@ryuenn3123/agentic-senior-core 6.9.0 → 6.11.0

package/.agents/plugins/agentic-senior-core/skills/asc-debt/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: asc-debt
 description: >
-  Trigger this skill when the user says: "log this debt", "skip this for now", "defer this fix", "note this smell", "track this violation", "add to debt ledger", "we'll fix this later", "accept the shortcut", "I know this is bad but", "just do it for now", "TODO later". Also trigger when an ASC ladder nudge fires and the user accepts the shortcut rather than fixing it — log the deferred violation for later resolution.
+  Trigger this skill when the user says: "log this debt", "skip this for now", "defer this fix", "note this smell", "track this violation", "add to debt ledger", "we'll fix this later", "accept the shortcut", "I know this is bad but", "just do it for now", "TODO later", "catat debt", "skip dulu", "nanti aja benerinnya", "tunda perbaikan", "catat ini buat nanti". Also trigger when an ASC ladder nudge fires and the user accepts the shortcut rather than fixing it — log the deferred violation for later resolution. Do NOT trigger for actively resolving or refactoring existing debt items (use asc-refactor instead).
 ---
 
 # Debt Ledger
@@ -12,13 +12,23 @@ Grounded in: Cunningham's technical debt metaphor (1992). Entry format (ladder s
 
 ## Storage
 
-Entries persist in `.agent-context/state/debt-ledger.json` via MCP `state_read`/`state_write`. The ledger is a JSON array of entry objects.
+Entries persist in `.agent-context/state/debt-ledger.json` (or `.asc/debt-ledger.json`) via standard file read/write operations. The ledger is a JSON array of entry objects.
+
+## Stub Convention
+
+When introducing a temporary stub during development, mark it explicitly:
+```typescript
+// ASC-STUB: [reason for temporary code] [ASC-DEBT-001]
+```
+(or `# ASC-STUB: [reason] [ASC-DEBT-001]` in Python/Ruby).
+
+Every stub marker in source code MUST reference an open debt ID. Unregistered stubs will be blocked by the Git pre-commit runner.
 
 ## Entry Format
 
 ```json
 {
-  "id": "sequential integer",
+  "id": "sequential integer (or ASC-DEBT-xxx)",
   "file": "path/to/file.ts",
   "ladderStep": "3",
   "violation": "Added axios — stdlib fetch covers this",
@@ -34,14 +44,14 @@ Entries persist in `.agent-context/state/debt-ledger.json` via MCP `state_read`/
 
 When an enforcement nudge fires and the violation is deferred:
 
-1. Read the current ledger via `state_read` (path: `debt-ledger.json`). If missing, start with `[]`.
+1. Read the current ledger from `.agent-context/state/debt-ledger.json`. If missing, start with `[]`.
 2. Append a new entry with the next sequential `id`, the file path, ladder step, and a one-line violation summary.
-3. Write the updated ledger via `state_write` (path: `debt-ledger.json`, mode: `overwrite`).
+3. Write the updated ledger back to disk.
 4. Confirm: "Logged to debt ledger: [violation summary]"
 
 ### List Open Debt
 
-1. Read the ledger via `state_read`.
+1. Read the ledger.
 2. Filter to entries where `status` is `"open"`.
 3. Display as a table: ID, file, ladder step, violation, age.
 4. If no open entries, say so explicitly.

package/.agents/plugins/agentic-senior-core/skills/asc-dedup/SKILL.md

@@ -9,7 +9,8 @@ description: >
   "isn't this a copy of", "cari kode duplikat", "ini kok sama kayak yang itu",
   "ini udah ada kan". Use for whole-repo or whole-directory duplication
   audits on demand — this is a deep, on-demand scan, distinct from the
-  continuous per-edit check already enforced by the dedup-gate hook.
+  continuous per-edit check already enforced by the dedup-gate hook. Do NOT
+  trigger for general code restructuring or refactoring without duplication/clone audit focus (use asc-refactor instead).
 ---
 
 # Duplicate Code Audit

package/.agents/plugins/agentic-senior-core/skills/asc-fingerprint/SKILL.md

@@ -2,9 +2,10 @@
 name: asc-fingerprint
 description: >
   Trigger this skill when the user says: "map this codebase", "what are our conventions",
-  "document our patterns", "onboard to this repo", "fingerprint this repository", or
-  "learn this repository structure". Use it before substantial work in an unfamiliar
-  repository or when feature research repeatedly rediscovers the same conventions.
+  "document our patterns", "onboard to this repo", "fingerprint this repository",
+  "learn this repository structure", "petakan codebase", "pelajari struktur repo",
+  "apa aturan arsitektur di sini", "kebiasaan coding repo ini apa". Use it before substantial work in an unfamiliar
+  repository or when feature research repeatedly rediscovers the same conventions. Do NOT trigger for simple file finding or code searches within single files.
 ---
 
 # Repository Fingerprinting

package/.agents/plugins/agentic-senior-core/skills/asc-learn/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: asc-learn
 description: >
-  Trigger this skill when the user says: "learn this preference", "don't do this again", "remember my preference", "log this rule", "add to my design rules", "never use X", "always use Y for UI", "save this preference", "remember this style". Also trigger when mining explicit user corrections from conversation history to update adaptive preferences.
+  Trigger this skill when the user says: "learn this preference", "don't do this again", "remember my preference", "log this rule", "add to my design rules", "never use X", "always use Y for UI", "save this preference", "remember this style", "ingat preferensi ini", "jangan lakuin ini lagi", "catat aturan ini", "simpan gaya ini". Also trigger when mining explicit user corrections from conversation history to update adaptive preferences. Do NOT trigger for initial day-one design rule bootstrapping or cold start wizard (use asc-bootstrap instead).
 ---
 
 # Adaptive Preference Miner (`asc-learn`)

package/.agents/plugins/agentic-senior-core/skills/asc-new-project/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: asc-new-project
 description: >
-  Trigger this skill when the user says: "new project", "start from scratch", "scaffold this", "bootstrap project", "bootstrap repository", "bootstrap new app", "create a new app", "init a project", "set up a new repo", "greenfield", "plan the architecture", "design the system", "build me an app", "start a new codebase", "I want to build", "let's create". Also trigger for any request to create a new codebase, plan a new system architecture, or scaffold a new repository from zero. Do NOT trigger for UI style preference onboarding (use asc-bootstrap instead).
+  Trigger this skill when the user says: "new project", "start from scratch", "scaffold this", "bootstrap project", "bootstrap repository", "bootstrap new app", "create a new app", "init a project", "set up a new repo", "greenfield", "plan the architecture", "design the system", "build me an app", "start a new codebase", "I want to build", "let's create", "bikin project baru", "buat aplikasi baru", "scaffold repo baru", "mulai dari awal". Also trigger for any request to create a new codebase, plan a new system architecture, or scaffold a new repository from zero. Do NOT trigger for adding features, routes, or components to an existing codebase (use asc-add-feature instead), or for UI style preference onboarding (use asc-bootstrap instead).
 ---
 
 # New Project Workflow

package/.agents/plugins/agentic-senior-core/skills/asc-refactor/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: asc-refactor
 description: >
-  Trigger this skill when the user says: "refactor this", "clean up this code", "improve this structure", "rewrite this", "extract this into", "reduce duplication", "apply DRY", "apply SOLID", "migrate this", "simplify this module", "split this file", "decompose this", "this is messy", "make this cleaner", "too much coupling", "move this logic". Also trigger for any request to restructure, modernize, or improve code organization without changing behavior.
+  Trigger this skill when the user says: "refactor this", "clean up this code", "improve this structure", "rewrite this", "extract this into", "reduce duplication", "apply DRY", "apply SOLID", "migrate this", "simplify this module", "split this file", "decompose this", "this is messy", "make this cleaner", "too much coupling", "move this logic", "rapikan kode ini", "bersihin kodingan", "refactor ini", "perbaiki struktur kodingan". Also trigger for any request to restructure, modernize, or improve code organization without changing behavior. Do NOT trigger for building new features from scratch or greenfield projects (use asc-add-feature or asc-new-project instead).
 ---
 
 # Refactor Skill
@@ -24,17 +24,16 @@ Removing speculative code is the highest-value, lowest-risk refactor type.
 After reading the target code, classify the refactor:
 
 - **Low-level** (rename, extract method, type safety, dead code removal): proceed after explaining the change. No approval gate needed.
-- **High-level** (move module, change architecture, redesign abstractions, multi-file structural changes): output a plan with specific files and rationale, then **stop and wait for user approval** before implementing.
-
-**Known limitation:** The high-level refactor gate is a skill-text instruction — the agent self-classifies and self-stops. Unlike `/asc-add-feature` and `/asc-new-project`, this gate is not backed by the PostToolUse hook or workflow-gate.json. If the agent bypasses the gate, there is no automated nudge.
+- **High-level** (move module, change architecture, redesign abstractions, multi-file structural changes): write `workflow-gate.json` with `{"workflow": "asc-refactor", "phase": "plan"}`, output a plan with specific files and rationale, then **stop and wait for user approval** before implementing.
 
 ## Before Editing
 
-1. Read the target code and understand existing patterns.
-2. Identify the smallest relevant scope for the refactor.
-3. Classify the refactor (see above). If high-level, stop and present a plan.
-4. If the change touches UI, check accessibility and responsive behavior.
-5. If the change touches dependencies, verify current official docs.
+1. **Verify Baseline**: Run project test runner (`ascx test`, `npm test`, or equivalent). Do not refactor on failing tests.
+2. Read the target code and understand existing patterns.
+3. Identify the smallest relevant scope for the refactor.
+4. Classify the refactor (see above). For high-level refactors, update `workflow-gate.json` to phase `implement` only after user approval.
+5. If the change touches UI, check accessibility and responsive behavior.
+6. If the change touches dependencies, verify current official docs.
 
 ## Refactor Rules
 

package/.agents/plugins/agentic-senior-core/skills/asc-reference/SKILL.md

@@ -40,9 +40,10 @@ Grounded in: WCAG 2.2 AA (accessibility), Fowler's Money Pattern (monetary types
 ## Frontend
 
 - Match the project's existing styling paradigm (Tailwind, CSS Modules, Vanilla CSS, styled-components, etc.). Do not introduce a new CSS framework or build tool without explicit user confirmation.
-- Semantic HTML before custom components.
-- WCAG 2.2 AA is the accessibility floor.
-- Responsive by default. Handle empty, loading, error, and offline states.
+- UI Component Reusability: Primitive UI elements (buttons, inputs, cards, dialogs, badges) must have a single source of truth in the shared component directory (`components/` or `ui/`). Never recreate ad-hoc variants or duplicate JSX structures across individual pages. Extend existing components with props or variants instead of cloning.
+- Design Consistency: Consume shared design tokens, CSS variables, or theme configuration for colors, spacing, and border-radius. Do not hardcode arbitrary raw color hexes or inconsistent spacing that causes visual design drift between pages.
+- Data-fetching components must explicitly handle 3 states: loading, error (with user-facing toast/notification and retry option), and data. Never leave an unhandled error state.
+- WCAG 2.2 AA accessibility floor. Responsive by default.
 - No placeholder, lorem, or TODO content in production UI.
 
 ## Infrastructure
@@ -59,10 +60,3 @@ Grounded in: WCAG 2.2 AA (accessibility), Fowler's Money Pattern (monetary types
 - Circuit breakers for unhealthy dependencies.
 - Graceful degradation on non-critical dependency failure.
 
-## Naming
-
-- Variables and properties are nouns: `userList`, `pageCount`, not `getUser`.
-- Functions and methods are verbs: `calculateTotal`, `fetchUsers`, not `total`.
-- Booleans prefixed with `is`/`has`/`can`: `isValid`, `hasPermission`.
-- Constants in UPPER_SNAKE_CASE: `MAX_RETRIES`, `API_BASE_URL`.
-- Follow the casing convention of the language and existing codebase. When starting fresh, use the community default for that language.

package/.agents/plugins/agentic-senior-core/skills/asc-review/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: asc-review
 description: >
-  Trigger this skill when the user says: "review this code", "check this PR", "what's wrong with this", "look at my changes", "critique this", "is this production-ready", "review my pull request", "find bugs", "check for issues", "any problems here", "does this look right", "sanity check this". Also trigger for any request to evaluate code quality, analyze recent commits, or assess production risks in existing code. Also trigger when editing or viewing diff output, PR descriptions, or code review comments. For deep penetration testing, threat modeling, or OWASP compliance audits, use asc-audit instead.
+  Trigger this skill when the user says: "review this code", "check this PR", "what's wrong with this", "look at my changes", "critique this", "is this production-ready", "review my pull request", "find bugs", "check for issues", "any problems here", "does this look right", "sanity check this", "review PR ini", "cek kodingan saya", "ada masalah ga di kode ini", "tolong review perubahan ini". Also trigger for any request to evaluate code quality, analyze recent commits, or assess production risks in existing code. Also trigger when editing or viewing diff output, PR descriptions, or code review comments. For deep penetration testing, threat modeling, or OWASP compliance audits, use asc-audit instead.
 ---
 
 # Review Skill
@@ -10,12 +10,13 @@ Production-risk code review. Prioritize findings by severity.
 
 Grounded in: OWASP Risk Rating Methodology, Google Engineering Practices (code review guide), Clean Architecture (transport vs business layer separation).
 
-## Before Reviewing
+## Review Procedure (Empirical First)
 
-1. Read the changed files and understand the scope.
-2. For UI changes, check accessibility and design consistency.
-3. For API changes, check contract stability and documentation sync.
-4. Walk the decision ladder for each new file or dependency: does this need to exist, could the stdlib or an existing dependency handle it?
+1. **Establish Scope**: Run `git diff --stat` (or `git status`) to inspect the exact set of changed files and line deltas.
+2. **Test-Change Correlation**: For every modified application source file, check if a corresponding test file was updated. If application logic changed without test updates, flag as Severity 3 ("Missing tests for changed behavior").
+3. **Run Deterministic Checks**: Run the project linter and test suite (`ascx test` / `npm test`). Do not evaluate architectural quality on a failing test suite.
+4. **Security & Invariants Scan**: Check for unverified `ASC-STUB:`, hardcoded credentials, or empty catch blocks in the diff.
+5. **Contract & Hierarchy**: Walk the decision ladder for each new file or dependency: does this need to exist, could the stdlib or an existing dependency handle it?
 
 ## Finding Priority Order
 

package/README.md

@@ -134,7 +134,8 @@ Supports both `.husky/` (appends without overwriting) and `.git/hooks/` (direct
 - **[Installation & Supported Hosts](docs/INSTALLATION.md)** - Setup instructions for Claude Code, Copilot, Antigravity, Cursor, Windsurf, Zed, Aider, and more.
 - **[Configuration Overrides](docs/CONFIGURATION.md)** - How to use `.asc/dedup-config.json` and `.asc/dependency-allowlist.json`.
 - **[Architecture & Philosophy](docs/ARCHITECTURE.md)** - How the hooks work, our engineering principles, and Migration guide from v4.x.
-- **[Benchmarks](benchmarks/RESULTS.md)** - ASC produces **18% less code**, uses **30% fewer tokens**, costs **42% less**, and finishes **18% faster**.
+- **[Benchmarks](benchmarks/RESULTS.md)** - Directional results (n=1-2 per task, single model): on complex tasks ASC trended toward **~18% less code** and **~12-30% fewer tokens**. Indicative, not statistically conclusive — see the methodology for the planned n>=5 validation.
+- **[Grounding](docs/GROUNDING.md)** - Full verified citations behind every rule.
 
 ---
 

package/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-senior-core",
-  "version": "6.9.0",
+  "version": "6.11.0",
   "description": "Universal AI coding rules. Write code like a staff engineer.",
   "author": "fatidaprilian",
   "license": "MIT",

package/lib/cli/ascx/runtime.mjs

@@ -162,6 +162,32 @@ export async function runAscx(commandArguments, options = {}) {
     shell: classification.kind === 'unsafe-for-compression',
   });
 
+  // ASC_CACHE_SAFE=1: near-passthrough mode. PointFive (arXiv:2607.12161, 2,908
+  // paired runs) found aggressive output compression can raise total billed cost
+  // by breaking prompt-cache locality; only minimal compression was cost-neutral.
+  // This mode emits raw output plus the cost-audit footer so billed cost can be
+  // compared against default compression without uninstalling ascx.
+  if (process.env.ASC_CACHE_SAFE === '1') {
+    const footer = buildAscxFooter({
+      classification: `${classification.kind} (cache-safe passthrough)`,
+      commandText: parsedCommand.commandText,
+      compactOutput: capture.stdout,
+      exitCode: capture.exitCode,
+      filterName: 'none (cache-safe)',
+      rawOutput: combineOutput(capture.stdout, capture.stderr),
+      rawTeePath: null,
+    });
+    return {
+      stdout: `${capture.stdout}\n\n${footer.text}\n`,
+      stderr: capture.stderr,
+      exitCode: capture.exitCode,
+      parsedCommand,
+      classification,
+      compressed: false,
+      rawTeePath: null,
+    };
+  }
+
   if (classification.kind !== 'compressible') {
     return {
       stdout: capture.stdout,

package/lib/cli/commands/git-hook-generator.mjs

@@ -202,6 +202,33 @@ function checkLargeFiles(stagedFiles, cwd, maxSizeKB) {
   }
 }
 
+function checkStubsAndTodos(stagedFiles, cwd) {
+  var STUB_REGEX = /(?:\\/\\/|#|\\/\\*)\\s*ASC-STUB:(?!.*\\b(ASC-DEBT|#\\d+|[A-Z]+-\\d+)\\b)/i;
+  var MOCK_SUCCESS_REGEX = /(?:return\\s*\\{\\s*success:\\s*true\\s*\\}|return\\s*True|return\\s*true|return\\s*nil)\\s*;?\\s*(?:\\/\\/|#).*?(mock|fake|stub|placeholder)/i;
+
+  for (var i = 0; i < stagedFiles.length; i++) {
+    var ext = path.extname(stagedFiles[i]).slice(1).toLowerCase();
+    if (!SOURCE_EXTENSIONS.has(ext)) continue;
+    try {
+      var content = fs.readFileSync(path.resolve(cwd, stagedFiles[i]), 'utf8');
+      var lines = content.split('\\n');
+      for (var l = 0; l < lines.length; l++) {
+        var line = lines[l];
+        if (STUB_REGEX.test(line)) {
+          console.error('\\x1b[31m[ASC Stub Gate]\\x1b[0m Unverified stub detected in ' + stagedFiles[i] + ' line ' + (l + 1) + ': ' + line.trim());
+          console.error('\\x1b[33mCommit blocked. Stubs must carry a tracked debt ID: // ASC-STUB: [reason] [ASC-DEBT-xxx]. Use git commit --no-verify to bypass.\\x1b[0m');
+          process.exit(1);
+        }
+        if (MOCK_SUCCESS_REGEX.test(line)) {
+          console.error('\\x1b[31m[ASC Fake-Done Gate]\\x1b[0m Simulated success return detected in ' + stagedFiles[i] + ' line ' + (l + 1) + ': ' + line.trim());
+          console.error('\\x1b[33mCommit blocked. Never commit hardcoded mock success returns mimicking live integration. Use git commit --no-verify to bypass.\\x1b[0m');
+          process.exit(1);
+        }
+      }
+    } catch (_) {}
+  }
+}
+
 function runJscpdScan(scanCmd, cwd, tmpDir) {
   const binaries = ['bunx jscpd', 'npx jscpd@5', 'npx jscpd'];
   for (let i = 0; i < binaries.length; i++) {
@@ -318,6 +345,7 @@ function runPreCommitGate() {
   checkSecrets(stagedFiles, cwd);
   checkMergeConflictMarkers(stagedFiles, cwd);
   checkLargeFiles(stagedFiles, cwd, config.maxFileSizeKB);
+  checkStubsAndTodos(stagedFiles, cwd);
 
   // 2. Filter staged files by SOURCE_EXTENSIONS for dedup scan
   const stagedSourceFiles = stagedFiles.filter(f => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ryuenn3123/agentic-senior-core",
-  "version": "6.9.0",
+  "version": "6.11.0",
   "type": "module",
   "description": "Agentic Senior Core: Universal AI coding rules and workflows. Write code like a staff engineer, not a junior.",
   "bin": {

package/plugin.yaml

@@ -1,5 +1,5 @@
 name: agentic-senior-core
-version: 6.9.0
+version: 6.11.0
 description: Universal AI coding rules. Write code like a staff engineer.
 author: fatidaprilian
 provides_hooks:
@@ -12,15 +12,18 @@ provides_commands:
   - asc-new-project
   - asc-add-feature
   - asc-adapter
+  - asc-dedup
   - asc-help
 provides_skills:
   - asc
   - asc-adapter
   - asc-add-feature
   - asc-audit
+  - asc-bootstrap
   - asc-debt
   - asc-dedup
   - asc-fingerprint
+  - asc-learn
   - asc-new-project
   - asc-refactor
   - asc-reference