@ryuenn3123/agentic-senior-core 5.7.0 → 5.8.1

package/.agents/plugins/agentic-senior-core/rules/agentic-senior-core.md

@@ -57,6 +57,13 @@ Before writing any code, stop at the first step that holds:
 
 For domain-specific rules (Testing, API Design, Database, Frontend, Infrastructure, Resilience), use `/asc-reference`.
 
+## Workflow
+
+Starting a project from scratch, or adding a non-trivial feature to an
+existing codebase? Mention `/asc-new-project` or `/asc-add-feature` —
+they set up a research/plan gate before implementation. Let the user
+decide whether to invoke it. Skip this for trivial edits.
+
 ## Response Style
 
 Lead with what the developer needs to act: the command, file path, code change, or decision point. Follow with context only when the action depends on it.

package/.agents/plugins/agentic-senior-core/skills/asc/SKILL.md

@@ -4,6 +4,8 @@ Universal AI coding rules. Write code like a staff engineer.
 
 ## Available Commands
 
+- `/asc-new-project` -- Greenfield workflow (Define -> Spec -> Implement -> Validate)
+- `/asc-add-feature` -- Brownfield workflow (Research -> Plan -> Implement)
 - `/asc-refactor` -- Structured refactoring workflow with pre-checks and validation
 - `/asc-review` -- Production-risk code review with severity-ordered findings
 - `/asc-audit` -- Security and architecture audit
@@ -17,8 +19,9 @@ On plugin-tier hosts (Claude Code, Codex CLI, Copilot CLI), a PostToolUse hook f
 - New dependencies against stdlib duplicates (decision ladder step 3)
 - LOC delta > 30 lines on edits (step 5)
 - New files > 50 lines (steps 1–2)
+- Workflow gate violations: source/config edits during research or plan phases
 
-Violations inject a nudge referencing the specific ladder step. The hook is silent when no issues are found.
+Violations inject a nudge referencing the specific ladder step or workflow phase. The hook is silent when no issues are found. All enforcement is advisory — nudges, not hard blocks.
 
 ## What It Does
 

package/.agents/plugins/agentic-senior-core/skills/asc-add-feature/SKILL.md

@@ -0,0 +1,46 @@
+# Add Feature Workflow
+
+Structured brownfield workflow. Adapted from QRSPI to prevent context rot and ensure alignment before building.
+
+Grounded in: RPI (Dex Horthy, HumanLayer 2025) with corrections from QRSPI 8-stage evolution (Coding Agents Conference, March 2026). Plan-reading illusion fix and instruction budget constraint applied. Stages 2/5/7 adapted; stages 1/3/4/6/8 skipped as too heavyweight for individual-developer workflow.
+
+## Gate Mechanism
+
+This workflow nudges the agent to stop at each phase boundary, same enforcement tier as the existing decision ladder — not a hard block. Bypasses are logged to the debt ledger.
+
+**Known limitation:** Bypass-to-debt-ledger logging is self-reported by the agent, not enforced by the hook. The PostToolUse hook has no MCP access — it nudges the agent to log, but cannot write the debt entry itself.
+
+To track phase, write to `workflow-gate.json` via the `state_write` MCP tool.
+Format:
+```json
+{
+  "workflow": "asc-add-feature",
+  "phase": "<current_phase>",
+  "updatedAt": "<ISO-timestamp>"
+}
+```
+
+## Phase 1: Research (No Code Changes)
+
+1. Write `workflow-gate.json` with phase `research`.
+2. Map existing code: patterns, utilities, dependencies already in use.
+3. Identify what must NOT be rebuilt (e.g., existing validation helpers).
+4. Output a factual research summary.
+5. **STOP and wait for user approval.** Do not plan or implement.
+
+## Phase 2: Plan
+
+1. On approval of Phase 1, update `workflow-gate.json` phase to `plan`.
+2. Create a numbered, step-by-step implementation plan with specific files, functions, and line references.
+3. Include a "Don't Build" list from the research phase.
+4. **Callout: Plan-Reading Illusion.** Ask the user to explicitly verify the plan against the codebase, not just skim it.
+5. Output the plan.
+6. **STOP and wait for user approval.** Do not implement.
+
+## Phase 3: Implement
+
+1. On approval of Phase 2, update `workflow-gate.json` phase to `implement`.
+2. Recommend a fresh context (intentional compaction) if the context window is getting full.
+3. Execute the approved plan.
+4. Validate: tests pass, no duplicate code introduced, plan items checked off.
+5. On completion, clear the state in `workflow-gate.json` by overwriting it with `{}`.

package/.agents/plugins/agentic-senior-core/skills/asc-audit/SKILL.md

@@ -2,6 +2,8 @@
 
 Security and architecture audit. Deeper than review, focused on finding vulnerabilities and structural anti-patterns.
 
+Grounded in: OWASP Top 10 (2021), OWASP ASVS v4, CVSS vulnerability report structure, CWE classification.
+
 ## Audit Scope
 
 1. **Trust boundaries**: Every point where external input enters the system. Validate that inputs are sanitized, normalized, and rejected when invalid.

package/.agents/plugins/agentic-senior-core/skills/asc-debt/SKILL.md

@@ -2,6 +2,8 @@
 
 Track deferred enforcement violations. When an ASC ladder nudge fires and the shortcut is accepted rather than fixed, log it here for later resolution.
 
+Grounded in: Cunningham's technical debt metaphor (1992). Entry format (ladder step + violation + status lifecycle) is an ASC-specific implementation.
+
 ## Storage
 
 Entries persist in `.agent-context/state/debt-ledger.json` via MCP `state_read`/`state_write`. The ledger is a JSON array of entry objects.

package/.agents/plugins/agentic-senior-core/skills/asc-new-project/SKILL.md

@@ -0,0 +1,49 @@
+# New Project Workflow
+
+Structured greenfield workflow. Prevents building before alignment on what to build.
+
+Grounded in: Spec-Driven Development (SDD) with scaffolding-spec approach. Specs guide implementation, then the code becomes the source of truth — specs are not maintained as living documents unless the team explicitly opts in.
+
+## Gate Mechanism
+
+This workflow nudges the agent to stop at each phase boundary, same enforcement tier as the existing decision ladder — not a hard block. Bypasses are logged to the debt ledger.
+
+**Known limitation:** Bypass-to-debt-ledger logging is self-reported by the agent, not enforced by the hook. The PostToolUse hook has no MCP access — it nudges the agent to log, but cannot write the debt entry itself.
+
+To track phase, write to `workflow-gate.json` via the `state_write` MCP tool.
+Format:
+```json
+{
+  "workflow": "asc-new-project",
+  "phase": "<current_phase>",
+  "updatedAt": "<ISO-timestamp>"
+}
+```
+
+## Phase 1: Define (No Code)
+
+1. Write `workflow-gate.json` with phase `research`.
+2. Clarify with the user: tech stack, target platform, constraints, non-goals.
+3. Propose a directory structure and module boundaries.
+4. Output a project brief summarizing decisions.
+5. **STOP and wait for user approval.** Do not write specs or code.
+
+## Phase 2: Spec (No Implementation Code)
+
+1. On approval of Phase 1, update `workflow-gate.json` phase to `plan`.
+2. Write per-feature specs with acceptance criteria and edge cases.
+3. Specs are scaffolding — they guide the build, then the code is the source of truth.
+4. Output specs for review.
+5. **STOP and wait for user approval.** Do not implement.
+
+## Phase 3: Implement
+
+1. On approval of Phase 2, update `workflow-gate.json` phase to `implement`.
+2. Build against the approved specs. Apply the ASC decision ladder on every file.
+3. Run the decision ladder: does this need to exist? Does stdlib cover it? One function or full module?
+
+## Phase 4: Validate
+
+1. Run tests. Check each spec's acceptance criteria.
+2. Confirm nothing was over-built beyond what the specs required.
+3. On completion, clear the state in `workflow-gate.json` by overwriting it with `{}`.

package/.agents/plugins/agentic-senior-core/skills/asc-refactor/SKILL.md

@@ -2,12 +2,33 @@
 
 Structured refactoring workflow. Preserves existing behavior while improving structure.
 
+Grounded in: Fowler's Refactoring (read-understand-smallest scope-preserve behavior), Rule of Three (abstraction threshold), YAGNI principle (XP/Kent Beck). Empirical evidence: agents dominate low-level refactors (rename, extract, type changes) but struggle with multi-file architectural changes (arXiv, 15k+ instance study).
+
+## YAGNI Scan (Before Any Restructuring)
+
+Before changing structure, scan for speculative code to remove:
+- "Just in case" logic, unused feature flags, dead branches behind config toggles.
+- Abstractions wrapping a single implementation with no second consumer.
+- Premature extension points (plugin hooks, strategy patterns) with one concrete path.
+
+Removing speculative code is the highest-value, lowest-risk refactor type.
+
+## Classify Before Proceeding
+
+After reading the target code, classify the refactor:
+
+- **Low-level** (rename, extract method, type safety, dead code removal): proceed after explaining the change. No approval gate needed.
+- **High-level** (move module, change architecture, redesign abstractions, multi-file structural changes): output a plan with specific files and rationale, then **stop and wait for user approval** before implementing.
+
+**Known limitation:** The high-level refactor gate is a skill-text instruction — the agent self-classifies and self-stops. Unlike `/asc-add-feature` and `/asc-new-project`, this gate is not backed by the PostToolUse hook or workflow-gate.json. If the agent bypasses the gate, there is no automated nudge.
+
 ## Before Editing
 
 1. Read the target code and understand existing patterns.
 2. Identify the smallest relevant scope for the refactor.
-3. If the change touches UI, check accessibility and responsive behavior.
-4. If the change touches dependencies, verify current official docs.
+3. Classify the refactor (see above). If high-level, stop and present a plan.
+4. If the change touches UI, check accessibility and responsive behavior.
+5. If the change touches dependencies, verify current official docs.
 
 ## Refactor Rules
 

package/.agents/plugins/agentic-senior-core/skills/asc-reference/SKILL.md

@@ -2,6 +2,8 @@
 
 Domain-specific coding rules for testing, API design, database queries, frontend components, infrastructure configs, and service resilience. Load this skill when working on any of these domains.
 
+Grounded in: WCAG 2.2 AA (accessibility), Fowler's Money Pattern (monetary types), Nygard's Release It! (resilience patterns), AWS Well-Architected Reliability Pillar (backoff/circuit breakers), OWASP Secure Coding Practices (input validation, logging).
+
 ## Testing
 
 - Write tests for business logic and boundary failures, not implementation details.

package/.agents/plugins/agentic-senior-core/skills/asc-review/SKILL.md

@@ -2,6 +2,8 @@
 
 Production-risk code review. Prioritize findings by severity.
 
+Grounded in: OWASP Risk Rating Methodology, Google Engineering Practices (code review guide), Clean Architecture (transport vs business layer separation).
+
 ## Before Reviewing
 
 1. Read the changed files and understand the scope.

package/.agents/rules/agentic-senior-core.md

@@ -57,6 +57,13 @@ Before writing any code, stop at the first step that holds:
 
 For domain-specific rules (Testing, API Design, Database, Frontend, Infrastructure, Resilience), use `/asc-reference`.
 
+## Workflow
+
+Starting a project from scratch, or adding a non-trivial feature to an
+existing codebase? Mention `/asc-new-project` or `/asc-add-feature` —
+they set up a research/plan gate before implementation. Let the user
+decide whether to invoke it. Skip this for trivial edits.
+
 ## Response Style
 
 Lead with what the developer needs to act: the command, file path, code change, or decision point. Follow with context only when the action depends on it.

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-senior-core",
-  "version": "5.7.0",
+  "version": "5.8.1",
   "displayName": "Agentic Senior Core",
   "description": "Universal AI coding rules. Write code like a staff engineer.",
   "author": {

package/.clinerules/agentic-senior-core.md

@@ -86,6 +86,13 @@ Before writing any code, stop at the first step that holds:
 - Retries use exponential backoff with jitter. Only retry idempotent operations.
 - Circuit breakers for unhealthy dependencies.
 
+## Workflow
+
+Starting a project from scratch, or adding a non-trivial feature to an
+existing codebase? Mention `/asc-new-project` or `/asc-add-feature` —
+they set up a research/plan gate before implementation. Let the user
+decide whether to invoke it. Skip this for trivial edits.
+
 ## Response Style
 
 Lead with what the developer needs to act: the command, file path, code change, or decision point. Format: direct statement, then evidence. Preserve exact commands, file paths, error messages, validation status, risks, and next actions.

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-senior-core",
-  "version": "5.7.0",
+  "version": "5.8.1",
   "description": "Universal AI coding rules. Write code like a staff engineer.",
   "author": {
     "name": "fatidaprilian",

package/.continue/rules/agentic-senior-core.md

@@ -86,6 +86,13 @@ Before writing any code, stop at the first step that holds:
 - Retries use exponential backoff with jitter. Only retry idempotent operations.
 - Circuit breakers for unhealthy dependencies.
 
+## Workflow
+
+Starting a project from scratch, or adding a non-trivial feature to an
+existing codebase? Mention `/asc-new-project` or `/asc-add-feature` —
+they set up a research/plan gate before implementation. Let the user
+decide whether to invoke it. Skip this for trivial edits.
+
 ## Response Style
 
 Lead with what the developer needs to act: the command, file path, code change, or decision point. Format: direct statement, then evidence. Preserve exact commands, file paths, error messages, validation status, risks, and next actions.

package/.cursor/rules/agentic-senior-core.mdc

@@ -91,6 +91,13 @@ Before writing any code, stop at the first step that holds:
 - Retries use exponential backoff with jitter. Only retry idempotent operations.
 - Circuit breakers for unhealthy dependencies.
 
+## Workflow
+
+Starting a project from scratch, or adding a non-trivial feature to an
+existing codebase? Mention `/asc-new-project` or `/asc-add-feature` —
+they set up a research/plan gate before implementation. Let the user
+decide whether to invoke it. Skip this for trivial edits.
+
 ## Response Style
 
 Lead with what the developer needs to act: the command, file path, code change, or decision point. Format: direct statement, then evidence. Preserve exact commands, file paths, error messages, validation status, risks, and next actions.

package/.devin/rules/agentic-senior-core.md

@@ -86,6 +86,13 @@ Before writing any code, stop at the first step that holds:
 - Retries use exponential backoff with jitter. Only retry idempotent operations.
 - Circuit breakers for unhealthy dependencies.
 
+## Workflow
+
+Starting a project from scratch, or adding a non-trivial feature to an
+existing codebase? Mention `/asc-new-project` or `/asc-add-feature` —
+they set up a research/plan gate before implementation. Let the user
+decide whether to invoke it. Skip this for trivial edits.
+
 ## Response Style
 
 Lead with what the developer needs to act: the command, file path, code change, or decision point. Format: direct statement, then evidence. Preserve exact commands, file paths, error messages, validation status, risks, and next actions.

package/.devin-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-senior-core",
-  "version": "5.7.0",
+  "version": "5.8.1",
   "description": "Universal AI coding rules. Write code like a staff engineer.",
   "author": {
     "name": "fatidaprilian",

package/.github/copilot-instructions.md

@@ -86,6 +86,13 @@ Before writing any code, stop at the first step that holds:
 - Retries use exponential backoff with jitter. Only retry idempotent operations.
 - Circuit breakers for unhealthy dependencies.
 
+## Workflow
+
+Starting a project from scratch, or adding a non-trivial feature to an
+existing codebase? Mention `/asc-new-project` or `/asc-add-feature` —
+they set up a research/plan gate before implementation. Let the user
+decide whether to invoke it. Skip this for trivial edits.
+
 ## Response Style
 
 Lead with what the developer needs to act: the command, file path, code change, or decision point. Format: direct statement, then evidence. Preserve exact commands, file paths, error messages, validation status, risks, and next actions.

package/.github/plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "agentic-senior-core",
   "description": "Universal AI coding rules. Write code like a staff engineer.",
-  "version": "5.7.0",
+  "version": "5.8.1",
   "author": {
     "name": "fatidaprilian",
     "url": "https://github.com/fatidaprilian"

package/.kilocode/rules/agentic-senior-core.md

@@ -86,6 +86,13 @@ Before writing any code, stop at the first step that holds:
 - Retries use exponential backoff with jitter. Only retry idempotent operations.
 - Circuit breakers for unhealthy dependencies.
 
+## Workflow
+
+Starting a project from scratch, or adding a non-trivial feature to an
+existing codebase? Mention `/asc-new-project` or `/asc-add-feature` —
+they set up a research/plan gate before implementation. Let the user
+decide whether to invoke it. Skip this for trivial edits.
+
 ## Response Style
 
 Lead with what the developer needs to act: the command, file path, code change, or decision point. Format: direct statement, then evidence. Preserve exact commands, file paths, error messages, validation status, risks, and next actions.

package/.kiro/steering/agentic-senior-core.md

@@ -86,6 +86,13 @@ Before writing any code, stop at the first step that holds:
 - Retries use exponential backoff with jitter. Only retry idempotent operations.
 - Circuit breakers for unhealthy dependencies.
 
+## Workflow
+
+Starting a project from scratch, or adding a non-trivial feature to an
+existing codebase? Mention `/asc-new-project` or `/asc-add-feature` —
+they set up a research/plan gate before implementation. Let the user
+decide whether to invoke it. Skip this for trivial edits.
+
 ## Response Style
 
 Lead with what the developer needs to act: the command, file path, code change, or decision point. Format: direct statement, then evidence. Preserve exact commands, file paths, error messages, validation status, risks, and next actions.

package/.openclaw/skills/asc/SKILL.md

@@ -1,16 +1,11 @@
----
-name: asc
-description: "Universal AI coding rules. Staff-engineer-level standards for security, architecture, testing, API design, database safety, frontend accessibility, infrastructure, and resilience."
-homepage: https://github.com/fatidaprilian/Agentic-Senior-Core
-license: MIT
----
-
 # Agentic Senior Core
 
 Universal AI coding rules. Write code like a staff engineer.
 
 ## Available Commands
 
+- `/asc-new-project` -- Greenfield workflow (Define -> Spec -> Implement -> Validate)
+- `/asc-add-feature` -- Brownfield workflow (Research -> Plan -> Implement)
 - `/asc-refactor` -- Structured refactoring workflow with pre-checks and validation
 - `/asc-review` -- Production-risk code review with severity-ordered findings
 - `/asc-audit` -- Security and architecture audit
@@ -24,8 +19,9 @@ On plugin-tier hosts (Claude Code, Codex CLI, Copilot CLI), a PostToolUse hook f
 - New dependencies against stdlib duplicates (decision ladder step 3)
 - LOC delta > 30 lines on edits (step 5)
 - New files > 50 lines (steps 1–2)
+- Workflow gate violations: source/config edits during research or plan phases
 
-Violations inject a nudge referencing the specific ladder step. The hook is silent when no issues are found.
+Violations inject a nudge referencing the specific ladder step or workflow phase. The hook is silent when no issues are found. All enforcement is advisory — nudges, not hard blocks.
 
 ## What It Does
 

package/.openclaw/skills/asc-adapter/SKILL.md

@@ -0,0 +1,37 @@
+# ASC Adapter
+
+Detect installed AI coding hosts and generate adapter files for the current project.
+
+## When to use
+
+Run this when setting up a new project or when a developer wants ASC rules active across all their AI coding tools.
+
+## Steps
+
+1. Run `asc status` to detect which AI coding hosts are installed on this system.
+2. Check which adapter files already exist in the current project directory.
+3. For any detected host that is missing an adapter, run `asc adapter --<host>` to generate it.
+4. Use `asc adapter --all` to generate adapters for all supported hosts at once.
+
+## Supported hosts
+
+Plugin hosts (always-on, no adapter needed): Claude Code, Codex CLI, Gemini CLI, Antigravity CLI, Copilot CLI, Devin CLI, Hermes, OpenCode, OpenClaw.
+
+Adapter hosts (one file per project): Cursor, Devin Desktop, Cline, GitHub Copilot, Kiro, Continue, Zed, Aider, Kilo Code, Roo Code, OpenHands.
+
+## Commands
+
+```bash
+asc status                # Show detected hosts
+asc adapter --all         # Generate all adapters
+asc adapter --cursor      # Generate for specific host
+asc uninstall             # Remove all ASC adapter files
+asc uninstall --dry-run   # Preview what would be removed
+```
+
+## Notes
+
+- Adapter files contain the ASC universal coding rules, compressed to fit within each host's size limits.
+- Cursor uses `.mdc` format with `alwaysApply: true` frontmatter.
+- Windsurf is now Devin Desktop. Use `--devin` for the preferred path, `--windsurf` for legacy.
+- Zed also reads `AGENTS.md` natively, so the adapter is optional.

package/.openclaw/skills/asc-add-feature/SKILL.md

@@ -0,0 +1,46 @@
+# Add Feature Workflow
+
+Structured brownfield workflow. Adapted from QRSPI to prevent context rot and ensure alignment before building.
+
+Grounded in: RPI (Dex Horthy, HumanLayer 2025) with corrections from QRSPI 8-stage evolution (Coding Agents Conference, March 2026). Plan-reading illusion fix and instruction budget constraint applied. Stages 2/5/7 adapted; stages 1/3/4/6/8 skipped as too heavyweight for individual-developer workflow.
+
+## Gate Mechanism
+
+This workflow nudges the agent to stop at each phase boundary, same enforcement tier as the existing decision ladder — not a hard block. Bypasses are logged to the debt ledger.
+
+**Known limitation:** Bypass-to-debt-ledger logging is self-reported by the agent, not enforced by the hook. The PostToolUse hook has no MCP access — it nudges the agent to log, but cannot write the debt entry itself.
+
+To track phase, write to `workflow-gate.json` via the `state_write` MCP tool.
+Format:
+```json
+{
+  "workflow": "asc-add-feature",
+  "phase": "<current_phase>",
+  "updatedAt": "<ISO-timestamp>"
+}
+```
+
+## Phase 1: Research (No Code Changes)
+
+1. Write `workflow-gate.json` with phase `research`.
+2. Map existing code: patterns, utilities, dependencies already in use.
+3. Identify what must NOT be rebuilt (e.g., existing validation helpers).
+4. Output a factual research summary.
+5. **STOP and wait for user approval.** Do not plan or implement.
+
+## Phase 2: Plan
+
+1. On approval of Phase 1, update `workflow-gate.json` phase to `plan`.
+2. Create a numbered, step-by-step implementation plan with specific files, functions, and line references.
+3. Include a "Don't Build" list from the research phase.
+4. **Callout: Plan-Reading Illusion.** Ask the user to explicitly verify the plan against the codebase, not just skim it.
+5. Output the plan.
+6. **STOP and wait for user approval.** Do not implement.
+
+## Phase 3: Implement
+
+1. On approval of Phase 2, update `workflow-gate.json` phase to `implement`.
+2. Recommend a fresh context (intentional compaction) if the context window is getting full.
+3. Execute the approved plan.
+4. Validate: tests pass, no duplicate code introduced, plan items checked off.
+5. On completion, clear the state in `workflow-gate.json` by overwriting it with `{}`.

package/.openclaw/skills/asc-audit/SKILL.md

@@ -2,6 +2,8 @@
 
 Security and architecture audit. Deeper than review, focused on finding vulnerabilities and structural anti-patterns.
 
+Grounded in: OWASP Top 10 (2021), OWASP ASVS v4, CVSS vulnerability report structure, CWE classification.
+
 ## Audit Scope
 
 1. **Trust boundaries**: Every point where external input enters the system. Validate that inputs are sanitized, normalized, and rejected when invalid.

package/.openclaw/skills/asc-debt/SKILL.md

@@ -1,14 +1,9 @@
----
-name: asc-debt
-description: "Track deferred enforcement violations. Log, list, resolve, and summarize shortcuts deferred during ASC ladder enforcement."
-homepage: https://github.com/fatidaprilian/Agentic-Senior-Core
-license: MIT
----
-
 # Debt Ledger
 
 Track deferred enforcement violations. When an ASC ladder nudge fires and the shortcut is accepted rather than fixed, log it here for later resolution.
 
+Grounded in: Cunningham's technical debt metaphor (1992). Entry format (ladder step + violation + status lifecycle) is an ASC-specific implementation.
+
 ## Storage
 
 Entries persist in `.agent-context/state/debt-ledger.json` via MCP `state_read`/`state_write`. The ledger is a JSON array of entry objects.

package/.openclaw/skills/asc-new-project/SKILL.md

@@ -0,0 +1,49 @@
+# New Project Workflow
+
+Structured greenfield workflow. Prevents building before alignment on what to build.
+
+Grounded in: Spec-Driven Development (SDD) with scaffolding-spec approach. Specs guide implementation, then the code becomes the source of truth — specs are not maintained as living documents unless the team explicitly opts in.
+
+## Gate Mechanism
+
+This workflow nudges the agent to stop at each phase boundary, same enforcement tier as the existing decision ladder — not a hard block. Bypasses are logged to the debt ledger.
+
+**Known limitation:** Bypass-to-debt-ledger logging is self-reported by the agent, not enforced by the hook. The PostToolUse hook has no MCP access — it nudges the agent to log, but cannot write the debt entry itself.
+
+To track phase, write to `workflow-gate.json` via the `state_write` MCP tool.
+Format:
+```json
+{
+  "workflow": "asc-new-project",
+  "phase": "<current_phase>",
+  "updatedAt": "<ISO-timestamp>"
+}
+```
+
+## Phase 1: Define (No Code)
+
+1. Write `workflow-gate.json` with phase `research`.
+2. Clarify with the user: tech stack, target platform, constraints, non-goals.
+3. Propose a directory structure and module boundaries.
+4. Output a project brief summarizing decisions.
+5. **STOP and wait for user approval.** Do not write specs or code.
+
+## Phase 2: Spec (No Implementation Code)
+
+1. On approval of Phase 1, update `workflow-gate.json` phase to `plan`.
+2. Write per-feature specs with acceptance criteria and edge cases.
+3. Specs are scaffolding — they guide the build, then the code is the source of truth.
+4. Output specs for review.
+5. **STOP and wait for user approval.** Do not implement.
+
+## Phase 3: Implement
+
+1. On approval of Phase 2, update `workflow-gate.json` phase to `implement`.
+2. Build against the approved specs. Apply the ASC decision ladder on every file.
+3. Run the decision ladder: does this need to exist? Does stdlib cover it? One function or full module?
+
+## Phase 4: Validate
+
+1. Run tests. Check each spec's acceptance criteria.
+2. Confirm nothing was over-built beyond what the specs required.
+3. On completion, clear the state in `workflow-gate.json` by overwriting it with `{}`.

package/.openclaw/skills/asc-refactor/SKILL.md

@@ -0,0 +1,56 @@
+# Refactor Skill
+
+Structured refactoring workflow. Preserves existing behavior while improving structure.
+
+Grounded in: Fowler's Refactoring (read-understand-smallest scope-preserve behavior), Rule of Three (abstraction threshold), YAGNI principle (XP/Kent Beck). Empirical evidence: agents dominate low-level refactors (rename, extract, type changes) but struggle with multi-file architectural changes (arXiv, 15k+ instance study).
+
+## YAGNI Scan (Before Any Restructuring)
+
+Before changing structure, scan for speculative code to remove:
+- "Just in case" logic, unused feature flags, dead branches behind config toggles.
+- Abstractions wrapping a single implementation with no second consumer.
+- Premature extension points (plugin hooks, strategy patterns) with one concrete path.
+
+Removing speculative code is the highest-value, lowest-risk refactor type.
+
+## Classify Before Proceeding
+
+After reading the target code, classify the refactor:
+
+- **Low-level** (rename, extract method, type safety, dead code removal): proceed after explaining the change. No approval gate needed.
+- **High-level** (move module, change architecture, redesign abstractions, multi-file structural changes): output a plan with specific files and rationale, then **stop and wait for user approval** before implementing.
+
+**Known limitation:** The high-level refactor gate is a skill-text instruction — the agent self-classifies and self-stops. Unlike `/asc-add-feature` and `/asc-new-project`, this gate is not backed by the PostToolUse hook or workflow-gate.json. If the agent bypasses the gate, there is no automated nudge.
+
+## Before Editing
+
+1. Read the target code and understand existing patterns.
+2. Identify the smallest relevant scope for the refactor.
+3. Classify the refactor (see above). If high-level, stop and present a plan.
+4. If the change touches UI, check accessibility and responsive behavior.
+5. If the change touches dependencies, verify current official docs.
+
+## Refactor Rules
+
+- Improve clarity, boundaries, naming, validation, error handling, and tests.
+- Prioritize maintainability over compressed one-liners.
+- Keep the main flow traceable. Use early returns where they reduce nesting.
+- Introduce abstractions only when the repeated pattern is real and visible.
+- Split large files when the split makes the flow easier to understand.
+- Remove code that does not carry behavior, safety, clarity, maintainability, or test value.
+- Prefer the shorter implementation only when it keeps the same guarantees.
+- Run a final simplification pass before completion.
+- Update tests and docs whenever behavior contracts, public APIs, data shape, or UI contracts change.
+
+## For Every Change, Explain
+
+- What risk or friction existed.
+- What changed.
+- Why the new shape is safer or easier to maintain.
+
+## Validation
+
+- Existing behavior is preserved unless the user approved a change.
+- Edge cases, empty states, error paths, and rollback paths are handled.
+- Public contracts remain stable or are versioned.
+- Tests pass.

package/.openclaw/skills/asc-reference/SKILL.md

@@ -1,14 +1,9 @@
----
-name: asc-reference
-description: "Domain-specific coding rules for testing, API design, database queries, frontend components, infrastructure configs, and service resilience."
-homepage: https://github.com/fatidaprilian/Agentic-Senior-Core
-license: MIT
----
-
 # ASC Domain Reference
 
 Domain-specific coding rules for testing, API design, database queries, frontend components, infrastructure configs, and service resilience. Load this skill when working on any of these domains.
 
+Grounded in: WCAG 2.2 AA (accessibility), Fowler's Money Pattern (monetary types), Nygard's Release It! (resilience patterns), AWS Well-Architected Reliability Pillar (backoff/circuit breakers), OWASP Secure Coding Practices (input validation, logging).
+
 ## Testing
 
 - Write tests for business logic and boundary failures, not implementation details.

package/.openclaw/skills/asc-review/SKILL.md

@@ -2,6 +2,8 @@
 
 Production-risk code review. Prioritize findings by severity.
 
+Grounded in: OWASP Risk Rating Methodology, Google Engineering Practices (code review guide), Clean Architecture (transport vs business layer separation).
+
 ## Before Reviewing
 
 1. Read the changed files and understand the scope.