@yeison.restrepo.r/code-conductor 1.23.0

package/project-template/.claude/hooks/verbosity-remind.sh

@@ -0,0 +1,168 @@
+#!/usr/bin/env bash
+# Same exit-0 invariant as global hook — must never exit non-zero.
+# See global hook comment for full design rationale.
+trap 'exit 0' EXIT ERR
+
+# CI/CD bypass — exit before any I/O
+case "${CC_VERBOSITY_SKIP:-0}" in
+    1|true|yes|on|TRUE|YES|ON|True|Yes|On) exit 0 ;;
+esac
+
+# Named traversal cap (same value as global hook; defined separately per-script
+# so each hook is independently executable without sourcing the other).
+readonly _VERBOSITY_TRAVERSAL_CAP=40
+
+# $HOME null guard
+if [ -z "${HOME:-}" ]; then
+    printf '\n[VERBOSITY:MIN] One sentence. [CHANGES] file list only. No prose.\n'
+    exit 0
+fi
+
+# $PWD null guard
+_start="${PWD:-}"
+_skip_traversal=0
+[ -z "$_start" ] && _skip_traversal=1
+
+# Log setup
+_SCOPE="project"
+_logdir="$HOME/.claude/logs"
+_logfile="$_logdir/verbosity-hook.log"
+_log_ok=0
+if [ -e "$_logdir" ] && [ ! -d "$_logdir" ]; then
+    echo "[verbosity-remind] log dir blocked by non-directory: $_logdir" >&2
+elif mkdir -p "$_logdir" 2>/dev/null && [ -w "$_logdir" ]; then
+    if [ -e "$_logfile" ] && [ ! -f "$_logfile" ]; then
+        echo "[verbosity-remind] log file path blocked by directory: $_logfile" >&2
+    else
+        _log_ok=1
+    fi
+fi
+
+_write_log() {
+    (( _log_ok )) || return 0
+    _logsize=0
+    [ -f "$_logfile" ] && _logsize=$(wc -c < "$_logfile" 2>/dev/null || echo 0)
+    if [ "${_logsize:-0}" -gt 1048576 ]; then
+        # Log rotation (same strategy as global hook): `true > "$_logfile"` is
+        # POSIX-portable. See global hook _write_log comment for full rationale.
+        true > "$_logfile" 2>/dev/null && \
+            printf '%s [%s] log rotated at 1 MB ceiling\n' \
+                "$(date '+%Y-%m-%d %H:%M:%S')" "$_SCOPE" >> "$_logfile" 2>/dev/null
+        # Fall through — write current message to freshly truncated file.
+    fi
+    # Concurrent writes: POSIX O_APPEND (>>) serialises each write() atomically for
+    # payloads under PIPE_BUF (~512 B). A single log line is well under that limit.
+    # The size check is a non-atomic TOCTOU; see global hook for the full note.
+    printf '%s [%s] %s\n' "$(date '+%Y-%m-%d %H:%M:%S')" "$_SCOPE" "$1" >> "$_logfile" 2>/dev/null
+}
+
+# ── Stage 2: cascading memory resolution (no Stage 1 — project hook IS the authority) ──
+_mem_file=""
+if [ "$_skip_traversal" = "0" ]; then
+    # Cycle safety: same guarantee as global hook — ${_dir%/*} is pure string
+    # truncation; symlink cycles cannot occur. The $_VERBOSITY_TRAVERSAL_CAP-iteration
+    # cap handles degenerate deep paths. See global hook for the full cycle-safety note.
+    _dir="$_start"; _prev=""; _iters=0; _cap=$_VERBOSITY_TRAVERSAL_CAP
+    while [ "$_dir" != "$_prev" ] && (( _iters < _cap )); do
+        _f="$_dir/.claude/memory/verbosity.md"
+        if [ -f "$_f" ] && [ -r "$_f" ]; then
+            # Symlink safety (same rule as global hook): skip verbosity.md files that
+            # resolve to sensitive system paths to prevent unintended file reads.
+            if [ -L "$_f" ]; then
+                _resolved=$(readlink -f "$_f" 2>/dev/null || readlink "$_f" 2>/dev/null || echo "")
+                case "$_resolved" in
+                    /etc/*|/proc/*|/sys/*|/dev/*)
+                        _write_log "WARN: verbosity.md at $_f resolves to '$_resolved' — skipping"
+                        _prev="$_dir"; _dir="${_dir%/*}"; [ -z "$_dir" ] && _dir="/"
+                        (( _iters++ )) || true; continue ;;
+                esac
+            fi
+            _mem_file="$_f"
+            break
+        fi
+        _prev="$_dir"
+        _dir="${_dir%/*}"
+        [ -z "$_dir" ] && _dir="/"
+        (( _iters++ )) || true
+    done
+    (( _iters >= _cap )) && [ -z "$_mem_file" ] && \
+        _write_log "traversal cap (${_cap}) reached; no verbosity.md found"
+fi
+
+[ -z "$_mem_file" ] && _mem_file="$HOME/.claude/memory/verbosity.md"
+
+# ── Extraction loop ───────────────────────────────────────────────────────────
+_in_fence=0; _in_fm=0; LEVEL=""; _lineno=0
+if [ -f "$_mem_file" ] && [ -r "$_mem_file" ]; then
+    while IFS= read -r _line || [ -n "$_line" ]; do
+        _lineno=$(( _lineno + 1 ))
+        [ "$_lineno" = "1" ] && _line="${_line#$'\xef\xbb\xbf'}"
+        _line="${_line%$'\r'}"
+        if [ "$_lineno" = "1" ] && [ "$_line" = "---" ]; then
+            _in_fm=1; continue
+        fi
+        if [ "$_in_fm" = "1" ]; then
+            case "$_line" in
+                ---|\.\.\.) _in_fm=0 ;;
+            esac
+            continue
+        fi
+        case "$_line" in
+            '```'*|'~~~'*) (( _in_fence = 1 - _in_fence )) || true ;;
+            VERBOSITY:*)
+                (( _in_fence )) && continue
+                LEVEL="${_line#VERBOSITY:}"
+                LEVEL="${LEVEL#"${LEVEL%%[! ]*}"}"
+                LEVEL="${LEVEL%% #*}"          # strip " # comment" (space+hash); bare # not treated as delimiter
+                LEVEL="${LEVEL%%[[:space:]]*}"  # strip remaining trailing whitespace
+                break
+                ;;
+        esac
+    done < "$_mem_file"
+fi
+
+# Recovery pass — unclosed fence
+if [ -z "$LEVEL" ] && [ "$_in_fence" = "1" ]; then
+    mkdir -p "$HOME/.claude/logs" 2>/dev/null
+    # .verbosity-fence-warned: 60-min TTL, per-machine. See global hook for full lifecycle note.
+    find "$HOME/.claude/logs/.verbosity-fence-warned" -mmin -60 2>/dev/null | grep -q . || {
+        echo "[verbosity-remind] unclosed fence in $_mem_file; using recovery pass" >&2
+        touch "$HOME/.claude/logs/.verbosity-fence-warned" 2>/dev/null
+    }
+    while IFS= read -r _line || [ -n "$_line" ]; do
+        _line="${_line%$'\r'}"
+        case "$_line" in
+            VERBOSITY:*)
+                LEVEL="${_line#VERBOSITY:}"
+                LEVEL="${LEVEL#"${LEVEL%%[! ]*}"}"
+                LEVEL="${LEVEL%% #*}"           # strip " # comment" (space+hash only)
+                LEVEL="${LEVEL%%[[:space:]]*}"  # strip remaining trailing whitespace
+                break
+                ;;
+        esac
+    done < "$_mem_file"
+fi
+
+# ── Normalization ─────────────────────────────────────────────────────────────
+# Empty / whitespace-only verbosity.md: same recovery as global hook.
+# LEVEL="" passes through normalization unchanged; Stage 3 sanity guard
+# catches it via the wildcard branch and sets LEVEL="MIN". No extra guard needed.
+case "$LEVEL" in
+    [Mm][Ii][Nn])                           LEVEL="MIN"     ;;
+    [Ii][Nn][Ff][Oo])                       LEVEL="INFO"    ;;
+    [Vv][Ee][Rr][Bb][Oo][Ss][Ee])          LEVEL="VERBOSE" ;;
+esac
+
+# ── Stage 3: sanity guard + emit ─────────────────────────────────────────────
+case "$LEVEL" in
+    MIN|INFO|VERBOSE) ;;
+    *) LEVEL="MIN" ;;
+esac
+
+# Output is injected into Claude's prompt context. Use only printable ASCII —
+# no ANSI escapes, control sequences, or non-ASCII bytes. See global hook note.
+case "$LEVEL" in
+    MIN)     printf '\n[VERBOSITY:MIN] One sentence. [CHANGES] file list only. No prose.\n' ;;
+    INFO)    printf '\n[VERBOSITY:INFO] Bullet list max 5. [CHANGES]+[REASON] tags.\n' ;;
+    VERBOSE) printf '\n[VERBOSITY:VERBOSE] Full explanation. All tags active.\n' ;;
+esac

package/project-template/.claude/memory/context-threshold.txt

@@ -0,0 +1 @@
+25

package/project-template/.claude/memory/project.md

@@ -0,0 +1,48 @@
+# Project Memory
+
+Shared team memory. Committed to git. Updated automatically by /checkpoint.
+
+## Stack
+<!-- Set by /stack -->
+
+## Architecture Decisions
+<!-- Append by /checkpoint. Never delete entries. -->
+
+### Checkpoint 2026-06-09 17:45
+
+**BUG-001: Phase Boundary Compaction (/cc-compact) — v1.7.0**
+
+- **Decided:** phase context clearing uses a dedicated `/cc-compact` command (not baked into phase commands, not an extension of `/cc-checkpoint`). One command, one invariant: serialize then prompt for `/compact`.
+- **Decided:** snapshot schema is fixed and token-bounded (≤300 tokens): Phase, Commit (full SHA-1 via `git rev-parse HEAD`), Decisions (max 10), Pending, Files Touched, Constraints (max 5), Spec Reference. No freeform prose.
+- **Decided:** snapshot file is `.claude/memory/session-snapshot.md`, gitignored, single instance (always overwritten).
+- **Decided:** Destructive Read Invariant — every phase command that reads the snapshot must delete it immediately after reading. Deletion failure halts the command.
+- **Decided:** Phase Handoff Enforcement uses decoupled conditions — turn count > 5 is the only blocking halt; absent snapshot is a read-if-present fallback, not a blocker (prevents infinite standby on fresh sessions).
+- **Decided:** `/compact` is user-invoked, not agent-invoked. `/cc-compact` outputs a prompt; it does not call `/compact` itself.
+- **Rejected:** extending `/cc-checkpoint` with phase-boundary semantics (blurs its purpose as a general decision-saver).
+- **Rejected:** baking compaction logic directly into phase commands (harder to evolve independently).
+
+**Files added/modified:**
+- `global/commands/cc-compact.md` — new
+- `project-template/.claude/commands/cc-implement.md` — new
+- `project-template/.claude/commands/cc-spec.md` — DRI + exit prompt
+- `project-template/.claude/commands/cc-plan.md` — enforcement + DRI + exit prompt
+- `project-template/.claude/commands/cc-review.md` — enforcement + DRI
+
+## Active Conventions
+<!-- Project-specific conventions established in this codebase -->
+
+- No em-dashes (—) anywhere in command files or docs — use hyphens (-) or colons (:).
+- All phase command files use `## Phase entry - <Name>` and `## Phase exit` section headers (second-level).
+- Spec files live in `docs/superpowers/specs/YYYY-MM-DD-<slug>-design.md` (force-added since `docs/` is gitignored).
+- Plan files live in `docs/superpowers/plans/YYYY-MM-DD-<slug>.md` (force-added).
+- VERSION file contains a single semver string. Minor bump for new behavioral features.
+
+## Technical Debt
+<!-- Known shortcuts, limitations, and deferred work -->
+
+- `docs/` is in `.gitignore` but spec/plan files need to be tracked — currently force-added individually. Should add `!docs/superpowers/` exception to `.gitignore` to fix this properly (deferred).
+- BUG-001 enforcement check relies on the agent counting turns correctly — no programmatic turn counter exists yet. FEAT-007 (token threshold auto-compaction) would make this structural.
+- `/cc-compact` depends on the agent accurately recalling phase state from conversation context — no structured state extraction mechanism exists yet (FEAT-005 SQLite layer would fix this).
+
+## Workarounds
+<!-- Non-obvious solutions and why they exist -->

package/project-template/.claude/settings.json

@@ -0,0 +1,52 @@
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Write|Edit|create_file|write_file",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash -c 'h=\".claude/hooks/pre-tool-use.sh\"; [ -f \"$h\" ] && bash \"$h\" || { echo \"⚠ Hook missing — run /cc-init to repair\"; exit 0; }'"
+          }
+        ]
+      }
+    ],
+    "PostCompact": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash -c 'h=\".claude/hooks/post-compact.sh\"; [ -f \"$h\" ] && bash \"$h\" || exit 0'"
+          },
+          {
+            "type": "command",
+            "command": "powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -File \".claude/hooks/post-compact.ps1\""
+          }
+        ]
+      }
+    ],
+    "UserPromptSubmit": [
+      {
+        "matcher": "",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash -c 'set +e; _dir=\"${PWD:-}\"; _prev=\"\"; _iters=0; while [ \"$_dir\" != \"$_prev\" ] && [ \"$_iters\" -lt 40 ]; do _h=\"$_dir/.claude/hooks/verbosity-remind.sh\"; [ -f \"$_h\" ] && [ -r \"$_h\" ] && { bash \"$_h\"; exit $?; }; _prev=\"$_dir\"; _dir=\"${_dir%/*}\"; [ -z \"$_dir\" ] && _dir=/; _iters=$((_iters+1)); done; exit 0'"
+          },
+          {
+            "type": "command",
+            "command": "bash -c 'set +e; _dir=\"${PWD:-}\"; _prev=\"\"; _i=0; while [ \"$_dir\" != \"$_prev\" ] && [ \"$_i\" -lt 40 ]; do _h=\"$_dir/.claude/hooks/context-guard.sh\"; [ -f \"$_h\" ] && [ -r \"$_h\" ] && { CC_PROJECT_ROOT=\"$_dir\" bash \"$_h\"; exit $?; }; _prev=\"$_dir\"; _dir=\"${_dir%/*}\"; [ -z \"$_dir\" ] && _dir=/; _i=$((_i+1)); done; exit 0'"
+          },
+          {
+            "type": "command",
+            "command": "powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -File \".claude/hooks/context-guard.ps1\""
+          }
+        ]
+      }
+    ]
+  },
+  "permissions": {
+    "allow": [],
+    "deny": []
+  }
+}

package/project-template/CLAUDE.md

@@ -0,0 +1,104 @@
+# Project Claude Configuration
+
+Extends global CLAUDE.md. Project-specific rules take precedence over global ones.
+
+## Project Identity
+- Name:
+- Description:
+- Stack:
+- Language: en
+
+## Development Commands
+- Build: <command>
+- Test: <command>
+- Lint: <command>
+- Format: <command>
+- Setup: <command>
+
+## Architecture Notes
+<!-- Key architectural decisions for this project -->
+
+## Conventions
+<!-- Project-specific conventions that override global defaults -->
+
+## Out of Scope
+<!-- Things Claude should not touch in this project -->
+
+## Active Stack Profiles
+<!-- cc-stack:managed: regenerated by /cc-stack, manual edits inside are overwritten -->
+
+---
+
+## Agent Identity
+You are a Senior Full-Stack Architect and Orchestrator specialized in spec-driven, modular engineering. You delegate raw data processing to sub-agents, never guess when you can query, and never open a file when a targeted search suffices.
+
+## Session Initialization
+- At session start: use **Glob** (NEVER use Read) to check that `project.md` and
+  `graphify-out/graph.json` exist; run `/cc-init` if absent.
+- NEVER read raw files under `graphify-out/` or `node_modules/` — Guard 4 blocks such
+  reads at the hook level. For graph queries, invoke the graphify skill:
+  `/graphify query "<question>"`.
+- Do not accept implementation tasks without valid project memory and graph.
+
+## Dynamic Specialization
+| Mode          | Trigger                 | Persona focus                          |
+|---------------|-------------------------|----------------------------------------|
+| BACKEND_ONLY  | No frontend framework   | API performance, DB integrity          |
+| FRONTEND_ONLY | No backend framework    | Component modularity, ui-ux-pro-max    |
+| FULLSTACK     | Both layers detected    | Frontend/backend contract, type safety |
+
+## Operational Philosophy
+- Token efficiency: query the graph before reading; search before opening; never ingest what can be looked up.
+- Modular autonomy: delegate raw output (grep, file content, intermediates) to sub-agents; keep main context clean.
+- State synchronization: run /cc-checkpoint after feature completion and before /compact.
+
+## Execution Rules
+
+### Graph-First
+Before modifying any file:
+1. Query graphify-out/graph.json for all callers, dependents, and related nodes of the target symbol.
+2. If graph absent, run /cc-init. Fallback: spawn Explore sub-agent (≤150 words, callers + file paths).
+3. Open a file only when you have a specific line range. Always pass limit on files > 150 lines.
+
+### Dependency Integrity
+After modifying any method, variable, class, or component:
+- Run a global grep for all usages of the modified element.
+- Identify and repair broken references, import errors, and type mismatches within the same task scope.
+- Report under [DEPS] tag.
+
+### Sub-Agent Delegation
+| Task                       | Sub-agent / Skill         |
+|----------------------------|---------------------------|
+| Refactoring                | code-simplifier skill     |
+| Frontend UI/UX             | ui-ux-pro-max skill       |
+| Pre-flight / adversarial   | critical-review skill     |
+| Graph querying             | Explore sub-agent         |
+| Codebase exploration (3+)  | Explore sub-agent         |
+| Parallel independent tasks | Multiple Agent calls      |
+
+## Response Tags
+| Tag          | When to use                                                                                        |
+|--------------|----------------------------------------------------------------------------------------------------|
+| [CHANGES]    | Always — comma-separated list of modified files                                                    |
+| [REASON]     | Omitted in MIN mode — why a change was made, when rationale is non-obvious                        |
+| [PLAN]       | Omitted in MIN mode — ordered steps for multi-step changes                                        |
+| [DEPS]       | Omitted in MIN mode — downstream references checked or repaired                                   |
+| [TESTS]      | Omitted in MIN mode — test files affected or written                                              |
+| [BUG]        | Always when a bug is found — format: `file:line — one-sentence description`. Never suppressed, including in MIN mode. |
+| [VALIDATION] | After implementation tasks only — edge cases, risks, justification                               |
+
+## Verbosity Protocol
+VERBOSITY: MIN (default)
+- One declarative sentence. No greeting. No intro. No filler. No "Sure!", "Of course!", "Here is…".
+- [CHANGES] tag: modified file list only.
+- [VALIDATION] tag: included after implementation tasks only (code changes, file rewrites, behavioral modifications); condensed to exactly three lines — one each for: edge cases covered, residual risks, justification. Omitted entirely for non-implementation tasks (file deletions, config-only chores, maintenance commits, pure documentation edits).
+- [BUG] tag: always included in MIN mode when a bug is found; format: `[BUG] file:line — one-sentence description`. Never suppressed.
+- All other tags ([REASON], [PLAN], [DEPS], [TESTS]) are omitted in MIN mode.
+- Ambiguity: one clarifying question, nothing else.
+
+## Hard Constraints
+- Never hardcode secrets, tokens, passwords, or API keys.
+- Never run destructive shell commands (rm -rf, git reset --hard, git push --force) without explicit user confirmation.
+- Never skip the pre-tool-use.sh hook; if it blocks a tool invocation, investigate — do not bypass.
+- Never write code without an approved /cc-spec; never implement without an approved /cc-plan.
+- Never overwrite plan or tracking files in bulk; all state updates must be surgical single-line edits targeting one checkbox or field at a time (BUG-003 invariant).

package/skills/agent-delegation.md

@@ -0,0 +1,44 @@
+---
+name: agent-delegation
+description: "Rules for when and how to spawn sub-agents: Explore for 3+ file reads, parallel agents for independent tasks, summaries only — raw output never enters main context"
+type: skill
+---
+
+# Agent Delegation
+
+Keep the main context clean. Raw file contents, grep output, and intermediate data never enter the main context. Sub-agents process data and return summaries only.
+
+## When to Spawn
+
+### Explore Sub-Agent
+**Condition:** Task requires reading 3+ files to answer one question, or codebase exploration precedes implementation.
+
+```javascript
+// Use the Agent tool with these parameters:
+Agent({
+  subagent_type: "Explore",
+  description: "<10-word description of the lookup>",
+  prompt: "<question>. Search across relevant files. Return a summary of ≤200 words. Do not include raw file contents."
+})
+```
+
+### Parallel Agents
+**Condition:** 2+ implementation tasks with no shared state, each describable independently.
+
+Send both Agent calls in a single message so they run in parallel:
+
+```javascript
+// Use the Agent tool twice in the same message — they run in parallel:
+Agent({ description: "Task A", prompt: "... Return a summary of ≤200 words." })
+Agent({ description: "Task B", prompt: "... Return a summary of ≤200 words." })
+```
+
+## Output Contract
+- Every sub-agent returns ≤200 words to the main context.
+- The main context acts only on summaries, not raw data.
+- If a sub-agent needs user input, it surfaces one question to the main context and stops.
+
+## When NOT to Spawn
+- Single Grep or Glob can answer the question.
+- Answer is already in `.claude/memory/project.md`.
+- Task requires back-and-forth with the user (stay inline).

package/skills/code-simplifier.md

@@ -0,0 +1,124 @@
+# Code Simplifier
+
+**Always active.** Apply these rules to every piece of code written or reviewed.
+
+## Rules
+
+### 1. No Speculative Abstractions
+Solve today's problem. Do not build for hypothetical future requirements.
+
+❌ Bad:
+```typescript
+interface DataProcessor<T, R> {
+  process(data: T): R;
+  validate(data: T): boolean;
+}
+```
+
+✅ Good:
+```typescript
+function parseUserInput(raw: string): User { ... }
+```
+
+### 2. No Premature Layers
+Add a layer only when it carries real logic — not to "separate concerns" theoretically.
+
+❌ Bad:
+```typescript
+class UserRepository {
+  constructor(private db: UserDataAccessLayer) {}
+  findById(id: string) { return this.db.findById(id); }
+}
+```
+
+✅ Good:
+```typescript
+async function getUserById(db: Database, id: string): Promise<User> {
+  return db.query('SELECT * FROM users WHERE id = ?', [id]);
+}
+```
+
+### 3. No Single-Implementation Interfaces
+Don't create an interface for a type that will only ever have one implementation.
+
+❌ Bad: `interface Logger { log(msg: string): void }`
+✅ Good: Use the class directly, or a plain function.
+
+### 4. Functions Do One Thing (Max 30 Lines)
+If a function needs a comment to describe what a section does, that section should be its own function.
+
+### 5. No Defensive Code for Impossible Cases
+Don't validate inputs that can't be wrong (internal calls, typed parameters, framework guarantees).
+
+❌ Bad:
+```typescript
+function add(a: number, b: number): number {
+  if (typeof a !== 'number') throw new Error('a must be a number');
+  return a + b;
+}
+```
+
+✅ Good:
+```typescript
+function add(a: number, b: number): number {
+  return a + b;
+}
+```
+
+### 6. No Design Patterns by Default
+Use a pattern only when it solves a specific pain you have today.
+
+### 7. Flat Over Nested
+Use guard clauses and early returns instead of nesting.
+
+❌ Bad:
+```typescript
+function process(user: User | null) {
+  if (user) {
+    if (user.isActive) {
+      if (user.hasPermission) {
+        doWork(user);
+      }
+    }
+  }
+}
+```
+
+✅ Good:
+```typescript
+function process(user: User | null) {
+  if (!user) return;
+  if (!user.isActive) return;
+  if (!user.hasPermission) return;
+  doWork(user);
+}
+```
+
+### 8. Descriptive Names
+No `Base`, `Abstract`, `Generic`, `Manager`, `Handler`, `Service`, `Helper`, `Util`.
+
+### 9. Constants Only When Used 2+ Places or Have Domain Meaning
+❌ Bad: `const ONE = 1`
+✅ Good: `const MAX_RETRY_ATTEMPTS = 3`
+
+### 10. Comments Explain Why, Never What
+❌ Bad: `// increment counter`
+✅ Good: `// retry limit matches SLA from the payments contract`
+
+## Complexity Signals — Stop and Simplify
+
+When you see any of these, stop and refactor before adding more code:
+
+- Class with 5+ constructor dependencies
+- Function over 30 lines
+- 3+ levels of nesting
+- A layer that only delegates to the layer below
+- A name containing Base, Abstract, Generic, Manager, or Handler
+
+## When Complexity IS Justified
+
+Only add abstraction when:
+- Multiple real implementations exist today (not "might exist someday")
+- Domain rules are genuinely complex and need encapsulation
+- A documented performance constraint requires it
+- The pattern prevents a bug class that has already occurred in this codebase

package/skills/critical-review.md

@@ -0,0 +1,75 @@
+---
+name: critical-review
+description: "4-phase adversarial review protocol: pre-flight analysis, adversarial execution check, self-correction loop, and [VALIDATION] report"
+type: skill
+---
+
+# Critical Review Protocol
+
+Apply this protocol to every implementation task. Do not skip phases.
+
+---
+
+## Phase 1 — Pre-Flight Analysis
+
+Before writing any code, perform a Vulnerability Assessment on the proposed solution. Do not proceed to implementation until all three are answered:
+
+**Happy Path** — Describe the most common successful execution flow in one sentence.
+
+**Failure Points** — Where is this logic most likely to break? List: race conditions, null/undefined references, network timeouts, missing auth, unhandled promise rejections, type coercion surprises.
+
+**Boundary Conditions** — What inputs or volume break assumptions? List: empty arrays, zero values, extremely large payloads, concurrent calls, missing environment variables.
+
+Present the Pre-Flight Analysis and wait for confirmation before implementing.
+
+---
+
+## Phase 2 — Execution & Adversarial Review
+
+After completing the initial implementation, switch to an Adversarial Review persona. Run each check:
+
+### RESILIENCE
+Does the system fail gracefully or crash silently when a dependency fails or input is malformed? Look for:
+- Caught errors that swallow the stack trace
+- Unchecked nulls after async calls
+- Missing fallbacks on external API responses
+
+### EFFICIENCY
+Is this the best possible outcome? Flag:
+- Redundant loops or duplicate traversals
+- Deep nesting (>3 levels) replaceable by early returns
+- High cyclomatic complexity (branches > 5 in one function)
+- N+1 query patterns
+
+### FRICTION
+Analyze the Happy Path for unnecessary friction:
+- Steps the caller must repeat on every use
+- Configuration that should have a sensible default
+- Error messages that don't tell the user what to do next
+
+---
+
+## Phase 3 — Self-Correction Loop
+
+For each weakness identified in Phase 2:
+
+1. State the weakness in one sentence (`file:line` reference if applicable).
+2. Refactor the code to address it.
+3. Re-verify: confirm the original failure point no longer applies.
+
+Do not bundle multiple fixes into one step. One weakness → one refactor → one verification.
+
+---
+
+## Phase 4 — Final Report
+
+End every implementation with a `[VALIDATION]` section:
+
+```
+[VALIDATION]
+- Edge cases accounted for: [list]
+- Why this is the best outcome vs simpler alternatives: [one paragraph]
+- Residual risks outside current scope: [list or "none identified"]
+```
+
+Do not omit `[VALIDATION]`. If verbosity is MIN, keep each item to one line. If VERBOSE, expand freely.

package/skills/memory-first.md

@@ -0,0 +1,50 @@
+---
+name: memory-first
+description: "Lookup chain enforced before any file read or search: project memory, code graph, grep/glob, Explore sub-agent, targeted read — stop at the first step that answers"
+type: skill
+---
+
+# Memory-First Protocol
+
+Follow this lookup chain in strict order before reading any file, running any search, or spawning any tool. Stop at the first step that answers the question.
+
+## Chain
+
+### 1. Project Memory
+Check `.claude/memory/project.md`.
+
+Use the Grep tool to check project.md first:
+
+```
+Grep pattern="<keyword>" path=".claude/memory/project.md"
+```
+
+If Grep returns matches, use that information and stop. If no matches, proceed to step 2.
+
+### 2. Graphify Graph
+For structural or relational questions, query the code graph.
+
+**Use when asking:**
+- "What calls function X?"
+- "What does module Y depend on?"
+- "Where is interface Z implemented?"
+- "What is the path between component A and B?"
+
+```bash
+graphify query "<your question>"
+```
+
+Skip this step if `graphify` is not installed or the command returns no results. Proceed to step 3.
+
+**Do not use for:** literal string patterns, variable names, import statements.
+
+### 3. Grep / Glob
+For pattern searches, use the `Grep` or `Glob` tools inline. Never read a full file to find a pattern.
+
+### 4. Targeted Read
+Last resort. Only when steps 1–3 cannot answer.
+- Always specify `offset` and `limit`.
+- Max 150 lines per call.
+- Know approximately which lines to read before calling.
+
+The `pre-tool-use` hook blocks `Read` calls on files >150 lines with no explicit `limit`. If blocked, return to step 1.