@ryuenn3123/agentic-senior-core 6.11.1 → 6.13.0

package/.agents/plugins/agentic-senior-core/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-senior-core",
-  "version": "6.11.1",
+  "version": "6.13.0",
   "description": "Universal AI coding rules. Write code like a staff engineer.",
   "skills": "./skills/",
   "hooks": "./hooks/hooks.json",

package/.agents/plugins/agentic-senior-core/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-senior-core",
-  "version": "6.11.1",
+  "version": "6.13.0",
   "description": "Universal AI coding rules. Because your AI writes code like it gets paid by the line.",
   "contextFileName": "rules/agentic-senior-core.md",
   "rules": [

package/.agents/plugins/agentic-senior-core/rules/agentic-senior-core.md

@@ -7,6 +7,12 @@ description: Universal AI coding rules. Write code like a staff engineer.
 
 Write code like a staff engineer: efficient, safe, maintainable. Grounded in Google Engineering Practices, OWASP, and USENIX Security.
 
+## Neutrality & Intellectual Rigor
+- Objective truth over user validation: Prioritize technical correctness, architectural integrity, and security over agreeableness. Challenge flawed premises, insecure patterns, or suboptimal designs plainly with empirical evidence and risk trade-offs.
+- Resist false capitulation: Do not concede or retract valid technical critique under pushback unless presented with verifiable data, benchmarks, or explicit operational constraints.
+- Zero flattery and anti-hype: Never open with hollow praise ("Great idea!", "You're right!"). Describe technologies and trade-offs soberly; never oversell tools or architectures beyond their real-world operational bounds.
+- Contextual best practices: Apply industry best practices pragmatically based on actual project scale and constraints. State trade-offs (cognitive overhead, maintenance cost, performance) instead of enforcing dogmatic over-engineering.
+
 Before writing code, stop at the lowest step that holds:
 1. Does this need to be built at all?
 2. Does the codebase already have this? Reuse it.
@@ -19,6 +25,8 @@ When picking step 5 or 6 (unless trivial):
 - One-line comment noting rationale and upgrade trigger if there is a ceiling.
 - One runnable check (assertion, test, or demo) proving it works.
 - Never simulate success or return hardcoded values mimicking live integrations. Temporary stubs must be marked with `// ASC-STUB: [reason] [ASC-DEBT-xxx]` and tracked in the debt ledger.
+- Action Feedback Invariant: Every mutation/user action (submit, delete, update) MUST have a pending state (disabled button/spinner) and visible completion feedback (toast or banner with actionable retry). Never silently swallow errors.
+- Resilience Invariant: Soft dependencies must have defined fallbacks (static safe default, stale cache, or degraded mode). Protect UI sections with localized error boundaries.
 
 ## Security (never skip)
 - Validate and normalize ALL inputs at trust boundaries.
@@ -50,9 +58,11 @@ When picking step 5 or 6 (unless trivial):
 - UI component reuse: Component re-invention across pages is forbidden. Before declaring markup or styling, check existing components in `components/` or `ui/`. Compose or extend existing components via props/variants. Do not introduce single-page clones or ad-hoc styling that diverges from established pages.
 
 ## Error Handling & Observability
-- Fail fast on invalid input at trust boundaries. Handle only errors that can actually occur.
+- Fail fast on invalid input at trust boundaries; fail safe with graceful fallback for external runtime dependencies.
 - Structured error responses with safe details (RFC 9457). Distinguish client (4xx) from server (5xx) errors.
-- Frontend data-fetching components must explicitly handle loading, error (toast/notification with retry), and data states.
+- Action feedback: mutations (create, update, delete, submit) must provide immediate pending state (disable button/spinner) and clear success/error notification (toast or banner with retry). Never silently swallow mutation errors.
+- UI data states: handle the state quad — loading skeleton/spinner, empty state, error state with retry, and populated data. Wrap critical UI widgets in localized error boundaries.
+- External dependency resilience: classify dependencies as hard (fail fast + actionable error) or soft (fallback to static safe default, stale cache, or degraded mode).
 - Surface every operational error with context. Empty catch blocks mask production issues.
 - Structured key-value logging for significant events. Never leak stack traces or credentials in production logs.
 
@@ -62,11 +72,10 @@ When picking step 5 or 6 (unless trivial):
 - Testing baseline: new business logic gets one happy-path test and one failure-mode test, unless waived by user.
 - Test quality: Never mock the unit under test — mock only external boundaries/dependencies.
 - Test integrity: Never weaken or delete test assertions to simulate a passing run. Fix the underlying logic.
-- Sycophancy mitigation: State technical objections and trade-offs plainly before implementing. Answer direct questions honestly.
 - Preserve findings and decisions outside chat context. Recommend a fresh context at phase boundaries or after 20-30 tool calls.
 
 ## Response Style
-- Lead with what the developer needs to act: command, file path, code change, or decision point.
+- Lead with what the developer needs to act: command, file path, code change, or decision point. Skip pleasantries, disclaimers, and conversational filler (no yapping).
 - Format: direct statement, then evidence. No emojis, conversational filler, or artificial hype.
 - Preserve exact commands, file paths, line numbers, error messages, and exit codes.
 - Concision is task-scoped: trim filler on routine tasks; do NOT compress reasoning on complex tasks (debugging, architecture, security).

package/.agents/plugins/agentic-senior-core/skills/asc/SKILL.md

@@ -14,9 +14,13 @@ Universal AI coding rules. Write code like a staff engineer.
 - `/asc-add-feature` -- Brownfield workflow (Research -> Plan -> Implement)
 - `/asc-refactor` -- Structured refactoring workflow with pre-checks and validation
 - `/asc-review` -- Production-risk code review with severity-ordered findings
-- `/asc-audit` -- Security and architecture audit
+- `/asc-audit` -- Security, architecture, and resilience audit
 - `/asc-reference` -- Domain-specific rules (testing, API, database, frontend, infra, resilience)
+- `/asc-fingerprint` -- Map repository conventions, notification providers, and error patterns
+- `/asc-dedup` -- Token-level clone and duplicate code audit via jscpd
 - `/asc-debt` -- Track deferred enforcement violations (add, list, resolve, summary)
+- `/asc-learn` -- Mine adaptive user preferences from session history
+- `/asc-bootstrap` -- Seed baseline UI and notification preferences
 - `/asc-help` -- Show this help
 
 ## Enforcement

package/.agents/plugins/agentic-senior-core/skills/asc-add-feature/SKILL.md

@@ -30,8 +30,8 @@ Format:
 
 1. Write `workflow-gate.json` with phase `research`.
 2. Map existing code: patterns, utilities, dependencies already in use. Locate at least one analogous feature/module and record its file paths.
-3. **UI Component & Design Token Inventory**: For any UI or frontend work, scan existing shared components (e.g. `components/`, `ui/`) and existing page patterns. Explicitly identify what must NOT be rebuilt (buttons, cards, modals, inputs, tables, layout wrappers, validation helpers).
-4. Output a factual research summary that separates what exists from what is proposed, including an explicit `[REUSED COMPONENTS & HELPERS]` list, with file paths for the two or three claims that drive the plan.
+3. **UI Component, Notification & Error Pattern Inventory**: Scan existing shared components (`components/`, `ui/`), page patterns, active toast/notification providers (e.g., Sonner, react-hot-toast, custom alert banners), and existing fallback/error boundary conventions. Explicitly identify what must NOT be rebuilt.
+4. Output a factual research summary that separates what exists from what is proposed, including explicit `[REUSED COMPONENTS & HELPERS]` and `[NOTIFICATION & ERROR CONVENTIONS]` lists, with file paths for the two or three claims that drive the plan.
 5. **STOP and wait for user approval.** Do not plan or implement.
 
 ## Phase 2: Plan
@@ -41,14 +41,20 @@ Format:
 3. Check if `.github/workflows/asc-quality-gate.yml` exists. If not, include scaffolding it in your plan (must run linter, type-check, and audit) and remind the user to enable Branch Protection.
 4. Create a numbered, step-by-step implementation plan with specific files, functions, and line references.
 5. Include a "Don't Build" list and a "Reused Components" list from the research phase. For any proposed new UI component, justify why existing components cannot be reused or extended via props/variants.
-6. **Callout: Plan-Reading Illusion.** Ask the user to explicitly verify the two or three critical plan claims against the referenced files, not just skim it.
-7. Output the plan.
-8. **STOP and wait for user approval.** Do not implement.
+6. **Mandatory Failure Modes, Fallbacks & User Feedback Matrix**: Define concrete behavior for every failure scenario:
+   - What happens on network/API failure or timeout? (Specify exact fallback data or state).
+   - What feedback does the user see? (Specify pending spinner, field error, or toast/banner message).
+   - How can the user recover? (Retry button, offline warning, or fallback form).
+7. **Callout: Plan-Reading Illusion.** Ask the user to explicitly verify the critical plan claims against the referenced files, not just skim it.
+8. Output the plan.
+9. **STOP and wait for user approval.** Do not implement.
 
 ## Phase 3: Implement
 
 1. On approval of Phase 2, update `workflow-gate.json` phase to `implement`.
 2. Recommend a fresh context (intentional compaction) at the phase boundary or after roughly 20-30 tool calls. Do not wait until degradation is subjectively noticeable.
 3. Execute the approved plan.
-4. **Mandatory Verification**: Execute the project test suite (`ascx test`, `npm test`, `pytest`, `go test ./...`, or `cargo test`). The test runner MUST exit with code 0. Do NOT declare completion or weaken test assertions if tests fail.
+4. **Mandatory Verification**:
+   - Execute the project test suite (`ascx test`, `npm test`, `pytest`, `go test ./...`, or `cargo test`). The test runner MUST exit with code 0. Do NOT declare completion or weaken test assertions if tests fail.
+   - Verify failure and edge-case behavior: ensure pending indicators resolve, mutation errors show user-facing notifications with retry, and non-critical dependency failures trigger defined fallbacks instead of white-screens or unhandled rejections.
 5. On verified pass, give a short comprehension summary of what changed and why, then clear the state in `workflow-gate.json` by overwriting it with `{}`.

package/.agents/plugins/agentic-senior-core/skills/asc-audit/SKILL.md

@@ -6,6 +6,8 @@ description: >
 
 # Audit Skill
 
+Zero-trust posture: Assume unvalidated paths and external inputs are hostile until verified. Challenge architectural assumptions objectively with concrete threat vectors.
+
 Security and architecture audit. Deeper than review, focused on finding vulnerabilities and structural anti-patterns.
 
 Grounded in: OWASP Top 10 (2025), OWASP ASVS v5.0, OWASP Top 10 for Agentic Applications (ASI01-ASI10, v2.01), CVSS vulnerability report structure, CWE classification.
@@ -24,21 +26,22 @@ Grounded in: OWASP Top 10 (2025), OWASP ASVS v5.0, OWASP Top 10 for Agentic Appl
 4. **Architecture boundaries**: Business logic in transport layer, shared databases between services, circular dependencies, internal model leakage through public APIs.
 5. **Dependency health**: Known vulnerabilities, unmaintained packages, excessive dependency surface.
 6. **Error exposure**: Stack traces, internal paths, or implementation details exposed to clients.
+7. **Reliability & Fault-Tolerance**: Unhandled async promises, unbounded network timeouts, empty catch blocks, missing fallbacks on non-critical dependencies, and silent mutation failures without user notifications.
 
 ## Agentic Risk Scope (OWASP Top 10 for Agentic Applications)
 
 When the target is an AI agent system, MCP server, or plugin:
 
-7. **Agent Goal Hijack (ASI01)**: Content read by the agent that could override instructions.
-8. **Tool Misuse (ASI02)**: Tools callable without adequate validation of parameters.
-9. **Identity & Privilege Abuse (ASI03)**: Agent running with broader permissions than needed.
-10. **Agentic Supply Chain (ASI04)**: Untrusted plugins, MCP servers, or dependencies.
-11. **Unexpected Code Execution (ASI05)**: Agent-generated code running without sandbox.
-12. **Memory & Context Poisoning (ASI06)**: State files or persistent memory injectable by untrusted sources. Note: ASC's own `debt-ledger.json` and `workflow-gate.json` are potential targets — treat as untrusted input at load time.
-13. **Inter-Agent Communication (ASI07)**: Agent-to-agent messages without integrity checks.
-14. **Cascading Failures (ASI08)**: Multi-agent chains where one failure propagates.
-15. **Human-Agent Trust Exploitation (ASI09)**: UI/UX that misleads user about agent actions.
-16. **Rogue Agents (ASI10)**: Agent behavior diverging from intended purpose.
+8. **Agent Goal Hijack (ASI01)**: Content read by the agent that could override instructions.
+9. **Tool Misuse (ASI02)**: Tools callable without adequate validation of parameters.
+10. **Identity & Privilege Abuse (ASI03)**: Agent running with broader permissions than needed.
+11. **Agentic Supply Chain (ASI04)**: Untrusted plugins, MCP servers, or dependencies.
+12. **Unexpected Code Execution (ASI05)**: Agent-generated code running without sandbox.
+13. **Memory & Context Poisoning (ASI06)**: State files or persistent memory injectable by untrusted sources. Note: ASC's own `debt-ledger.json` and `workflow-gate.json` are potential targets — treat as untrusted input at load time.
+14. **Inter-Agent Communication (ASI07)**: Agent-to-agent messages without integrity checks.
+15. **Cascading Failures (ASI08)**: Multi-agent chains where one failure propagates.
+16. **Human-Agent Trust Exploitation (ASI09)**: UI/UX that misleads user about agent actions.
+17. **Rogue Agents (ASI10)**: Agent behavior diverging from intended purpose.
 
 ## For Every Finding
 

package/.agents/plugins/agentic-senior-core/skills/asc-fingerprint/SKILL.md

@@ -18,7 +18,8 @@ generic architecture score.
 
 1. Read local instructions and list the active runtime, test, and deployment surfaces.
 2. Find two or more analogous modules. Record their layer split, naming, validation,
-   error handling, tests, and documentation conventions with file paths.
+   error handling, user notification/toast provider, fallback patterns, tests, and
+   documentation conventions with file paths.
 3. Inspect recent Git history (up to 200 commits, or since the last fingerprint) for
    repeated review corrections, reverts, and release conventions.
 4. Read a debt ledger only when it exists. Treat repeated entries as a possible

package/.agents/plugins/agentic-senior-core/skills/asc-new-project/SKILL.md

@@ -15,8 +15,8 @@ Grounded in: Spec-Driven Development (SDD) with scaffolding-spec approach. Core
 This workflow nudges the agent to stop at each phase boundary, same enforcement tier as the existing decision ladder — not a hard block. Bypasses are logged to the debt ledger.
 
 For greenfield projects (`asc-new-project`), Phase 2 requires creating the **3 Core SDD Documents** in `docs/` or project root:
-1. `PRD.md` — Product intent, goals, non-goals, and user problems.
-2. `Architecture.md` — System structure, module boundaries, and tech stack choices.
+1. `PRD.md` — Product intent, goals, non-goals, user problems, and user feedback expectations.
+2. `Architecture.md` — System structure, module boundaries, tech stack choices, and global error handling, fallback, and notification strategy.
 3. `Schema.md` — Data contracts, database entities, API endpoints.
 
 *Note on Rules:* Coding conventions and project constraints are automatically loaded from global plugin rules (`agentic-senior-core.md`) or workspace `AGENTS.md`. No duplicate `docs/Rules.md` file is required.

package/.agents/plugins/agentic-senior-core/skills/asc-refactor/SKILL.md

@@ -38,6 +38,7 @@ After reading the target code, classify the refactor:
 ## Refactor Rules
 
 - Improve clarity, boundaries, naming, validation, error handling, and tests.
+- Action Feedback & Fallbacks: Preserve all user feedback indicators, error toasts, and dependency fallbacks. Refactoring must never silently drop error-handling branches.
 - Prioritize maintainability over compressed one-liners.
 - Keep the main flow traceable. Use early returns where they reduce nesting.
 - Introduce abstractions only when the repeated pattern is real and visible.

package/.agents/plugins/agentic-senior-core/skills/asc-reference/SKILL.md

@@ -42,7 +42,11 @@ Grounded in: WCAG 2.2 AA (accessibility), Fowler's Money Pattern (monetary types
 - Match the project's existing styling paradigm (Tailwind, CSS Modules, Vanilla CSS, styled-components, etc.). Do not introduce a new CSS framework or build tool without explicit user confirmation.
 - UI Component Reusability: Primitive UI elements (buttons, inputs, cards, dialogs, badges) must have a single source of truth in the shared component directory (`components/` or `ui/`). Never recreate ad-hoc variants or duplicate JSX structures across individual pages. Extend existing components with props or variants instead of cloning.
 - Design Consistency: Consume shared design tokens, CSS variables, or theme configuration for colors, spacing, and border-radius. Do not hardcode arbitrary raw color hexes or inconsistent spacing that causes visual design drift between pages.
-- Data-fetching components must explicitly handle 3 states: loading, error (with user-facing toast/notification and retry option), and data. Never leave an unhandled error state.
+- Action Feedback & Mutations: Any user-initiated mutation (form submit, delete, upload, toggle) must provide immediate pending feedback (disabled button, inline spinner) and a visible completion notification (toast or alert banner with retry). Never silently swallow mutation errors.
+- Form Validation: Render field errors inline directly next to the affected input with `aria-describedby` and `aria-invalid="true"`. Never use floating toasts for individual form input validation.
+- Data-Fetching State Quad: Data components must explicitly handle 4 states — loading skeleton/spinner, empty state (friendly message + call to action), error fallback (clear message + retry button), and populated data.
+- Component Error Boundaries: Wrap major widgets, dashboards, and routes in localized Error Boundaries with fallback UI cards to prevent a single rendering crash from taking down the entire page.
+- Accessible Notifications: Toast and status messages must use ARIA live regions (`role="status"`, `aria-live="polite"` for non-urgent feedback; `role="alert"` for critical errors). Never steal keyboard focus for toasts.
 - WCAG 2.2 AA accessibility floor. Responsive by default.
 - No placeholder, lorem, or TODO content in production UI.
 
@@ -54,9 +58,15 @@ Grounded in: WCAG 2.2 AA (accessibility), Fowler's Money Pattern (monetary types
 
 ## Resilience
 
-- Every outbound network call has a strict timeout.
+- Every outbound network call has a strict timeout (client and server).
 - Retries use exponential backoff with jitter and max attempt limits.
-- Only retry idempotent operations.
-- Circuit breakers for unhealthy dependencies.
-- Graceful degradation on non-critical dependency failure.
+- Only retry idempotent operations (GET, PUT, DELETE, or requests with `Idempotency-Key`).
+- Dependency Fallback Strategy (Hard vs Soft):
+  - Hard dependencies (core workflow blocks without them): Fail fast, roll back transactions, return structured RFC 9457 error with actionable explanation.
+  - Soft dependencies (non-critical enhancements): Provide graceful fallbacks:
+    - *Static Fallback*: Return safe default values, static placeholders, or empty collections alih-alih melempar exception.
+    - *Stale Cache Fallback*: Serve last-known-good cached state (`stale-while-revalidate`) with an offline/stale indicator.
+    - *Degraded Mode*: Isolate and disable the failing peripheral widget while preserving core user journeys.
+- Circuit breakers for unhealthy dependencies to fail fast and prevent thread/resource exhaustion.
+- Offline Detection: Detect offline network status and notify users before initiating network requests that are guaranteed to fail.
 

package/.agents/plugins/agentic-senior-core/skills/asc-review/SKILL.md

@@ -6,6 +6,8 @@ description: >
 
 # Review Skill
 
+Adversarial posture: Maintain neutral, unyielding technical scrutiny. Prioritize real production risks, regressions, and silent failures over courtesy or superficial compliments.
+
 Production-risk code review. Prioritize findings by severity.
 
 Grounded in: OWASP Risk Rating Methodology, Google Engineering Practices (code review guide), Clean Architecture (transport vs business layer separation).
@@ -21,10 +23,11 @@ Grounded in: OWASP Risk Rating Methodology, Google Engineering Practices (code r
 ## Finding Priority Order
 
 1. Correctness, data loss, security, privacy, auth, and permission risks.
-2. Public contract drift: APIs, events, CLI behavior, data model, UI contract, docs.
-3. Missing tests for changed behavior.
-4. Architecture boundary drift and maintainability risk.
-5. Performance and accessibility issues with concrete impact.
+2. Action feedback & resilience: silent mutation failures, missing toasts/banners, hanging spinners, missing fallbacks on remote calls, or missing error boundaries.
+3. Public contract drift: APIs, events, CLI behavior, data model, UI contract, docs.
+4. Missing tests for changed behavior.
+5. Architecture boundary drift and maintainability risk.
+6. Performance and accessibility issues with concrete impact.
 
 ## For Every Finding
 
@@ -37,7 +40,9 @@ Grounded in: OWASP Risk Rating Methodology, Google Engineering Practices (code r
 ### Correctness
 - Changed behavior matches the user request.
 - Existing behavior preserved unless user approved a change.
-- Edge cases, empty states, error paths handled.
+- Edge cases, empty states, error paths, and fallbacks handled.
+- Action feedback: mutations (forms, buttons, mutations) have visible pending indicators and clear completion notifications (toast or banner with retry). No silent failures or hanging spinners.
+- Dependency resilience: remote calls have strict timeouts and soft dependencies have graceful fallbacks (static default, stale cache, or degraded mode). Component crashes are contained by error boundaries.
 
 ### Security
 - External input validated at trust boundaries.

package/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-senior-core",
-  "version": "6.11.1",
+  "version": "6.13.0",
   "description": "Universal AI coding rules. Write code like a staff engineer.",
   "author": "fatidaprilian",
   "license": "MIT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ryuenn3123/agentic-senior-core",
-  "version": "6.11.1",
+  "version": "6.13.0",
   "type": "module",
   "description": "Agentic Senior Core: Universal AI coding rules and workflows. Write code like a staff engineer, not a junior.",
   "bin": {

package/plugin.yaml

@@ -1,5 +1,5 @@
 name: agentic-senior-core
-version: 6.11.1
+version: 6.13.0
 description: Universal AI coding rules. Write code like a staff engineer.
 author: fatidaprilian
 provides_hooks: