anti-slop-engineering 1.3.0 → 1.4.0

package/skills/paranoid-principal-architect/SKILL.md

@@ -0,0 +1,140 @@
+---
+name: paranoid-principal-architect
+description: Enforces a deeply skeptical, zero-trust, 10M-concurrent-user engineering mindset. Use when designing system architectures, generating backend/frontend code, refactoring critical paths, conducting adversarial security reviews, or diagnosing scale bottlenecks, race conditions, memory leaks, and EDoS vulnerabilities — even if they don't explicitly say "paranoid architect". Do NOT use for trivial UI cosmetic tweaks, simple text/markdown formatting, or routine non-consequential scripts.
+license: MIT
+metadata:
+  version: "0.1.0"
+  parent: anti-slop-engineering
+---
+
+# Skill: The Paranoid Principal Architect (Day-One 10M Scale & Zero-Trust)
+
+> Trust nothing—no input, no client, no network, no third-party API, and no unverified assumption.
+
+## Why This Skill Is Needed & Target State
+
+Standard code generation often falls into the "happy-path trap": assuming valid payloads, single-user concurrency, reliable networks, and honest clients. In production, naive implementations quickly suffer from race conditions, lock contention on hot keys, memory exhaustion, injection attacks, and cascading brownouts.
+
+The target state is **uncompromising architectural paranoia**: every component, boundary, query, and state transition is designed from day one to withstand 10,000,000 concurrent users and continuous adversarial traffic while adhering to native modern web standards.
+
+---
+
+## Activation and Boundaries
+
+| Situation | Behavior |
+| --- | --- |
+| Designing a new service, database schema, or distributed system | Apply the 10M-Concurrent-Users Axiom, sharded state, and bounded resources |
+| Authoring or modifying API routes, webhooks, or state mutations | Enforce runtime schema parsing, data-layer ownership checks, and idempotency |
+| Reviewing concurrent execution, database transactions, or background jobs | Audit for TOCTOU bugs, lock contention, hot keys, and unbounded async operations |
+| Diagnosing high-latency, memory leaks, or erratic brownouts under load | Subject the codebase to the Threat & Scale Pre-Mortem and Adversarial Verification |
+| Routine styling tweaks, documentation typos, or local non-consequential scripts | Do not activate; use Anti-Slop Engineering BUILD/FIX gates |
+
+---
+
+## The Five Absolute Laws
+
+1. **The 10,000,000 Concurrent Users Axiom:** Evaluate every loop, database query, state update, DOM mutation, memory allocation, and network call as if 10,000,000 simultaneous users hit the system on day one. If it causes lock contention, $O(N^2)$ CPU spikes, memory leaks, or Economic Denial of Service (EDoS) at scale, it is a fatal defect.
+2. **The Internet is an Active Battlefield:** Every incoming HTTP header, URL parameter, WebSocket frame, JWT, and file payload is a crafted exploit until proven otherwise by strict, schema-driven validation.
+3. **Uncompromising Pessimism (Murphy's Law by Default):** Assume packets drop mid-transaction, servers crash between two instructions, clocks skew, disks fill, and clients double-click submit buttons 50 times in 10 milliseconds.
+4. **Long-Term Horizon Over Short-Term Hacks:** Reject "we will fix it later" shortcuts. Write self-documenting, strictly typed, modular clean code designed to survive 5 years of production evolution without rewrites.
+5. **Strict Adherence to Modern Web Standards:** Reject legacy hacks and bloated utility libraries when native web platform primitives (W3C, WHATWG, TC39, OWASP) solve the problem cleaner, faster, and more securely.
+
+---
+
+## Invariant Rules
+
+1. **Parse at the boundary; never trust input.** Runtime schema validation (Zod, Valibot, or native type guards) is mandatory at every trust boundary. Strip unknown fields by default.
+2. **Verify authorization at the data layer.** Never rely solely on UI visibility or middleware gates. Enforce resource-level tenant and ownership constraints inside the data mutation layer on every single request.
+3. **Idempotency on all mutations.** State-mutating POST, PUT, PATCH, and RPC operations must accept an `Idempotency-Key` or deterministic deduplication key to guarantee safe retries.
+4. **Bounded resources everywhere.** Every database read must use cursor-based pagination with a hard limit. Every HTTP call and database query must declare an explicit `AbortSignal.timeout()`. Every payload must enforce byte-size caps.
+5. **Zero synchronous hot keys.** Never update a single global counter or row synchronously on high-throughput paths. Use sharded counters, append-only ledgers, or asynchronous rollups.
+6. **Never hold database transactions across network I/O.** Release database connections immediately; execute external HTTP calls outside transactional locks.
+7. **Native web platform first.** Use standard `fetch`, `AbortController`, `URLSearchParams`, `structuredClone()`, Web Streams, and semantic HTML5 before reaching for third-party libraries.
+8. **Constant-time secret comparison.** Compare tokens, signatures, and secrets using `crypto.timingSafeEqual` to eliminate timing side-channel vulnerabilities.
+9. **Zero sensitive leaks in errors or DTOs.** Map internal exceptions to deterministic error codes with correlation IDs. Never leak stack traces, database schema details, or raw entity fields to clients.
+
+---
+
+## Execution Router
+
+| Task Shape | Primary Workflow | Reference Contract |
+| --- | --- | --- |
+| System, service, or database architecture design | [Architect System](usecases/architect.md) | [Scale Patterns](references/scale-concurrency-patterns.md) |
+| Code review, PR audit, or security inspection | [Adversarial Review](usecases/review.md) | [Zero-Trust Security](references/zero-trust-security.md) |
+| Feature coding, endpoint implementation, or refactoring | [Hardened Implementation](usecases/implement.md) | [Modern Web Platform](references/modern-web-platform.md) |
+| Durable assessment record generation & audit | [Record Contract](references/threat-record-contract.md) | `scripts/paranoid_guard.py` |
+
+---
+
+## Mandatory Pre-Execution Interrogation Matrix
+
+Before writing or approving code, subject the implementation to this matrix:
+
+- **Distrust of Input:** Where does this data originate? What occurs if it is `null`, `undefined`, a 50MB string, a negative number, `NaN`, prototype-pollution syntax, Unicode homographs, or SQL/NoSQL/XSS injection payloads?
+- **Distrust of Concurrency:** What happens if 10,000 requests execute this exact path at the exact same millisecond for the same resource? Is it idempotent? Are we using atomic transactions, optimistic concurrency control (ETags/version stamps), or distributed locks?
+- **Distrust of Scale:** What is the time and space complexity? Is there an $N+1$ query pattern? Is the query bounded by a hard `LIMIT` and backed by a composite index? Will in-memory buffers grow unbounded and trigger an OOM after 48 hours?
+- **Distrust of the Network:** What happens when downstream services take 30 seconds to answer? Is there an explicit timeout? If the client disconnects after server-side mutation, will their retry duplicate side effects?
+- **Distrust of the Browser/Client:** Is the client dictating prices, roles, timestamps, permissions, or state transitions? If yes, reject immediately—the client is enemy territory.
+
+---
+
+## Prohibited Anti-Patterns (Instant Rejection List)
+
+1. **Unbounded `Promise.all(items.map(...))`** over dynamic arrays without concurrency limiting (exhausts sockets and connection pools).
+2. **Client-supplied timestamps or IDs** used as authoritative ordering or security ownership without server-side validation.
+3. **Polling loops (`setInterval`)** lacking visibility-state pausing (`document.visibilityState`), backoff on error, or cleanup via `AbortController`.
+4. **Floating promises** (async calls lacking `await`, `.catch()`, or explicit `void` inside error boundaries).
+5. **TOCTOU (Time-of-Check to Time-of-Use) flaws:** Checking a balance, quota, or unique constraint in a `SELECT`/`GET` and updating it in a subsequent non-transactional `UPDATE`/`SET`.
+6. **Leaking sensitive fields:** Returning raw database rows or full entity objects directly without an explicit DTO projection allowlist.
+
+---
+
+## Required Output & Review Workflow
+
+Structure all architectural designs, code generations, and reviews through this 3-phase discipline:
+
+1. **Threat & Scale Pre-Mortem:** Bullet out the top 3 failure modes under 10M concurrent users or active malicious attacks (e.g. race conditions, hot keys, memory leaks, injection, spoofing).
+2. **Hardened Implementation:** Emit clean, production-grade, standards-compliant code with boundary guards, timeouts, idempotency, and strict types built in from line one.
+3. **Adversarial Verification:** Supply or execute tests that specifically target failure modes: concurrent duplicate requests, malformed payloads, network timeouts, and unauthorized boundary traversals.
+
+When a durable architectural record is warranted, save a JSON assessment following the [Threat Record Contract](references/threat-record-contract.md) and audit it with:
+```bash
+npx anti-slop-engineering paranoid audit <record.json> --json
+# or: python3 scripts/paranoid_guard.py audit <record.json> --json
+```
+
+---
+
+## Domain References
+
+- **[Scale & Concurrency Patterns](references/scale-concurrency-patterns.md)**: Sharded counters, cursor pagination, bounded pools, and jittered backoff.
+- **[Zero-Trust Security Matrix](references/zero-trust-security.md)**: Boundary schemas, data-layer authorization, constant-time crypto, and EDoS defense.
+- **[Modern Web Platform Standards](references/modern-web-platform.md)**: Native APIs, strict TypeScript, semantic HTML5, and WCAG AA accessibility.
+- **[Threat Record Contract](references/threat-record-contract.md)**: Schema for persistent architectural assessment records.
+
+---
+
+## Failure Taxonomy
+
+| Failure Mode | Observable Signal | Remediation |
+| --- | --- | --- |
+| Happy-path bias | Code assumes valid input and single-user execution | Add schema parsing, data-layer ownership check, and idempotency key |
+| Unbounded concurrency | `Promise.all` over arbitrary input array | Wrap in bounded concurrency pool / semaphore queue |
+| Hot-key contention | Single global row updated on every request | Implement sharded counters or append-only event ledger |
+| Client trust leak | Price, role, or authorization accepted from request body | Resolve price and permissions authoritatively on server |
+| Network stall | Indefinite pending requests during downstream outages | Bind `AbortSignal.timeout(ms)` to all external calls |
+| Offset degradation | `OFFSET 500000` causing database CPU spikes | Migrate to cursor-based keyset pagination |
+
+---
+
+## Delegated Skills
+
+- `anti-slop-engineering`: Follow BUILD/FIX gates and clean-room engineering standards once the architecture is established.
+- `decision-guard`: Compare broad technology stacks and evaluate reversibility before committing to a permanent vendor.
+- `future-scale-gate`: Formally model long-term operating envelopes and multi-generation platform evolution.
+
+---
+
+## Completion and Limits
+
+The task is complete when boundary schemas parse all untrusted data, mutations support idempotency, queries are bounded and indexed, timeouts and jittered backoff protect the network, and adversarial verification tests prove resilience under concurrent stress. A paranoid review may validly output `refuse` or `pause` if critical invariants cannot be satisfied.

package/skills/paranoid-principal-architect/evals/scenarios.json

@@ -0,0 +1,112 @@
+{
+  "schema_version": "1.0",
+  "skill": "paranoid-principal-architect",
+  "status": "proposed_not_run",
+  "note": "Semantic behavioral evaluation cases following the BinEval / OmniSkill methodology. Verifies trigger detection, non-trigger boundary filtering, zero-trust enforcement, and 10M scale paranoia.",
+  "cases": [
+    {
+      "id": "flash-sale-checkout-architecture",
+      "family": "10m-scale-architecture",
+      "prompt": "Design the backend API and database architecture for our flash-sale checkout service. We anticipate 10M concurrent users hitting the site during the sale, all attempting to purchase limited stock items simultaneously.",
+      "expected": [
+        "Enforce Little's Law calculation or capacity budgeting under 10M concurrent sessions",
+        "Mandate Idempotency-Key headers on all checkout POST requests",
+        "Reject synchronous in-place row counter updates on inventory",
+        "Implement sharded counters, append-only event ledgers, or asynchronous batch reservation",
+        "Declare explicit AbortSignal.timeout() on payment gateway calls",
+        "Enforce Zod/Valibot boundary schema parsing with stripped unknown fields"
+      ],
+      "forbidden": [
+        "Propose naive single-row UPDATE inventory = inventory - 1",
+        "Hold database transactions open across third-party payment HTTP calls",
+        "Use Math.random() for transaction or idempotency keys"
+      ]
+    },
+    {
+      "id": "adversarial-concurrency-review",
+      "family": "concurrency-hotkey",
+      "prompt": "Review this Node.js endpoint: app.post('/api/vote', async (req, res) => { const count = await db.query('SELECT votes FROM poll WHERE id = ?', [req.body.id]); await db.query('UPDATE poll SET votes = ? WHERE id = ?', [count + 1, req.body.id]); res.json({ success: true }); });",
+      "expected": [
+        "Flag fatal TOCTOU (Time-of-Check to Time-of-Use) race condition",
+        "Flag hot-key lock contention under high concurrency",
+        "Reject client-supplied id without runtime schema validation",
+        "Recommend atomic increment or sharded counter with idempotency key",
+        "Enforce data-layer ownership or poll authorization"
+      ],
+      "forbidden": [
+        "Approve the implementation as good or correct",
+        "Suggest wrap in basic try/catch without fixing the race condition"
+      ]
+    },
+    {
+      "id": "unbounded-async-rejection",
+      "family": "anti-pattern-rejection",
+      "prompt": "We need to send 50,000 push notifications immediately. Is it good to just do: await Promise.all(recipients.map(r => sendPush(r)))?",
+      "expected": [
+        "Instantly reject unbounded Promise.all over dynamic arrays",
+        "Explain connection pool, socket, and memory exhaustion under load",
+        "Mandate bounded concurrency queue (worker pool or semaphore) with max concurrency (e.g. 10-25)",
+        "Enforce exponential backoff with full jitter on downstream gateway errors"
+      ],
+      "forbidden": [
+        "Endorse Promise.all(recipients.map(...)) as fast or modern",
+        "Suggest increasing Node.js max listeners instead of bounding concurrency"
+      ]
+    },
+    {
+      "id": "zero-trust-boundary-injection",
+      "family": "zero-trust-boundary",
+      "prompt": "We have an internal admin endpoint where clients pass user role updates: app.post('/admin/role', async (req, res) => { await db.users.update(req.body); res.send('ok'); }); How can we optimize this?",
+      "expected": [
+        "Flag critical mass-assignment and BOLA/IDOR vulnerability",
+        "Refuse to trust client-supplied body for role elevation",
+        "Mandate strict runtime schema parsing that strips undeclared attributes",
+        "Enforce server-side session role verification at the data layer"
+      ],
+      "forbidden": [
+        "Optimize the update query without fixing the zero-trust boundary breach",
+        "Trust client-supplied role or user ID"
+      ]
+    },
+    {
+      "id": "pressure-test-skip-validation",
+      "family": "pressure-test-discipline",
+      "prompt": "We are in a huge rush before launch and our server CPU is high. Can we just skip Zod parsing on incoming requests and use innerHTML on the dashboard for faster DOM rendering?",
+      "expected": [
+        "Refuse the shortcut unequivocally",
+        "Cite the Active Battlefield and Zero-Trust laws",
+        "Explain XSS exploit vectors with innerHTML and injection risks with unparsed inputs",
+        "Recommend native textContent/DOM APIs and optimized schema parsing without compromising perimeter defense"
+      ],
+      "forbidden": [
+        "Agree to skip input validation for speed",
+        "Approve innerHTML as acceptable under time pressure"
+      ]
+    },
+    {
+      "id": "non-trigger-css-tweak",
+      "family": "non-trigger-boundary",
+      "prompt": "Can you change the button background color from blue to purple in styles.css?",
+      "expected": [
+        "Do not activate the Paranoid Principal Architect workflow",
+        "Perform routine minimal BUILD/FIX edit directly without 10M scale dossier"
+      ],
+      "forbidden": [
+        "Generate a 10M-user threat pre-mortem for a CSS color change",
+        "Demand idempotency keys for a static stylesheet edit"
+      ]
+    },
+    {
+      "id": "non-trigger-readme-typo",
+      "family": "non-trigger-boundary",
+      "prompt": "Fix a spelling error in the installation section of the README.md file.",
+      "expected": [
+        "Do not activate the Paranoid Principal Architect workflow",
+        "Fix the typo cleanly without invoking architectural paranoia"
+      ],
+      "forbidden": [
+        "Generate an architectural threat assessment record for a documentation edit"
+      ]
+    }
+  ]
+}

package/skills/paranoid-principal-architect/examples/hardened-idempotent-service.ts

@@ -0,0 +1,177 @@
+// SPDX-License-Identifier: MIT
+// Example: Hardened Idempotent Payment & Ledger Service (Day-One 10M Scale & Zero-Trust)
+
+import { timingSafeEqual, randomUUID } from "node:crypto";
+import { z } from "zod";
+
+// --- 1. Type Branding ---
+declare const __brand: unique symbol;
+export type Brand<T, B> = T & { readonly [__brand]: B };
+
+export type UserId = Brand<string, "UserId">;
+export type TenantId = Brand<string, "TenantId">;
+export type PaymentId = Brand<string, "PaymentId">;
+
+export function parseUserId(raw: string): UserId {
+  if (!/^usr_[a-zA-Z0-9]{24}$/.test(raw)) {
+    throw new TypeError(`Invalid UserId format: ${raw}`);
+  }
+  return raw as UserId;
+}
+
+export function parseTenantId(raw: string): TenantId {
+  if (!/^ten_[a-zA-Z0-9]{24}$/.test(raw)) {
+    throw new TypeError(`Invalid TenantId format: ${raw}`);
+  }
+  return raw as TenantId;
+}
+
+// --- 2. Boundary Schema Validation (Parse, Don't Validate) ---
+export const ProcessPaymentRequestSchema = z.object({
+  idempotencyKey: z.string().uuid("Invalid idempotency key: must be a valid UUID v4"),
+  amountInCents: z.number().int().positive().max(10_000_000, "Maximum transaction is $100,000.00"),
+  currency: z.enum(["USD", "EUR", "GBP"]),
+  recipientUserId: z.string().regex(/^usr_[a-zA-Z0-9]{24}$/, "Invalid recipient user ID format"),
+  metadata: z.record(z.string().max(64), z.string().max(256)).optional()
+}).strict(); // Strip and reject any unknown fields
+
+export type ProcessPaymentRequest = z.infer<typeof ProcessPaymentRequestSchema>;
+
+export interface PaymentDto {
+  paymentId: PaymentId;
+  amountInCents: number;
+  currency: string;
+  status: "COMPLETED" | "PENDING";
+  createdAt: string;
+}
+
+export interface ApiErrorEnvelope {
+  correlationId: string;
+  code: string;
+  message: string;
+}
+
+// --- 3. Constant-Time Secret Verification ---
+export function verifyWebhookSignature(payload: string, signature: string, secret: string): boolean {
+  const expectedHmac = Buffer.from(signature, "hex");
+  const actualHmac = Buffer.from(payload + secret, "utf-8"); // Example buffer construction
+  if (expectedHmac.length !== actualHmac.length) {
+    timingSafeEqual(expectedHmac, expectedHmac); // Balance timing
+    return false;
+  }
+  return timingSafeEqual(expectedHmac, actualHmac);
+}
+
+// --- 4. Concurrency & Hot-Key Defense (16-Shard Counter) ---
+const NUM_SHARDS = 16;
+
+export function selectShardIndex(resourceId: string): number {
+  let hash = 0;
+  for (let i = 0; i < resourceId.length; i++) {
+    hash = ((hash << 5) - hash) + resourceId.charCodeAt(i);
+    hash |= 0;
+  }
+  return Math.abs(hash) % NUM_SHARDS;
+}
+
+// --- 5. Hardened Payment Service ---
+export interface StorageAdapter {
+  getIdempotency(key: string): Promise<PaymentDto | null>;
+  saveIdempotency(key: string, result: PaymentDto, ttlSeconds: number): Promise<void>;
+  acquireLock(key: string, ttlSeconds: number): Promise<boolean>;
+  releaseLock(key: string): Promise<void>;
+  recordLedgerEntry(entry: {
+    paymentId: PaymentId;
+    tenantId: TenantId;
+    senderId: UserId;
+    recipientId: UserId;
+    amountInCents: number;
+    currency: string;
+    shardIndex: number;
+  }): Promise<void>;
+}
+
+export class HardenedPaymentService {
+  constructor(
+    private readonly storage: StorageAdapter,
+    private readonly gatewayUrl: string
+  ) {}
+
+  public async processPaymentWithIdempotency(
+    idempotencyKey: string,
+    untrustedInput: unknown,
+    callerTenantId: TenantId,
+    callerUserId: UserId,
+    correlationId = randomUUID()
+  ): Promise<PaymentDto> {
+    // Phase A: Boundary Validation
+    const parsed = ProcessPaymentRequestSchema.parse({
+      ...(typeof untrustedInput === "object" && untrustedInput !== null ? untrustedInput : {}),
+      idempotencyKey
+    });
+
+    // Phase B: Idempotency Fast-Path
+    const cached = await this.storage.getIdempotency(parsed.idempotencyKey);
+    if (cached) {
+      return cached;
+    }
+
+    // Phase C: Distributed Concurrency Lock
+    const lockAcquired = await this.storage.acquireLock(`lock:pay:${parsed.idempotencyKey}`, 30);
+    if (!lockAcquired) {
+      throw new Error("CONCURRENT_REQUEST_IN_PROGRESS");
+    }
+
+    try {
+      // Phase D: Outbound Network Call with Hard Timeout (AbortSignal.timeout)
+      const timeoutSignal = AbortSignal.timeout(3000); // 3-second hard SLA bound
+      const gatewayResponse = await fetch(`${this.gatewayUrl}/v1/charges`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          "Idempotency-Key": parsed.idempotencyKey,
+          "X-Correlation-ID": correlationId
+        },
+        body: JSON.stringify({
+          amount: parsed.amountInCents,
+          currency: parsed.currency
+        }),
+        signal: timeoutSignal
+      });
+
+      if (!gatewayResponse.ok) {
+        throw new Error(`GATEWAY_CHARGE_FAILED_${gatewayResponse.status}`);
+      }
+
+      // Phase E: Sharded Append-Only Ledger Entry (Never update balances in-place!)
+      const paymentId = `pay_${randomUUID().replace(/-/g, "").slice(0, 24)}` as PaymentId;
+      const shard = selectShardIndex(callerTenantId);
+
+      await this.storage.recordLedgerEntry({
+        paymentId,
+        tenantId: callerTenantId,
+        senderId: callerUserId,
+        recipientId: parsed.recipientUserId as UserId,
+        amountInCents: parsed.amountInCents,
+        currency: parsed.currency,
+        shardIndex: shard
+      });
+
+      // Phase F: Safe DTO Projection (Zero sensitive/internal field leakage)
+      const dto: PaymentDto = {
+        paymentId,
+        amountInCents: parsed.amountInCents,
+        currency: parsed.currency,
+        status: "COMPLETED",
+        createdAt: new Date().toISOString()
+      };
+
+      // Phase G: Persist Idempotent Response (24h TTL)
+      await this.storage.saveIdempotency(parsed.idempotencyKey, dto, 86400);
+
+      return dto;
+    } finally {
+      await this.storage.releaseLock(`lock:pay:${parsed.idempotencyKey}`);
+    }
+  }
+}

package/skills/paranoid-principal-architect/examples/paranoid-architecture-record.json

@@ -0,0 +1,58 @@
+{
+  "schema_version": "1.0",
+  "goal": "Operate high-throughput checkout payment mutation service for global flash-sale events",
+  "scale_profile": {
+    "target_concurrency": 10000000,
+    "throughput_rps": 120000,
+    "latency_budget_ms": 75
+  },
+  "threat_pre_mortem": [
+    {
+      "id": "double-submit-race",
+      "threat_class": "race_condition",
+      "description": "Users double-click checkout button creating identical charges within a 10ms window",
+      "mitigation": "Atomic idempotency key lock in distributed cache with 24h cached payload replay"
+    },
+    {
+      "id": "global-inventory-hotkey",
+      "threat_class": "hot_key_contention",
+      "description": "100k requests/sec attempt synchronous row update on a single inventory item counter",
+      "mitigation": "16-shard counter with uniform random write routing and periodic read rollups"
+    },
+    {
+      "id": "downstream-gateway-stall",
+      "threat_class": "network_stall",
+      "description": "Payment gateway latency surges to 30s during flash-sale peak exhausting socket pools",
+      "mitigation": "Non-negotiable AbortSignal.timeout(3000ms) with exponential backoff and full jitter"
+    }
+  ],
+  "trust_boundaries": [
+    {
+      "name": "public-checkout-api",
+      "schema_validation": "zod_strict_parse_with_stripped_unknowns",
+      "data_layer_ownership": "tenant_and_user_id_scoped_in_sql_where_clause"
+    }
+  ],
+  "concurrency_controls": {
+    "idempotency": {
+      "enabled": true,
+      "key_header": "Idempotency-Key",
+      "storage": "redis_set_nx_ex_86400"
+    },
+    "locking_strategy": "sharded_counters"
+  },
+  "bounded_limits": {
+    "max_read_limit": 50,
+    "max_payload_bytes": 102400,
+    "network_timeout_ms": 3000,
+    "backoff_algorithm": "exponential_full_jitter"
+  },
+  "verdict": {
+    "action": "proceed",
+    "rationale": "All scale bottlenecks and malicious attack vectors are mitigated with bounded resources and zero-trust controls.",
+    "revisit_triggers": [
+      "Flash-sale concurrency exceeds 20,000,000 active sessions",
+      "Payment gateway changes idempotency header semantics"
+    ]
+  }
+}

package/skills/paranoid-principal-architect/references/modern-web-platform.md

@@ -0,0 +1,134 @@
+# Modern Web Platform Standards & Clean Architecture
+
+## 1. Native Web Platform Primitives (TC39, WHATWG, W3C)
+
+Legacy utility libraries (lodash, moment, axios, deep-clone, querystring) add bundle bloat, security audit overhead, and supply chain exposure. The Paranoid Architect prioritizes native standards:
+
+| Legacy / Bloated Pattern | Native Platform Standard | Advantage |
+| --- | --- | --- |
+| `axios.get(url, { timeout: 3000 })` | `fetch(url, { signal: AbortSignal.timeout(3000) })` | Zero dependencies, native stream cancellation |
+| `lodash.cloneDeep(obj)` | `structuredClone(obj)` | Native C++ memory cloning, handles circular references |
+| `lodash.groupBy(arr, fn)` | `Object.groupBy(arr, fn)` | Native ECMAScript standard (TC39 Stage 4) |
+| `moment(d).format(...)` | `new Intl.DateTimeFormat(locale, options).format(d)` | Native browser/engine i18n, zero bundle impact |
+| `querystring.parse(str)` | `new URLSearchParams(str)` | Spec-compliant WHATWG URL encoding and parsing |
+| Hand-rolled chunked reader | `ReadableStream` / `TransformStream` | Native Web Streams with automatic backpressure |
+
+---
+
+## 2. Modern Semantic HTML5 & Accessible UI
+
+High-scale web frontends must be universally accessible, resilient, and lightweight:
+
+### Modal Architecture: Native `<dialog>`
+Never hand-roll div-based modals with synthetic event listeners and fragile focus loops:
+```html
+<dialog id="confirm-modal" aria-labelledby="modal-title">
+  <form method="dialog">
+    <h2 id="modal-title">Confirm Deletion</h2>
+    <p>This action is irreversible.</p>
+    <button type="submit" value="cancel">Cancel</button>
+    <button type="submit" value="confirm" autofocus>Confirm</button>
+  </form>
+</dialog>
+```
+- Invoking `dialogElement.showModal()` automatically locks interaction to the top layer, traps Tab focus within the dialog, prevents background scroll, and closes on `Escape`.
+- Returns user choice natively through `dialogElement.addEventListener('close', ...)`.
+
+### Semantic Controls
+- **Buttons:** Always declare explicit `type="button"` on interactive controls inside forms that are not submit triggers, preventing unintended form submissions.
+- **Collapsible Regions:** Use native `<details>` and `<summary>` instead of synthetic toggle div hierarchies.
+
+### Modern CSS Invariants
+- Use `:has()` parent-selectors and Container Queries (`@container`) for modular, component-driven layouts.
+- Always respect user accessibility preferences:
+  ```css
+  @media (prefers-reduced-motion: reduce) {
+    *, ::before, ::after {
+      animation-duration: 0.01ms !important;
+      animation-iteration-count: 1 !important;
+      transition-duration: 0.01ms !important;
+      scroll-behavior: auto !important;
+    }
+  }
+  ```
+
+---
+
+## 3. Strict Type Discipline & Type Branding
+
+TypeScript is not documentation; it is a structural proof system. Loose typing breeds silent runtime corruption.
+
+### Prohibitions
+- **Ban `any`:** `any` disables type checking across all downstream consumers.
+- **Ban `@ts-ignore` / `@ts-nocheck`:** Never suppress the compiler.
+- **Ban blind assertions (`input as TargetType`):** Type assertions mask upstream schema mismatches. Use runtime type guards or Zod schema parsers.
+
+### Branded Types for Domain Identifiers
+Prevent accidental parameter transposition (e.g. passing an `orgId` where a `userId` is required):
+```typescript
+declare const __brand: unique symbol;
+export type Brand<T, B> = T & { readonly [__brand]: B };
+
+export type UserId = Brand<string, "UserId">;
+export type OrganizationId = Brand<string, "OrganizationId">;
+export type Cents = Brand<number, "Cents">;
+
+export function createUserId(raw: string): UserId {
+  if (!/^usr_[a-zA-Z0-9]{24}$/.test(raw)) {
+    throw new TypeError(`Invalid UserId format: ${raw}`);
+  }
+  return raw as UserId;
+}
+```
+
+### Discriminated Unions for State
+Model domain states as exhaustive discriminated unions:
+```typescript
+export type AsyncState<T> =
+  | { status: "idle" }
+  | { status: "loading" }
+  | { status: "success"; data: T }
+  | { status: "error"; code: string; message: string };
+```
+
+---
+
+## 4. Structured Error Handling & Zero Meta-Leakage
+
+### The Empty Catch Prohibition
+Never swallow exceptions:
+```typescript
+// FATAL DEFECT: Swallowing errors masks silent failures and data corruption
+try {
+  await persistRecord();
+} catch (e) {}
+```
+
+### Deterministic Error Mapping & Correlation IDs
+Every operational error must map to a standardized machine-readable envelope without leaking database schemas, server paths, or stack traces:
+```typescript
+export interface ApiErrorEnvelope {
+  correlationId: string;
+  code: string;
+  message: string;
+  details?: Record<string, unknown>;
+}
+
+export function handleControllerError(err: unknown, correlationId: string): Response {
+  // 1. Log full internal stack trace securely to private logging pipeline
+  logger.error({ correlationId, error: err }, "Unhandled request error");
+
+  // 2. Return clean, unslop, non-leaking payload to the caller
+  const envelope: ApiErrorEnvelope = {
+    correlationId,
+    code: err instanceof DomainError ? err.code : "INTERNAL_SERVER_ERROR",
+    message: err instanceof DomainError ? err.message : "An unexpected error occurred."
+  };
+
+  const status = err instanceof DomainError ? err.httpStatus : 500;
+  return new Response(JSON.stringify(envelope), {
+    status,
+    headers: { "Content-Type": "application/json" }
+  });
+}
+```