@zerwiz/ymir 0.1.4 → 0.1.7

package/.agents/skills/nsr-compliance/assets/nsr/assets/compliance/telemetry/logger.py

@@ -0,0 +1,112 @@
+#!/usr/bin/env python3
+# telemetry logger: SQLite observability.
+# One data path: agents write to SQLite (runs/events); readers poll SQLite.
+import argparse
+import json
+import pathlib
+import sqlite3
+import sys
+import time
+import uuid
+
+
+def find_root():
+    for parent in pathlib.Path(__file__).resolve().parents:
+        if (parent / ".agents").is_dir():
+            return parent
+    raise SystemExit("error: not in a NorthStar repo (no .agents/ upward)")
+
+
+ROOT = find_root()
+DB = ROOT / ".compliance" / "telemetry" / "runs.db"
+
+SCHEMA = """
+CREATE TABLE IF NOT EXISTS runs (
+  id TEXT PRIMARY KEY,
+  ts REAL NOT NULL,
+  phase TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'success',
+  tokens INTEGER NOT NULL DEFAULT 0,
+  latency_ms REAL NOT NULL DEFAULT 0,
+  tool_invocations INTEGER NOT NULL DEFAULT 0,
+  cost_usd REAL NOT NULL DEFAULT 0
+);
+CREATE TABLE IF NOT EXISTS events (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  run_id TEXT,
+  ts REAL NOT NULL,
+  type TEXT NOT NULL,
+  detail TEXT
+);
+"""
+
+
+def connect():
+    DB.parent.mkdir(parents=True, exist_ok=True)
+    con = sqlite3.connect(str(DB))
+    con.executescript(SCHEMA)
+    return con
+
+
+def cmd_log(args):
+    run_id = args.run_id or uuid.uuid4().hex[:12]
+    con = connect()
+    con.execute(
+        "INSERT INTO runs (id, ts, phase, status, tokens, latency_ms, tool_invocations, cost_usd) "
+        "VALUES (?, ?, ?, ?, ?, ?, ?, ?)",
+        (run_id, time.time(), args.phase, args.status, args.tokens,
+         args.latency_ms, args.tool_invocations, args.cost),
+    )
+    for ev in args.event or []:
+        etype, _, detail = ev.partition(":")
+        con.execute(
+            "INSERT INTO events (run_id, ts, type, detail) VALUES (?, ?, ?, ?)",
+            (run_id, time.time(), etype, detail),
+        )
+    con.commit()
+    print("[telemetry] logged %s (%s): tokens=%d latency=%.1fms tools=%d cost=$%.4f"
+          % (args.phase, run_id, args.tokens, args.latency_ms, args.tool_invocations, args.cost))
+    con.close()
+
+
+def cmd_query(args):
+    con = connect()
+    rows = con.execute(
+        "SELECT id, ts, phase, status, tokens, latency_ms, tool_invocations, cost_usd "
+        "FROM runs ORDER BY ts DESC LIMIT ?",
+        (args.last,),
+    ).fetchall()
+    for row in rows:
+        print(json.dumps(dict(zip(
+            ["run_id", "ts", "phase", "status", "tokens", "latency_ms", "tool_invocations", "cost_usd"],
+            row))))
+    con.close()
+
+
+def main():
+    p = argparse.ArgumentParser(description="WayOfNorthStar telemetry logger (SQLite)")
+    sub = p.add_subparsers(dest="cmd")
+    logp = sub.add_parser("log", help="write a run/event record")
+    logp.add_argument("--run-id")
+    logp.add_argument("--phase", default="debug")
+    logp.add_argument("--status", default="success")
+    logp.add_argument("--tokens", type=int, default=0)
+    logp.add_argument("--latency-ms", type=float, default=0.0)
+    logp.add_argument("--tool-invocations", type=int, default=0)
+    logp.add_argument("--cost", type=float, default=0.0)
+    logp.add_argument("--event", action="append", help="type[:detail]")
+    qp = sub.add_parser("query", help="read recent runs (readers poll SQLite)")
+    qp.add_argument("--last", type=int, default=10)
+    args = p.parse_args()
+    if args.cmd == "log":
+        cmd_log(args)
+        return 0
+    if args.cmd == "query":
+        cmd_query(args)
+        return 0
+    p.print_help()
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/.agents/skills/nsr-compliance/assets/nsr/assets/docs/BEST_PRACTICES/README.md

@@ -0,0 +1,14 @@
+# BEST_PRACTICES/
+
+Category-specific engineering standards. Indexed by `BEST_PRACTICES.md` (root).
+
+## Files
+
+- `api.md` — REST design, versioning, error handling.
+- `frontend.md` — Component structure, state, styling.
+- *(add more: `state-management.md`, `code-quality.md`, ...)*
+
+## Rules
+
+- One topic per file; actionable guidance.
+- Keep `BEST_PRACTICES.md` (root) in sync.

package/.agents/skills/nsr-compliance/assets/nsr/assets/docs/BEST_PRACTICES/api.md

@@ -0,0 +1,17 @@
+# API Best Practices — __PROJECT__
+
+## REST Design
+- Resource-based URLs under a versioned prefix (`/api/v1/...`).
+- JSON everywhere; camelCase fields.
+
+## Versioning
+- Breaking changes → new major version (`/api/v2`).
+- Deprecations documented in `docs/features/`.
+
+## Error Handling
+- Consistent error envelope: `{ error: { code, message, details } }`.
+- 4xx for client errors, 5xx for server errors; never leak stack traces.
+- Log errors with context via `.agents/skills/features/*/logs.sh`.
+
+## Enforced By
+- `.agents/skills/features/<feature>/test.sh` (API contract tests).

package/.agents/skills/nsr-compliance/assets/nsr/assets/docs/BEST_PRACTICES/compliance-wiring.md

@@ -0,0 +1,155 @@
+# Wiring the Compliance to Your Project
+
+> The compliance is a project-agnostic engine. Wiring is how it *benefits your specific stack*.
+> This guide is for humans **and** agents: it explains how to add things, wire existing
+> procedures, and operate the compliance safely. Read it before dispatching agents against a
+> wired repo.
+
+## 1. The Mental Model
+
+- **Engine** — the compliance: `runner.py`, gates, telemetry, envelopes. Generic, portable, stack-neutral. It does not know or care what stack you run.
+- **Gearbox** — the scripts under `.agents/skills/lifecycle/` and `.agents/skills/features/<name>/`. **You wire these to your app.** This is where your project's reality lives.
+- **Fuel** — your existing procedures: how you start, stop, health-check, test, seed, and deploy today. The compliance never replaces them — it *wraps* them in env checks, exit-code gates, and telemetry.
+
+Rule: **the compliance adds value only where the gearbox is wired.** A freshly stamped repo is 100% stubs — that is scaffolding, not operation.
+
+## 2. The Fixed Script Contract
+
+Every script must be:
+- POSIX bash, relative paths only, no absolute paths
+- `set -e`; `exit 0` on success, non-zero on failure
+- Env-driven (read `APP_ENV`, `DATABASE_URL`, etc.; never hardcode)
+- No raw `kill -9` / `pkill` — use wired lifecycle scripts
+- If it touches anything destructive → annotate `# gate:` (see §5)
+
+| Domain | Script | What it binds to |
+|--------|--------|------------------|
+| lifecycle | `start.sh` | boot the app for `APP_ENV` |
+| lifecycle | `stop.sh` | graceful shutdown (no kill -9) |
+| lifecycle | `status.sh` | health endpoint / process check |
+| lifecycle | `smoke_test.sh` | post-boot verification against the real app |
+| features/`<name>` | `setup.sh` | env/data bootstrap, seeds, migrations |
+| features/`<name>` | `test.sh` | the feature's real test suite |
+| features/`<name>` | `smoke_test.sh` | feature health after a change |
+| features/`<name>` | `rollback.sh` | teardown / emergency rollback |
+
+## 3. Step 1 — Inventory Existing Procedures
+
+Write down the exact commands your project already uses:
+
+- How do you boot it today? (`mix phx.server`, `npm run dev`, `manage.py runserver`, `docker compose up`...)
+- How do you stop it? (Ctrl-C, `mix phx.server --no-compile` teardown, `docker compose down`, systemd stop)
+- What is the health signal? (HTTP endpoint, DB ping, `mix phx.status`, `pg_isready`)
+- What is the real test command? (`mix test`, `npm test`, `pytest`, `go test`)
+- What needs permission before running? (migrations, seed/production data, `DROP`, force push, deploy)
+
+## 4. Step 2 — Wire the Lifecycle Scripts (examples)
+
+**Elixir / Phoenix**
+
+```bash
+# .agents/skills/lifecycle/start.sh
+#!/usr/bin/env bash
+set -e
+cd "$(dirname "$0")/../../.."
+[ -f .env ] && set -a && . ./.env && set +a
+case "${APP_ENV:-development}" in
+  dev|development) exec mix phx.server ;;
+  prod)            exec mix phx.server --no-compile ;;
+  *) echo "unknown APP_ENV=$APP_ENV"; exit 1 ;;
+esac
+```
+
+```bash
+# .agents/skills/lifecycle/status.sh
+#!/usr/bin/env bash
+set -e
+cd "$(dirname "$0")/../../.."
+curl -fsS "http://${PHX_HOST:-localhost}:${PORT:-4000}/health" >/dev/null
+```
+
+**Node.js**
+
+```bash
+# .agents/skills/lifecycle/start.sh
+#!/usr/bin/env bash
+set -e
+cd "$(dirname "$0")/../../.."
+case "${APP_ENV:-development}" in
+  prod) exec npm run start ;;
+  *)    exec npm run dev ;;
+esac
+```
+
+**Python / Django**
+
+```bash
+# .agents/skills/lifecycle/start.sh
+#!/usr/bin/env bash
+set -e
+cd "$(dirname "$0")/../../.."
+exec python manage.py runserver 0.0.0.0:"${PORT:-8000}"
+```
+
+Wrap, never replace: if `scripts/cloudflare/startprod.sh` already does the right thing, your `start.sh` can simply delegate to it plus an env check:
+
+```bash
+# .agents/skills/lifecycle/start.sh
+#!/usr/bin/env bash
+set -e
+cd "$(dirname "$0")/../../.."
+[ "${APP_ENV:-development}" != "prod" ] || { scripts/cloudflare/startprod.sh; exit $?; }
+scripts/cloudflare/startdev.sh
+```
+
+## 5. Step 3 — Danger Annotations
+
+Any script containing a destructive/force primitive **must** declare it:
+
+```bash
+# gate: dev    – safe for agents/automation in dev; human confirm in prod
+# gate: guard  – must not run until a required guard script passes
+# gate: human  – irreversible; agents must never run this alone
+```
+
+`check_danger.sh` fails on dangerous scripts without an annotation. The runner *refuses* to auto-run `guard`/`human` scripts during `--plan` unless a human passes `--confirm-gate`.
+
+## 6. Step 4 — Prove the Wiring
+
+```bash
+# 1. Nothing left stubbed
+.compliance/gates/check_wiring.sh --strict
+
+# 2. No undeclared danger
+.compliance/gates/check_danger.sh
+
+# 3. Script registry (see what the compliance can do)
+.compliance/harness/runner.py --list
+
+# 4. Run for real — envelope -> gates -> your test suite
+.compliance/harness/runner.py --plan <task-envelope.json> --action test
+```
+
+Run each lifecycle script once manually. If any exits non-zero, it is not wired and must be fixed before agents are trusted.
+
+## 7. How Agents Operate the Compliance
+
+- Agents never invent commands: they call wired scripts through `runner.py`.
+- Agents read `--list` to see what exists, then open the matching feature script.
+- The compliance verifies success by `$?`, never by the agent's word.
+- Human-gated scripts (`# gate: human/guard`) are off-limits to agents; a human runs them after review.
+
+## 8. The Compliance Grows with the Project
+
+Adding a capability is mechanical:
+
+1. Register the feature in `FEATURES.md`.
+2. Create `.agents/skills/features/<name>/` with the five wired scripts (`setup test smoke_test rollback` + `SKILL.md`).
+3. `check_wiring.sh --strict` and `check_danger.sh` automatically include it.
+4. `runner.py --list` and `--plan --feature <name>` pick it up with zero compliance changes.
+
+A new gate dropped in `.compliance/gates/` is auto-run by every `--gates`/`--plan`.
+
+## 9. When It Is NOT Worth It
+
+A one-off feature that will not be run repeatedly → prompt an agent directly; do not build a feature slot. The compliance earns its keep when the same workflow runs often (agents, CI, or repeated automation) and you need verification, metering, and safe autonomy.

package/.agents/skills/nsr-compliance/assets/nsr/assets/docs/BEST_PRACTICES/frontend.md

@@ -0,0 +1,15 @@
+# Frontend Best Practices — __PROJECT__
+
+## Structure
+- Feature-based folders; shared UI in a common components dir.
+
+## State
+- Server state via a data-fetching library; local UI state via hooks.
+- No global state store unless genuinely cross-cutting.
+
+## Styling
+- Pinned CSS approach; no inline magic values.
+- Responsive-first.
+
+## Enforced By
+- `.agents/skills/lifecycle/status.sh` + feature smoke tests.

package/.agents/skills/nsr-compliance/assets/nsr/assets/docs/CI_CD/README.md

@@ -0,0 +1,11 @@
+# CI_CD/
+
+Pipeline configuration docs and deployment specs.
+
+## Files
+- `build.md`, `test.md`, `release.md` — pipeline stage docs (add as needed).
+- `deployment/` — envs, clients, tenants, deploy.sh.
+
+## Rules
+- Every pipeline step calls `.agents/skills/` scripts — no ad-hoc inline shell.
+- Deploy via `deployment/deploy.sh`.

package/.agents/skills/nsr-compliance/assets/nsr/assets/docs/CI_CD/deployment/README.md

@@ -0,0 +1,23 @@
+# CI_CD/deployment/
+
+Env-driven deployment specifications. Multiple deployments per project: env tiers, per-client, and shared multi-tenant instances.
+
+## Layout
+
+```
+deployment/
+├── envs/                    # Per-environment base templates
+│   ├── development.env.example
+│   ├── staging.env.example
+│   └── production.env.example
+├── clients/                 # Per-client deployments
+│   └── <client>/            # staging.env.example, production.env.example
+├── tenants/                 # Multi-tenant provisioning
+│   └── <tenant>.env.example
+└── deploy.sh                # Env-driven deploy runner
+```
+
+## Rules
+- Templates only committed; real values injected at deploy time.
+- Client/tenant identity is an env input, never hardcoded.
+- Run `.compliance/gates/*` before any deploy.

package/.agents/skills/nsr-compliance/assets/nsr/assets/docs/CI_CD/deployment/clients/README.md

@@ -0,0 +1,16 @@
+# clients/
+
+Per-client deployments. Each client is a first-class deployment target.
+
+## Layout
+
+```
+clients/<client>/
+├── README.md
+├── staging.env.example
+└── production.env.example
+```
+
+## Rules
+- Client identity is an env input, never hardcoded.
+- Commit templates only; inject real values/secrets at deploy.

package/.agents/skills/nsr-compliance/assets/nsr/assets/docs/CI_CD/deployment/clients/template-README.md

@@ -0,0 +1,11 @@
+# Client: <name>
+
+Per-client deployment for a client.
+
+## Templates
+- `staging.env.example`
+- `production.env.example`
+
+## Rules
+- Deploy via `docs/CI_CD/deployment/deploy.sh --env <env> --target client:<name>`.
+- Client-specific branding/features come from these templates.

package/.agents/skills/nsr-compliance/assets/nsr/assets/docs/CI_CD/deployment/deploy.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# Env-driven deploy runner. Inputs: environment tier + deployment target (client|tenant).
+# All paths relative to repo root. POSIX-portable (Mac/Linux/Windows via Git Bash/WSL).
+set -e
+
+ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
+DEPLOY_DIR="$(cd "$(dirname "$0")" && pwd)"
+
+usage() {
+  echo "Usage: deploy.sh --env <env> --target <client|tenant>"
+  echo "  --env     environment tier: development|staging|production"
+  echo "  --target  deployment target: 'client:<name>' or 'tenant:<name>'"
+  exit 1
+}
+
+ENV=""
+TARGET=""
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --env) ENV="$2"; shift 2 ;;
+    --target) TARGET="$2"; shift 2 ;;
+    *) usage ;;
+  esac
+done
+
+[ -n "$ENV" ] && [ -n "$TARGET" ] || usage
+
+BASE="$DEPLOY_DIR/envs/$ENV.env.example"
+[ -f "$BASE" ] || { echo "Missing env template: $BASE"; exit 1; }
+
+TYPE="${TARGET%%:*}"
+NAME="${TARGET#*:}"
+case "$TYPE" in
+  client) OVERRIDE="$DEPLOY_DIR/clients/$NAME/$ENV.env.example" ;;
+  tenant) OVERRIDE="$DEPLOY_DIR/tenants/$NAME.env.example" ;;
+  *) echo "Unknown target type: $TYPE"; exit 1 ;;
+esac
+
+echo "[deploy] env=$ENV target=$TARGET"
+echo "  base:   $BASE"
+[ -f "$OVERRIDE" ] && echo "  over:   $OVERRIDE" || echo "  over:   (none)"
+
+# Deterministic pre-deploy gates
+echo "[deploy] running pre-deploy gates"
+bash "$ROOT/.compliance/gates/check_env.sh"
+bash "$ROOT/.compliance/gates/check_paths.sh"
+bash "$ROOT/.compliance/gates/check_platform.sh"
+
+echo "[deploy] OK: ready to deploy (stub — actual rollout via .agents/skills/features/*)"

package/.agents/skills/nsr-compliance/assets/nsr/assets/docs/CI_CD/deployment/envs/README.md

@@ -0,0 +1,12 @@
+# envs/
+
+Per-environment base config templates.
+
+## Files
+- `development.env.example`
+- `staging.env.example`
+- `production.env.example`
+
+## Rules
+- Commit templates only; never real `.env`/secrets.
+- Declare every required var explicitly for `check_env.sh`.

package/.agents/skills/nsr-compliance/assets/nsr/assets/docs/CI_CD/deployment/envs/development.env.example

@@ -0,0 +1,17 @@
+# Env: development
+
+# Copy to .env for local dev — inject real values, never commit.
+APP_NAME=__project__
+APP_ENV=development
+APP_PORT=3000
+
+DATABASE_URL=postgres://app:app@localhost:5432/app
+REDIS_URL=redis://localhost:6379
+
+FEATURES_ENABLED=
+
+CLIENT_ID=dev-client
+TENANT_ID=dev-tenant
+
+# Inject at runtime; never commit.
+# CRYPTO_SECRET=

package/.agents/skills/nsr-compliance/assets/nsr/assets/docs/CI_CD/deployment/envs/production.env.example

@@ -0,0 +1,17 @@
+# Env: production
+
+APP_NAME=__project__
+APP_ENV=production
+APP_PORT=443
+
+DATABASE_URL=postgres://app:app@prod-db:5432/app
+REDIS_URL=redis://prod-redis:6379
+
+FEATURES_ENABLED=
+
+# Set at deploy time per client/tenant.
+# CLIENT_ID=
+# TENANT_ID=
+
+# MUST be injected via secret manager. Never commit, never default.
+# CRYPTO_SECRET=

package/.agents/skills/nsr-compliance/assets/nsr/assets/docs/CI_CD/deployment/envs/staging.env.example

@@ -0,0 +1,17 @@
+# Env: staging
+
+APP_NAME=__project__
+APP_ENV=staging
+APP_PORT=8080
+
+DATABASE_URL=postgres://app:app@staging-db:5432/app
+REDIS_URL=redis://staging-redis:6379
+
+FEATURES_ENABLED=
+
+# Set at deploy time.
+# CLIENT_ID=
+# TENANT_ID=
+
+# Inject at runtime; never commit.
+# CRYPTO_SECRET=

package/.agents/skills/nsr-compliance/assets/nsr/assets/docs/CI_CD/deployment/tenants/README.md

@@ -0,0 +1,11 @@
+# tenants/
+
+Multi-tenant provisioning & tenant config for shared instances.
+
+## Files
+- `<tenant>.env.example` — per-tenant provisioning profile.
+
+## Rules
+- Tenant identity is dynamic (per-request), isolated at runtime.
+- Tenant-scoped config as templates; data isolation enforced at runtime.
+- Never commit tenant secrets.

package/.agents/skills/nsr-compliance/assets/nsr/assets/docs/CI_CD/deployment/tenants/template.env.example

@@ -0,0 +1,8 @@
+# Tenant: <name>
+
+# Base config for a tenant in a shared multi-tenant deployment.
+APP_MODE=multi-tenant
+FEATURES_ENABLED=
+
+# Tenant identity resolved per-request from token claims.
+# TENANT_SIGNING_KEY=  (inject via secret manager)

package/.agents/skills/nsr-compliance/assets/nsr/assets/docs/DEVELOPER_SETUP/README.md

@@ -0,0 +1,26 @@
+# docs/DEVELOPER_SETUP/
+
+Per-developer core setup — explain every developer so no one guesses.
+
+## Who Develops Here (Brief)
+
+1. **Developer 1 — *(name)*:** *(role)* — *(stack)*.
+2. *(add each developer)*
+
+## Core Setup (Common)
+
+1. Platform: Mac/Linux/Windows (WSL2 / Git Bash for POSIX).
+2. Toolchain: pinned in `TECH_STACK.md`.
+3. Clone + install via `.agents/skills/` scripts.
+4. Env: copy `docs/CI_CD/deployment/envs/development.env.example` → `.env`; inject via secret manager.
+5. Credentials: SSH key + secret manager (references only).
+6. Verify: `check_env.sh`, `check_paths.sh`, `check_platform.sh`.
+
+## Explicit Per-Developer Files
+
+- `developers/dev-1.md` .. `dev-N.md` — one file per developer.
+
+## Platform Appendices
+
+- `shared.md` — cross-platform rules.
+- `macos.md`, `linux.md`, `windows.md`, `agent.md`.

package/.agents/skills/nsr-compliance/assets/nsr/assets/docs/DEVELOPER_SETUP/agent.md

@@ -0,0 +1,7 @@
+# DEVELOPER_SETUP — Agent Runtime
+
+- Install harness via `.compliance/installer/install.sh`.
+- Embedded compliance: `.agents/skills/NSRcompliance/` (SKILL.md, config, gates, harness, telemetry).
+- MCP sync → WayOfTeams (Kanban, Knowledge Base, Anchor Memory).
+- Env-driven config only; run `check_env.sh` before tasks.
+- Telemetry via `.compliance/telemetry/logger.py`.

package/.agents/skills/nsr-compliance/assets/nsr/assets/docs/DEVELOPER_SETUP/developers/dev-1.md

@@ -0,0 +1,20 @@
+# Developer N
+
+## Identity
+- **Name:** *(replace)*
+- **Role:** *(e.g., Backend / Frontend / DevOps)*
+- **Platform:** *(macOS / Linux / Windows)*
+
+## Core Setup
+- **Stack:** *(from TECH_STACK.md)*
+- **Toolchain:** *(pinned versions)*
+- **Environment:** `.env` from `docs/CI_CD/deployment/envs/development.env.example`
+- **Credentials:** *(SSH key, secret-manager refs — never raw secrets)*
+
+## Local Loop
+- **Start:** `.agents/skills/lifecycle/start.sh`
+- **Test:** `.agents/skills/features/<feature>/test.sh`
+- **Verify:** `.compliance/gates/check_env.sh`, `check_paths.sh`, `check_platform.sh`
+
+## Responsibilities
+- *(what this developer owns)*

package/.agents/skills/nsr-compliance/assets/nsr/assets/docs/DEVELOPER_SETUP/linux.md

@@ -0,0 +1,9 @@
+# DEVELOPER_SETUP — Linux
+
+- Debian/Ubuntu: `sudo apt install -y git bash python3 nodejs npm`
+- Fedora: `sudo dnf install -y git bash python3 nodejs`
+- SSH keys at `~/.ssh/`; `ssh-agent` for keys.
+- Docker: add user to `docker` group if used.
+
+## Gotchas
+- Forward slashes; LF endings.

package/.agents/skills/nsr-compliance/assets/nsr/assets/docs/DEVELOPER_SETUP/macos.md

@@ -0,0 +1,10 @@
+# DEVELOPER_SETUP — macOS
+
+- Homebrew: `/bin/bash -c "$(curl -fsSL ...install/HEAD/install.sh)"`
+- Toolchain: `brew install git bash python3 node`
+- SSH keys at `~/.ssh/`.
+- Local loop via `.agents/skills/lifecycle/*`.
+
+## Gotchas
+- Run bash scripts with `bash`, not `zsh`.
+- Localhost port from `.env` `APP_PORT`.

package/.agents/skills/nsr-compliance/assets/nsr/assets/docs/DEVELOPER_SETUP/shared.md

@@ -0,0 +1,19 @@
+# DEVELOPER_SETUP — Shared (All Platforms)
+
+Cross-platform toolchain/env/git rules.
+
+## Toolchain
+- Runtimes per `TECH_STACK.md` (pinned versions).
+- bash (POSIX) for automation; Windows uses WSL2 / Git Bash.
+
+## Git & Credentials
+- SSH key + secret manager (references only).
+- Git ops via `.agents/skills/git_ops/`.
+
+## Environment
+- Copy `docs/CI_CD/deployment/envs/development.env.example` → `.env`.
+- Inject real values via env / secret manager. Never commit `.env`.
+
+## Rules
+- Everything via `.agents/skills/` scripts — zero ad-hoc.
+- Repo-relative paths; forward slashes; LF.

package/.agents/skills/nsr-compliance/assets/nsr/assets/docs/DEVELOPER_SETUP/windows.md

@@ -0,0 +1,14 @@
+# DEVELOPER_SETUP — Windows
+
+Use WSL2 (recommended) or Git Bash for POSIX automation.
+
+## Option A — WSL2
+- `wsl --install`, then follow `linux.md`.
+
+## Option B — Git Bash
+- Install "Git for Windows"; run `.sh` from Git Bash.
+
+## Gotchas
+- LF line endings (rejected by `check_platform.sh` if CRLF).
+- No `C:\...` absolute paths (rejected by `check_paths.sh`).
+- No `taskkill`/`pkill` in project scripts.

package/.agents/skills/nsr-compliance/assets/nsr/assets/docs/HOSTING/README.md

@@ -0,0 +1,25 @@
+# docs/HOSTING/
+
+Per-hosting core info — never break production.
+
+## Consolidated Hosting List
+
+1. **Hosting 1 — *(provider)*:** runs *(services)* for *(clients/tenants/envs)*; access via *(secret manager / service account)*; **critical rule:** always deploy via skill scripts, no manual live-config edits.
+2. *(add each hosting here)*
+
+## Core Rules
+
+1. Never break hosting — ops via `.agents/skills/` scripts only.
+2. No raw secrets — reference env/secret-manager names.
+3. Relative paths only; cross-platform.
+4. Every production hosting documented here + per-host file.
+5. Rollback path exists for every host.
+
+## Per-Host Files
+
+- `_template.md` — copy for a new host.
+- `hosting-N.md` — explicit doc per hosting.
+
+## Verification
+
+- `.compliance/gates/verify_docs.py` checks every hosting has a doc.