 4. Invariant Rules for Check Scripts
+
+1. **Executable bit**: Every check script must have `chmod +x` set and tracked in Git.
+2. **Safe shell options**: Always start with `#!/usr/bin/env bash` and `set -euo pipefail`.
+3. **Idempotent cleanup**: Always use `trap 'rm -rf "$tmp"' EXIT` when creating temporary sandbox clones.
+4. **Relativity**: Always resolve paths relative to the script location: `cd "$(dirname "$0")/.."`.
+5. **Universal `--quick` parameter**: Every check script must accept `--quick` as its first argument and forward it to nested submodule invocations.