@njeybe/nativ 2.4.1 → 2.5.0

package/dist/server/studio-ui/shell/pipeline-state.js

@@ -83,9 +83,11 @@ export const pipelineStateScript = String.raw `  // ─── Pipeline state ─
       pipe.escalations = Array.isArray(body.escalations) ? body.escalations : [];
       syncHealTab();
       renderTriageChip();
+      if (typeof checkAutoTriage === 'function') checkAutoTriage();
     } else if (part === 'triage') {
       pipe.triage = body;
       renderTriageChip();
+      if (typeof checkAutoTriage === 'function') checkAutoTriage();
     }
   }
 

package/dist/server/studio-ui/shell/triage.js

@@ -59,6 +59,15 @@ export const triageScript = String.raw `  // ─── Tier 1 AI Strategist (/ap
     ($('t1-auto').disabled ? menu : $('t1-auto')).focus();
   }
 
+  function checkAutoTriage() {
+    if (!pipe.triage || !pipe.triage.autoTriageEnabled) return;
+    (pipe.escalations || []).forEach(function (e) {
+      if (e && e.status === 'pending_review' && !e.triage && !pipe.triageRunning[e.id]) {
+        runTriage(e);
+      }
+    });
+  }
+
   function setAutoTriage(enabled) {
     if (pipe.busy.triageConfig) return;
     pipe.busy.triageConfig = true;
@@ -66,6 +75,7 @@ export const triageScript = String.raw `  // ─── Tier 1 AI Strategist (/ap
     postJson('/api/pipeline/triage/config', { autoTriageEnabled: enabled }).then(function (body) {
       pipe.triage = Object.assign({}, pipe.triage || {}, { autoTriageEnabled: !!(body.config && body.config.autoTriageEnabled) });
       toast(enabled ? 'Autonomous Auto-Triage on: fixes Tier 1 proves safe are applied without asking' : 'Autonomous Auto-Triage off: every fix waits for your approval', 'ok');
+      if (enabled) checkAutoTriage();
     }, function (e) {
       toast('Could not change Autonomous Auto-Triage: ' + e.message);
     }).then(function () {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@njeybe/nativ",
-  "version": "2.4.1",
+  "version": "2.5.0",
   "description": "Role-based multi-agent workflow harness: Claude Code by default, other AI agents pluggable",
   "type": "module",
   "main": "dist/index.js",
@@ -22,7 +22,7 @@
     "prepare": "npm run build",
     "prepublishOnly": "npm run build && node scripts/sync-plugin.mjs --check",
     "start": "node bin/cli.js",
-    "test": "node tests/test-task-router.mjs && node tests/test-task-fields.mjs && node tests/test-design-templates.mjs && node tests/test-spec-slices.mjs && node tests/test-learnings.mjs && node tests/test-contract-generator.mjs && node tests/test-verify-gatekeeper.mjs && node tests/test-mcp-server.mjs && node tests/test-data-studio.mjs && node tests/test-fragmented-env.mjs && node tests/test-env-example-detection.mjs && node tests/test-contract-governor.mjs && node tests/test-worktree-lifecycle.mjs && node tests/test-agent-supervisor.mjs && node tests/test-concurrency-locks.mjs && node tests/test-telemetry-engine.mjs && node tests/test-benchmark-suite.mjs && node tests/test-providers.mjs && node tests/test-tier1-liaison.mjs && node tests/test-enforcement.mjs && node tests/test-setup-doctor.mjs && node tests/test-update.mjs && node tests/test-validate.mjs && node tests/test-plugin-manifest.mjs && node tests/test-code-shape.mjs && node tests/test-model-routing.mjs && node tests/test-v2-e2e.mjs && npx tsx tests/test-studio-pipeline-api.mjs && npx tsx tests/test-studio-light-ui.mjs && npx tsx tests/test-studio-shell.mjs && npx tsx tests/test-studio-home.mjs && npx tsx tests/test-studio-tasks-view.mjs && npx tsx tests/test-studio-flow.mjs && npx tsx tests/test-studio-team.mjs && npx tsx tests/test-studio-redesign-e2e.mjs"
+    "test": "node tests/test-profiles.mjs && node tests/test-task-router.mjs && node tests/test-task-fields.mjs && node tests/test-design-templates.mjs && node tests/test-spec-slices.mjs && node tests/test-learnings.mjs && node tests/test-contract-generator.mjs && node tests/test-verify-gatekeeper.mjs && node tests/test-mcp-server.mjs && node tests/test-data-studio.mjs && node tests/test-fragmented-env.mjs && node tests/test-env-example-detection.mjs && node tests/test-contract-governor.mjs && node tests/test-worktree-lifecycle.mjs && node tests/test-agent-supervisor.mjs && node tests/test-concurrency-locks.mjs && node tests/test-telemetry-engine.mjs && node tests/test-benchmark-suite.mjs && node tests/test-providers.mjs && node tests/test-tier1-liaison.mjs && node tests/test-enforcement.mjs && node tests/test-setup-doctor.mjs && node tests/test-update.mjs && node tests/test-validate.mjs && node tests/test-plugin-manifest.mjs && node tests/test-code-shape.mjs && node tests/test-model-routing.mjs && node tests/test-v2-e2e.mjs && npx tsx tests/test-studio-pipeline-api.mjs && npx tsx tests/test-studio-light-ui.mjs && npx tsx tests/test-studio-shell.mjs && npx tsx tests/test-studio-home.mjs && npx tsx tests/test-studio-tasks-view.mjs && npx tsx tests/test-studio-flow.mjs && npx tsx tests/test-studio-team.mjs && npx tsx tests/test-studio-redesign-e2e.mjs"
   },
   "keywords": [
     "ai",

package/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "nativ",
   "displayName": "nativ",
-  "version": "2.4.1",
+  "version": "2.5.0",
   "description": "Role-based multi-agent workflow for Claude Code: architect, worker, verifier and explorer agents, task-scope enforcement, and the nativ MCP server.",
   "author": {
     "name": "JB Natividad"

package/plugin/agents/architect.md

@@ -45,9 +45,11 @@ Token limits: exactly two directions, style tiles only in Full, compact wirefram
 ## Task breakdown
 
 - About one component or endpoint per task, at most 5 files.
-- `acceptanceCriteria` in plain words, including which states apply (loading, empty, error).
+- Reusable components first: If a UI element or primitive is needed across multiple views, create a dedicated foundational component task first and register it under the Shared Component Registry in `.ai/ui_specs.md` before dependent screen tasks.
+- `acceptanceCriteria` in plain words, including which states apply (loading, empty, error) and which shared components must be reused.
 - `specRefs` point to exact sections, such as `ui_specs.md#appointment-list` or an `api_contracts.json` route.
 - `complexity` is `simple`, `standard` or `complex`.
+- `verificationCommand` must be a targeted single-file test (e.g. `npx vitest run path/to/file.test.ts`), taking < 5s. Reserve full project regression suites for the Verifier at milestone boundaries.
 - Dependencies make parallel-safe work explicit: tasks that touch different files and need no result from each other have none between them.
 
 ```bash
@@ -55,7 +57,7 @@ nativ task add "Appointment list" --agent frontend \
   --spec-refs "ui_specs.md#appointment-list,api_contracts.json#GET /appointments" \
   --complexity standard \
   --accept "Shows name and time per row" --accept "Empty and error states shown" \
-  --files src/components/AppointmentList.tsx --deps task-3 --verify "npm test"
+  --files src/components/AppointmentList.tsx --deps task-3 --verify "npx vitest run tests/unit/AppointmentList.test.tsx"
 ```
 
 ## Limits

package/plugin/agents/verifier.md

@@ -18,7 +18,7 @@ You did not write this code, and that is the point: check it as a skeptic would.
    - table, column, route and schema names match `.ai/db_schema.json` and `.ai/api_contracts.json`
    - only the task's `targetFiles` changed, and no tests were deleted or weakened
    - no secrets, connection strings or data in code, logs, tests or commits
-   - the `## Code style` rules in `AGENTS.md` are followed (lines over 120 characters, comments over 2 lines, oversized files or UI files with several components); report violations as findings
+   - the `## Code style` rules in `AGENTS.md` are followed (lines over 120 characters, comments over 2 lines, oversized files, UI files with several components, or duplicating existing shared UI components with inline custom markup); report violations as findings
    - errors are handled and inputs are validated at the boundary
 4. Report in short findings, most serious first. For each: the file and line, what is wrong, and why it matters. Separate confirmed problems from suspicions and say which is which.
 5. If you find nothing, say what you checked so the result can be trusted.

package/plugin/agents/worker.md

@@ -3,8 +3,8 @@ name: worker
 description: Implements exactly one nativ task inside its targetFiles and verifies it. Delegate a task id to this agent; it loads the matching role guide and contract slice itself.
 tools: Read, Grep, Glob, Edit, Write, Bash, mcp__plugin_nativ_nativ
 model: sonnet
-effort: medium
-maxTurns: 40
+effort: low
+maxTurns: 20
 ---
 
 You are a **Worker** in a nativ workflow. Read `AGENTS.md` first; it defines every role and the task loop.
@@ -17,6 +17,7 @@ You are given one task id. Do that task and nothing else.
 2. Load only what the task needs: `.ai/subagents/<assignedSubagent>.md` and the contract slice `AGENTS.md` lists for that role. If the task has `specSlices`, read those first. Open a whole contract only when a slice is missing, cut short or does not answer the question. If it has `priorEscalations`, follow how each was settled; do not raise a settled gap again. If it has `learnings`, follow them.
 3. Change **only** the files in `targetFiles`. Match the style of the surrounding code and follow the contracts exactly: table and column names, routes and schemas, design tokens.
    Follow the `## Code style` rules in `AGENTS.md`: short lines, small functions, one UI component per file, brief plain comments.
+   Ensure UI components are pure, props-driven, and reusable. Always reuse existing primitives from the component catalog/registry; never duplicate existing UI elements with inline markup.
 4. Run the `verificationCommand`. If it fails, fix the cause and run it again. You have three fix attempts.
 5. If it still fails: `git checkout -- <targetFiles>`, then `nativ task block <taskId> --reason "Verification failed after 3 attempts: <short error>"`, then stop and report.
 6. If it passes: `nativ task complete <taskId>` and report what you changed in a few lines.
@@ -24,5 +25,7 @@ You are given one task id. Do that task and nothing else.
 
 ## Boundaries
 
-- A hook flags writes outside `targetFiles`. If a change outside them seems necessary, that is a contract or scope gap: run `nativ task escalate <taskId> --type architectural_ambiguity --details "..."` and stop. Do not edit the file anyway.
-- Never edit anything under `.ai/`. Never read or write `.env*` files or other secrets. Do not use `nativ task unlock`, `nativ db sync` or `--no-verify`.
+- A hook flags writes outside `targetFiles` and safe peripheral files. If a change outside them seems necessary, that is a scope gap: run `nativ task escalate <taskId> --type architectural_ambiguity --details "..."` and stop.
+- Never edit anything under `.ai/` directly. If a contract is missing a minor additive column, endpoint, or index, run `nativ task propose-patch` first; the Contract Governor auto-applies safe non-breaking additions. Only escalate if the change is destructive or ambiguous.
+- Never read or write `.env*` files or other secrets. Do not use `nativ task unlock`, `nativ db sync` or `--no-verify`.
+

package/plugin/skills/nativ/SKILL.md

@@ -59,6 +59,7 @@ Applies to every worker. A project's own formatter or linter config wins over th
 - Lines: aim for 100 characters or fewer, hard maximum 120.
 - Functions: about 40 lines. Files: about 300 lines.
 - A growing UI file is split into components, one component per file.
+- Reusable components: UI components must be pure, props-driven, and single-responsibility. Reuse shared components from the design system or component registry; never duplicate existing UI elements with inline custom markup.
 - Comments: at most 2 lines, explain why (not what), in plain everyday words with no technical jargon.
 - Do not restate the code in a comment. No banner or divider comments. No commented-out code.
 - Match the surrounding code.

package/templates/.claudeignore

@@ -1,45 +1,62 @@
-# Nativ Zero-Credential AI Air-Gap
-# Files that must never be read into an AI agent's context.
-# Database credentials live only in these files and in the local nativ process memory.
-
-# Environment files (connection strings, API keys, secrets)
-.env
-.env.*
-.env*.local
-**/.env
-**/.env.*
-!.env.example
-!**/.env.example
-
-# Nativ local runtime state (saved connections, session data)
-.nativ/*.local.json
-.agentj/*.local.json
-**/*.local.json
-
-# Private keys & certificates
-*.pem
-*.key
-*.p12
-*.pfx
-id_rsa*
-id_ed25519*
-
-# Local database files (may contain real data; agents only need .ai/db_schema.json)
-*.sqlite
-*.sqlite3
-*.db
-*.db-journal
-*.db-wal
-*.db-shm
-
-# Database dumps & backups
-*.dump
-*.sql.gz
-*.bak
-
-# Cloud & tooling credentials
-.npmrc
-.pgpass
-.my.cnf
-**/credentials.json
-**/service-account*.json
+# Nativ Zero-Credential AI Air-Gap
+# Files that must never be read into an AI agent's context.
+# Database credentials live only in these files and in the local nativ process memory.
+
+# Environment files (connection strings, API keys, secrets)
+.env
+.env.*
+.env*.local
+**/.env
+**/.env.*
+!.env.example
+!**/.env.example
+
+# Nativ local runtime state (saved connections, session data)
+.nativ/*.local.json
+.agentj/*.local.json
+**/*.local.json
+
+# Private keys & certificates
+*.pem
+*.key
+*.p12
+*.pfx
+id_rsa*
+id_ed25519*
+
+# Local database files (may contain real data; agents only need .ai/db_schema.json)
+*.sqlite
+*.sqlite3
+*.db
+*.db-journal
+*.db-wal
+*.db-shm
+
+# Database dumps & backups
+*.dump
+*.sql.gz
+*.bak
+
+# Cloud & tooling credentials
+.npmrc
+.pgpass
+.my.cnf
+**/credentials.json
+**/service-account*.json
+
+# Build outputs, compiler caches & coverage (token bloat prevention)
+dist/
+build/
+coverage/
+.next/
+*.tsbuildinfo
+
+# Isolated worktrees & dependency trees
+.worktrees/
+node_modules/
+
+# Package manager lockfiles (massive non-code context)
+package-lock.json
+pnpm-lock.yaml
+yarn.lock
+

package/templates/AGENTS.md

@@ -51,6 +51,7 @@ Applies to every worker. A project's own formatter or linter config wins over th
 - Lines: aim for 100 characters or fewer, hard maximum 120.
 - Functions: about 40 lines. Files: about 300 lines.
 - A growing UI file is split into components, one component per file.
+- Reusable components: UI components must be pure, props-driven, and single-responsibility. Reuse shared components from the design system or component registry; never duplicate existing UI elements with inline custom markup.
 - Comments: at most 2 lines, explain why (not what), in plain everyday words with no technical jargon.
 - Do not restate the code in a comment. No banner or divider comments. No commented-out code.
 - Match the surrounding code.

package/templates/CLAUDE.md

@@ -13,6 +13,19 @@ You are the **Project Manager** in this project's nativ workflow. `AGENTS.md` (i
 - You may not edit `.ai/`. If the enforcement hook warns about a file, that is a scope or contract gap: escalate with `nativ task escalate`, do not edit around it.
 - `nativ doctor` confirms the integration is intact. Run it after updating Claude Code or nativ, and whenever hooks or MCP tools seem to be missing.
 
+## Autonomous Execution (Hands-Free Loop)
+
+When instructed to run autonomously (e.g. "run the queue", "execute milestone", or AFK mode):
+1. Call `nativ_task_next`.
+2. Start the task (`nativ_task_start`).
+3. Delegate to the `worker` agent with the task ID and recommended model.
+4. When the worker finishes, verify (`nativ_verify`).
+5. Complete the task (`nativ_task_complete`).
+6. **Immediately loop to the next task.** Do NOT pause between tasks or ask the human for permission to proceed.
+7. Stop ONLY when:
+   - All tasks in the milestone are completed: call the `verifier` agent for an independent milestone check, then notify the human.
+   - A task trips the circuit breaker or escalates: stop and present the four-part summary.
+
 ## Human-Centric Communication Protocol
 
 The human is the product owner, not a log reader. When you report a blocker, a trade-off or an escalation, use four parts and plain words:

package/templates/claude-agents/architect.md

@@ -45,9 +45,11 @@ Token limits: exactly two directions, style tiles only in Full, compact wirefram
 ## Task breakdown
 
 - About one component or endpoint per task, at most 5 files.
-- `acceptanceCriteria` in plain words, including which states apply (loading, empty, error).
+- Reusable components first: If a UI element or primitive is needed across multiple views, create a dedicated foundational component task first and register it under the Shared Component Registry in `.ai/ui_specs.md` before dependent screen tasks.
+- `acceptanceCriteria` in plain words, including which states apply (loading, empty, error) and which shared components must be reused.
 - `specRefs` point to exact sections, such as `ui_specs.md#appointment-list` or an `api_contracts.json` route.
 - `complexity` is `simple`, `standard` or `complex`.
+- `verificationCommand` must be a targeted single-file test (e.g. `npx vitest run path/to/file.test.ts`), taking < 5s. Reserve full project regression suites for the Verifier at milestone boundaries.
 - Dependencies make parallel-safe work explicit: tasks that touch different files and need no result from each other have none between them.
 
 ```bash
@@ -55,7 +57,7 @@ nativ task add "Appointment list" --agent frontend \
   --spec-refs "ui_specs.md#appointment-list,api_contracts.json#GET /appointments" \
   --complexity standard \
   --accept "Shows name and time per row" --accept "Empty and error states shown" \
-  --files src/components/AppointmentList.tsx --deps task-3 --verify "npm test"
+  --files src/components/AppointmentList.tsx --deps task-3 --verify "npx vitest run tests/unit/AppointmentList.test.tsx"
 ```
 
 ## Limits

package/templates/claude-agents/verifier.md

@@ -18,7 +18,7 @@ You did not write this code, and that is the point: check it as a skeptic would.
    - table, column, route and schema names match `.ai/db_schema.json` and `.ai/api_contracts.json`
    - only the task's `targetFiles` changed, and no tests were deleted or weakened
    - no secrets, connection strings or data in code, logs, tests or commits
-   - the `## Code style` rules in `AGENTS.md` are followed (lines over 120 characters, comments over 2 lines, oversized files or UI files with several components); report violations as findings
+   - the `## Code style` rules in `AGENTS.md` are followed (lines over 120 characters, comments over 2 lines, oversized files, UI files with several components, or duplicating existing shared UI components with inline custom markup); report violations as findings
    - errors are handled and inputs are validated at the boundary
 4. Report in short findings, most serious first. For each: the file and line, what is wrong, and why it matters. Separate confirmed problems from suspicions and say which is which.
 5. If you find nothing, say what you checked so the result can be trusted.

package/templates/claude-agents/worker.md

@@ -3,8 +3,8 @@ name: worker
 description: Implements exactly one nativ task inside its targetFiles and verifies it. Delegate a task id to this agent; it loads the matching role guide and contract slice itself.
 tools: Read, Grep, Glob, Edit, Write, Bash, mcp__nativ
 model: sonnet
-effort: medium
-maxTurns: 40
+effort: low
+maxTurns: 20
 ---
 
 You are a **Worker** in a nativ workflow. Read `AGENTS.md` first; it defines every role and the task loop.
@@ -17,6 +17,7 @@ You are given one task id. Do that task and nothing else.
 2. Load only what the task needs: `.ai/subagents/<assignedSubagent>.md` and the contract slice `AGENTS.md` lists for that role. If the task has `specSlices`, read those first. Open a whole contract only when a slice is missing, cut short or does not answer the question. If it has `priorEscalations`, follow how each was settled; do not raise a settled gap again. If it has `learnings`, follow them.
 3. Change **only** the files in `targetFiles`. Match the style of the surrounding code and follow the contracts exactly: table and column names, routes and schemas, design tokens.
    Follow the `## Code style` rules in `AGENTS.md`: short lines, small functions, one UI component per file, brief plain comments.
+   Ensure UI components are pure, props-driven, and reusable. Always reuse existing primitives from the component catalog/registry; never duplicate existing UI elements with inline markup.
 4. Run the `verificationCommand`. If it fails, fix the cause and run it again. You have three fix attempts.
 5. If it still fails: `git checkout -- <targetFiles>`, then `nativ task block <taskId> --reason "Verification failed after 3 attempts: <short error>"`, then stop and report.
 6. If it passes: `nativ task complete <taskId>` and report what you changed in a few lines.
@@ -24,5 +25,7 @@ You are given one task id. Do that task and nothing else.
 
 ## Boundaries
 
-- A hook flags writes outside `targetFiles`. If a change outside them seems necessary, that is a contract or scope gap: run `nativ task escalate <taskId> --type architectural_ambiguity --details "..."` and stop. Do not edit the file anyway.
-- Never edit anything under `.ai/`. Never read or write `.env*` files or other secrets. Do not use `nativ task unlock`, `nativ db sync` or `--no-verify`.
+- A hook flags writes outside `targetFiles` and safe peripheral files. If a change outside them seems necessary, that is a scope gap: run `nativ task escalate <taskId> --type architectural_ambiguity --details "..."` and stop.
+- Never edit anything under `.ai/` directly. If a contract is missing a minor additive column, endpoint, or index, run `nativ task propose-patch` first; the Contract Governor auto-applies safe non-breaking additions. Only escalate if the change is destructive or ambiguous.
+- Never read or write `.env*` files or other secrets. Do not use `nativ task unlock`, `nativ db sync` or `--no-verify`.
+

package/templates/dot-ai/api_contracts.json

@@ -1,66 +1,66 @@
-{
-  "$schema": "http://json-schema.org/draft-07/schema#",
-  "version": "1.0.0",
-  "projectName": "{{PROJECT_NAME}}",
-  "updatedAt": "{{TIMESTAMP}}",
-  "baseUrl": "/api/v1",
-  "authScheme": "Bearer JWT",
-  "endpoints": [
-    {
-      "id": "health-check",
-      "path": "/health",
-      "method": "GET",
-      "description": "System health and runtime status check",
-      "auth": false,
-      "request": {
-        "headers": {},
-        "queryParams": {},
-        "pathParams": {},
-        "body": null
-      },
-      "responses": {
-        "200": {
-          "description": "System is healthy and operational",
-          "body": {
-            "status": "ok",
-            "uptime": "number",
-            "timestamp": "string"
-          }
-        }
-      }
-    },
-    {
-      "id": "example-entity-list",
-      "path": "/entities",
-      "method": "GET",
-      "description": "Demonstration collection endpoint. The architect updates this during Phase 1 API design.",
-      "auth": true,
-      "request": {
-        "headers": {
-          "Authorization": "Bearer <token>"
-        },
-        "queryParams": {
-          "limit": "integer (optional, default 20)",
-          "offset": "integer (optional, default 0)"
-        },
-        "pathParams": {},
-        "body": null
-      },
-      "responses": {
-        "200": {
-          "description": "List of entities matching query filter",
-          "body": {
-            "data": "array of example_entity",
-            "total": "integer"
-          }
-        },
-        "401": {
-          "description": "Unauthorized access missing or invalid token",
-          "body": {
-            "error": "Unauthorized"
-          }
-        }
-      }
-    }
-  ]
-}
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "version": "1.0.0",
+  "projectName": "{{PROJECT_NAME}}",
+  "updatedAt": "{{TIMESTAMP}}",
+  "baseUrl": "/api/v1",
+  "authScheme": "Bearer JWT",
+  "endpoints": [
+    {
+      "id": "health-check",
+      "path": "/health",
+      "method": "GET",
+      "description": "System health and runtime status check",
+      "auth": false,
+      "request": {
+        "headers": {},
+        "queryParams": {},
+        "pathParams": {},
+        "body": null
+      },
+      "responses": {
+        "200": {
+          "description": "System is healthy and operational",
+          "body": {
+            "status": "ok",
+            "uptime": "number",
+            "timestamp": "string"
+          }
+        }
+      }
+    },
+    {
+      "id": "example-entity-list",
+      "path": "/entities",
+      "method": "GET",
+      "description": "Demonstration collection endpoint. The architect updates this during Phase 1 API design.",
+      "auth": true,
+      "request": {
+        "headers": {
+          "Authorization": "Bearer <token>"
+        },
+        "queryParams": {
+          "limit": "integer (optional, default 20)",
+          "offset": "integer (optional, default 0)"
+        },
+        "pathParams": {},
+        "body": null
+      },
+      "responses": {
+        "200": {
+          "description": "List of entities matching query filter",
+          "body": {
+            "data": "array of example_entity",
+            "total": "integer"
+          }
+        },
+        "401": {
+          "description": "Unauthorized access missing or invalid token",
+          "body": {
+            "error": "Unauthorized"
+          }
+        }
+      }
+    }
+  ]
+}

package/templates/dot-ai/context.md

@@ -1,38 +1,38 @@
-# Project Context & Guardrails
-
-## 1. System Overview & Repository Profile
-- **Project Name:** {{PROJECT_NAME}}
-- **Repository Type:** {{REPOSITORY_TYPE}}
-- **Workspace Topology:** {{WORKSPACE_TOPOLOGY}}
-- **Primary Goal:** {{PROJECT_GOAL}}
-
-## 2. Technology Stack & Ecosystem Manifests
-- **Language / Runtime:** {{DETECTED_RUNTIME}}
-- **Framework:** {{DETECTED_FRAMEWORK}}
-- **Database / ORM:** {{DETECTED_DATABASE_ORM}}
-- **ORM / Migration Config:** {{DETECTED_ORM_CONFIG}}
-- **Styling / UI Library:** {{DETECTED_STYLING}}
-- **Testing Framework:** {{DETECTED_TESTING}}
-- **Package Manager:** {{DETECTED_PACKAGE_MANAGER}}
-- **Discovered Manifests:** {{ECOSYSTEM_MANIFESTS}}
-
-## 3. Architecture & Codebase Layout
-- **Source Root:** `{{SOURCE_ROOT}}`
-- **Core Pattern:** {{ARCHITECTURE_PATTERN}}
-- **Key Directories:**
-{{KEY_DIRECTORIES}}
-
-## 4. Engineering Guardrails & Constraints
-1. **Strict Role Pipeline (provider-agnostic):** Architect (designs contracts and resolves escalations) -> Project Manager (orchestrates the task loop) -> Workers (specialized sub-agents) -> Verifier (independent checks). Roles are fixed; the model or vendor behind a role is configurable. Claude Code is the default host for every role, and other agents can be plugged in.
-2. **Zero Breaking Changes:** Avoid breaking existing public interfaces, CLI options, or database contracts without explicit migration strategies.
-3. **Schema Authority:** Database modifications must strictly align with `.ai/db_schema.json`.
-4. **UI Fidelity:** User interface components must strictly match `.ai/ui_specs.md`.
-5. **Secrets & Security:** Never hardcode API keys, passwords, or tokens. Use environment variables. Validate all external inputs.
-6. **Testing Requirement:** Every newly introduced endpoint, service, or complex component must include automated tests before marking tasks completed in `.ai/master_plan.json`.
-
-## 5. Execution Boundaries (Sub-Agent Allocation)
-- **`backend`:** Core services, CLI logic, APIs, server runtime code, and route handlers.
-- **`frontend`:** Web application views, client components, or terminal UI presentation.
-- **`database`:** Schema definitions, ORM models, migrations, and seed scripts matching `.ai/db_schema.json`.
-- **`qa-tester`:** Unit tests, integration tests, and verification scripts.
-- **Specialized Units:** `flutter-developer`, `devops-agent`, `security-auditor`, `db-migration` when required.
+# Project Context & Guardrails
+
+## 1. System Overview & Repository Profile
+- **Project Name:** {{PROJECT_NAME}}
+- **Repository Type:** {{REPOSITORY_TYPE}}
+- **Workspace Topology:** {{WORKSPACE_TOPOLOGY}}
+- **Primary Goal:** {{PROJECT_GOAL}}
+
+## 2. Technology Stack & Ecosystem Manifests
+- **Language / Runtime:** {{DETECTED_RUNTIME}}
+- **Framework:** {{DETECTED_FRAMEWORK}}
+- **Database / ORM:** {{DETECTED_DATABASE_ORM}}
+- **ORM / Migration Config:** {{DETECTED_ORM_CONFIG}}
+- **Styling / UI Library:** {{DETECTED_STYLING}}
+- **Testing Framework:** {{DETECTED_TESTING}}
+- **Package Manager:** {{DETECTED_PACKAGE_MANAGER}}
+- **Discovered Manifests:** {{ECOSYSTEM_MANIFESTS}}
+
+## 3. Architecture & Codebase Layout
+- **Source Root:** `{{SOURCE_ROOT}}`
+- **Core Pattern:** {{ARCHITECTURE_PATTERN}}
+- **Key Directories:**
+{{KEY_DIRECTORIES}}
+
+## 4. Engineering Guardrails & Constraints
+1. **Strict Role Pipeline (provider-agnostic):** Architect (designs contracts and resolves escalations) -> Project Manager (orchestrates the task loop) -> Workers (specialized sub-agents) -> Verifier (independent checks). Roles are fixed; the model or vendor behind a role is configurable. Claude Code is the default host for every role, and other agents can be plugged in.
+2. **Zero Breaking Changes:** Avoid breaking existing public interfaces, CLI options, or database contracts without explicit migration strategies.
+3. **Schema Authority:** Database modifications must strictly align with `.ai/db_schema.json`.
+4. **UI Fidelity:** User interface components must strictly match `.ai/ui_specs.md`.
+5. **Secrets & Security:** Never hardcode API keys, passwords, or tokens. Use environment variables. Validate all external inputs.
+6. **Testing Requirement:** Every newly introduced endpoint, service, or complex component must include automated tests before marking tasks completed in `.ai/master_plan.json`.
+
+## 5. Execution Boundaries (Sub-Agent Allocation)
+- **`backend`:** Core services, CLI logic, APIs, server runtime code, and route handlers.
+- **`frontend`:** Web application views, client components, or terminal UI presentation.
+- **`database`:** Schema definitions, ORM models, migrations, and seed scripts matching `.ai/db_schema.json`.
+- **`qa-tester`:** Unit tests, integration tests, and verification scripts.
+- **Specialized Units:** `flutter-developer`, `devops-agent`, `security-auditor`, `db-migration` when required.

package/templates/dot-ai/db_schema.json

@@ -1,39 +1,39 @@
-{
-  "$schema": "http://json-schema.org/draft-07/schema#",
-  "version": "1.0.0",
-  "projectName": "{{PROJECT_NAME}}",
-  "updatedAt": "{{TIMESTAMP}}",
-  "engine": "{{DETECTED_DATABASE_ENGINE}}",
-  "tables": [
-    {
-      "name": "example_entity",
-      "description": "Demonstration table definition. The architect updates this during Phase 1A.",
-      "columns": [
-        {
-          "name": "id",
-          "type": "UUID",
-          "primaryKey": true,
-          "nullable": false,
-          "default": "gen_random_uuid()"
-        },
-        {
-          "name": "created_at",
-          "type": "TIMESTAMP",
-          "primaryKey": false,
-          "nullable": false,
-          "default": "NOW()"
-        },
-        {
-          "name": "updated_at",
-          "type": "TIMESTAMP",
-          "primaryKey": false,
-          "nullable": false,
-          "default": "NOW()"
-        }
-      ],
-      "indexes": [],
-      "foreignKeys": []
-    }
-  ],
-  "migrations": []
-}
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "version": "1.0.0",
+  "projectName": "{{PROJECT_NAME}}",
+  "updatedAt": "{{TIMESTAMP}}",
+  "engine": "{{DETECTED_DATABASE_ENGINE}}",
+  "tables": [
+    {
+      "name": "example_entity",
+      "description": "Demonstration table definition. The architect updates this during Phase 1A.",
+      "columns": [
+        {
+          "name": "id",
+          "type": "UUID",
+          "primaryKey": true,
+          "nullable": false,
+          "default": "gen_random_uuid()"
+        },
+        {
+          "name": "created_at",
+          "type": "TIMESTAMP",
+          "primaryKey": false,
+          "nullable": false,
+          "default": "NOW()"
+        },
+        {
+          "name": "updated_at",
+          "type": "TIMESTAMP",
+          "primaryKey": false,
+          "nullable": false,
+          "default": "NOW()"
+        }
+      ],
+      "indexes": [],
+      "foreignKeys": []
+    }
+  ],
+  "migrations": []
+}