@rune-kit/rune 2.2.6 → 2.3.0

package/README.md

@@ -26,7 +26,7 @@ Mesh:      A ↔ B ↔ C             (B fails = A reaches C via D→E)
            D ↔ E ↔ F
 ```
 
-## What's New (v2.2.2)
+## What's New (v2.3.0)
 
 - **UI/UX Pro Max Integration** — 161 palettes, 84 styles, 73 font pairings, 161 reasoning rules from [UI/UX Pro Max](https://github.com/nextlevelbuilder/ui-ux-pro-max-skill) (MIT, 42.8k★) meshed into `design` skill + `@rune/ui` pack
 - **11 Core Skill Enrichments** — deviation rules, repair operators, evidence quality gate, decision classification, debug knowledge base, CSO discipline, YAGNI pushback, formal pause/resume

package/docs/SKILL-TEMPLATE.md

@@ -54,6 +54,17 @@ Step-by-step execution flow.
 Structured output that calling skills can consume.
 ```
 
+## Returns
+
+Explicit output contract so calling skills know exactly what to expect.
+
+| Field | Type | Description |
+|-------|------|-------------|
+| `field_name` | type | What this field contains and when it's populated |
+| `status` | enum | e.g., `DONE` / `DONE_WITH_CONCERNS` / `BLOCKED` |
+
+Why: Without explicit return schemas, calling skills guess at output structure. This causes silent failures when output format changes. Every L1/L2 skill MUST have a Returns section.
+
 ## Constraints
 
 3-7 MUST/MUST NOT rules specific to this skill.
@@ -101,3 +112,7 @@ Why: Completion-gate validates claims generically. Self-Validation catches domai
 ## Cost Profile
 
 Estimated token usage per invocation.
+
+**Scope guardrail**: [Terminal boundary statement — what this skill must NOT do even if asked. Examples: "Do not write code — only produce plans.", "Do not modify files outside the target module.", "Do not execute fixes — only diagnose and hand off to fix."]
+
+Why: Without terminal guardrails, agents drift into adjacent responsibilities. A review skill starts fixing code, a plan skill starts implementing, a debug skill starts deploying. The guardrail is the last line in the skill file — a final reminder of scope boundaries before the agent acts.

package/docs/index.html

@@ -62,7 +62,7 @@
       <canvas id="mesh-canvas"></canvas>
     </div>
     <div class="hero-content">
-      <p class="hero-badge">v2.2.2 &mdash; 58 skills &bull; 8 platforms &bull; MIT</p>
+      <p class="hero-badge">v2.3.0 &mdash; 59 skills &bull; 8 platforms &bull; MIT</p>
       <h1>Less skills.<br><span class="accent">Deeper connections.</span></h1>
       <p class="hero-sub">A mesh ecosystem for AI coding assistants. Skills call each other bidirectionally, forming resilient workflows that adapt when things go wrong.</p>
       <div class="hero-actions">
@@ -839,12 +839,42 @@ claude plugin install rune</code></pre>
       </div>
 
       <!-- Step 4: Success -->
-      <div id="pay-step-4" class="pay-step" hidden>
-        <div class="pay-success-icon">&#10003;</div>
-        <h3>Payment Received!</h3>
-        <p class="pay-subtitle">A GitHub invitation has been sent to <strong id="pay-success-user"></strong></p>
-        <p class="pay-hint">Check your email for the invitation to <code>rune-kit/rune-pro</code></p>
-        <button class="btn btn-primary" style="width:100%;margin-top:20px" onclick="closePayment()">Done</button>
+      <div id="pay-step-4" class="pay-step pay-success" hidden>
+        <div class="pay-success-badge">
+          <svg class="pay-success-check" viewBox="0 0 52 52" width="52" height="52">
+            <circle class="pay-success-circle" cx="26" cy="26" r="24" fill="none" stroke="currentColor" stroke-width="2.5"/>
+            <path class="pay-success-tick" fill="none" stroke="currentColor" stroke-width="3" stroke-linecap="round" stroke-linejoin="round" d="M15 27l7 7 15-15"/>
+          </svg>
+        </div>
+        <h3 class="pay-success-title">You're in!</h3>
+        <p class="pay-success-sub">A GitHub repo invitation is on its way to <strong id="pay-success-user"></strong></p>
+
+        <div class="pay-success-steps">
+          <div class="pay-success-step">
+            <span class="pay-success-num">1</span>
+            <div>
+              <strong>Check your GitHub email</strong>
+              <span>Look for an invite from <code>noreply@github.com</code> — usually within 1 minute</span>
+            </div>
+          </div>
+          <div class="pay-success-step">
+            <span class="pay-success-num">2</span>
+            <div>
+              <strong>Accept the invitation</strong>
+              <span>Click "View invitation" to join the private repo</span>
+            </div>
+          </div>
+          <div class="pay-success-step">
+            <span class="pay-success-num">3</span>
+            <div>
+              <strong>Install your packs</strong>
+              <span id="pay-success-install">Follow the setup guide in the repo README</span>
+            </div>
+          </div>
+        </div>
+
+        <button class="btn btn-primary pay-success-done" onclick="closePayment()">Got it</button>
+        <p class="pay-success-help">Didn't get the invite? Check spam, or email <a href="mailto:claude@theio.vn">claude@theio.vn</a></p>
       </div>
 
       <!-- Step 5: International — GitHub username + Polar checkout -->
@@ -861,6 +891,45 @@ claude plugin install rune</code></pre>
         <button id="pay-intl-submit" class="btn btn-pro" style="width:100%;margin-top:16px" onclick="startPolarCheckout()">Pay with Card / PayPal</button>
         <p class="pay-hint" style="margin-top:12px">You'll be redirected to Polar's secure checkout page</p>
       </div>
+
+      <!-- Step 6: Success (Vietnamese — for SePay flow) -->
+      <div id="pay-step-6" class="pay-step pay-success notranslate" translate="no" hidden>
+        <div class="pay-success-badge">
+          <svg class="pay-success-check" viewBox="0 0 52 52" width="52" height="52">
+            <circle class="pay-success-circle" cx="26" cy="26" r="24" fill="none" stroke="currentColor" stroke-width="2.5"/>
+            <path class="pay-success-tick" fill="none" stroke="currentColor" stroke-width="3" stroke-linecap="round" stroke-linejoin="round" d="M15 27l7 7 15-15"/>
+          </svg>
+        </div>
+        <h3 class="pay-success-title">Thanh toán thành công!</h3>
+        <p class="pay-success-sub">Lời mời truy cập repo đã được gửi đến <strong id="pay-success-user-vn"></strong></p>
+
+        <div class="pay-success-steps">
+          <div class="pay-success-step">
+            <span class="pay-success-num">1</span>
+            <div>
+              <strong>Kiểm tra email GitHub</strong>
+              <span>Tìm email mời từ <code>noreply@github.com</code> — thường trong vòng 1 phút</span>
+            </div>
+          </div>
+          <div class="pay-success-step">
+            <span class="pay-success-num">2</span>
+            <div>
+              <strong>Chấp nhận lời mời</strong>
+              <span>Nhấn "View invitation" để vào private repo</span>
+            </div>
+          </div>
+          <div class="pay-success-step">
+            <span class="pay-success-num">3</span>
+            <div>
+              <strong>Cài đặt skill packs</strong>
+              <span id="pay-success-install-vn">Làm theo hướng dẫn trong README của repo</span>
+            </div>
+          </div>
+        </div>
+
+        <button class="btn btn-primary pay-success-done" onclick="closePayment()">Xong</button>
+        <p class="pay-success-help">Chưa nhận được? Kiểm tra spam, hoặc email <a href="mailto:claude@theio.vn">claude@theio.vn</a></p>
+      </div>
     </div>
   </div>
 

package/docs/script.js

@@ -227,8 +227,9 @@ function closePayment() {
 }
 
 function showPayStep(n) {
-  for (let i = 1; i <= 5; i++) {
-    document.getElementById('pay-step-' + i).hidden = (i !== n);
+  for (let i = 1; i <= 6; i++) {
+    const el = document.getElementById('pay-step-' + i);
+    if (el) el.hidden = (i !== n);
   }
 }
 
@@ -290,7 +291,7 @@ async function startPolarCheckout() {
     const data = await res.json();
     if (!data.success || !data.url) throw new Error(data.error || 'Failed to create checkout');
 
-    // Redirect to Polar checkout page
+    // Redirect to Polar checkout page (context embedded in success_url by worker)
     window.location.href = data.url;
   } catch (err) {
     errorEl.textContent = err.message;
@@ -365,8 +366,14 @@ function startPolling(github) {
       if (data.status === 'delivered') {
         clearInterval(payState.pollTimer);
         payState.pollTimer = null;
-        document.getElementById('pay-success-user').textContent = github;
-        showPayStep(4);
+        // VN users → Vietnamese success (step 6)
+        const vnUser = document.getElementById('pay-success-user-vn');
+        if (vnUser) vnUser.textContent = github;
+        const vnInstall = document.getElementById('pay-success-install-vn');
+        if (vnInstall && (payState.product === 'rune-biz' || payState.product === 'RUNE-BIZ')) {
+          vnInstall.textContent = 'Bạn nhận cả Pro + Business packs — xem README trong repo';
+        }
+        showPayStep(6);
       } else if (data.status === 'underpaid') {
         document.getElementById('pay-status').innerHTML =
           '<span style="color:var(--loss)">&#9888; Amount too low. Please transfer the exact amount.</span>';
@@ -452,17 +459,37 @@ function startPolling(github) {
 (function checkPolarReturn() {
   const params = new URLSearchParams(window.location.search);
   if (params.get('polar') === 'success') {
+    // Read context from URL (embedded by worker in success_url)
+    const github = params.get('gh') || 'your GitHub account';
+    const product = params.get('pkg') || '';
+
     // Clean URL
     window.history.replaceState({}, '', window.location.pathname);
+
     // Show success message
     const modal = document.getElementById('pay-modal');
     if (modal) {
       modal.hidden = false;
       document.body.style.overflow = 'hidden';
-      document.getElementById('pay-success-user').textContent = 'you';
+      showSuccessForProduct(product, github);
       for (let i = 1; i <= 5; i++) {
         document.getElementById('pay-step-' + i).hidden = (i !== 4);
       }
     }
   }
 })();
+
+// Update success page based on product context
+function showSuccessForProduct(product, github) {
+  const el = document.getElementById('pay-success-user');
+  if (el) el.textContent = github || 'your GitHub account';
+
+  const installEl = document.getElementById('pay-success-install');
+  if (!installEl) return;
+
+  if (product === 'rune-biz' || product === 'RUNE-BIZ') {
+    installEl.textContent = 'You get Pro + Business packs — check the repo README for setup';
+  } else {
+    installEl.textContent = 'Follow the setup guide in the repo README';
+  }
+}

package/docs/style.css

@@ -653,6 +653,68 @@ font[style] > font { vertical-align: unset !important; }
 }
 @keyframes spin { to { transform: rotate(360deg); } }
 .pay-hint { font-size: 12px; color: var(--text-muted); text-align: center; margin-top: 12px; line-height: 1.5; }
+/* Success page */
+.pay-success { text-align: center; }
+
+.pay-success-badge {
+  width: 72px; height: 72px; border-radius: 50%;
+  background: var(--accent-dim); color: var(--accent);
+  display: flex; align-items: center; justify-content: center;
+  margin: 0 auto 20px;
+  animation: successPop 0.4s cubic-bezier(0.34, 1.56, 0.64, 1) both;
+}
+
+.pay-success-circle {
+  stroke-dasharray: 151; stroke-dashoffset: 151;
+  animation: successCircle 0.6s 0.2s ease-out forwards;
+}
+.pay-success-tick {
+  stroke-dasharray: 40; stroke-dashoffset: 40;
+  animation: successTick 0.4s 0.6s ease-out forwards;
+}
+
+@keyframes successPop { 0% { transform: scale(0); opacity: 0; } 100% { transform: scale(1); opacity: 1; } }
+@keyframes successCircle { to { stroke-dashoffset: 0; } }
+@keyframes successTick { to { stroke-dashoffset: 0; } }
+
+.pay-success-title {
+  font-family: var(--font-display); font-size: 26px; font-weight: 700;
+  margin-bottom: 6px; color: var(--text-primary);
+}
+.pay-success-sub {
+  font-size: 14px; color: var(--text-secondary); margin-bottom: 24px;
+}
+
+.pay-success-steps {
+  text-align: left; display: flex; flex-direction: column; gap: 14px;
+  background: var(--accent-dim); border-radius: var(--radius-md);
+  padding: 20px; margin-bottom: 24px;
+}
+.pay-success-step {
+  display: flex; align-items: flex-start; gap: 12px;
+}
+.pay-success-num {
+  flex-shrink: 0; width: 26px; height: 26px; border-radius: 50%;
+  background: var(--accent); color: #fff; font-size: 13px; font-weight: 700;
+  display: flex; align-items: center; justify-content: center;
+  margin-top: 1px;
+}
+.pay-success-step strong {
+  display: block; font-size: 14px; color: var(--text-primary); margin-bottom: 2px;
+}
+.pay-success-step span {
+  font-size: 13px; color: var(--text-secondary); line-height: 1.4;
+}
+
+.pay-success-done {
+  width: 100%; margin-bottom: 12px;
+}
+.pay-success-help {
+  font-size: 12px; color: var(--text-secondary); opacity: 0.7;
+}
+.pay-success-help a { color: var(--accent); }
+
+/* Legacy (keep for backwards compat) */
 .pay-success-icon {
   width: 64px; height: 64px; border-radius: 50%; background: var(--accent);
   color: #fff; font-size: 32px; display: flex; align-items: center; justify-content: center;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@rune-kit/rune",
-  "version": "2.2.6",
-  "description": "58-skill mesh for AI coding assistants — 5-layer architecture, 200+ connections, 8 platforms (Claude Code, Cursor, Windsurf, Antigravity, Codex, OpenCode, OpenClaw, Generic)",
+  "version": "2.3.0",
+  "description": "59-skill mesh for AI coding assistants — 5-layer architecture, 200+ connections, 8 platforms (Claude Code, Cursor, Windsurf, Antigravity, Codex, OpenCode, OpenClaw, Generic)",
   "type": "module",
   "bin": {
     "rune": "./compiler/bin/rune.js"
@@ -9,11 +9,12 @@
   "scripts": {
     "build": "node compiler/bin/rune.js build",
     "doctor": "node compiler/bin/rune.js doctor && node scripts/version-sync-check.js",
-    "test": "node --test compiler/__tests__/*.test.js",
+    "test": "node --test compiler/__tests__/*.test.js scripts/__tests__/*.test.js",
+    "test:coverage": "c8 --reporter=text --reporter=lcov node --test compiler/__tests__/*.test.js scripts/__tests__/*.test.js",
     "lint": "biome check .",
     "lint:fix": "biome check --fix .",
     "format": "biome format --write .",
-    "ci": "biome check . && node --test compiler/__tests__/*.test.js && node compiler/bin/rune.js doctor",
+    "ci": "biome check . && node --test compiler/__tests__/*.test.js scripts/__tests__/*.test.js && node compiler/bin/rune.js doctor",
     "version-check": "node scripts/version-sync-check.js",
     "prepublishOnly": "node scripts/version-sync-check.js"
   },
@@ -57,6 +58,7 @@
     "url": "https://github.com/rune-kit/rune/issues"
   },
   "devDependencies": {
-    "@biomejs/biome": "^2.4.7"
+    "@biomejs/biome": "^2.4.7",
+    "c8": "^10.1.3"
   }
 }

package/skills/adversary/SKILL.md

@@ -266,6 +266,18 @@ Trigger: plan involves auth, crypto, payment, or user data handling.
 - Findings formatted for consumption by cook Phase 3 (if PROCEED) or plan (if REVISE)
 - Strength Notes section acknowledges well-designed aspects of the plan
 
+## Returns
+
+| Artifact | Format | Location |
+|----------|--------|----------|
+| Adversary Report | Markdown | inline (stdout) |
+| Threat findings | Structured list (CRITICAL/HIGH/MEDIUM) | inline |
+| Risk matrix per dimension | Table | inline |
+| Verdict + remediation list | Markdown | inline |
+| Hardened plan notes (if PROCEED) | Text | passed to cook Phase 3 |
+
 ## Cost Profile
 
 ~4000-8000 tokens input (plan + codebase context), ~2000-3000 tokens output. Opus model for adversarial depth. Runs once per feature plan — high cost justified by preventing wasted implementation cycles.
+
+**Scope guardrail:** adversary reviews THE PLAN only — never audits existing codebase quality or rewrites code.

package/skills/audit/SKILL.md

@@ -3,7 +3,7 @@ name: audit
 description: Comprehensive project audit — security, dependencies, code quality, architecture, performance, infra, docs, and mesh analytics. Delegates to specialist skills and generates an 8-dimension health score.
 metadata:
   author: runedev
-  version: "0.1.0"
+  version: "0.3.0"
   layer: L2
   model: sonnet
   group: quality
@@ -56,6 +56,24 @@ Determine:
 
 **Output before proceeding:** Brief project profile, stack summary, and which Framework-Specific Checks will be applied.
 
+### Phase 0.5: Context-Building (Pure Understanding)
+
+<HARD-GATE>
+This phase is FORBIDDEN from producing findings. No BLOCKs, no WARNs, no issues. Context-building only.
+Rushed context = hallucinated vulnerabilities. Slow is fast.
+</HARD-GATE>
+
+For each critical module (entry points, auth, data layer, core business logic):
+1. Read line-by-line. Note at minimum:
+   - **3 invariants**: What MUST always be true for this code to work? (e.g., "user is authenticated before reaching this handler")
+   - **5 assumptions**: What does this code assume about its inputs, environment, and callers?
+   - **3 risks**: What could break if assumptions are violated?
+2. Record findings as context notes — these feed into Phases 1-7, NOT into the final report directly
+
+**Why**: Without this phase, the auditor pattern-matches against known vulnerability lists and hallucinates findings that don't exist in THIS specific codebase. The invariants + assumptions ground all later analysis in reality.
+
+> Source: trailofbits/skills (3.7k★) — mandatory pure context phase before findings.
+
 ---
 
 ### Phase 1: Dependency Audit
@@ -364,6 +382,36 @@ Use `Write` to save `AUDIT-REPORT.md` to the project root with the full findings
 
 Call `rune:journal` to record: audit date, overall health score, verdict, and CRITICAL count.
 
+## Weighted Composite Scoring
+
+Each dimension score feeds into a weighted composite formula that produces a single comparable health score. Use this formula to compute **Overall Health** — not a simple average.
+
+### Scoring Formula
+
+```
+Overall = (Security × 0.25) + (Code Quality × 0.20) + (Architecture × 0.15)
+        + (Dependencies × 0.15) + (Performance × 0.10) + (Infrastructure × 0.08)
+        + (Documentation × 0.07)
+```
+
+Mesh Analytics (Phase 8) is advisory — it contributes 0 to the weighted score but informs the verdict narrative.
+
+### Grade Thresholds
+
+| Score Range | Grade | Verdict | Action |
+|-------------|-------|---------|--------|
+| 90–100 | Excellent | PASS | Routine audit in 3 months |
+| 75–89 | Good | PASS | Address MEDIUM items next sprint |
+| 60–74 | Fair | WARNING | Fix HIGH items within 2 weeks |
+| 40–59 | Poor | FAIL | Fix CRITICAL + HIGH within 1 week |
+| 0–39 | Critical | FAIL | Emergency response — CRITICAL items block all new work |
+
+### Why Weighted (not average)
+
+Security issues cause exponential blast — a 3/10 security score with all other dimensions at 9/10 = overall 72 (Fair), not 8.1 (Good). The formula ensures security and code quality dominate the verdict. Comparable across runs: if Overall moves from 68 → 74 after fixes, the project measurably improved.
+
+> Source: zubair-trabzada/geo-seo-claude (2.7k★) — explicit weighted formula with 5-tier grade thresholds.
+
 ## Severity Levels
 
 ```
@@ -411,6 +459,10 @@ Apply confidence filtering: only report findings with >80% confidence. Consolida
 | Documentation  | [n]    |
 | Mesh Analytics | [n]    |
 
+### Composite Score
+- **Formula**: (Security×0.25) + (Code Quality×0.20) + (Architecture×0.15) + (Dependencies×0.15) + (Performance×0.10) + (Infrastructure×0.08) + (Documentation×0.07)
+- **Weighted Score**: [computed value] → Grade: [Excellent/Good/Fair/Poor/Critical]
+
 ### Top Priority Actions
 1. [action] — [file:line] — [why it matters]
 
@@ -444,6 +496,16 @@ Report saved to: AUDIT-REPORT.md
 | Deps Gate | dependency-doctor report received before assembling final report | Invoke rune:dependency-doctor — do not skip |
 | Report Gate | All 8 phases completed before writing AUDIT-REPORT.md | Complete all phases, note skipped ones |
 
+## Returns
+
+| Artifact | Format | Location |
+|----------|--------|----------|
+| Audit report | Markdown | `AUDIT-REPORT.md` (project root) |
+| 8-dimension health score | Markdown table | `AUDIT-REPORT.md` + inline |
+| Weighted composite score + grade | Markdown | inline + `AUDIT-REPORT.md` |
+| Mesh analytics section | Markdown table | inline + `AUDIT-REPORT.md` |
+| Journal entry | Text | `.rune/adr/` (via `rune:journal`) |
+
 ## Sharp Edges
 
 | Failure Mode | Severity | Mitigation |

package/skills/autopsy/SKILL.md

@@ -195,6 +195,18 @@ Known failure modes for this skill. Check these before declaring done.
 - journal called with health score and surgery queue
 - Autopsy Report emitted with overall health tier and top-3 issues
 
+## Returns
+
+| Artifact | Format | Location |
+|----------|--------|----------|
+| Health score per module | Scored table (0-100) | inline |
+| RESCUE-REPORT.md | Markdown + Mermaid | project root |
+| Surgery queue (priority order) | Ordered list | RESCUE-REPORT.md |
+| Git archaeology findings | Bash output + summary | inline |
+| Journal entry | Text | via `journal` L3 |
+
 ## Cost Profile
 
 ~5000-10000 tokens input, ~2000-4000 tokens output. Opus for deep analysis. Most expensive L2 skill but runs once per rescue.
+
+**Scope guardrail:** autopsy assesses — it does not refactor. All surgery is delegated to `surgeon` after the report is complete.

package/skills/ba/SKILL.md

@@ -311,6 +311,15 @@ Saved to `.rune/features/<feature-name>/requirements.md`
 6. MUST ask ONE question at a time — don't overwhelm user with 5 questions at once
 7. MUST NOT skip BA for non-trivial tasks — "just build it" gets redirected to Question 1
 
+## Returns
+
+| Artifact | Format | Location |
+|----------|--------|----------|
+| Requirements document | Markdown | `.rune/features/<feature-name>/requirements.md` |
+| User stories with acceptance criteria | Markdown (GIVEN/WHEN/THEN) | inline + requirements.md |
+| Scope definition (in/out/assumptions) | Markdown sections | requirements.md |
+| Non-functional requirements table | Markdown table | requirements.md |
+
 ## Sharp Edges
 
 Known failure modes for this skill. Check these before declaring done.

package/skills/brainstorm/SKILL.md

@@ -299,6 +299,15 @@ Choose Option B if [specific hedge condition].
 Proceeding to rune:plan with Option A. Constraints to honor: [list].
 ```
 
+## Returns
+
+| Artifact | Format | Location |
+|----------|--------|----------|
+| Option matrix (2-3 Discovery / 3-5 Rescue) | Markdown sections | inline (chat output) |
+| Trade-off analysis per option | Markdown (pros/cons/effort/risk) | inline |
+| Single recommendation with hedge condition | Markdown | inline |
+| Approved design document | Markdown | `docs/plans/<feature>.md` |
+
 ## Sharp Edges
 
 Known failure modes for this skill. Check these before declaring done.
@@ -326,3 +335,5 @@ Known failure modes for this skill. Check these before declaring done.
 ## Cost Profile
 
 ~2000-5000 tokens input, ~1000-2500 tokens output. Opus for creative reasoning depth. Runs infrequently — only when creative exploration is needed.
+
+**Scope guardrail:** Brainstorm produces options and a recommendation — never implementation code or an execution plan. All code and planning begins only after user approves an approach and `rune:plan` is invoked.

package/skills/completion-gate/SKILL.md

@@ -4,7 +4,7 @@ description: "Validates agent claims against evidence trail. Catches 'done' with
 user-invocable: false
 metadata:
   author: runedev
-  version: "1.5.0"
+  version: "1.6.0"
   layer: L3
   model: haiku
   group: validation
@@ -126,11 +126,24 @@ IF no evidence found:
   → UNCONFIRMED (agent may be right but didn't prove it)
 ```
 
+**3-Axis verification** — categorize each claim into one of three axes, then ensure all axes are covered:
+
+| Axis | Question | Example Claims |
+|------|----------|----------------|
+| **Completeness** | Were all planned tasks done? All specs implemented? | "implemented feature X", "all TODO items done", "migration created" |
+| **Correctness** | Does output match spec intent? Do tests verify real behavior? | "tests pass", "build succeeds", "lint clean", "fixed the bug" |
+| **Coherence** | Does it follow project patterns? Consistent with existing code? | "follows conventions", "uses existing patterns", "no new deps needed" |
+
+If an axis has ZERO claims → flag as gap: "No [Completeness/Correctness/Coherence] evidence found — agent may have skipped this dimension."
+
+> Source: Fission-AI/OpenSpec (32.8k★) — 3-dimensional verification beyond pass/fail.
+
 **Adversarial validation checklist** (run AFTER initial verdicts):
 1. Re-read each CONFIRMED claim — is the evidence actually proving THIS claim, or a different one?
 2. Check for **partial completion** — did the agent do 80% but claim 100%? (e.g., "implemented feature" but only the happy path)
 3. Check for **scope mismatch** — does the evidence prove the SPECIFIC claim or a broader/narrower version?
 4. If all claims are CONFIRMED on first pass, apply **skeptic sweep**: re-examine the weakest 2 claims with heightened scrutiny
+5. Check **axis coverage** — are all 3 axes (Completeness/Correctness/Coherence) represented? Missing axis = investigation gap
 
 ### Step 4 — Report
 
@@ -241,6 +254,7 @@ Completion Gate Report with status (CONFIRMED/UNCONFIRMED/CONTRADICTED), claim v
 - All completion claims extracted from agent output
 - Each claim matched against tool output evidence
 - Verdict table emitted with claim/evidence/verdict for each item
+- All 3 verification axes (Completeness/Correctness/Coherence) have at least one claim checked
 - Overall verdict: CONFIRMED / UNCONFIRMED / CONTRADICTED
 - If not CONFIRMED: specific gaps listed with remediation steps
 

package/skills/context-engine/SKILL.md

@@ -4,7 +4,7 @@ description: "Context window management. Auto-triggered when context is filling
 user-invocable: false
 metadata:
   author: runedev
-  version: "0.4.0"
+  version: "0.6.0"
   layer: L3
   model: haiku
   group: state
@@ -130,6 +130,23 @@ In addition to tool-call counting, monitor context window percentage when availa
 Debounce: emit advisory max once per 5 tool calls to avoid noise.
 Tool-call thresholds (Steps 1-2) remain the primary signal. Percentage advisory is supplementary — use when CLI status bar data is available.
 
+## Iterative Retrieval (Context-Loading Strategy)
+
+When loading context for a task (Phase 1 of cook, or onboard), use a 4-phase retrieval loop instead of loading everything at once:
+
+```
+1. DISPATCH (broad): Search with initial task keywords → get 5-10 candidate files
+2. EVALUATE: Score each file's relevance (0-1). Note codebase-specific terminology discovered
+3. REFINE: Use discovered terms to search again with better keywords
+4. LOOP: Repeat max 3 cycles. STOP when 3 high-relevance files found (not 10 mediocre ones)
+```
+
+**Why**: The first search cycle reveals codebase-specific terms (custom class names, project conventions, internal APIs) that produce much better results in cycle 2. Loading 3 deeply relevant files beats loading 10 surface-level matches.
+
+**Key rule**: Stop at 3 high-relevance files, not 10 mediocre ones. Quality > quantity for context loading.
+
+> Source: affaan-m/everything-claude-code (91.9k★) — 4-phase iterative retrieval.
+
 ## Context Health Levels
 
 ```
@@ -158,6 +175,71 @@ Note: These are tool call counts, NOT token percentages. Claude Code does not ex
 - Blockers: [if any]
 ```
 
+## Strategic Compact Decision Table
+
+When ORANGE or RED is reached, use this table to determine whether compaction is safe at the current boundary:
+
+| Transition | Compact? | Reason |
+|-----------|----------|--------|
+| Research → Planning | YES | Research findings summarize well; key decisions survive |
+| Planning → Implementation | YES | Plan is in files (.rune/plan-*.md); context can reload from artifacts |
+| Debug → Next feature | YES | Debug findings are in Debug Report; fix has the diagnosis |
+| Mid-implementation (Phase 4) | **NO** | Losing file paths, partial changes, and test state is catastrophic |
+| After failed approach → Pivot | YES | Failed approach should be discarded; fresh context helps |
+| Quality (Phase 5) → Verify | **NO** | Quality findings reference specific file:line in current context |
+| After commit (Phase 7) | YES | Work is persisted in git; safe boundary |
+
+**What survives compaction**: Task description, file paths mentioned, key decisions, plan reference, current phase.
+**What is lost**: Full file contents read, intermediate reasoning, exact error messages, tool output details.
+
+> Source: affaan-m/everything-claude-code (91.9k★) — strategic compact timing decision table.
+
+## Context Budget Audit (Baseline Cost Awareness)
+
+MCP tool schemas and agent descriptions consume significant baseline context before any work begins. This section helps identify and reduce invisible context waste.
+
+### Token Cost Reference
+
+| Source | Approx. Cost | Loaded When |
+|--------|-------------|-------------|
+| Each MCP tool schema | ~500 tokens | Session start (always) |
+| Each agent description | ~200-400 tokens | Every `Task()` invocation |
+| CLAUDE.md | ~100-2000 tokens | Session start (always) |
+| Skill SKILL.md (full load) | ~500-3000 tokens | When skill is invoked |
+
+### Budget Rules
+
+| Rule | Threshold | Action |
+|------|-----------|--------|
+| Max MCP servers | <10 active | Disable unused MCP servers in settings |
+| Max MCP tools | <80 total | Remove or consolidate bloated MCP servers |
+| Agent descriptions | Only load needed | Use specific `subagent_type` to avoid loading all descriptions |
+| CLAUDE.md size | <150 lines | Move detailed docs to `.rune/` files, keep CLAUDE.md as index |
+
+### Audit Procedure
+
+When context health is YELLOW or worse, or when onboard detects >80 MCP tools:
+
+1. Count total MCP tool schemas loaded (from session start messages)
+2. Count agent descriptions available
+3. Estimate baseline cost: `(tools × 500) + (agents × 300) + CLAUDE.md tokens`
+4. If baseline >15% of estimated context window → flag as **Context Budget Warning**
+5. Rank MCP servers by tool count — suggest disabling servers with most tools and least usage
+
+### Report Addition
+
+When Context Budget Warning fires, append to Context Health report:
+
+```
+### Context Budget
+- **Baseline cost**: ~[N]k tokens ([X]% of estimated window)
+- **MCP tools loaded**: [count] across [N] servers
+- **Top consumers**: [server1] ([N] tools), [server2] ([N] tools)
+- **Recommendation**: Disable [server] to save ~[N]k tokens
+```
+
+> Source: affaan-m/everything-claude-code (91.9k★) — MCP token cost awareness and budget rules.
+
 ## Constraints
 
 1. MUST preserve context fidelity — no summarizing away critical details