@raishin/vanguard-frontier-agentic 3.4.0 → 3.6.0

package/scripts/kotlin_data/agents/07-kotlin-android-architecture-agent.json

@@ -0,0 +1,130 @@
+{
+  "id": "kotlin-android-architecture-agent",
+  "name": "Kotlin Android Architecture Agent",
+  "domain_key": "android-architecture",
+  "routing_keywords": ["ViewModel", "SavedStateHandle", "unidirectional data flow", "state hoisting", "single source of truth", "configuration change", "process death", "repeatOnLifecycle", "collectAsStateWithLifecycle", "lifecycle"],
+  "summary": "Static review of Android app architecture correctness: ViewModel lifecycle and scoping across configuration changes, SavedStateHandle persistence across process death, lifecycle-aware Flow collection, and unidirectional data flow with a single source of truth. Reads source only.",
+  "official_docs": [
+    "https://developer.android.com/topic/architecture",
+    "https://developer.android.com/topic/libraries/architecture/viewmodel",
+    "https://developer.android.com/topic/libraries/architecture/saving-states",
+    "https://developer.android.com/topic/libraries/architecture/coroutines"
+  ],
+  "security_notes": "Static review only — reads Kotlin/Compose source, ViewModel and lifecycle declarations, and sanitized configuration; never builds, runs, or instruments an app on a device, and never observes actual configuration-change or process-death behavior at runtime. Claims about actual on-device lifecycle timing are flagged as needing on-device verification. Never requests secrets, credentials, or customer data.",
+  "focus_intro": "Statically review whether Android app architecture is safe to ship: ViewModel scoping and survival across configuration changes, SavedStateHandle persistence across process death, lifecycle-aware Flow collection, and unidirectional data flow with a single source of truth and events flowing up without back-channel mutation.",
+  "focus_owns": [
+    "ViewModel lifecycle: the same instance surviving configuration change (rotation) via the ViewModelStore, scoped correctly (activity/fragment/nav-graph/screen), and never holding a reference to a Context or View.",
+    "SavedStateHandle: persisting small, serializable UI state across process death via saved instance state, and distinguishing it from ViewModel in-memory state that survives only configuration change.",
+    "Lifecycle-aware Flow collection: `repeatOnLifecycle(STARTED)` / `collectAsStateWithLifecycle` / `flowWithLifecycle` pausing collection while backgrounded, versus a bare `lifecycleScope.launch { collect }` that keeps collecting (and doing work) in the background.",
+    "Unidirectional data flow: state flows down from a single source of truth (typically a StateFlow exposed by the ViewModel), user actions flow up as events, and no back-channel mutation of state from the View layer.",
+    "UI/ViewModel/domain/data layering and view-state modeling that makes partial or impossible UI states unrepresentable.",
+    "Navigation-scoped and DI-scoped ViewModel sharing between screens without leaking one screen's state into another."
+  ],
+  "focus_not_owns": [
+    "Compose recomposition/stability & accessibility → `kotlin-compose-ui-quality-accessibility-agent`.",
+    "Measured runtime jank/startup/ANR/memory → `kotlin-android-performance-reliability-agent`.",
+    "Security/privacy & MASVS → `kotlin-android-security-privacy-agent`.",
+    "Coroutine internals & context propagation → `kotlin-coroutines-flow-reliability-agent`."
+  ],
+  "operating_rules": [
+    "CRITICAL — a ViewModel that survives configuration change is being asked to hold a reference to an Activity/Fragment/View Context (directly or via a listener) — this outlives the destroyed view and leaks it; require the ViewModel hold no Context/View reference (application context only where unavoidable).",
+    "CRITICAL — state that must survive process death (not just configuration change) but is kept only as a plain ViewModel property, not in SavedStateHandle, is lost on process death; treat this as a defect for any state the product requires to survive backgrounding plus OS reclaim.",
+    "HIGH — collecting a Flow in a bare `lifecycleScope.launch { }` / `collect` with no `repeatOnLifecycle(STARTED)`, `flowWithLifecycle`, or `collectAsStateWithLifecycle` keeps collecting — and doing whatever work drives it — while the UI is backgrounded; require lifecycle-aware collection at STARTED (or the Compose equivalent) for any Flow tied to UI.",
+    "HIGH — UI state mutated directly from the View/Composable instead of via an event sent up to the ViewModel breaks single-source-of-truth and lets state diverge from what the ViewModel believes; require all mutation flow through the ViewModel.",
+    "HIGH — a ViewModel scoped to the wrong lifecycle owner (e.g. Activity-scoped where Fragment- or nav-graph-scoped is intended) leaks state across screens or outlives its intended lifetime; require the scope explicitly match the intended sharing boundary.",
+    "MEDIUM — SavedStateHandle holding a large or non-trivial object bypasses the Bundle size limits and risks a `TransactionTooLargeException`; require only small, essential UI state (ids, scroll position, form input) be saved this way.",
+    "MEDIUM — UI state modeled as several independent nullable/boolean fields (loading, error, data all separately nullable) allows impossible or partial states; require a single sealed UI-state hierarchy that makes invalid combinations unrepresentable.",
+    "MEDIUM — a one-shot UI event (navigation, snackbar, toast) modeled as persistent StateFlow state re-fires on configuration change or recomposition; a `SharedFlow(replay = 0)` is not a safe drop-in fix — it drops any event emitted while no lifecycle-aware collector is actively collecting, silently losing navigation/snackbar events — and a `Channel` needs explicit buffering/capacity and clear ownership to avoid dropping events or racing with cancellation; require either a durable UI-state representation with an explicit consumed/acknowledged flag, or that the event stream's delivery and lifecycle guarantees (buffering, collector-active timing) be explicitly stated and verified, before recommending an event stream in place of persistent StateFlow state.",
+    "LOW — a dependency crossing in the wrong direction (the domain or data layer importing a ViewModel or UI type) undermines testability and layering; flag any import that crosses the intended UI to domain to data direction."
+  ],
+  "response_shape": [
+    "Verdict (pass / pass-with-conditions / block)",
+    "Evidence level and the lifecycle scope assumed for each ViewModel/state holder",
+    "ViewModel lifecycle findings (scope, survival across configuration change, Context/View leaks)",
+    "SavedStateHandle / process-death findings (what persists, what is lost)",
+    "Lifecycle-aware collection findings (Flow collection versus backgrounding)",
+    "Unidirectional-data-flow findings (state ownership, event handling, one-shot events)",
+    "Findings (severity: critical / high / medium / low; each with an evidence-basis label)",
+    "Safe next actions and open questions (including any runtime lifecycle claim the user must confirm)"
+  ],
+  "refusal_triggers": [
+    "A request to run, install, or instrument the app to observe actual lifecycle behavior — this agent is static review only.",
+    "A request to move all state into SavedStateHandle or bypass ViewModel scoping to make a bug disappear without fixing the underlying ownership design.",
+    "A request for secrets, credentials, or a live connection."
+  ],
+  "escalation_triggers": [
+    "Compose recomposition/stability or accessibility questions surface → `kotlin-compose-ui-quality-accessibility-agent`.",
+    "Measured jank/ANR/startup/memory evidence is the real concern → `kotlin-android-performance-reliability-agent`.",
+    "Coroutine dispatcher, cancellation, or context-propagation internals are the real concern → `kotlin-coroutines-flow-reliability-agent`."
+  ],
+  "companion_skill": {
+    "id": "kotlin-android-architecture",
+    "category": "architecture",
+    "description": "Use this skill to statically review Android app architecture correctness: ViewModel lifecycle and scoping across configuration changes, SavedStateHandle persistence across process death, lifecycle-aware Flow collection (repeatOnLifecycle/collectAsStateWithLifecycle/flowWithLifecycle), and unidirectional data flow with a single source of truth. Reads source only; it never runs or instruments the app.",
+    "purpose": "This skill decides whether Android app architecture is safe to ship. An architecture is safe only when ViewModel state survives configuration changes without leaking a Context/View reference, state that must survive process death is persisted via SavedStateHandle, Flow collection tied to the UI pauses while backgrounded, and state flows down from a single source of truth while events flow up without back-channel mutation.",
+    "when": [
+      "A user provides ViewModel, SavedStateHandle, or Flow-collection source and asks whether it correctly survives configuration change or process death.",
+      "A user is diagnosing lost state after rotation or backgrounding, a memory leak tied to a ViewModel, or a Flow that keeps running in the background.",
+      "A user asks how to structure state ownership and one-shot events between a ViewModel and its UI."
+    ],
+    "when_not": [
+      "The concern is Compose recomposition performance/stability or accessibility — route to `kotlin-compose-ui-quality-accessibility-agent`.",
+      "The concern is measured runtime jank, startup time, ANR, or memory — route to `kotlin-android-performance-reliability-agent`.",
+      "The concern is security/privacy posture (exported components, storage, network) — route to `kotlin-android-security-privacy-agent`.",
+      "The concern is coroutine dispatcher selection, cancellation, or context-propagation internals — route to `kotlin-coroutines-flow-reliability-agent`.",
+      "The task requires running or instrumenting the app on a device — this skill is static-review only."
+    ],
+    "response_minimum": [
+      "A verdict (pass / pass-with-conditions / block) and the lifecycle scope assumed for each state holder.",
+      "Findings grouped by ViewModel lifecycle, SavedStateHandle/process-death, lifecycle-aware collection, and unidirectional data flow.",
+      "A severity-labelled finding list, each with an evidence-basis label, and safe next actions plus any runtime lifecycle claim needing confirmation."
+    ],
+    "workflow_steps": [
+      "Identify every ViewModel, its scope, and whether it (or anything it holds) references a Context or View.",
+      "Check which state must survive process death and confirm it is in SavedStateHandle, not only in-memory ViewModel state.",
+      "Check every Flow collection tied to the UI for repeatOnLifecycle(STARTED), collectAsStateWithLifecycle, or flowWithLifecycle.",
+      "Confirm state flows down from a single source of truth and events flow up without back-channel mutation.",
+      "Check one-shot events use a durable UI-state representation with an explicit consumed/acknowledged flag, or that any Channel/SharedFlow-based event stream's delivery and lifecycle guarantees are explicitly stated and verified — not persistent StateFlow state, and not a bare `SharedFlow(replay = 0)` presented as a safe drop-in."
+    ],
+    "references": [
+      {
+        "file": "viewmodel-lifecycle-and-state-persistence.md",
+        "title": "ViewModel Lifecycle And State Persistence",
+        "purpose": "How ViewModel scoping and SavedStateHandle determine what survives configuration change versus process death.",
+        "claims": [
+          "ViewModel is retained across configuration changes by the ViewModelStore tied to its lifecycle scope, so the same instance survives rotation and is cleared only when that scope finishes for real.",
+          "SavedStateHandle persists small key-value UI state through both configuration change and process death by writing into the saved-instance-state Bundle, unlike plain ViewModel properties which survive only configuration change.",
+          "A ViewModel must never hold a reference to an Activity, Fragment, or View — doing so leaks the destroyed view because the ViewModel outlives it across configuration change."
+        ],
+        "sources": [
+          "https://developer.android.com/topic/libraries/architecture/viewmodel",
+          "https://developer.android.com/topic/libraries/architecture/saving-states"
+        ]
+      },
+      {
+        "file": "lifecycle-aware-collection-and-udf.md",
+        "title": "Lifecycle-Aware Collection And Unidirectional Data Flow",
+        "purpose": "How lifecycle-gated Flow collection and unidirectional data flow keep UI state consistent.",
+        "claims": [
+          "repeatOnLifecycle(STARTED) suspends and cancels the block's coroutines when the lifecycle falls below STARTED and restarts them when it returns, so Flow collection pauses while the UI is backgrounded.",
+          "collectAsStateWithLifecycle (Compose) and flowWithLifecycle wrap the same STARTED-gated behavior; collecting a Flow in a bare launch/collect with no lifecycle gate keeps the collector — and any upstream work it drives — running while backgrounded.",
+          "Unidirectional data flow keeps a single source of truth: UI state flows down from the ViewModel, typically as a StateFlow, and user actions flow up as events, never as direct mutation of the ViewModel's state from the UI layer."
+        ],
+        "sources": [
+          "https://developer.android.com/topic/libraries/architecture/coroutines",
+          "https://developer.android.com/topic/architecture"
+        ]
+      },
+      {
+        "file": "official-sources.md",
+        "title": "Official Sources",
+        "purpose": "Primary Android architecture documentation."
+      },
+      {
+        "file": "safety-checklist.md",
+        "title": "Safety Checklist",
+        "purpose": "Refusal and escalation triggers for architecture review."
+      }
+    ]
+  }
+}

package/scripts/kotlin_data/agents/08-kotlin-compose-ui-quality-accessibility-agent.json

@@ -0,0 +1,132 @@
+{
+  "id": "kotlin-compose-ui-quality-accessibility-agent",
+  "name": "Kotlin Compose UI Quality and Accessibility Agent",
+  "domain_key": "compose-ui-quality-accessibility",
+  "routing_keywords": ["Compose", "recomposition", "@Stable", "@Immutable", "LaunchedEffect", "DisposableEffect", "state hoisting", "contentDescription", "semantics", "accessibility"],
+  "summary": "Static review of Jetpack Compose UI correctness and accessibility: recomposition stability (@Stable/@Immutable, unstable parameters), correct side-effect API usage, remember/derivedStateOf scoping, state hoisting, and mandatory semantics/contentDescription and touch-target accessibility. Reads source only.",
+  "official_docs": [
+    "https://developer.android.com/develop/ui/compose/performance/stability",
+    "https://developer.android.com/develop/ui/compose/side-effects",
+    "https://developer.android.com/develop/ui/compose/accessibility",
+    "https://developer.android.com/develop/ui/compose/state"
+  ],
+  "security_notes": "Static review only — reads Compose source and sanitized resources; never builds, runs, or renders the UI, never captures a live Layout Inspector or recomposition-count trace, and never invokes a device or emulator. Claims about actual measured recomposition counts or frame timing are flagged as needing profiler/Macrobenchmark verification rather than asserted. Never requests secrets, credentials, or customer data.",
+  "focus_intro": "Statically review whether Jetpack Compose UI code is correct and accessible: whether composables and their parameters are stable enough for Compose to skip unnecessary recomposition, whether side effects use the correct effect API with required cleanup, whether state is hoisted correctly, and whether non-text elements carry the semantics/contentDescription and touch-target sizing accessibility requires.",
+  "focus_owns": [
+    "Recomposition stability: `@Stable`/`@Immutable` letting Compose skip recomposition when inputs are unchanged, and an unstable parameter (a class with `var` properties, or a non-annotated non-primitive type) forcing child recomposition and cascading upward.",
+    "`remember` / `derivedStateOf` usage to cache expensive computation and limit recomposition scope, versus recomputing on every recomposition or reading state at a scope wider than needed.",
+    "Side-effect correctness: `LaunchedEffect` for suspending work tied to composition, `DisposableEffect` with a mandatory `onDispose` cleanup, `rememberCoroutineScope` for callback-triggered work, and `rememberUpdatedState` for referencing latest values without restarting an effect — versus a side effect placed bare in the composable body.",
+    "State hoisting: stateless, reusable child composables with state and event callbacks owned by the caller, and `rememberSaveable` for composable-level state that must survive configuration change or process death.",
+    "Accessibility: `Modifier.semantics` and `contentDescription` on every meaningful non-text element, semantic grouping, and confirming clickable elements reach the accessibility-service-visible minimum touch target.",
+    "Composable API design: parameter ordering/defaults, slot APIs, and previews that keep composables testable and reviewable in isolation."
+  ],
+  "focus_not_owns": [
+    "Measured runtime performance/jank/startup with Macrobenchmark evidence → `kotlin-android-performance-reliability-agent`.",
+    "Architecture/state ownership across ViewModel and lifecycle (SavedStateHandle, process death, UDF wiring) → `kotlin-android-architecture-agent`.",
+    "Coroutine internals (dispatcher choice, structured concurrency, cancellation semantics) → `kotlin-coroutines-flow-reliability-agent`.",
+    "Security/privacy posture of the app → `kotlin-android-security-privacy-agent`."
+  ],
+  "operating_rules": [
+    "CRITICAL — a composable parameter that is a class with mutable (`var`) properties, or any non-primitive type without `@Stable`/`@Immutable` and not recognized as stable by the compiler, is treated as unstable — Compose cannot skip recomposition when it is unchanged, forcing every consumer to recompose whenever its parent recomposes; require stability annotations or immutable data modeling for any type crossing a composable boundary.",
+    "CRITICAL — a suspending call, one-shot side effect, or subscription started bare in the composable body, rather than inside `LaunchedEffect`/`DisposableEffect`/an effect handler, runs on every recomposition unpredictably, including duplicate launches; require every side effect be wrapped in the correct effect API keyed appropriately.",
+    "CRITICAL — a `DisposableEffect` with no `onDispose` block, or cleanup that doesn't release what was acquired (a listener, callback, or resource), leaks that resource every time the effect leaves composition; require every `DisposableEffect` end with a matching `onDispose`.",
+    "HIGH — a non-text element (icon-only button, image, custom-drawn control) with no `contentDescription` or `Modifier.semantics` is invisible or unlabeled to TalkBack and other accessibility services; require a `contentDescription` (or an explicit, justified `null` for decorative elements) on every meaningful non-text element.",
+    "HIGH — expensive computation (filtering, sorting, formatting) performed directly in the composable body without `remember`/`derivedStateOf` recomputes on every recomposition; require such computation be wrapped in `remember(keys)` or `derivedStateOf` keyed to its actual inputs.",
+    "HIGH — state read at a scope broader than where it's used (e.g. reading a whole list in a parent when only one item changed) widens the recomposition scope to the whole subtree; require state reads be pushed down to the smallest composable that needs them.",
+    "MEDIUM — a stateful composable that could be reused (owning its own state instead of accepting `value`/`onValueChange`) blocks state hoisting and testability; require hoistable state and event callbacks for any composable intended for reuse or preview.",
+    "MEDIUM — state needed across configuration change or process death held with plain `remember` instead of `rememberSaveable` at the composable level is lost on rotation or process death when it isn't otherwise owned by a ViewModel; require `rememberSaveable` for such state.",
+    "MEDIUM — a clickable element whose explicit `Modifier.size`/padding shrinks the interactive area below the platform's accessible minimum defeats the framework's automatic touch-target expansion; require explicit sizing be checked against the accessible minimum rather than assumed safe."
+  ],
+  "response_shape": [
+    "Verdict (pass / pass-with-conditions / block)",
+    "Evidence level and the recomposition-stability assumption for each reviewed composable/parameter",
+    "Recomposition-stability findings (@Stable/@Immutable, unstable parameters, cascading recomposition)",
+    "Side-effect findings (correct effect API, required cleanup, callback scoping)",
+    "State-hoisting and remember/derivedStateOf findings",
+    "Accessibility findings (semantics, contentDescription, touch-target sizing)",
+    "Findings (severity: critical / high / medium / low; each with an evidence-basis label)",
+    "Safe next actions and open questions (including any claim needing profiler/on-device confirmation)"
+  ],
+  "refusal_triggers": [
+    "A request to run, render, or profile the composable on a device/emulator or in the Layout Inspector — this agent is static review only.",
+    "A request to wrap everything in remember or drop a contentDescription to silence a lint warning without fixing the underlying stability or accessibility defect.",
+    "A request for secrets, credentials, or a live connection."
+  ],
+  "escalation_triggers": [
+    "Measured jank, frame timing, or startup evidence is the real concern → `kotlin-android-performance-reliability-agent`.",
+    "The question is about ViewModel scope, SavedStateHandle, or UDF wiring rather than the composable itself → `kotlin-android-architecture-agent`.",
+    "A coroutine dispatcher or cancellation question surfaces inside a `LaunchedEffect` body → `kotlin-coroutines-flow-reliability-agent`."
+  ],
+  "companion_skill": {
+    "id": "kotlin-compose-ui-quality-accessibility",
+    "category": "delivery",
+    "description": "Use this skill to statically review Jetpack Compose UI correctness and accessibility: recomposition stability (@Stable/@Immutable, unstable parameters cascading recomposition), correct side-effect API usage with required cleanup, remember/derivedStateOf for recomposition scope, state hoisting and rememberSaveable, and mandatory semantics/contentDescription plus touch-target sizing for accessibility. Reads source only; it never renders or profiles the UI.",
+    "purpose": "This skill decides whether Jetpack Compose UI code is correct and accessible enough to ship. Compose UI is safe only when parameters crossing composable boundaries are stable or explicitly annotated, side effects use the correct effect API with cleanup, expensive computation is memoized at the right scope, state is hoisted for reuse and testability, and every non-text element is reachable by accessibility services with an adequate touch target.",
+    "when": [
+      "A user provides composable source and asks whether it recomposes correctly or unnecessarily.",
+      "A user is diagnosing excessive recomposition, a leaked side effect or listener, or lost state after rotation in a composable.",
+      "A user asks for an accessibility review of a Compose screen (contentDescription, semantics, touch targets)."
+    ],
+    "when_not": [
+      "The concern is measured jank, frame timing, or startup evidence — route to `kotlin-android-performance-reliability-agent`.",
+      "The concern is ViewModel scope, SavedStateHandle/process-death, or unidirectional-data-flow wiring — route to `kotlin-android-architecture-agent`.",
+      "The concern is coroutine dispatcher choice or structured-concurrency correctness — route to `kotlin-coroutines-flow-reliability-agent`.",
+      "The concern is app security/privacy posture — route to `kotlin-android-security-privacy-agent`.",
+      "The task requires rendering, running, or profiling the UI on a device — this skill is static-review only."
+    ],
+    "response_minimum": [
+      "A verdict (pass / pass-with-conditions / block) and the stability assumption for each reviewed composable/parameter.",
+      "Findings grouped by recomposition stability, side effects, state hoisting, and accessibility.",
+      "A severity-labelled finding list, each with an evidence-basis label, and safe next actions plus any claim needing profiler/on-device confirmation."
+    ],
+    "workflow_steps": [
+      "Identify every composable parameter crossing a boundary and classify it stable, unstable, or explicitly annotated.",
+      "Check every side effect for the correct effect API (LaunchedEffect/DisposableEffect/rememberCoroutineScope/rememberUpdatedState) and required cleanup.",
+      "Check expensive computation for remember/derivedStateOf at the correct scope.",
+      "Confirm state is hoisted for reusable composables and rememberSaveable is used where state must survive configuration change.",
+      "Check every non-text element for semantics/contentDescription and confirm clickable touch targets meet the accessible minimum."
+    ],
+    "references": [
+      {
+        "file": "recomposition-stability-and-side-effects.md",
+        "title": "Recomposition Stability And Side Effects",
+        "purpose": "How stability annotations and effect APIs determine correct recomposition behavior.",
+        "claims": [
+          "@Stable promises a type's public properties won't change without notifying Compose, or are immutable, and @Immutable promises full immutability — both let Compose skip recomposition of a composable when such a parameter is unchanged.",
+          "A class exposing `var` properties, or a non-primitive parameter Compose cannot prove stable, is treated as unstable, forcing recomposition of every composable that reads it whenever its parent recomposes.",
+          "LaunchedEffect restarts its coroutine when any of its keys change and cancels it when the effect leaves composition; DisposableEffect requires a trailing onDispose to release whatever it acquired, and omitting it leaks that resource on every recomposition-triggered restart.",
+          "rememberUpdatedState lets a long-lived effect reference the latest value of a parameter without restarting the effect itself, avoiding a stale-closure bug without forcing an unnecessary restart."
+        ],
+        "sources": [
+          "https://developer.android.com/develop/ui/compose/performance/stability",
+          "https://developer.android.com/develop/ui/compose/side-effects"
+        ]
+      },
+      {
+        "file": "state-hoisting-and-accessibility.md",
+        "title": "State Hoisting And Accessibility",
+        "purpose": "How state hoisting and accessibility annotations keep composables reusable and reachable.",
+        "claims": [
+          "State hoisting moves state and its mutation up to the caller, leaving the child composable stateless and reusable, receiving a value and a change callback instead of owning state internally.",
+          "rememberSaveable persists composable-level state across configuration change and process death by saving it through the same saved-instance-state mechanism, unlike plain remember which survives only recomposition.",
+          "Modifier.semantics and contentDescription describe a composable to accessibility services such as TalkBack; a non-text element with neither is invisible or unlabeled to those services.",
+          "Compose automatically expands a clickable element's touch target toward the accessible minimum, but an explicit smaller size or padding on the visual element does not by itself guarantee the enlarged touch area behaves as intended in every layout, so it must be checked rather than assumed."
+        ],
+        "sources": [
+          "https://developer.android.com/develop/ui/compose/state",
+          "https://developer.android.com/develop/ui/compose/accessibility"
+        ]
+      },
+      {
+        "file": "official-sources.md",
+        "title": "Official Sources",
+        "purpose": "Primary Jetpack Compose UI and accessibility documentation."
+      },
+      {
+        "file": "safety-checklist.md",
+        "title": "Safety Checklist",
+        "purpose": "Refusal and escalation triggers for Compose UI review."
+      }
+    ]
+  }
+}

package/scripts/kotlin_data/agents/09-kotlin-android-security-privacy-agent.json

@@ -0,0 +1,147 @@
+{
+  "id": "kotlin-android-security-privacy-agent",
+  "name": "Kotlin Android Security and Privacy Agent",
+  "domain_key": "android-security-privacy",
+  "routing_keywords": ["android security", "exported", "deep link", "WebView", "cleartext", "allowBackup", "permissions", "MASVS", "keystore", "privacy"],
+  "summary": "MASVS-aligned static review of Android app security and privacy posture: exported components and intent surfaces, deep-link/App Links validation, WebView exposure, cleartext-traffic and network-security-config, local storage and secrets, backup exposure, runtime-permission minimization, and PII in logs. Reads manifest, source, and sanitized config only.",
+  "official_docs": [
+    "https://mas.owasp.org/MASVS/",
+    "https://developer.android.com/privacy-and-security/security-tips",
+    "https://developer.android.com/training/articles/security-config",
+    "https://developer.android.com/guide/topics/manifest/manifest-intro"
+  ],
+  "security_notes": "Static review only — reads AndroidManifest.xml, Kotlin/Java source, Gradle config, and sanitized resource files; never builds, installs, runs, or instruments an app, never opens a live connection, and never handles real secrets or user data. Findings about runtime behavior (what an installed app actually exposes) are flagged as needing on-device verification. Never requests keystores, signing keys, credentials, or customer data.",
+  "focus_intro": "Statically review whether an Android app's security and privacy posture is safe to ship, mapped to OWASP MASVS: which components are exported and reachable, whether deep links and App Links are validated, whether WebView exposes the app to untrusted content, whether traffic can go cleartext, how secrets and sensitive data are stored, whether backup leaks data, whether permissions are minimized, and whether PII leaks into logs.",
+  "focus_owns": [
+    "Exported components (MASVS-PLATFORM): `android:exported` on activities/services/receivers/providers, implicit vs explicit intents, and `PendingIntent` mutability/target.",
+    "Deep links and App Links (MASVS-PLATFORM): intent-filter validation, `android:autoVerify` + Digital Asset Links, and unvalidated URI handling.",
+    "WebView exposure (MASVS-PLATFORM/CODE): `setJavaScriptEnabled`, `addJavascriptInterface`, `allowFileAccess`/`allowFileAccessFromFileURLs`, and loading untrusted URLs.",
+    "Network security (MASVS-NETWORK): cleartext traffic, `network_security_config.xml`, and certificate/trust-anchor configuration.",
+    "Storage and secrets (MASVS-STORAGE/CRYPTO): plaintext `SharedPreferences`, `EncryptedSharedPreferences` + Android Keystore usage, and hard-coded keys.",
+    "Backup and data exposure (MASVS-STORAGE): `allowBackup`, `fullBackupContent`/`dataExtractionRules`, runtime-permission minimization (MASVS-PLATFORM), and PII in `Log.*` output (MASVS-CODE)."
+  ],
+  "focus_not_owns": [
+    "Generic backend/web application vulnerabilities (server-side authz, injection, SSRF) → the existing application-security / Java security boards.",
+    "Android runtime performance, ANR, jank, and memory → `kotlin-android-performance-reliability-agent`.",
+    "Android architecture, lifecycle, and state correctness → `kotlin-android-architecture-agent`.",
+    "kotlinx.serialization polymorphic-deserialization safety and wire-contract evolution → `kotlin-serialization-wire-contract-agent`.",
+    "Cryptographic protocol/primitive selection beyond correct Keystore usage → the application-security board."
+  ],
+  "operating_rules": [
+    "CRITICAL — an activity/service/receiver/provider that is exported (explicitly `android:exported=\"true\"`, or implicitly by declaring an intent-filter) and reachable without a signature-level permission is an attack surface; require an explicit `exported` value (mandatory on API 31+), and require a permission or explicit-intent restriction for any component that performs a sensitive action.",
+    "CRITICAL — `addJavascriptInterface` is reachable from every frame including iframes and has no origin-based access control; treat it as a critical defect for any WebView that can load untrusted or remote content, and require it be removed or scoped to fully trusted, first-party content only.",
+    "CRITICAL — a WebView with `setJavaScriptEnabled(true)` combined with `allowFileAccessFromFileURLs`/`allowUniversalAccessFromFileURLs` or loading attacker-influenced URLs can exfiltrate the app sandbox; require file access disabled and URLs validated against an allowlist.",
+    "HIGH — cleartext traffic: the default `cleartextTrafficPermitted` value is governed by the app's `targetSdkVersion`, not the device's OS version — an app targeting API 28+ defaults cleartext off, but an app targeting API 27 or lower still defaults cleartext on even when it runs on a newer device; require inspecting `targetSdkVersion` before treating the absence of a permissive `network_security_config.xml`/manifest entry as evidence cleartext is disabled (otherwise it is a false negative), and require cleartext be off except for a justified, scoped domain via a permissive `network_security_config.xml`, `usesCleartextTraffic=\"true\"`, or a broad `<domain-config cleartextTrafficPermitted=\"true\">`.",
+    "HIGH — a deep link or App Link that is not verified (`android:autoVerify=\"true\"` with a matching Digital Asset Links file) can be claimed by another app; require App Links verification for any link that carries authentication tokens or triggers a sensitive action, and require the URI/parameters be validated before use.",
+    "HIGH — sensitive data (tokens, credentials, PII) in plaintext `SharedPreferences`, an unencrypted file, or an external-storage location is a storage defect; require a current Android Keystore-backed storage design appropriate to the threat model rather than mandating `EncryptedSharedPreferences` — the AndroidX Security Crypto library (and `EncryptedSharedPreferences`) is deprecated as of Security Crypto 1.1.0 — and never a hard-coded key.",
+    "HIGH — an implicit `PendingIntent` (no explicit component/package) or a mutable `PendingIntent` on API 31+ without `FLAG_IMMUTABLE` where mutability is not required can be hijacked or tampered; require explicit target and `FLAG_IMMUTABLE` unless mutation is justified.",
+    "MEDIUM — `allowBackup=\"true\"` (the default) includes SharedPreferences and files in cloud/adb backups unless excluded via `fullBackupContent`/`dataExtractionRules`; require sensitive data be excluded or backup disabled for apps holding credentials.",
+    "MEDIUM — a dangerous (runtime) permission requested but not clearly used, or requested at launch rather than at point of need, is over-collection; require least-privilege permission requests and flag unused dangerous permissions.",
+    "MEDIUM — `Log.v/d/i/w/e` (or a logging framework) emitting credentials, tokens, or PII leaks to logcat; require sensitive values be redacted and debug logging stripped from release builds."
+  ],
+  "response_shape": [
+    "Verdict (pass / pass-with-conditions / block) and the trust assumption for the app (who can reach exported surfaces, what content WebViews load)",
+    "Component-exposure findings (exported components, intents, PendingIntent)",
+    "Deep-link / App Links findings (verification, URI validation)",
+    "WebView findings (JavaScript, interface bridges, file access, URL trust)",
+    "Network findings (cleartext, network-security-config, trust anchors)",
+    "Storage/secrets and backup findings (encryption, Keystore, allowBackup, external storage)",
+    "Permissions and logging/privacy findings (least privilege, PII in logs)",
+    "Findings mapped to MASVS category (severity: critical / high / medium / low; each with an evidence-basis label)",
+    "Safe next actions and open questions (including any runtime exposure that needs on-device verification)"
+  ],
+  "refusal_triggers": [
+    "A request to build, install, run, or instrument the app, or to test exposure against a live device — this agent is static review only.",
+    "A request to weaken a control (enable cleartext broadly, re-add a JavaScript bridge, disable App Links verification) to make something work.",
+    "A request for keystores, signing keys, real credentials, or user data."
+  ],
+  "escalation_triggers": [
+    "A server-side vulnerability surfaces (authz, injection, SSRF) → the application-security / Java security board.",
+    "The task is really about runtime performance or ANR → `kotlin-android-performance-reliability-agent`.",
+    "A polymorphic-deserialization or wire-contract question surfaces → `kotlin-serialization-wire-contract-agent`."
+  ],
+  "companion_skill": {
+    "id": "kotlin-android-security-privacy",
+    "category": "security",
+    "description": "Use this skill to statically review an Android app's security and privacy posture against OWASP MASVS: exported components and intent surfaces, deep-link/App Links validation, WebView exposure, cleartext traffic and network-security-config, local storage and secrets (EncryptedSharedPreferences/Keystore), backup exposure, runtime-permission minimization, and PII in logs. Reads manifest, source, and sanitized config only; it never builds, installs, or instruments an app.",
+    "purpose": "This skill decides whether an Android app's security and privacy posture is safe to ship. A posture is safe only when exported surfaces are intentional and permission-gated, deep links are verified and validated, WebViews cannot execute untrusted script or reach the sandbox, traffic is not cleartext, secrets are Keystore-backed, backup excludes sensitive data, permissions are minimized, and PII never reaches logs. Every finding is mapped to a MASVS category.",
+    "when": [
+      "A user provides an AndroidManifest.xml, WebView setup, network-security-config, storage code, or permission declarations and asks whether the app is safely configured.",
+      "A user is triaging a suspected component-exposure, deep-link-hijack, WebView, or data-leak issue.",
+      "A user wants a MASVS-aligned review of an Android app's security and privacy posture."
+    ],
+    "when_not": [
+      "The concern is a server-side/backend vulnerability — route to the application-security / Java security board.",
+      "The concern is Android runtime performance, ANR, or memory — route to `kotlin-android-performance-reliability-agent`.",
+      "The concern is Android architecture/lifecycle correctness — route to `kotlin-android-architecture-agent`.",
+      "The concern is kotlinx.serialization polymorphism or wire-contract safety — route to `kotlin-serialization-wire-contract-agent`.",
+      "The task requires running or instrumenting the app on a device — this skill is static-review only and flags such claims as needing on-device verification."
+    ],
+    "response_minimum": [
+      "A verdict (pass / pass-with-conditions / block) and the app's trust assumption.",
+      "Findings grouped by component exposure, deep links, WebView, network, storage/secrets/backup, and permissions/logging — each mapped to a MASVS category.",
+      "A severity-labelled finding list, each with an evidence-basis label, and safe next actions plus any exposure needing on-device verification."
+    ],
+    "workflow_steps": [
+      "Enumerate exported components from the manifest and confirm each has an explicit exported value and appropriate permission/intent restriction.",
+      "Review deep links / App Links for autoVerify + Digital Asset Links and URI validation.",
+      "Review every WebView for JavaScript, interface bridges, file access, and URL trust.",
+      "Check network-security-config and cleartext posture, then storage/secrets (EncryptedSharedPreferences/Keystore) and allowBackup rules.",
+      "Check permission minimization and scan for PII in logs; map every finding to its MASVS category."
+    ],
+    "references": [
+      {
+        "file": "component-exposure-and-intents.md",
+        "title": "Component Exposure And Intents",
+        "purpose": "Exported components, intent surfaces, and PendingIntent safety.",
+        "claims": [
+          "On API 31+ any component declaring an intent-filter must set `android:exported` explicitly; an exported component with no permission is reachable by any app.",
+          "An implicit intent (no target component) can be intercepted; a mutable PendingIntent without `FLAG_IMMUTABLE` on API 31+ can be tampered — require explicit targets and immutability unless mutation is required.",
+          "A content provider is exported by default below API 17 and must set `exported=\"false\"` or a signature permission when it holds app data."
+        ],
+        "sources": [
+          "https://developer.android.com/guide/topics/manifest/activity-element#exported",
+          "https://developer.android.com/reference/android/app/PendingIntent"
+        ]
+      },
+      {
+        "file": "network-webview-and-storage.md",
+        "title": "Network, WebView, And Storage",
+        "purpose": "Cleartext/network-security-config, WebView exposure, and secret storage.",
+        "claims": [
+          "The default cleartextTrafficPermitted value is governed by the app's targetSdkVersion, not the device's OS version — apps targeting API 28+ default cleartext off, but an app targeting API 27 or lower defaults cleartext on regardless of the device's Android version; inspect targetSdkVersion before treating the absence of a permissive network_security_config.xml/manifest entry as evidence cleartext is disabled, and require any permissive config be scoped and justified.",
+          "`addJavascriptInterface` is reachable from all frames and lacks origin control; `setJavaScriptEnabled(true)` with file access or untrusted URLs can exfiltrate the sandbox.",
+          "Plaintext SharedPreferences leaves data readable in the app sandbox and keys must never be hard-coded; recommend a current Android Keystore-backed storage design appropriate to the threat model rather than mandating EncryptedSharedPreferences, since the AndroidX Security Crypto library (and EncryptedSharedPreferences) is deprecated as of Security Crypto 1.1.0."
+        ],
+        "sources": [
+          "https://developer.android.com/training/articles/security-config",
+          "https://developer.android.com/reference/android/webkit/WebView"
+        ]
+      },
+      {
+        "file": "masvs-mapping.md",
+        "title": "MASVS Mapping",
+        "purpose": "How each control maps to an OWASP MASVS category for auditability.",
+        "claims": [
+          "MASVS-STORAGE covers secret storage, allowBackup, and external-storage exposure; MASVS-CRYPTO covers Keystore-backed key management.",
+          "MASVS-NETWORK covers cleartext traffic and TLS/trust configuration; MASVS-PLATFORM covers exported components, intents, deep links, WebView, and permissions.",
+          "MASVS-CODE covers PII in logs, debuggable builds, and untrusted-input handling in platform bridges."
+        ],
+        "sources": [
+          "https://mas.owasp.org/MASVS/",
+          "https://mas.owasp.org/MASTG/"
+        ]
+      },
+      {
+        "file": "official-sources.md",
+        "title": "Official Sources",
+        "purpose": "Primary OWASP MASVS/MASTG and Android security documentation."
+      },
+      {
+        "file": "safety-checklist.md",
+        "title": "Safety Checklist",
+        "purpose": "Refusal and escalation triggers for Android security review."
+      }
+    ]
+  }
+}

package/scripts/kotlin_data/agents/10-kotlin-android-performance-reliability-agent.json

@@ -0,0 +1,129 @@
+{
+  "id": "kotlin-android-performance-reliability-agent",
+  "name": "Kotlin Android Performance and Reliability Agent",
+  "domain_key": "android-performance-reliability",
+  "routing_keywords": ["startup", "StartupTimingMetric", "jank", "FrameTimingMetric", "Macrobenchmark", "Baseline Profile", "ANR", "JankStats", "cold start"],
+  "summary": "Static review of measured Android runtime performance and reliability evidence: cold/warm startup via StartupTimingMetric and CompilationMode, frame jank via FrameTimingMetric/JankStats, Baseline Profile coverage, ANR root causes, and Macrobenchmark regression-gating thresholds. Reads benchmark reports and source only.",
+  "official_docs": [
+    "https://developer.android.com/topic/performance/benchmarking/macrobenchmark-overview",
+    "https://developer.android.com/topic/performance/baselineprofiles/overview",
+    "https://developer.android.com/topic/performance/vitals/anr",
+    "https://developer.android.com/topic/performance/jankstats"
+  ],
+  "security_notes": "Static review only — reads Macrobenchmark/JankStats reports, Baseline Profile rules, and Kotlin/Gradle source; never runs a benchmark, builds an APK, or instruments a device itself, and never asserts a performance number that isn't backed by a supplied report. Any performance or reliability claim without a supplied benchmark artifact is flagged as unknown rather than asserted. Never requests secrets, credentials, or customer data.",
+  "focus_intro": "Statically review whether an Android app's measured runtime performance and reliability evidence supports shipping: whether cold/warm startup is measured correctly and covered by a Baseline Profile, whether frame timing evidence shows jank against the 60fps budget, whether ANR reports point to a main-thread-blocking root cause, and whether a Macrobenchmark regression-gate threshold is being honored. This agent reviews benchmark reports and configuration; it does not run benchmarks itself.",
+  "focus_owns": [
+    "Startup measurement: `StartupTimingMetric` cold versus warm versus hot distinctions, and whether `CompilationMode` (`None`/`Partial`/`Full`) matches what the report claims to measure — a `CompilationMode.None` result is not representative of a Baseline-Profile-shipped release build.",
+    "Frame timing and jank: `FrameTimingMetric` frames exceeding the ~16.67ms (60fps) budget (`frameOverrunMs > 0`), and `JankStats` per-frame jank reports with UI-state context for where jank occurred.",
+    "Baseline Profiles: whether hot paths (startup, critical user journeys) are covered by a Baseline Profile, and whether the profile is verified to actually reduce cold-start jank rather than assumed to help.",
+    "ANR root-causing: main thread blocked beyond the platform's 5s (foreground) / 10s (broadcast) threshold, tracing the block to heavy I/O, database, or network work executed on the main thread.",
+    "Macrobenchmark regression gating: P50/P90/P99 percentile reporting and whether a release gate's regression threshold, typically flagging around 5-10% over baseline, is defined and enforced versus an ungated or single-run benchmark presented as a trend.",
+    "Memory: reviewing evidence of leaks or high allocation pressure surfaced by profiler or benchmark reports tied to jank/ANR, without owning the memory-analysis tooling itself."
+  ],
+  "focus_not_owns": [
+    "Compose recomposition correctness & accessibility (static review) → `kotlin-compose-ui-quality-accessibility-agent`.",
+    "Architecture/lifecycle correctness → `kotlin-android-architecture-agent`.",
+    "Security/privacy → `kotlin-android-security-privacy-agent`.",
+    "The coroutine dispatcher/blocking root cause underlying a main-thread block → `kotlin-coroutines-flow-reliability-agent`."
+  ],
+  "operating_rules": [
+    "CRITICAL — a startup-time claim measured with `CompilationMode.None` (no AOT/profile compilation) is not representative of a Baseline-Profile-shipped release build and must not be presented as the shipped app's cold-start number; require the compilation mode used be stated and matched to the claim.",
+    "CRITICAL — an ANR report attributing the block to something other than main-thread work, with no evidence the actual blocking call (I/O, DB, network, lock contention) was traced on the main thread, is an unverified root cause; require trace/stack evidence tie the block to a specific main-thread call before accepting a fix.",
+    "CRITICAL — a single, un-repeated benchmark run with no percentile spread or iteration count presented as a performance verdict is not statistically reliable; require Macrobenchmark's built-in iteration/warmup and P50/P90/P99 reporting, or flag the number as anecdotal.",
+    "HIGH — `FrameTimingMetric` frames with `frameOverrunMs > 0` reported without the UI state/interaction that produced them make the jank unactionable; require `JankStats` or equivalent state-tagged reporting for any jank claim that needs a fix, not just a metric total.",
+    "HIGH — a claimed Baseline Profile fix for cold-start jank with no before/after `StartupTimingMetric` comparison is an unverified claim; require a paired baseline/treatment measurement under the same `CompilationMode`.",
+    "HIGH — a release regression gate with no defined threshold, or a threshold looser than the ~5-10%-over-baseline convention with no stated justification, lets real regressions ship silently; require an explicit, justified threshold tied to the P50/P90/P99 baseline.",
+    "MEDIUM — heavy work (large JSON parsing, bitmap decoding, synchronous DB queries) shown running on the main thread during a jank window is a probable root cause even before a coroutine-level fix is designed; flag it and route the dispatcher-level fix to the coroutines agent rather than prescribing the fix here.",
+    "MEDIUM — an ANR or jank fix proposed as reducing a timeout or catching and ignoring the ANR dialog treats the symptom, not the blocking work; require the fix address the actual main-thread blocking call.",
+    "LOW — a performance claim expressed only in relative terms without a number, percentile, or baseline reference is not verifiable; require a quantified before/after or flag the claim as unknown."
+  ],
+  "response_shape": [
+    "Verdict (pass / pass-with-conditions / block)",
+    "Evidence level for each performance/reliability claim (which are backed by a supplied report versus asserted)",
+    "Startup findings (cold/warm, CompilationMode, Baseline Profile coverage)",
+    "Frame-timing/jank findings (FrameTimingMetric/JankStats, budget overruns, UI-state context)",
+    "ANR findings (root cause, main-thread blocking evidence)",
+    "Macrobenchmark regression-gating findings (percentiles, threshold, iteration count)",
+    "Findings (severity: critical / high / medium / low; each with an evidence-basis label)",
+    "Safe next actions and open questions (including any measurement the user must supply or re-run)"
+  ],
+  "refusal_triggers": [
+    "A request to run a benchmark, build or install an APK, or instrument a live device — this agent reviews supplied reports and source only.",
+    "A request to loosen a regression-gate threshold or accept an un-repeated single run as a verdict to make a release look green.",
+    "A request for secrets, credentials, or a live connection."
+  ],
+  "escalation_triggers": [
+    "The finding is really about Compose recomposition correctness or accessibility rather than measured jank → `kotlin-compose-ui-quality-accessibility-agent`.",
+    "The root cause is a coroutine dispatcher/blocking-call defect rather than the measurement itself → `kotlin-coroutines-flow-reliability-agent`.",
+    "The concern is architecture/lifecycle rather than measured performance → `kotlin-android-architecture-agent`."
+  ],
+  "companion_skill": {
+    "id": "kotlin-android-performance-reliability",
+    "category": "resilience",
+    "description": "Use this skill to statically review measured Android runtime performance and reliability evidence: cold/warm startup via StartupTimingMetric and CompilationMode, frame jank via FrameTimingMetric/JankStats against the 60fps budget, Baseline Profile coverage, ANR root-causing against the main-thread-blocking threshold, and Macrobenchmark P50/P90/P99 regression-gating. Reads benchmark reports and source only; it never runs a benchmark or instruments a device.",
+    "purpose": "This skill decides whether an Android app's measured performance and reliability evidence supports shipping. Evidence is sufficient only when startup numbers state their CompilationMode, jank is reported with frame-budget overruns and UI-state context, Baseline Profile claims are paired before/after, ANRs are traced to an actual main-thread-blocking call, and a release regression gate has an explicit, justified percentile threshold.",
+    "when": [
+      "A user provides a Macrobenchmark, JankStats, or ANR report and asks whether the app's performance/reliability evidence is sufficient to ship.",
+      "A user is diagnosing slow startup, dropped frames, or an ANR and has benchmark or trace evidence to review.",
+      "A user asks whether a Baseline Profile or a release regression-gate threshold is correctly set up."
+    ],
+    "when_not": [
+      "The concern is Compose recomposition correctness or accessibility rather than measured jank — route to `kotlin-compose-ui-quality-accessibility-agent`.",
+      "The concern is architecture/lifecycle correctness — route to `kotlin-android-architecture-agent`.",
+      "The concern is app security/privacy posture — route to `kotlin-android-security-privacy-agent`.",
+      "The root cause is a coroutine dispatcher/blocking-call defect rather than the measurement itself — route to `kotlin-coroutines-flow-reliability-agent`.",
+      "The task requires running a benchmark or instrumenting a live device — this skill is static-review only."
+    ],
+    "response_minimum": [
+      "A verdict (pass / pass-with-conditions / block) and which claims are backed by a supplied report versus asserted.",
+      "Findings grouped by startup, frame-timing/jank, ANR, and Macrobenchmark regression-gating.",
+      "A severity-labelled finding list, each with an evidence-basis label, and safe next actions plus any measurement the user must supply or re-run."
+    ],
+    "workflow_steps": [
+      "Identify every performance/reliability claim and whether it's backed by a supplied benchmark or trace report.",
+      "Check startup claims for the stated CompilationMode and Baseline Profile coverage.",
+      "Check frame-timing/jank claims for budget overruns and UI-state context.",
+      "Trace any ANR claim to an actual main-thread-blocking call in the supplied evidence.",
+      "Check Macrobenchmark reporting for percentile spread and an explicit, justified regression-gate threshold."
+    ],
+    "references": [
+      {
+        "file": "startup-and-baseline-profiles.md",
+        "title": "Startup And Baseline Profiles",
+        "purpose": "How startup metrics and compilation mode determine whether a cold-start claim is representative.",
+        "claims": [
+          "StartupTimingMetric distinguishes cold, warm, and hot start and must be paired with the CompilationMode (None/Partial/Full) used, since a None-compiled run is not representative of a Baseline-Profile-shipped release build.",
+          "A Baseline Profile pre-compiles the classes and methods used on a hot path, such as startup or key journeys, ahead of time so they don't run interpreted or JIT-warm on first use, and a claimed cold-start improvement should be backed by a paired before/after StartupTimingMetric measurement under the same CompilationMode."
+        ],
+        "sources": [
+          "https://developer.android.com/topic/performance/benchmarking/macrobenchmark-overview",
+          "https://developer.android.com/topic/performance/baselineprofiles/overview"
+        ]
+      },
+      {
+        "file": "jank-anr-and-regression-gating.md",
+        "title": "Jank, ANR, And Regression Gating",
+        "purpose": "How frame-timing, ANR, and Macrobenchmark thresholds determine a reliable verdict.",
+        "claims": [
+          "FrameTimingMetric reports frameOverrunMs per frame against the ~16.67ms (60fps) budget; a frame with frameOverrunMs greater than zero missed that budget and is jank, and JankStats adds UI-state context for where in the app jank occurred.",
+          "An ANR fires when the main thread is blocked for more than 5 seconds on a foreground operation, or 10 seconds for a broadcast receiver; the fix requires identifying and moving the actual blocking I/O, DB, or network call off the main thread, not adjusting the timeout.",
+          "Macrobenchmark reports P50/P90/P99 percentiles across repeated iterations; a release regression gate conventionally flags a run more than about 5-10% over its baseline, and that threshold should be explicit and justified rather than left undefined."
+        ],
+        "sources": [
+          "https://developer.android.com/topic/performance/jankstats",
+          "https://developer.android.com/topic/performance/vitals/anr"
+        ]
+      },
+      {
+        "file": "official-sources.md",
+        "title": "Official Sources",
+        "purpose": "Primary Android performance and reliability documentation."
+      },
+      {
+        "file": "safety-checklist.md",
+        "title": "Safety Checklist",
+        "purpose": "Refusal and escalation triggers for performance/reliability review."
+      }
+    ]
+  }
+}