@ryuenn3123/agentic-senior-core 6.16.3 → 6.16.5

package/.agents/plugins/agentic-senior-core/skills/asc-pentest/references/pentest-task-tree.md

@@ -0,0 +1,70 @@
+# The Pentesting Task Tree (PTT) Protocol
+
+Derived from the USENIX Security architecture of **PentestGPT**. Prevents conversational context drift and maintains rigorous state tracking across multi-turn security engagements.
+
+---
+
+## 1. Task Taxonomies
+
+Every security evaluation action must map to one of six explicit task kinds:
+
+| Task Kind | Intent & Scope | Entry Criteria | Exit Criteria |
+|---|---|---|---|
+| **`DISCOVER`** | Network and surface mapping. Extract routes, ports, endpoints, and authentication schemes from source or running app. | Target URL / source repository provided. | Exhaustive inventory of accessible routes and protocols documented in session ledger. |
+| **`ENUMERATE`** | Parameter and contract analysis. Identify parameter types, required fields, and boundary expectations per route. | Route inventory established. | Input vectors mapped (query parameters, body schema, headers, cookies). |
+| **`TEST`** | Dynamic vulnerability probing. Execute targeted fuzzing, payload injection, or authorization checks. | Target parameters identified. | Target behavior analyzed; anomalies (5xx errors, reflection, unauthorized data) logged. |
+| **`EXPLOIT`** | Proof-of-exploit verification. Formulate a minimal, non-destructive reproduction proving the vulnerability is real. | Anomaly confirmed under `TEST`. | Deterministic `curl` script or test assertion proving the vulnerability exists. |
+| **`VERIFY`** | Patch verification. Re-run the reproduction script after developer code remediation. | Code patch applied. | Reproduction script fails (vulnerability successfully mitigated). |
+| **`RECOVER`** | Environment restoration. Purge canary entities, tokens, or temporary records injected during testing. | Engagement complete or failed. | Database and filesystem confirmed clean of canary records. |
+
+---
+
+## 2. Task State Transitions
+
+Tasks progress through a deterministic state machine:
+
+```
+┌─────────┐      Dependencies Met      ┌─────────┐      Execution Start      ┌──────────┐
+│ BLOCKED │ ─────────────────────────► │  READY  │ ────────────────────────► │  ACTIVE  │
+└─────────┘                            └─────────┘                           └────┬─────┘
+                                                                                  │
+                                            ┌─────────────────────────────────────┴──────────┐
+                                            ▼                                                ▼
+                                       ┌─────────┐                                      ┌──────────┐
+                                       │  DONE   │                                      │  FAILED  │
+                                       └─────────┘                                      └──────────┘
+```
+
+- **`BLOCKED`**: Prerequisites (e.g. valid auth token, route discovery) not yet satisfied.
+- **`READY`**: All `depends_on` tasks have reached `DONE`.
+- **`ACTIVE`**: Currently executing under a single task lease.
+- **`DONE`**: Target objective fulfilled; basis artifacts recorded.
+- **`FAILED`**: Execution failed or payload rejected; requires recovery or strategy adaptation.
+
+---
+
+## 3. Session Ledger Format (`scratch/pentest-session.md`)
+
+When executing an engagement spanning more than 2 steps, initialize a session ledger in the scratch directory:
+
+```markdown
+# Pentest Session Ledger: [Target Name]
+Target URL: http://localhost:8000
+Session Started: YYYY-MM-DD HH:MM:SS
+
+## Active Task Tree
+- [x] T01 [DISCOVER]: Route inventory from src/routes/ (DONE)
+- [x] T02 [ENUMERATE]: Parameter mapping on /api/v1/invoices/:id (DONE)
+- [x] T03 [TEST]: BOLA check with secondary tenant token (DONE)
+- [ ] T04 [EXPLOIT]: Minimal curl proof demonstrating horizontal data leakage (ACTIVE)
+- [ ] T05 [VERIFY]: Re-check after authorization policy middleware applied (BLOCKED on T04)
+- [ ] T06 [RECOVER]: Purge canary tenant records from test database (BLOCKED on T05)
+
+## Findings Ledger
+### F01: BOLA on GET /api/v1/invoices/:id
+- Severity: CRITICAL
+- Location: routes/invoices.js:45
+- Finding: Route queries DB by `id` directly without filtering by `tenant_id` from auth context.
+- Evidence: Peer B token successfully retrieved Invoice #1042 owned by Tenant A.
+```
+

package/.agents/plugins/agentic-senior-core/skills/asc-review/SKILL.md

@@ -32,7 +32,7 @@ Use when reviewing PRs, diffs, commits, or newly written feature code.
 ### Review Procedure
 1. **Scope Inspection**: Run `git diff --stat` (or `git status`) to inspect modified files and line deltas.
 2. **Test-Change Correlation**: For every modified application logic file, verify that a corresponding test was updated. If logic changed without tests, flag as missing test coverage.
-3. **Deterministic Verification**: Run project linter and test suite (`ascx test` / `npm test`). Confirm exit code 0 fresh.
+3. **Deterministic Verification**: Run project linter and test suite (`ascx npm test`). Confirm exit code 0 fresh.
 4. **Severity Priority Order**:
    - **Severity 1 (Critical)**: Correctness, data corruption, auth/permission bypass, security sinks, PII leakage.
    - **Severity 2 (High)**: Action feedback failures (hanging spinners, unhandled mutations, missing error boundaries), unhandled async rejections, missing remote timeouts.

package/.agents/plugins/agentic-senior-core/skills/asc-test/SKILL.md

@@ -33,6 +33,9 @@ Before writing tests, running suites, or claiming verification:
 1. **Mandatory Ingestion (BLOCKING GATE):** Call `read_file` on the tier reference matching your testing requirement BEFORE taking action:
    - Writing unit tests / TDD cycle ➔ `references/tdd-cycle.md`
    - Behavior testing, boundary isolation, mocks/fakes ➔ `references/test-design.md`
+   - Generative property invariants & fuzzing ➔ `references/property-testing.md`
+   - Mutation testing & assertion integrity ➔ `references/mutation-testing.md`
+   - Concurrency latency & performance budgets ➔ `references/performance-budgets.md`
    - Playwright browser tests, locators, page objects ➔ `references/e2e-playwright.md`
    - Acceptance criteria, UAT checklists, edge case quads ➔ `references/uat.md`
    - Bug reproduction, root-cause verification, regression proof ➔ `references/regression-proof.md`
@@ -104,6 +107,9 @@ Select the lowest testing tier that validates the requirement:
 |---|---|
 | Red-Green-Refactor mechanics & whole-suite checks | `references/tdd-cycle.md` |
 | Behavior testing, boundary isolation & mocking | `references/test-design.md` |
+| Generative property invariants & boundary fuzzing | `references/property-testing.md` |
+| Mutation integrity score (>= 80%) & mutant triage | `references/mutation-testing.md` |
+| Latency budgets (p95 <= 150ms) & concurrency benchmarking | `references/performance-budgets.md` |
 | Playwright E2E, reconnaissance & locator hierarchy | `references/e2e-playwright.md` |
 | Given/When/Then acceptance criteria & edge case quad | `references/uat.md` |
 | 3-step bugfix verification & regression proof | `references/regression-proof.md` |
@@ -118,5 +124,6 @@ Before declaring any coding or testing task complete:
 2. **Regression Proof:** For bugfixes, confirm the test failed without the fix and passes with it.
 3. **Whole-Suite Run:** Execute the full test suite (`ascx npm test` or project test runner); confirm exit code 0.
 4. **No Assertions Weakened:** Verify no existing test assertions were deleted or commented out to simulate success.
-5. **Hermetic State:** Ensure tests clean up temporary files, database records, and environment variables.
+5. **Mutation Sanity:** For critical authorization or business logic, verify tests catch condition inversion.
+6. **Hermetic State:** Ensure tests clean up temporary files, database records, and environment variables.
 

package/.agents/plugins/agentic-senior-core/skills/asc-test/references/mutation-testing.md

@@ -0,0 +1,55 @@
+# Mutation Testing & Test Suite Integrity
+
+Staff-grade guidelines for mutation testing and eradicating false-positive test suites. Grounded in the principles of **Stryker Mutator**.
+
+---
+
+## 1. The Fallacy of Code Coverage
+
+Code coverage (line, branch, or statement coverage) measures only what code was executed; it does **not** measure whether assertions were made:
+```javascript
+// A test with 100% line coverage and ZERO verification value:
+it('calculates invoice total', () => {
+  const result = calculateTotal(mockCart);
+  // No assertions! Or weak assertion: assert.ok(result);
+});
+```
+Such tests give false confidence: business logic can break completely while 100% of tests continue to pass.
+
+**Mutation testing** tests the test suite: it introduces small synthetic defects (**mutants**) into the production code. If your tests fail, the mutant is **killed** (good). If your tests pass despite the corrupted logic, the mutant **survives** (flawed test coverage).
+
+---
+
+## 2. Standard Mutant Operators
+
+| Mutant Class | Original Code | Mutated Code | Verification Test Expectation |
+|---|---|---|---|
+| **Equality Operator** | `if (user.role === 'admin')` | `if (user.role !== 'admin')` | Test asserting admin access must fail immediately. |
+| **Relational Boundary** | `if (balance >= price)` | `if (balance > price)` | Boundary test where `balance === price` must fail. |
+| **Logical Connector** | `if (hasToken && isValid)` | `if (hasToken \|\| isValid)` | Test with valid token and invalid state must fail. |
+| **Return Constant** | `return totalAmount;` | `return 0;` or `return null;` | Result consumer assertion must fail. |
+| **Statement Deletion** | `await auditLog.record(event);` | `/* deleted */` | Audit persistence assertion must fail. |
+
+---
+
+## 3. The Mutation Integrity Score
+
+$$\text{Mutation Score} = \left( \frac{\text{Killed Mutants}}{\text{Total Mutants}} \right) \times 100\%$$
+
+- **Target Threshold**: Core business logic, pricing, authorization checks, and security boundaries must achieve a Mutation Score of $\ge 80\%$.
+- **Survived Mutant Triage**:
+  - Every survived mutant indicates an untested boundary or missing assertion.
+  - Fix: Do not modify production code; write a specific failure assertion that kills the surviving mutant.
+
+---
+
+## 4. The Agentic Mutant Sanity Check
+
+When introducing or refactoring a critical function (e.g. auth check, payment math, permissions):
+1. **Identify the core decision branch** (e.g. `if (isAuthorized) return allow();`).
+2. **Inject a manual mutant**: temporarily invert the condition (`if (!isAuthorized)`).
+3. **Run the test runner**:
+   - If tests still pass $\to$ **FLAG AS CRITICAL TEST DEFECT**. Your tests are not testing the logic.
+   - Add the missing negative test case until the mutant is killed.
+4. **Revert the mutant** and confirm the full test suite turns green.
+

package/.agents/plugins/agentic-senior-core/skills/asc-test/references/performance-budgets.md

@@ -0,0 +1,67 @@
+# Performance Budgets & Concurrency Benchmarking
+
+Staff-grade guidelines for performance testing, latency budgets, and concurrency verification. Grounded in the principles of **Grafana k6**.
+
+---
+
+## 1. Latency Budgets & Percentiles
+
+Averages mask performance degradation. A service with an average response time of $50\text{ms}$ can still have $10\%$ of users waiting over $1,500\text{ms}$. Performance must be budgeted and measured using **percentiles**:
+
+| Metric | Target Standard | Operational Context |
+|---|---|---|
+| **Unit Logic Runtime** | $\le 5\text{ms}$ | Pure algorithms, mathematical transforms, string parsers. |
+| **$p_{50}$ (Median Latency)** | $\le 50\text{ms}$ | Standard read operations with warm database index. |
+| **$p_{95}$ (95th Percentile)** | $\le 150\text{ms}$ | 95 out of 100 requests must complete under this budget. |
+| **$p_{99}$ (Worst-case Tail)** | $\le 300\text{ms}$ | Tail latency under concurrency and database lock contention. |
+| **Error Rate Threshold** | Strictly $0.00\%$ | Zero 5xx errors or dropped socket connections under target load. |
+
+---
+
+## 2. Micro-Benchmark Concurrency Harness
+
+For critical endpoints, verify concurrency resilience using a native script before handoff:
+
+```javascript
+import assert from 'node:assert/strict';
+
+async function benchmarkEndpoint(url, concurrentRequests = 10, totalRequests = 50) {
+  const durations = [];
+  const runBatch = async () => {
+    const start = performance.now();
+    const res = await fetch(url);
+    const duration = performance.now() - start;
+    assert.equal(res.status, 200, `Expected 200, got ${res.status}`);
+    durations.push(duration);
+  };
+
+  // Run in chunks of `concurrentRequests`
+  for (let i = 0; i < totalRequests; i += concurrentRequests) {
+    await Promise.all(Array.from({ length: concurrentRequests }, runBatch));
+  }
+
+  durations.sort((a, b) => a - b);
+  const p50 = durations[Math.floor(durations.length * 0.50)];
+  const p95 = durations[Math.floor(durations.length * 0.95)];
+
+  console.log(`Benchmark: N=${totalRequests} | p50=${p50.toFixed(1)}ms | p95=${p95.toFixed(1)}ms`);
+  assert.ok(p95 <= 150, `p95 exceeded budget: ${p95.toFixed(1)}ms > 150ms`);
+}
+```
+
+---
+
+## 3. Memory Leak & Garbage Collection Invariants
+
+Under sustained request loops, memory footprint must reach a steady plateau rather than growing monotonically:
+
+1. **Heap Growth Check**:
+   - Record `process.memoryUsage().heapUsed` before iteration loop.
+   - Run $1,000$ iterations of the business operation.
+   - Trigger garbage collection (or sample at $N=1000$).
+   - Assert heap growth is bounded ($\le 10\%$ increase from baseline).
+2. **Common Culprits**:
+   - Global event listeners (`emitter.on()`) attached inside request handlers without removal.
+   - Unbounded in-memory caches or map accumulators without LRU eviction.
+   - Retained references inside closures of unresolved promises.
+

package/.agents/plugins/agentic-senior-core/skills/asc-test/references/property-testing.md

@@ -0,0 +1,72 @@
+# Generative Property-Based Testing & Invariant Fuzzing
+
+Staff-grade guidelines for property-based testing and generative fuzzing. Grounded in the principles of **Hypothesis** and **fast-check**.
+
+---
+
+## 1. Example-Based vs. Property-Based Testing
+
+Standard unit tests validate specific, hand-picked examples:
+```javascript
+// Example-based: tests 1 trivial scenario
+assert.equal(parsePrice("$19.99"), 1999);
+```
+Example-based tests suffer from confirmation bias: developers only test inputs they already anticipate.
+
+**Property-based testing** flips the testing paradigm: you define universal system **invariants** (truths that must hold for ALL possible inputs), and the engine executes hundreds or thousands of randomized boundary inputs to prove or disprove the property:
+```javascript
+import fc from 'fast-check';
+
+// Property-based: tests 100+ generated inputs across extreme boundaries
+fc.assert(
+  fc.property(fc.integer({ min: 0, max: 1000000 }), (cents) => {
+    const formatted = formatCurrency(cents);
+    return parseCurrency(formatted) === cents; // Invariant: round-trip fidelity
+  })
+);
+```
+
+---
+
+## 2. Core Invariant Archetypes
+
+Every complex business module should be tested against at least one of these four invariant patterns:
+
+| Invariant Pattern | Definition | Canonical Example |
+|---|---|---|
+| **Round-Trip (Serialization)** | Transforming $A \to B \to A$ preserves exact identity. | `deserialize(serialize(record)) === record`<br>`base64Decode(base64Encode(data)) === data` |
+| **Idempotence** | Applying an operation multiple times yields the same result as applying it once. | `format(format(input)) === format(input)`<br>`cleanHtml(cleanHtml(dirty)) === cleanHtml(dirty)` |
+| **Crash Invariance (No 5xx)** | No valid or invalid input shall trigger an unhandled exception or server crash. | For any generated string $s$, `parseAddress(s)` returns a parsed object OR a safe `ValidationFailure` without throwing uncaught errors. |
+| **Monotonicity & Invariance** | Mathematical or business logic ordering invariants. | Adding an item to a cart never decreases the cart subtotal (`subtotal(cart + item) >= subtotal(cart)`). |
+
+---
+
+## 3. Boundary Input Generators
+
+When testing pure functions or data transformations, generators must evaluate pathological boundary inputs:
+
+1. **Numeric Boundaries**:
+   - `0`, `-0`, `1`, `-1`
+   - `Number.MIN_SAFE_INTEGER`, `Number.MAX_SAFE_INTEGER`
+   - `Infinity`, `-Infinity`, `NaN`
+   - Floating-point precision traps (`0.1 + 0.2`)
+2. **String Boundaries**:
+   - Empty string `""`
+   - Strings with null bytes (`"canary\0danger"`)
+   - Unicode RTL override characters (`\u202E`) and emojis
+   - Extremely large strings ($10^5$ characters)
+   - Unpaired surrogate halves (`\uD800`)
+3. **Collection & Tree Boundaries**:
+   - Empty arrays `[]`, single-element `[x]`, arrays with duplicates `[x, x]`.
+   - Deeply nested objects (depth $> 30$).
+   - Objects with prototype poisoning keys (`__proto__`, `constructor`).
+
+---
+
+## 4. Failure Shrinking
+
+When a property test fails on a massive random input (e.g. an array of 500 items containing a string of 4,000 characters), the property testing runner automatically **shrinks** the failure down to the minimal counterexample that still reproduces the bug (e.g. `['\0']`).
+
+**Operational Rule**:
+When documenting a property test failure, always report the **minimal shrunk counterexample** rather than the full randomized run seed.
+

package/.agents/plugins/agentic-senior-core/skills/asc-ui/SKILL.md

@@ -30,6 +30,9 @@ Every UI edit must satisfy these 15 rules without exception:
 14. **Single-language purity:** Never mix languages on one surface; ban hybrid neologisms (`di-submit`, `meng-generate`).
 15. **Icon semantics:** Never use raw unicode or emojis as icons. Use dedicated SVG icons; mark decorative icons `aria-hidden="true"`.
 16. **Substance over restraint:** Stripping slop is only half the job. Replace removed ornaments with real substance: strong typographic scale contrast, full-field color anchors, and authentic interface fragments. Never leave an empty, sterile wireframe void.
+17. **Product over skill (No geek cosplay):** The real-world domain dictates aesthetics. Never inject terminal windows, ASCII art, or pseudo-telemetry consoles into civic, educational, or commercial products (`references/modes/genre-calibration.md`).
+18. **The Purpose-Gate:** Every component, widget, or scorecard must enable an actual user task. Never invent unearned widgets, sliders, or simulated feeds without real business data.
+19. **Anti-card-soup invariant:** Never wrap structural layout sections (header, nav, rails, tables) into floating rounded card islands. Use a Unified Spatial Canvas with hairline dividers (`divide-y`, `border-r`). Cards are strictly for discrete, interchangeable items (`references/divergence.md`).
 
 ---
 
@@ -42,13 +45,10 @@ Before declaring markup, drafting redesign plans, or inspecting user code:
    `<skill_directory>/references/<category>/<file>.md`
    Identify the path of this `SKILL.md` file (provided by host/tooling) and resolve all reference paths relative to it.
 
-2. **Step 1 — Surface Mode Ingestion (MANDATORY GATE):**
-   Classify the surface and execute `read_file` on the corresponding mode reference BEFORE inspecting files or writing code:
-   - Dashboards, settings, data tables, developer tools ➔ `references/modes/operate.md`
-   - Landing pages, pricing tiers, conversion flows ➔ `references/modes/persuade.md`
-   - Documentation, changelogs, knowledge bases ➔ `references/modes/read.md`
-   - Showcases, portfolios, interactive galleries ➔ `references/modes/experience.md`
-   *Do NOT proceed until you have read the mode reference into context.*
+2. **Step 1 — Two-Phase Enforcement Gate (MANDATORY GATE):**
+   - **Phase A (Structure & Hierarchy First):** Lock project domain genre (Civic, Enterprise, SaaS, DevTools) and read `references/modes/genre-calibration.md` + target mode reference (`references/modes/<mode>.md`). Lock the primary focal anchor and spatial posture before writing code.
+   - **Phase B (Visual System & Themes):** Read `references/craft/themes-catalog.md` and lock one of the 16 curated themes across 8 real-world domains (e.g., Sovereign Slate, Almanac Index, Editorial Ledger, Pharmacy Calm, Ink & Signal, Graphite Instrument) to prevent probabilistic palette slop.
+   *Do NOT proceed until you have read the genre, mode, and theme references into context.*
 
 3. **Step 2 — Secondary Craft Ingestion:**
    Execute `read_file` on at least one relevant craft reference for your task from Section 5 (e.g. `references/craft/typography.md`, `references/craft/color-surfaces.md`, or `references/divergence.md`).
@@ -79,7 +79,7 @@ Visual posture is governed by the surface type, not product branding. Every surf
 Never split the difference into cosmetic polish on a discarded look:
 - **Polish / Refinement:** Preserves layout structure, DOM hierarchy, and design tokens. Resolves contrast, missing state quad, microcopy, and lint issues.
 - **Restyle:** Preserves layout geometry. Replaces color tokens, typographic scales, corner radiuses, and elevation shadows.
-- **Full Redesign:** Replaces entire spatial geometry and posture. Mandatory decoupled protocol: extract data/contracts first, discard old DOM, author standalone preview (`asc preview <path>`), build fresh geometry, re-bind dynamic data.
+- **Full Redesign:** Replaces entire spatial geometry and posture. Mandatory decoupled protocol: extract data/contracts first, discard old DOM, establish clear spatial posture and theme tokens, and compile directly to production files with complete layout coherence.
 
 ---
 
@@ -90,6 +90,8 @@ Never split the difference into cosmetic polish on a discarded look:
 
 | Target Domain / Task Requirement | Mandatory Reference Path |
 |---|---|
+| Domain & genre calibration (Anti-geek cosplay) | `references/modes/genre-calibration.md` |
+| Curated material themes & locked art direction | `references/craft/themes-catalog.md` |
 | Waivable defaults & waiver syntax | `references/reflexes.md` |
 | Typography, line-height & tabular numbers | `references/craft/typography.md` |
 | Color tokens, 60-30-10 & elevation | `references/craft/color-surfaces.md` |
@@ -99,7 +101,7 @@ Never split the difference into cosmetic polish on a discarded look:
 | Responsive reflow, dvh & touch targets | `references/mobile-responsive.md` |
 | WCAG 2.2 AA contrast & keyboard operability | `references/accessibility.md` |
 | The Data State Quad & mutation feedback | `references/states-feedback.md` |
-| Anti-convergence, 3 Waves of Tells & Mirror Test | `references/divergence.md` |
+| Anti-convergence, 4 Waves of Tells & Mirror Test | `references/divergence.md` |
 | Structured UI audit matrix | `references/redesign-audit.md` |
 
 ---
@@ -107,8 +109,9 @@ Never split the difference into cosmetic polish on a discarded look:
 ## 6. Verification & Handoff Sweep
 
 Before completing any UI task, run this mechanical check:
-1. **Reference Compliance:** Confirm constraints from the loaded `references/modes/<mode>.md` and craft references were strictly applied.
-2. **State Quad:** Loading skeleton, empty state, error with retry, and populated data are all handled.
-3. **Pending Feedback:** Buttons disable and display feedback during ongoing mutations.
-4. **Contrast & Focus:** Verify keyboard tab flow and high-contrast `:focus-visible` styling.
-5. **Lint Check:** Verify changes against `hooks/lib/known-ui-slop-patterns.json`.
+1. **Reference Compliance:** Confirm constraints from `references/modes/genre-calibration.md`, `references/craft/themes-catalog.md`, and target mode were strictly applied.
+2. **Finish Gate Sweep:** Verify zero text clipping (+30% expansion buffer), zero awkward text wraps, and 4px/8px spacing grid consistency.
+3. **State Quad:** Loading skeleton, empty state, error with retry, and populated data are all handled.
+4. **Pending Feedback:** Buttons disable and display feedback during ongoing mutations.
+5. **Contrast & Focus:** Verify keyboard tab flow and high-contrast `:focus-visible` styling.
+6. **Lint Check:** Verify changes against `hooks/lib/known-ui-slop-patterns.json`.

package/.agents/plugins/agentic-senior-core/skills/asc-ui/references/craft/color-surfaces.md

@@ -47,3 +47,28 @@ Grounded in: Apple HIG, Google Material Design 3, and Refactoring UI Color Strat
   - When placing secondary text on a colored or dark surface, tint the text using the parent background hue or foreground token (`text-primary-foreground/70`).
   - **Never use neutral gray text (`text-slate-400`) on a saturated or colored background.** It produces a muddy, dirty optical illusion.
 
+---
+
+## 4. Integrated Scorecards & Metric Blocks (Anti-Sticker Invariant)
+
+- **Ban The Sticker Box:** Never place an isolated white box with a thin border floating inside an already white or light header canvas. This creates an optical "detached sticker" artifact.
+- **Anchor Into Layout Chrome:**
+  - Integrate scorecards directly into the identity header rail or stage banner using a unified divider (`border-l border-border/80 pl-6`) or structural inset well (`bg-muted/40`).
+- **Semantic Tinting for Evaluation Scores:**
+  - When communicating aggregate grades (e.g. `84,20 / 100`, Predikat B):
+    - Background: subtle semantic tint (`bg-emerald-500/10` or `bg-slate-500/10`).
+    - Border: matching tinted hairline (`border border-emerald-500/20`).
+    - Typography: tabular numbers (`font-mono tabular-nums`) with clear contrast ($Display \ge 3.5\times Body$).
+  - Always position the grading scale key (e.g. `A > 85, B 71-85`) in immediate secondary proximity as muted metadata.
+
+---
+
+## 5. Contextual Inline Alerts & Callouts (The Callout Invariant)
+
+- **Never Float Warning Text Adrift:** Warning notes, disclaimers, or temporary state alerts must NEVER be dumped as raw floating text between layout sections.
+- **The Callout Invariant:** Every alert must reside in a structured callout container:
+  - Container: 1px hairline border with matching light background tint (e.g. `border border-amber-500/30 bg-amber-500/10 rounded-md p-3`).
+  - Icon Anchor: Dedicated semantic SVG icon (alert circle, triangle) aligned with first line of text.
+  - Placement: Positioned immediately above or inside the data table/form it modifies, establishing unmistakable contextual binding.
+
+

package/.agents/plugins/agentic-senior-core/skills/asc-ui/references/craft/themes-catalog.md

@@ -0,0 +1,198 @@
+# Curated Design Themes Catalog (16 Production Material Systems)
+
+> **Core Invariant:** Never allow an LLM to invent an ad-hoc color palette or arbitrary font pairing from scratch. Unconstrained models converge onto the statistical median: muddy slate-indigo, generic SaaS card soup, or gimmick cosplay. Lock visual styling to one of **16 verified, domain-calibrated material themes** across **8 real-world software domains** (2 contrasting directions per domain).
+
+---
+
+## 1. Domain Matrix (8 Domains × 2 Contrasting Directions)
+
+Select the domain matching the product's real-world purpose, then pick one of its two contrasting material directions so consecutive projects never converge onto a single look:
+
+| Domain | Option A (Cool / Crisp / Structural) | Option B (Warm / Tactile / Editorial) |
+|---|---|---|
+| **1. Civic, Academic & Institutional** | `01. Sovereign Slate` | `02. Almanac Index` |
+| **2. Financial, ERP & Operations** | `03. Editorial Ledger` | `04. Warm Stationery` |
+| **3. Healthcare, Clinical & Care** | `05. Pharmacy Calm` | `06. Clinical Precision` |
+| **4. Commercial B2B SaaS & Platforms** | `07. Ink & Signal` | `08. Obsidian Stage` |
+| **5. Developer Tools, Observability & Security** | `09. Graphite Instrument` | `10. Technical Whiteprint` |
+| **6. Commerce, Hospitality, Craft & Hardware** | `11. Atelier Gallery` | `12. Kinetic Grid` |
+| **7. Editorial, Publishing, EdTech & Knowledge** | `13. Studio Proof` | `14. Botanical Field` |
+| **8. Industrial, Logistics, Construction & Geo** | `15. Formwork Concrete` | `16. Meridian Survey` |
+
+---
+
+## 2. Anti-Gimmick Exclusion Filter (Why Cosplay Themes Are Banned)
+
+External theme packs frequently confuse novelty with craft—producing a **second wave of AI slop** that breaks usability and production budgets. The following patterns are strictly excluded from ASC:
+1. **Cosplay & Novelty Surfaces:** Medieval blackletter parchment, green/amber CRT phosphor scanlines, two-drum pink/blue risograph with no black ink, torn-paper edges, and die-cut sticker outlines.
+2. **Decorative Runtime Shaders:** Mandatory `<canvas>` or WebGL background noise fields, drifting particle hazes, and SVG `feTurbulence` grain overlays sitting over running body text.
+3. **Broken Font & Asset Dependencies:** Fontshare-only families (`Sentient`, `General Sans`, `Switzer`, `Cabinet Grotesk`, `Boska`, `Chillax`, `Ranade`) that 404 on Google Fonts CDNs, and unbundled local texture URLs (`url("cotton.svg")`). Every font in this catalog is verified on Google Fonts with clean system fallbacks.
+4. **Low-Contrast Mid-Tone Grounds:** Raw `70%` grey or `35%` saturated blue full-app drenches that fail WCAG 2.2 AA `4.5:1` contrast on secondary metadata.
+
+---
+
+## 3. Domain 1 — Civic, Academic & Institutional
+
+### `01. Sovereign Slate`
+*Best for: School evaluations (SAURAN), accreditation dossiers, compliance portals, municipal registries.*
+- **Surface Tokens:** Canvas `#f8fafc` (`oklch(98.4% 0.003 248)`) · Sheet `#ffffff` · Rail `#f1f5f9` · Rule `1px solid #e2e8f0`
+- **Ink Tokens:** Primary `#0f172a` · Secondary `#334155` · Muted `#64748b`
+- **Accent & Semantic:** Deep Pine `#0f766e` (`oklch(51% 0.096 186)`), Soft `#f0fdfa` · Status: Emerald `#047857`, Amber `#b45309`, Rose `#be123c`
+- **Typography:** Display & UI `Plus Jakarta Sans` (600/700 heads, 400/500 body) · Numeric `JetBrains Mono` (`tabular-nums`)
+- **Geometry & Posture:** Unified Spatial Canvas (`0px` sheet divisions, `6px` control radius). Left verification rail + right primary data table. Zero floating card islands.
+
+### `02. Almanac Index`
+*Best for: University catalogs, public archives, policy repositories, judicial & regulatory filings.*
+- **Surface Tokens:** Canvas `#f7f4ed` (`oklch(96.6% 0.012 85)`) · Sheet `#fcfbf8` · Subtle `#efeae0` · Rule `1px solid #ded8cb` (Section head rule: `2px solid #1f1d1a`)
+- **Ink Tokens:** Primary `#1f1d1a` · Secondary `#3d3934` · Muted `#666057`
+- **Accent & Semantic:** Terracotta Seal `#b4532a` (`oklch(53% 0.14 38)`), Soft `#fdf2ed`
+- **Typography:** Display `Newsreader` (500/600, `-0.02em`) · Body & UI `Source Sans 3` (400/600) · Index/Filing IDs `IBM Plex Mono`
+- **Geometry & Posture:** Archival index sheet (`4px` control radius, zero drop shadows at rest). Heavy `2px` ink top-bars anchor tables and statutory sections; hairline rules separate rows.
+
+---
+
+## 4. Domain 2 — Financial, ERP & Operations
+
+### `03. Editorial Ledger`
+*Best for: Accounting systems, treasury consoles, ERP inventory, institutional billing, audit ledgers.*
+- **Surface Tokens:** Canvas `#ffffff` · Sub-surface / Striping `#f9fafb` (`oklch(98.5% 0.002 247)`) · Rule `1px solid #e5e7eb`
+- **Ink Tokens:** Primary `#111827` · Secondary `#374151` · Muted `#6b7280`
+- **Accent & Semantic:** Sovereign Navy `#1e3a8a` (`oklch(38% 0.14 262)`), Soft `#eff6ff` · Variance: Positive `#047857`, Negative `#b91c1c`
+- **Typography:** Display & UI `Inter` (600 heads, 400/500 body) · Figures `IBM Plex Mono` (`tabular-nums`, right-aligned quantitative columns)
+- **Geometry & Posture:** Edge-to-edge sticky-header tables (`10px–12px` vertical cell padding, `6px` control radius) with 65/35 master-detail inspector Drawer/Rail.
+
+### `04. Warm Stationery`
+*Best for: Private banking, advisory portfolios, payroll & compensation portals, procurement workflows.*
+- **Surface Tokens:** Canvas `#faf7f2` (`oklch(97.5% 0.009 80)`) · Sheet `#ffffff` · Subtle `#f2ede4` · Rule `1px solid #e4ddd1`
+- **Ink Tokens:** Primary `#231f1c` · Secondary `#443e38` · Muted `#6e655d`
+- **Accent & Semantic:** Deep Forest `#166534` (`oklch(44% 0.11 152)`), Soft `#f0fdf4`
+- **Typography:** Display & Totals `Instrument Serif` (400, `-0.015em`) · UI & Tables `DM Sans` (400/500/600) · Figures `DM Mono` (`tabular-nums`)
+- **Geometry & Posture:** Calm ledger sheet (`8px` radius on inputs/wells, `1px` warm hairline borders, zero shadow on resting panels).
+
+---
+
+## 5. Domain 3 — Healthcare, Clinical & Care
+
+### `05. Pharmacy Calm`
+*Best for: Patient portals, telehealth scheduling, pharmacy fulfillment, mental health & wellness care.*
+- **Surface Tokens:** Canvas `#f6f7f4` (`oklch(97.2% 0.008 135)`) · Sheet `#ffffff` · Subtle `#ebeee7` · Rule `1px solid #dce1d6`
+- **Ink Tokens:** Primary `#18221e` · Secondary `#33423c` · Muted `#596b63`
+- **Accent & Semantic:** Apothecary Eucalyptus `#0d6e5b` (`oklch(48% 0.095 172)`), Soft `#ecfdf5`
+- **Typography:** Display `Outfit` (600, `-0.02em`) · Clinical Body `Public Sans` (400/500, `1.55` line-height) · Dosages & Times `JetBrains Mono`
+- **Geometry & Posture:** Generous breathing room (`10px` control/surface radius, `1px` crisp borders, clear progressive step flows, high-legibility medication and appointment timelines).
+
+### `06. Clinical Precision`
+*Best for: Electronic Health Records (EHR), lab diagnostics, radiology worklists, ICU/ward triage.*
+- **Surface Tokens:** Canvas `#f8fafc` · Worklist `#ffffff` · Header/Rail `#f1f5f9` · Rule `1px solid #cbd5e1`
+- **Ink Tokens:** Primary `#0b1324` · Secondary `#283548` · Muted `#526277`
+- **Accent & Semantic:** Diagnostic Cerulean `#0369a1` (`oklch(50% 0.12 238)`), Soft `#f0f9ff` · Out-of-range flag: `#b91c1c` (always paired with explicit `H`/`L` symbol, never color alone)
+- **Typography:** UI `IBM Plex Sans` (400/500/600) · Vitals, Reference Ranges & Timestamps `IBM Plex Mono` (`tabular-nums`)
+- **Geometry & Posture:** High-density patient banner pinned top, `4px` tight radius, zero decorative imagery, instant keyboard/row triage.
+
+---
+
+## 6. Domain 4 — Commercial B2B SaaS & Platforms
+
+### `07. Ink & Signal`
+*Best for: Collaborative workspaces, CRM, project trackers, service desks, multi-tenant B2B apps.*
+- **Surface Tokens:** Canvas `#fcfcfc` (`oklch(99.2% 0.002 100)`) · Well `#f5f5f4` · Subtle `#ebebea` · Rule `1px solid #e4e4e2`
+- **Ink Tokens:** Primary `#171717` (`oklch(16% 0 0)`) · Secondary `#383838` · Muted `#666666`
+- **Accent & Semantic:** Chromatic Teal `#0d7477` (`oklch(50% 0.095 190)`), Soft `#e6f6f6`
+- **Typography:** Display `Epilogue` (700, `-0.035em`) · Body & Controls `Inter` (400/500/600) · IDs & Counts `IBM Plex Mono`
+- **Geometry & Posture:** Hueless carbon ink on clean paper; teal marks only active/open state and primary CTA (`8px` control radius, `12px` wells, shadow reserved strictly for floating popovers/dialogs).
+
+### `08. Obsidian Stage`
+*Best for: Media production suites, AI creative workflows, high-contrast SaaS launches, real-time analytics.*
+- **Surface Tokens:** Canvas `#09090b` (`oklch(14% 0.005 270)`) · Elevated `#121216` · Subtle `#1c1c22` · Rule `1px solid #27272a`
+- **Ink Tokens:** Primary `#fafafa` · Secondary `#d4d4d8` · Muted `#a1a1aa`
+- **Accent & Semantic:** Cobalt Signal `#3b82f6` (`oklch(62% 0.19 258)`), Soft `rgba(59, 130, 246, 0.14)`
+- **Typography:** Display `Space Grotesk` (600/700, `-0.03em`) · Body `Plus Jakarta Sans` (400/500) · Telemetry `JetBrains Mono`
+- **Geometry & Posture:** Precision dark surface separated strictly by `1px solid #27272a` keylines and luminance steps (`8px` radius). Zero purple/indigo neon blooms or glowing card borders.
+
+---
+
+## 7. Domain 5 — Developer Tools, Observability & Security
+
+### `09. Graphite Instrument`
+*Best for: Log explorers, APM tracing, DAST/pentest consoles, database studios, CI/CD pipelines.*
+- **Surface Tokens:** Canvas `#0d1117` (`oklch(17.5% 0.012 255)`) · Pane `#161b22` · Subtle `#21262d` · Rule `1px solid #30363d`
+- **Ink Tokens:** Primary `#e6edf3` · Secondary `#b1bac4` · Muted `#8b949e`
+- **Accent & Semantic:** Amber Telemetry `#f59e0b` (`oklch(75% 0.16 75)` — dark ink `#0d1117` on filled buttons), Soft `rgba(245, 158, 11, 0.14)` · Severity: Critical `#f85149`, High `#db6d28`, Low `#3fb950`
+- **Typography:** UI `IBM Plex Sans` (400/500/600) · Logs, Payloads, Traces & Queries `JetBrains Mono` (`tabular-nums`)
+- **Geometry & Posture:** Keyboard-first multi-pane workbench (`4px` radius, `Cmd+K` bar, split log/trace inspector, zero marketing ornament).
+
+### `10. Technical Whiteprint`
+*Best for: API documentation, architecture registries, CAD/spec viewers, schema & hardware documentation.*
+- **Surface Tokens:** Canvas `#f4f7fb` (`oklch(97.2% 0.008 245)`) · Sheet `#ffffff` · Subtle `#e8eef6` · Rule `1px solid #cbd5e1` (Major register rule: `2px solid #13294b`)
+- **Ink Tokens:** Primary `#13294b` (Prussian Ink) · Secondary `#2c4469` · Muted `#566d8e`
+- **Accent & Semantic:** Drafting Cobalt `#1d4ed8` (`oklch(49% 0.19 260)`), Soft `#dbeafe`
+- **Typography:** Display `Chakra Petch` (600, `-0.015em`) · Prose & UI `IBM Plex Sans` (400/500) · Specs, Endpoints & Units `IBM Plex Mono`
+- **Geometry & Posture:** Square `0px` drafted keylines, specification register tables, dual-rail documentation layout with crisp code/parameter blocks.
+
+---
+
+## 8. Domain 6 — Commerce, Hospitality, Craft & Hardware
+
+### `11. Atelier Gallery`
+*Best for: Architecture studios, boutique hospitality, furniture/ceramics commerce, specialty roasters, galleries.*
+- **Surface Tokens:** Canvas `#f4f0e8` (`oklch(95.5% 0.012 78)`) · Card Stock `#faf8f4` · Subtle `#eae4d8` · Rule `1px solid #dcd4c5`
+- **Ink Tokens:** Primary `#241d18` (Deep Umber) · Secondary `#463b33` · Muted `#6e6055`
+- **Accent & Semantic:** Slate Ultramarine `#334e68` (`oklch(41% 0.075 248)`), Soft `#eaeff5`
+- **Typography:** Display `Cormorant Garamond` (500/600, `-0.018em`, line-height `1.06`) · Body, Wall Labels & Checkout `Hanken Grotesk` (400/500/600) · Prices/Editions `Hanken Grotesk` (`tabular-nums`)
+- **Geometry & Posture:** Crisp `2px` gallery corners, generous daylight imagery with captions placed cleanly beneath (never overlaid on cluttered gradients), quiet ruled specification tables.
+
+### `12. Kinetic Grid`
+*Best for: Athletic gear, consumer electronics, ticketing & live events, fitness/training platforms, automotive.*
+- **Surface Tokens:** Canvas `#f7f7f5` · Plate `#ffffff` · Subtle `#ededeb` · Rule `1px solid #d6d6d2` (Section header bar: `2px solid #111111`)
+- **Ink Tokens:** Primary `#111111` · Secondary `#333333` · Muted `#636360`
+- **Accent & Semantic:** Vermilion Signal `#dc2626` (`oklch(56% 0.21 27)`), Soft `#fef2f2`
+- **Typography:** Display & Scoreboards `Barlow Condensed` (700 uppercase, `-0.01em`) · Body & Controls `Archivo` (400/500/600) · Splits, SKUs & Specs `JetBrains Mono`
+- **Geometry & Posture:** High-contrast Swiss structural grid (`4px` radius), bold typographic hierarchy, crisp inventory/size matrices, zero soft pastel washes.
+
+---
+
+## 9. Domain 7 — Editorial, Publishing, EdTech & Knowledge
+
+### `13. Studio Proof`
+*Best for: Digital publications, research journals, documentation hubs, writing studios, legal analysis.*
+- **Surface Tokens:** Canvas `#f9f7f1` (`oklch(97.5% 0.010 90)`) · Reading Sheet `#ffffff` · Subtle `#f0ece1` · Rule `1px solid #e0dacb`
+- **Ink Tokens:** Primary `#1c1917` · Secondary `#3f3a36` · Muted `#6b635b`
+- **Accent & Semantic:** Editorial Crimson `#9f1239` (`oklch(45% 0.17 15)`), Soft `#fff1f2`
+- **Typography:** Display `Fraunces` (600, `-0.02em`) · Long-form Prose `Source Serif 4` (`65ch–72ch` measure, `1.65` line-height) · UI Chrome & TOC `Work Sans` (400/500/600)
+- **Geometry & Posture:** Distraction-free reading column flanked by receding table-of-contents and citation/footnote margin rails (`4px` radius).
+
+### `14. Botanical Field`
+*Best for: EdTech courses, language & science learning, sustainability/climate platforms, community libraries.*
+- **Surface Tokens:** Canvas `#f4f6f0` (`oklch(96.6% 0.012 125)`) · Sheet `#ffffff` · Subtle `#e7ece0` · Rule `1px solid #d5ddd0`
+- **Ink Tokens:** Primary `#1c241b` · Secondary `#374436` · Muted `#5c6b5a`
+- **Accent & Semantic:** Warm Ochre `#b45309` (`oklch(53% 0.14 55)`), Soft `#fef3c7` · Completion: Forest `#15803d`
+- **Typography:** Display `Libre Baskerville` (400/700) · Learning UI & Exercises `Figtree` (400/500/600) · Curriculum Codes & Progress `IBM Plex Mono`
+- **Geometry & Posture:** Structured syllabus rail + focused lesson canvas (`10px` radius, clear progress milestones, tactile quietness without childish gamification).
+
+---
+
+## 10. Domain 8 — Industrial, Logistics, Construction & Geospatial
+
+### `15. Formwork Concrete`
+*Best for: Construction management, field engineering, manufacturing MES, warehouse WMS, heavy equipment.*
+- **Surface Tokens:** Canvas `#eeece6` (`oklch(94.2% 0.008 82)`) · Work Plate `#f9f8f5` · Subtle `#e2dfd7` · Rule `1px solid #cbc7bc` (Plate top-bar: `3px solid #18181b`)
+- **Ink Tokens:** Primary `#18181b` · Secondary `#36363a` · Muted `#575652`
+- **Accent & Semantic:** Safety Orange `#c2410c` (`oklch(52% 0.18 38)` — passes WCAG AA `4.5:1` with `#ffffff` button ink), Soft `#ffedd5`
+- **Typography:** Display `Oswald` (600/700, `-0.005em`) · UI & Field Forms `Archivo` (400/500/600) · Tolerances, Tonnage & Lot IDs `IBM Plex Mono` (`tabular-nums`)
+- **Geometry & Posture:** Square `0px` board-cast edges, high-target field controls (`>= 44px`), unambiguous work-order status plates.
+
+### `16. Meridian Survey`
+*Best for: Fleet dispatch, supply chain & freight tracking, GIS/geospatial consoles, energy & utility grids.*
+- **Surface Tokens:** Canvas `#f3f5f7` (`oklch(96.5% 0.005 235)`) · Map/Data Overlay `#ffffff` · Subtle `#e5e9ef` · Rule `1px solid #cfd6e0`
+- **Ink Tokens:** Primary `#0f172a` · Secondary `#2d3a4f` · Muted `#58677e`
+- **Accent & Semantic:** Survey Teal `#0f766e` (`oklch(51% 0.096 186)`), Waypoint Alert `#b45309`, Soft `#f0fdfa`
+- **Typography:** Display `Sora` (600, `-0.02em`) · Dispatch UI `Public Sans` (400/500/600) · Coordinates, ETAs & Manifests `JetBrains Mono` (`tabular-nums`)
+- **Geometry & Posture:** Split canvas (geospatial/timeline viewport + docked high-density manifest drawer, `6px` radius, crisp `1px` keylines).
+
+---
+
+## 11. Selection & Lock Protocol
+
+1. **Match Domain First:** Map the user's product to one of the 8 domains in Section 1. Never cross-contaminate genres (e.g., never apply `09. Graphite Instrument` dark terminal aesthetics to `01. Sovereign Slate` civic portals).
+2. **Alternate Within Domain:** Choose between Option A (cool/structural) and Option B (warm/editorial) based on brand tone or to diverge from recent builds.
+3. **Declare Lock Explicitly:** State `THEME LOCKED: <ID. Name>` during pre-flight and translate all tokens into CSS custom properties (`--bg-canvas`, `--bg-surface`, `--text-ink`, `--border-rule`, `--accent-primary`) before writing component markup.