@rune-kit/rune 2.2.2 → 2.2.4

package/compiler/transforms/hooks.js

@@ -8,12 +8,14 @@
 const HOOK_CONSTRAINTS = [
   {
     id: 'secrets-scan',
-    instruction: 'MUST NOT: Never run commands containing hardcoded secrets, API keys, or tokens. Scan all shell commands for secret patterns before execution.',
+    instruction:
+      'MUST NOT: Never run commands containing hardcoded secrets, API keys, or tokens. Scan all shell commands for secret patterns before execution.',
     relevantTools: ['Bash'],
   },
   {
     id: 'auto-format',
-    instruction: 'MUST: After editing JS/TS files, ensure code follows project formatting conventions (Prettier/ESLint).',
+    instruction:
+      'MUST: After editing JS/TS files, ensure code follows project formatting conventions (Prettier/ESLint).',
     relevantTools: ['Edit', 'Write'],
   },
   {
@@ -23,7 +25,8 @@ const HOOK_CONSTRAINTS = [
   },
   {
     id: 'context-watch',
-    instruction: 'SHOULD: Monitor your context usage. If working on a long task, summarize progress before context fills up.',
+    instruction:
+      'SHOULD: Monitor your context usage. If working on a long task, summarize progress before context fills up.',
     relevantTools: [],
   },
   {
@@ -33,7 +36,8 @@ const HOOK_CONSTRAINTS = [
   },
   {
     id: 'post-session',
-    instruction: 'SHOULD: Before ending, save architectural decisions and progress to .rune/ directory for future sessions.',
+    instruction:
+      'SHOULD: Before ending, save architectural decisions and progress to .rune/ directory for future sessions.',
     relevantTools: [],
   },
 ];
@@ -49,20 +53,14 @@ export function generateHookConstraints(parsedSkill, adapter) {
   if (adapter.name === 'claude') return '';
 
   // Filter to relevant constraints based on tool usage in this skill
-  const skillToolNames = parsedSkill.toolRefs.map(r => r.toolName);
-  const relevant = HOOK_CONSTRAINTS.filter(h =>
-    h.relevantTools.length === 0 || h.relevantTools.some(t => skillToolNames.includes(t))
+  const skillToolNames = parsedSkill.toolRefs.map((r) => r.toolName);
+  const relevant = HOOK_CONSTRAINTS.filter(
+    (h) => h.relevantTools.length === 0 || h.relevantTools.some((t) => skillToolNames.includes(t)),
   );
 
   if (relevant.length === 0) return '';
 
-  const lines = [
-    '',
-    '## Platform Constraints',
-    '',
-    ...relevant.map(h => `- ${h.instruction}`),
-    '',
-  ];
+  const lines = ['', '## Platform Constraints', '', ...relevant.map((h) => `- ${h.instruction}`), ''];
 
   return lines.join('\n');
 }

package/compiler/transforms/subagents.js

@@ -30,7 +30,5 @@ export function transformSubagents(body, adapter) {
     result = result.replace(pattern, replace);
   }
 
-  return adapter.transformSubagentInstruction
-    ? adapter.transformSubagentInstruction(result)
-    : result;
+  return adapter.transformSubagentInstruction ? adapter.transformSubagentInstruction(result) : result;
 }

package/compiler/transforms/tool-names.js

@@ -41,7 +41,7 @@ export function transformToolNames(body, adapter) {
   let result = body.replace(TOOL_INSTRUCTION_TO_PATTERN, (match, toolName) => {
     const mapped = adapter.transformToolName(toolName);
     if (mapped === toolName) return match;
-    return mapped.charAt(0).toUpperCase() + mapped.slice(1) + ' to ';
+    return `${mapped.charAt(0).toUpperCase() + mapped.slice(1)} to `;
   });
 
   // Second: "Use `Tool`:" or "Use `Tool`." patterns

package/docs/guides/index.html

@@ -561,22 +561,26 @@
           <button class="tab-btn" data-tab="install-cursor">Cursor</button>
           <button class="tab-btn" data-tab="install-windsurf">Windsurf</button>
           <button class="tab-btn" data-tab="install-antigravity">Antigravity</button>
+          <button class="tab-btn" data-tab="install-openclaw">OpenClaw</button>
         </div>
 
         <div class="tab-panel active" id="install-claude">
           <p>Claude Code uses Rune as a <strong>native plugin</strong> — no compilation needed.</p>
           <div class="code-wrapper">
-            <div class="code-block"><span class="comment"># Install the plugin</span>
-<span class="cmd">claude plugin install rune-kit/rune</span>
+            <div class="code-block"><span class="comment"># Step 1: Add marketplace (one-time)</span>
+<span class="cmd">claude plugin marketplace add rune-kit/rune</span>
+
+<span class="comment"># Step 2: Install the plugin</span>
+<span class="cmd">claude plugin install rune</span>
 
 <span class="comment"># Verify it's loaded</span>
 <span class="cmd">claude</span>
 <span class="output">  58 skills loaded from rune</span></div>
-            <button class="copy-btn" data-copy="claude plugin install rune-kit/rune">Copy</button>
+            <button class="copy-btn" data-copy="claude plugin marketplace add rune-kit/rune && claude plugin install rune">Copy</button>
           </div>
           <div class="callout callout-tip">
-            <strong>Tip:</strong> Claude Code loads SKILL.md files directly from the plugin source.
-            No compilation step, no configuration needed. Just install and go.
+            <strong>Tip:</strong> The marketplace only needs to be added once. After that,
+            just <code>claude plugin install rune</code> or <code>claude plugin update rune</code>.
           </div>
         </div>
 
@@ -618,6 +622,21 @@
             or via your Google Cloud workspace.
           </div>
         </div>
+
+        <div class="tab-panel" id="install-openclaw">
+          <p>OpenClaw uses Rune as a unified mesh package from <strong>ClawHub</strong>.</p>
+          <div class="code-wrapper">
+            <div class="code-block"><span class="cmd">clawhub install rune-kit</span>
+
+<span class="comment"># All 58 skills installed as one mesh package</span>
+<span class="comment"># Works with any OpenClaw-compatible agent</span></div>
+            <button class="copy-btn" data-copy="clawhub install rune-kit">Copy</button>
+          </div>
+          <div class="callout callout-info">
+            <strong>Note:</strong> Rune is published as a single unified package on ClawHub.
+            Individual skills are NOT published separately — the mesh requires all skills together.
+          </div>
+        </div>
       </div>
 
       <!-- FIRST RUN -->
@@ -933,8 +952,11 @@
       </p>
 
       <div class="code-wrapper">
-        <div class="code-block"><span class="comment"># Install</span>
-<span class="cmd">claude plugin install rune-kit/rune</span>
+        <div class="code-block"><span class="comment"># Step 1: Add marketplace (one-time)</span>
+<span class="cmd">claude plugin marketplace add rune-kit/rune</span>
+
+<span class="comment"># Step 2: Install</span>
+<span class="cmd">claude plugin install rune</span>
 
 <span class="comment"># Use any skill directly</span>
 <span class="cmd">/rune cook "add user authentication"</span>
@@ -1038,6 +1060,25 @@
         <code>.agents/skills/</code> — so Claude-compatible skill formats work too.
       </div>
 
+      <h2 id="ide-openclaw">OpenClaw (ClawHub)</h2>
+
+      <p>
+        OpenClaw agents can install Rune from <strong>ClawHub</strong> — the skill registry for the
+        OpenClaw ecosystem. Rune is published as a single unified package (not individual skills).
+      </p>
+
+      <div class="code-wrapper">
+        <div class="code-block"><span class="cmd">clawhub install rune-kit</span>
+
+<span class="comment"># All 58 skills + 14 extension packs as one mesh package</span>
+<span class="comment"># Slug: rune-kit on clawhub.ai</span></div>
+      </div>
+
+      <div class="callout callout-warn">
+        <strong>Important:</strong> Rune skills are NOT published individually on ClawHub.
+        The mesh requires all 200+ connections to function — installing skills separately would break routing.
+      </div>
+
       <div class="callout callout-info">
         <strong>All platforms get the same 58 skills.</strong> The compiler handles format differences.
         Cross-references, tool names, and model hints are adapted per platform.

package/docs/index.html

@@ -61,7 +61,7 @@
       <canvas id="mesh-canvas"></canvas>
     </div>
     <div class="hero-content">
-      <p class="hero-badge">v2.2.1 &mdash; 58 skills &bull; 8 platforms &bull; MIT</p>
+      <p class="hero-badge">v2.2.2 &mdash; 58 skills &bull; 8 platforms &bull; MIT</p>
       <h1>Less skills.<br><span class="accent">Deeper connections.</span></h1>
       <p class="hero-sub">A mesh ecosystem for AI coding assistants. Skills call each other bidirectionally, forming resilient workflows that adapt when things go wrong.</p>
       <div class="hero-actions">
@@ -244,7 +244,11 @@ D &harr; E &harr; F
         <div class="install-card">
           <h3>Claude Code</h3>
           <p class="install-badge">Native Plugin</p>
-          <pre class="code-block"><code>/plugin install rune@rune-kit</code></pre>
+          <pre class="code-block"><code># Add marketplace (one-time)
+claude plugin marketplace add rune-kit/rune
+
+# Install plugin
+claude plugin install rune</code></pre>
           <p>Full mesh: subagents, hooks, adaptive routing, analytics.</p>
         </div>
         <div class="install-card">
@@ -253,6 +257,67 @@ D &harr; E &harr; F
           <pre class="code-block"><code>npx @rune-kit/rune init</code></pre>
           <p>Auto-detects platform. Compiles all 58 skills to native rule format.</p>
         </div>
+        <div class="install-card">
+          <h3>OpenClaw</h3>
+          <p class="install-badge">ClawHub Registry</p>
+          <pre class="code-block"><code>clawhub install rune-kit</code></pre>
+          <p>58 skills as unified mesh package. Works with any OpenClaw agent.</p>
+        </div>
+      </div>
+    </div>
+  </section>
+
+  <!-- GUIDES DIRECTORY -->
+  <section class="section section-dark" id="learn">
+    <div class="container">
+      <h2>Learn Rune</h2>
+      <p class="section-sub">From first install to advanced mesh orchestration &mdash; everything in one place.</p>
+      <div class="guide-grid">
+        <a href="guides/#install" class="guide-link">
+          <span class="guide-icon">&#9889;</span>
+          <div>
+            <strong>Quick Start</strong>
+            <span>Install + first run in 2 minutes</span>
+          </div>
+        </a>
+        <a href="guides/#mesh-architecture" class="guide-link">
+          <span class="guide-icon">&#9670;</span>
+          <div>
+            <strong>Mesh Architecture</strong>
+            <span>How 200+ connections work</span>
+          </div>
+        </a>
+        <a href="guides/#wf-cook" class="guide-link">
+          <span class="guide-icon">&#9881;</span>
+          <div>
+            <strong>Workflows</strong>
+            <span>cook, rescue, team, debug</span>
+          </div>
+        </a>
+        <a href="guides/#ide-claude" class="guide-link">
+          <span class="guide-icon">&#128187;</span>
+          <div>
+            <strong>Platform Guides</strong>
+            <span>Claude, Cursor, Windsurf, Codex, OpenClaw</span>
+          </div>
+        </a>
+        <a href="guides/#ext-using" class="guide-link">
+          <span class="guide-icon">&#128230;</span>
+          <div>
+            <strong>Extension Packs</strong>
+            <span>14 domain packs + create your own</span>
+          </div>
+        </a>
+        <a href="guides/#faq" class="guide-link">
+          <span class="guide-icon">&#10067;</span>
+          <div>
+            <strong>FAQ &amp; Troubleshooting</strong>
+            <span>Common issues + answers</span>
+          </div>
+        </a>
+      </div>
+      <div style="text-align:center;margin-top:24px">
+        <a href="guides/" class="btn btn-ghost">View Full Guide &rarr;</a>
       </div>
     </div>
   </section>

package/docs/style.css

@@ -245,7 +245,7 @@ a:hover { opacity: 0.85; }
 .feature-card p { font-size: 14px; color: var(--text-secondary); line-height: 1.6; }
 
 /* ─── INSTALL ─── */
-.install-grid { display: grid; grid-template-columns: repeat(2, 1fr); gap: 20px; max-width: 800px; margin: 0 auto; }
+.install-grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(240px, 1fr)); gap: 20px; max-width: 960px; margin: 0 auto; }
 .install-card {
   background: var(--bg-card); border: 1px solid var(--border);
   border-radius: var(--radius-lg); padding: 32px; text-align: center;
@@ -264,6 +264,23 @@ a:hover { opacity: 0.85; }
 }
 .install-card p:last-child { font-size: 14px; color: var(--text-secondary); }
 
+/* ─── GUIDE DIRECTORY ─── */
+.guide-grid {
+  display: grid; grid-template-columns: repeat(auto-fit, minmax(280px, 1fr));
+  gap: 12px; max-width: 960px; margin: 0 auto;
+}
+.guide-link {
+  display: flex; align-items: center; gap: 16px;
+  padding: 16px 20px; background: var(--bg-card);
+  border: 1px solid var(--border); border-radius: var(--radius-md);
+  color: var(--text-primary);
+  transition: border-color var(--transition), transform var(--transition);
+}
+.guide-link:hover { border-color: var(--accent); transform: translateY(-2px); opacity: 1; }
+.guide-icon { font-size: 24px; flex-shrink: 0; }
+.guide-link strong { display: block; font-size: 15px; margin-bottom: 2px; }
+.guide-link span { font-size: 13px; color: var(--text-secondary); }
+
 /* ─── PRICING ─── */
 
 /* Persona cards — "who needs what" */

package/extensions/security/PACK.md

@@ -3,7 +3,7 @@ name: "@rune/security"
 description: Deep security analysis — OWASP audit, penetration testing patterns, secret management, compliance checking, supply chain security, and API hardening.
 metadata:
   author: runedev
-  version: "0.2.0"
+  version: "0.3.0"
   layer: L4
   price: "$15"
   target: Security engineers
@@ -20,12 +20,12 @@ tools:
 
 ## Purpose
 
-@rune/security delivers manual-grade security analysis for teams that need more than an automated gate. Where `sentinel` (L2) runs fast checks on every commit, this pack runs thorough, on-demand audits: threat modeling entire auth flows, mapping real attack surfaces, designing vault strategies, auditing supply chain integrity, hardening API surfaces, and producing compliance audit trails. All six skills share the same threat mindset — assume breach, prove safety, document evidence.
+@rune/security delivers manual-grade security analysis for teams that need more than an automated gate. Where `sentinel` (L2) runs fast checks on every commit, this pack runs thorough, on-demand audits: threat modeling entire auth flows, mapping real attack surfaces, designing vault strategies, auditing supply chain integrity, hardening API surfaces, enforcing multi-layer validation, and producing compliance audit trails. All seven skills share the same threat mindset — assume breach, prove safety, document evidence.
 
 ## Triggers
 
 - `/rune security` — manual invocation, full pack audit
-- `/rune owasp-audit` | `/rune pentest-patterns` | `/rune secret-mgmt` | `/rune compliance` | `/rune supply-chain` | `/rune api-security` — single skill invocation
+- `/rune owasp-audit` | `/rune pentest-patterns` | `/rune secret-mgmt` | `/rune compliance` | `/rune supply-chain` | `/rune api-security` | `/rune defense-in-depth` — single skill invocation
 - Called by `cook` (L1) when auth, crypto, payment, or PII-handling code is detected
 - Called by `review` (L2) when security-critical patterns are flagged during code review
 - Called by `deploy` (L2) before production releases when security scope is active
@@ -40,6 +40,7 @@ tools:
 | [compliance](skills/compliance.md) | opus | SOC 2, GDPR, HIPAA, PCI-DSS v4.0 gap analysis, automated evidence collection, and audit-ready evidence packages. |
 | [supply-chain](skills/supply-chain.md) | sonnet | Dependency confusion attacks, typosquatting, lockfile injection, manifest confusion, and SLSA provenance verification. |
 | [api-security](skills/api-security.md) | sonnet | Rate limiting, input sanitization, CORS, CSP generation, and security headers middleware for Express, Fastify, and Next.js. |
+| [defense-in-depth](skills/defense-in-depth.md) | sonnet | Multi-layer validation strategy — add validation at every layer data passes through (entry, business logic, environment, instrumentation). |
 
 ## Connections
 

package/extensions/security/skills/defense-in-depth.md

@@ -0,0 +1,103 @@
+---
+name: "defense-in-depth"
+pack: "@rune/security"
+description: "Multi-layer validation strategy — add validation at EVERY layer data passes through, not just the entry point. Prevents single-point-of-failure in input handling."
+model: sonnet
+tools: [Read, Edit, Write, Grep, Glob, Bash]
+---
+
+# defense-in-depth
+
+Multi-layer validation strategy. When a bug is caused by invalid data flowing through the system, the fix must add validation at EVERY layer — not just where the error appeared. Different code paths bypass single validation points. All four layers are necessary; during testing, each catches bugs the others miss.
+
+#### When to Use
+
+- After `debug` finds a root cause involving invalid data propagation
+- When `owasp-audit` identifies input validation gaps across multiple boundaries
+- During new feature implementation where data crosses 3+ layers (API → service → DB)
+- When a fix at one layer didn't prevent the same class of bug from recurring at another layer
+
+#### The 4-Layer Model
+
+| Layer | Purpose | What to Validate | Example |
+|-------|---------|------------------|---------|
+| **L1: Entry Point** | Reject invalid input at system boundary | Schema, type, format, size | Zod schema at API route, CLI arg parser |
+| **L2: Business Logic** | Ensure data makes sense for the operation | Semantic validity, permissions, state | "User owns this resource", "balance >= withdrawal" |
+| **L3: Environment Guards** | Prevent dangerous operations in wrong context | Path containment, env checks, capability limits | Refuse `git init` outside tmpdir in tests, block prod writes in dev |
+| **L4: Debug Instrumentation** | Capture context for forensics when layers 1-3 fail | Stack traces, data snapshots at boundaries | `console.error` with full context before dangerous operations |
+
+#### Workflow
+
+**Step 1 — Map Data Flow**
+Trace the path of the problematic data from entry point to crash site. Identify every function boundary it crosses. Each boundary is a potential validation layer.
+
+**Step 2 — Audit Existing Validation**
+For each boundary, check: does validation exist? Is it sufficient? Common gaps:
+- Entry point validates type but not semantic meaning (e.g., "is string" but not "is valid email")
+- Business logic assumes entry point already validated (no redundancy)
+- Environment guards absent entirely (test code can hit production paths)
+- No instrumentation to diagnose future failures
+
+**Step 3 — Add Missing Layers**
+For each gap, add validation appropriate to that layer:
+
+```typescript
+// L1: Entry Point — schema validation
+const CreateOrderSchema = z.object({
+  userId: z.string().uuid(),
+  amount: z.number().positive().max(100000),
+  currency: z.enum(['USD', 'EUR', 'VND']),
+})
+
+// L2: Business Logic — semantic validation
+async function createOrder(data: CreateOrderInput) {
+  const user = await db.users.findById(data.userId)
+  if (!user) throw new NotFoundError('User not found')
+  if (user.balance < data.amount) throw new InsufficientFundsError()
+  // proceed...
+}
+
+// L3: Environment Guard — context protection
+function writeToPath(targetDir: string, filename: string) {
+  const resolved = path.resolve(targetDir, filename)
+  if (!resolved.startsWith(path.resolve(targetDir))) {
+    throw new SecurityError('Path traversal attempt blocked')
+  }
+  if (process.env.NODE_ENV === 'test' && !resolved.startsWith('/tmp')) {
+    throw new SecurityError('Test environment: writes restricted to /tmp')
+  }
+}
+
+// L4: Debug Instrumentation — forensic context
+function dangerousOperation(input: unknown) {
+  console.error('[DEFENSE] dangerousOperation called with:', {
+    input,
+    stack: new Error().stack,
+    env: process.env.NODE_ENV,
+    timestamp: new Date().toISOString(),
+  })
+  // proceed with operation...
+}
+```
+
+**Step 4 — Verify All Layers**
+Write tests that bypass each individual layer and confirm the next layer catches it:
+- Test L2 with valid-schema but semantically invalid data (passes L1, caught by L2)
+- Test L3 with valid business data but wrong environment (passes L1+L2, caught by L3)
+- If any single-layer bypass succeeds end-to-end → the defense is incomplete
+
+#### Sharp Edges
+
+| Failure Mode | Severity | Mitigation |
+|---|---|---|
+| Fixing only at crash site, not at data origin | CRITICAL | Backward trace: fix at source AND add guards at each intermediate layer |
+| L1 validation gives false sense of security | HIGH | L1 validates format only — L2 must validate meaning and permissions |
+| Environment guards missing in test context | HIGH | L3: add `NODE_ENV` checks to prevent test pollution and dangerous operations |
+| No forensic trail when all layers are bypassed | MEDIUM | L4: always log context before irreversible operations |
+
+#### Connection to Other Skills
+
+- Called by `debug` (L2): after root cause found, recommend defense-in-depth fix via `rune:fix`
+- Called by `owasp-audit` (L4): when audit finds validation only at entry point
+- Complements `sentinel` (L2): sentinel gates commits, defense-in-depth designs the validation architecture
+- Informs `api-security` (L4): API hardening is L1 of this model; defense-in-depth extends to all layers

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rune-kit/rune",
-  "version": "2.2.2",
+  "version": "2.2.4",
   "description": "58-skill mesh for AI coding assistants — 5-layer architecture, 200+ connections, 8 platforms (Claude Code, Cursor, Windsurf, Antigravity, Codex, OpenCode, OpenClaw, Generic)",
   "type": "module",
   "bin": {
@@ -10,6 +10,10 @@
     "build": "node compiler/bin/rune.js build",
     "doctor": "node compiler/bin/rune.js doctor && node scripts/version-sync-check.js",
     "test": "node --test compiler/__tests__/*.test.js",
+    "lint": "biome check .",
+    "lint:fix": "biome check --fix .",
+    "format": "biome format --write .",
+    "ci": "biome check . && node --test compiler/__tests__/*.test.js && node compiler/bin/rune.js doctor",
     "version-check": "node scripts/version-sync-check.js",
     "prepublishOnly": "node scripts/version-sync-check.js"
   },
@@ -51,5 +55,8 @@
   "homepage": "https://github.com/rune-kit/rune",
   "bugs": {
     "url": "https://github.com/rune-kit/rune/issues"
+  },
+  "devDependencies": {
+    "@biomejs/biome": "^2.4.7"
   }
 }

package/skills/completion-gate/SKILL.md

@@ -4,7 +4,7 @@ description: "Validates agent claims against evidence trail. Catches 'done' with
 user-invocable: false
 metadata:
   author: runedev
-  version: "1.2.0"
+  version: "1.3.0"
   layer: L3
   model: haiku
   group: validation
@@ -123,6 +123,34 @@ IF no evidence found:
 UNCONFIRMED — 1 claim lacks evidence, 1 contradicted. Cannot proceed to commit.
 ```
 
+### Step 4.5 — Cross-Phase Integration Check
+
+> From GSD (gsd-build/get-shit-done, 30.8k★): "Phase boundaries are where integration bugs hide."
+
+When validating a completed phase in a multi-phase plan, check for integration gaps between phases:
+
+1. **Orphaned exports** — files/functions created in this phase that claim to be used by future phases (see `## Cross-Phase Context → Exports`) but are not yet importable:
+   ```
+   Grep for the export name in the current codebase:
+   - If export exists AND is importable → CONFIRMED
+   - If export exists but has wrong signature vs phase file contract → CONTRADICTED
+   - Expected export missing entirely → UNCONFIRMED ("Phase N claims to export X but X not found")
+   ```
+
+2. **Uncalled routes** — API endpoints added in this phase but not wired to any frontend/consumer yet:
+   - This is OK if a future phase handles wiring (check master plan)
+   - Flag as WARN if no future phase mentions consuming this route
+
+3. **Auth gaps** — new endpoints or pages without authentication/authorization:
+   - `Grep` for route handlers without auth middleware
+   - Flag as WARN (may be intentional for public endpoints, but worth checking)
+
+4. **E2E flow trace** — for the primary user flow this phase enables:
+   - Trace: entry point → business logic → data layer → response
+   - If any step in the chain is missing or stubbed → CONTRADICTED
+
+**This step is OPTIONAL for single-phase tasks and MANDATORY for multi-phase master plans.**
+
 ### Step 5 — Evidence Quality Gate
 
 Before emitting verdict, verify evidence quality:
@@ -170,6 +198,8 @@ Completion Gate Report with status (CONFIRMED/UNCONFIRMED/CONTRADICTED), claim v
 | Agent pre-generates evidence by running commands proactively | LOW | This is actually GOOD behavior — we want agents to provide evidence |
 | Completion-gate itself claims "all confirmed" without evidence | CRITICAL | Gate report MUST include the evidence table — no table = report is invalid |
 | Existence Theater — agent creates files but they're stubs | HIGH | Step 1b stub detection: grep for Placeholder/TODO/NotImplementedError in new files |
+| Cross-phase integration gaps — exports exist but wrong signature | HIGH | Step 4.5: verify exports match Code Contracts from phase file |
+| Phase complete but E2E flow broken — missing link in the chain | MEDIUM | Step 4.5 E2E flow trace: entry → logic → data → response must all be connected |
 
 ## Done When
 

package/skills/cook/SKILL.md

@@ -5,7 +5,7 @@ context: fork
 agent: general-purpose
 metadata:
   author: runedev
-  version: "0.7.0"
+  version: "0.9.0"
   layer: L1
   model: sonnet
   group: orchestrator
@@ -322,6 +322,11 @@ If the coder model needs info from other phases, it's in the Cross-Phase Context
 1. Mark Phase 4 as `in_progress`
 2. **Phase-file execution** — if working from a master plan + phase file:
    - Execute tasks listed in the phase file (the `## Tasks` section)
+   - **Wave-based execution**: if tasks are organized into waves (see `plan` skill), execute wave-by-wave:
+     - Wave 1 tasks first (no dependencies — can run in parallel if inside `team`)
+     - Wave 2 tasks only after ALL Wave 1 tasks complete
+     - Within a wave: `team` dispatches as parallel subagents; solo cook runs sequentially
+     - If a task in Wave N fails → do NOT start Wave N+1. Fix or DECOMPOSE the failed task first
    - Follow code contracts from `## Code Contracts` section
    - Respect rejection criteria from `## Rejection Criteria` section
    - Handle failure scenarios from `## Failure Scenarios` section
@@ -419,6 +424,7 @@ PARALLEL EXECUTION:
 **REQUIRED SUB-SKILL**: Use `rune:completion-gate`
 - Validate that agent claims match evidence trail
 - Check: tests actually ran (stdout captured), files actually changed (git diff), build actually passed
+- Check: no truncated code files (`// ...`, `// rest of code`, bare ellipsis) — agent MUST complete all output
 - Any UNCONFIRMED claim → BLOCK with specific gap identified
 
 **Gate**: If sentinel finds CRITICAL security issue → STOP, fix it, re-run. Non-negotiable.
@@ -739,13 +745,23 @@ A wrong first attempt that produces feedback beats perfect understanding that ne
 
 ```
 ## Cook Report: [Task Name]
-- **Status**: complete | partial | blocked
+- **Status**: DONE | DONE_WITH_CONCERNS | NEEDS_CONTEXT | BLOCKED
 - **Phases**: [list of completed phases]
 - **Files Changed**: [count] ([list])
 - **Tests**: [passed]/[total] ([coverage]%)
 - **Quality**: preflight [PASS/WARN] | sentinel [PASS/WARN] | review [PASS/WARN]
 - **Commit**: [hash] — [message]
 
+### Deliverables (NEXUS response — when invoked by team)
+| # | Deliverable | Status | Evidence |
+|---|-------------|--------|----------|
+| 1 | [from handoff] | DELIVERED | [file path or test output quote] |
+| 2 | [from handoff] | DELIVERED | [file path or test output quote] |
+| 3 | [from handoff] | PARTIAL | [what's missing and why] |
+
+### Concerns (if DONE_WITH_CONCERNS)
+- [concern]: [impact assessment] — [suggested remediation]
+
 ### Decisions Made
 - [decision]: [rationale]
 
@@ -754,6 +770,8 @@ A wrong first attempt that produces feedback beats perfect understanding that ne
 - Saved to .rune/progress.md
 ```
 
+> When cook is invoked standalone (not by team), the Deliverables table is optional. When invoked by team with a NEXUS Handoff, the Deliverables table is MANDATORY — team uses it to track acceptance criteria across streams.
+
 ## Sharp Edges
 
 Known failure modes for this skill. Check these before declaring done.

package/skills/debug/SKILL.md

@@ -3,7 +3,7 @@ name: debug
 description: Root cause analysis for bugs and unexpected behavior. Traces errors through code, uses structured reasoning, and hands off to fix when cause is found. Core of the debug↔fix mesh.
 metadata:
   author: runedev
-  version: "0.4.0"
+  version: "0.5.0"
   layer: L2
   model: sonnet
   group: development
@@ -89,6 +89,21 @@ When the error appears deep in execution (wrong directory, wrong path, wrong val
 
 Rule: NEVER fix where the error appears. Trace back to where invalid data originated.
 
+#### Instrumentation Tip: Use console.error, Not Loggers
+When adding diagnostic instrumentation, use `console.error()` (stderr) — NOT application loggers. Loggers are configured to suppress output based on log level or environment (e.g., `LOG_LEVEL=warn` silences `logger.debug`). `console.error` bypasses all logger configuration and writes directly to stderr. This is counterintuitive but critical — the one time you NEED debug output is exactly when loggers are configured to hide it.
+
+#### Defense-in-Depth (After Root Cause Found)
+When the root cause is invalid data flowing through multiple layers, recommend fixing at ALL layers — not just the source:
+
+| Layer | Purpose | Example |
+|-------|---------|---------|
+| Layer 1: Entry Point | Reject invalid input at API/CLI boundary | Validate not empty, exists, correct type |
+| Layer 2: Business Logic | Ensure data makes sense for the operation | Validate required params before processing |
+| Layer 3: Environment Guards | Prevent dangerous operations in specific contexts | Refuse destructive ops outside allowed dirs |
+| Layer 4: Debug Instrumentation | Capture context for forensics | Stack trace logging before dangerous operations |
+
+All four layers are necessary. During testing, each layer catches bugs the others miss — different code paths bypass single validation points. When recommending a fix via `rune:fix`, explicitly call out which layers need validation added.
+
 #### Multi-Component Instrumentation (for systems with 3+ layers)
 
 When the system has multiple components (CI → build → deploy, API → service → DB):