@thanhthi2895/luna-ai 2.16.2

package/agentic/opencode/.opencode/skills/debugger/references/log-and-ci-analysis.md

@@ -0,0 +1,88 @@
+# Log & CI/CD Analysis
+
+Collect and analyze logs from servers, CI/CD pipelines, and application layers to diagnose failures.
+
+## GitHub Actions Analysis
+
+### List and Inspect Runs
+
+```bash
+# List recent runs (all workflows)
+gh run list --limit 10
+
+# List runs for specific workflow
+gh run list --workflow=ci.yml --limit 5
+
+# View specific run details
+gh run view <run-id>
+
+# View failed job logs only
+gh run view <run-id> --log-failed
+
+# Download complete logs
+gh run view <run-id> --log > /tmp/ci-full.txt
+
+# Re-run failed jobs
+gh run rerun <run-id> --failed
+```
+
+### Common CI/CD Failure Patterns
+
+| Pattern | Likely Cause | Investigation |
+|---------|-------------|---------------|
+| Passes locally, fails CI | Environment diff | Check Node/Python version, OS, env vars |
+| Intermittent failures | Race conditions, flaky tests | Run 3x, check timing, shared state |
+| Timeout failures | Resource limits, infinite loops | Check resource usage, add timeouts |
+| Permission errors | Token/secret misconfiguration | Verify `GITHUB_TOKEN`, secret names |
+| Dependency install fails | Registry issues, version conflicts | Check lockfile, registry status |
+| Build succeeds, tests fail | Test environment setup | Check test config, database setup, fixtures |
+
+### Analyzing Failed Steps
+
+1. **Identify which step failed** — `gh run view <id>` shows step-by-step status
+2. **Get the logs** — `gh run view <id> --log-failed` for focused output
+3. **Search for error patterns** — Look for `Error:`, `FAIL`, `exit code`, stack traces
+
+## Server Log Analysis
+
+### Log Collection Strategy
+
+1. **Identify log locations** — Application logs, system logs, web server logs
+2. **Filter by timeframe** — Narrow to incident window
+3. **Correlate request IDs** — Trace single request across services
+4. **Look for patterns** — Repeated errors, error rate changes, unusual payloads
+
+### Structured Log Queries
+
+```bash
+# PostgreSQL slow query log
+psql -c "SELECT query, calls, mean_exec_time FROM pg_stat_statements ORDER BY mean_exec_time DESC LIMIT 10;"
+
+# Check database connections
+psql -c "SELECT count(*), state FROM pg_stat_activity GROUP BY state;"
+```
+
+### Cross-Source Correlation
+
+1. **Align timestamps** across all log sources (timezone awareness)
+2. **Build timeline** — First error → propagation → user impact
+3. **Identify trigger** — What changed immediately before first error?
+4. **Map blast radius** — Which services/endpoints affected?
+
+## Error Pattern Recognition
+
+| Pattern | Likely Cause |
+|---------|-------------|
+| Sudden spike | Deployment, config change, external dependency failure |
+| Gradual increase | Resource leak, data growth, degradation |
+| Periodic failures | Cron jobs, scheduled tasks, resource contention |
+| Single endpoint | Code bug, data issue, specific dependency |
+| All endpoints | Infrastructure, database, network issue |
+
+## Evidence Preservation
+
+Always capture relevant log excerpts for the diagnostic report. Include:
+- Exact error messages and stack traces
+- Timestamps and request IDs
+- Before/after comparison (normal vs error state)
+- Counts and frequencies

package/agentic/opencode/.opencode/skills/debugger/references/performance-diagnostics.md

@@ -0,0 +1,93 @@
+# Performance Diagnostics
+
+Identify bottlenecks, analyze query performance, and develop optimization strategies.
+
+## When to Use
+
+- Response times increased significantly
+- Application feels slow or unresponsive
+- Database queries taking too long
+- High CPU/memory/disk usage
+- Resource exhaustion or OOM errors
+
+## Diagnostic Process
+
+### 1. Quantify the Problem
+
+**Measure before optimizing.** Establish baseline and current state.
+
+- What is the expected response time vs actual?
+- When did degradation start? (correlate with changes)
+- Which endpoints/operations are affected?
+- Is it consistent or intermittent?
+
+### 2. Identify the Bottleneck Layer
+
+```
+Request → Network → Web Server → Application → Database → Filesystem
+                                      ↓
+                              External APIs / Services
+```
+
+| Layer | Check | Tool |
+|-------|-------|------|
+| Network | Latency, DNS, TLS | `curl -w` timing, network logs |
+| Web server | Request queue, connections | Server metrics, access logs |
+| Application | CPU profiling, memory | Profiler, APM, `process.memoryUsage()` |
+| Database | Query time, connections | `EXPLAIN ANALYZE`, `pg_stat_statements` |
+| Filesystem | I/O wait, disk usage | `iostat`, `df -h` |
+| External APIs | Response time, timeouts | Request logging with durations |
+
+### 3. Database Performance
+
+```sql
+-- Slow queries (requires pg_stat_statements)
+SELECT query, calls, mean_exec_time, total_exec_time
+FROM pg_stat_statements
+ORDER BY mean_exec_time DESC LIMIT 20;
+
+-- Active queries right now
+SELECT pid, now() - query_start AS duration, query, state
+FROM pg_stat_activity
+WHERE state != 'idle'
+ORDER BY duration DESC;
+
+-- Missing indexes (sequential scans on large tables)
+SELECT relname, seq_scan, seq_tup_read, idx_scan
+FROM pg_stat_user_tables
+WHERE seq_scan > 100 AND seq_tup_read > 10000
+ORDER BY seq_tup_read DESC;
+
+-- Analyze specific query
+EXPLAIN (ANALYZE, BUFFERS, FORMAT TEXT) <your-query>;
+```
+
+### 4. Application Bottlenecks
+
+| Issue | Symptom | Fix |
+|-------|---------|-----|
+| N+1 queries | Many small DB calls per request | Eager loading, batch queries |
+| Memory leaks | Growing memory over time | Profile heap, check event listeners |
+| Blocking I/O | High response time, low CPU | Async operations, connection pooling |
+| CPU-bound | High CPU, proportional to load | Optimize algorithms, caching |
+| Connection exhaustion | Intermittent timeouts | Pool sizing, connection reuse |
+| Large payloads | Slow transfers, high memory | Pagination, compression, streaming |
+
+### 5. Optimization Strategy
+
+**Priority order:**
+1. **Quick wins** — Add missing index, fix N+1 query, enable caching
+2. **Configuration** — Pool sizes, timeouts, buffer sizes, worker counts
+3. **Code changes** — Algorithm optimization, data structure changes
+4. **Architecture** — Caching layer, read replicas, async processing, CDN
+
+**Always:** Measure after each change to verify improvement. One change at a time.
+
+## Reporting
+
+Include in diagnostic report:
+- **Baseline vs current** metrics (with numbers)
+- **Bottleneck identification** with evidence
+- **Root cause** explanation
+- **Recommended fixes** with expected impact
+- **Verification plan** to confirm improvement

package/agentic/opencode/.opencode/skills/debugger/references/reporting-standards.md

@@ -0,0 +1,108 @@
+# Reporting Standards
+
+Structured format for diagnostic and investigation reports.
+
+## When to Use
+
+- After completing system investigation
+- Summarizing debugging session findings
+- Producing incident post-mortems
+- Reporting performance analysis results
+
+## Report Structure
+
+### 1. Executive Summary (3-5 lines)
+
+- **Issue:** One-line description
+- **Impact:** Users/systems affected, severity
+- **Root cause:** One-line explanation
+- **Status:** Resolved / Mitigated / Under investigation
+- **Fix:** What was done or recommended
+
+### 2. Technical Analysis
+
+**Timeline:**
+```
+HH:MM - Event description
+HH:MM - Next event
+```
+
+**Evidence:**
+- Relevant log excerpts (trimmed to essential lines)
+- Query results with key metrics
+- Error messages and stack traces
+- Before/after comparisons
+
+**Findings:**
+- List each finding with supporting evidence
+- Distinguish confirmed facts from hypotheses
+- Note correlation vs causation
+
+### 3. Actionable Recommendations
+
+**Immediate (P0):**
+- [ ] Critical fix with implementation steps
+
+**Short-term (P1):**
+- [ ] Follow-up improvements
+
+**Long-term (P2):**
+- [ ] Monitoring/alerting enhancements
+- [ ] Architecture improvements
+
+Each recommendation: what to do, why, expected impact, effort (low/medium/high).
+
+### 4. Unresolved Questions
+
+List anything that remains unclear or needs further investigation.
+
+## Report File Naming
+
+Use pattern from `## Naming` section injected by dev-rules-reminder hook.
+
+**Example:** `plans/reports/debugger-2026-03-06-api-500-investigation.md`
+
+## Writing Guidelines
+
+- **Concise:** Facts and evidence, not narrative. Sacrifice grammar for brevity
+- **Evidence-backed:** Every claim supported by logs, metrics, or reproduction steps
+- **Actionable:** Recommendations are specific with clear next steps
+- **Honest:** State unknowns explicitly — "Likely cause" vs "confirmed cause"
+
+## Template
+
+```markdown
+# [Issue Title] - Investigation Report
+
+## Executive Summary
+- **Issue:**
+- **Impact:**
+- **Root cause:**
+- **Status:**
+- **Fix:**
+
+## Timeline
+- HH:MM -
+- HH:MM -
+
+## Technical Analysis
+### Findings
+1.
+2.
+
+### Evidence
+[logs, queries, metrics]
+
+## Recommendations
+### Immediate (P0)
+- [ ]
+
+### Short-term (P1)
+- [ ]
+
+### Long-term (P2)
+- [ ]
+
+## Unresolved Questions
+-
+```

package/agentic/opencode/.opencode/skills/debugger/references/root-cause-tracing.md

@@ -0,0 +1,88 @@
+# Root Cause Tracing
+
+Systematically trace bugs backward through call stack to find original trigger.
+
+## Core Principle
+
+**Trace backward through call chain until finding original trigger, then fix at source.**
+
+Bugs often manifest deep in call stack. Instinct is to fix where error appears, but that's treating symptom.
+
+## When to Use
+
+- Error happens deep in execution (not at entry point)
+- Stack trace shows long call chain
+- Unclear where invalid data originated
+- Need to find which test/code triggers problem
+
+## The Tracing Process
+
+### 1. Observe the Symptom
+```
+Error: git init failed in /project/packages/core
+```
+
+### 2. Find Immediate Cause
+What code directly causes this?
+```typescript
+await execFileAsync('git', ['init'], { cwd: projectDir });
+```
+
+### 3. Ask: What Called This?
+```typescript
+WorktreeManager.createSessionWorktree(projectDir, sessionId)
+  → called by Session.initializeWorkspace()
+  → called by Session.create()
+  → called by test at Project.create()
+```
+
+### 4. Keep Tracing Up
+What value was passed?
+- `projectDir = ''` (empty string!)
+- Empty string as `cwd` resolves to `process.cwd()`
+
+### 5. Find Original Trigger
+Where did empty string come from?
+```typescript
+const context = setupCoreTest(); // Returns { tempDir: '' }
+Project.create('name', context.tempDir); // Accessed before beforeEach!
+```
+
+## Adding Stack Traces
+
+When can't trace manually, add instrumentation:
+
+```typescript
+async function gitInit(directory: string) {
+  const stack = new Error().stack;
+  console.error('DEBUG git init:', { directory, cwd: process.cwd(), stack });
+  await execFileAsync('git', ['init'], { cwd: directory });
+}
+```
+
+**Critical:** Use `console.error()` in tests (not logger — may not show)
+
+**Capture output:**
+```bash
+npm test 2>&1 | grep 'DEBUG git init'
+```
+
+## Finding Which Test Causes Pollution
+
+If something appears during tests but don't know which test:
+
+Use bisection script: `scripts/find-polluter.sh`
+
+```bash
+./scripts/find-polluter.sh '.git' 'src/**/*.test.ts'
+```
+
+Runs tests one-by-one, stops at first polluter.
+
+## Key Principle
+
+**NEVER fix just where error appears.** Trace back to find original trigger.
+
+- Can trace one level up? → Keep tracing
+- Is this the source? → Fix at source
+- Then add validation at each layer (see defense-in-depth.md)

package/agentic/opencode/.opencode/skills/debugger/references/systematic-debugging.md

@@ -0,0 +1,91 @@
+# Systematic Debugging
+
+Four-phase debugging framework that ensures root cause investigation before attempting fixes.
+
+## The Iron Law
+
+```
+NO FIXES WITHOUT ROOT CAUSE INVESTIGATION FIRST
+```
+
+If haven't completed Phase 1, cannot propose fixes.
+
+## The Four Phases
+
+Must complete each phase before proceeding to next.
+
+### Phase 1: Root Cause Investigation
+
+**BEFORE attempting ANY fix:**
+
+1. **Read Error Messages Carefully** - Don't skip past errors/warnings, read stack traces completely
+2. **Reproduce Consistently** - Can trigger reliably? Exact steps? If not reproducible → gather more data
+3. **Check Recent Changes** - What changed? Git diff, recent commits, new dependencies, config changes
+4. **Gather Evidence in Multi-Component Systems**
+   - For EACH component boundary: log data entering/exiting, verify environment propagation
+   - Run once to gather evidence showing WHERE it breaks
+   - THEN analyze to identify failing component
+5. **Trace Data Flow** - Where does bad value originate? Trace up call stack until finding source (see root-cause-tracing.md)
+
+### Phase 2: Pattern Analysis
+
+**Find pattern before fixing:**
+
+1. **Find Working Examples** - Locate similar working code in same codebase
+2. **Compare Against References** - Read reference implementation COMPLETELY, understand fully before applying
+3. **Identify Differences** - List every difference however small, don't assume "that can't matter"
+4. **Understand Dependencies** - What other components, settings, config, environment needed?
+
+### Phase 3: Hypothesis and Testing
+
+**Scientific method:**
+
+1. **Form Single Hypothesis** - "I think X is root cause because Y", be specific not vague
+2. **Test Minimally** - SMALLEST possible change to test hypothesis, one variable at a time
+3. **Verify Before Continuing** - Worked? → Phase 4. Didn't work? → NEW hypothesis. DON'T add more fixes
+4. **When Don't Know** - Say "I don't understand X", don't pretend, ask for help
+
+### Phase 4: Implementation
+
+**Fix root cause, not symptom:**
+
+1. **Create Failing Test Case** - Simplest reproduction, automated if possible, MUST have before fixing
+2. **Implement Single Fix** - Address root cause identified, ONE change, no "while I'm here" improvements
+3. **Verify Fix** - Test passes? No other tests broken? Issue actually resolved?
+4. **If Fix Doesn't Work**
+   - STOP. Count: How many fixes tried?
+   - If < 3: Return to Phase 1, re-analyze with new information
+   - **If ≥ 3: STOP and question architecture**
+5. **If 3+ Fixes Failed: Question Architecture**
+   - Pattern: Each fix reveals new shared state/coupling problem elsewhere
+   - STOP and question fundamentals: Is pattern sound? Wrong architecture?
+   - Discuss with human partner before more fixes
+
+## Red Flags - STOP and Follow Process
+
+If catch yourself thinking:
+- "Quick fix for now, investigate later"
+- "Just try changing X and see if it works"
+- "Add multiple changes, run tests"
+- "Skip the test, I'll manually verify"
+- "It's probably X, let me fix that"
+- "I don't fully understand but this might work"
+- "One more fix attempt" (when already tried 2+)
+
+**ALL mean:** STOP. Return to Phase 1.
+
+## Common Rationalizations
+
+| Excuse | Reality |
+|--------|---------|
+| "Issue is simple, don't need process" | Simple issues have root causes too |
+| "Emergency, no time for process" | Systematic is FASTER than guess-and-check |
+| "Just try this first, then investigate" | First fix sets pattern. Do right from start |
+| "One more fix attempt" (after 2+ failures) | 3+ failures = architectural problem |
+
+## Real-World Impact
+
+- Systematic approach: 15-30 minutes to fix
+- Random fixes approach: 2-3 hours of thrashing
+- First-time fix rate: 95% vs 40%
+- New bugs introduced: Near zero vs common

package/agentic/opencode/.opencode/skills/debugger/references/task-management-debugging.md

@@ -0,0 +1,109 @@
+# Debug Task Management Patterns
+
+Track investigation and debugging pipelines via Claude Native Tasks (TaskCreate, TaskUpdate, TaskList).
+
+## When to Create Tasks
+
+| Debug Scope | Tasks? | Rationale |
+|-------------|--------|-----------|
+| Single bug, one file | No | Systematic debugging handles directly |
+| Multi-component investigation (3+ steps) | Yes | Track assess → collect → analyze → fix → verify |
+| Parallel log/data collection agents | Yes | Coordinate independent evidence gathering |
+| Performance investigation with multiple layers | Yes | Track bottleneck analysis per layer |
+| CI/CD pipeline failure with 3+ possible causes | Yes | Track hypothesis elimination |
+
+**3-Task Rule:** Skip task creation when investigation has < 3 meaningful steps.
+
+## Investigation Pipeline as Tasks
+
+```
+TaskCreate: "Assess incident scope"      → pending
+TaskCreate: "Collect logs and evidence"  → pending, blockedBy: [assess]
+TaskCreate: "Analyze root cause"         → pending, blockedBy: [collect]
+TaskCreate: "Implement fix"              → pending, blockedBy: [analyze]
+TaskCreate: "Verify fix resolves issue"  → pending, blockedBy: [fix]
+```
+
+Maps to investigation-methodology.md 5-step process. Auto-unblocks as each step completes.
+
+## Task Schemas
+
+### Assess Task
+```
+TaskCreate(
+  subject: "Assess {incident} scope and impact",
+  description: "Gather symptoms, identify affected components, check recent changes. See investigation-methodology.md Step 1",
+  metadata: { debugStage: "assess", incident: "{incident}", effort: "5m" }
+)
+```
+
+### Collect Task
+```
+TaskCreate(
+  subject: "Collect evidence for {incident}",
+  description: "Server logs, CI/CD logs, database state, metrics. See log-and-ci-analysis.md",
+  metadata: { debugStage: "collect", incident: "{incident}", effort: "10m" },
+  addBlockedBy: ["{assess-task-id}"]
+)
+```
+
+### Analyze Task
+```
+TaskCreate(
+  subject: "Analyze root cause of {incident}",
+  description: "Correlate evidence, trace execution paths. See systematic-debugging.md Phase 1-3",
+  metadata: { debugStage: "analyze", effort: "15m" },
+  addBlockedBy: ["{collect-task-id}"]
+)
+```
+
+### Fix Task
+```
+TaskCreate(
+  subject: "Fix root cause: {root_cause_summary}",
+  description: "Address root cause, add defense-in-depth validation. See defense-in-depth.md",
+  metadata: { debugStage: "fix", effort: "20m" },
+  addBlockedBy: ["{analyze-task-id}"]
+)
+```
+
+### Verify Task
+```
+TaskCreate(
+  subject: "Verify fix with fresh evidence",
+  description: "Run tests, confirm issue resolved. NO CLAIMS WITHOUT EVIDENCE. See verification.md",
+  metadata: { debugStage: "verify", effort: "5m" },
+  addBlockedBy: ["{fix-task-id}"]
+)
+```
+
+## Parallel Evidence Collection
+
+For multi-source investigations, spawn parallel collection agents:
+
+```
+// Parallel — no blockedBy between them
+TaskCreate(subject: "Collect CI/CD pipeline logs",   metadata: { source: "ci",     agentIndex: 1 })
+TaskCreate(subject: "Collect application server logs", metadata: { source: "server", agentIndex: 2 })
+TaskCreate(subject: "Query database for anomalies",   metadata: { source: "db",     agentIndex: 3 })
+
+// Analyze blocks on ALL collection:
+TaskCreate(subject: "Analyze root cause from collected evidence",
+  addBlockedBy: ["{ci-id}", "{server-id}", "{db-id}"])
+```
+
+## Re-Investigation Cycle
+
+When fix doesn't resolve → new analyze-fix-verify cycle:
+
+```
+TaskCreate(subject: "Re-analyze: fix attempt {N} failed",
+  addBlockedBy: ["{verify-task-id}"],
+  metadata: { debugStage: "analyze", cycle: 2 })
+```
+
+Limit to 3 cycles. After cycle 3 → question architecture (systematic-debugging.md Phase 4.5).
+
+## Report Sync-Back
+
+After investigation, write diagnostic report per reporting-standards.md. Report persists as "source of truth" (tasks are session-scoped only).

package/agentic/opencode/.opencode/skills/debugger/references/verification.md

@@ -0,0 +1,80 @@
+# Verification Before Completion
+
+Run verification commands and confirm output before claiming success.
+
+## The Iron Law
+
+```
+NO COMPLETION CLAIMS WITHOUT FRESH VERIFICATION EVIDENCE
+```
+
+If haven't run verification command in this message, cannot claim it passes.
+
+## The Gate Function
+
+```
+BEFORE claiming any status or expressing satisfaction:
+
+1. IDENTIFY: What command proves this claim?
+2. RUN: Execute FULL command (fresh, complete)
+3. READ: Full output, check exit code, count failures
+4. VERIFY: Does output confirm claim?
+   - If NO: State actual status with evidence
+   - If YES: State claim WITH evidence
+5. ONLY THEN: Make claim
+```
+
+## Common Failures
+
+| Claim | Requires | Not Sufficient |
+|-------|----------|----------------|
+| Tests pass | Test command output: 0 failures | Previous run, "should pass" |
+| Linter clean | Linter output: 0 errors | Partial check, extrapolation |
+| Build succeeds | Build command: exit 0 | Linter passing, logs look good |
+| Bug fixed | Test original symptom: passes | Code changed, assumed fixed |
+| Agent completed | VCS diff shows changes | Agent reports "success" |
+
+## Red Flags - STOP
+
+- Using "should", "probably", "seems to"
+- Expressing satisfaction before verification ("Great!", "Perfect!", "Done!")
+- About to commit/push/PR without verification
+- Trusting agent success reports
+- Relying on partial verification
+
+## Key Patterns
+
+**Tests:**
+```
+✅ [Run test command] → [See: 34/34 pass] → "All tests pass"
+❌ "Should pass now" / "Looks correct"
+```
+
+**Regression tests (TDD Red-Green):**
+```
+✅ Write → Run (pass) → Revert fix → Run (MUST FAIL) → Restore → Run (pass)
+❌ "I've written regression test" (without red-green verification)
+```
+
+**Build:**
+```
+✅ [Run build] → [See: exit 0] → "Build passes"
+❌ "Linter passed" (linter doesn't check compilation)
+```
+
+**Agent delegation:**
+```
+✅ Agent reports success → Check VCS diff → Verify changes → Report actual state
+❌ Trust agent report without independent verification
+```
+
+## When To Apply
+
+**ALWAYS before:**
+- ANY success/completion claims
+- ANY expression of satisfaction
+- Committing, PR creation, task completion
+- Moving to next task
+- Delegating to agents
+
+**Non-negotiable.** Run command. Read output. THEN claim result.