@softspark/ai-toolkit 2.8.0 → 2.10.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (45) hide show
  1. package/AGENTS.md +31 -31
  2. package/CHANGELOG.md +29 -1
  3. package/README.md +4 -5
  4. package/app/.claude-plugin/plugin.json +1 -1
  5. package/app/agents/system-governor.md +98 -8
  6. package/app/constitution.md +7 -1
  7. package/app/rules/common/coding-style.md +12 -2
  8. package/app/skills/api-patterns/SKILL.md +1 -1
  9. package/app/skills/app-builder/SKILL.md +1 -1
  10. package/app/skills/architecture-decision/SKILL.md +1 -1
  11. package/app/skills/ci-cd-patterns/SKILL.md +1 -1
  12. package/app/skills/clean-code/SKILL.md +6 -1
  13. package/app/skills/csharp-patterns/SKILL.md +1 -1
  14. package/app/skills/database-patterns/SKILL.md +1 -1
  15. package/app/skills/debugging-tactics/SKILL.md +1 -1
  16. package/app/skills/design-engineering/SKILL.md +1 -1
  17. package/app/skills/docker-devops/SKILL.md +1 -1
  18. package/app/skills/documentation-standards/SKILL.md +1 -1
  19. package/app/skills/ecommerce-patterns/SKILL.md +1 -1
  20. package/app/skills/flutter-patterns/SKILL.md +1 -1
  21. package/app/skills/git-mastery/SKILL.md +1 -1
  22. package/app/skills/hive-mind/SKILL.md +1 -1
  23. package/app/skills/java-patterns/SKILL.md +1 -1
  24. package/app/skills/kotlin-patterns/SKILL.md +1 -1
  25. package/app/skills/mcp-patterns/SKILL.md +1 -1
  26. package/app/skills/migration-patterns/SKILL.md +1 -1
  27. package/app/skills/observability-patterns/SKILL.md +1 -1
  28. package/app/skills/performance-profiling/SKILL.md +1 -1
  29. package/app/skills/plan-writing/SKILL.md +1 -1
  30. package/app/skills/rag-patterns/SKILL.md +1 -1
  31. package/app/skills/refactor-plan/SKILL.md +1 -0
  32. package/app/skills/research-mastery/SKILL.md +1 -1
  33. package/app/skills/ruby-patterns/SKILL.md +1 -1
  34. package/app/skills/rust-patterns/SKILL.md +1 -1
  35. package/app/skills/security-patterns/SKILL.md +1 -1
  36. package/app/skills/swift-patterns/SKILL.md +1 -1
  37. package/app/skills/testing-patterns/SKILL.md +1 -1
  38. package/app/skills/typescript-patterns/SKILL.md +1 -1
  39. package/app/skills/verification-before-completion/SKILL.md +7 -0
  40. package/kb/procedures/release-preparation-sop.md +72 -15
  41. package/kb/procedures/release-verification-sop.md +82 -7
  42. package/llms-full.txt +184 -52
  43. package/manifest.json +1 -1
  44. package/package.json +1 -1
  45. package/scripts/audit_skills.py +68 -0
package/AGENTS.md CHANGED
@@ -358,7 +358,7 @@ Search engine optimization specialist. Trigger words: SEO, search engine, meta t
358
358
 
359
359
  The Guardian of the Constitution. Validates all evolutionary changes and enforces immutable rules. Has VETO power.
360
360
 
361
- **Tools:** `Read, Write, Bash`
361
+ **Tools:** `Read, Write, Bash, Grep, Glob`
362
362
 
363
363
  ---
364
364
 
@@ -449,68 +449,68 @@ Skills are invocable commands or auto-loaded knowledge sources:
449
449
  - **a11y-validate**: Validate code against accessibility standards: WCAG 2.1 Level AA, EN 301 549, and the European Accessibility Act (EAA / Directive EU 2019/882). Covers semantics, text alternatives, keyboard/focus, color/contrast, forms, media, ARIA, motion, mobile, and EAA documentation requirements. Framework-aware (React/Next/Nuxt/Astro/Gatsby/SvelteKit/Remix/Angular/Vue/React Native/Flutter/static HTML).
450
450
  - **agent-creator**: Creates new specialized agents with frontmatter, tool selection, and delegation guidance
451
451
  - **analyze**: Analyze code quality, complexity, and patterns
452
- - **api-patterns**: Loaded when user asks about REST API design or GraphQL patterns
453
- - **app-builder**: Loaded when user asks to scaffold or build a full-stack app
452
+ - **api-patterns**: REST and GraphQL API design patterns: resource naming, versioning, pagination, error contracts, idempotency, HATEOAS, OpenAPI. Triggers: API design, REST, GraphQL, endpoint, route, OpenAPI, Swagger, pagination, rate limit, versioning, idempotency key. Load when designing or reviewing any HTTP API surface.
453
+ - **app-builder**: Full-stack app scaffolding with stack-selection matrix: Next.js, React+Vite, Nuxt, Astro, FastAPI, Django, Laravel, React Native, Flutter, Unity. Triggers: scaffold, bootstrap, new project, starter template, build app, landing page, dashboard, API, mobile app, CLI, e-commerce, game. Load when user wants to start a new project from scratch.
454
454
  - **architecture-audit**: Explore codebase organically for architectural friction, discover shallow modules, and propose module-deepening refactors as GitHub issue RFCs using parallel sub-agent interface designs. Use when user wants to improve architecture, find shallow modules, deepen modules, or reduce coupling. Codex-adapted: uses native subagents and plan tracking.
455
- - **architecture-decision**: Loaded when user asks about architecture decisions or architecture note writing
455
+ - **architecture-decision**: Architecture decision making via trade-off analysis in RFC/RFD/ADR format: context, constraints, 3+ options, comparison, recommendation. Triggers: architecture decision, ADR, RFC, RFD, trade-offs, options comparison, design choice, pick between, should we use, evaluate approach. Load when weighing 2+ architectural options or writing decision records.
456
456
  - **biz-scan**: Scan codebase for business opportunities and KPIs
457
457
  - **brand-voice**: Loaded when writing documentation, content, README, or user-facing text. Prevents generic LLM rhetoric and enforces direct, technical voice.
458
458
  - **briefing**: Generate executive daily briefing across all agents
459
459
  - **build**: Build the project with auto-detected toolchain
460
460
  - **chaos**: Inject controlled faults for resilience testing
461
461
  - **ci**: Detect and run CI pipeline with status reporting
462
- - **ci-cd-patterns**: Loaded when user asks about CI/CD pipelines or deployment automation
463
- - **clean-code**: Loaded when user asks about clean code, naming, or code quality
462
+ - **ci-cd-patterns**: CI/CD pipeline and deployment automation: GitHub Actions, GitLab CI, Jenkins, build stages, caching, artifact promotion, blue-green, canary, rollback gates. Triggers: CI, CD, pipeline, GitHub Actions, workflow YAML, deploy automation, release, artifact, rollout, canary, blue-green. Load when designing or fixing a build/release pipeline.
463
+ - **clean-code**: Code quality principles: meaningful names, single responsibility, DRY, small functions, clear intent, guard clauses, refactoring rules. Triggers: clean code, naming, refactor for clarity, code smell, SRP, DRY, long function, god class, magic number, dead code. Load when reviewing or writing any production code.
464
464
  - **command-creator**: Creates new Claude Code slash commands with frontmatter, workflow guidance, and validation
465
465
  - **commit**: Create Conventional Commits with pre-commit validation
466
466
  - **content-moderation-patterns**: Loaded when user builds content moderation, safety filters, or policy enforcement with Claude. Covers pre-filter vs LLM-classify, category design, confidence thresholds, and human-in-the-loop.
467
467
  - **council**: 4-perspective decision evaluation for architecture choices. Use when user wants multi-angle analysis, needs to decide between alternatives, or mentions 'council', 'evaluate decision', 'pros cons'. Codex-adapted: uses native subagents and plan tracking.
468
- - **csharp-patterns**: Loaded when user asks about C# or .NET development patterns
468
+ - **csharp-patterns**: C# and .NET development patterns: LINQ, async/await, dependency injection, records, nullable reference types, ASP.NET Core minimal APIs, EF Core, MediatR. Triggers: C#, .NET, dotnet, ASP.NET, EF Core, LINQ, IServiceCollection, record type, async C#, nullable reference types. Load when writing or reviewing C#/.NET code.
469
469
  - **cve-scan**: Scan project dependencies for known CVEs using native audit tools (npm, pip, composer, cargo, go, bundler, dart)
470
- - **database-patterns**: Loaded when user asks about database schema or query optimization
470
+ - **database-patterns**: Database schema design and query optimization: normalization, indexing strategies, joins, N+1, transactions, isolation levels, partitioning, EXPLAIN plans. Triggers: schema, table design, index, slow query, N+1, PostgreSQL, MySQL, SQL Server, SQL, EXPLAIN, query plan, transaction, deadlock. Load when designing tables or tuning queries.
471
471
  - **debug**: Debug errors and trace root causes systematically
472
- - **debugging-tactics**: Loaded when user is debugging an issue or needs root cause analysis
472
+ - **debugging-tactics**: Root-cause debugging with 4-phase method: investigation, hypothesis, validation, fix. No fix without RCA. Triggers: bug, error, exception, stack trace, not working, intermittent, flaky, crash, regression, fails sometimes, why is X happening, broken after. Load when user reports a bug or asks to investigate failing code.
473
473
  - **deploy**: Deploy with pre-flight checks and health verification
474
474
  - **design-an-interface**: Generate multiple radically different interface designs using parallel sub-agents, then compare on simplicity, depth, and correctness. Based on 'Design It Twice' from Ousterhout. Use when user wants to design an API, explore interface options, compare module shapes, or mentions 'design it twice'. Codex-adapted: uses native subagents and plan tracking.
475
- - **design-engineering**: Loaded when user asks about UI animations or CSS design craft
476
- - **docker-devops**: Loaded when user asks about Docker, containers, or DevOps patterns
475
+ - **design-engineering**: UI craftsmanship (Emil Kowalski school): animation frequency rules, easing curves, micro-interactions, state polish, invisible-details philosophy. Triggers: animation, transition, ease-out, ease-in-out, motion, micro-interaction, hover state, loading state, UI polish, design detail, spring curve, delightful UX. Load when building or reviewing interactive UI.
476
+ - **docker-devops**: Docker, containers, Kubernetes, and DevOps patterns: Dockerfile best practices, multi-stage builds, compose, k8s manifests, Helm charts, service mesh, image hardening. Triggers: Docker, Dockerfile, container, image, Kubernetes, k8s, compose, Helm, registry, layer caching, service mesh, pod, deployment yaml. Load when writing or fixing container/orchestration configs.
477
477
  - **docs**: Generate and update README, API docs, and architecture notes
478
- - **documentation-standards**: Loaded when creating or updating KB documents, architecture notes, SOPs, or any file in kb/ directory
479
- - **ecommerce-patterns**: Loaded when user asks about e-commerce or shopping cart features
478
+ - **documentation-standards**: KB document conventions: YAML frontmatter (7 required fields), 5-category taxonomy (reference/howto/procedures/troubleshooting/best-practices), directory-category matching, validate.sh CI rules. Triggers: kb/, KB document, architecture note, SOP, runbook, howto, frontmatter, knowledge base entry, documentation standard. Load when creating or editing any file under kb/.
479
+ - **ecommerce-patterns**: E-commerce domain patterns: cart, checkout flow, payment providers (Stripe/Adyen), order state machine, inventory, promotions, tax, B2B vs B2C. Triggers: cart, checkout, product, SKU, inventory, payment, Stripe, Shopify, Medusa, Magento, order status, promotion, tax calculation, coupon, refund. Load when working on any e-commerce feature.
480
480
  - **evaluate**: Evaluate skill quality and RAG retrieval accuracy
481
481
  - **evolve**: Evolve agent definitions via meta-architect
482
482
  - **explain**: Explain code, architecture, or concepts with diagrams
483
483
  - **explore**: Explore codebase structure, stack, and architecture
484
484
  - **fix**: Auto-fix lint errors, type issues, and simple bugs
485
- - **flutter-patterns**: Loaded when user asks about Flutter or Dart development patterns
486
- - **git-mastery**: Loaded when user asks about advanced Git workflows or history rewriting
485
+ - **flutter-patterns**: Flutter and Dart development patterns: widget composition, state management (Riverpod/Bloc/Provider), navigation, async, platform channels, performance. Triggers: Flutter, Dart, widget, StatefulWidget, Riverpod, Bloc, Provider, pubspec, Navigator, platform channel, hot reload, StatelessWidget. Load when writing or reviewing Flutter code.
486
+ - **git-mastery**: Advanced Git workflows: interactive rebase, bisect, reflog, cherry-pick, worktrees, history rewriting, submodules, large-file migration (LFS/filter-repo). Triggers: git rebase, bisect, cherry-pick, reflog, force push, history rewrite, detached HEAD, merge conflict, worktree, squash, fixup, submodule. Load when user needs non-trivial Git operations.
487
487
  - **grill-me**: Stress-test a plan or design through relentless Socratic questioning, walking down each decision branch until reaching shared understanding. Use when user wants to stress-test a plan, get grilled, validate assumptions, or mentions 'grill me'. Codex-adapted: uses native subagents and plan tracking.
488
488
  - **health**: Report service and infrastructure health status
489
489
  - **hipaa-validate**: Validate code against HIPAA policy: PHI exposure, missing audit logging, unencrypted transmission/storage, access control gaps, temp file exposure, and missing BAA references
490
- - **hive-mind**: Loaded when orchestrating multi-agent swarms or consensus workflows
490
+ - **hive-mind**: Multi-agent swarm coordination: consensus voting with confidence scores, output aggregation, file ownership, targeted vs broadcast messaging, map-reduce workflows. Triggers: swarm, hive mind, multi-agent, consensus, parallel agents, team of agents, aggregate results, agent voting, distributed agents. Load when orchestrating 3+ agents working in parallel.
491
491
  - **hook-creator**: Creates new Claude Code hooks with guided workflow, strict conventions, and validation
492
492
  - **index**: Index codebase into the knowledge base
493
493
  - **instinct-review**: Review and manage learned instincts from past sessions
494
494
  - **introspect**: Agent self-debugging and recovery. Use when stuck in loops, making repeated errors, or quality degrades. Triggers: introspect, self-debug, stuck, loop, why failing.
495
- - **java-patterns**: Loaded when user asks about Java development patterns
495
+ - **java-patterns**: Java development patterns: Spring Boot, CompletableFuture, records, sealed types, streams, JPA/Hibernate, Maven/Gradle, virtual threads (Loom). Triggers: Java, Spring, Spring Boot, JPA, Hibernate, Maven, Gradle, CompletableFuture, record type, sealed class, virtual thread. Load when writing or reviewing Java code.
496
496
  - **json-mode-patterns**: Loaded when user needs structured JSON output from Claude. Covers tool-use-as-JSON-mode, schema design, parsing, partial recovery, and validation.
497
- - **kotlin-patterns**: Loaded when user asks about Kotlin development patterns
497
+ - **kotlin-patterns**: Kotlin development patterns: coroutines, Flow, sealed classes, data classes, extension functions, null safety, Ktor, Jetpack Compose, KMP. Triggers: Kotlin, coroutine, Flow, suspend, Ktor, Android Kotlin, Jetpack Compose, sealed class, data class, KMP, kotlinx. Load when writing or reviewing Kotlin code.
498
498
  - **lint**: Lint code with auto-detected tools and fix suggestions
499
499
  - **mcp-builder**: Build production-grade MCP (Model Context Protocol) servers from scratch using the 4-phase methodology: research, implement, test, evaluate. Use when creating new MCP integrations for external APIs, databases, or internal services.
500
- - **mcp-patterns**: Loaded when user asks about MCP servers or tool protocol design
500
+ - **mcp-patterns**: MCP (Model Context Protocol) server design: tool schemas, resource patterns, transport selection (stdio/SSE), client configuration, error handling, capability negotiation. Triggers: MCP, Model Context Protocol, MCP server, MCP tool, MCP resource, JSON-RPC, stdio transport, SSE transport, Claude Desktop config, Cursor MCP. Load when building or integrating MCP servers.
501
501
  - **mem-search**: Search past coding sessions using natural language. Finds relevant observations, decisions, and context from previous work.
502
502
  - **migrate**: Run database migrations with backup verification
503
- - **migration-patterns**: Loaded when user asks about database migrations or zero-downtime deploys
503
+ - **migration-patterns**: Zero-downtime database migration patterns: expand-contract, double-write, backfill, blue-green schema changes, feature flags, rollback safety, online DDL. Triggers: migration, schema change, zero-downtime, expand-contract, double-write, backfill, ALTER TABLE, column rename, safe deploy, online DDL. Load when planning non-trivial DB schema changes.
504
504
  - **model-routing-patterns**: Loaded when user builds multi-model pipelines (Haiku/Sonnet/Opus). Covers cost-optimized routing, escalation, sub-agent delegation, and fallback chains.
505
505
  - **night-watch**: Run autonomous maintenance and dependency updates
506
- - **observability-patterns**: Loaded when user asks about logging, metrics, or tracing patterns
506
+ - **observability-patterns**: Observability: structured logging, metrics (RED/USE/four golden signals), distributed tracing (OpenTelemetry), correlation IDs, log aggregation, SLO/SLI. Triggers: logging, log level, metrics, Prometheus, Grafana, OpenTelemetry, trace, span, structured log, observability, monitoring, SLO, SLI, alerting. Load when adding or reviewing logs, metrics, or traces.
507
507
  - **onboard**: Generate project onboarding materials
508
508
  - **orchestrate**: Coordinate multiple specialized agents in parallel Codex-adapted: uses native subagents and plan tracking.
509
509
  - **panic**: Emergency stabilization via system-governor agent
510
- - **performance-profiling**: Loaded when user asks about performance profiling or optimization
510
+ - **performance-profiling**: Performance measurement and optimization: four golden signals (latency/traffic/errors/saturation), p50/p95/p99, baseline-change-measure loop, flame graphs, load testing. Triggers: performance, slow, latency, p99, flame graph, profile, bottleneck, optimization, load test, benchmark, CPU profiling, memory leak. Load when diagnosing or optimizing slow code or services.
511
511
  - **persona**: Switch engineering persona at runtime: backend-lead, frontend-lead, devops-eng, junior-dev
512
512
  - **plan**: Plan implementation with tasks and success criteria
513
- - **plan-writing**: Loaded when user asks to write an implementation plan or pre-mortem
513
+ - **plan-writing**: Implementation plan and pre-mortem drafting: phase breakdown, success criteria, risks, rollback plan, acceptance tests, estimated effort. Triggers: implementation plan, pre-mortem, phased plan, project plan, task breakdown, success criteria, rollback strategy, risk register. Load when user asks to write a plan or pre-mortem document.
514
514
  - **plugin-creator**: Creates experimental opt-in plugin packs with manifests, conventions, and optional module scaffolding for Claude and Codex runtimes
515
515
  - **pr**: Create pull requests with pre-flight validation
516
516
  - **prd-to-issues**: Break a PRD into independently-grabbable GitHub issues using vertical slices with HITL/AFK tagging and dependency ordering. Use when user wants to convert a PRD to issues, create tickets, or break down a PRD into work items.
@@ -518,29 +518,29 @@ Skills are invocable commands or auto-loaded knowledge sources:
518
518
  - **predict**: Predict regressions and impact before changes land
519
519
  - **prompt-caching-patterns**: Loaded when user builds with Anthropic API and needs to cut cost or latency via prompt caching. Covers TTL, cache breakpoints, stacking, invalidation, and measuring hit rate.
520
520
  - **qa-session**: Interactive QA session where user reports bugs conversationally and agent files GitHub issues with domain language. Explores codebase in background for context. Use when user wants to report bugs, do QA, file issues conversationally, or mentions QA session. Codex-adapted: uses native subagents and plan tracking.
521
- - **rag-patterns**: Loaded when user asks about RAG systems, embeddings, or vector search
521
+ - **rag-patterns**: RAG architecture: embeddings, chunking strategies, hybrid search (BM25 + vector), reranking, CRAG/self-correcting, multi-hop reasoning, evaluation metrics. Triggers: RAG, embedding, vector search, pgvector, Qdrant, Pinecone, Weaviate, chunking, reranker, retrieval, hybrid search, semantic search, knowledge base, cosine similarity. Load when building or tuning RAG systems.
522
522
  - **refactor**: Refactor code for quality and maintainability
523
523
  - **refactor-plan**: Create a detailed refactor plan with tiny commits via user interview, then file as a GitHub issue RFC. Use when user wants to plan a refactor, create a refactoring RFC, or break a refactor into safe incremental steps. Codex-adapted: uses native subagents and plan tracking.
524
524
  - **repeat**: Run a prompt or slash command on a recurring interval until task complete or limits reached. Use when user wants to set up a recurring task, poll for status, or run something repeatedly on an interval. Codex-adapted: uses native subagents and plan tracking.
525
- - **research-mastery**: Loaded when user asks to research, verify, or synthesize information
525
+ - **research-mastery**: Hierarchical information retrieval following strict order: KB first (smart_query/crag_search), then MCP/Context7, then web search, then LLM knowledge as last resort. Triggers: research, find information, verify fact, synthesize sources, fact-check, cross-reference, multi-source, cite sources, investigate topic. Load when any task requires external or cross-source knowledge.
526
526
  - **review**: Review code for quality, security, and correctness
527
527
  - **rollback**: Roll back a deployment safely with verification
528
- - **ruby-patterns**: Loaded when user asks about Ruby development patterns
529
- - **rust-patterns**: Loaded when user asks about Rust development patterns
528
+ - **ruby-patterns**: Ruby and Rails development patterns: blocks, metaprogramming, ActiveRecord, Sidekiq, RSpec, Sorbet/RBS, Hanami, Roda, Rack middleware. Triggers: Ruby, Rails, ActiveRecord, Sidekiq, RSpec, gem, Gemfile, bundler, rake, Hanami, Sorbet. Load when writing or reviewing Ruby code.
529
+ - **rust-patterns**: Rust development patterns: ownership, borrowing, lifetimes, async (Tokio), error handling (Result/anyhow/thiserror), traits, macros, zero-cost abstractions, unsafe boundaries. Triggers: Rust, borrow checker, lifetime, Tokio, async Rust, cargo, trait, impl, Result, unsafe, lifetime annotation, clippy. Load when writing or reviewing Rust code.
530
530
  - **search**: Search the knowledge base with semantic and hybrid modes
531
- - **security-patterns**: Loaded when user asks about security, OWASP, or auth patterns
531
+ - **security-patterns**: Application security: OWASP Top 10, authN/authZ, input validation, secrets management, TLS, CSRF/XSS/SQLi, session handling, JWT, rate limiting, CSP. Triggers: security, OWASP, auth, JWT, CSRF, XSS, SQL injection, secrets, encryption, TLS, authentication, authorization, CSP, CORS, password hashing. Load when touching auth code, handling user input, or doing security review.
532
532
  - **seo-validate**: Validate code against SEO best practices: W3C semantics, meta/OG tags, Schema.org, hreflang, Core Web Vitals (LCP/INP/CLS), resource hints, GEO, SPA/SSG/CSR crawlability, technical SEO, accessibility-for-SEO. Supports React/Next/Nuxt/Astro/Gatsby/SvelteKit/Remix/Angular/Vue/static HTML.
533
533
  - **skill-audit**: Scan skills and agents for security risks: dangerous patterns, secrets, excessive permissions
534
534
  - **skill-creator**: Create new skills from templates with guided workflow
535
535
  - **subagent-development**: Execute implementation plans using fresh subagents per task with two-stage review: spec compliance first, then code quality. Use when executing plans with independent tasks. Codex-adapted: uses native subagents and plan tracking.
536
536
  - **swarm**: Execute tasks via Map-Reduce, Consensus, or Relay swarms Codex-adapted: uses native subagents and plan tracking.
537
- - **swift-patterns**: Loaded when user asks about Swift or iOS development patterns
537
+ - **swift-patterns**: Swift and iOS development patterns: SwiftUI, Combine, async/await, property wrappers, actors, Swift Package Manager, Core Data, UIKit interop, @MainActor. Triggers: Swift, SwiftUI, Combine, iOS, Xcode, actor, property wrapper, Core Data, SPM, UIKit, @MainActor, @State, @Binding. Load when writing or reviewing Swift code.
538
538
  - **tdd**: Test-driven development with red-green-refactor loop and vertical slices. Use when user wants TDD, test-first development, red-green-refactor, or building features with tests driving the implementation. Codex-adapted: uses native subagents and plan tracking.
539
539
  - **teams**: Launch pre-configured Agent Teams for common workflows Codex-adapted: uses native subagents and plan tracking.
540
540
  - **test**: Run tests with coverage analysis and reporting
541
- - **testing-patterns**: Loaded when user asks about testing strategy, fixtures, or mocking
541
+ - **testing-patterns**: Testing strategy and craft: pyramid vs trophy, unit/integration/e2e split, fixtures, mocks vs fakes vs stubs, AAA pattern, flaky test diagnosis, coverage goals, property-based testing. Triggers: test, testing strategy, fixture, mock, stub, AAA, unit test, integration test, e2e, Playwright, Cypress, flaky, coverage, TDD, test pyramid. Load when writing, reviewing, or designing test suites.
542
542
  - **triage-issue**: Triage a bug by deeply exploring the codebase for root cause, then create a GitHub issue with a TDD-based fix plan. Mostly hands-off — minimal user interaction. Use when user reports a bug, wants to investigate an issue, mentions triage, or wants a fix plan. Codex-adapted: uses native subagents and plan tracking.
543
- - **typescript-patterns**: Loaded when user asks about TypeScript patterns or type safety
543
+ - **typescript-patterns**: TypeScript type safety patterns: strict mode, generics, conditional types, template literals, discriminated unions, branded types, Zod, satisfies operator, const assertions. Triggers: TypeScript, TS, generics, conditional type, utility type, strict, Zod, satisfies, discriminated union, type safety, type narrowing, template literal type. Load when writing or reviewing TypeScript code.
544
544
  - **ubiquitous-language**: Extract a DDD-style ubiquitous language glossary from the conversation, flagging ambiguities and proposing canonical terms. Saves to UBIQUITOUS_LANGUAGE.md. Use when user wants to define domain terms, build a glossary, harden terminology, or mentions DDD or domain model.
545
545
  - **verification-before-completion**: Loaded when agent is about to claim work is complete, fixed, or passing — requires running verification commands and confirming output before making any success claims. Evidence before assertions, always.
546
546
  - **workflow**: Start and manage autonomous agent workflows Codex-adapted: uses native subagents and plan tracking.
package/CHANGELOG.md CHANGED
@@ -7,7 +7,35 @@ Versioning follows [Semantic Versioning](https://semver.org/).
7
7
 
8
8
  ---
9
9
 
10
- ## v2.8.0 — Security Hardening & GHAS Integration (2026-04-18)
10
+ ## v2.10.0 — Constitution Article VI: Repair Discipline (2026-04-21)
11
+
12
+ ### Added
13
+ - **Constitution Article VI — Repair Discipline** (`app/constitution.md`) — four new immutable rules: no dead code (VI.1), fix every found bug (VI.2), tests and docs follow behavior (VI.3), verify before claiming done (VI.4). Closes the gap where agents deferred "świadome pominięcie", "out of scope", or "separate PR" fixes for work that was a direct consequence of the current change. Articles I–V remain unchanged.
14
+ - **`system-governor` Art. VI audit protocol** (`app/agents/system-governor.md`) — agent gained `Grep` + `Glob` tools and a four-part audit that runs before any completion claim: VI.1 dead-symbol grep, VI.2 deferred-work scan (scoped to commit message + PR body + non-`.md` code lines + agent summary, so skill docs that legitimately document "Out of Scope" headings are not false-positives), VI.3 behavior/test/doc coverage detection, VI.4 diff re-read. Outputs a structured verdict with per-Article PASS/VETO citations.
15
+ - **`clean-code` skill Art. VI checklist items** — two new checklist entries ("No dead code — grep-verified zero references", "Every found bug fixed") plus three new "Challenged Assumptions" rows that call out the common deferral rationalizations.
16
+ - **`refactor-plan` skill Art. VI anchor** — mandatory dead-code cleanup per step, not deferred. Only transitional expand-contract phases may leave both paths live, and the cleanup step must be explicitly listed.
17
+ - **`verification-before-completion` skill Art. VI rows** — three new rows in the evidence-vs-non-evidence table covering VI.1/VI.2/VI.4, plus a "Constitutional Anchors" section that pins the skill to Art. VI.4.
18
+ - **`coding-style` rule Art. VI sections** (`app/rules/common/coding-style.md`, v1.0.0 → v1.1.0) — expanded "No Dead Code" section and new "Fix Every Found Bug" section, both citing the Constitutional article they implement.
19
+
20
+ ### Changed
21
+ - **`system-governor` description** widened to reflect Art. VI audit scope, tools broadened from `Read, Write, Bash` to `Read, Write, Bash, Grep, Glob` (needed for symbol-reference grep during VI.1).
22
+
23
+ ### Notes
24
+ - No skill/agent/hook counts changed. Totals remain: 44 agents, 99 skills, 666 tests.
25
+ - Art. VI is enforcement-level discipline, not workflow change — existing pipelines keep passing. Governor veto gates a completion claim, not a commit.
26
+
27
+ ---
28
+
29
+ ## v2.9.0 — Skill Routability & Description Lint (2026-04-19)
30
+
31
+ ### Changed
32
+ - **30 knowledge-skill descriptions rewritten** — every skill with `user-invocable: false` used the `"Loaded when user asks about X"` shape, which carries no action verb and no concrete trigger keywords. Per [Anthropic skill docs](https://code.claude.com/docs/en/skills.md), Claude Code auto-routes skills using only the `description:` field (+ optional `when_to_use:`), so weak descriptions silently lowered hit rate. Rewritten with the pattern `[capability]. Triggers: [keywords]. Load when [...]`. Affected skills: `api-patterns`, `app-builder`, `architecture-decision`, `ci-cd-patterns`, `clean-code`, `csharp-patterns`, `database-patterns`, `debugging-tactics`, `design-engineering`, `docker-devops`, `documentation-standards`, `ecommerce-patterns`, `flutter-patterns`, `git-mastery`, `hive-mind`, `java-patterns`, `kotlin-patterns`, `mcp-patterns`, `migration-patterns`, `observability-patterns`, `performance-profiling`, `plan-writing`, `rag-patterns`, `research-mastery`, `ruby-patterns`, `rust-patterns`, `security-patterns`, `swift-patterns`, `testing-patterns`, `typescript-patterns`.
33
+
34
+ ### Added
35
+ - **`scripts/audit_skills.py` description-quality lint (`check_description`)** — new WARN rules that prevent the `"Loaded when user asks about/to ..."` anti-pattern from returning. Enforces three limits on auto-loadable skills: `description + when_to_use ≤ 1536 chars` (Anthropic truncation limit), knowledge-skill description ≥ 80 chars, and a regex block on the historical weak-opening patterns. Task skills (`disable-model-invocation: true`) are skipped — their description is a menu label, not a routing signal.
36
+ - **Regenerated `AGENTS.md`, `llms.txt`, `llms-full.txt`, `GEMINI.md`, `.github/copilot-instructions.md`** — machine-readable catalogs now carry the new descriptions. External clients (Cursor, Windsurf, Copilot, Gemini CLI, Codex) get the same routing signal as Claude Code.
37
+
38
+
11
39
 
12
40
  ### Added
13
41
  - **`scripts/audit_skills.py --sarif`** — emits SARIF 2.1.0 JSON compatible with GitHub Advanced Security Code Scanning. Severity maps HIGH→error / WARN→warning / INFO→note. Enables the GitHub Security tab to ingest audit findings directly.
package/README.md CHANGED
@@ -10,12 +10,11 @@
10
10
 
11
11
  ---
12
12
 
13
- ## What's New in v2.8.0
13
+ ## What's New in v2.10.0
14
14
 
15
- - **SARIF + permissions audit** — `audit_skills.py --sarif` emits SARIF 2.1.0 for GitHub Advanced Security Code Scanning; `--permissions` prints per-skill tool usage (e.g. "50 skills use Bash") and flags broad Bash+Write+Edit access.
16
- - **Signed npm provenance** — the publish workflow now runs with `--provenance`; published tarballs carry a cryptographic build-origin attestation verifiable via `npm audit signatures`.
17
- - **Checksum-pinned URL sources** — `sources.json` now persists `sha256` of every URL-sourced rule/hook and warns on upstream content change. `AI_TOOLKIT_STRICT_PIN=1` turns mismatches into a hard CI failure.
18
- - **Security hardening** — `tarfile.extract` uses `filter="data"` on Python 3.12+; `session-start.sh` sanitises `VERSION_MSG` before `osascript`/`powershell.exe`; install-time `subprocess.run` calls now time out at 120 s.
15
+ - **Constitution Article VI — Repair Discipline** — four new immutable rules close the "świadome pominięcie / out of scope / separate PR" loophole: no dead code (VI.1), fix every found bug (VI.2), tests and docs follow behavior (VI.3), verify before claiming done (VI.4). A bug fix is a bug fix; a feature is a feature; orphaned code and deferred-adjacent fixes no longer pass review.
16
+ - **`system-governor` gains Art. VI audit protocol** — the governor now runs a four-part check before any completion claim, with per-Article PASS/VETO citations. Scope is intentionally scoped to commit message + PR body + non-`.md` code lines + agent summary, so skill docs that legitimately use "Out of Scope" as a section heading do not trigger false positives.
17
+ - **Rule, skill, and agent reinforcement** — `coding-style` rule (v1.1.0), `clean-code`, `refactor-plan`, and `verification-before-completion` skills all carry explicit Art. VI anchors and checklist rows. Totals unchanged: 44 agents, 99 skills, 666 tests.
19
18
 
20
19
  See [CHANGELOG.md](CHANGELOG.md) for full history.
21
20
 
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "ai-toolkit",
3
3
  "description": "Professional-grade Claude Code toolkit with persona presets, skill security auditor, expanded lifecycle hooks, experimental opt-in plugin packs, benchmark harvesting, and multi-tool support.",
4
- "version": "2.8.0",
4
+ "version": "2.10.0",
5
5
  "author": {
6
6
  "name": "SoftSpark",
7
7
  "url": "https://github.com/softspark"
@@ -3,7 +3,7 @@ name: system-governor
3
3
  description: "The Guardian of the Constitution. Validates all evolutionary changes and enforces immutable rules. Has VETO power."
4
4
  model: opus
5
5
  color: red
6
- tools: Read, Write, Bash
6
+ tools: Read, Write, Bash, Grep, Glob
7
7
  skills: research-mastery
8
8
  ---
9
9
 
@@ -12,7 +12,7 @@ skills: research-mastery
12
12
  You are the **System Governor**. You serve the Constitution, not the Orchestrator.
13
13
 
14
14
  ## Core Mission
15
- Ensure that no agent (especially `meta-architect`) violates the Immutable Rules.
15
+ Ensure that no agent (especially `meta-architect`) violates the Immutable Rules, and that no task is claimed "done" while Constitutional Article VI (Repair Discipline) is breached.
16
16
 
17
17
  ## Mandatory Protocol (VETO POWER)
18
18
  Before any `/evolve` or `meta-architect` change is applied:
@@ -21,6 +21,7 @@ Before any `/evolve` or `meta-architect` change is applied:
21
21
  - Removing tests? (Violation Art. III.1)
22
22
  - Deleting logs? (Violation Art. III.2)
23
23
  - Bypassing KB? (Violation Art. II.2)
24
+ - Leaving dead code, missing tests for changed behavior, stale docs? (Violation Art. VI)
24
25
  3. **Verdict**:
25
26
  - **APPROVE**: "Constitutional Check Passed."
26
27
  - **VETO**: "VIOLATION DETECTED [Article X]. Change Rejected."
@@ -34,24 +35,113 @@ On startup, verify:
34
35
  ## Capabilities
35
36
 
36
37
  ### 1. Constitutional Review
37
- - **Input**: Pull Request / Diff from `meta-architect`.
38
- - **Output**: Pass/Fail with citation.
38
+ - **Input**: Pull Request / Diff from `meta-architect` or a completion claim.
39
+ - **Output**: Pass/Fail with citation per Article.
39
40
 
40
41
  ### 2. Emergency Halt
41
42
  - **Trigger**: "Kill Switch" activated or massive deletion detected.
42
43
  - **Action**: Lock the task. Notify User immediately.
43
44
 
45
+ ### 3. Article VI Audit (Repair Discipline)
46
+ Run before approving any completion claim that touches code. Each check returns PASS / VETO with evidence.
47
+
48
+ #### VI.1 — No Dead Code
49
+ Produce the list of symbols the change removed or renamed (entities, classes, functions, API resources, l10n keys, imports, DTO fields). For each:
50
+ ```bash
51
+ # Example heuristics; adapt to project's grep/search tools.
52
+ git diff --name-only <base>..HEAD | xargs -I{} grep -nE "OldSymbol" {} 2>/dev/null || true
53
+ rg --no-heading --line-number "OldSymbol" .
54
+ ```
55
+ Also check whether any existing file is now unreferenced because the change stopped calling it:
56
+ ```bash
57
+ # For every .php / .dart / .ts file not modified in this diff, search for ANY caller of its public symbols.
58
+ # Zero-caller files are candidates for deletion.
59
+ ```
60
+ - **VETO** if grep returns zero references for any removed symbol AND the source file still exists.
61
+ - **VETO** if the diff stops calling a whole file and that file is not deleted.
62
+ - **APPROVE** only when dead-code grep is clean.
63
+
64
+ Rationalizations explicitly rejected: "pre-existing", "legacy", "separate refactor", "out of scope", "świadome pominięcie".
65
+
66
+ #### VI.2 — Fix Every Found Bug
67
+ Scan ONLY the three surfaces where a deferral is actually asserted — NOT doc files that legitimately document those phrases as headings or examples.
68
+
69
+ **Scope (in priority order):**
70
+ 1. **Commit message / PR body** — the author's own statement of what this change does:
71
+ ```bash
72
+ git log -1 --format=%B HEAD | grep -iE "TODO\(defer\)|FIXME|świadome pominięcie|out of scope|second step|osobny refactor|separate PR"
73
+ gh pr view --json body -q .body 2>/dev/null | grep -iE "TODO\(defer\)|FIXME|świadome pominięcie|out of scope|second step|osobny refactor|separate PR"
74
+ ```
75
+ 2. **Newly-added lines in NON-documentation files** — code changes only, never `.md` prose:
76
+ ```bash
77
+ git diff --unified=0 <base>..HEAD -- ':!*.md' ':!kb/**' ':!app/skills/**/SKILL.md' ':!app/agents/**/*.md' \
78
+ | grep -E "^\+" | grep -v "^\+\+\+" \
79
+ | grep -iE "TODO\(defer\)|FIXME|świadome pominięcie|out of scope|second step|osobny refactor|separate PR"
80
+ ```
81
+ 3. **Agent completion summary in the current chat transcript** — the text the orchestrator is about to emit as "done".
82
+
83
+ **Explicitly OUT OF SCOPE for this check:**
84
+ - The body of any `.md` file (skill docs, KB, README, CHANGELOG, ADRs). Skills like `a11y-validate`, `clean-code`, `refactor-plan`, `write-a-prd`, `hipaa-validate`, and agents like `product-manager` legitimately use "Out of Scope" as section headings or examples. Matching against their prose is a false positive.
85
+ - Historical commits (scan only the diff under review, not `git log` of the whole branch).
86
+
87
+ **Rulings:**
88
+ - **VETO** any hit in surfaces 1-3 unless paired with an explicit user decision recorded in the PR description or chat.
89
+ - **VETO** if the agent's own summary uses those phrases for fixes that are a direct consequence of the change.
90
+ - **APPROVE** when all three surfaces are clean, even if `.md` docs in the diff contain the phrases as documentation.
91
+
92
+ #### VI.3 — Tests and Docs Follow Behavior
93
+ Detect behavior change surface:
94
+ ```bash
95
+ # Changed public API, processor, controller, endpoint, or exported contract?
96
+ git diff --name-only <base>..HEAD | rg -e 'Processor\.php$' -e 'Controller\.php$' -e 'Api/' -e 'api/endpoints/' -e 'routes' -e 'ApiResource/'
97
+ ```
98
+ For every modified public-surface file, verify:
99
+ - Corresponding integration test exists and was modified in this diff, OR a new integration test was added.
100
+ - Unit test-only coverage for behavior exposed over API is INSUFFICIENT.
101
+ - Docs (`kb/`, `README.md`, `CLAUDE.md`, ADRs) that reference the changed behavior are updated.
102
+ - **VETO** if any of these are missing.
103
+
104
+ #### VI.4 — Verify Before Claiming Done
105
+ Before allowing an agent to emit a completion claim:
106
+ ```bash
107
+ git diff --stat <base>..HEAD # Re-read full shape of the change
108
+ git status # Nothing stranded in the working tree
109
+ ```
110
+ - **VETO** if working tree shows untracked artefacts that look like half-finished work (new files without references, orphan migrations without entity updates).
111
+ - **VETO** if the agent's text claims success but any prior Art. VI check is still failing.
112
+
44
113
  ## Output Format
45
114
  ```markdown
46
115
  ## ⚖️ Governance Verdict
47
116
 
48
117
  ### Proposed Change
49
- Modified `tech-lead.md` to remove `view_skill("research-mastery")`.
118
+ <one-sentence summary of the diff>
50
119
 
51
120
  ### Constitutional Check
52
- - **Article II.2 (Research Protocol)**: VIOLATED.
53
- - **Reason**: Trying to bypass mandatory knowledge check.
121
+ - **Article II.2 (Research Protocol)**: <PASSED | VIOLATED — reason>
122
+ - **Article III.1 (Tests are Sacred)**: <PASSED | VIOLATED reason>
123
+ - **Article VI.1 (No Dead Code)**: <PASSED | VIOLATED — orphan evidence>
124
+ - **Article VI.2 (Fix Every Found Bug)**: <PASSED | VIOLATED — deferred fix evidence>
125
+ - **Article VI.3 (Tests and Docs)**: <PASSED | VIOLATED — missing coverage>
126
+ - **Article VI.4 (Verify Before Done)**: <PASSED | VIOLATED — stale claim evidence>
54
127
 
55
128
  ### RULING
56
- 🔴 **VETO**. This change is rejected.
129
+ 🟢 **APPROVE** Constitutional Check Passed.
130
+ OR
131
+ 🔴 **VETO** — <Articles violated>. Change Rejected. Required remediation: <bulleted fixes>.
57
132
  ```
133
+
134
+ ## When To Run Art. VI Checks
135
+ - Before any `meta-architect` / `/evolve` apply.
136
+ - Before any orchestrator emits a completion claim on a task that touched code.
137
+ - On-demand when invoked directly by the user ("governor, audit this diff").
138
+ - NOT required for documentation-only changes outside `kb/`, scratch files, or explicit WIP commits marked as such.
139
+
140
+ ## Known Bypass Attempts (Auto-Reject)
141
+ | Phrase in the diff or summary | Default ruling |
142
+ |-------------------------------|----------------|
143
+ | "świadome pominięcie" | VETO — direct Art. VI.2 violation |
144
+ | "out of scope (for now)" | VETO unless user-approved in conversation |
145
+ | "separate PR will fix" | VETO unless the follow-up ticket ID is cited |
146
+ | "pre-existing dead code, leaving it" | VETO per Art. VI.1 |
147
+ | "tests will follow" | VETO per Art. VI.3 |
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  title: "The Immutable Constitution of the System"
3
- last_updated: "2026-01-30"
3
+ last_updated: "2026-04-21"
4
4
  status: IMMUTABLE
5
5
  ---
6
6
 
@@ -43,3 +43,9 @@ status: IMMUTABLE
43
43
  ## Article V: Resource Governance
44
44
  1. **No Destructive Commands**: Commands like `rm -rf`, `DROP TABLE`, `FORMAT` require explicit user confirmation before execution.
45
45
  2. **Model Tier Respect**: Agents MUST operate within their assigned model tier. Model tier changes require user approval.
46
+
47
+ ## Article VI: Repair Discipline
48
+ 1. **No Dead Code**: Unused code (files, classes, functions, imports, l10n keys, variables) MUST be removed in the same change that makes it unused — whether the change introduced it or merely exposed it. "Pre-existing", "legacy", "separate refactor", or "out of scope" are NOT valid reasons to keep dead code when its unusedness is verifiable (grep returns zero references across the repo).
49
+ 2. **Fix Every Found Bug**: Any bug, gap, missing test for changed behavior, or stale doc discovered during a task MUST be fixed in the same change. Deferring with "świadome pominięcie", "second step", "osobny refactor", or "poza scope" is forbidden when the issue is a direct consequence of, or directly adjacent to, the work being done. Legitimate deferral is permitted only when (a) the fix requires a user decision — in which case the agent MUST surface it explicitly and ask, not bury it in a summary — or (b) the issue is genuinely unrelated to the current change surface.
50
+ 3. **Tests and Docs Follow Behavior**: When behavior changes, the corresponding integration and unit tests, plus any affected documentation, MUST be updated in the same change. A unit test on a new helper is not sufficient when the behavior is exposed over an API — add the integration test too.
51
+ 4. **Verify Before Claiming Done**: Before marking a task complete, re-read the diff and confirm: no orphaned references, no missing test coverage for changed paths, no stale docs. If any are present, the task is not done.
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  language: common
3
3
  category: coding-style
4
- version: "1.0.0"
4
+ version: "1.1.0"
5
5
  ---
6
6
 
7
7
  # Universal Coding Style
@@ -51,7 +51,17 @@ version: "1.0.0"
51
51
  - Match existing style, even if you would do it differently.
52
52
  - Do not "improve" adjacent code, comments, or formatting unprompted.
53
53
  - Orphan cleanup: remove imports/variables/functions that YOUR changes made unused.
54
- - Do not remove pre-existing dead code unless explicitly asked.
54
+
55
+ ## No Dead Code (Constitution Art. VI.1)
56
+ - When a refactor leaves a file, class, function, import, l10n key, or variable unused, DELETE it in the same change. Verify via grep that zero references remain in the repo.
57
+ - This applies to pre-existing code too, if your work makes its unusedness verifiable. "Legacy", "separate refactor", "out of scope", or "świadome pominięcie" are NOT valid excuses.
58
+ - Before claiming the task done: grep for every symbol you removed or renamed; fix orphaned references.
59
+
60
+ ## Fix Every Found Bug (Constitution Art. VI.2)
61
+ - A bug, missing test for changed behavior, or stale doc discovered while working on a task MUST be fixed in the same change — not deferred to "second step", "separate PR", or "świadome pominięcie".
62
+ - When behavior changes, update integration AND unit tests AND the affected docs alongside. A unit test on a new helper is not sufficient when the behavior is exposed over an API — add the integration test too.
63
+ - Legitimate deferral exists ONLY when: (a) the fix requires a user decision — in that case, surface it explicitly and ask, don't bury in a summary; or (b) the issue is genuinely unrelated to the current change surface.
64
+ - Before marking done: re-read the diff and confirm no orphaned references, no missing test coverage for changed paths, no stale docs. If any are present, keep working.
55
65
 
56
66
  ## Goal-Driven Execution
57
67
  - Transform vague tasks into verifiable goals before starting.
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  name: api-patterns
3
- description: "Loaded when user asks about REST API design or GraphQL patterns"
3
+ description: "REST and GraphQL API design patterns: resource naming, versioning, pagination, error contracts, idempotency, HATEOAS, OpenAPI. Triggers: API design, REST, GraphQL, endpoint, route, OpenAPI, Swagger, pagination, rate limit, versioning, idempotency key. Load when designing or reviewing any HTTP API surface."
4
4
  effort: medium
5
5
  user-invocable: false
6
6
  allowed-tools: Read
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  name: app-builder
3
- description: "Loaded when user asks to scaffold or build a full-stack app"
3
+ description: "Full-stack app scaffolding with stack-selection matrix: Next.js, React+Vite, Nuxt, Astro, FastAPI, Django, Laravel, React Native, Flutter, Unity. Triggers: scaffold, bootstrap, new project, starter template, build app, landing page, dashboard, API, mobile app, CLI, e-commerce, game. Load when user wants to start a new project from scratch."
4
4
  effort: medium
5
5
  user-invocable: false
6
6
  allowed-tools: Read
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  name: architecture-decision
3
- description: "Loaded when user asks about architecture decisions or architecture note writing"
3
+ description: "Architecture decision making via trade-off analysis in RFC/RFD/ADR format: context, constraints, 3+ options, comparison, recommendation. Triggers: architecture decision, ADR, RFC, RFD, trade-offs, options comparison, design choice, pick between, should we use, evaluate approach. Load when weighing 2+ architectural options or writing decision records."
4
4
  effort: medium
5
5
  user-invocable: false
6
6
  allowed-tools: Read, Write
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  name: ci-cd-patterns
3
- description: "Loaded when user asks about CI/CD pipelines or deployment automation"
3
+ description: "CI/CD pipeline and deployment automation: GitHub Actions, GitLab CI, Jenkins, build stages, caching, artifact promotion, blue-green, canary, rollback gates. Triggers: CI, CD, pipeline, GitHub Actions, workflow YAML, deploy automation, release, artifact, rollout, canary, blue-green. Load when designing or fixing a build/release pipeline."
4
4
  effort: medium
5
5
  user-invocable: false
6
6
  allowed-tools: Read
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  name: clean-code
3
- description: "Loaded when user asks about clean code, naming, or code quality"
3
+ description: "Code quality principles: meaningful names, single responsibility, DRY, small functions, clear intent, guard clauses, refactoring rules. Triggers: clean code, naming, refactor for clarity, code smell, SRP, DRY, long function, god class, magic number, dead code. Load when reviewing or writing any production code."
4
4
  effort: medium
5
5
  user-invocable: false
6
6
  allowed-tools: Read
@@ -97,6 +97,8 @@ Keep modules focused. Order contents consistently: imports (stdlib, third-party,
97
97
  - [ ] Resources are properly cleaned up
98
98
  - [ ] No code duplication
99
99
  - [ ] Tests cover critical paths
100
+ - [ ] **No dead code** — grep-verified zero references for every removed/renamed symbol; pre-existing dead code touched by this change is deleted too (Constitution Art. VI.1)
101
+ - [ ] **Every found bug fixed** — bugs, missing tests for changed behavior, and stale docs discovered during the task are fixed in the same change, not deferred (Constitution Art. VI.2)
100
102
 
101
103
  ---
102
104
 
@@ -109,6 +111,9 @@ Keep modules focused. Order contents consistently: imports (stdlib, third-party,
109
111
  | "Short variable names are faster to type" | You type it once, readers parse it hundreds of times — optimize for reading |
110
112
  | "DRY means never repeat anything" | Wrong DRY creates coupling — duplicate until you see the real abstraction |
111
113
  | "More abstractions = cleaner code" | Premature abstraction is worse than duplication — wait for the third use |
114
+ | "That dead file is pre-existing, not my problem" | If your change makes it verifiably unused, deleting it IS your problem (Constitution Art. VI.1) |
115
+ | "I'll fix the missing test in a separate PR" | Forbidden when the test covers behavior you just changed — add it now (Constitution Art. VI.2) |
116
+ | "Świadome pominięcie" / "out of scope" | Deferral of directly-adjacent fixes is forbidden; if a user decision is needed, ASK, don't bury it |
112
117
 
113
118
  ## Language-Specific References
114
119
 
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  name: csharp-patterns
3
- description: "Loaded when user asks about C# or .NET development patterns"
3
+ description: "C# and .NET development patterns: LINQ, async/await, dependency injection, records, nullable reference types, ASP.NET Core minimal APIs, EF Core, MediatR. Triggers: C#, .NET, dotnet, ASP.NET, EF Core, LINQ, IServiceCollection, record type, async C#, nullable reference types. Load when writing or reviewing C#/.NET code."
4
4
  effort: medium
5
5
  user-invocable: false
6
6
  allowed-tools: Read
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  name: database-patterns
3
- description: "Loaded when user asks about database schema or query optimization"
3
+ description: "Database schema design and query optimization: normalization, indexing strategies, joins, N+1, transactions, isolation levels, partitioning, EXPLAIN plans. Triggers: schema, table design, index, slow query, N+1, PostgreSQL, MySQL, SQL Server, SQL, EXPLAIN, query plan, transaction, deadlock. Load when designing tables or tuning queries."
4
4
  effort: medium
5
5
  user-invocable: false
6
6
  allowed-tools: Read
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  name: debugging-tactics
3
- description: "Loaded when user is debugging an issue or needs root cause analysis"
3
+ description: "Root-cause debugging with 4-phase method: investigation, hypothesis, validation, fix. No fix without RCA. Triggers: bug, error, exception, stack trace, not working, intermittent, flaky, crash, regression, fails sometimes, why is X happening, broken after. Load when user reports a bug or asks to investigate failing code."
4
4
  effort: medium
5
5
  user-invocable: false
6
6
  allowed-tools: Grep, Read
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  name: design-engineering
3
- description: "Loaded when user asks about UI animations or CSS design craft"
3
+ description: "UI craftsmanship (Emil Kowalski school): animation frequency rules, easing curves, micro-interactions, state polish, invisible-details philosophy. Triggers: animation, transition, ease-out, ease-in-out, motion, micro-interaction, hover state, loading state, UI polish, design detail, spring curve, delightful UX. Load when building or reviewing interactive UI."
4
4
  effort: medium
5
5
  user-invocable: false
6
6
  allowed-tools: Read
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  name: docker-devops
3
- description: "Loaded when user asks about Docker, containers, or DevOps patterns"
3
+ description: "Docker, containers, Kubernetes, and DevOps patterns: Dockerfile best practices, multi-stage builds, compose, k8s manifests, Helm charts, service mesh, image hardening. Triggers: Docker, Dockerfile, container, image, Kubernetes, k8s, compose, Helm, registry, layer caching, service mesh, pod, deployment yaml. Load when writing or fixing container/orchestration configs."
4
4
  effort: medium
5
5
  user-invocable: false
6
6
  allowed-tools: Read
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  name: documentation-standards
3
- description: "Loaded when creating or updating KB documents, architecture notes, SOPs, or any file in kb/ directory"
3
+ description: "KB document conventions: YAML frontmatter (7 required fields), 5-category taxonomy (reference/howto/procedures/troubleshooting/best-practices), directory-category matching, validate.sh CI rules. Triggers: kb/, KB document, architecture note, SOP, runbook, howto, frontmatter, knowledge base entry, documentation standard. Load when creating or editing any file under kb/."
4
4
  effort: medium
5
5
  user-invocable: false
6
6
  allowed-tools: Read
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  name: ecommerce-patterns
3
- description: "Loaded when user asks about e-commerce or shopping cart features"
3
+ description: "E-commerce domain patterns: cart, checkout flow, payment providers (Stripe/Adyen), order state machine, inventory, promotions, tax, B2B vs B2C. Triggers: cart, checkout, product, SKU, inventory, payment, Stripe, Shopify, Medusa, Magento, order status, promotion, tax calculation, coupon, refund. Load when working on any e-commerce feature."
4
4
  effort: medium
5
5
  user-invocable: false
6
6
  allowed-tools: Read
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  name: flutter-patterns
3
- description: "Loaded when user asks about Flutter or Dart development patterns"
3
+ description: "Flutter and Dart development patterns: widget composition, state management (Riverpod/Bloc/Provider), navigation, async, platform channels, performance. Triggers: Flutter, Dart, widget, StatefulWidget, Riverpod, Bloc, Provider, pubspec, Navigator, platform channel, hot reload, StatelessWidget. Load when writing or reviewing Flutter code."
4
4
  effort: medium
5
5
  user-invocable: false
6
6
  allowed-tools: Read
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  name: git-mastery
3
- description: "Loaded when user asks about advanced Git workflows or history rewriting"
3
+ description: "Advanced Git workflows: interactive rebase, bisect, reflog, cherry-pick, worktrees, history rewriting, submodules, large-file migration (LFS/filter-repo). Triggers: git rebase, bisect, cherry-pick, reflog, force push, history rewrite, detached HEAD, merge conflict, worktree, squash, fixup, submodule. Load when user needs non-trivial Git operations."
4
4
  effort: medium
5
5
  user-invocable: false
6
6
  allowed-tools: Read, Grep, Glob
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  name: hive-mind
3
- description: "Loaded when orchestrating multi-agent swarms or consensus workflows"
3
+ description: "Multi-agent swarm coordination: consensus voting with confidence scores, output aggregation, file ownership, targeted vs broadcast messaging, map-reduce workflows. Triggers: swarm, hive mind, multi-agent, consensus, parallel agents, team of agents, aggregate results, agent voting, distributed agents. Load when orchestrating 3+ agents working in parallel."
4
4
  effort: medium
5
5
  user-invocable: false
6
6
  allowed-tools: Read