@ryuenn3123/agentic-senior-core 6.13.0 → 6.15.0

package/.agents/plugins/agentic-senior-core/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-senior-core",
-  "version": "6.13.0",
+  "version": "6.15.0",
   "description": "Universal AI coding rules. Write code like a staff engineer.",
   "skills": "./skills/",
   "hooks": "./hooks/hooks.json",

package/.agents/plugins/agentic-senior-core/commands/asc-develop.md

@@ -0,0 +1 @@
+Run the engineering lifecycle workflow from skills/asc-develop/SKILL.md (Greenfield scaffolding, Brownfield features, and Refactoring). Research analogous modules, plan architecture and fallbacks, apply the decision ladder, and verify with tests without creating disk checkpoint files.

package/.agents/plugins/agentic-senior-core/commands/asc-develop.toml

@@ -0,0 +1,3 @@
+description = "Engineering lifecycle for greenfield apps, brownfield features, and refactoring"
+prompt = "Load and follow the asc-develop skill. Research analogous modules, plan architecture and failure fallbacks, apply the decision ladder, and verify with tests without creating disk checkpoint files."
+

package/.agents/plugins/agentic-senior-core/commands/asc-reference.md

@@ -0,0 +1 @@
+Apply domain-specific engineering standards from skills/asc-reference/SKILL.md (RFC API design, database N+1/transactions, isolation testing contracts, infrastructure, and resilience).

package/.agents/plugins/agentic-senior-core/commands/asc-reference.toml

@@ -0,0 +1,3 @@
+description = "Domain reference for APIs, database queries, testing, and resilience"
+prompt = "Load and follow the asc-reference skill. Apply standards for RFC API design, database N+1/transactions, isolation testing contracts, and service resilience."
+

package/.agents/plugins/agentic-senior-core/commands/asc-review.md

@@ -1 +1 @@
-Run the code review workflow from skills/asc-review/SKILL.md on the current diff or specified files. Prioritize findings by severity: correctness and security first, then contracts, tests, architecture, and performance.
+Run the quality and security assurance workflow from skills/asc-review/SKILL.md (Code Review, OWASP Security Audit, and Clone Duplication). Prioritize findings strictly by severity with concrete evidence and remediations.

package/.agents/plugins/agentic-senior-core/commands/asc-review.toml

@@ -1,2 +1,2 @@
-description = "Production-risk code review with severity-ordered findings"
-prompt = "Load and follow the asc-review skill. Review changed files for production risks. Priority order: correctness/data-loss/security, public contract drift, missing tests, architecture boundary drift, performance/accessibility with concrete impact. For every finding include file/line reference, real risk, and smallest safe fix. Report findings ordered by severity."
+description = "Quality, security, and duplication audit"
+prompt = "Load and follow the asc-review skill. Inspect PR/diff changes, audit security trust boundaries (OWASP), and detect code clones. Report findings ordered by severity."

package/.agents/plugins/agentic-senior-core/commands/asc-ui.md

@@ -0,0 +1 @@
+Run the UI/UX engineering and anti-slop guidelines from skills/asc-ui/SKILL.md. Clean up verbose microcopy, eliminate redundant headings/subtitles, enforce single-language purity without awkward foreign loanwords, optimize information density, and implement reliable data states.

package/.agents/plugins/agentic-senior-core/commands/asc-ui.toml

@@ -0,0 +1,3 @@
+description = "UI/UX engineering, microcopy hygiene, and anti-slop design"
+prompt = "Load and follow the asc-ui skill. Inspect the target UI components and layouts. Strip out AI slop: eliminate redundant subtitles repeating headers, cut verbose copy by 50%, remove marketing buzzwords in functional tools, enforce strict single-language consistency without unidiomatic foreign loanwords, replace generic 3-card templates with scannable information density, and ensure proper state quad (loading, empty, error, populated) handling."
+

package/.agents/plugins/agentic-senior-core/commands/asc.md

@@ -0,0 +1 @@
+Show Agentic Senior Core guidelines, fingerprint codebase conventions, manage preferences, and configure tool adapters from skills/asc/SKILL.md.

package/.agents/plugins/agentic-senior-core/commands/asc.toml

@@ -0,0 +1,3 @@
+description = "Agentic Senior Core overview, codebase fingerprinting, and meta-tools"
+prompt = "Load and follow the asc skill. View guidelines, fingerprint codebase conventions, manage preferences, and configure tool adapters."
+

package/.agents/plugins/agentic-senior-core/hooks/lib/known-ui-slop-patterns.json

@@ -44,6 +44,21 @@
       "id": "ui-stripped-focus-ring",
       "regex": "(?:\\boutline-none\\b|\\bfocus:outline-none\\b)(?!.*(?:focus-visible:ring|focus:ring|focus-visible:outline))",
       "message": "warning: 'outline-none' without a focus-visible ring breaks keyboard navigation (WCAG 2.4.7 violation). Pair with focus-visible:ring-2."
+    },
+    {
+      "id": "copy-marketing-buzzwords",
+      "regex": "\\b(seamlessly|effortlessly|empower your|revolutionize your|at your fingertips)\\b",
+      "message": "note: marketing buzzword detected in functional UI copy. Strip conversational filler and speak plainly."
+    },
+    {
+      "id": "code-decorative-banner",
+      "regex": "//\\s*={5,}|//\\s*-{5,}\\s*[A-Z]+",
+      "message": "note: decorative ASCII character banner detected. Keep comments concise, sentence-case, and focused on rationale."
+    },
+    {
+      "id": "code-step-narration",
+      "regex": "//\\s*Step\\s+[0-9]+:\\s*|//\\s*Initialize\\s+(?:the\\s+)?[a-zA-Z0-9_]+",
+      "message": "note: procedural line-by-line comment narration detected. Describe non-obvious intent and constraints instead of restating the obvious code flow."
     }
   ]
 }

package/.agents/plugins/agentic-senior-core/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-senior-core",
-  "version": "6.13.0",
+  "version": "6.15.0",
   "description": "Universal AI coding rules. Because your AI writes code like it gets paid by the line.",
   "contextFileName": "rules/agentic-senior-core.md",
   "rules": [

package/.agents/plugins/agentic-senior-core/rules/agentic-senior-core.md

@@ -25,8 +25,6 @@ When picking step 5 or 6 (unless trivial):
 - One-line comment noting rationale and upgrade trigger if there is a ceiling.
 - One runnable check (assertion, test, or demo) proving it works.
 - Never simulate success or return hardcoded values mimicking live integrations. Temporary stubs must be marked with `// ASC-STUB: [reason] [ASC-DEBT-xxx]` and tracked in the debt ledger.
-- Action Feedback Invariant: Every mutation/user action (submit, delete, update) MUST have a pending state (disabled button/spinner) and visible completion feedback (toast or banner with actionable retry). Never silently swallow errors.
-- Resilience Invariant: Soft dependencies must have defined fallbacks (static safe default, stale cache, or degraded mode). Protect UI sections with localized error boundaries.
 
 ## Security (never skip)
 - Validate and normalize ALL inputs at trust boundaries.
@@ -44,6 +42,8 @@ When picking step 5 or 6 (unless trivial):
 - Early returns over deep nesting (keep happy path flat).
 - Three similar lines is better than a premature abstraction (duplication over wrong abstraction).
 - Single design source of truth: UI styling must reuse defined design tokens, theme variables, or existing page patterns. No ad-hoc palette, radius, or font deviations between pages.
+- UI copy & microcopy hygiene: Functional UI is a tool, not a brochure. Zero conversational filler or marketing buzzwords ("seamless", "empower", "robust"). Never echo heading text in redundant subheadings. Enforce strict single-language consistency without unidiomatic foreign loanwords or hybrid transliterations.
+- Code comment hygiene: Zero decorative character banners (// =====), zero line-by-line narration (// Step 1: validate), zero empty category tags (// Main logic), and zero signature echoes in docstrings. Keep only comments that document non-obvious operational constraints, security boundaries, concurrency hazards, or protocol contracts.
 - Delete code that carries no behavior, safety, or test value. Readability wins over brevity.
 - Detect and respect project linter/formatter configs. Do not restate style rules enforced by tooling.
 
@@ -83,8 +83,7 @@ When picking step 5 or 6 (unless trivial):
 ## Domain References & Skills (On-Demand)
 Detailed domain guidelines are loaded on-demand via skills or scoped rules:
 - **Testing, API Design, Database, Frontend, Infrastructure, Resilience** → run `/asc-reference`
-- **Security & Vulnerability Audit** → run `/asc-audit`
-- **Code Review & Pull Requests** → run `/asc-review`
-- **Refactoring & Code Modernization** → run `/asc-refactor`
-- **Feature Implementation** → run `/asc-add-feature`
-- **New Project Scaffolding** → run `/asc-new-project`
+- **UI/UX Engineering & Anti-Slop Design** → run `/asc-ui`
+- **Engineering Lifecycle & Features** → run `/asc-develop`
+- **Quality, Security & Duplication Audit** → run `/asc-review`
+- **Repository Meta & Configuration** → run `/asc`

package/.agents/plugins/agentic-senior-core/skills/asc/SKILL.md

@@ -1,40 +1,75 @@
 ---
 name: asc
 description: >
-  Trigger this skill when the user says: "what are the rules", "coding guidelines", "best practices", "code quality standards", "how should I write this", "staff engineer approach", "senior developer rules", "what does ASC say about", "how do I write this properly", "what's the right way", "any guidelines for this", "apa aturannya", "panduan koding", "cara tulis yang bener". Also trigger for any general request about coding standards, quality guidelines, or when the user asks the agent to follow senior/staff engineering practices. Do NOT trigger for implementing features, refactoring code, running audits, or writing specific project code directly (use the respective domain skills like asc-add-feature, asc-refactor, or asc-audit instead).
+  Trigger this skill when the user asks: "what are the rules", "coding guidelines", "best practices", "how should I write this", "staff engineer approach", "map this codebase", "document our patterns", "fingerprint this repository", "learn my preferences", "bootstrap preferences", "log this debt", "add to debt ledger", "install ASC", "configure for Cursor", "set up adapter", "apa aturannya", "panduan koding", "petakan codebase", "pasang asc". Covers Core Overview, Codebase Fingerprinting, Adaptive Preferences, Debt Tracking, and IDE Adapters.
 ---
 
-# Agentic Senior Core
+# Agentic Senior Core: Architecture & Meta-Tools (`asc`)
 
-Universal AI coding rules. Write code like a staff engineer.
+Universal AI coding rules and meta-tooling playbook. Grounded in Google Engineering Practices, OWASP, and USENIX Security.
 
-## Available Commands
+---
+
+## 1. The 5 Core Meta-Skills Architecture
+
+Agentic Senior Core organizes operational guidance into 5 high-density, non-overlapping playbooks:
+
+1. **`/asc` (This Skill)**: Core engineering rules, codebase convention fingerprinting, adaptive preferences, debt tracking, and IDE adapter setup.
+2. **`/asc-develop`**: Engineering lifecycle for greenfield scaffolding, brownfield feature implementation, and structured refactoring.
+3. **`/asc-review`**: Quality and security assurance: production PR reviews, deep vulnerability audits (OWASP / ASI), and code clone deduplication.
+4. **`/asc-reference`**: Domain architecture reference for REST/GraphQL APIs, database queries/migrations, testing contracts, infrastructure, and resilience.
+5. **`/asc-ui`**: Human-interface engineering: UI visuals, UX microcopy hygiene, strict single-language localization, mobile reflow (`dvh`/`clamp`), and WCAG 2.2 AA accessibility.
+
+---
+
+## 2. Repository Fingerprinting
+
+Extract this repository's architectural and procedural conventions before undertaking major changes. The goal is evidence-backed alignment with this codebase.
+
+### Procedure
+1. **Map Runtime & Stack**: Inspect package manifests, test runners, and deployment configs.
+2. **Analogous Modules**: Locate at least 2 existing modules. Record their layer splits, naming conventions, validation schemas, error handling, and notification patterns.
+3. **Evidence-Backed Conventions**: Report only falsifiable findings with file and line references. Separate observations from proposals.
+4. **Project Conventions File**: When approved by the user, record project-specific conventions in `CONVENTIONS.md` at the project root. Never overwrite universal ASC rules.
 
-- `/asc-new-project` -- Greenfield workflow (Define -> Spec -> Implement -> Validate)
-- `/asc-add-feature` -- Brownfield workflow (Research -> Plan -> Implement)
-- `/asc-refactor` -- Structured refactoring workflow with pre-checks and validation
-- `/asc-review` -- Production-risk code review with severity-ordered findings
-- `/asc-audit` -- Security, architecture, and resilience audit
-- `/asc-reference` -- Domain-specific rules (testing, API, database, frontend, infra, resilience)
-- `/asc-fingerprint` -- Map repository conventions, notification providers, and error patterns
-- `/asc-dedup` -- Token-level clone and duplicate code audit via jscpd
-- `/asc-debt` -- Track deferred enforcement violations (add, list, resolve, summary)
-- `/asc-learn` -- Mine adaptive user preferences from session history
-- `/asc-bootstrap` -- Seed baseline UI and notification preferences
-- `/asc-help` -- Show this help
+---
+
+## 3. Adaptive Preferences & Baseline Onboarding
+
+Customize AI coding behavior and design preferences dynamically.
 
-## Enforcement
+### Workflow
+- **Elicit Baseline Preferences**: Use `asc bootstrap` to select design slop patterns to ban (e.g. generic gradients, unlinked Inter font, stripped focus rings).
+- **Learn from Corrections**: When a user corrects a styling or architectural choice (e.g. *"never use modals for multi-step flows"*, *"always use date-fns"*), log the rule into `.agents/adaptive_preferences.json` via `addRule()`.
+- **Enforcement**: Project preferences are automatically consulted during code generation and compiled into local git hooks.
+
+---
 
-On plugin-tier hosts (Claude Code, Codex CLI, Copilot CLI), a PostToolUse hook fires after every Edit/Write and checks:
-- New dependencies against stdlib duplicates (decision ladder step 3)
-- LOC delta > 30 lines on edits (step 5)
-- New files > 50 lines (steps 1–2)
-- Workflow gate violations: source/config edits during research or plan phases
+## 4. Technical Debt Ledger
+
+Track deferred quality violations and temporary stubs systematically.
+
+### Ledger Standards
+- When an ASC nudge or quality violation is deferred with user consent, tag the stub in code:
+  `// ASC-STUB: [reason] [ASC-DEBT-xxx]`
+- Record the item in `.agents/debt-ledger.json` with timestamp, file location, severity, and planned remediation.
+- Never let temporary mocks or hardcoded values silently masquerade as completed production integrations.
+
+---
 
-Violations inject a nudge referencing the specific ladder step or workflow phase. The hook is silent when no issues are found. All enforcement is advisory — nudges, not hard blocks.
+## 5. Host Adapters & Setup
 
-## What It Does
+Synchronize ASC rules and skills across all installed AI coding tools.
 
-Loads universal engineering rules on every session: code quality, architecture, security, error handling, testing, API design, database, frontend, infrastructure, resilience, and async patterns.
+### Supported Tools
+- **Native Plugin Hosts (Zero setup)**: Antigravity, Claude Code, Codex CLI, Copilot CLI, OpenCode, Kilo Code.
+- **Adapter Hosts (Single file in project)**: Cursor (`.cursor/rules/agentic-senior-core.mdc`), Windsurf/Devin (`.devin/rules/`), Cline, Continue, Zed, Aider.
 
-Rules apply to any project, stack, language, or framework. No per-project configuration needed.
+### CLI Utility Commands
+```bash
+asc status          # Detect installed AI coding tools
+asc global --all    # Install global rules and smart git hook dispatcher
+asc adapter --all   # Generate workspace adapters for all detected IDEs
+asc adapter --cursor # Generate adapter specifically for Cursor
+asc uninstall       # Clean up adapter files and hooks
+```

package/.agents/plugins/agentic-senior-core/skills/asc-develop/SKILL.md

@@ -0,0 +1,85 @@
+---
+name: asc-develop
+description: >
+  Trigger this skill when the user is: building a new feature, creating an endpoint, adding components, scaffolding a new project, starting from scratch, or refactoring existing code. Trigger when the user says: "add a feature", "build this endpoint", "implement this", "extend this", "wire up", "create a new route", "add a new page", "tambah fitur", "bikin endpoint", "new project", "start from scratch", "scaffold this", "bootstrap app", "bikin project baru", "buat aplikasi baru", "refactor this", "clean up this code", "rewrite this", "extract this into", "simplify this module", "rapikan kode ini", "refactor ini". Handles Greenfield, Brownfield, and Refactoring workflows.
+---
+
+# Engineering Lifecycle Playbook (`asc-develop`)
+
+Universal engineering workflow for greenfield development, feature implementation, and structured refactoring. Enforces strict specification alignment, analog module reuse, and automated validation without cluttering repositories with disk checkpoint files.
+
+Grounded in: Fowler's Refactoring, Spec-Driven Development (SDD), and HumanLayer RPI.
+
+---
+
+## Mode 1: Greenfield (New Project Scaffolding)
+
+Use when creating a new application, service, or repository from zero.
+
+### Step 1: Define & Clarify (No Code)
+1. Clarify essential project requirements with the user: target runtime, platform, frameworks, performance bounds, and explicit non-goals.
+2. Propose the top-level directory layout and module boundaries following idiomatic conventions of the chosen stack.
+3. Present an architectural summary and wait for user alignment before writing files.
+
+### Step 2: Implementation & Decision Ladder
+1. Apply the ASC Decision Ladder to every module:
+   - Does this need to be built?
+   - Can standard library or native platform handle it?
+   - Can this be one straightforward function?
+2. Build the core domain entities, data models, and services first before protocol/transport controllers.
+3. For frontend interfaces, follow the design standards in `/asc-ui`.
+4. Generate a quality gate workflow (e.g., `.github/workflows/quality-gate.yml`) that runs linter, type-check, and tests.
+
+### Step 3: Validation
+1. Verify acceptance criteria against the initial specification.
+2. Confirm no unnecessary dependencies or speculative abstractions were introduced.
+
+---
+
+## Mode 2: Brownfield (Feature Implementation)
+
+Use when adding endpoints, components, pages, or capabilities to an existing codebase.
+
+### Step 1: Research (Codebase & Pattern Inventory)
+1. Map existing code: scan analogous modules to inspect their layer split, naming conventions, error handling, and notification patterns.
+2. **Reuse Inventory**: Identify existing shared components (`components/`, `ui/`), utility functions, and active toast/banner providers. Explicitly decide what must **NOT** be rebuilt.
+3. Present a factual research summary identifying reused components and implementation direction. Stop and confirm before implementing.
+
+### Step 2: Implementation Plan & Fallback Matrix
+1. Define a step-by-step implementation plan with targeted files and functions.
+2. **Failure Modes & Fallback Matrix**: Define concrete behavior for failure scenarios:
+   - What happens on network/API failure or timeout?
+   - What feedback does the user see? (Pending state, inline field error, toast/banner with retry).
+   - How can the system recover? (Retry, cached fallback, degraded mode).
+3. If building UI, ensure compliance with `/asc-ui` (zero marketing fluff, single-language consistency, mobile reflow, WCAG AA contrast).
+
+### Step 3: Implement & Validate
+1. Implement the feature following the approved plan.
+2. **Zero-Fake-Done Testing**: Run the project test suite (`ascx test`, `npm test`, `pytest`, `cargo test`). The test runner **MUST** exit with code 0.
+3. Never weaken or delete test assertions to simulate a passing run. Fix the underlying business logic.
+
+---
+
+## Mode 3: Refactoring (Structure Modernization)
+
+Use when restructuring, simplifying, or modernizing code without changing external behavior.
+
+### Step 1: YAGNI Scan & Baseline Verification
+1. **Verify Baseline**: Run project tests to ensure all existing tests pass before touching code. Do not refactor on broken tests.
+2. **YAGNI Scan**: Identify speculative code to remove:
+   - "Just in case" abstractions wrapping a single implementation with no second consumer.
+   - Dead branches, unused flags, and premature extension points.
+
+### Step 2: Scope & Execution
+1. **Low-Level Refactors** (rename, extract helper, type tightening, dead code removal): Proceed immediately.
+2. **High-Level Refactors** (moving modules, altering architecture boundaries, redesigning contracts): Propose the plan and rationale, then confirm before applying.
+3. Apply Refactor Invariants:
+   - Maintain flat happy paths via early returns over nested `if/else`.
+   - Preserve all user feedback indicators, error notifications, and fallbacks.
+   - Never drop error-handling branches.
+   - Run a final simplification pass.
+
+### Step 3: Verification
+1. Re-run tests to confirm that behavior, public contracts, and error handling remain identical.
+2. For every changed module, confirm that readability, maintainability, and safety have improved.
+

package/.agents/plugins/agentic-senior-core/skills/asc-reference/SKILL.md

@@ -49,6 +49,7 @@ Grounded in: WCAG 2.2 AA (accessibility), Fowler's Money Pattern (monetary types
 - Accessible Notifications: Toast and status messages must use ARIA live regions (`role="status"`, `aria-live="polite"` for non-urgent feedback; `role="alert"` for critical errors). Never steal keyboard focus for toasts.
 - WCAG 2.2 AA accessibility floor. Responsive by default.
 - No placeholder, lorem, or TODO content in production UI.
+- UI/UX Microcopy & Anti-Slop: For comprehensive UX writing, redundancy elimination, single-language localization hygiene, and layout de-sloppification, load the dedicated `/asc-ui` skill (`skills/asc-ui/SKILL.md`).
 
 ## Infrastructure
 
@@ -64,7 +65,7 @@ Grounded in: WCAG 2.2 AA (accessibility), Fowler's Money Pattern (monetary types
 - Dependency Fallback Strategy (Hard vs Soft):
   - Hard dependencies (core workflow blocks without them): Fail fast, roll back transactions, return structured RFC 9457 error with actionable explanation.
   - Soft dependencies (non-critical enhancements): Provide graceful fallbacks:
-    - *Static Fallback*: Return safe default values, static placeholders, or empty collections alih-alih melempar exception.
+    - *Static Fallback*: Return safe default values, static placeholders, or empty collections instead of throwing unhandled exceptions.
     - *Stale Cache Fallback*: Serve last-known-good cached state (`stale-while-revalidate`) with an offline/stale indicator.
     - *Degraded Mode*: Isolate and disable the failing peripheral widget while preserving core user journeys.
 - Circuit breakers for unhealthy dependencies to fail fast and prevent thread/resource exhaustion.

package/.agents/plugins/agentic-senior-core/skills/asc-review/SKILL.md

@@ -1,73 +1,77 @@
 ---
 name: asc-review
 description: >
-  Trigger this skill when the user says: "review this code", "check this PR", "what's wrong with this", "look at my changes", "critique this", "is this production-ready", "review my pull request", "find bugs", "check for issues", "any problems here", "does this look right", "sanity check this", "review PR ini", "cek kodingan saya", "ada masalah ga di kode ini", "tolong review perubahan ini". Also trigger for any request to evaluate code quality, analyze recent commits, or assess production risks in existing code. Also trigger when editing or viewing diff output, PR descriptions, or code review comments. For deep penetration testing, threat modeling, or OWASP compliance audits, use asc-audit instead.
+  Trigger this skill when the user is: reviewing pull requests, checking recent changes, auditing security, scanning for vulnerabilities, threat modeling, or detecting duplicate code. Trigger when the user says: "review this code", "check this PR", "what's wrong with this", "look at my changes", "is this production-ready", "find bugs", "audit this", "security check", "find vulnerabilities", "check for XSS", "check for SQL injection", "OWASP check", "check auth", "find duplicate code", "check for clones", "audit for duplication", "review PR ini", "cek kodingan saya", "cari celah keamanan", "cari kode duplikat". Covers Code Review, Security Audit, and Duplicate Detection.
 ---
 
-# Review Skill
+# Quality & Security Assurance Playbook (`asc-review`)
 
-Adversarial posture: Maintain neutral, unyielding technical scrutiny. Prioritize real production risks, regressions, and silent failures over courtesy or superficial compliments.
+Unified assurance playbook for rigorous code review, deep vulnerability audits, and structural duplication detection. Operates with an adversarial, zero-trust posture: prioritizing production risks, data security, and maintainability over superficial compliments.
 
-Production-risk code review. Prioritize findings by severity.
+Grounded in: OWASP Top 10 (2025), OWASP ASVS v5.0, OWASP Agentic Applications (ASI01-ASI10), Google Engineering Practices, and Fowler's Rule of Three.
 
-Grounded in: OWASP Risk Rating Methodology, Google Engineering Practices (code review guide), Clean Architecture (transport vs business layer separation).
+---
+
+## Mode 1: Production Code Review
 
-## Review Procedure (Empirical First)
+Use when reviewing PRs, diffs, commits, or newly written feature code.
 
-1. **Establish Scope**: Run `git diff --stat` (or `git status`) to inspect the exact set of changed files and line deltas.
-2. **Test-Change Correlation**: For every modified application source file, check if a corresponding test file was updated. If application logic changed without test updates, flag as Severity 3 ("Missing tests for changed behavior").
-3. **Run Deterministic Checks**: Run the project linter and test suite (`ascx test` / `npm test`). Do not evaluate architectural quality on a failing test suite.
-4. **Security & Invariants Scan**: Check for unverified `ASC-STUB:`, hardcoded credentials, or empty catch blocks in the diff.
-5. **Contract & Hierarchy**: Walk the decision ladder for each new file or dependency: does this need to exist, could the stdlib or an existing dependency handle it?
+### Review Procedure
+1. **Scope Inspection**: Run `git diff --stat` (or `git status`) to inspect modified files and line deltas.
+2. **Test-Change Correlation**: For every modified application logic file, verify that a corresponding test was updated. If logic changed without tests, report as a missing test finding.
+3. **Deterministic Verification**: Run project linter and test suite (`ascx test` / `npm test`).
+4. **Severity Priority Order**:
+   - **Severity 1 (Critical)**: Correctness, data corruption, auth/permission bypass, security sinks, PII leakage.
+   - **Severity 2 (High)**: Action feedback failures (hanging spinners, unhandled mutations, missing error boundaries), unhandled async rejections, missing remote timeouts.
+   - **Severity 3 (Medium)**: Public contract drift, missing failure-path tests, architectural boundary violations.
+   - **Severity 4 (Low)**: Maintainability debt, performance micro-optimizations, code comment noise.
 
-## Finding Priority Order
+---
 
-1. Correctness, data loss, security, privacy, auth, and permission risks.
-2. Action feedback & resilience: silent mutation failures, missing toasts/banners, hanging spinners, missing fallbacks on remote calls, or missing error boundaries.
-3. Public contract drift: APIs, events, CLI behavior, data model, UI contract, docs.
-4. Missing tests for changed behavior.
-5. Architecture boundary drift and maintainability risk.
-6. Performance and accessibility issues with concrete impact.
+## Mode 2: Security & Vulnerability Audit
 
-## For Every Finding
+Use when assessing trust boundaries, reviewing auth systems, running threat models, or auditing external dependencies.
 
-- Include file and line reference.
-- Explain the real risk.
-- Propose the smallest safe fix.
+### Security Audit Procedure
+1. **Dependency Audit**: Run native vulnerability scanners (`npm audit`, `cargo audit`, `pip-audit`).
+2. **Lexical Sink & Secret Scan**: Search for hardcoded secrets, dangerous functions (`eval`, `pickle.load`, `shell=True`), unvalidated redirects, and unhandled stubs (`// ASC-STUB:`).
+3. **Trust Boundary Mapping**: Trace all points where external, untrusted input enters the application. Validate that inputs are strictly sanitized, type-checked, and normalized.
 
-## Checklist
+### Security Scope Checklist
+- **Authentication & Authorization**: Verify resource-level access control on every private endpoint, not just session presence.
+- **Injection & XSS**: Verify all database queries are strictly parameterized. Check HTML escaping for user-controlled strings.
+- **SSRF & Network**: Validate outbound URLs; verify service credentials follow least-privilege principles.
+- **Agentic Risk Scope (OWASP Top 10 for Agentic Applications)**:
+  - Agent Goal Hijack (ASI01), Tool Parameter Tampering (ASI02), Identity & Privilege Abuse (ASI03).
+  - Supply Chain & Untrusted Plugins (ASI04), Sandboxing & Execution (ASI05).
+  - Memory & Context Poisoning (ASI06): Treat persistent state as untrusted input.
 
-### Correctness
-- Changed behavior matches the user request.
-- Existing behavior preserved unless user approved a change.
-- Edge cases, empty states, error paths, and fallbacks handled.
-- Action feedback: mutations (forms, buttons, mutations) have visible pending indicators and clear completion notifications (toast or banner with retry). No silent failures or hanging spinners.
-- Dependency resilience: remote calls have strict timeouts and soft dependencies have graceful fallbacks (static default, stale cache, or degraded mode). Component crashes are contained by error boundaries.
+---
 
-### Security
-- External input validated at trust boundaries.
-- Secrets, tokens, credentials not committed or logged.
-- Authorization enforced at a trusted boundary.
-- Error responses keep internal details out of client responses.
-- User-derived URLs are protected against SSRF and user-controlled log values cannot forge or corrupt log entries.
-- New dependencies have verified identity and provenance; plausible package names are not evidence. Confirm git clone targets and plugin/skill install paths against trusted sources (mitigate HalluSquatting).
+## Mode 3: Clone & Code Duplication Audit
 
-### Architecture
-- Layer boundaries clear. Controllers handle protocol translation only; business logic stays in services.
-- Abstractions backed by real duplication, not prediction. Straightforward code over clever solutions.
-- Complexity budget applied: fewer moving parts without losing safety.
-- New code follows a named analogous module in this codebase. Any deviation is explicitly justified.
+Use when evaluating copy-paste repetition or consolidating duplicated logic across a repository.
+
+### Duplication Audit Procedure
+1. **Rule of Three Threshold**: Duplication is permitted up to 2 instances to avoid premature wrong abstractions. Three or more identical or near-identical logic blocks must be flagged for consolidation.
+2. **Scan Tools**: Execute token-level clone audit (e.g., `asc dedup` or `jscpd`) when available.
+3. **Consolidation Guidance**:
+   - Prefer extracting pure, stateless utility functions over creating complex abstract base classes.
+   - Ensure the consolidated helper resides in a shared module matching existing project conventions.
+
+---
 
-### Testing
-- Changed behavior has appropriate tests (baseline: happy path + failure mode).
-- Never mock the unit under test — mock only external boundaries and dependencies.
-- Tests assert behavior and contracts, not implementation trivia.
-- Critical flows include failure-path coverage.
+## Output Format for Findings
 
-### Documentation
-- API, event, CLI, and data contract changes update docs in the same commit.
-- Root README exists and stays current.
+Report findings ordered strictly by severity with file and line references:
 
-## Output
+```
+Severity: Critical | High | Medium | Low
+Category: Correctness | Security | Resilience | Duplication
+Location: path/to/file.ext:line
+Impact: Concrete operational risk or threat vector
+Evidence: Exact code excerpt or test failure
+Remediation: Smallest safe, actionable fix
+```
 
-Report findings ordered by severity with file/line references and concrete fixes. If no findings, say so explicitly and name any residual risk.
+If no issues are found, state so explicitly and summarize the audit coverage.