@rune-kit/rune 2.10.0 → 2.12.0

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 Rune Contributors
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 Rune Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -83,14 +83,27 @@ _Methodology: Claude Code CLI headless mode (`claude -p --output-format json`),
 
 ---
 
-## What's New (v2.10.0)
+## What's New (v2.12.0 — Auto-Discipline)
 
-- **graft skill** (NEW L2) — port features from external repos with 5-dimension challenge gate (License, Stack Fit, Scope, Quality, Maintenance)
-- **plan v1.4.0** — Feature Map system: auto-maintained `.rune/features.md` for cross-feature awareness and gap detection
-- **Mesh Signals v2** — 23 active signals, 14 mesh gaps fixed, signal dispatch ordering documented
-- **62 skills, 215+ connections** across 5 layers
+- **Runtime auto-discipline** — `rune hooks install` wires native hooks on Claude Code, Cursor, Windsurf, Antigravity so `preflight`, `sentinel`, `completion-gate` auto-fire before tool use. No more "remember to invoke the skill."
+- **Three presets** — `strict` (blocking gates), `gentle` (warnings, default), `off` (uninstall). Idempotent install / uninstall with full restore of user hooks.
+- **Multi-tier hook layering** — `--tier pro` / `--tier business` stack paid-tier hooks on top of Free using a tier-tagged manifest at `$<TIER>_ROOT/hooks/manifest.json`. Free compiler stays tier-agnostic (MIT-clean).
+- **logic-guardian v0.3.0** — `rune init` now auto-seeds `.rune/INVARIANTS.md` with project-detected rules (money math, state machines, payment flows). Preflight reads it as a hard gate.
+- **session-bridge v0.7.0** — emits `context.compact.imminent` signal; cook/plan/team listen and checkpoint work before compaction.
+- **autopilot v1.1.0** (Pro) — honors the hooks manifest; runs overnight with the same blocking gates your interactive sessions enforce.
+- **Security** — tier name sanitization (path-traversal-safe), precise `statusLine` detection (no false-positive uninstall of user commands), `overrides` migration for legacy hook entries.
+- **1,152 tests** — +31 from v2.11.0 covering hooks adapter, tier manifest loader, override migration, and review regressions.
 
-### Previous (v2.9.0)
+### Previous (v2.11.0)
+
+- **Mesh integrity** — 8 dead wires fixed, 5 workflow gaps closed (hotfix chain, API versioning, monorepo mode, feature flags, dependency upgrade campaigns)
+- **audit v0.4.0** — DX Review Mode: Addy Osmani's 8 developer experience principles with scoring rubric and browser-pilot integration
+- **cook v2.4.0** — remediation cycle counter + upstream inconsistency protocol
+- **problem-solver v0.4.0** — Cynefin, SWOT, PESTLE, Porter's Five Forces, ethics framework
+- **plan v1.5.0** — autopilot suggested_next: autonomous execution path for Pro users after plan approval
+- **Autopilot routing** — skill-router Tier 1 entry for Pro autopilot ("auto", "làm hết", "đi ngủ" → autonomous mode)
+
+### Previous (v2.10.0)
 
 - **marketing v0.4.0** — anti-AI copy rules (banned phrases, 5 hook types, specificity mandate), expanded SEO audit with schema markup guide (10 types + `@graph` pattern), programmatic SEO awareness (4 playbooks), optional Pro content-scorer/cro-analyst integration
 - **Pro growth pack v1.1.0** — 3 new skills (content-scorer, cro-analyst, marketing-psych) + 6 existing skills enriched with SEO Machine patterns
@@ -246,6 +259,52 @@ This compiles all 62 skills into your IDE's rules format. Same knowledge, same w
 /rune mcp-builder "weather API with forecast tools"
 ```
 
+## Auto-Discipline (Claude Code Hooks)
+
+Turn Rune skills into ambient runtime — no more `/rune preflight` every time. Install once, skills auto-fire on relevant tool calls:
+
+```bash
+# Wire Rune quality gates into Claude Code (.claude/settings.json)
+npx @rune-kit/rune hooks install --preset gentle
+
+# Preset options:
+#   gentle  — advisory, never blocks (default)
+#   strict  — blocks tool call on BLOCK verdict
+#   off     — uninstall
+
+# Inspect current wiring
+npx @rune-kit/rune hooks status
+
+# Remove (preserves user-authored hooks)
+npx @rune-kit/rune hooks uninstall
+```
+
+What gets wired:
+
+| Event | Skill | When it fires |
+|---|---|---|
+| PreToolUse(Edit\|Write) | preflight | Before Claude edits source files |
+| PreToolUse(Bash) | sentinel | Before shell commands (catches `git commit`, secrets) |
+| PostToolUse(Edit\|Write) | dependency-doctor | After dependency manifest edits |
+| Stop | completion-gate | End of session — validates claims against evidence |
+
+Rune only manages entries tagged with its command signature. User-authored hooks in the same events are preserved on install/uninstall.
+
+### Stacking paid tiers (Pro, Business)
+
+Paid tiers ship their own `hooks/manifest.json`. Point Rune at the install root and pass `--tier`:
+
+```bash
+export RUNE_PRO_ROOT=~/rune-pro
+rune hooks install --preset gentle --tier pro
+
+# Stack Free + Pro + Business in one command
+export RUNE_BUSINESS_ROOT=~/rune-business
+rune hooks install --preset gentle --tier pro --tier business
+```
+
+Multi-platform: tier hooks compile to Claude Code, Cursor, Windsurf, and Antigravity with the same command — no Claude-only lock-in.
+
 ## Architecture
 
 ### 5-Layer Model

package/commands/rune.md

@@ -1,168 +1,168 @@
----
-description: "Rune skill ecosystem — interconnected workflows for the full project lifecycle. Use /rune <action> to invoke skills."
-disable-model-invocation: true
----
-
-# Rune — Less skills. Deeper connections.
-
-Route to the appropriate Rune skill based on the action:
-
-## Available Commands
-
-### Orchestrators (L1)
-- `/rune cook <task>` — Invoke the rune:cook skill for feature implementation
-- `/rune team <task>` — Invoke the rune:team skill for parallel multi-agent work
-- `/rune launch` — Invoke the rune:launch skill for deploy + marketing
-- `/rune rescue` — Invoke the rune:rescue skill for legacy refactoring
-
-### Workflow (L2) — Creation
-- `/rune plan <task>` — Invoke the rune:plan skill to create implementation plan
-- `/rune scout` — Invoke the rune:scout skill to scan codebase
-- `/rune brainstorm <topic>` — Invoke the rune:brainstorm skill for creative ideation
-
-### Workflow (L2) — Development
-- `/rune debug <issue>` — Invoke the rune:debug skill for root cause analysis
-- `/rune fix <issue>` — Invoke the rune:fix skill to apply code changes
-- `/rune test` — Invoke the rune:test skill to write and run tests
-- `/rune review` — Invoke the rune:review skill for code quality review
-
-### Workflow (L2) — Quality
-- `/rune sentinel` — Invoke the rune:sentinel skill for security scanning
-- `/rune preflight` — Invoke the rune:preflight skill for pre-commit quality gate
-- `/rune onboard` — Invoke the rune:onboard skill to generate project context
-- `/rune logic-guardian` — Invoke the rune:logic-guardian skill to protect business logic from accidental deletion
-
-### Workflow (L2) — Delivery
-- `/rune deploy` — Invoke the rune:deploy skill for deployment management
-- `/rune marketing` — Invoke the rune:marketing skill for launch asset creation
-
-### Workflow (L2) — Rescue
-- `/rune autopsy` — Invoke the rune:autopsy skill for codebase health assessment
-- `/rune safeguard` — Invoke the rune:safeguard skill to build safety nets for legacy code
-- `/rune surgeon` — Invoke the rune:surgeon skill for incremental refactoring
-
-### Utilities (L3) — Knowledge
-- `/rune research <topic>` — Invoke the rune:research skill for web research
-- `/rune docs-seeker <query>` — Invoke the rune:docs-seeker skill for documentation lookup
-- `/rune trend-scout <topic>` — Invoke the rune:trend-scout skill for market intelligence
-
-### Utilities (L3) — Reasoning
-- `/rune problem-solver <problem>` — Invoke the rune:problem-solver skill for structured reasoning
-- `/rune sequential-thinking <problem>` — Invoke the rune:sequential-thinking skill for multi-variable analysis
-
-### Utilities (L3) — Validation
-- `/rune verification` — Invoke the rune:verification skill to run lint, type-check, tests, build
-- `/rune hallucination-guard` — Invoke the rune:hallucination-guard skill to verify imports and APIs
-
-### Utilities (L3) — State
-- `/rune context-engine` — Invoke the rune:context-engine skill for context window management
-- `/rune journal` — Invoke the rune:journal skill for rescue state tracking
-- `/rune session-bridge` — Invoke the rune:session-bridge skill for cross-session persistence
-
-### Utilities (L3) — Monitoring
-- `/rune watchdog` — Invoke the rune:watchdog skill for post-deploy monitoring
-- `/rune scope-guard` — Invoke the rune:scope-guard skill for scope creep detection
-
-### Utilities (L3) — Media
-- `/rune browser-pilot <url>` — Invoke the rune:browser-pilot skill for Playwright automation
-- `/rune asset-creator <brief>` — Invoke the rune:asset-creator skill for visual asset generation
-- `/rune video-creator <brief>` — Invoke the rune:video-creator skill for video content planning
-
-### Utilities (L3) — Deps
-- `/rune dependency-doctor` — Invoke the rune:dependency-doctor skill for dependency management
-
-### Intelligence (H3)
-- `/rune metrics` — Show mesh analytics from .rune/metrics/ (runs audit Phase 8 only)
-- `/rune pack list` — List installed L4 packs (core + community)
-- `/rune pack install <git-url>` — Install a community L4 pack from Git
-- `/rune pack remove <name>` — Remove a community L4 pack
-- `/rune pack create <name>` — Scaffold a new L4 pack using skill-forge
-
-### Extension Packs (L4)
-
-L4 packs provide domain-specific patterns. When invoked, read the pack's PACK.md and follow the matching skill's workflow steps.
-
-#### Frontend & UI (`extensions/ui/PACK.md`)
-- `/rune design-system` — Design token generation and enforcement
-- `/rune component-patterns` — Component architecture refactoring
-- `/rune a11y-audit` — Accessibility audit (WCAG compliance)
-- `/rune animation-patterns` — Motion design and animation patterns
-
-#### Backend (`extensions/backend/PACK.md`)
-- `/rune api-patterns` — REST/GraphQL API design and validation
-- `/rune auth-patterns` — Authentication and authorization flows
-- `/rune database-patterns` — Schema design, migrations, query optimization
-- `/rune middleware-patterns` — Middleware pipeline and error handling
-
-#### DevOps (`extensions/devops/PACK.md`)
-- `/rune docker` — Dockerfile optimization, multi-stage builds, compose
-- `/rune ci-cd` — CI/CD pipeline setup (GitHub Actions, GitLab CI)
-- `/rune monitoring` — Observability, logging, alerting setup
-- `/rune server-setup` — VPS/cloud server provisioning
-- `/rune ssl-domain` — SSL certificates and domain configuration
-
-#### Mobile (`extensions/mobile/PACK.md`)
-- `/rune react-native` — React Native / Expo architecture and performance
-- `/rune flutter` — Flutter state management and widget patterns
-- `/rune app-store-prep` — App Store / Play Store submission preparation
-- `/rune native-bridge` — Native module bridges (Turbo Modules, MethodChannel)
-
-#### Security (`extensions/security/PACK.md`)
-- `/rune owasp-audit` — OWASP Top 10 vulnerability audit
-- `/rune pentest-patterns` — Penetration testing methodology
-- `/rune secret-mgmt` — Secret management and rotation
-- `/rune compliance` — Compliance framework guidance (SOC2, HIPAA, PCI)
-
-#### Trading & Finance (`extensions/trading/PACK.md`)
-- `/rune fintech-patterns` — Financial data validation, decimal arithmetic
-- `/rune realtime-data` — WebSocket market data, order book management
-- `/rune chart-components` — Trading chart integration (TradingView, Lightweight Charts)
-- `/rune indicator-library` — Technical indicators (SMA, EMA, RSI, MACD)
-- `/rune trade-logic` — Trading logic preservation, strategy specs, backtest linkage
-
-#### SaaS (`extensions/saas/PACK.md`)
-- `/rune multi-tenant` — Multi-tenancy architecture patterns
-- `/rune billing-integration` — Stripe/Paddle billing integration
-- `/rune subscription-flow` — Subscription lifecycle management
-- `/rune onboarding-flow` — User onboarding flow design
-
-#### E-commerce (`extensions/ecommerce/PACK.md`)
-- `/rune shopify-dev` — Shopify theme/app development (Hydrogen, Liquid)
-- `/rune payment-integration` — Payment flow (Stripe Payment Intents, 3DS)
-- `/rune cart-system` — Shopping cart architecture
-- `/rune inventory-mgmt` — Stock tracking with optimistic locking
-
-#### AI/ML (`extensions/ai-ml/PACK.md`)
-- `/rune llm-integration` — LLM API clients with retry and structured output
-- `/rune rag-patterns` — RAG pipeline (chunking, embedding, retrieval, reranking)
-- `/rune embedding-search` — Hybrid search (BM25 + vector)
-- `/rune fine-tuning-guide` — Fine-tuning dataset prep, training, evaluation
-
-#### Game Development (`extensions/gamedev/PACK.md`)
-- `/rune threejs-patterns` — Three.js / React Three Fiber scene optimization
-- `/rune webgl` — WebGL shader programming and buffer management
-- `/rune game-loops` — Fixed timestep game loop with interpolation
-- `/rune physics-engine` — Rapier.js physics integration
-- `/rune asset-pipeline` — Game asset loading, compression, preloading
-
-#### Content (`extensions/content/PACK.md`)
-- `/rune blog-patterns` — Blog system (pagination, RSS, reading time)
-- `/rune cms-integration` — Headless CMS setup (Sanity, Contentful, Strapi)
-- `/rune mdx-authoring` — MDX pipeline with custom components
-- `/rune i18n` — Internationalization (locale routing, translations)
-- `/rune seo-patterns` — SEO audit (JSON-LD, sitemap, meta tags, OG)
-
-#### Analytics (`extensions/analytics/PACK.md`)
-- `/rune tracking-setup` — Analytics tracking with consent management
-- `/rune ab-testing` — A/B experiment design and statistical significance
-- `/rune funnel-analysis` — Conversion funnel tracking and drop-off analysis
-- `/rune dashboard-patterns` — KPI dashboards with server-side aggregation
-
-### Quick Actions
-- `/rune status` — Show current project state from .rune/ files
-
-## Usage
-
-When the user runs `/rune <action>`, invoke the corresponding `rune:<action>` skill.
-For L4 pack commands, read the specified PACK.md file and follow the matching skill's workflow.
-If no action is provided, show this help menu.
+---
+description: "Rune skill ecosystem — interconnected workflows for the full project lifecycle. Use /rune <action> to invoke skills."
+disable-model-invocation: true
+---
+
+# Rune — Less skills. Deeper connections.
+
+Route to the appropriate Rune skill based on the action:
+
+## Available Commands
+
+### Orchestrators (L1)
+- `/rune cook <task>` — Invoke the rune:cook skill for feature implementation
+- `/rune team <task>` — Invoke the rune:team skill for parallel multi-agent work
+- `/rune launch` — Invoke the rune:launch skill for deploy + marketing
+- `/rune rescue` — Invoke the rune:rescue skill for legacy refactoring
+
+### Workflow (L2) — Creation
+- `/rune plan <task>` — Invoke the rune:plan skill to create implementation plan
+- `/rune scout` — Invoke the rune:scout skill to scan codebase
+- `/rune brainstorm <topic>` — Invoke the rune:brainstorm skill for creative ideation
+
+### Workflow (L2) — Development
+- `/rune debug <issue>` — Invoke the rune:debug skill for root cause analysis
+- `/rune fix <issue>` — Invoke the rune:fix skill to apply code changes
+- `/rune test` — Invoke the rune:test skill to write and run tests
+- `/rune review` — Invoke the rune:review skill for code quality review
+
+### Workflow (L2) — Quality
+- `/rune sentinel` — Invoke the rune:sentinel skill for security scanning
+- `/rune preflight` — Invoke the rune:preflight skill for pre-commit quality gate
+- `/rune onboard` — Invoke the rune:onboard skill to generate project context
+- `/rune logic-guardian` — Invoke the rune:logic-guardian skill to protect business logic from accidental deletion
+
+### Workflow (L2) — Delivery
+- `/rune deploy` — Invoke the rune:deploy skill for deployment management
+- `/rune marketing` — Invoke the rune:marketing skill for launch asset creation
+
+### Workflow (L2) — Rescue
+- `/rune autopsy` — Invoke the rune:autopsy skill for codebase health assessment
+- `/rune safeguard` — Invoke the rune:safeguard skill to build safety nets for legacy code
+- `/rune surgeon` — Invoke the rune:surgeon skill for incremental refactoring
+
+### Utilities (L3) — Knowledge
+- `/rune research <topic>` — Invoke the rune:research skill for web research
+- `/rune docs-seeker <query>` — Invoke the rune:docs-seeker skill for documentation lookup
+- `/rune trend-scout <topic>` — Invoke the rune:trend-scout skill for market intelligence
+
+### Utilities (L3) — Reasoning
+- `/rune problem-solver <problem>` — Invoke the rune:problem-solver skill for structured reasoning
+- `/rune sequential-thinking <problem>` — Invoke the rune:sequential-thinking skill for multi-variable analysis
+
+### Utilities (L3) — Validation
+- `/rune verification` — Invoke the rune:verification skill to run lint, type-check, tests, build
+- `/rune hallucination-guard` — Invoke the rune:hallucination-guard skill to verify imports and APIs
+
+### Utilities (L3) — State
+- `/rune context-engine` — Invoke the rune:context-engine skill for context window management
+- `/rune journal` — Invoke the rune:journal skill for rescue state tracking
+- `/rune session-bridge` — Invoke the rune:session-bridge skill for cross-session persistence
+
+### Utilities (L3) — Monitoring
+- `/rune watchdog` — Invoke the rune:watchdog skill for post-deploy monitoring
+- `/rune scope-guard` — Invoke the rune:scope-guard skill for scope creep detection
+
+### Utilities (L3) — Media
+- `/rune browser-pilot <url>` — Invoke the rune:browser-pilot skill for Playwright automation
+- `/rune asset-creator <brief>` — Invoke the rune:asset-creator skill for visual asset generation
+- `/rune video-creator <brief>` — Invoke the rune:video-creator skill for video content planning
+
+### Utilities (L3) — Deps
+- `/rune dependency-doctor` — Invoke the rune:dependency-doctor skill for dependency management
+
+### Intelligence (H3)
+- `/rune metrics` — Show mesh analytics from .rune/metrics/ (runs audit Phase 8 only)
+- `/rune pack list` — List installed L4 packs (core + community)
+- `/rune pack install <git-url>` — Install a community L4 pack from Git
+- `/rune pack remove <name>` — Remove a community L4 pack
+- `/rune pack create <name>` — Scaffold a new L4 pack using skill-forge
+
+### Extension Packs (L4)
+
+L4 packs provide domain-specific patterns. When invoked, read the pack's PACK.md and follow the matching skill's workflow steps.
+
+#### Frontend & UI (`extensions/ui/PACK.md`)
+- `/rune design-system` — Design token generation and enforcement
+- `/rune component-patterns` — Component architecture refactoring
+- `/rune a11y-audit` — Accessibility audit (WCAG compliance)
+- `/rune animation-patterns` — Motion design and animation patterns
+
+#### Backend (`extensions/backend/PACK.md`)
+- `/rune api-patterns` — REST/GraphQL API design and validation
+- `/rune auth-patterns` — Authentication and authorization flows
+- `/rune database-patterns` — Schema design, migrations, query optimization
+- `/rune middleware-patterns` — Middleware pipeline and error handling
+
+#### DevOps (`extensions/devops/PACK.md`)
+- `/rune docker` — Dockerfile optimization, multi-stage builds, compose
+- `/rune ci-cd` — CI/CD pipeline setup (GitHub Actions, GitLab CI)
+- `/rune monitoring` — Observability, logging, alerting setup
+- `/rune server-setup` — VPS/cloud server provisioning
+- `/rune ssl-domain` — SSL certificates and domain configuration
+
+#### Mobile (`extensions/mobile/PACK.md`)
+- `/rune react-native` — React Native / Expo architecture and performance
+- `/rune flutter` — Flutter state management and widget patterns
+- `/rune app-store-prep` — App Store / Play Store submission preparation
+- `/rune native-bridge` — Native module bridges (Turbo Modules, MethodChannel)
+
+#### Security (`extensions/security/PACK.md`)
+- `/rune owasp-audit` — OWASP Top 10 vulnerability audit
+- `/rune pentest-patterns` — Penetration testing methodology
+- `/rune secret-mgmt` — Secret management and rotation
+- `/rune compliance` — Compliance framework guidance (SOC2, HIPAA, PCI)
+
+#### Trading & Finance (`extensions/trading/PACK.md`)
+- `/rune fintech-patterns` — Financial data validation, decimal arithmetic
+- `/rune realtime-data` — WebSocket market data, order book management
+- `/rune chart-components` — Trading chart integration (TradingView, Lightweight Charts)
+- `/rune indicator-library` — Technical indicators (SMA, EMA, RSI, MACD)
+- `/rune trade-logic` — Trading logic preservation, strategy specs, backtest linkage
+
+#### SaaS (`extensions/saas/PACK.md`)
+- `/rune multi-tenant` — Multi-tenancy architecture patterns
+- `/rune billing-integration` — Stripe/Paddle billing integration
+- `/rune subscription-flow` — Subscription lifecycle management
+- `/rune onboarding-flow` — User onboarding flow design
+
+#### E-commerce (`extensions/ecommerce/PACK.md`)
+- `/rune shopify-dev` — Shopify theme/app development (Hydrogen, Liquid)
+- `/rune payment-integration` — Payment flow (Stripe Payment Intents, 3DS)
+- `/rune cart-system` — Shopping cart architecture
+- `/rune inventory-mgmt` — Stock tracking with optimistic locking
+
+#### AI/ML (`extensions/ai-ml/PACK.md`)
+- `/rune llm-integration` — LLM API clients with retry and structured output
+- `/rune rag-patterns` — RAG pipeline (chunking, embedding, retrieval, reranking)
+- `/rune embedding-search` — Hybrid search (BM25 + vector)
+- `/rune fine-tuning-guide` — Fine-tuning dataset prep, training, evaluation
+
+#### Game Development (`extensions/gamedev/PACK.md`)
+- `/rune threejs-patterns` — Three.js / React Three Fiber scene optimization
+- `/rune webgl` — WebGL shader programming and buffer management
+- `/rune game-loops` — Fixed timestep game loop with interpolation
+- `/rune physics-engine` — Rapier.js physics integration
+- `/rune asset-pipeline` — Game asset loading, compression, preloading
+
+#### Content (`extensions/content/PACK.md`)
+- `/rune blog-patterns` — Blog system (pagination, RSS, reading time)
+- `/rune cms-integration` — Headless CMS setup (Sanity, Contentful, Strapi)
+- `/rune mdx-authoring` — MDX pipeline with custom components
+- `/rune i18n` — Internationalization (locale routing, translations)
+- `/rune seo-patterns` — SEO audit (JSON-LD, sitemap, meta tags, OG)
+
+#### Analytics (`extensions/analytics/PACK.md`)
+- `/rune tracking-setup` — Analytics tracking with consent management
+- `/rune ab-testing` — A/B experiment design and statistical significance
+- `/rune funnel-analysis` — Conversion funnel tracking and drop-off analysis
+- `/rune dashboard-patterns` — KPI dashboards with server-side aggregation
+
+### Quick Actions
+- `/rune status` — Show current project state from .rune/ files
+
+## Usage
+
+When the user runs `/rune <action>`, invoke the corresponding `rune:<action>` skill.
+For L4 pack commands, read the specified PACK.md file and follow the matching skill's workflow.
+If no action is provided, show this help menu.

package/compiler/__tests__/detect-invariants.test.js

@@ -0,0 +1,136 @@
+import assert from 'node:assert';
+import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { after, before, describe, test } from 'node:test';
+import { detectInvariants, renderInvariants } from '../../skills/onboard/scripts/detect-invariants.js';
+
+async function scaffold(files) {
+  const root = await mkdtemp(path.join(tmpdir(), 'rune-invariants-'));
+  for (const [rel, content] of Object.entries(files)) {
+    const abs = path.join(root, rel);
+    await mkdir(path.dirname(abs), { recursive: true });
+    await writeFile(abs, content, 'utf8');
+  }
+  return root;
+}
+
+describe('detectInvariants — danger zones', () => {
+  test('scores deeply-nested source directories as danger zones', async () => {
+    const files = {};
+    for (let i = 0; i < 12; i++) {
+      files[`src/auth/sub/file${i}.ts`] = `export const x${i} = ${i};\n`;
+    }
+    files['src/auth/session.ts'] = 'export const SESSION_TTL = 900;\n';
+    const root = await scaffold(files);
+    try {
+      const result = await detectInvariants({ root });
+      const danger = result.danger.map((r) => r.where[0]);
+      assert.ok(
+        danger.some((d) => d.startsWith('src/auth')),
+        `expected src/auth in danger, got: ${JSON.stringify(danger)}`,
+      );
+    } finally {
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+
+  test('ignores node_modules and .git', async () => {
+    const files = {};
+    for (let i = 0; i < 20; i++) {
+      files[`node_modules/pkg/file${i}.js`] = '// noise\n';
+    }
+    files['src/app.ts'] = 'export const A = 1;\n';
+    const root = await scaffold(files);
+    try {
+      const result = await detectInvariants({ root });
+      const danger = result.danger.map((r) => r.where[0]);
+      assert.ok(!danger.some((d) => d.includes('node_modules')), 'node_modules must not appear');
+    } finally {
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+});
+
+describe('detectInvariants — critical constants', () => {
+  test('flags SCREAMING_SNAKE constants used in 3+ files', async () => {
+    const files = {
+      'src/config.ts': 'export const MAX_RETRIES = 3;\n',
+      'src/a.ts': 'import { MAX_RETRIES } from "./config";\nconsole.log(MAX_RETRIES);\n',
+      'src/b.ts': 'import { MAX_RETRIES } from "./config";\nif (MAX_RETRIES > 0) {}\n',
+      'src/c.ts': 'import { MAX_RETRIES } from "./config";\nconst x = MAX_RETRIES;\n',
+    };
+    const root = await scaffold(files);
+    try {
+      const result = await detectInvariants({ root });
+      const found = result.critical.some(
+        (r) => (r.title ?? '').includes('MAX_RETRIES') || (r.what ?? '').includes('MAX_RETRIES'),
+      );
+      assert.ok(
+        found,
+        `expected MAX_RETRIES in critical, got titles: ${JSON.stringify(result.critical.map((r) => r.title))}`,
+      );
+    } finally {
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+
+  test('does NOT flag constants used in fewer than 3 places', async () => {
+    const files = {
+      'src/config.ts': 'export const LONELY = 1;\n',
+      'src/a.ts': 'import { LONELY } from "./config";\n',
+    };
+    const root = await scaffold(files);
+    try {
+      const result = await detectInvariants({ root });
+      const found = result.critical.some((r) => (r.title ?? '').includes('LONELY'));
+      assert.strictEqual(found, false, 'LONELY should not be flagged with only 2 usages');
+    } finally {
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+});
+
+describe('renderInvariants', () => {
+  test('produces markdown headings per non-empty bucket', () => {
+    const result = {
+      danger: [{ title: 'src/auth', what: '12 files', where: ['src/auth/**'], why: 'high churn' }],
+      critical: [],
+      state: [],
+      cross: [],
+      stats: { filesScanned: 10 },
+    };
+    const md = renderInvariants(result);
+    assert.ok(md.includes('### Danger Zones'));
+    assert.ok(md.includes('#### src/auth'));
+    assert.ok(md.includes('- **WHAT**: 12 files'));
+    assert.ok(!md.includes('### Critical Invariants'));
+  });
+
+  test('falls back to placeholder when empty', () => {
+    const md = renderInvariants({ danger: [], critical: [], state: [], cross: [] });
+    assert.match(md, /No invariants detected/);
+  });
+});
+
+describe('detectInvariants — performance', () => {
+  let root;
+  before(async () => {
+    const files = {};
+    for (let i = 0; i < 120; i++) {
+      files[`src/mod${i % 12}/file${i}.ts`] = `export const FOO_${i} = ${i};\n`;
+    }
+    root = await scaffold(files);
+  });
+  after(async () => {
+    await rm(root, { recursive: true, force: true });
+  });
+
+  test('completes under 5 seconds for a 120-file project', async () => {
+    const start = Date.now();
+    const result = await detectInvariants({ root });
+    const elapsed = Date.now() - start;
+    assert.ok(elapsed < 5000, `took ${elapsed}ms, expected <5000ms`);
+    assert.ok(result.stats.filesScanned >= 100, `scanned ${result.stats.filesScanned} files`);
+  });
+});