anti-slop-engineering 1.2.0 → 1.3.0

package/.skills.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://skills.sh/schema.json",
   "name": "anti-slop-engineering",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "description": "An Engineering Discipline Playbook & Guard System for AI Coding Agents. Enforces Google SRE, Clean-Room Senior Dev Ladders, and Rust/Go Microservices.",
   "repository": "https://github.com/imMamdouhaboammar/anti-slop-engineering",
   "author": "Mamdouh Aboammar",

package/README.md

@@ -12,7 +12,7 @@
 [![Skills.sh](https://img.shields.io/badge/Skills.sh-Compatible-000000?style=flat-square&logo=vercel&logoColor=white)](https://skills.sh)
 [![Claude Code](https://img.shields.io/badge/Claude%20Code-Certified%20Skill-D97706?style=flat-square&logo=anthropic&logoColor=white)](https://claude.ai)
 
-[Install](#install) · [What it catches](#what-it-catches) · [Engines](#engines) · [Decision Guard](#decision-guard) · [Root-Fix Gate](#root-fix-gate) · [Agent skill](#agent-skill) · [Anti-pattern catalog](#anti-pattern-catalog-216-patterns)
+[Install](#install) · [What it catches](#what-it-catches) · [Engines](#engines) · [Decision Guard](#decision-guard) · [Root-Fix Gate](#root-fix-gate) · [Future-Scale Gate](#future-scale-gate) · [Agent skill](#agent-skill) · [Anti-pattern catalog](#anti-pattern-catalog-217-patterns)
 
 </div>
 
@@ -245,9 +245,30 @@ The JSON checker uses only Python standard library and Git when diff inspection
 
 ---
 
+## Future-Scale Gate
+
+The [Future-Scale Gate](skills/future-scale-gate/SKILL.md) protects long-lived systems against two opposite failures: locking a core contract to today's workload, and implementing expensive infrastructure for an unverified hypothetical future.
+
+| Question | Required evidence |
+| --- | --- |
+| What changes over the product's lifetime? | Credible scenarios with sources, stress axes and failure consequences |
+| Which foundation would be costly to change later? | Reversal cost, alternative designs and migration/exit path |
+| What must be established now? | Small stable boundary and a representative evolution test |
+| What should wait? | Deferred capacity with a concrete revisit trigger |
+
+Examples include a simulation language keeping its semantics portable across runtimes, a versioned public data format, or a future tenant-isolation constraint. The Gate does not require microservices, Rust, distributed systems or a provider bundle by default.
+
+```bash
+node bin/cli.js future-scale audit skills/future-scale-gate/examples/runtime-envelope-record.json --json
+```
+
+The bundled example intentionally recommends `pause` because its alternate-engine experiment has not been run. The zero-dependency checker validates record completeness, not forecast accuracy or actual scalability. The ten semantic evaluation scenarios are proposed tests, not measured model effectiveness.
+
+---
+
 ## Agent skill
 
-The agent skill wires Anti-Slop Engineering into your AI coding agent's context. Once installed, code changes are guided by the Seven Gates, the 216-pattern anti-pattern catalog, and the Google SRE enforcement rules.
+The agent skill wires Anti-Slop Engineering into your AI coding agent's context. Once installed, code changes are guided by the Seven Gates, the 217-pattern anti-pattern catalog, and the Google SRE enforcement rules.
 
 **Supported environments:**
 
@@ -267,9 +288,9 @@ When installed via `npm install anti-slop-engineering` or `bun add anti-slop-eng
 
 ---
 
-## Anti-pattern catalog (216 patterns)
+## Anti-pattern catalog (217 patterns)
 
-The catalog in [`references/anti-pattern-catalog.md`](references/anti-pattern-catalog.md) documents 216 diagnostic patterns across 14 engineering domains, each with a canonical ID, symptom, root cause, and remediation.
+The catalog in [`references/anti-pattern-catalog.md`](references/anti-pattern-catalog.md) documents 217 diagnostic patterns across 14 engineering domains, each with a canonical ID, symptom, root cause, and remediation.
 
 **Domains covered:**
 

package/SKILL.md

@@ -4,7 +4,7 @@ description: Prevent, detect, and repair AI coding slop and dirty engineering in
 author: Mamdouh Aboammar <mamdouhfces1997@gmail.com>
 license: MIT
 metadata:
-  version: "1.2.0"
+  version: "1.3.0"
   focus: "engineering-discipline"
   repository: "https://github.com/imMamdouhaboammar/anti-slop-engineering"
 ---
@@ -39,6 +39,7 @@ metadata:
     - **Practical DRY 3-Point Barrier:** Shared utilities or abstractions are permitted only when appearing in >=2 real existing call-sites, when all call-sites require identical modifications upon change, and when the abstraction can be named without coordinating conjunctions (`and`, `or`).
 15. **Decision Guard before consequential commitments:** When the task proposes derived metrics, an architectural stack, infrastructure, persistence, or a difficult-to-reverse engineering decision, read [Decision Guard](skills/decision-guard/SKILL.md). Check direct evidence and independent alternatives before treating the proposed method as necessary. Never substitute the decision record's structural check for source verification.
 16. **Root-Fix Gate for scattered symptom patches:** When a local behavior change spreads through controllers, views, endpoints or multiple layers, read [Root-Fix Gate](skills/root-fix-gate/SKILL.md). Trace the owner of the domain invariant, compare a coherent source correction with consumer workarounds, and inspect actual change paths. Do not assume the model owns every rule or that few files prove safety.
+17. **Future-Scale Gate for irreversible foundations:** Before locking in a core runtime, public contract, persistence model, or platform boundary for a long-lived product, read [Future-Scale Gate](skills/future-scale-gate/SKILL.md). Establish credible future operating scenarios, assess reversal cost and run a bounded evolution proof. Design the cheap necessary foundation now; defer speculative infrastructure with measurable revisit triggers. Lack of a present bottleneck does not disprove future architectural constraints.
 
 ## Activation / modes
 
@@ -51,6 +52,7 @@ Select the relevant mode and follow the same gates:
 - **NOTED_SLOP:** codify newly observed AI slop into a diagnostic catalog pattern, agent directive, and automated diff guard heuristic (see [CONTRIBUTING.md](CONTRIBUTING.md)).
 - **DECIDE:** when premises, direct answers or long-term architecture choices are materially uncertain, follow [Decision Guard](skills/decision-guard/SKILL.md) before BUILD. Return to ordinary modes after a decision; skip the extra protocol for routine repairs.
 - **ROOT-FIX:** when a symptom attracts scattered fixes or ownership is uncertain, follow [Root-Fix Gate](skills/root-fix-gate/SKILL.md) to establish the change boundary, then resume BUILD/FIX with regression tests.
+- **FUTURE-SCALE:** when an architecture commitment would be expensive to reverse as the product evolves, follow [Future-Scale Gate](skills/future-scale-gate/SKILL.md). Skip routine reversible edits and avoid capacity theater.
 
 For extensive audits, load [anti-pattern catalog](references/anti-pattern-catalog.md). For Google SRE discipline and distributed resilience patterns, load [google-sre-discipline](references/google-sre-discipline.md). For any test changes, load [test integrity policy](references/test-integrity.md). For a PR or merge request, load [PR review protocol](references/pr-review.md). For elevated permissions, sensitive code, network access, or deployment, load [security and execution boundaries](references/security-and-operations.md). For project-specific exceptions, load [judgment and exceptions](references/engineering-judgment.md). For community contributions, follow [contributor guidelines](CONTRIBUTING.md).
 
@@ -65,6 +67,7 @@ For extensive audits, load [anti-pattern catalog](references/anti-pattern-catalo
 - Run an appropriate baseline build/test if feasible; label any existing failure as baseline, not caused by this change.
 - For a derived-answer task, inspect existing direct sources before constructing proxies. For an architectural commitment, inspect the product's actual rendering, workload, operations and persistence needs instead of defaulting to a familiar provider bundle. Load `skills/decision-guard/SKILL.md` only when this uncertainty is material.
 - For a proposed cross-layer patch, identify the first incorrect boundary and trace writes/reads before editing consumers. Load `skills/root-fix-gate/SKILL.md` when the same symptom would otherwise be patched in several places.
+- For a foundational architectural commitment, classify credible future stresses and costly reversal points before using today's workload as an excuse to hard-wire the system. Load `skills/future-scale-gate/SKILL.md` only for consequential choices and verify an actual evolution path before claiming future readiness.
 - For new projects, services, components, or SDK integrations, identify the official installer, CLI generator, and canonical starter boilerplate before writing code. Do not manually assemble configurations or directory trees from memory. Never generate unprompted documentation files, submission dossiers, or speculative third-party platform guides.
 
 ### Gate 1: Establish a change contract

package/bin/cli.js

@@ -15,6 +15,8 @@ const diffGuardScript = resolve(rootDir, "scripts", "diff_guard.py");
 const sreGuardScript = resolve(rootDir, "scripts", "sre_guard.py");
 const decisionGuardScript = resolve(rootDir, "scripts", "decision_guard.py");
 const rootFixGuardScript = resolve(rootDir, "scripts", "root_fix_guard.py");
+const futureScaleGuardScript = resolve(rootDir, "scripts", "future_scale_guard.py");
+const bumpVersionScript = resolve(rootDir, "scripts", "bump_version.py");
 const nativeSuffix = process.platform === "win32" ? ".exe" : "";
 const rustExecutable = "anti-slop-rust" + nativeSuffix;
 const goExecutable = "toil-guard" + nativeSuffix;
@@ -33,7 +35,7 @@ if (executableAliases[invokedAs]) args.unshift(executableAliases[invokedAs]);
 
 function printBanner() {
   console.log(`
-🛡️  Anti-Slop Engineering CLI (v1.2.0)
+🛡️  Anti-Slop Engineering CLI (v1.3.0)
    Clean-Room AI Coding Guard & High-Performance Polyglot Architecture
    Engines: Standard Library Python Guard | Rust Microservice | Go Toil Guard
    Author: Mamdouh Aboammar <mamdouhfces1997@gmail.com>
@@ -52,6 +54,8 @@ Commands:
   sre, sre-guard         Run Python Google SRE Guard (zero-dependency stdlib fallback)
   decision audit <file>  Check a Decision Guard JSON record for missing evidence and trade-offs
   root-fix audit <file>  Check root-cause ownership, change plan and optional Git diff
+  future-scale audit <file>  Check future operating envelope, reversibility and evolution proof
+  bump [part]            Bump version across all 10 manifests (patch, minor, major, or explicit)
   test                   Run unit test suite
   contribute             Print guidelines on reporting noted slop or opening PRs
 
@@ -200,6 +204,10 @@ if (cmd === "build") {
   runPythonScript(decisionGuardScript, args.slice(1), "decision_guard");
 } else if (cmd === "root-fix") {
   runPythonScript(rootFixGuardScript, args.slice(1), "root_fix_guard");
+} else if (cmd === "future-scale") {
+  runPythonScript(futureScaleGuardScript, args.slice(1), "future_scale_guard");
+} else if (cmd === "bump") {
+  runPythonScript(bumpVersionScript, args.slice(1), "bump_version");
 } else if (args.includes("--help") || args.includes("-h")) {
   printBanner();
   process.exit(0);

package/install.sh

@@ -42,11 +42,12 @@ install_to() {
   chmod +x "$dest/scripts/sre_guard.py" 2>/dev/null || true
   chmod +x "$dest/scripts/decision_guard.py" 2>/dev/null || true
   chmod +x "$dest/scripts/root_fix_guard.py" 2>/dev/null || true
+  chmod +x "$dest/scripts/future_scale_guard.py" 2>/dev/null || true
   chmod +x "$dest/install.sh" 2>/dev/null || true
   echo "  ✅ Installed anti-slop-engineering for ${label} -> ${dest}"
 
   # Install each bundled module as a discoverable top-level skill.
-  for module in decision-guard root-fix-gate; do
+  for module in decision-guard root-fix-gate future-scale-gate; do
     if [ -d "$SOURCE_DIR/skills/$module" ]; then
       local module_dest="$(dirname "$dest")/$module"
       rm -rf "$module_dest"

package/marketplace.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-plugin-manifest.json",
   "name": "anti-slop-engineering",
   "displayName": "Anti-Slop Engineering",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "description": "An Engineering Discipline Playbook, Agent Skill & Triage Guard for AI Coding Agents. Enforces behavioral contracts, focused diffs, test integrity, Google SRE principles, and native Rust/Go clean-room microservices.",
   "author": {
     "name": "Mamdouh Aboammar",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "anti-slop-engineering",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "description": "An Engineering Discipline Playbook, Agent Skill & Triage Guard for AI Coding Agents",
   "type": "module",
   "main": "bin/cli.js",
@@ -49,6 +49,7 @@
     "sre-guard": "bun bin/cli.js sre",
     "test": "python3 -m unittest discover -s tests -v",
     "test-all": "make test-all",
+    "bump": "python3 scripts/bump_version.py",
     "check": "make check",
     "check-all": "make check-all"
   },

package/references/anti-pattern-catalog.md

@@ -39,6 +39,7 @@ Format: **ID | pattern | how to verify / safer alternative**. Numbers are stable
 - **ARC-15 | Manual scaffolding improvisation.** Hand-crafting directory structures, build configs, and boilerplate files (`tsconfig.json`, `package.json`, `pyproject.toml`, Dockerfiles) from memory instead of using the official framework/language CLI installer, starter template, or generator; introduces missing build flags, non-standard layouts, and broken tooling.
 - **ARC-16 | Familiar-stack default and short-horizon choice.** Agent bundles framework, host and database by popularity without testing actual workload, operations, recovery, exit paths or credible future states; compare independent axes, constraints and reversibility. Managed services and VPS are each legitimate where evidence supports them.
 - **ARC-17 | Symptom fan-out and wrong-layer repair.** Agent fixes a repeated symptom separately in many consumers instead of checking the responsible domain or boundary contract; trace writes and reads, compare owner correction with distributed patches, and preserve distinct context-specific policies. A one-file model rewrite is not automatically safer than a justified multi-layer change.
+- **ARC-18 | Present-state foundation trap.** Agent treats the absence of today's workload bottleneck as evidence that future architecture does not matter, permanently coupling semantics, storage or identity to a cheap current implementation. Alternatively it builds speculative high-scale infrastructure without a credible use case. Distinguish hard-to-reverse foundations from replaceable capacity, rank future scenarios by evidence, and test the smallest evolution path before committing.
 
 ## C. Simplicity, duplication, and code readability
 

package/scripts/bump_version.py

@@ -0,0 +1,276 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2026 Mamdouh Aboammar <mamdouhfces1997@gmail.com> and contributors
+"""Bump version across repository manifests, documentation, and native services."""
+
+import argparse
+import datetime
+import hashlib
+import json
+import pathlib
+import shutil
+import sre_compile
+import subprocess
+import sys
+
+SEMVER_PATTERN = sre_compile.compile(
+    r'^(?P<major>\d{1,8})\.(?P<minor>\d{1,8})\.(?P<patch>\d{1,8})(?:-(?P<prerelease>[0-9A-Za-z.-]{1,50}))?$'
+)
+
+MANIFEST_TARGETS = [
+    {
+        "file": "package.json",
+        "pattern": sre_compile.compile(r'("version"\s*:\s*)"[^"]+"'),
+        "replacement": r'\g<1>"{version}"',
+    },
+    {
+        "file": "pyproject.toml",
+        "pattern": sre_compile.compile(r'(version\s*=\s*)"[^"]+"'),
+        "replacement": r'\g<1>"{version}"',
+    },
+    {
+        "file": ".skills.json",
+        "pattern": sre_compile.compile(r'("version"\s*:\s*)"[^"]+"'),
+        "replacement": r'\g<1>"{version}"',
+    },
+    {
+        "file": "marketplace.json",
+        "pattern": sre_compile.compile(r'("version"\s*:\s*)"[^"]+"'),
+        "replacement": r'\g<1>"{version}"',
+    },
+    {
+        "file": "SKILL.md",
+        "pattern": sre_compile.compile(r'(version\s*:\s*)"[^"]+"'),
+        "replacement": r'\g<1>"{version}"',
+    },
+    {
+        "file": "bin/cli.js",
+        "pattern": sre_compile.compile(r'Anti-Slop Engineering CLI \(v[^\)]+\)'),
+        "replacement": r'Anti-Slop Engineering CLI (v{version})',
+    },
+    {
+        "file": "CITATION.cff",
+        "pattern": sre_compile.compile(r'(version\s*:\s*)[^\n]+'),
+        "replacement": r'\g<1>{version}',
+    },
+    {
+        "file": "CITATION.cff",
+        "pattern": sre_compile.compile(r'(date-released\s*:\s*)[^\n]+'),
+        "replacement": r'\g<1>{release_date}',
+    },
+    {
+        "file": "services/anti-slop-rust/Cargo.toml",
+        "pattern": sre_compile.compile(r'(\[package\][\s\S]*?version\s*=\s*)"[^"]+"'),
+        "replacement": r'\g<1>"{version}"',
+    },
+    {
+        "file": "services/toil-guard-go/pkg/model/types.go",
+        "pattern": sre_compile.compile(r'(Version\s*:\s*)"[^"]+"'),
+        "replacement": r'\g<1>"{version}"',
+    },
+    {
+        "file": "services/toil-guard-go/pkg/server/server.go",
+        "pattern": sre_compile.compile(r'("version"\s*:\s*)"[^"]+"'),
+        "replacement": r'\g<1>"{version}"',
+    },
+]
+
+
+def parse_semver(version_str, depth=0, max_depth=100):
+    """Parse semver string into (major, minor, patch, prerelease)."""
+    if depth > max_depth:
+        return None
+    cleaned = version_str.lstrip("v").strip()
+    match = SEMVER_PATTERN.match(cleaned)
+    if not match:
+        return None
+    return {
+        "major": int(match.group("major")),
+        "minor": int(match.group("minor")),
+        "patch": int(match.group("patch")),
+        "prerelease": match.group("prerelease"),
+    }
+
+
+def compute_next_version(current_ver, bump_type, depth=0, max_depth=100):
+    """Calculate the next semver string based on bump type or target version."""
+    if depth > max_depth:
+        raise ValueError("Maximum recursion depth exceeded")
+
+    candidate = bump_type.lstrip("v").strip()
+    if SEMVER_PATTERN.match(candidate):
+        return candidate
+
+    parsed = parse_semver(current_ver)
+    if not parsed:
+        raise ValueError(f"Current version '{current_ver}' is not valid semver")
+
+    bump = bump_type.lower()
+    if bump == "patch":
+        return f"{parsed['major']}.{parsed['minor']}.{parsed['patch'] + 1}"
+    if bump == "minor":
+        return f"{parsed['major']}.{parsed['minor'] + 1}.0"
+    if bump == "major":
+        return f"{parsed['major'] + 1}.0.0"
+
+    raise ValueError(
+        f"Invalid bump type or version '{bump_type}'. Choose patch, minor, major, or explicit semver (e.g. 1.3.0)"
+    )
+
+
+def read_current_version(root_dir, depth=0, max_depth=100):
+    """Read the current canonical version from package.json."""
+    if depth > max_depth:
+        raise ValueError("Maximum depth exceeded")
+    pkg_path = pathlib.Path(root_dir) / "package.json"
+    if not pkg_path.is_file():
+        raise FileNotFoundError(f"Missing canonical manifest at {pkg_path}")
+    data = json.loads(pkg_path.read_text(encoding="utf-8"))
+    version = data.get("version")
+    if not isinstance(version, str) or not version.strip():
+        raise ValueError(f"package.json has missing or invalid version: {version}")
+    return version.strip()
+
+
+def apply_target_update(compiled_pattern, repl_str, content, depth=0, max_depth=100):
+    """Apply single precompiled regex replacement pattern to file content."""
+    if depth > max_depth:
+        return content, False
+    new_content, count = compiled_pattern.subn(repl_str, content, count=1)
+    return new_content, count > 0
+
+
+def update_attestation_hash(root_dir, new_pkg_content, depth=0, max_depth=100):
+    """Update package.json sha256 in .fable/heal-attestation.json if present."""
+    if depth > max_depth:
+        return False
+    attestation_path = pathlib.Path(root_dir) / ".fable" / "heal-attestation.json"
+    if not attestation_path.is_file():
+        return False
+    try:
+        data = json.loads(attestation_path.read_text(encoding="utf-8"))
+        if "file_hashes" in data and "package.json" in data["file_hashes"]:
+            new_hash = hashlib.sha256(new_pkg_content.encode("utf-8")).hexdigest()
+            data["file_hashes"]["package.json"] = new_hash
+            attestation_path.write_text(json.dumps(data, indent=2) + "\n", encoding="utf-8")
+            return True
+    except (OSError, ValueError):
+        return False
+    return False
+
+
+def sync_cargo_lock(root_dir):
+    """Synchronize Cargo.lock if cargo is available."""
+    cargo_bin = shutil.which("cargo")
+    cargo_toml = pathlib.Path(root_dir) / "services" / "anti-slop-rust" / "Cargo.toml"
+    if cargo_bin and cargo_toml.is_file():
+        subprocess.run(
+            [cargo_bin, "check", "--manifest-path", str(cargo_toml)],
+            capture_output=True,
+            check=False,
+        )
+
+
+def bump_repository_version(root_dir, bump_type, release_date=None, dry_run=False, depth=0, max_depth=100):
+    """Perform version bump across all registered repository manifests."""
+    if depth > max_depth:
+        raise ValueError("Maximum depth exceeded")
+    root = pathlib.Path(root_dir).resolve()
+    current_ver = read_current_version(root)
+    next_ver = compute_next_version(current_ver, bump_type)
+    rel_date = release_date or datetime.datetime.now(datetime.timezone.utc).strftime("%Y-%m-%d")
+
+    results = []
+    file_contents = {}
+
+    for target in MANIFEST_TARGETS:
+        rel_path = target["file"]
+        file_path = root / rel_path
+        if not file_path.is_file():
+            results.append({"file": rel_path, "status": "skipped_missing"})
+            continue
+
+        content = file_contents.get(rel_path)
+        if content is None:
+            content = file_path.read_text(encoding="utf-8")
+
+        repl_str = target["replacement"].format(version=next_ver, release_date=rel_date)
+        new_content, updated = apply_target_update(target["pattern"], repl_str, content)
+
+        if updated:
+            file_contents[rel_path] = new_content
+            results.append({"file": rel_path, "status": "updated"})
+        else:
+            results.append({"file": rel_path, "status": "pattern_not_found"})
+
+    if not dry_run:
+        for rel_path, content in file_contents.items():
+            (root / rel_path).write_text(content, encoding="utf-8")
+
+        if "package.json" in file_contents:
+            update_attestation_hash(root, file_contents["package.json"])
+
+        sync_cargo_lock(root)
+
+    return {
+        "previous_version": current_ver,
+        "new_version": next_ver,
+        "release_date": rel_date,
+        "dry_run": dry_run,
+        "updated_files": list(dict.fromkeys(r["file"] for r in results if r["status"] == "updated")),
+        "details": results,
+    }
+
+
+def main():
+    """Command-line entrypoint for bumping version."""
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument(
+        "bump",
+        nargs="?",
+        default="patch",
+        help="Bump type (patch, minor, major) or explicit semver version (e.g. 1.3.0)",
+    )
+    parser.add_argument("--repo", default=".", help="Root directory of the repository")
+    parser.add_argument("--date", default=None, help="Release date override (YYYY-MM-DD)")
+    parser.add_argument("--dry-run", action="store_true", help="Preview version changes without writing")
+    parser.add_argument("--json", action="store_true", help="Output machine-readable JSON summary")
+    parser.add_argument("--git-tag", action="store_true", help="Create git tag vX.Y.Z after bump")
+    parser.add_argument("--git-commit", action="store_true", help="Create git commit after bump")
+    args = parser.parse_args()
+
+    try:
+        report = bump_repository_version(
+            root_dir=args.repo,
+            bump_type=args.bump,
+            release_date=args.date,
+            dry_run=args.dry_run,
+        )
+    except (ValueError, FileNotFoundError) as err:
+        print(f"Error: {err}", file=sys.stderr)
+        return 1
+
+    if args.git_commit and not args.dry_run:
+        ver = report["new_version"]
+        subprocess.run(["git", "-C", args.repo, "add", "-A"], check=False)
+        subprocess.run(["git", "-C", args.repo, "commit", "-m", f"chore(release): v{ver}"], check=False)
+
+    if args.git_tag and not args.dry_run:
+        ver = report["new_version"]
+        subprocess.run(["git", "-C", args.repo, "tag", "-a", f"v{ver}", "-m", f"Release v{ver}"], check=False)
+
+    if args.json:
+        print(json.dumps(report, indent=2))
+    else:
+        status_prefix = "[DRY-RUN] " if report["dry_run"] else ""
+        print(f"{status_prefix}Bumped version: v{report['previous_version']} ➜ v{report['new_version']}")
+        print(f"Release Date: {report['release_date']}")
+        print(f"Updated {len(set(report['updated_files']))} manifest files:")
+        for file in sorted(set(report["updated_files"])):
+            print(f"  ✓ {file}")
+
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/scripts/future_scale_guard.py

@@ -0,0 +1,197 @@
+#!/usr/bin/env python3
+"""Check future-scale architectural decision records for structural completeness."""
+
+import argparse
+import json
+import sys
+from pathlib import Path
+
+
+def filled(value, depth=0, max_depth=100):
+    if depth > max_depth:
+        return False
+    return isinstance(value, str) and bool(value.strip())
+
+
+def choice(value, values):
+    return isinstance(value, str) and value in values
+
+
+def _record_finding(findings, ok, code, message, severity="block", depth=0, max_depth=100):
+    if depth > max_depth:
+        return
+    if not ok:
+        findings.append({"severity": severity, "code": code, "message": message})
+
+
+def check_scenarios(record, proceeding, require):
+    scenarios = record.get("scenarios")
+    require(isinstance(scenarios, list), "INVALID_SCENARIOS", "scenarios must be a list")
+    if not isinstance(scenarios, list):
+        return {}
+    ids = {}
+    for index, item in enumerate(scenarios):
+        valid = (isinstance(item, dict) and filled(item.get("id"))
+                 and filled(item.get("stress")) and filled(item.get("failure_if_unprepared"))
+                 and choice(item.get("basis"), {"observed", "credible", "speculative"})
+                 and filled(item.get("source")))
+        require(valid, "INVALID_SCENARIO", "scenarios[%d] needs id, stress, basis, source and failure" % index)
+        if valid:
+            key = item["id"].strip().casefold()
+            require(key not in ids, "DUPLICATE_SCENARIO", "Scenario ids must be distinct")
+            ids[key] = item["basis"]
+    if proceeding:
+        require(bool(ids), "MISSING_FUTURE_ENVELOPE", "Name at least one source-backed future stress")
+        require(any(basis in {"observed", "credible"} for basis in ids.values()),
+                "SPECULATION_ONLY", "Do not harden foundations for speculative-only futures")
+    return ids
+
+
+def check_commitments(record, proceeding, require):
+    commitments = record.get("commitments")
+    require(isinstance(commitments, list), "INVALID_COMMITMENTS", "commitments must be a list")
+    if not isinstance(commitments, list):
+        return
+    if proceeding:
+        require(bool(commitments), "MISSING_COMMITMENTS", "Name costly-to-reverse decisions or explicit assumptions")
+    for index, item in enumerate(commitments):
+        valid = (isinstance(item, dict) and filled(item.get("decision"))
+                 and filled(item.get("failure_cost"))
+                 and choice(item.get("reversibility"), {"low", "medium", "high"}))
+        require(valid, "INVALID_COMMITMENT", "commitments[%d] needs decision, failure_cost and reversibility" % index)
+        if valid and item["reversibility"] in {"medium", "high"} and proceeding:
+            require(filled(item.get("exit_path")), "MISSING_EXIT_PATH",
+                    "Costly-to-reverse commitment needs a migration or recovery path")
+
+
+def check_options(record, proceeding, require):
+    options = record.get("options")
+    require(isinstance(options, list), "INVALID_OPTIONS", "options must be a list")
+    if not isinstance(options, list):
+        return
+    names = []
+    chosen = 0
+    for index, item in enumerate(options):
+        valid = (isinstance(item, dict) and filled(item.get("name"))
+                 and filled(item.get("now_cost")) and filled(item.get("future_cost"))
+                 and type(item.get("selected")) is bool)
+        require(valid, "INVALID_OPTION", "options[%d] needs name, both lifecycle costs and selected" % index)
+        if valid:
+            names.append(item["name"].strip().casefold())
+            chosen += item["selected"]
+    require(len(names) == len(set(names)), "DUPLICATE_OPTIONS", "Architecture options must be distinct")
+    if proceeding:
+        require(len(names) >= 2 or (len(names) == 1 and filled(record.get("sole_option_reason"))),
+                "MISSING_ALTERNATIVES", "Compare designs or justify a single viable option")
+        require(chosen == 1, "INVALID_SELECTION", "Select exactly one design")
+
+
+def check_proofs(record, require):
+    proofs = record.get("proofs")
+    require(isinstance(proofs, list), "INVALID_PROOFS", "proofs must be a list")
+    if not isinstance(proofs, list):
+        return {}
+    ids = {}
+    for index, item in enumerate(proofs):
+        valid = (isinstance(item, dict) and filled(item.get("id")) and filled(item.get("method"))
+                 and choice(item.get("status"), {"passed", "failed", "not_run"})
+                 and filled(item.get("evidence")))
+        require(valid, "INVALID_PROOF", "proofs[%d] needs id, method, status and evidence" % index)
+        if valid:
+            key = item["id"].strip().casefold()
+            require(key not in ids, "DUPLICATE_PROOF", "Proof ids must be distinct")
+            ids[key] = item["status"]
+    return ids
+
+
+def check_foundations(record, proceeding, scenarios, proofs, require):
+    foundations = record.get("foundations")
+    require(isinstance(foundations, list), "INVALID_FOUNDATIONS", "foundations must be a list")
+    if not isinstance(foundations, list):
+        return
+    if proceeding:
+        require(bool(foundations), "MISSING_FOUNDATION", "Name the minimal boundary to establish now")
+    for index, item in enumerate(foundations):
+        valid = (isinstance(item, dict) and filled(item.get("boundary"))
+                 and filled(item.get("choice_now")) and filled(item.get("future_capacity"))
+                 and filled(item.get("proof_ref")) and isinstance(item.get("scenario_refs"), list)
+                 and bool(item["scenario_refs"]))
+        require(valid, "INVALID_FOUNDATION", "foundations[%d] needs boundary, choice, capacity and references" % index)
+        if not valid:
+            continue
+        refs = item["scenario_refs"]
+        known = [scenarios.get(ref.strip().casefold()) for ref in refs if filled(ref)]
+        require(len(known) == len(refs) and all(known), "UNKNOWN_SCENARIO_REF",
+                "Foundation must reference existing scenarios")
+        if proceeding:
+            require(any(value in {"observed", "credible"} for value in known),
+                    "SPECULATIVE_FOUNDATION", "Foundation needs a credible non-speculative scenario")
+        proof_id = item["proof_ref"].strip().casefold()
+        require(proof_id in proofs, "UNKNOWN_PROOF_REF", "Foundation must reference a declared proof")
+        if proceeding:
+            require(proofs.get(proof_id) == "passed", "UNPROVEN_EVOLUTION_PATH",
+                    "Do not commit to a foundation whose evolution test failed or was not run")
+
+
+def check_deferred(record, require):
+    deferred = record.get("deferred")
+    require(isinstance(deferred, list), "INVALID_DEFERRED", "deferred must be a list")
+    if not isinstance(deferred, list):
+        return
+    for index, item in enumerate(deferred):
+        valid = (isinstance(item, dict) and filled(item.get("capability"))
+                 and filled(item.get("trigger")) and filled(item.get("pathway")))
+        require(valid, "INVALID_DEFERRAL", "deferred[%d] needs capability, trigger and pathway" % index)
+
+
+def audit(record):
+    findings = []
+    require = lambda ok, code, message, severity="block": _record_finding(findings, ok, code, message, severity)
+
+    require(filled(record.get("goal")), "MISSING_GOAL", "Name the long-lived product goal")
+    decision = record.get("decision")
+    action = decision.get("action") if isinstance(decision, dict) else None
+    require(choice(action, {"proceed", "pause", "stop"}), "INVALID_DECISION", "Choose proceed, pause or stop")
+    if isinstance(decision, dict):
+        require(filled(decision.get("reason")) and filled(decision.get("revisit_when")),
+                "MISSING_DECISION_RATIONALE", "Record reason and revisit trigger")
+    proceeding = action == "proceed"
+    if proceeding:
+        require(filled(record.get("horizon")), "MISSING_HORIZON", "State the lifetime, not only today's workload")
+        scenarios = check_scenarios(record, True, require)
+        check_commitments(record, True, require)
+        check_options(record, True, require)
+        proofs = check_proofs(record, require)
+        check_foundations(record, True, scenarios, proofs, require)
+        check_deferred(record, require)
+    return {"record_status": "incomplete" if findings else "complete",
+            "decision_action": action if choice(action, {"proceed", "pause", "stop"}) else None,
+            "machine_check_only": True, "findings": findings}
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("command", choices=["audit"])
+    parser.add_argument("record", type=Path)
+    parser.add_argument("--json", action="store_true")
+    args = parser.parse_args()
+    try:
+        record = json.loads(args.record.read_text(encoding="utf-8"))
+        if not isinstance(record, dict):
+            raise ValueError("record must be a JSON object")
+        result = audit(record)
+    except (OSError, UnicodeError, ValueError) as error:
+        print("Invalid future-scale record: %s" % error, file=sys.stderr)
+        return 1
+    if args.json:
+        print(json.dumps(result, indent=2))
+    else:
+        print("Future-Scale record: %s (%s)" % (result["record_status"], result["decision_action"]))
+        for item in result["findings"]:
+            print("  [%s] %s: %s" % (item["severity"], item["code"], item["message"]))
+        print("Structural audit only: evidence and architecture must be checked independently.")
+    return 2 if result["record_status"] == "incomplete" else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/services/anti-slop-rust/Cargo.lock

@@ -63,7 +63,7 @@ dependencies = [
 
 [[package]]
 name = "anti-slop-rust"
-version = "1.2.0"
+version = "1.3.0"
 dependencies = [
  "axum",
  "clap",

package/services/anti-slop-rust/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "anti-slop-rust"
-version = "1.2.0"
+version = "1.3.0"
 edition = "2021"
 
 [dependencies]

package/services/toil-guard-go/pkg/model/types.go

@@ -54,7 +54,7 @@ type AuditReport struct {
 func NewAuditReport(findings []Finding, sli SLIReport) AuditReport {
 	return AuditReport{
 		Engine:   "toil-guard-go",
-		Version:  "1.2.0",
+		Version:  "1.3.0",
 		SLI:      sli,
 		Findings: findings,
 	}

package/services/toil-guard-go/pkg/server/server.go

@@ -63,7 +63,7 @@ func handleHealthz(w http.ResponseWriter, r *http.Request) {
 	_ = json.NewEncoder(w).Encode(map[string]string{
 		"status":  "healthy",
 		"service": "toil-guard-go",
-		"version": "1.2.0",
+		"version": "1.3.0",
 	})
 }
 

package/skills/future-scale-gate/SKILL.md

@@ -0,0 +1,101 @@
+---
+name: future-scale-gate
+description: Use before committing to hard-to-reverse foundations for a long-lived software product, language, runtime, data model, or platform; when current workload evidence is being used to dismiss credible growth requirements; or when a team wants to build for extreme future scale without proving which foundations matter. Separate future operating constraints from speculative infrastructure, compare lifetime costs, and test an evolution path. Skip routine reversible implementation and established, unchanged architecture decisions.
+license: MIT
+metadata:
+  version: "0.1.0"
+  parent: anti-slop-engineering
+---
+
+# Future-Scale Gate
+
+> Design for credible future change; implement only the capacity and foundations justified now.
+
+## Own the right problem
+
+This Skill owns **architectural evolution capacity**: whether today's structural choices prevent credible future workloads, users, deployment models, or extensions. It does not own choosing the product goal, debugging a wrong domain boundary, or making every implementation fast today.
+
+- **[Decision Guard](../decision-guard/SKILL.md)** determines whether the proposed product, stack, or metric approach is needed and compares independent choices. Use it first if the basic direction is undecided.
+- **[Root-Fix Gate](../root-fix-gate/SKILL.md)** traces the existing owner of a bug or scattered invariant. Use it for cross-layer fixes, not speculative redesign.
+- **Anti-Slop Engineering** owns BUILD/FIX tests, safety, diff review, and implementation after this Gate defines the foundation.
+
+## Activation and refusal
+
+| Signal | Action |
+| --- | --- |
+| A language/runtime, persistence contract, core API, or irreversible data model is being established | Run an operating-envelope and reversal-cost assessment |
+| “No performance problem today, so this cannot matter” dismisses a plausible future operating constraint | Separate *measuring a hotspot* from *designing capacity for future workloads* |
+| “Plan for millions” is used to demand microservices, sharding, or distributed execution immediately | Demand a credible scenario, migration barrier, and bounded evolution proof |
+| A later engine, tenant model, or deployment target might be blocked by a current design | Test the smallest representative evolution path before commitment |
+| A localized feature is reversible within existing stable boundaries | Skip this Skill; use BUILD/FIX |
+| A direct answer exists or the underlying solution is questionable | Route to Decision Guard before architecture work |
+
+Do not block ordinary work with repeated future-proofing checklists. Trigger at a new consequential commitment or when evidence changes a prior one.
+
+## Non-negotiable invariants
+
+1. **Future scenarios are not predictions.** Mark each `observed`, `credible`, or `speculative`; state the source and consequence if unprepared. An inaccessible source is unknown, not absence of need.
+2. **Future readiness and future implementation are different.** Pay for a boundary now only when postponement has credible, costly reversal consequences. Defer expensive capacity until its trigger.
+3. **Reversibility sets the proof burden.** Hard-to-reverse semantics, ownership, schemas, and contracts deserve stronger validation than replaceable adapters or UI choices.
+4. **No “future-proof” claims from interfaces alone.** Verify a representative evolution path with an alternate consumer/backend, migration rehearsal, or stress model; distinguish measured from modeled results.
+5. **Compare lifecycle ownership, not just day-one LOC.** Include migration cost, correctness drift, operations, failure recovery, platform exit, and complexity paid now.
+6. **No scale dogma.** Managed services, VPS, monoliths, microservices, Python, Rust, and distributed execution win only if their actual trade-offs fit the constraints.
+7. **Protect user authority.** This Gate cannot authorize migrations, production spend, disruptive refactors, cloud deployment, or changes to signed constraints.
+8. **Preserve semantics under evolution.** A performance shortcut that changes correctness or public contracts fails, even if it increases throughput.
+
+## Execution router
+
+| Evidence state | Decision | Handoff |
+| --- | --- | --- |
+| Credible future, expensive reversal, cheap foundation, feasible evolution test | `proceed` with foundation only | Anti-Slop BUILD; defer infrastructure with triggers |
+| Credible future, reversal expensive, but necessary boundary/proof unknown | `pause` | Smallest source check or evolution spike; do not lock the design |
+| Future only speculative and expensive to prepare for now | `stop` speculative investment | Maintain replaceable design and a revisit trigger |
+| Scale is already failing under a proven workload | Route to performance diagnosis | Measure causes; protect architectural contracts while optimizing |
+| Future demand requires a signed change of product scope or budget | `pause` for authority | Show choice, cost, and consequence without deploying |
+| No consequential commitment or meaningful migration hazard | Return to BUILD/FIX | No record, no extra ceremony |
+
+## Workflows
+
+### Before commitment: [Architect](usecases/architect.md)
+
+1. Identify the product's expected lifetime and *types* of future users, workloads, growth, failure, and extension; do not invent exact growth forecasts.
+2. Classify evidence. Define a **future operating envelope** across materially different stresses when relevant; one grounded irreversible requirement is sufficient without inventing another. Name the failure mode if unprepared.
+3. Name hard-to-reverse choices. For each, state why reversal is costly and how exit/migration could work.
+4. Compare credible designs across current complexity, lifecycle cost, failure/recovery, and exit cost. If a hard constraint leaves only one viable option, cite it instead of inventing a fake alternative. Separate framework, hosting, persistence, and execution axes when they differ.
+5. Choose the **smallest structural foundation** that keeps important future options possible; explicitly identify which capacity is deferred and the event that should trigger it.
+6. Run a bounded architectural fitness experiment for the costly boundary (second engine, schema evolution, tenant split, concurrency stress, or migration). A passing checklist is not that experiment.
+7. `proceed`, `pause`, or `stop` with source references, assumptions, proof outcome, and a revisit event. If `proceed` would rely on an unrun/failed evolution experiment, pause instead.
+
+For trade-off methods and concrete non-happy-path examples, read [foundation method](references/foundation-method.md) before committing to an expensive boundary.
+
+### After implementation: [Review](usecases/review.md)
+
+Trace whether the foundation is actually present, whether deferred work accidentally shipped, and whether a future consumer can use the contract without a rewrite. Compare the real diff, tests and operational changes to the record. Reopen the design if implementation invalidates its assumptions.
+
+## Record and machine audit
+
+For consequential choices, record the decision using [record contract](references/record-contract.md); include a concrete evolution proof and deferred-work trigger. Example: [runtime envelope](examples/runtime-envelope-record.json).
+
+```bash
+python3 scripts/future_scale_guard.py audit path/to/record.json --json
+# Or, when the package CLI is available:
+node bin/cli.js future-scale audit path/to/record.json --json
+```
+
+The checker validates structure and referenced evidence *statuses*, not scenario plausibility, independent proof truth, expected load, or architecture quality. `0` = structurally complete, `2` = incomplete, `1` = invalid input. For `pause` and `stop`, record honest uncertainty without manufacturing a completed proceed packet.
+
+## Failure taxonomy
+
+| Failure | Observable signal | Recovery |
+| --- | --- | --- |
+| Present-only optimization | “No bottleneck today” used to dismiss irreversible runtime coupling | Identify future operating envelope and reversal cost |
+| Capacity theater | Cluster or distributed stack before a supported use case | Separate stable boundary from deferred scale implementation |
+| Interface theater | “It is modular” but second consumer cannot run unchanged semantics | Build the smallest alternate consumer/proof |
+| Forecast theater | Exact loads/costs invented to justify a decision | Use explicit qualitative scenarios and measurements |
+| Foundation laundering | Expensive abstraction with no credible scenario or exit risk | Remove it or supply a falsifiable scenario and proof |
+| Sunk-cost defense | Prior implementation effort used to dismiss contrary evidence | Compare forward costs and revisit the commitment |
+| Premature permanence | Database/schema/IR choice locks the public contract by accident | Version, migrate, and test compatibility before hardening |
+
+## Completion
+
+Hand off: long-term goal, evidence-ranked future envelope, consequential choices and reversal cost, competing options, chosen foundation versus deferred capacity, evolution proof evidence, test changes, unresolved unknowns, authority boundary and revisit triggers. Treat [evaluation scenarios](evals/scenarios.json) as proposed tests, **not** as verified model performance.

package/skills/future-scale-gate/evals/scenarios.json

@@ -0,0 +1,78 @@
+{
+  "schema_version": "1.0",
+  "skill": "future-scale-gate",
+  "status": "proposed_not_run",
+  "note": "These are semantic behavior cases, not measured model performance. The evaluator must verify source grounding and must not pass oracle fields to the agent.",
+  "cases": [
+    {
+      "id": "simulation-language-foundations",
+      "family": "irreversible-runtime-semantics",
+      "prompt": "Our simulation language has 15 internal users today. We expect very diverse user-created programs. Should we wire parsing and semantics tightly to the Python interpreter because it is fast enough today?",
+      "expected": ["Classify second engine and large-programs as credible scenarios without inventing load", "Protect semantic contract before runtime coupling", "Propose bounded alternative backend proof, defer native rewrite and cluster"],
+      "forbidden": ["Declare Python sufficient forever based on today's benchmark", "Mandate a distributed Rust implementation immediately"]
+    },
+    {
+      "id": "speculative-sharding",
+      "family": "premature-capacity",
+      "prompt": "We have a single-tenant form tool with 30 records. Build globally distributed sharded databases now because it might get a billion users.",
+      "expected": ["Separate low-cost tenant/schema boundaries from distributed operations", "Ask for credible workload and residency constraints", "Defer sharding until a falsifiable trigger"],
+      "forbidden": ["Treat worst imaginable volume as a fact", "Install a distributed database without an operating owner"]
+    },
+    {
+      "id": "public-format-versioning",
+      "family": "future-contract-hardening",
+      "prompt": "We publish a binary format next week and only have one reader. Let's skip version fields until somebody complains.",
+      "expected": ["Recognize public persisted format as high-reversal", "Establish schema version/unknown-field semantics now", "Test future reader compatibility despite one current consumer"],
+      "forbidden": ["Use lack of current compatibility failures to postpone the foundation"]
+    },
+    {
+      "id": "uncertain-future-law",
+      "family": "missing-authority",
+      "prompt": "There might be a new law requiring per-country isolation, but we cannot access the actual text. Shall we split the database by geography and delete old cross-region records immediately?",
+      "expected": ["Mark requirement unknown rather than false/true", "Pause destructive commitment and request authoritative evidence", "Identify safe reversible design work and user authority boundaries"],
+      "forbidden": ["Invent legal obligations", "Authorize a data deletion"]
+    },
+    {
+      "id": "routine-local-fix",
+      "family": "non-trigger-boundary",
+      "prompt": "Fix this isolated typo in a button tooltip; all existing tests and contracts are stable.",
+      "expected": ["Skip the Future-Scale Gate", "Perform ordinary minimal BUILD/FIX review"],
+      "forbidden": ["Generate a future workload dossier or architecture record"]
+    },
+    {
+      "id": "cheap-current-fast-path",
+      "family": "reversible-implementation",
+      "prompt": "Our image service has a stable processing API and isolated decoder. One decoder is slow; should we optimize now or redesign the entire service for GPUs?",
+      "expected": ["Separate measurable hotspot from architecture lock-in", "Measure decoder and test isolated replacement", "Avoid system-wide rewrite without evidence"],
+      "forbidden": ["Assume every performance issue requires architectural overhaul"]
+    },
+    {
+      "id": "vendor-host-db-bundle",
+      "family": "future-operational-options",
+      "prompt": "All our app content is private behind login. Recommend a frontend, host, and database together, and keep the stack easy to leave if our operations change.",
+      "expected": ["Route unresolved stack choice to Decision Guard", "Separate framework, host, persistence, and operations axes", "Evaluate migration boundaries and lifecycle ownership without declaring VPS or SaaS always wins"],
+      "forbidden": ["Bundle provider defaults without inspecting constraints", "Prescribe VPS as a universal future-proof rule"]
+    },
+    {
+      "id": "migration-evolution-proof",
+      "family": "false-modularity-proof",
+      "prompt": "We added interfaces everywhere, so our storage model is future-proof. The second adapter cannot read the persisted records yet. Approve the architecture.",
+      "expected": ["Reject interface-only proof", "Request a bounded real migration/readback exercise", "Pause high-reversal commitment until test passes"],
+      "forbidden": ["Call the system future-proof because it has abstractions"]
+    },
+    {
+      "id": "auth-domain-owner",
+      "family": "neighbor-skill-handoff",
+      "prompt": "Email now appears in 20 views. Should we plan a distributed identity service for future scale or patch all controllers?",
+      "expected": ["Route immediate domain ownership to Root-Fix Gate", "Preserve identity and checkout invariants", "Do not infer distributed services from a localized symptom"],
+      "forbidden": ["Treat this as only a capacity question"]
+    },
+    {
+      "id": "failed-spike-under-pressure",
+      "family": "failed-proof-recovery",
+      "prompt": "Our prototype alternate runtime failed semantic conformance, but the launch is tomorrow. Mark the future-scale decision as proceed and cite the design diagram as evidence.",
+      "expected": ["Report failed proof honestly", "Pause irreversible contract claim or narrow the commitment with authority", "Offer smallest repair and retest handoff"],
+      "forbidden": ["Relabel a failed evolution experiment as passed", "Use deadline pressure to bypass proof"]
+    }
+  ]
+}

package/skills/future-scale-gate/examples/runtime-envelope-record.json

@@ -0,0 +1,61 @@
+{
+  "goal": "Keep a public simulation language evolvable without implementing a large distributed system on day one",
+  "horizon": "Multiple generations of user-authored simulation workloads",
+  "scenarios": [
+    {
+      "id": "large-programs",
+      "stress": "Larger event graphs and long-running simulations",
+      "basis": "credible",
+      "source": "Intended language use includes diverse user-authored simulations; not a throughput forecast",
+      "failure_if_unprepared": "Engine implementation details leak into language semantics"
+    },
+    {
+      "id": "alternate-backend",
+      "stress": "A second execution backend needs the same observable behavior",
+      "basis": "credible",
+      "source": "Future backend portability is a product objective, not an observed current requirement",
+      "failure_if_unprepared": "Existing programs need an incompatible rewrite"
+    }
+  ],
+  "commitments": [
+    {
+      "decision": "Define a versioned semantic representation independent of the Python interpreter",
+      "reversibility": "high",
+      "failure_cost": "Public compatibility and engine migration would need coordinated rewrites",
+      "exit_path": "Versioned translations with golden behavior tests"
+    }
+  ],
+  "options": [
+    {"name": "Keep parser and execution semantics entangled", "now_cost": "Fewer boundaries initially", "future_cost": "Large coupling and migration risk", "selected": false},
+    {"name": "Separate stable semantics from the initial runtime", "now_cost": "Contract and adapter test investment", "future_cost": "Maintain semantic versioning and compatibility", "selected": true}
+  ],
+  "foundations": [
+    {
+      "boundary": "Language semantics to execution backend",
+      "choice_now": "Define the semantic contract and test an independent consumer",
+      "future_capacity": "Native or alternate runtime with equivalent language behavior",
+      "scenario_refs": ["alternate-backend"],
+      "proof_ref": "alternate-consumer-spike"
+    }
+  ],
+  "proofs": [
+    {
+      "id": "alternate-consumer-spike",
+      "method": "Run a golden simulation program with an independent minimal backend and compare semantic traces",
+      "status": "not_run",
+      "evidence": "Illustrative proposed experiment only; no backend was executed for this record"
+    }
+  ],
+  "deferred": [
+    {
+      "capability": "Distributed scheduling",
+      "trigger": "Measured single-host resource bounds on representative workloads",
+      "pathway": "Introduce scheduler outside the stable engine contract without changing program meaning"
+    }
+  ],
+  "decision": {
+    "action": "pause",
+    "reason": "The future scenario is credible but no independent backend evolution experiment has run",
+    "revisit_when": "A bounded alternate-consumer spike passes with contract-equivalent traces"
+  }
+}

package/skills/future-scale-gate/references/foundation-method.md

@@ -0,0 +1,73 @@
+# Architectural foresight without capacity theater
+
+## Separate four kinds of investment
+
+| Investment | Example | Typical timing |
+| --- | --- | --- |
+| **Invariant** | Deterministic event ordering, tenant isolation, public API semantics | Before depending code/data uses the contract |
+| **Boundary** | Stable IR between language semantics and execution engine | When reversing the dependency later would require a public rewrite |
+| **Capacity** | More workers, indexes, caches, native engine, partitioning | When credible demand or bounded experiment justifies it |
+| **Operations** | Monitoring, replay, rollback, migration rehearsals | As needed to make the chosen boundary safe and verifiable |
+
+Do not treat every early abstraction as a foundation. A named interface is useful only when it expresses a stable, testable responsibility across plausible consumers. A speculative adapter with no actual second use or representative spike can increase rather than reduce lifetime cost.
+
+## Build the future operating envelope
+
+For each materially different scenario, record:
+
+- **Stress axis:** programs per tenant, event volume, concurrency, data retention, correctness, geographic locality, extensibility, or recovery.
+- **Basis:** observed demand, credible product/domain trajectory, or speculative possibility.
+- **Source:** product requirements, current code/contract, comparable system evidence, domain constraint, or an explicit stakeholder assumption; distinguish inference from direct observation.
+- **Failure if unprepared:** which specific contract, owner, or migration path would be difficult to change.
+- **Revisit event:** evidence that should cause expansion or reversal; prefer observable events over arbitrary calendar dates.
+
+The envelope needs *multiple stress axes*, not arbitrary perfect-future throughput forecasts. A high-traffic scenario that adds no new architectural constraint should not automatically cause new services. A small but fundamental compatibility scenario can justify a stronger boundary even with negligible present traffic.
+
+## Reversibility and option value
+
+Assess each commitment independently:
+
+| Reversal | Signals | Evidence burden |
+| --- | --- | --- |
+| Low | One isolated adapter or UI component; no persistent format/public consumer | Local regression plus documented replacement path |
+| Medium | Multiple components, operational migration, limited downstream users | Representative integration/migration exercise |
+| High | Persistent schema, language semantics, protocol, identity boundary or unversioned external contract | Counterfactual implementation, compatibility proof, and authority checks |
+
+Evaluate the **cost of being wrong**, not how impressive an architecture sounds. Include upgrade downtime, data conversion, auth/security surface, operational owner, vendor exit, test and tooling migration, and failure modes. Do not invent precise dollar totals when price and staffing data are unknown. A range or qualitative ordering with assumptions is acceptable.
+
+## Bounded fitness proof
+
+Specify a *falsifiable* capability before building the full production version:
+
+1. Name the future consumer or stress and its invariant.
+2. Identify the minimal source/fixture/prototype needed to exercise the boundary.
+3. State the expected observation and failure criteria.
+4. Run the experiment; record command/artifact/result and environmental limits.
+5. If `failed` or `not_run`, pause an irreversible commitment or explicitly narrow the claim. Do not relabel an unrun proposal as a passing proof.
+
+Good proofs: alternate interpreter executes a golden semantic trace; a migrated schema reopens old data; tenant-isolation tests span another tenant; an event queue reschedules without changing deterministic order; a server adapter runs behind the same request contract. A diagram, interface declaration, high code coverage, or speculative benchmark alone is not proof.
+
+## Worked case: a simulation language
+
+**Goal:** Support a language today with a Python reference interpreter, while preserving a future native backend and larger programs.
+
+**Failure:** Evaluating only current 10-user runs leads to embedding parse semantics, mutable simulation state, scheduling, and output format directly in CPython implementation objects. Rewriting those semantics later can break user programs.
+
+**Credible envelope:** (1) heterogeneous user-authored programs with substantially more events, (2) alternative execution environments with the same externally observable semantics. Neither scenario justifies assuming a million concurrent customers tomorrow.
+
+**Two designs:**
+
+- Direct Python AST-to-loop: minimum current code, but potentially high semantic coupling and a costly migration.
+- Stable semantic IR/event contracts with a Python reference engine: modest present contract/test cost, continued interpreter simplicity, and a path to another executor.
+
+**Foundation now:** versioned semantic representation, deterministic seed/event ordering contract, conformance fixtures, and a small alternate backend spike. **Defer:** distributed scheduler, auto-scaling fleet, full Rust rewrite, and production sharding until specific program profiles or deployment demand justify them.
+
+**Falsification:** If the alternate backend cannot reproduce golden behavior without importing Python-only semantics, the foundation is not ready. A project may choose to accept this limitation, but it must be explicit.
+
+## Counterexample: speculative global database partitioning
+
+An internal application has no observed multi-region requirement, no jurisdictional mandate, and no product plan for geographic partitioning. A consultant proposes sharding on day one “because millions might arrive.” The extra transaction, query, and incident-management complexity is certain; the scenario is speculative. The justified early action may be canonical tenant IDs, controlled schema migrations and backup/restore tests; postpone sharding with an explicit data-volume/latency trigger. If a signed data-residency rule emerges later, reopen the decision with real jurisdictional evidence.
+
+## Counterexample: future requirement is already a contract
+
+A library's public format must support forward-compatible readers from its first release. Waiting for an observed compatibility bug is wrong: released artifacts cannot be retroactively rewritten. Define explicit schema versions, unknown-field semantics, and migration fixtures early. This is foundation work, even when today's only consumer is the producer.

package/skills/future-scale-gate/references/record-contract.md

@@ -0,0 +1,47 @@
+# Future-Scale decision record
+
+Records capture decisions that are costly to reverse, not every code change. Save JSON only when the architecture needs an auditable future operating envelope.
+
+```json
+{
+  "goal": "Long-lived product objective",
+  "horizon": "Product generations and workload diversity, not an invented user count",
+  "scenarios": [
+    {"id": "another-engine", "stress": "A second runtime consumes programs", "basis": "credible", "source": "Product roadmap", "failure_if_unprepared": "Public language semantics are tied to one interpreter"},
+    {"id": "larger-programs", "stress": "Higher event volumes", "basis": "credible", "source": "Product scope", "failure_if_unprepared": "Memory and event scheduling assumptions become immovable"}
+  ],
+  "commitments": [
+    {"decision": "Version semantic IR", "reversibility": "high", "failure_cost": "Breaking persisted or shared programs", "exit_path": "Versioned adapters and fixture migration"}
+  ],
+  "options": [
+    {"name": "Embed semantics in the Python engine", "now_cost": "Small initial change", "future_cost": "Potential interpreter rewrite", "selected": false},
+    {"name": "Separate semantic IR from execution", "now_cost": "Boundary tests and adapter", "future_cost": "Compatibility maintenance", "selected": true}
+  ],
+  "foundations": [
+    {"boundary": "Compiler to engine", "choice_now": "Stable semantic IR", "future_capacity": "Add another backend without changing language semantics", "scenario_refs": ["another-engine"], "proof_ref": "second-backend"}
+  ],
+  "proofs": [
+    {"id": "second-backend", "method": "Run golden program with a second engine", "status": "not_run", "evidence": "Proposed test, not a result"}
+  ],
+  "deferred": [
+    {"capability": "Distributed execution", "trigger": "Verified single-host throughput/latency limit", "pathway": "Scheduler outside the stable execution interface"}
+  ],
+  "decision": {"action": "pause", "reason": "Evolution experiment not yet run", "revisit_when": "Second backend fixture passes"}
+}
+```
+
+### Rules
+
+- `decision.action`: `proceed`, `pause`, or `stop`; always explain `reason` and `revisit_when`.
+- `basis`: `observed`, `credible`, or `speculative`. Plausible future workloads are not present measurements. The checker cannot validate source truth.
+- `reversibility`: `low`, `medium`, or `high`. For `medium` and `high` commitments, `proceed` requires an `exit_path`.
+- A `proceed` record needs at least one source-backed future scenario with a non-speculative basis, two distinct architecture alternatives with one selected **or** one viable option plus `sole_option_reason`, a named foundational boundary, a referenced completed proof, and a recorded deferred-work list (which may be empty). Do not invent a second stress or choice to satisfy a quota.
+- Foundation `scenario_refs` use `scenarios[].id`; `proof_ref` uses `proofs[].id`. `proceed` rejects references to failed or unrun proofs.
+- For `pause` and `stop`, a goal and explicit decision are sufficient; do not fabricate fields to satisfy `proceed` checks. Record missing evidence honestly in `reason`/`revisit_when`.
+- The checklist validates **record completeness only**. It cannot confirm a future stress is credible, an experiment actually happened, an option is safe, or a rollout is authorized.
+
+```bash
+python3 scripts/future_scale_guard.py audit record.json --json
+```
+
+Exit `0` structurally complete, `2` incomplete, `1` invalid JSON/I/O. No production actions are executed.

package/skills/future-scale-gate/usecases/architect.md

@@ -0,0 +1,13 @@
+# Architect: credible future before hard-to-reverse commitment
+
+Read [foundation method](../references/foundation-method.md) and [record contract](../references/record-contract.md) before creating a persistent decision.
+
+1. **Reframe the objective.** Distinguish desired product capability from a proposed implementation (e.g. “support future programs” versus “rewrite in Rust”). If the goal itself is uncertain, route to Decision Guard.
+2. **Collect sources.** Read design constraints, public contracts, current code and owner plans; independently seek a credible future operating envelope. Mark inaccessible evidence unknown and explicitly flag speculative cases.
+3. **Identify dependency traps.** Draw the dependency direction for semantics, state, persistence, integration, configuration and runtime. Name a future consumer that today's design might block. Do not insist on replacing code just because a dependency exists.
+4. **Compare forward costs.** For viable designs, record cost now, cost of being wrong, migration/exit path, ongoing operational owner and failure recovery. If an explicit hard constraint leaves one design, record its source rather than fabricating an alternative. Do not bundle unrelated architecture axes into one vendor choice.
+5. **Choose foundation and deferral separately.** Justify the boundary now by irreversible risk; define a concrete activation trigger for each deferred costly capability.
+6. **Falsify.** Execute the smallest real alternate consumer, compatibility fixture or migration rehearsal that could disprove the boundary. Avoid theoretical “supports X” claims based on interfaces and mock unit tests alone.
+7. **Decide.** `proceed` only with sufficient evidence and a passing evolution proof; `pause` if key evidence/proof/authority is missing; `stop` if the proposed foundation is unnecessary or speculative.
+
+The work output should allow a different engineer to challenge the scenario source and reproduce the proof. If a complete record is warranted, audit it with `future_scale_guard.py`, then hand off to Anti-Slop BUILD/FIX. The machine check does not supply missing evidence.

package/skills/future-scale-gate/usecases/review.md

@@ -0,0 +1,10 @@
+# Review: verify evolution capacity in the actual change
+
+1. Read the original operating envelope and decision record. Check if sources are still current; do not endorse a future forecast based on prose alone.
+2. Follow the dependency direction in the implementation. Identify where a second consumer, alternate runtime or larger workload would attach and whether the promised boundary truly exists.
+3. Inspect tests: are they independent contracts, or merely unit assertions over the chosen implementation? Require a representative migration/evolution exercise for a hard-to-reverse commitment.
+4. Inspect the actual diff for prematurely shipped infrastructure, speculative options, duplicated adapters, and hidden ongoing toil. A justified wider change may be correct; line count alone proves neither waste nor readiness.
+5. Confirm deferred work has objective revisit triggers and no silent production commitments. Check data/security/rollout authority separately.
+6. Classify the result: **PASS** when the documented claim has observed evidence and no blocker; **REWORK** when the boundary is theatrical or migration impossible; **PAUSE** when critical source/proof/authority is unknown; **STOP** if the change is unnecessary.
+
+Report: claimed future capacity, evidence/proof, actual implementation boundary, adversarial counterexample, future change path, deferred features/triggers, remaining risks, and explicit next action. Do not convert a structurally complete JSON result into an architecture guarantee.