@vegastack/skills 0.1.0

package/skill/vegastack-arch-guardian/references/architecture/connectors-sandbox.md

@@ -0,0 +1,39 @@
+# Connectors and sandbox
+
+Apply connector rules only to enabled/observed connectors, MCP or webhooks. Apply sandbox rules only to enabled/observed untrusted execution. Ordinary trusted application code does not activate a sandbox requirement.
+
+## Connector boundary
+
+- **CONN-001 — Capability-bound tools.** Every tool call **MUST** carry an expiring capability bound to audience, resource, action, workspace, data class, risk class, and approval requirement. Subagents receive attenuated capabilities and no ambient credentials.
+- **CONN-002 — Connector credentials.** Access and refresh tokens **MUST** remain encrypted references outside agents and sandboxes. Refresh **MUST** be single-flight and revoke on disable, deprovision, or policy loss.
+- **CONN-003 — Trusted outbound fetch.** Connector and MCP HTTP **MUST** revalidate every redirect, couple DNS validation to the actual connection, reject private/loopback/link-local/metadata/multicast targets, strip cross-origin credentials, and bound method, port, path, body, response, and time.
+- **CONN-004 — MCP token separation.** MCP access tokens **MUST** be resource/audience-bound and validated on every request; because MCP `2026-07-28` accepts or rejects each request independently, validation **MUST NOT** rely on session or handshake state. An inbound token **MUST NOT** be forwarded to an upstream API; use a separate downstream credential and per-client consent. [MCP-SPEC]
+- **CONN-005 — Webhook admission.** Webhook ingress **MUST** verify a signature over the raw bounded body, enforce timestamp/replay windows and event dedupe, derive the workspace from server-owned mappings, and durably admit before acknowledgement.
+
+Classify tools as read-only, reversible write, irreversible/external effect, privileged administrative, or untrusted execution. Default-deny unknown tools. High-risk or capability-escalating calls require an EVE approval gate with reason, expiry, actor, decision, and immutable audit.
+
+Target MCP spec revision `2026-07-28`: each request declares its protocol version via `io.modelcontextprotocol/protocolVersion` in `_meta` (mirrored in the `MCP-Protocol-Version` header on Streamable HTTP), servers implement the mandatory `server/discover` RPC advertising supported versions, capabilities, and identity, and unsupported versions fail with `UnsupportedProtocolVersionError` for a retry at a mutually supported revision. <!-- source: MCP-SPEC --> Track the spec's deprecated-features registry; deprecated features carry a minimum twelve-month removal window (ninety days expedited), so plan migrations from it rather than from breakage. <!-- source: MCP-SPEC --> [MCP-SPEC]
+
+## Sandbox boundary
+
+- **SBX-001 — Untrusted execution.** Production untrusted code **MUST** use a provider sandbox uniquely bound to workspace, run, and trust class. Local execution is trusted-development only.
+- **SBX-002 — Credential-free sandbox.** A sandbox **MUST NOT** receive database, OpenBao, model-provider, connector-refresh, or ambient object-store credentials. Trusted broker code MAY inject an upstream credential only after validating a short-lived capability and must never return it.
+- **SBX-003 — Default-deny egress.** Egress **MUST** default deny. Trusted policy **MUST** constrain destination, method, path, headers, redirects, body, and response; discard sandbox-provided `Authorization`, cookies, and `Host` before reconstructing the request.
+- **SBX-004 — Disposable execution.** Enforce CPU, memory, disk, process, network, output, and time quotas plus cleanup and sweeper reconciliation. Correctness and durable state **MUST NOT** depend on sandbox process or filesystem survival.
+- **SBX-005 — Provider contract.** A provider **MUST** declare isolation, lifecycle, quotas, network controls, file transfer, streaming, cleanup, region/jurisdiction, and capability stability; conformance tests determine support.
+
+```mermaid
+flowchart LR
+  Eve["EVE with scoped capability"] --> Broker["Trusted broker"]
+  Broker --> Policy["Tenant, action, destination policy"]
+  Policy --> Sandbox["Disposable sandbox"]
+  Sandbox --> Request["Credential-free request intent"]
+  Request --> Broker
+  Broker --> Upstream["Allowlisted upstream with injected credential"]
+  Sandbox -. blocked .-> Private["Private, metadata, or arbitrary network"]
+  Sandbox -. no access .-> Secrets["Database, OpenBao, provider keys"]
+```
+
+Cloudflare Sandbox is preferred and Modal is the main alternative behind `SandboxProvider`. Cloudflare outbound Internet is open unless explicitly restricted: set `allowedHosts`, which becomes a deny-by-default allowlist once configured, plus `deniedHosts` for explicit blocks; route credentialed egress through outbound handlers, changeable at runtime via `setOutboundHandler()`; per-instance TLS interception (an ephemeral CA per sandbox, available since `@cloudflare/sandbox` 0.8.9) extends handler policy to HTTPS. <!-- source: CF-SANDBOX --> The API accepts glob patterns; SBX-003 still requires deny-by-default egress without wildcards, so allowlists pin exact hosts. Modal also requires explicit network restriction. [CF-SANDBOX] [MODAL-SANDBOX]
+
+Test IPv4/IPv6, DNS rebinding, redirect hops, header stripping, token expiry/replay, cross-tenant sandbox IDs, credential-bearing errors/responses, quota, timeout, cancellation, crash, and cleanup.

package/skill/vegastack-arch-guardian/references/architecture/data-memory.md

@@ -0,0 +1,25 @@
+# Data and memory
+
+Apply each rule only to its enabled/observed data capability. A stateless/shared-package project need not add PostgreSQL, knowledge, memory, object storage or Valkey.
+
+- **DATA-001 — System of record.** PostgreSQL **MUST** be the authoritative business store. Valkey MAY accelerate measured hot paths but correctness **MUST NOT** depend on it. [POSTGRES-DOCS]
+- **DATA-002 — Knowledge storage.** Default knowledge retrieval **MUST** use tenant-scoped PostgreSQL FTS plus pgvector; binary objects use an S3-compatible abstraction with checksums and version IDs. [PGVECTOR] [S3-SPEC]
+- **DATA-003 — Separate state classes.** EVE conversation state, curated durable memory, and provenance-bearing knowledge **MUST** remain distinct. Model-generated memory is a proposal that passes policy, dedupe, classification, provenance, and retention before persistence.
+- **DATA-004 — Lifecycle policy.** Every data class **MUST** define purpose, location, retention, export, deletion propagation, backup expiry, legal-hold behavior, and owner. Deletion **MUST** be tracked and reconciled across PostgreSQL, objects, indexes/vectors, caches, telemetry, and downstream connectors.
+- **DATA-005 — Object boundary.** Object upload/download **MUST** use short-lived scoped access, size/type validation, encryption, and applicable malware scanning. Production buckets and long-lived object credentials **MUST NOT** be mounted into a sandbox.
+
+| Data | Authoritative owner | Required metadata |
+|---|---|---|
+| business and tenant records | PostgreSQL | workspace, policy version, audit correlation |
+| agent execution | EVE/Postgres World | session, step/event cursor, published version |
+| curated memory | application PostgreSQL | provenance, classifier, retention, supersession |
+| knowledge chunks | PostgreSQL/pgvector | source, extraction and embedding versions, access policy |
+| binary objects | S3-compatible store | workspace, checksum, version, data class, retention |
+
+Authorize before retrieval and before producing snippets. Enforce workspace/data policy in SQL/RLS, include provenance and source timestamps, version extraction/chunking/embedding, and treat retrieved text as untrusted data rather than instructions.
+
+Residency claims require enforceable jurisdiction restrictions and tested placement; provider hints alone are insufficient. Legal hold suspends ordinary deletion only for the scoped records and must remain auditable.
+
+Add Valkey only after a measured cache or coordination benefit exists and the PostgreSQL-backed correctness path passes without it.
+
+The pinned baseline is the PostgreSQL 17.x series; PostgreSQL 18 (GA, 18.4 current minor) is the candidate upgrade horizon and adopting it requires re-qualifying RLS, pg-boss, and Workflow World behavior for the exact tuple. <!-- source: POSTGRES-DOCS -->

package/skill/vegastack-arch-guardian/references/architecture/delivery-operations.md

@@ -0,0 +1,34 @@
+# Delivery and operations
+
+Apply test and release boundaries only to enabled capabilities and declared deployables. Never report an absent capability as an untested control.
+
+- **DEL-001 — Boundary verification.** Tests **MUST** cover every applicable enabled boundary—contracts/code generation, RLS/tenant negatives, EVE replay/evals, pg-boss crash/retry, sandbox egress/secrets, web/mobile E2E, performance, restore, and dependency failure. Static sentinels never substitute for runtime qualification.
+- **DEL-002 — Compatible migrations.** Migrations **MUST** use expand, migrate, and contract: add backward-compatible schema, deploy compatible code, backfill idempotently with progress, verify, switch reads/writes, and remove only after the rollback window.
+- **DEL-003 — Migration safety.** Destructive migrations **MUST NOT** run as unreviewed application startup side effects. Estimate locks/rewrites, bound batches, verify backup/restore, expose progress, and define rollback or forward-fix.
+- **DEL-004 — Release identity.** Release artifacts **MUST** record source/lock/toolchain digests, exact dependencies, generated outputs, tests and skips, package/container digests, SBOM, provenance, signatures, migrations, profile/ADR identity, target, and rollback artifact.
+- **DEL-005 — Relevant freshness.** Refresh official evidence only for affected rules/topics. Critical security, auth, tenancy, durability, secrets, and deployment evidence **MUST** fail closed when stale or unavailable; unrelated work stays on the fast path.
+- **DEL-006 — Honest verification.** Environment-bound replay, isolation, failover, restore, and provider tests **MUST** be reported as `NOT RUN` when not executed, with reason, risk, owner, and next action.
+
+## Required test boundaries
+
+| Boundary | Minimum evidence |
+|---|---|
+| API/schema | Zod → OpenAPI → clients deterministic and compatible |
+| identity/tenancy | session/revocation, OAuth/PKCE, SCIM, composite keys, per-table RLS negatives |
+| execution | exact tuple, publication pin, approval, replay, waits, effects, cancellation |
+| admission/jobs | atomic enqueue, dedupe, retry/heartbeat, DLQ, ordinary job separation |
+| connectors/sandbox | SSRF/replay, capability scope, no credentials, egress, quota, cleanup |
+| clients/channels | reconnect, offline mutation, push/deep links, localization, accessibility |
+| operations | load, process/dependency/cell loss, PITR/restore, migration rollback |
+
+CI fails on hard-rule violations, nondeterministic generated output, broken references/source IDs, stale critical evidence, unsupported placement, incompatible migrations/contracts, or security/durability regressions. Flaky critical tests are defects and must not be silently retried to green.
+
+## Rollout and maintenance
+
+Roll out by profile, cell, or cohort with health gates; preserve protocol compatibility during mixed versions; drain long-running workers; and keep code/config rollback independent where schema permits.
+
+Bootstrap by creating the profile, choosing an exact hosting profile, linking exceptions, validating placement/versions, refreshing affected sources, checking generated contracts, running architecture checks, and completing threat/deployment review.
+
+Doctor verifies Node availability, profile structure, installed-skill integrity, and deterministic static invariants. It does not prove database connectivity/extensions, source freshness, OpenBao identity, generated-contract drift, or live object/sandbox/model behavior.
+
+Use the bundled ADR, threat-model, service-design, and deployment-review templates when relevant. Maintain applicable runbooks and review exceptions regularly; setup scripts never create paid or cloud resources implicitly.

package/skill/vegastack-arch-guardian/references/architecture/durable-execution.md

@@ -0,0 +1,43 @@
+# Durable execution
+
+Apply EVE/Workflow/AgentRun rules only when agents are enabled or observed. Apply pg-boss rules only when owned agent admission or ordinary jobs are enabled or observed. A non-agentic project does not require EVE, Workflow World, AgentRun or pg-boss.
+
+## Exclusive ownership
+
+- **DUR-001 — One workflow owner.** EVE with its compatible PostgreSQL Workflow World **MUST** exclusively own durable agent sessions, steps, waits, approvals, continuations, hooks, streams, and tool-loop state. Do not introduce a second workflow engine, tool loop, HITL store, or execution queue.
+- **DUR-002 — Exact production tuple.** Production **MUST** pin `eve@0.29.5` and `@workflow/world-postgres@5.0.0-beta.30`; the lock **MUST** resolve its compatible `@workflow/world@5.0.0-beta.23` and `@workflow/world-local@5.0.0-beta.32`. Upgrade the family atomically. Local Workflow Worlds/files are development-only and forbidden in production. [EVE-PINNED] [WORKFLOW-PG]
+- **DUR-003 — Admission owner.** pg-boss **MUST** own transactional application admission and ordinary background jobs only. It **MUST NOT** model EVE execution state or use flow features as a second agent workflow engine. [PGBOSS-1227]
+- **DUR-004 — Product record.** AgentRun **MUST** retain authoritative product/audit inputs and a cursor-versioned projection of EVE events. Projection is required behavior in a trusted long-running plane, not a required standalone deployable. It **MUST** declare its source, direction, reconciliation, and monotonic update rule; it is not replay truth.
+- **DUR-005 — Transaction boundary.** The control plane **MUST** create AgentRun and one pg-boss admission job in the same PostgreSQL transaction when possible. The job carries the deterministic admission key and AgentRun records pending/accepted audit state plus the unique EVE session reference. Use an outbox only when a transaction or database boundary prevents atomic enqueue.
+- **DUR-006 — External effects.** Every retried external effect **MUST** use an idempotency/effect fence and reconciliation. Job claiming or step replay is not proof of exactly-once external side effects.
+- **DUR-007 — Replay qualification.** Production durable execution **MUST** reproduce crash behavior before/after checkpoints and effects, completed-step replay, interrupted-step idempotency, approval persistence, wait/resume, cancellation, cursors, mixed-version migration, and PostgreSQL recovery for the exact tuple.
+- **DUR-008 — Tenant-qualified World.** Before shared-database production, every tenant-bearing Workflow World record and service role **MUST** satisfy `TEN-001` through `TEN-004`. A tuple that cannot preserve that boundary **MUST** fail qualification; RLS weakening, owner roles, and `BYPASSRLS` are forbidden.
+- **DUR-009 — Workflow exit contract.** Owning the workflow engine does not exempt it from provider neutrality: production durable execution **MUST** maintain an exit/migration contract naming the engine-specific constructs in use (sessions, steps, waits, approvals, hooks, streams), an exportable schema for durable session and event state, a drain/quiesce procedure, and a documented migration path with rollback to a replacement engine or major version. The contract is reviewed with the same cadence as the pinned tuple; a lock without an exit plan is accepted risk, not neutrality.
+
+```mermaid
+sequenceDiagram
+  participant API as Control plane
+  participant PG as PostgreSQL and pg-boss
+  participant Eve as EVE worker
+  participant World as Postgres Workflow World
+  participant Tool as External effect
+  API->>PG: AgentRun and admission job in one transaction
+  PG->>Eve: dispatch workspace and admission key
+  Eve->>World: create or find durable session
+  Eve->>Tool: approved, fenced effect
+  Tool-->>Eve: result
+  Eve->>World: checkpoint and emit event
+  World-->>PG: trusted projection handler advances AgentRun cursor
+```
+
+## Admission and recovery
+
+Use `(workspace_id, admission_key)` as the logical start key. After a lost acknowledgement, look up the same EVE session before retrying; a retry never creates another logical run. The trusted EVE-event projection handler, not the admission job, supplies terminal execution state; it MAY run inside an existing trusted long-running deployable.
+
+Use pg-boss groups/priority plus measured wait age for ordinary tenant fairness. Add a separate selector/lease table only when reproduced strict global quota or starvation requirements exceed pg-boss semantics; that extraction needs an ADR and must not model EVE execution.
+
+Configure bounded retries/backoff, heartbeats, dedupe, attempt history, DLQ/redrive, inspect/cancel operations, and graceful shutdown. Redrive reuses the same admission key and effect fence. LISTEN/NOTIFY MAY reduce latency, but polling remains the safety path. [PGBOSS-1227]
+
+Do not assume same-session FIFO unless reproduced for the exact tuple.
+
+Qualification evidence remains tuple-specific and environment-specific. The pinned `eve@0.29.5` tuple is beta; <!-- source: EVE-PINNED --> `@workflow/world-postgres` remains a `5.0.0-beta` line, and the workflow SDK reaching GA is a mandatory human re-review trigger for `DUR-002` and `DUR-009` — re-evaluate the pin, the migration path, and the exit contract at that point rather than upgrading silently. <!-- source: WORKFLOW-PG -->

package/skill/vegastack-arch-guardian/references/architecture/flutter.md

@@ -0,0 +1,26 @@
+# Flutter client
+
+Apply this reference only when the `flutter` capability is enabled or Flutter code is observed.
+
+## Architecture
+
+- **MOB-001 — Delegated mobile identity.** Flutter **MUST** use Better Auth OAuth 2.1/OIDC authorization code with S256 PKCE, discovery, consent, refresh rotation, and revocation. Better Auth Bearer session transport is not the mobile foundation. [BETTERAUTH-OAUTH] [APP-AUTH]
+- **MOB-002 — Generated client.** Flutter **MUST** consume the generated OpenAPI client and must not maintain parallel request/response types.
+- **MOB-003 — Local secrets.** Refresh tokens and device-bound secrets **MUST** use platform secure storage; logs, analytics, crash reports, deep links, and ordinary local databases **MUST NOT** contain them.
+- **MOB-004 — Push and link boundary.** Push payloads **MUST NOT** contain sensitive content or credentials; clients authenticate and fetch authoritative state. Universal/app links **MUST** validate scheme, host, path, state, expiry, and authenticated tenant before navigation.
+
+Organize code by Riverpod feature modules with declarative routing and online-first repositories. Expose loading, stale, error, retry, and conflict state rather than hiding network state. [FLUTTER-DOCS] [RIVERPOD-DOCS]
+
+Apply pinned claims to the Flutter 3.44 stable series (Dart 3.12), the current stable baseline; adopting a newer stable is source drift that requests scoped review, matching how other foundation-compatibility families handle version advances. <!-- source: FLUTTER-DOCS -->
+
+## Network and local state
+
+Attach access tokens only to allowlisted API origins. Refresh through one coordinated path; on reuse, revocation, or invalid grant, clear credentials and require authentication. Bind idempotency keys to mutating commands and reconcile optimistic state with the server.
+
+Classify cached data by sensitivity and retention. Encrypt confidential caches, scope them to account and workspace, purge them on sign-out, revocation, workspace removal, or policy change, and make schema migrations reversible or safely destructive.
+
+## Push, links, and release
+
+Treat notifications as hints and deduplicate them by event ID. [FCM-DOCS] [APNS-DOCS]
+
+Support localized UI and templates, RTL, IANA timezones, accessibility semantics, font scaling, and locale-aware formatting. Release gates should cover generated-client drift, OAuth/PKCE, token refresh/revocation, offline mutation recovery, tenant switching, push/deep links, storage purge, localization, and accessibility.

package/skill/vegastack-arch-guardian/references/architecture/foundation.md

@@ -0,0 +1,33 @@
+# Foundation
+
+## Operating model
+
+VegaStack projects may be SaaS, internal/public products, platform services or shared packages; single- or multi-tenant; web-only, Flutter-enabled, agentic or non-agentic. Activate only declared or observed capabilities. Resolve decisions in this order: security/correctness; recovery; ownership; contracts; operability; delivery; optional optimization.
+
+- **FOUND-001 — Confirmed profile.** For architecture conformance checks, a project **MUST** commit a confirmed v3 `.vegastack/architecture.json` containing only applicable, confirmed facts (legacy `.yaml`-named JSON is accepted with a deprecation notice). [invariant; activation: CI/profile work; verification: structural+semantic; waiver: project ADR]
+- **FOUND-002 — Project exceptions.** A project exception **MUST** use exact rule/control/path scope and a contained accepted ADR with project owner, rationale/decision, risks, controls, verification, rollback/migration, review date or event, and foundation-deviation acknowledgement. [invariant; activation: exception declared; verification: semantic+filesystem; waiver: project ADR]
+- **FOUND-003 — Honest outcomes.** The guardian **MUST NOT** represent accepted risk as safe or foundation-compliant: report `PASS`, `FAIL`, `EXCEPTED`, and `NOT VERIFIED` exactly, and keep a rejection recommendation when warranted. [invariant; activation: every decision/review; verification: output review; waiver: project ADR]
+- **FOUND-004 — Capability alignment.** Declared capability status, ownership, versions, placement, roots and contracts **MUST** match project intent and repository evidence; removal **MUST** clean durable data, credentials, queues and contracts. [invariant; activation: capability declared/observed/removed; verification: static+semantic+runtime; waiver: project ADR]
+
+Every project architecture rule is waivable by an active project-owner ADR. A valid ADR changes a matching violation to `EXCEPTED` and may allow CI success, but it never proves safety. Invalid, expired or mismatched exceptions fail. Foundation changes and project accepted risks remain distinct.
+
+Prefer reproduced behavior over prose and official primary sources over secondary material. Apply pinned claims to the pinned baseline; current documentation describes current capability. Source drift requests scoped review and does not automatically expire ADRs.
+
+## Ownership and portability
+
+Product-owned enabled capabilities are the default. Shared-managed and external-managed services are explicit exceptions to ownership, not compliance exceptions; require the complete service contract in the profile. A consumer of shared EVE or another shared service does not contain the provider's source roots.
+
+Use PostgreSQL, REST/OpenAPI, OCI, S3-compatible objects, OpenTelemetry, OAuth/OIDC and provider-neutral sandbox/model interfaces when their capabilities apply. Provider features must not become hidden correctness dependencies.
+
+The foundation excludes billing, pricing and Stripe. Usage, quota, capacity, token, sandbox and storage accounting remain applicable when those resources exist. Add optional infrastructure only after the trigger in its reference is met.
+
+## Enforcement
+
+| Class | Treatment |
+|---|---|
+| invariant / forbidden design | CI failure when detectable; otherwise manual qualification |
+| preferred default | warning with evidence-backed reason to vary |
+| permitted option | supported only inside declared activation and ownership boundaries |
+| valid project ADR | visible `EXCEPTED`; CI may pass; recommendation remains unmet |
+
+Choose the smallest design meeting current requirements and measured objectives. Challenge a foundation default when project evidence shows it does not fit; use an ADR to record the project decision.

package/skill/vegastack-arch-guardian/references/architecture/hosting-reliability.md

@@ -0,0 +1,37 @@
+# Hosting and reliability
+
+Apply a hosting profile only to declared production deployables. `none` is valid for a non-deployable shared package. EVE/jobs placement clauses activate only when those owned capabilities are enabled.
+
+## Exact placement profiles
+
+- **HOST-001 — Declared profile.** A deployable **MUST** match one exact profile below; provider capability does not silently change the selected baseline.
+- **HOST-002 — Self-hosted.** Starter production **MUST** use OCI deployables with Docker Compose documented as non-HA. It requires externalized backups, TLS, OpenBao bootstrap, monitoring, capacity, and explicit single-host failure handling.
+- **HOST-003 — Vercel.** The Vercel profile **MUST** use the `vercel-web-external-eve` baseline: Next runs on Vercel while EVE and pg-boss run in qualified external long-running Node/OCI placements with direct PostgreSQL access. AgentRun projection initially belongs to this trusted long-running plane. This is a VegaStack profile choice, not a claim that Vercel lacks other capabilities.
+- **HOST-004 — Cloudflare/OpenNext.** The OpenNext Worker owns only the Next control plane. EVE, Workflow packages, pg-boss workers, and background daemons **MUST NOT** enter its source or bundle. Tenant/auth paths use cache-disabled direct PostgreSQL semantics; `nodejs_compat` does not make the Worker a general Node process. [OPENNEXT-1202] [CF-WORKERS] [HYPERDRIVE]
+
+| Profile | Next | EVE and jobs | PostgreSQL/World | Required warning |
+|---|---|---|---|---|
+| self-hosted | Node OCI | Node OCI | direct PostgreSQL | Compose is non-HA |
+| Vercel | Vercel Next | external Node/OCI | external direct PostgreSQL | external runtime ownership |
+| Cloudflare/OpenNext | OpenNext Worker | external Node/OCI | external direct PostgreSQL | Worker Node subset; auth cache off |
+
+Profile changes require an ADR, deployment review, data/secret migration, contract and recovery tests, rollout, and rollback.
+
+## Reliability
+
+- **REL-001 — Measured objectives.** Each production profile **MUST** define measured objectives for its applicable enabled boundaries (such as API latency, admission age, EVE continuation, SSE freshness, dependency success or notification delivery), with RPO/RTO only where durable data and recovery requirements exist.
+- **REL-002 — Reproduced recovery.** Recovery plans **MUST** use encrypted PostgreSQL backups plus WAL/PITR, object versioning/replication where required, OpenBao recovery procedures, and independent restore verification. A successful backup job is not restore evidence.
+- **REL-003 — Regional ownership.** Add cells only for measured capacity, residency, or blast-radius needs. A workspace and its authoritative business/workflow state **MUST** have one home cell; moves use quiescence, copy, validation, cutover, and rollback.
+- **REL-004 — Incident ownership.** Teams **MUST** maintain owned runbooks for cross-tenant exposure, credential theft, workflow/job stalls, database loss, sandbox egress/escape, model data incidents, connector abuse, provider/cell loss, and deletion failure.
+
+| Failure | Expected recovery evidence |
+|---|---|
+| Next loss | retry/idempotency; durable state intact |
+| pg-boss crash | lease retry; same admission/effect key |
+| EVE crash | World resume/replay; effect reconciliation |
+| PostgreSQL loss | fail closed; PITR/failover within objectives |
+| sandbox crash | recreate from durable inputs; cleanup reconciliation |
+| dependency outage | policy-safe fallback or visible pause |
+| cell loss | home-cell routing and exercised recovery plan |
+
+Add Kubernetes only when HA, scale, placement, or operational requirements exceed Compose/managed profiles. Change workflow ownership only after the qualified EVE/Postgres World baseline fails a required capability and an ADR proves migration and rollback. PostgreSQL 18 is the candidate major-version horizon for these profiles; treat it as a qualification event, not a drop-in upgrade. <!-- source: POSTGRES-DOCS -->

package/skill/vegastack-arch-guardian/references/architecture/identity-tenancy.md

@@ -0,0 +1,37 @@
+# Identity and tenancy
+
+Apply identity rules only to authenticated/delegated/service access that exists. Apply organization rules to multi-tenant workspace products. Apply `TEN-*` rules to shared-schema multi-tenancy; public, single-tenant and isolated-database projects do not acquire RLS requirements merely by using VegaStack.
+
+## Identity boundary
+
+- **AUTH-001 — Workspace boundary.** For authenticated multi-tenant products, Better Auth organization **MUST** be the workspace boundary. A client-supplied or session-cached active organization **MUST NOT** authorize access without current membership resolution. Projects MAY subdivide a workspace.
+- **AUTH-002 — Resource authorization.** `owner`, `admin`, and `member` are coarse membership roles; teams are grouping only. Application-owned typed resource policies and grants **MUST** be authoritative and default-deny. [BETTERAUTH-ORG]
+- **AUTH-003 — Browser sessions.** Browser authentication **MUST** use secure, HttpOnly, SameSite cookies. CSRF/origin checks **MUST NOT** be disabled; production origins **MUST** be exact HTTPS allowlists. Sensitive actions **MUST** revalidate the session and current membership against durable storage rather than trusting cookie cache. [BETTERAUTH-SESSIONS] [BETTERAUTH-SECURITY]
+- **AUTH-004 — Delegated clients.** Flutter, MCP, delegated applications, and third parties **MUST** use authorization code with S256 PKCE, discovery, explicit consent, audience/resource validation, refresh rotation, revocation, and introspection. Reject `require_pkce: false`; do not use the Bearer plugin as the mobile foundation. Verify that OAuth and OIDC discovery endpoints are reachable outside framework catch-all routes. [BETTERAUTH-OAUTH]
+- **AUTH-005 — Automation and services.** Workspace API keys **MUST** be organization-owned, hashed, scoped, expiring, rate-limited, and revocable. Internal services **MUST** use short-lived audience-bound OpenBao identities, with mTLS where practical. Neither identity may synthesize a browser session. [BETTERAUTH-APIKEY] [OPENBAO-DOCS]
+- **AUTH-006 — Enterprise provisioning.** SSO and SCIM connections **MUST** be organization-scoped. Production `defaultSCIM` and plaintext SCIM token storage are forbidden. Deprovisioning **MUST** revoke sessions, memberships, grants, API keys, connector access, and support elevation. [BETTERAUTH-SSO] [BETTERAUTH-SCIM]
+- **AUTH-007 — Support elevation.** Support access **MUST** be visible, reason/ticket-bound, narrowly scoped, expiring, revocable, and immutable-audited. It **MUST NOT** impersonate a user or bypass normal RLS.
+
+## Tenant database boundary
+
+- **TEN-001 — Composite tenant keys.** Every tenant-owned primary, unique, and foreign-key relationship **MUST** include `workspace_id`; a globally unique object ID is not tenant isolation.
+- **TEN-002 — Forced RLS.** Every tenant table **MUST** enable and force PostgreSQL RLS with fail-closed `USING` and `WITH CHECK` coverage appropriate to each command. [POSTGRES-DOCS]
+- **TEN-003 — Trusted transaction context.** Request roles **MUST** be non-owner and lack `BYPASSRLS`. Trusted server code **MUST** establish workspace, subject, and support context using `SET LOCAL` or `set_config(..., true)` inside the same explicit transaction as protected queries. Clients and pooled session state **MUST NOT** set it.
+- **TEN-004 — Privileged and batch paths.** Bulk, export, background, support, and maintenance paths **MUST** preserve tenant context. A `SECURITY DEFINER` function **MUST** use a fixed safe `search_path`, revoke public execution, validate tenant inputs, and avoid an RLS-bypassing owner.
+
+```mermaid
+sequenceDiagram
+  participant API as Trusted API
+  participant Policy as Typed authorizer
+  participant DB as PostgreSQL transaction
+  API->>Policy: subject, workspace, action, resource
+  Policy-->>API: allow plus policy version
+  API->>DB: BEGIN and SET LOCAL context
+  API->>DB: query with workspace composite key
+  DB-->>API: RLS-filtered result
+  API->>DB: append audit and COMMIT
+```
+
+Use cache-disabled database paths for auth, session, permission, and RLS-sensitive reads. Hyperdrive transaction pooling resets session state and eligible cached reads do not provide authorization freshness. [HYPERDRIVE]
+
+Qualification includes applicable cross-workspace IDs, joins, subqueries, composite foreign keys, inserts/updates, exports, background jobs, migrations, pool reuse, support expiry, role ownership, `SECURITY DEFINER`, SCIM deprovisioning, and session revocation.

package/skill/vegastack-arch-guardian/references/architecture/model-lifecycle.md

@@ -0,0 +1,18 @@
+# Model lifecycle
+
+Apply this reference only when external model providers are enabled or observed. It extends `MODEL-001` through `MODEL-003` with lifecycle, rollout, and pressure behavior; the provider-neutral adapter remains the enforcement point.
+
+- **MLIFE-001 — Explicit model pins.** Every route **MUST** pin an explicit model identifier. Floating aliases such as `latest` or provider-default snapshots are forbidden in production routes; alias resolution happens at review time, and the resolved identifier is what ships.
+- **MLIFE-002 — Deprecation watch.** The project **MUST** subscribe to deprecation and retirement notices for every pinned model and record, per model, the announced retirement date, the chosen successor, and a migration window that completes eval and cost qualification (`EVAL-002`, `COST-004`) before the provider deadline. A pinned model with a published retirement date and no successor plan is a `FAIL`, not a warning.
+- **MLIFE-003 — Canary rollout.** Prompt+model behavior changes reaching paying tenants **MUST** roll out by canary or cohort: a bounded traffic slice, pre-declared comparison metrics (eval score, error rate, latency, cost), and automatic or one-step rollback to the prior pinned pair. Pre-launch and internal-only surfaces may ship directly. Cohort assignment respects tenant policy; a tenant is never split across behavior variants within one conversation.
+- **MLIFE-004 — Provider backpressure.** Provider rate limits and `429`/overload responses **MUST** be absorbed by the adapter with bounded adaptive backoff, per-tenant fairness, and admission shedding at the queue edge — reject or defer new work visibly rather than retrying into a saturated provider. Retries **MUST NOT** amplify load, and fallback routing under pressure obeys `MODEL-003` policy preservation.
+
+## Retirement flow
+
+`pinned → deprecation notice → successor selected → eval and cost qualification → canary → cohort ramp → old pin removed`. Each step records evidence; skipping straight from notice to swap is qualification debt. Where the provider offers a legacy alias during migration, treat it as a bridge with an end date, not a destination. The provider model catalogs and deprecation registries are the watch surface. [ANTHROPIC-MODELS] [OPENAI-MODELS] [GOOGLE-MODELS]
+
+## Fallback and admission
+
+Fallback order is part of route policy: same-policy alternates first, degraded-capability alternates only when the product declares the degradation acceptable, visible pause when nothing satisfies policy. Record which pin actually served each request — a fallback that served traffic for a week is a de facto primary and must be qualified as one.
+
+Admission shedding is an architecture concern, not an error handler: quotas per workspace and per feature decide who waits when capacity shrinks, and shed work surfaces as retryable, audited outcomes rather than silent loss. Measure provider error and latency baselines continuously so a deprecation-driven migration has a comparison target.

package/skill/vegastack-arch-guardian/references/architecture/models-observability.md

@@ -0,0 +1,23 @@
+# Models and observability
+
+Apply model rules only when model routing is enabled or observed. Apply telemetry/audit rules to signals and audit surfaces the project actually emits.
+
+## Model routing
+
+- **MODEL-001 — Provider-neutral adapter.** Model calls **MUST** use a provider-neutral adapter that declares model capabilities, streaming, structured output, tool use, region, retention, key source, quota, timeout, and fallback policy.
+- **MODEL-002 — Key paths.** Platform keys stay in the trusted model service. Workspace BYOK **MUST** persist only as encrypted ciphertext/reference and be resolved just in time; agents and sandboxes receive neither key path.
+- **MODEL-003 — Policy-preserving fallback.** Fallback and caches **MUST NOT** weaken region, retention, key-source, data-class, or tenant policy. A blocked fallback pauses visibly rather than silently changing policy.
+
+Prefer Cloudflare AI Gateway behind the adapter; direct AI SDK providers and qualified self-hosted alternatives remain supported. Explicitly configure gateway logging/caching to the same privacy contract. [AI-GATEWAY] [AI-SDK-7]
+
+Record route decision, policy version, provider/model, key source, region, latency, token/usage estimate, cache/fallback state, approval link, and outcome—never the key. Low-retention/no-retention requests must fail closed when no route satisfies policy.
+
+## Telemetry and audit
+
+- **OBS-001 — Vendor-neutral telemetry.** Services **MUST** emit OpenTelemetry-compatible traces, metrics, and logs with W3C propagation and stable tenant-safe correlation. [OTEL-DOCS]
+- **OBS-002 — Metadata-only default.** Telemetry **MUST** default to metadata. Cookies, authorization headers, tokens, keys, prompts, restricted content, and unbounded tool output **MUST NOT** enter logs or traces.
+- **OBS-003 — Immutable audit.** Security and product audit events **MUST** be append-only, tenant-scoped, access-controlled, tamper-evident, retention-managed, and exportable to WORM storage where policy requires.
+
+Run history MAY expose inputs/outputs allowed by data policy, steps, tool calls, approvals, model decisions, usage, errors, and replay lineage. Do not store hidden chain-of-thought; retain structured reasons, decisions, and evidence references.
+
+Define owners and alerts for API latency, admission age, EVE stalls, connector/model/sandbox failures, SSE freshness, notification delivery, audit pipeline health, and deletion backlog.

package/skill/vegastack-arch-guardian/references/architecture/realtime-channels.md

@@ -0,0 +1,16 @@
+# Realtime and channels
+
+Apply realtime, notification and external-channel rules independently when each capability is enabled or observed.
+
+- **RT-001 — Resumable output.** Resumable SSE **MUST** be the default for run output and server-to-client events. Events need tenant and run identity, monotonic cursor/event ID, type/schema version, timestamp, trace correlation, and replay/terminal reconciliation.
+- **RT-002 — WebSocket trigger.** WebSockets MAY be added only for true bidirectional collaboration or presence; they **MUST NOT** become durable state or the default agent-output transport.
+- **RT-003 — Event ownership.** Every event type **MUST** name one authoritative producer, allowed consumers, ordering scope, dedupe key, retention, authorization, and redaction policy.
+- **RT-004 — Channel boundary.** Slack, Teams, Gmail, Outlook, and public API adapters **MUST** normalize identity, workspace mapping, consent, dedupe, threading, attachments, rate limits, retries, and revocation. They **MUST NOT** own workflow state.
+- **RT-005 — Notification intent.** In-app, email, FCM, and APNs delivery **MUST** originate from one durable tenant-scoped notification intent with channel attempts, preferences, locale, timezone, quiet hours, dedupe, receipt, and audit state.
+- **RT-006 — Channel admission.** Channel ingress **MUST** authenticate the provider, derive tenancy from server-owned mappings, enforce replay/dedupe, and durably admit before acknowledging work that can outlive the request.
+
+Interactive reconnect sends the last acknowledged cursor; the server replays authorized retained events or returns a snapshot/terminal result when replay is unavailable. Slow consumers need bounded buffers, backpressure, cancellation, and visible truncation.
+
+Create notification intent in the same transaction as the business event when possible; use an outbox only across a transaction/database boundary. Push payloads remain non-sensitive hints and clients fetch authoritative state.
+
+Add collaboration/presence infrastructure only after a bidirectional requirement and ordering scope are explicit; agent streaming alone is not a trigger.

package/skill/vegastack-arch-guardian/references/architecture/security-privacy.md

@@ -0,0 +1,23 @@
+# Security and privacy
+
+Apply threat scenarios to enabled/exposed services and capabilities. Absence of a capability is not a missing control; observed sensitive data, secrets or execution activates the relevant boundary.
+
+- **SEC-001 — Threat model.** Every enabled/exposed service and capability **MUST** model its applicable tenant crossing, confused deputy, prompt/tool injection, SSRF, credential theft, replay, support abuse, sandbox escape/exfiltration, supply-chain, resource exhaustion, and deletion-failure scenarios.
+- **SEC-002 — Secret custody.** When production secrets exist, workspace BYOK and connector tokens **MUST** persist only as encrypted ciphertext/reference; project-owned production secret/KMS functions, service identities, rotation, revocation, and audit **MUST** use OpenBao. Plaintext secrets in code, profiles, logs, telemetry, agents, or sandboxes are forbidden. [OPENBAO-DOCS]
+- **SEC-003 — Enforced authorization.** Prompts and model instructions **MUST NOT** be treated as security controls. Typed authorization, capabilities, EVE approval gates, database RLS, egress policy, quotas, and immutable audit enforce decisions.
+- **SEC-004 — Supply chain.** Builds **MUST** use reviewed locks, registry integrity, canonical tags/commits, isolated builders, vulnerability/license review, pinned image digests, SBOM, provenance, and signatures for release artifacts.
+- **SEC-005 — Abuse controls.** Systems **MUST** apply tenant/identity/IP/risk-class quotas, payload and output limits, anomaly detection, suspension/kill switches, appeal/restore paths, and immutable administrative audit.
+
+| Control objective | Required mechanism |
+|---|---|
+| tenant isolation | `TEN-001` through `TEN-004`, typed grants, negative tests |
+| least privilege | `AUTH-002`, `CONN-001`, short-lived service identities |
+| untrusted execution | `SBX-001` through `SBX-005` |
+| confidentiality | `SEC-002`, `MODEL-002`, `OBS-002`, encryption and redaction |
+| durable accountability | EVE checkpoints, AgentRun projection, `OBS-003` |
+| privacy lifecycle | `DATA-004`, export/deletion reconciliation, legal-hold scope |
+| recovery | qualified backups, PITR, restore and incident drills |
+
+Map evidence to applicable SOC 2 security/availability/confidentiality/privacy criteria and GDPR principles, lawful basis, data-subject rights, processor/subprocessor duties, breach response, transfers, and retention. This mapping supports control design; it is not a certification or legal conclusion.
+
+Threat and deployment reviews identify detection, containment, evidence preservation, recovery, communication, owner, and verification for every material scenario.

package/skill/vegastack-arch-guardian/references/architecture/topology-monorepo.md

@@ -0,0 +1,47 @@
+# Topology and monorepo
+
+The topology is composable. Include only enabled project-owned capabilities; shared/external providers sit behind declared contracts and need no consumer source root.
+
+## Runtime ownership
+
+- **RUN-001 — EVE placement.** EVE **MUST** run as a separate officially supported long-running Node/OCI service and **MUST NOT** run inside an OpenNext Worker or request-lifetime function. Pinned `eve@0.29.5` requires Node 24+, and its PostgreSQL Workflow World needs a long-lived worker. [EVE-PINNED] [WORKFLOW-PG]
+- **RUN-002 — Job placement.** pg-boss workers **MUST** run in a separate supported Node/OCI placement, never inside the OpenNext request bundle.
+- **RUN-003 — Explicit provider boundary.** Provider-specific compute, storage, model, and sandbox behavior **MUST** remain behind declared adapters and hosting profiles.
+- **RUN-004 — Runtime qualification.** Bun compatibility **MUST NOT** be treated as proof that a deployable is supported on Node, Workers, Flutter, or another production runtime.
+
+```mermaid
+flowchart LR
+  Client["Web, Flutter, channels"] --> Next["Next.js control plane"]
+  Next --> PG["PostgreSQL system of record"]
+  Next --> Boss["pg-boss admission and jobs"]
+  Boss --> Eve["EVE long-running Node service"]
+  Eve --> World["PostgreSQL Workflow World"]
+  Eve --> Broker["Trusted capability broker"]
+  Broker --> Sandbox["Untrusted sandbox"]
+  Eve --> Model["Model adapter"]
+  Eve --> Objects["S3-compatible objects"]
+  OpenBao["OpenBao"] --> Next
+  OpenBao --> Eve
+```
+
+| Component | Owns | Must not own |
+|---|---|---|
+| Next.js | UI, RSC, Route Handlers, Better Auth, REST/OpenAPI, admission transaction | long-running execution |
+| pg-boss | transactional admission and ordinary jobs | EVE sessions, steps, waits, approvals, hooks, or streams |
+| EVE + Postgres World | durable agent execution state | business admission/fairness queue |
+| AgentRun | product/audit inputs and execution projection | workflow replay internals |
+| sandbox broker/provider | isolated execution and scoped capabilities | database, OpenBao, or provider credentials |
+| PostgreSQL | business truth, jobs, Workflow World, FTS/vector metadata | binary object payloads |
+
+OpenNext supports the selected Next.js request surface, but Workers provides only a subset of Node APIs; `nodejs_compat` is not a general Node process. [OPENNEXT-1202] [CF-WORKERS]
+
+## Workspace and packages
+
+Use a Bun/Turborepo workspace for JavaScript/TypeScript and Flutter orchestration. Production deployables use their supported runtimes.
+
+- **PKG-001 — Directed package graph.** Apps **MUST NOT** import another app's internals. Domain packages **MUST NOT** depend on Next.js, Flutter, UI, or provider SDKs; adapters depend on provider-neutral contracts.
+- **PKG-002 — Generated contracts.** Zod is editable API source; OpenAPI, Flutter/public clients, schema snapshots, and the packaged skill copy **MUST** be deterministic outputs with source and tool digests.
+- **PKG-003 — Dependency qualification.** Security, runtime, and durability protocol families **MUST** be pinned and upgraded atomically with compatibility, migration, replay, and rollback tests.
+- **PKG-004 — Production graph qualification.** CI **MUST** validate the install graph and every pruned production graph, public exports, dependency cycles, registry integrity, SBOM/provenance, and lockfile consistency.
+
+Commit generated public contracts needed by consumers. [TURBO-DOCS] [BUN-DOCS]

package/skill/vegastack-arch-guardian/references/architecture/web.md

@@ -0,0 +1,29 @@
+# Web control plane
+
+Apply this reference only when the owned `webControlPlane` capability is enabled or Next.js control-plane code is observed. A public API, shared package, or non-web platform service does not imply Next.js; review its declared provider-neutral contract and runtime separately.
+
+## Ownership and contract
+
+- **API-001 — Control-plane owner.** Next.js 16 App Router **MUST** initially own the web UI, RSC, Route Handlers, Better Auth, and canonical REST/OpenAPI control-plane API. Do not add NestJS or Hono without an extraction ADR.
+- **API-002 — Canonical API.** Bounded Zod schemas **MUST** deterministically generate OpenAPI and Flutter/public clients. Parallel hand-written wire contracts are forbidden.
+- **API-003 — Protected request order.** A protected request **MUST** authenticate, derive workspace membership server-side, authorize the typed action, set tenant context inside the protected transaction, execute the query, and emit an audit correlation ID.
+- **API-004 — Tenant-safe caching.** Auth, session, authorization, membership, audit, and tenant-sensitive reads **MUST NOT** use implicit or stale caches.
+- **WEB-001 — Design authority.** Web components, tokens, integrity, accessibility, and upgrade guidance **MUST** come from VegaStack Design skills/packages; this guardian must not duplicate them.
+
+Next.js 16 and the reviewed OpenNext adapter support the selected App Router request features, but the OpenNext Worker is not an Edge-runtime or general-Node replacement. [NEXT-1630] [OPENNEXT-1202]
+
+## Rendering and state
+
+| Concern | Default |
+|---|---|
+| initial authenticated read | RSC with server-derived tenant context |
+| interaction, mutation, reconnect | TanStack Query over typed REST |
+| durable run output | resumable SSE with cursor and terminal reconciliation |
+| validation | shared Zod contract; server authoritative |
+| optimistic update | idempotency key, rollback, authoritative reconciliation, no privilege escalation |
+
+Store UTC instants and IANA timezone identifiers. Support localized templates, pluralization, locale-aware formatting, RTL, keyboard navigation, focus management, reduced motion, and screen readers from the first implementation.
+
+## Extraction trigger
+
+Extract an API service only for a measured independent security, runtime, scaling, or deployment boundary after query/cache work cannot meet the SLO. Framework preference and anticipated scale are not triggers. Preserve REST/OpenAPI and one implementation of authorization, schema, and business rules through extraction.

package/skill/vegastack-arch-guardian/references/control-catalog.json

@@ -0,0 +1,55 @@
+{
+  "schemaVersion": 1,
+  "description": "Atomic checker/validator controls. Normative prose remains canonical in architecture references.",
+  "controls": [
+    { "rule": "FOUND-001", "idPattern": "^profile\\.(?:present|parse|schema|schema-version|confirmed|project-name)$", "classification": "invariant", "activation": "profile validation or CI", "verification": "structural/semantic", "waiver": "project-adr" },
+    { "rule": "FOUND-002", "idPattern": "^exception\\.(?:validity|scope-match)$", "classification": "invariant", "activation": "exception declared", "verification": "semantic/filesystem", "waiver": "project-adr" },
+    { "rule": "FOUND-004", "idPattern": "^(?:capability\\.[A-Za-z]+\\.(?:source-root|undeclared|missing-code)|profile\\.capability-alignment)$", "classification": "invariant", "activation": "capability declared or observed", "verification": "static/semantic", "waiver": "project-adr" },
+    { "rule": "PKG-003", "idPattern": "^(?:foundation\\.(?:baseline|adoption|non-supported-adoption)|version\\.[A-Za-z]+\\.[A-Za-z0-9]+)$", "classification": "invariant", "activation": "versioned capability enabled", "verification": "semantic", "waiver": "project-adr" },
+    { "rule": "RUN-001", "idPattern": "^(?:runtime\\.web-bundle-boundary|hosting\\.agents-placement)$", "classification": "forbidden-design", "activation": "owned agents", "verification": "static/semantic", "waiver": "project-adr" },
+    { "rule": "RUN-002", "idPattern": "^(?:runtime\\.web-bundle-boundary|hosting\\.jobs-placement)$", "classification": "forbidden-design", "activation": "owned jobs", "verification": "static/semantic", "waiver": "project-adr" },
+    { "rule": "RUN-003", "idPattern": "^(?:capability\\.source-root-overlap|contract\\.[A-Za-z]+\\.qualification)$", "classification": "invariant", "activation": "provider boundary or shared/external capability", "verification": "semantic/manual", "waiver": "project-adr" },
+    { "rule": "HOST-004", "id": "hosting.web-placement", "classification": "invariant", "activation": "Cloudflare/OpenNext web", "verification": "semantic", "waiver": "project-adr" },
+    { "rule": "MOB-001", "id": "flutter.oauth-pkce", "classification": "invariant", "activation": "Flutter enabled", "verification": "semantic/runtime", "waiver": "project-adr" },
+    { "rule": "MOB-002", "idPattern": "^flutter\\.(?:api-provider|generated-client)$", "classification": "invariant", "activation": "Flutter enabled", "verification": "semantic/generated-contract", "waiver": "project-adr" },
+    { "rule": "DUR-001", "idPattern": "^(?:agents\\.(?:durable-owner|storage-ownership|dual-workflow-state)|jobs\\.workflow-ownership)$", "classification": "invariant", "activation": "agents enabled or observed", "verification": "static/semantic/runtime", "waiver": "project-adr" },
+    { "rule": "DUR-003", "idPattern": "^(?:agents\\.(?:admission|pg-boss-ownership)|jobs\\.database-owner)$", "classification": "invariant", "activation": "agent admission or owned jobs", "verification": "static/semantic/runtime", "waiver": "project-adr" },
+    { "rule": "DATA-002", "idPattern": "^knowledge\\.(?:storage-owner|object-storage-owner)$", "classification": "preferred-default", "activation": "owned knowledge", "verification": "semantic/runtime", "waiver": "project-adr" },
+    { "rule": "SBX-001", "id": "sandbox.activation", "classification": "invariant", "activation": "untrusted execution", "verification": "semantic/runtime", "waiver": "project-adr" },
+    { "rule": "SBX-002", "idPattern": "^sandbox\\.(?:trusted-broker|credentials)$", "classification": "invariant", "activation": "sandbox enabled", "verification": "semantic/runtime", "waiver": "project-adr" },
+    { "rule": "SBX-003", "id": "sandbox.egress", "classification": "forbidden-design", "activation": "sandbox enabled or observed", "verification": "static/runtime", "waiver": "project-adr" },
+    { "rule": "AUTH-001", "id": "auth.organization-boundary", "classification": "invariant", "activation": "authenticated multi-tenant product", "verification": "static/runtime", "waiver": "project-adr" },
+    { "rule": "AUTH-003", "idPattern": "^(?:auth\\.(?:secure-cookies|secure-cookies-code|library|csrf-origin|trusted-origins))$", "classification": "invariant", "activation": "authenticated web", "verification": "static/semantic/runtime", "waiver": "project-adr" },
+    { "rule": "AUTH-004", "idPattern": "^auth\\.(?:pkce|oauth-provider)$", "classification": "invariant", "activation": "delegated client", "verification": "static/runtime", "waiver": "project-adr" },
+    { "rule": "AUTH-005", "id": "auth.api-key-scope", "classification": "forbidden-design", "activation": "API keys observed", "verification": "static/runtime", "waiver": "project-adr" },
+    { "rule": "AUTH-006", "idPattern": "^identity\\.(?:scim-deprovisioning|scim-storage)$", "classification": "invariant", "activation": "SCIM enabled or observed", "verification": "static/semantic/runtime", "waiver": "project-adr" },
+    { "rule": "API-002", "id": "api.generated-contract", "classification": "invariant", "activation": "Flutter/public client enabled", "verification": "semantic/generated-contract", "waiver": "project-adr" },
+    { "rule": "TEN-001", "idPattern": "^tenancy\\.composite-(?:primary-key|relationship)$", "classification": "invariant", "activation": "shared-schema multi-tenancy", "verification": "static/runtime", "waiver": "project-adr" },
+    { "rule": "TEN-002", "idPattern": "^tenancy\\.rls-(?:enable|force|policy|evidence)$", "classification": "invariant", "activation": "shared-schema multi-tenancy", "verification": "static/runtime", "waiver": "project-adr" },
+    { "rule": "TEN-003", "idPattern": "^tenancy\\.(?:context-local|role-bypassrls|context-evidence)$", "classification": "forbidden-design", "activation": "shared-schema multi-tenancy or tenant context observed", "verification": "static/runtime", "waiver": "project-adr" },
+    { "rule": "TEN-004", "id": "tenancy.security-definer", "classification": "forbidden-design", "activation": "privileged shared-schema path", "verification": "static/runtime", "waiver": "project-adr" },
+    { "rule": "SEC-002", "idPattern": "^(?:secret\\.(?:plaintext|bearer)|secrets\\.(?:activation|production-provider|dependency))$", "classification": "forbidden-design", "activation": "production secrets declared or observed", "verification": "static/semantic/runtime", "waiver": "project-adr" },
+    { "rule": "OBS-002", "id": "telemetry.sensitive-data", "classification": "forbidden-design", "activation": "telemetry call observed", "verification": "static/runtime", "waiver": "project-adr" },
+    { "rule": "RT-002", "id": "realtime.websocket-trigger", "classification": "preferred-default", "activation": "WebSockets observed", "verification": "manual-qualification", "waiver": "project-adr" },
+    { "rule": "RT-005", "id": "notifications.durable-intent-owner", "classification": "invariant", "activation": "notifications enabled", "verification": "semantic/runtime", "waiver": "project-adr" },
+    { "rule": "REL-001", "id": "reliability.objectives", "classification": "invariant", "activation": "production project", "verification": "declared/manual", "waiver": "project-adr" },
+    { "rule": "DEL-001", "idPattern": "^(?:inspection\\.(?:traversal|read)|qualification\\.runtime)$", "classification": "invariant", "activation": "review or qualification", "verification": "static/manual/runtime", "waiver": "project-adr" },
+    { "rule": "DUR-009", "id": "agents.exit-contract", "classification": "invariant", "activation": "owned durable execution in production", "verification": "manual-qualification", "waiver": "project-adr" },
+    { "rule": "EVAL-001", "id": "evals.definition", "classification": "invariant", "activation": "model-backed behavior shipped to users", "verification": "manual-qualification", "waiver": "project-adr" },
+    { "rule": "EVAL-002", "id": "evals.promotion-gate", "classification": "invariant", "activation": "agent/prompt/model change promoted", "verification": "manual-qualification", "waiver": "project-adr" },
+    { "rule": "EVAL-003", "id": "evals.dataset-versioning", "classification": "invariant", "activation": "eval datasets exist", "verification": "manual-qualification", "waiver": "project-adr" },
+    { "rule": "EVAL-004", "id": "evals.online-sampling", "classification": "invariant", "activation": "production eval sampling enabled", "verification": "manual-qualification", "waiver": "project-adr" },
+    { "rule": "MLIFE-001", "id": "models.pinned-ids", "classification": "invariant", "activation": "external model providers enabled", "verification": "manual-qualification", "waiver": "project-adr" },
+    { "rule": "MLIFE-002", "id": "models.deprecation-watch", "classification": "invariant", "activation": "external model providers enabled", "verification": "manual-qualification", "waiver": "project-adr" },
+    { "rule": "MLIFE-003", "id": "models.canary-rollout", "classification": "preferred-default", "activation": "prompt+model behavior change", "verification": "manual-qualification", "waiver": "project-adr" },
+    { "rule": "MLIFE-004", "id": "models.backpressure", "classification": "invariant", "activation": "external model providers enabled", "verification": "manual-qualification", "waiver": "project-adr" },
+    { "rule": "COST-001", "id": "cost.workspace-attribution", "classification": "invariant", "activation": "metered AI resources exist", "verification": "manual-qualification", "waiver": "project-adr" },
+    { "rule": "COST-002", "id": "cost.budgets-alerts", "classification": "invariant", "activation": "production AI features", "verification": "manual-qualification", "waiver": "project-adr" },
+    { "rule": "COST-003", "id": "cost.cache-economics", "classification": "preferred-default", "activation": "prompt/context caching enabled", "verification": "manual-qualification", "waiver": "project-adr" },
+    { "rule": "COST-004", "id": "cost.regression-gate", "classification": "invariant", "activation": "AI feature deploy", "verification": "manual-qualification", "waiver": "project-adr" },
+    { "rule": "PII-001", "id": "pii.ingestion-redaction", "classification": "invariant", "activation": "knowledge or embedding ingestion", "verification": "manual-qualification", "waiver": "project-adr" },
+    { "rule": "PII-002", "id": "pii.prompt-boundary", "classification": "invariant", "activation": "external model calls with personal data", "verification": "manual-qualification", "waiver": "project-adr" },
+    { "rule": "PII-003", "id": "pii.output-moderation", "classification": "invariant", "activation": "public-facing AI output", "verification": "manual-qualification", "waiver": "project-adr" },
+    { "rule": "PII-004", "id": "pii.injection-mitigations", "classification": "invariant", "activation": "tool results, retrieval, or connector content in prompts", "verification": "manual-qualification", "waiver": "project-adr" }
+  ]
+}