@ryuenn3123/agentic-senior-core 6.16.2 → 6.16.5

package/.agents/plugins/agentic-senior-core/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-senior-core",
-  "version": "6.16.2",
+  "version": "6.16.5",
   "description": "Universal AI coding rules. Write code like a staff engineer.",
   "skills": "./skills/",
   "hooks": "./hooks/hooks.json",

package/.agents/plugins/agentic-senior-core/commands/asc-pentest.md

@@ -0,0 +1,2 @@
+Run the adversarial penetration testing, DAST, and API security verification standards from skills/asc-pentest/SKILL.md. Execute non-destructive reconnaissance, dynamic request fuzzing, BOLA/IDOR dual-identity verification, and generate deterministic proof-of-exploit ledgers with safe remediation.
+

package/.agents/plugins/agentic-senior-core/commands/asc-pentest.toml

@@ -0,0 +1,3 @@
+description = "Adversarial penetration testing, DAST, API security fuzzing, and BOLA/IDOR verification"
+prompt = "Load and follow the asc-pentest skill. Execute defensive penetration testing against local/staging targets using the Pentesting Task Tree, run DAST baseline scans, probe BOLA/IDOR with dual-identity replay, fuzz input boundaries safely, and output deterministic proof-of-exploit curl ledgers."
+

package/.agents/plugins/agentic-senior-core/hooks/dedup-gate.js

@@ -14,6 +14,11 @@ const {
   LOC_DELTA_THRESHOLD,
   NEW_FILE_LINE_THRESHOLD,
 } = require('./constants.cjs');
+const {
+  isAntigravityPayload,
+  resolveWorkspaceRoot,
+  normalizeEditToolCall,
+} = require('./path-util.cjs');
 
 const JSCPD_TIMEOUT_MS = 10000;
 
@@ -77,133 +82,136 @@ function isFrameworkConventional(basename) {
   return FRAMEWORK_CONVENTIONAL_BASENAMES.has(basename) || hasConventionalSuffix(basename);
 }
 
+let handled = false;
 let inputBuffer = '';
-process.stdin.setEncoding('utf8');
-process.stdin.on('data', chunk => {
-  inputBuffer += chunk;
-  try {
-    const data = JSON.parse(inputBuffer);
 
-    let toolName = '';
-    let toolInput = {};
-    let isAntigravity = false;
-
-    if (data.toolCall) {
-      // Antigravity PreToolUse shape (has toolCall directly)
-      isAntigravity = true;
-      toolName = data.toolCall.name;
-      toolInput = data.toolCall.args || {};
-    } else if (data.stepIdx !== undefined && data.transcriptPath) {
-      // Antigravity PostToolUse shape — no toolCall in payload,
-      // read the tool call details from the transcript at stepIdx
-      isAntigravity = true;
-      var extracted = extractToolCallFromTranscript(data.transcriptPath, data.stepIdx);
-      if (!extracted) { process.exit(0); return; }
-      toolName = extracted.toolName;
-      toolInput = extracted.toolInput;
-    } else {
-      // Claude Code / Codex / Copilot path
-      toolName = data.tool_name || data.toolName || '';
-      toolInput = data.tool_input || data.toolInput || {};
-    }
+function handleDedupPayload(data) {
+  if (handled) return;
+  handled = true;
 
-    const filePath = toolInput.file_path || toolInput.TargetFile || toolInput.path || toolInput.target_file || '';
-    if (!filePath) { process.exit(0); return; }
+  const isAntigravity = isAntigravityPayload(data);
+  if (isAntigravity && data && data.stepIdx !== undefined) {
+    // Antigravity PostToolUse strictly expects {} on stdout
+    process.stdout.write('{}\n');
+    process.exit(0);
+    return;
+  }
 
-    const ext = path.extname(filePath).slice(1);
-    if (!SOURCE_EXTENSIONS.has(ext)) { process.exit(0); return; }
+  const workspaceRoot = resolveWorkspaceRoot(data);
+  let rawTool = '';
+  let rawArgs = {};
 
-    const config = loadDedupConfig();
-    if (!isQualifyingEdit(toolName, toolInput, config)) { process.exit(0); return; }
+  if (data && data.toolCall) {
+    rawTool = data.toolCall.name || '';
+    rawArgs = data.toolCall.args || {};
+  } else if (data) {
+    rawTool = data.tool_name || data.toolName || '';
+    rawArgs = data.tool_input || data.toolInput || {};
+  }
+
+  const norm = normalizeEditToolCall(rawTool, rawArgs);
+  if (!norm || !norm.filePath) {
+    if (isAntigravity) process.stdout.write('{}\n');
+    process.exit(0);
+    return;
+  }
 
-    if (hasValidInlineIgnore(filePath)) { process.exit(0); return; }
+  const resolvedFile = path.isAbsolute(norm.filePath)
+    ? norm.filePath
+    : path.resolve(workspaceRoot, norm.filePath);
+  const ext = path.extname(resolvedFile).slice(1);
+  if (!SOURCE_EXTENSIONS.has(ext)) {
+    if (isAntigravity) process.stdout.write('{}\n');
+    process.exit(0);
+    return;
+  }
 
-    const scanDir = resolveScanDir(filePath, config);
-    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'asc-dedup-'));
+  const config = loadDedupConfig(workspaceRoot);
+  const mappedInput = norm.canonicalTool === 'Edit'
+    ? { new_string: norm.newContent, old_string: norm.oldContent }
+    : { content: norm.newContent };
 
-    const ignoreFlags = (config.ignoreDirs || []).map(function (d) { return '--ignore "' + d + '"'; }).join(' ');
-    const minTokens = config.minTokens || 30;
-    const scanCmd = ' "' + scanDir + '" --min-tokens ' + minTokens
-      + ' --reporters json --silent --output "' + tmpDir + '" ' + ignoreFlags;
+  if (!isQualifyingEdit(norm.canonicalTool, mappedInput, config)) {
+    if (isAntigravity) process.stdout.write('{}\n');
+    process.exit(0);
+    return;
+  }
 
-    const report = runJscpdScan(scanCmd, tmpDir);
-    if (!report) { cleanup(tmpDir); process.exit(0); return; }
+  if (hasValidInlineIgnore(resolvedFile)) {
+    if (isAntigravity) process.stdout.write('{}\n');
+    process.exit(0);
+    return;
+  }
 
-    const finding = checkForDuplicates(report, filePath, config);
-    if (!finding) { cleanup(tmpDir); process.exit(0); return; }
+  const scanDir = resolveScanDir(resolvedFile, config, workspaceRoot);
+  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'asc-dedup-'));
 
-    const nudge = '[ASC Dedup] ' + path.basename(filePath) + ' looks similar to '
-      + finding.matchedFile + ' (' + finding.percent + '% overlap, '
-      + finding.lines + ' lines). Ladder step 2: does the codebase already have this? '
-      + 'Reuse it, or confirm this is intentional.';
+  const ignoreFlags = (config.ignoreDirs || []).map(function (d) { return '--ignore "' + d + '"'; }).join(' ');
+  const minTokens = config.minTokens || 30;
+  const scanCmd = ' "' + scanDir + '" --min-tokens ' + minTokens
+    + ' --reporters json --silent --output "' + tmpDir + '" ' + ignoreFlags;
 
-    if (config.mode === 'block') {
-      emitDeny(nudge, isAntigravity);
-    } else {
-      emitAdvisory(nudge, isAntigravity);
-    }
+  const report = runJscpdScan(scanCmd, tmpDir, workspaceRoot);
+  if (!report) {
+    cleanup(tmpDir);
+    if (isAntigravity) process.stdout.write('{}\n');
+    process.exit(0);
+    return;
+  }
 
+  const finding = checkForDuplicates(report, resolvedFile, config, workspaceRoot);
+  if (!finding) {
     cleanup(tmpDir);
+    if (isAntigravity) process.stdout.write('{}\n');
     process.exit(0);
-  } catch (e) {
+    return;
+  }
+
+  const nudge = '[ASC Dedup] ' + path.basename(resolvedFile) + ' looks similar to '
+    + finding.matchedFile + ' (' + finding.percent + '% overlap, '
+    + finding.lines + ' lines). Ladder step 2: does the codebase already have this? '
+    + 'Reuse it, or confirm this is intentional.';
+
+  cleanup(tmpDir);
+  if (config.mode === 'block') {
+    emitDeny(nudge, isAntigravity);
+  } else {
+    emitAdvisory(nudge, isAntigravity);
+  }
+  process.exit(0);
+}
+
+if (process.stdin.isTTY) {
+  process.exit(0);
+}
+
+process.stdin.setEncoding('utf8');
+process.stdin.on('data', chunk => {
+  inputBuffer += chunk;
+  try {
+    const data = JSON.parse(inputBuffer);
+    handleDedupPayload(data);
+  } catch (_) {
     // incomplete json, wait for more chunks
   }
 });
 
-// Extract tool call details from the Antigravity transcript at a given step index.
-// PostToolUse on Antigravity only provides stepIdx — the actual tool call args
-// must be recovered from the transcript log. Same approach as post-edit-enforce.js.
-function extractToolCallFromTranscript(transcriptPath, stepIdx) {
+process.stdin.on('end', () => {
+  if (handled) return;
+  if (!inputBuffer.trim()) {
+    process.exit(0);
+    return;
+  }
   try {
-    if (!fs.existsSync(transcriptPath)) return null;
-    var lines = fs.readFileSync(transcriptPath, 'utf8').split('\n').filter(Boolean);
-
-    // Find the step with matching step_index that contains tool_calls
-    for (var i = lines.length - 1; i >= 0; i--) {
-      try {
-        var step = JSON.parse(lines[i]);
-        if (step.step_index !== stepIdx || !step.tool_calls) continue;
-
-        for (var j = 0; j < step.tool_calls.length; j++) {
-          var tc = step.tool_calls[j];
-          if (tc.name === 'replace_file_content' || tc.name === 'multi_replace_file_content') {
-            return {
-              toolName: 'Edit',
-              toolInput: {
-                file_path: tc.args.TargetFile || '',
-                new_string: tc.args.ReplacementContent || '',
-                old_string: tc.args.TargetContent || '',
-              },
-            };
-          } else if (tc.name === 'write_to_file') {
-            return {
-              toolName: 'Write',
-              toolInput: {
-                file_path: tc.args.TargetFile || '',
-                content: tc.args.CodeContent || '',
-              },
-            };
-          }
-        }
-      } catch (lineErr) {
-        if (process.env.ASC_DEBUG) {
-          console.error('[ASC Debug] Transcript line parse failed line ' + i + ':', lineErr.message);
-        }
-        // Skip malformed line and keep scanning
-      }
-    }
-    return null;
-  } catch (err) {
-    if (process.env.ASC_DEBUG) {
-      console.error('[ASC Debug] extractToolCallFromTranscript failed:', err.message);
-    }
-    return null;
+    handleDedupPayload(JSON.parse(inputBuffer));
+  } catch (_) {
+    process.exit(0);
   }
-}
+});
 
 function isQualifyingEdit(toolName, toolInput, config) {
   var isWrite = ['Write', 'write_to_file', 'write_file'].indexOf(toolName) !== -1;
-  var isEdit = ['Edit', 'replace_file_content', 'multi_replace_file_content'].indexOf(toolName) !== -1;
+  var isEdit = ['Edit', 'edit_file', 'replace_file_content', 'multi_replace_file_content'].indexOf(toolName) !== -1;
 
   var newFileThreshold = (config && typeof config.NEW_FILE_LINE_THRESHOLD === 'number')
     ? config.NEW_FILE_LINE_THRESHOLD
@@ -225,8 +233,8 @@ function isQualifyingEdit(toolName, toolInput, config) {
   return false;
 }
 
-function resolveScanDir(filePath, config) {
-  var cwd = process.cwd();
+function resolveScanDir(filePath, config, workspaceRoot) {
+  var cwd = workspaceRoot || process.cwd();
 
   // User override takes priority
   if (config.scanRoot) {
@@ -248,10 +256,11 @@ function resolveScanDir(filePath, config) {
   return cwd;
 }
 
-function loadDedupConfig() {
+function loadDedupConfig(workspaceRoot) {
+  var root = workspaceRoot || process.cwd();
   var candidates = [
-    path.join(process.cwd(), '.asc', 'dedup-config.json'),
-    path.join(process.cwd(), '.agents', 'dedup-config.json'),
+    path.join(root, '.asc', 'dedup-config.json'),
+    path.join(root, '.agents', 'dedup-config.json'),
   ];
   for (var i = 0; i < candidates.length; i++) {
     try {
@@ -273,18 +282,20 @@ function loadDedupConfig() {
 
 // minimal: attempt-then-fallback — try scan directly, fall back on failure.
 // No separate --version probes. Upgrade if jscpd provides a stable JS API.
-function runJscpdScan(scanCmd, tmpDir) {
-  var binaries = ['bunx jscpd', 'npx jscpd@5', 'npx jscpd'];
+function runJscpdScan(scanCmd, tmpDir, workspaceRoot) {
+  var cwd = workspaceRoot || process.cwd();
+  var binaries = ['bunx jscpd', 'npx --yes jscpd@5', 'npx --yes jscpd'];
   for (var i = 0; i < binaries.length; i++) {
     try {
       execSync(binaries[i] + scanCmd, {
         timeout: JSCPD_TIMEOUT_MS,
         stdio: 'pipe',
-        cwd: process.cwd(),
+        cwd: cwd,
       });
       return loadReport(tmpDir);
     } catch (_) {
-      // Try next binary
+      var partial = loadReport(tmpDir);
+      if (partial) return partial;
     }
   }
   return null;
@@ -333,7 +344,7 @@ function isAllowedDuplicate(fileA, fileB, allowedDuplicates) {
   return false;
 }
 
-function checkForDuplicates(report, filePath, config) {
+function checkForDuplicates(report, filePath, config, workspaceRoot) {
   var duplicates = report.duplicates || [];
   if (duplicates.length === 0) return null;
 
@@ -354,17 +365,13 @@ function checkForDuplicates(report, filePath, config) {
         continue;
       }
 
-      // Skip framework-conventional filenames in different directories — identical names
-      // are mandated by the framework (e.g. Next.js page.tsx, Angular *.component.ts),
-      // not copy-paste duplication.
       if (isFrameworkConventional(targetBasename)
           && isFrameworkConventional(otherBasename)
           && path.dirname(path.resolve(filePath)) !== path.dirname(path.resolve(otherRaw))) {
         continue;
       }
 
-      // Show relative path instead of bare basename so the developer knows WHICH file.
-      var cwd = process.cwd();
+      var cwd = workspaceRoot || process.cwd();
       var matchedFile = path.relative(cwd, path.resolve(otherRaw)).replace(/\\/g, '/');
       var lines = dup.lines || 0;
       var totalFileLines = 1;
@@ -375,7 +382,6 @@ function checkForDuplicates(report, filePath, config) {
       }
       var percent = Math.round((lines / totalFileLines) * 100);
 
-      // Skip trivial matches (import boilerplate, small overlaps)
       if (lines < 10 && percent < 10) {
         continue;
       }
@@ -408,18 +414,21 @@ function emitAdvisory(nudge, isAntigravity) {
 
 function emitDeny(reason, isAntigravity) {
   if (isAntigravity) {
-    process.stdout.write(JSON.stringify({ decision: 'deny', reason: reason }) + '\n');
-  } else {
     process.stdout.write(JSON.stringify({
-      allow_tool: false,
-      deny_reason: reason,
-      hookSpecificOutput: {
-        hookEventName: 'PostToolUse',
-        permissionDecision: 'deny',
-        permissionDecisionReason: reason,
-      },
+      injectSteps: [{ ephemeralMessage: reason }],
     }) + '\n');
+    process.exit(0);
+    return;
   }
+  process.stdout.write(JSON.stringify({
+    allow_tool: false,
+    deny_reason: reason,
+    hookSpecificOutput: {
+      hookEventName: 'PostToolUse',
+      permissionDecision: 'deny',
+      permissionDecisionReason: reason,
+    },
+  }) + '\n');
   process.exit(2);
 }
 

package/.agents/plugins/agentic-senior-core/hooks/hooks.json

@@ -0,0 +1,97 @@
+{
+  "hooks": {
+    "SessionStart": [
+      {
+        "matcher": "startup|resume|clear|compact",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node hooks/session-start.js",
+            "commandWindows": "node hooks/session-start.js",
+            "timeout": 5,
+            "statusMessage": "Loading ASC rules..."
+          }
+        ]
+      }
+    ],
+    "SubagentStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node hooks/subagent-start.js",
+            "commandWindows": "node hooks/subagent-start.js",
+            "timeout": 5,
+            "statusMessage": "Loading ASC rules..."
+          }
+        ]
+      }
+    ],
+    "PreToolUse": [
+      {
+        "matcher": "Edit|Write|edit_file|replace_file_content|write_to_file|write_file|multi_replace_file_content",
+        "hooks": [
+          {
+            "type": "command",
+            "if": "Edit(**/package.json)|Edit(**/requirements.txt)|Edit(**/pyproject.toml)|Edit(**/go.mod)|Edit(**/Cargo.toml)|Edit(**/Gemfile)",
+            "command": "node hooks/pre-tool-dependency-gate.js",
+            "commandWindows": "node hooks/pre-tool-dependency-gate.js",
+            "timeout": 5,
+            "statusMessage": "ASC Pre-tool dependency check (Edit)..."
+          },
+          {
+            "type": "command",
+            "if": "Write(**/package.json)|Write(**/requirements.txt)|Write(**/pyproject.toml)|Write(**/go.mod)|Write(**/Cargo.toml)|Write(**/Gemfile)",
+            "command": "node hooks/pre-tool-dependency-gate.js",
+            "commandWindows": "node hooks/pre-tool-dependency-gate.js",
+            "timeout": 5,
+            "statusMessage": "ASC Pre-tool dependency check (Write)..."
+          }
+        ]
+      },
+      {
+        "matcher": "Bash|run_command|run_shell_command|terminal|execute_command",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node hooks/pre-tool-dependency-gate.js",
+            "commandWindows": "node hooks/pre-tool-dependency-gate.js",
+            "timeout": 5,
+            "statusMessage": "ASC Pre-tool dependency check (Terminal)..."
+          }
+        ]
+      }
+    ],
+    "PostToolUse": [
+      {
+        "matcher": "Edit|Write|edit_file|replace_file_content|write_to_file|write_file|multi_replace_file_content",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node hooks/post-edit-enforce.js",
+            "commandWindows": "node hooks/post-edit-enforce.js",
+            "timeout": 5,
+            "statusMessage": "ASC ladder & spec gate check..."
+          },
+          {
+            "type": "command",
+            "command": "node hooks/dedup-gate.js",
+            "commandWindows": "node hooks/dedup-gate.js",
+            "timeout": 15,
+            "statusMessage": "ASC duplicate-code scan..."
+          }
+        ]
+      }
+    ],
+    "PreCompact": [
+      {
+        "type": "command",
+        "command": "node hooks/pre-compact-pin.js",
+        "commandWindows": "node hooks/pre-compact-pin.js",
+        "timeout": 5,
+        "statusMessage": "ASC constraint pinning..."
+      }
+    ]
+  }
+}
+

package/.agents/plugins/agentic-senior-core/hooks/ladder-pulse.js

@@ -1,48 +1,65 @@
 #!/usr/bin/env node
 // Agentic Senior Core — PreInvocation ladder persistence hook
-// Counters context rot by re-injecting a short decision-ladder reminder
-// periodically, late in context, rather than relying only on rules/ content
-// that sits at the start of the conversation.
-// Antigravity-only: PreInvocation fires before every model call with
-// invocationNum in the input payload. For other hosts, the equivalent
-// pulse is integrated into post-edit-enforce.js via the sourceEditCount counter.
+// Counters context rot by re-injecting a concise decision-ladder + security pin
+// periodically during long Antigravity sessions.
 
-const { LADDER_PULSE_INTERVAL } = require('./constants.cjs');
+const { getThresholds } = require('./constants.cjs');
+const { resolveWorkspaceRoot } = require('./path-util.cjs');
 
-const LADDER_REMINDER = '[ASC] Ladder check: (1) needed? (2) exists already \u2014 reuse? '
-  + '(3) stdlib/native? (4) existing dep? (5) one function? Then minimal code.';
-
-// Security constraints are negation-type ("never do X") — most vulnerable to context rot
-// per arXiv:2604.20911. Reinject verbatim alongside ladder pulse.
 const SECURITY_REMINDER = '[ASC SECURITY PIN — verbatim, do not paraphrase] '
   + 'NEVER: interpolate input into SQL/shell · commit secrets/tokens/credentials '
   + '· store plaintext passwords · leak stack traces/internals/PII in responses. '
   + 'ALWAYS: parameterize queries · enforce resource-level authz · rate-limit public endpoints.';
 
+if (process.stdin.isTTY) {
+  process.stdout.write('{}\n');
+  process.exit(0);
+}
+
+let handled = false;
 let inputBuffer = '';
-process.stdin.setEncoding('utf8');
-process.stdin.on('data', chunk => {
-    inputBuffer += chunk;
-    try {
-        const payload = JSON.parse(inputBuffer);
-        
-        let shouldInject = false;
-        const invNum = payload.invocationNum || 0;
-        if (invNum > 0 && invNum % LADDER_PULSE_INTERVAL === 0) {
-            shouldInject = true;
-        }
-
-        if (shouldInject) {
-            process.stdout.write(JSON.stringify({
-                injectSteps: [{
-                    ephemeralMessage: `**ASC LADDER PULSE**: You have completed several steps. Remember to review the 1-6 decision ladder. Document deferred debt if you take shortcuts.\n\n${SECURITY_REMINDER}`
-                }]
-            }) + '\n');
-        } else {
-            process.stdout.write('{}\n');
-        }
-        process.exit(0);
-    } catch (e) {
-        // wait for more chunks
+
+function finish(payload) {
+  if (handled) return;
+  handled = true;
+  clearTimeout(timer);
+
+  try {
+    const workspaceRoot = resolveWorkspaceRoot(payload);
+    const thresholds = getThresholds(workspaceRoot);
+    const interval = thresholds.LADDER_PULSE_INTERVAL || 3;
+    const invNum = payload && typeof payload.invocationNum === 'number' ? payload.invocationNum : 0;
+
+    if (invNum > 0 && invNum % interval === 0) {
+      process.stdout.write(JSON.stringify({
+        injectSteps: [{
+          ephemeralMessage: '**ASC LADDER PULSE**: Review the 1-6 decision ladder before writing new abstractions. Document deferred debt if taking shortcuts.\n\n' + SECURITY_REMINDER,
+        }],
+      }) + '\n');
+    } else {
+      process.stdout.write('{}\n');
     }
+  } catch (_) {
+    process.stdout.write('{}\n');
+  }
+  process.exit(0);
+}
+
+const timer = setTimeout(function () { finish(null); }, 2000);
+
+process.stdin.setEncoding('utf8');
+process.stdin.on('data', function (chunk) {
+  inputBuffer += chunk;
+  try {
+    const payload = JSON.parse(inputBuffer);
+    finish(payload);
+  } catch (_) {}
+});
+
+process.stdin.on('end', function () {
+  let payload = null;
+  if (inputBuffer.trim()) {
+    try { payload = JSON.parse(inputBuffer); } catch (_) {}
+  }
+  finish(payload);
 });

package/.agents/plugins/agentic-senior-core/hooks/lib/known-ui-slop-patterns.json

@@ -139,6 +139,26 @@
       "id": "ui-agency-micro-meta",
       "regex": "(?:\\b\\d{1,2}\\.\\d+°\\s*[NSEW]\\b|©\\s*20\\d\\d\\s*—\\s*Scroll)",
       "message": "note: performative agency metadata (geographic coordinates, fake version/scroll stamps) detected. Remove ornamental meta."
+    },
+    {
+      "id": "copy-ai-buzzwords",
+      "regex": "\\b(seamlessly?|robust(?:ness)?|empowers?|supercharg(?:ed?|ing)|cutting-edge|next-generation|blazing-fast|effortlessly?)\\b",
+      "message": "note: generic AI buzzword detected ('seamless', 'robust', 'supercharge', 'cutting-edge'). Use plain operational verbs and concrete metrics."
+    },
+    {
+      "id": "copy-cadence-tricolon",
+      "regex": "\\b[A-Z][a-z]+\\.\\s+[A-Z][a-z]+\\.\\s+[A-Z][a-z]+\\.",
+      "message": "note: tricolon cadence detected ('Word. Word. Word.'). State the capability or outcome directly instead of using advertising triplets."
+    },
+    {
+      "id": "copy-cadence-rebuttal",
+      "regex": "\\b(Not (?:just )?a|More than a) \\w+[,.] (?:it's|a) \\w+\\b",
+      "message": "note: synthetic rebuttal cadence ('Not just a X, it\\'s a Y') detected. State what the system does directly without the false dichotomy."
+    },
+    {
+      "id": "copy-filler-preamble",
+      "regex": "\\b(In today's (?:fast-paced|digital)|Built for (?:the )?modern teams?|Welcome to the)\\b",
+      "message": "note: AI preamble/filler detected ('In today\\'s fast-paced...', 'Built for modern teams'). Delete the introductory throat-clearing and lead with action."
     }
   ]
 }