@ryuenn3123/agentic-senior-core 6.15.0 → 6.16.0

package/.agents/plugins/agentic-senior-core/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-senior-core",
-  "version": "6.15.0",
+  "version": "6.16.0",
   "description": "Universal AI coding rules. Write code like a staff engineer.",
   "skills": "./skills/",
   "hooks": "./hooks/hooks.json",

package/.agents/plugins/agentic-senior-core/commands/asc-reference.md

@@ -1 +1 @@
-Apply domain-specific engineering standards from skills/asc-reference/SKILL.md (RFC API design, database N+1/transactions, isolation testing contracts, infrastructure, and resilience).
+Apply domain-specific engineering standards from skills/asc-reference/SKILL.md (RFC API design, database N+1/transactions, infrastructure configs, and service resilience).

package/.agents/plugins/agentic-senior-core/commands/asc-reference.toml

@@ -1,3 +1,2 @@
-description = "Domain reference for APIs, database queries, testing, and resilience"
-prompt = "Load and follow the asc-reference skill. Apply standards for RFC API design, database N+1/transactions, isolation testing contracts, and service resilience."
-
+description = "Domain reference for APIs, database queries, infrastructure, and resilience"
+prompt = "Load and follow the asc-reference skill. Apply standards for RFC API design, database N+1/transactions, infrastructure configurations, and service resilience."

package/.agents/plugins/agentic-senior-core/commands/asc-test.md

@@ -0,0 +1,2 @@
+Run the testing, TDD, verification, and UAT standards from skills/asc-test/SKILL.md. Enforce the Iron Law (no production code without a failing test first), apply verification gates with fresh execution evidence, reproduce bugfixes with regression proofs, design boundary-isolated tests, and diagnose flaky tests.
+

package/.agents/plugins/agentic-senior-core/commands/asc-test.toml

@@ -0,0 +1,3 @@
+description = "Test-driven development, verification gates, Playwright E2E, and UAT"
+prompt = "Load and follow the asc-test skill. Enforce the Iron Law of TDD (no production code without a failing test first), apply verification gates with fresh execution evidence, perform regression proofs on bugfixes, design boundary-isolated tests without mocking the unit under test, and trace flaky tests."
+

package/.agents/plugins/agentic-senior-core/hooks/lib/known-ui-slop-patterns.json

@@ -59,6 +59,86 @@
       "id": "code-step-narration",
       "regex": "//\\s*Step\\s+[0-9]+:\\s*|//\\s*Initialize\\s+(?:the\\s+)?[a-zA-Z0-9_]+",
       "message": "note: procedural line-by-line comment narration detected. Describe non-obvious intent and constraints instead of restating the obvious code flow."
+    },
+    {
+      "id": "ui-eyebrow-tracked-caps",
+      "regex": "text-\\[(?:10|11|12)px\\][^\\n\"']*uppercase[^\\n\"']*tracking-(?:wider|widest)|uppercase[^\\n\"']*tracking-(?:wider|widest)[^\\n\"']*text-\\[(?:10|11|12)px\\]",
+      "message": "note: 'eyebrow micro-label' (tracked uppercase kicker above headings) is an AI template habit. Let headings carry their own weight."
+    },
+    {
+      "id": "ui-hard-offset-shadow",
+      "regex": "box-?shadow:\\s*['\"]?[1-9]px\\s+[1-9]px\\s+0\\b|shadow-\\[[1-9]px_[1-9]px_0",
+      "message": "note: 'hard offset shadow' (neo-brutalist block shadow) detected. Verify this matches project design language, or use subtle stepped elevation."
+    },
+    {
+      "id": "ui-zero-offset-glow",
+      "regex": "shadow-\\[0_0_[0-9]+px|box-shadow:\\s*0\\s+0\\s+[0-9]+px",
+      "message": "note: 'zero-offset glow' (neon ambient halo) is an AI aesthetic cliché. Prefer crisp 1px borders or directional elevation shadows."
+    },
+    {
+      "id": "ui-ghost-card",
+      "regex": "border\\s+border-[a-z0-9/-]+\\s+[^\\n\"']*shadow-(?:lg|xl|2xl)|shadow-(?:lg|xl|2xl)\\s+[^\\n\"']*border\\s+border-[a-z0-9/-]+",
+      "message": "note: 'ghost card' (declaring elevation twice with border + heavy shadow) detected. Choose one elevation model: a crisp 1px border OR an elevation shadow."
+    },
+    {
+      "id": "ui-viewport-100vh-mobile",
+      "regex": "(?:\\bh-screen\\b|height:\\s*100vh\\b)(?!.*dvh)",
+      "message": "warning: '100vh' / 'h-screen' causes content clipping under mobile browser address bars. Use '100dvh' or 'min-h-dvh' instead."
+    },
+    {
+      "id": "ui-fixed-button-width",
+      "regex": "<button[^>]*class(?:Name)?=[\"'][^\"']*\\bw-\\[[0-9]+px\\]|<button[^>]*style=[\"'][^\"']*width:\\s*[0-9]+px",
+      "message": "note: fixed-width button detected. Hardcoded widths cause text clipping in non-English locales (+20% to +40% expansion). Use padding and min-width."
+    },
+    {
+      "id": "ui-empty-state-essay",
+      "regex": "(?:looks like you haven't|blank canvas awaiting|getting started is easy and fun|your workspace is empty)",
+      "message": "note: flowery empty state copy detected. Keep empty states to 1 factual sentence plus a direct action button."
+    },
+    {
+      "id": "ui-modal-by-default",
+      "regex": "<(?:Dialog|Modal)[^>]*>(?=[\\s\\S]{0,500}<form)",
+      "message": "note: modal dialog enclosing simple form detected. Prefer inline progressive disclosure or dedicated route canvas over disruptive modals."
+    },
+    {
+      "id": "ui-missing-reduced-motion",
+      "regex": "@keyframes\\s+[a-zA-Z0-9_-]+(?![\\s\\S]{1,600}prefers-reduced-motion)",
+      "message": "note: CSS @keyframes animation without 'prefers-reduced-motion' query detected. Provide a static or reduced motion fallback."
+    },
+    {
+      "id": "ui-hover-scale-bounce",
+      "regex": "hover:scale-(?:105|110|125)",
+      "message": "note: 'hover:scale-105' bounce on buttons feels gimmicky in operational UI. Use snappy micro-feedback (transition-colors or active:scale-[0.98])."
+    },
+    {
+      "id": "copy-hybrid-neologism",
+      "regex": "\\b(meng-generate|di-submit|di-approve|di-cancel|meng-handle|di-delete|men-delete|me-restore|di-update|meng-update)\\b",
+      "message": "warning: hybrid neologism ('di-submit', 'meng-generate') detected. Maintain strict single-language purity (use native Indonesian terms or pure English)."
+    },
+    {
+      "id": "ui-card-in-card-nesting",
+      "regex": "class(?:Name)?=[\"'][^\"']*rounded-(?:xl|2xl)[^\"']*[\"'][^>]*>(?=[\\s\\S]{0,350}class(?:Name)?=[\"'][^\"']*rounded-(?:lg|xl|2xl))",
+      "message": "note: nested card containers ('card-in-card') detected. Use flat lists, hairline dividers, or recessed well surfaces instead of nesting cards."
+    },
+    {
+      "id": "ui-terracotta-cream-cliche",
+      "regex": "(?:bg-(?:amber|orange|yellow)-50|#fdfbf7)[\\s\\S]{0,250}(?:text-(?:amber|orange)-800|#c2410c)",
+      "message": "note: unprompted 'cream ground + terracotta accent' (Wave 3 AI editorial cliché) detected. Derive palette from project tokens or authentic material instead."
+    },
+    {
+      "id": "ui-index-number-trope",
+      "regex": "(?:\\b0[1-9]\\s*/\\s*0[1-9]\\b|\\(00[1-9]\\)|Step\\s+0[1-9])",
+      "message": "note: decorative index numbering ('01 / 02', '(001)') detected. Order sections by typography scale and content rather than performative index tags."
+    },
+    {
+      "id": "ui-broadsheet-cosplay",
+      "regex": "border-(?:t|b|l|r)\\s+border-border\\/[0-9]+\\s+rounded-none",
+      "message": "note: 'broadsheet cosplay' (dense hairline dividers with zero border-radius) detected. Structure layouts with spatial padding and tonal contrast."
+    },
+    {
+      "id": "ui-agency-micro-meta",
+      "regex": "(?:\\b\\d{1,2}\\.\\d+°\\s*[NSEW]\\b|©\\s*20\\d\\d\\s*—\\s*Scroll)",
+      "message": "note: performative agency metadata (geographic coordinates, fake version/scroll stamps) detected. Remove ornamental meta."
     }
   ]
-}
+}

package/.agents/plugins/agentic-senior-core/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-senior-core",
-  "version": "6.15.0",
+  "version": "6.16.0",
   "description": "Universal AI coding rules. Because your AI writes code like it gets paid by the line.",
   "contextFileName": "rules/agentic-senior-core.md",
   "rules": [

package/.agents/plugins/agentic-senior-core/rules/agentic-senior-core.md

@@ -82,8 +82,9 @@ When picking step 5 or 6 (unless trivial):
 
 ## Domain References & Skills (On-Demand)
 Detailed domain guidelines are loaded on-demand via skills or scoped rules:
-- **Testing, API Design, Database, Frontend, Infrastructure, Resilience** → run `/asc-reference`
-- **UI/UX Engineering & Anti-Slop Design** → run `/asc-ui`
+- **Testing, TDD, Verification, E2E & UAT** → run `/asc-test`
+- **API Design, Database, Infrastructure, Resilience** → run `/asc-reference`
+- **Frontend UI/UX Engineering & Anti-Slop Design** → run `/asc-ui`
 - **Engineering Lifecycle & Features** → run `/asc-develop`
 - **Quality, Security & Duplication Audit** → run `/asc-review`
 - **Repository Meta & Configuration** → run `/asc`

package/.agents/plugins/agentic-senior-core/skills/asc/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: asc
 description: >
-  Trigger this skill when the user asks: "what are the rules", "coding guidelines", "best practices", "how should I write this", "staff engineer approach", "map this codebase", "document our patterns", "fingerprint this repository", "learn my preferences", "bootstrap preferences", "log this debt", "add to debt ledger", "install ASC", "configure for Cursor", "set up adapter", "apa aturannya", "panduan koding", "petakan codebase", "pasang asc". Covers Core Overview, Codebase Fingerprinting, Adaptive Preferences, Debt Tracking, and IDE Adapters.
+  Trigger this skill when the user asks: "what are the rules", "coding guidelines", "best practices", "how should I write this", "staff engineer approach", "map this codebase", "document our patterns", "fingerprint this repository", "learn my preferences", "bootstrap preferences", "log this debt", "add to debt ledger", "install ASC", "configure for Cursor", "set up adapter", "apa aturannya", "panduan koding", "petakan codebase", "pasang asc".
 ---
 
 # Agentic Senior Core: Architecture & Meta-Tools (`asc`)
@@ -10,15 +10,16 @@ Universal AI coding rules and meta-tooling playbook. Grounded in Google Engineer
 
 ---
 
-## 1. The 5 Core Meta-Skills Architecture
+## 1. The 6 Core Meta-Skills Architecture
 
-Agentic Senior Core organizes operational guidance into 5 high-density, non-overlapping playbooks:
+Agentic Senior Core organizes operational guidance into 6 high-density, non-overlapping playbooks:
 
-1. **`/asc` (This Skill)**: Core engineering rules, codebase convention fingerprinting, adaptive preferences, debt tracking, and IDE adapter setup.
+1. **`/asc` (This Skill)**: Core engineering rules, codebase convention fingerprinting, adaptive preferences, debt tracking, skill authoring, and IDE adapter setup.
 2. **`/asc-develop`**: Engineering lifecycle for greenfield scaffolding, brownfield feature implementation, and structured refactoring.
 3. **`/asc-review`**: Quality and security assurance: production PR reviews, deep vulnerability audits (OWASP / ASI), and code clone deduplication.
-4. **`/asc-reference`**: Domain architecture reference for REST/GraphQL APIs, database queries/migrations, testing contracts, infrastructure, and resilience.
-5. **`/asc-ui`**: Human-interface engineering: UI visuals, UX microcopy hygiene, strict single-language localization, mobile reflow (`dvh`/`clamp`), and WCAG 2.2 AA accessibility.
+4. **`/asc-test`**: Dedicated testing playbook: the Iron Law of TDD, verification gates, Playwright E2E, UAT acceptance checklists, regression proofs, and flaky test remediation.
+5. **`/asc-reference`**: Domain architecture reference for REST/GraphQL APIs, database indexing/transactions/migrations, infrastructure configs, and service resilience.
+6. **`/asc-ui`**: Human-interface engineering: surface modes (Operate, Persuade, Read, Experience), UX microcopy hygiene, single-language localization, mobile reflow (`dvh`/`clamp`), and WCAG 2.2 AA accessibility.
 
 ---
 
@@ -73,3 +74,11 @@ asc adapter --all   # Generate workspace adapters for all detected IDEs
 asc adapter --cursor # Generate adapter specifically for Cursor
 asc uninstall       # Clean up adapter files and hooks
 ```
+
+---
+
+## 6. On-Demand Reference Library
+
+| Topic | Reference Path |
+|---|---|
+| Authoring skills, trigger descriptions & 150-line routers | [references/writing-skills.md](references/writing-skills.md) |

package/.agents/plugins/agentic-senior-core/skills/asc/references/writing-skills.md

@@ -0,0 +1,72 @@
+# Authoring Agentic Skills & Routers
+
+Engineering guidelines for creating high-performance, token-efficient skills for Antigravity, Claude Code, Codex, and other AI coding agents.
+
+---
+
+## 1. The Discovery & Routing Trap
+
+Research into agent skill selection shows that models degrade in tool and skill routing when descriptions summarize internal workflows.
+
+### 1.1 The Description Rules
+1. **Trigger-Only Content:** Descriptions must contain ONLY triggering conditions: user tasks, symptom phrases, and file match patterns.
+2. **Zero Workflow Summaries:** Never describe how the skill works or what steps it executes inside the description. When a description outlines the workflow, the agent executes the summary directly and skips loading the full skill body.
+3. **Character Budget:** Keep descriptions concise (under 500 characters).
+4. **Symptom Keywords:** Include authentic user vocabulary, colloquial complaints (*"too slow"*, *"flaky"*, *"looks broken on mobile"*), and non-English equivalents (*"bikin tes"*, *"rapikan tampilan"*).
+
+| Anti-Pattern Description (Banned) | Deterministic Trigger Description (Enforced) |
+|---|---|
+| `description: Handles Greenfield, Brownfield, and Refactoring workflows by researching analogous code, making a plan, and running tests.` | `description: Trigger when building a new feature, creating an endpoint, adding components, scaffolding a project, or refactoring existing code. Trigger when user says: 'add a feature', 'build endpoint', 'refactor this', 'clean up'.` |
+
+---
+
+## 2. The Router + On-Demand References Pattern
+
+Loading complete domain encyclopedias into every agent session wastes prompt cache tokens and causes attention degradation.
+
+```
+┌────────────────────────────────────────────────────────┐
+│ SKILL.md (Router: < 150 Lines)                         │
+├────────────────────────────────────────────────────────┤
+│ 1. Trigger Frontmatter                                 │
+│ 2. The Quality Floor (Bans & Invariants)               │
+│ 3. Core Pre-flight & Classification Decision Tree      │
+│ 4. Reference Routing Table ────────┐                   │
+│ 5. Verification & Handoff Sweep    │                   │
+└────────────────────────────────────┼───────────────────┘
+                                     │
+                     ┌───────────────┴───────────────┐
+                     ▼                               ▼
+       ┌───────────────────────────┐   ┌───────────────────────────┐
+       │ references/domain-a.md    │   │ references/domain-b.md    │
+       │ (Loaded on demand only)   │   │ (Loaded on demand only)   │
+       └───────────────────────────┘   └───────────────────────────┘
+```
+
+### 2.1 The 150-Line Router Budget
+`SKILL.md` must stay under 150 lines:
+- **The Floor:** 10–15 unbending bans or architectural invariants.
+- **Decision Engine:** High-level classification (Surface Modes, TDD tiers, Refine vs. Redesign).
+- **Load Map:** A concise markdown table linking user tasks to specific files in `references/`.
+- **Handoff Sweep:** Mechanical checklist executed before claiming completion.
+
+### 2.2 Deep Domain References (`references/*.md`)
+Offload detailed explanations, code examples, schemas, and nuance to separate markdown files in `references/`. The agent reads only the relevant reference file when that specific branch of work executes.
+
+---
+
+## 3. The Zero Disk Checkpoint Invariant
+
+Skills must never clutter user repositories with transient agent state files.
+
+- **Banned:** Writing `PRD.md`, `workflow-gate.json`, `test-checklist.json`, or temporary progress trackers into the user's project root.
+- **Enforced:** Store transient plans and state in conversation memory or agent brain artifacts (`brain/<id>/`). Read existing project documentation (`DESIGN.md`, `CONVENTIONS.md`) if present, but never mutate project directories without user instruction.
+
+---
+
+## 4. Verification Gates Over Written Promises
+
+A skill without a verifiable gate is merely a suggestion.
+- Every modification must be coupled with an automated verification command (linter, unit test, Playwright run, or slop pattern check).
+- Mandate fresh execution evidence: require the agent to execute the runner fresh and verify exit code 0 before claiming completion.
+

package/.agents/plugins/agentic-senior-core/skills/asc-develop/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: asc-develop
 description: >
-  Trigger this skill when the user is: building a new feature, creating an endpoint, adding components, scaffolding a new project, starting from scratch, or refactoring existing code. Trigger when the user says: "add a feature", "build this endpoint", "implement this", "extend this", "wire up", "create a new route", "add a new page", "tambah fitur", "bikin endpoint", "new project", "start from scratch", "scaffold this", "bootstrap app", "bikin project baru", "buat aplikasi baru", "refactor this", "clean up this code", "rewrite this", "extract this into", "simplify this module", "rapikan kode ini", "refactor ini". Handles Greenfield, Brownfield, and Refactoring workflows.
+  Trigger this skill when the user is: building a new feature, creating an endpoint, adding components, scaffolding a new project, starting from scratch, or refactoring existing code. Trigger when the user says: "add a feature", "build this endpoint", "implement this", "extend this", "wire up", "create a new route", "add a new page", "tambah fitur", "bikin endpoint", "new project", "start from scratch", "scaffold this", "bootstrap app", "bikin project baru", "buat aplikasi baru", "refactor this", "clean up this code", "rewrite this", "extract this into", "simplify this module", "rapikan kode ini", "refactor ini".
 ---
 
 # Engineering Lifecycle Playbook (`asc-develop`)
@@ -53,8 +53,8 @@ Use when adding endpoints, components, pages, or capabilities to an existing cod
    - How can the system recover? (Retry, cached fallback, degraded mode).
 3. If building UI, ensure compliance with `/asc-ui` (zero marketing fluff, single-language consistency, mobile reflow, WCAG AA contrast).
 
-### Step 3: Implement & Validate
-1. Implement the feature following the approved plan.
+### Step 3: Implement & Validate (TDD Integration)
+1. Follow the TDD cycle via `/asc-test`: write the failing test first (RED), write minimal code to pass (GREEN), then refactor.
 2. **Zero-Fake-Done Testing**: Run the project test suite (`ascx test`, `npm test`, `pytest`, `cargo test`). The test runner **MUST** exit with code 0.
 3. Never weaken or delete test assertions to simulate a passing run. Fix the underlying business logic.
 
@@ -82,4 +82,3 @@ Use when restructuring, simplifying, or modernizing code without changing extern
 ### Step 3: Verification
 1. Re-run tests to confirm that behavior, public contracts, and error handling remain identical.
 2. For every changed module, confirm that readability, maintainability, and safety have improved.
-

package/.agents/plugins/agentic-senior-core/skills/asc-reference/SKILL.md

@@ -1,73 +1,61 @@
 ---
 name: asc-reference
 description: >
-  Trigger this skill when the user is working on: unit tests, integration tests, REST APIs, GraphQL APIs, SQL queries, database migrations, React components, frontend layouts, Docker configs, CI/CD pipelines, Kubernetes manifests, or service resilience (retries, circuit breakers, rate limiting). Also trigger when the user says: "how should I test this", "design this API", "optimize this query", "set up Docker", "add retry logic", "write a test", "add pagination", "handle errors", "add loading state", "set up CI", "it keeps failing", "make it try again if it fails", "it's too slow with lots of data", "looks broken on mobile", "how do I deploy this", "will this break anything", "bagaimana cara ngetes ini", "bikin tes", "kok lambat banget", "tampilan di hp rusak", "cara deploy ini". Also trigger when editing files matching: `*.test.*`, `*.spec.*`, `Dockerfile`, `docker-compose.*`, `.github/workflows/*`, `*.sql`, or migration files.
+  Trigger this skill when working on: REST APIs, GraphQL APIs, SQL queries, database indexing, transactions, migrations, Docker configs, CI/CD pipelines, Kubernetes manifests, or service resilience. Also trigger when the user says: "design this API", "optimize query", "database transaction", "set up Docker", "add retry logic", "add pagination", "handle errors", "set up CI", "kok lambat banget", "cara deploy ini". Also trigger when editing files matching: `Dockerfile`, `docker-compose.*`, `.github/workflows/*`, `*.sql`, or migration files.
 ---
 
-# ASC Domain Reference
-
-Domain-specific coding rules for testing, API design, database queries, frontend components, infrastructure configs, and service resilience. Load this skill when working on any of these domains.
-
-Grounded in: WCAG 2.2 AA (accessibility), Fowler's Money Pattern (monetary types), Nygard's Release It! (resilience patterns), AWS Well-Architected Reliability Pillar (backoff/circuit breakers), OWASP Secure Coding Practices (input validation, logging).
-
-## Testing
-
-- New business logic requires at least one happy path test and one primary failure mode test.
-- Never mock the unit under test — mock only external dependencies and boundaries. Prefer real in-process doubles (e.g. `node:sqlite`, in-memory repositories, or MSW network interceptors) over fragile behavioral mock spies.
-- Tests assert behavior and contracts, not implementation details. Must be fast, isolated, deterministic.
-- Cover happy path, error paths, edge cases, and empty states.
-- Integration tests for critical data paths. Sensitive mutations need idempotency or duplicate-submit coverage.
-- CI pipelines block on test failures.
-
-## API Design
-
-- Consistent resource naming and HTTP semantics (follow RFC 9110; RFC 9457 for problem details).
-- Bounded list reads: always paginate or set explicit limits.
-- Idempotent for side-effect mutations (support `Idempotency-Key` headers for safe retries). Document retry behavior.
-- Backward-compatible by default. Version breaking changes explicitly.
-- Sync docs in the same commit when changing API, CLI, or schema.
-
-## Database
-
-- Use eager loading or batching to eliminate N+1 queries.
-- Paginate all growable datasets. No unbounded queries.
-- Multi-table mutations run inside transactions.
-- Monetary amounts: integer minor units or exact decimal. Never floats.
-- Timestamps in UTC. No naive timestamps.
-- Schema changes require versioned, reversible migrations.
-- Never modify merged migrations. Create new ones.
-
-## Frontend
-
-- Match the project's existing styling paradigm (Tailwind, CSS Modules, Vanilla CSS, styled-components, etc.). Do not introduce a new CSS framework or build tool without explicit user confirmation.
-- UI Component Reusability: Primitive UI elements (buttons, inputs, cards, dialogs, badges) must have a single source of truth in the shared component directory (`components/` or `ui/`). Never recreate ad-hoc variants or duplicate JSX structures across individual pages. Extend existing components with props or variants instead of cloning.
-- Design Consistency: Consume shared design tokens, CSS variables, or theme configuration for colors, spacing, and border-radius. Do not hardcode arbitrary raw color hexes or inconsistent spacing that causes visual design drift between pages.
-- Action Feedback & Mutations: Any user-initiated mutation (form submit, delete, upload, toggle) must provide immediate pending feedback (disabled button, inline spinner) and a visible completion notification (toast or alert banner with retry). Never silently swallow mutation errors.
-- Form Validation: Render field errors inline directly next to the affected input with `aria-describedby` and `aria-invalid="true"`. Never use floating toasts for individual form input validation.
-- Data-Fetching State Quad: Data components must explicitly handle 4 states — loading skeleton/spinner, empty state (friendly message + call to action), error fallback (clear message + retry button), and populated data.
-- Component Error Boundaries: Wrap major widgets, dashboards, and routes in localized Error Boundaries with fallback UI cards to prevent a single rendering crash from taking down the entire page.
-- Accessible Notifications: Toast and status messages must use ARIA live regions (`role="status"`, `aria-live="polite"` for non-urgent feedback; `role="alert"` for critical errors). Never steal keyboard focus for toasts.
-- WCAG 2.2 AA accessibility floor. Responsive by default.
-- No placeholder, lorem, or TODO content in production UI.
-- UI/UX Microcopy & Anti-Slop: For comprehensive UX writing, redundancy elimination, single-language localization hygiene, and layout de-sloppification, load the dedicated `/asc-ui` skill (`skills/asc-ui/SKILL.md`).
-
-## Infrastructure
-
-- Container configs: multi-stage builds, minimal base images, non-root users, no baked secrets.
-- Configuration from environment, validated at startup. Fail fast if invalid.
-- Structured logging with correlation IDs. No PII in logs.
-
-## Resilience
-
-- Every outbound network call has a strict timeout (client and server).
-- Retries use exponential backoff with jitter and max attempt limits.
-- Only retry idempotent operations (GET, PUT, DELETE, or requests with `Idempotency-Key`).
-- Dependency Fallback Strategy (Hard vs Soft):
-  - Hard dependencies (core workflow blocks without them): Fail fast, roll back transactions, return structured RFC 9457 error with actionable explanation.
-  - Soft dependencies (non-critical enhancements): Provide graceful fallbacks:
-    - *Static Fallback*: Return safe default values, static placeholders, or empty collections instead of throwing unhandled exceptions.
-    - *Stale Cache Fallback*: Serve last-known-good cached state (`stale-while-revalidate`) with an offline/stale indicator.
-    - *Degraded Mode*: Isolate and disable the failing peripheral widget while preserving core user journeys.
-- Circuit breakers for unhealthy dependencies to fail fast and prevent thread/resource exhaustion.
-- Offline Detection: Detect offline network status and notify users before initiating network requests that are guaranteed to fail.
+# Domain Engineering Reference Router
 
+Staff-grade architectural standards for APIs, databases, infrastructure, and distributed resilience. Enforces baseline invariants and routes deep domain guidance on demand.
+
+---
+
+## 1. The Core Engineering Floor
+
+Every backend and infrastructure change must satisfy these baseline invariants:
+
+1. **RFC 9457 Problem Details:** All API error responses must return structured JSON problem details with actionable error types and HTTP status codes.
+2. **Bounded Reads:** Every list query or API endpoint must enforce pagination or explicit limits. Unbounded scans are forbidden.
+3. **Idempotent Mutations:** Side-effect mutations must accept an `Idempotency-Key` header and return cached responses on repeat requests.
+4. **ACID Transactions:** Any multi-table mutation or read-then-write sequence must run inside an explicit database transaction.
+5. **No N+1 Queries:** Database queries inside loops are forbidden; use eager loading, joins, or batching (DataLoader).
+6. **Precision Data Types:** Monetary amounts must use integer minor units (cents) or `NUMERIC(18, 4)`. Floating point (`FLOAT`/`DOUBLE`) for currency is banned.
+7. **UTC Timestamps:** All dates and times must be stored in UTC (`TIMESTAMPTZ` or ISO-8601 strings).
+8. **Reversible Migrations:** Schema changes require reversible migrations using Expand-and-Contract for zero-downtime evolution.
+9. **Container Security:** Multi-stage Docker builds, non-root users (`USER node`/`USER 10001`), and zero baked credentials.
+10. **Zero-Hang Timeouts:** Every outbound network call must specify explicit connection and read timeouts.
+11. **Jittered Backoff:** Retries must use exponential backoff with full jitter and limit attempts to safe idempotent methods.
+
+---
+
+## 2. On-Demand Reference Library
+
+Load these references only when working on that specific domain:
+
+| Domain | Scope & Substance | Reference Path |
+|---|---|---|
+| **API Design** | REST semantics, cursor pagination, RFC 9457, GraphQL DataLoader, query complexity | [references/api.md](references/api.md) |
+| **Database** | B-Tree indexing, N+1 prevention, row locking (`FOR UPDATE`), expand-and-contract | [references/database.md](references/database.md) |
+| **Infrastructure** | Multi-stage Docker, non-root users, 12-factor env validation, liveness/readiness | [references/infrastructure.md](references/infrastructure.md) |
+| **Resilience** | Timeouts, full jitter backoff, circuit breakers, hard vs soft dependency fallbacks | [references/resilience.md](references/resilience.md) |
+
+---
+
+## 3. Dependency Classification: Hard vs. Soft
+
+Before writing integration code, classify external services:
+- **Hard Dependency (Core Workflow):** Fail fast, roll back local database transactions, and return an RFC 9457 error to the caller.
+- **Soft Dependency (Auxiliary/Enhancement):** Provide graceful fallback:
+  1. *Stale Cache:* Return last-known-good cached state (`stale-while-revalidate`).
+  2. *Static Safe Default:* Return empty collections or static safe placeholders.
+  3. *Degraded Mode:* Isolate and disable the peripheral widget without breaking primary journeys.
+
+---
+
+## 4. Verification & Handoff Sweep
+
+Before completing backend or infrastructure work:
+1. Verify query execution plan (`EXPLAIN ANALYZE`) for newly introduced SQL queries.
+2. Verify all outbound network calls have timeout parameters.
+3. Validate startup configuration fails fast on missing environment variables.
+4. Confirm migrations run cleanly in both `up` and `down` directions.

package/.agents/plugins/agentic-senior-core/skills/asc-reference/references/api.md

@@ -0,0 +1,108 @@
+# API Design: REST & GraphQL Standards
+
+Production APIs must be predictable, idempotent, strictly typed, and backward-compatible.
+
+---
+
+## 1. REST API Architecture & HTTP Semantics (RFC 9110)
+
+### 1.1 Resource Naming & URI Grammar
+- Use plural nouns for resource collections: `/v1/projects`, `/v1/projects/{id}/deployments`.
+- Use HTTP verbs for actions:
+  - `GET`: Safe, idempotent retrieval. No body.
+  - `POST`: Create a resource or trigger a non-idempotent operation.
+  - `PUT`: Idempotent full replacement of the resource.
+  - `PATCH`: Partial update of specific fields (prefer JSON Merge Patch RFC 7396).
+  - `DELETE`: Idempotent removal of the resource.
+
+### 1.2 Bounded Collections & Pagination
+Every endpoint returning a list must enforce an upper limit to prevent memory exhaustion:
+- **Cursor-based pagination (Recommended for real-time/large datasets):**
+  - Query parameters: `?after=cursor_xyz&limit=50`.
+  - Response envelope:
+    ```json
+    {
+      "items": [...],
+      "page_info": {
+        "has_next_page": true,
+        "end_cursor": "cursor_xyz"
+      }
+    }
+    ```
+- **Offset pagination (For simple admin portals):**
+  - Query parameters: `?page=1&per_page=25` (enforce max `per_page=100`).
+  - Return pagination metadata in headers: `X-Total-Count`, `Link: <...>; rel="next"`.
+
+### 1.3 Mutation Idempotency (The `Idempotency-Key` Header)
+Critical mutations (payments, resource creation, batch operations) must accept an `Idempotency-Key` header:
+1. When receiving a mutation request with `Idempotency-Key: <uuid>`:
+   - Check cache/database for existing key within TTL (e.g. 24 hours).
+   - If key exists and processing is in progress: return `409 Conflict` or wait.
+   - If key exists and completed: return the cached response (headers + body) immediately.
+   - If new key: save key with state `PENDING`, execute mutation in transaction, store result, return response.
+
+---
+
+## 2. Structured Error Details (RFC 9457)
+
+Never return generic error strings like `{"error": "Something went wrong"}`. Use RFC 9457 Problem Details:
+
+```json
+{
+  "type": "https://api.example.com/errors/validation-failed",
+  "title": "Validation Failed",
+  "status": 422,
+  "detail": "The request payload failed validation constraints.",
+  "instance": "/v1/projects/proj_982/deployments",
+  "invalid_params": [
+    {
+      "name": "branch",
+      "reason": "Branch 'feature/beta' does not exist in the connected repository."
+    }
+  ]
+}
+```
+
+- Always return the appropriate HTTP status code (`400`, `401`, `403`, `404`, `409`, `422`, `429`, `500`, `503`).
+- Set `Content-Type: application/problem+json`.
+
+---
+
+## 3. GraphQL Standards
+
+### 3.1 N+1 Query Elimination via DataLoader
+GraphQL resolvers execute independently, naturally producing N+1 database queries.
+- **Enforced:** Wrap database lookups in a batching mechanism (e.g., `DataLoader` in JS, `graphene-dataloader` in Python):
+  ```typescript
+  const userLoader = new DataLoader(async (userIds: readonly string[]) => {
+    const users = await db.users.findMany({ where: { id: { in: [...userIds] } } });
+    const userMap = new Map(users.map(u => [u.id, u]));
+    return userIds.map(id => userMap.get(id) || null);
+  });
+  ```
+
+### 3.2 Query Depth & Complexity Limits
+Protect GraphQL endpoints against Denial-of-Service (DoS) via deeply nested circular queries:
+- Configure maximum query depth (e.g., maximum depth of 6).
+- Implement query cost analysis: reject queries whose calculated complexity score exceeds budget.
+
+### 3.3 Explicit Mutation Errors (Result Unions)
+Model business failures as schema types rather than top-level GraphQL errors:
+```graphql
+type TransferSuccess {
+  transactionId: ID!
+  newBalance: Float!
+}
+
+type InsufficientFundsError {
+  available: Float!
+  required: Float!
+}
+
+union TransferResult = TransferSuccess | InsufficientFundsError
+
+type Mutation {
+  transferMoney(input: TransferInput!): TransferResult!
+}
+```
+

package/.agents/plugins/agentic-senior-core/skills/asc-reference/references/database.md

@@ -0,0 +1,97 @@
+# Database Engineering: Indexing, Transactions & Migrations
+
+Relational and document databases underpin application state. High-traffic systems fail most frequently at the database boundary.
+
+---
+
+## 1. Indexing Strategies & Query Optimization
+
+Indexes turn full table scans ($O(N)$) into logarithmic tree lookups ($O(\log N)$). Unindexed queries are the primary source of production latency spikes.
+
+### 1.1 Index Placement Rules
+- **Foreign Keys:** Always index foreign key columns (`author_id`, `org_id`). Database engines do not automatically index foreign keys, leading to full table scans during cascade checks and joins.
+- **Filter & Sort Predicates:** Index columns present in `WHERE`, `ORDER BY`, and `GROUP BY` clauses.
+- **Leftmost Prefix Rule for Composite Indexes:** An index on `(org_id, status, created_at)` accelerates:
+  - `WHERE org_id = ?`
+  - `WHERE org_id = ? AND status = ?`
+  - `WHERE org_id = ? AND status = ? ORDER BY created_at`
+  - *It does NOT accelerate:* `WHERE status = ?` alone. Order columns by cardinality and filter frequency.
+
+### 1.2 Partial Indexes
+Save index size and write overhead by indexing only active rows:
+```sql
+-- Accelerates lookups for active users without indexing millions of deleted rows
+CREATE INDEX idx_users_active_email ON users (email) WHERE deleted_at IS NULL;
+```
+
+---
+
+## 2. N+1 Query Prevention
+
+Never execute database queries inside an application loop:
+
+```typescript
+// BANNED: 1 initial query + N separate queries for authors
+const posts = await db.posts.findMany();
+for (const post of posts) {
+  post.author = await db.users.findUnique({ where: { id: post.authorId } });
+}
+
+// ENFORCED: 1 query with join or batch preload
+const posts = await db.posts.findMany({
+  include: { author: true }
+});
+```
+
+---
+
+## 3. Transaction Boundaries & Concurrency Control
+
+Any operation modifying more than one table, or reading state to calculate a mutation, must be guarded by an ACID transaction.
+
+### 3.1 Lost Update Prevention (Pessimistic Locking)
+When decrementing balances or claiming inventory, reading then writing in two queries creates a race condition:
+
+```sql
+-- BANNED: Two concurrent requests read balance = 100, both deduct 50, final balance 50 instead of 0
+SELECT balance FROM accounts WHERE id = 1;
+UPDATE accounts SET balance = balance - 50 WHERE id = 1;
+
+-- ENFORCED: Pessimistic Row Lock inside transaction
+BEGIN;
+SELECT balance FROM accounts WHERE id = 1 FOR UPDATE;
+-- Validate balance >= 50
+UPDATE accounts SET balance = balance - 50 WHERE id = 1;
+COMMIT;
+```
+
+---
+
+## 4. Zero-Downtime Migrations: The Expand-and-Contract Pattern
+
+Never perform breaking schema alterations (renaming columns, changing column types, deleting columns) in a single deployment step. Use the Expand-and-Contract pattern across three deployments:
+
+```
+Deployment 1 (Expand)        Deployment 2 (Migrate & Read)    Deployment 3 (Contract)
+──────────────────────       ────────────────────────────     ───────────────────────
+Add new column `new_col`     Application writes both cols     Drop old column `old_col`
+Application writes both      Reads from `new_col`             Remove dual-write logic
+Backfill historical data     All code points to `new_col`     Migration complete
+```
+
+### 4.1 Migration Invariants
+- **Non-blocking Index Creation:** In PostgreSQL, always use `CREATE INDEX CONCURRENTLY` to avoid locking the table against writes. Set a statement lock timeout: `SET lock_timeout = '5s'`.
+- **Never Edit Merged Migrations:** Once a migration has been committed and run in shared environments, treat it as immutable. Author a new corrective migration instead.
+- **Reversibility:** Every migration must provide a valid `down` step that reverses schema modifications cleanly.
+
+---
+
+## 5. Data Types: Precision & Time
+
+1. **Monetary Amounts:**
+   - **Strictly Banned:** `FLOAT`, `DOUBLE`, `REAL`. Floating-point arithmetic produces rounding inaccuracies (`0.1 + 0.2 = 0.30000000000000004`).
+   - **Enforced:** Integer minor units (e.g. storing USD as integer cents: `$19.99` $\to$ `1999`) or exact fixed-point `NUMERIC(18, 4)`.
+2. **Timestamps:**
+   - Store all timestamps in UTC with timezone: `TIMESTAMPTZ` (Postgres) or ISO-8601 UTC strings (`2026-11-04T10:00:00Z`).
+   - Never store naive local times without timezone offset.
+