arcane-cli 0.22.10 → 0.22.11

package/dist/assets/.github/prompts/spell-architect.prompt.md

@@ -112,5 +112,5 @@ Workflow:
 Rules:
 - Stories must be right-sized per the methodology doc (not "build the entire dashboard").
 - Architecture decisions must reference existing ADRs when relevant.
-- Use Mermaid for all diagrams.
+- Use Mermaid for all diagrams, per rule 8 (`.arcane/governance/universal-agent-rules.md`) — this spell's component/data-flow diagrams are agent-authored design output, not the generated-state-diagrams sub-convention ARC-036 covers.
 - If PRD scope is too large, recommend splitting before proceeding.

package/dist/assets/.github/prompts/spell-explain-concept.prompt.md

@@ -21,7 +21,7 @@ Follow these rules strictly:
 
 1. **Start with the one-sentence answer.** What is it, or why does it happen? No preamble.
 2. **Use analogies from the user's world** — relate to tools, systems, or workflows they already use (their editor, their chat/notification tooling, their own agents, their own infrastructure). Check the workspace for context about the user's setup.
-3. **Use diagrams when architecture matters.** Mermaid sequence diagrams for flows, flowcharts for decision trees. Don't use diagrams for simple definitions.
+3. **Use diagrams per rule 8** (`.arcane/governance/universal-agent-rules.md`) — Mermaid sequence diagrams for flows, flowcharts for decision trees. Don't use diagrams for simple definitions.
 4. **Show the "so what?"** — connect the explanation to what the user can *do* with this knowledge. What decisions does it unlock? What options does it create?
 5. **Name the moving parts** with a summary table when there are multiple components, layers, or options to compare.
 6. **Use real examples from their system** — reference actual agent names, actual config files, actual commands. Don't use generic placeholders when specific is available.

package/dist/assets/.github/prompts/spell-scope.prompt.md

@@ -175,7 +175,7 @@ Flag any epics that need **multiple roles** (e.g., a full-stack feature = backen
 
 ### 7. Dependency Graph
 
-Produce a Mermaid diagram showing epic execution order:
+Produce a Mermaid diagram (per rule 8) showing epic execution order — an agent-authored planning diagram, not the generated-state-diagrams sub-convention ARC-036 covers, since the ordering is this spell's own design output rather than already-computed state:
 
 ```mermaid
 flowchart LR

package/dist/assets/.github/prompts/spell-security-review.prompt.md

@@ -30,6 +30,25 @@ Workflow:
    - Full project audit
    - Particular area of concern (auth, payments, data handling)
 
+1a. **Map trust boundaries and data flow** — before running the checklists below, sketch how data crosses trust zones (external actors, the auth boundary, internal services, data stores). This is agent-authored analysis under rule 8 (`.arcane/governance/universal-agent-rules.md`), not the generated-state-diagrams sub-convention ARC-036 covers — there is no already-computed trust-boundary state to read back, only the agent's own reasoning about the code. Use a Mermaid flowchart with a subgraph per trust zone:
+
+   ```mermaid
+   flowchart LR
+       subgraph External [Untrusted]
+           User[User / Client]
+       end
+       subgraph Boundary [Trust Boundary: Auth]
+           API[API Layer]
+       end
+       subgraph Internal [Trusted]
+           DB[(Data Store)]
+       end
+       User -->|request| API
+       API -->|authenticated query| DB
+   ```
+
+   Skip this step when the review scope doesn't cross any trust boundary — a single internal utility with no new external interaction, no new data store, and no new auth flow has nothing to diagram.
+
 2. **OWASP Top 10 checklist** — check each category:
 
    | #   | Category                  | Check                                                                                       |
@@ -81,6 +100,9 @@ Workflow:
    **Date:** [timestamp]
    **Scope:** [What was reviewed]
 
+   ### Trust Boundary / Data Flow
+   [Mermaid flowchart from step 1a — omit this section entirely if step 1a was skipped]
+
    ### OWASP Top 10 Results
    | Category                  | Status    | Findings  |
    | ------------------------- | --------- | --------- |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arcane-cli",
-  "version": "0.22.10",
+  "version": "0.22.11",
   "description": "Arcane framework CLI — scaffold and manage governance files in consuming repositories",
   "keywords": [
     "arcane",