arkaos 4.18.0 → 4.20.0

package/README.md

@@ -2,7 +2,7 @@
 
 **The Operating System for AI Agent Teams.**
 
-86 agents. 17 departments. 279 skills. Enterprise frameworks. Multi-runtime. One install.
+86 agents. 17 departments. 287 skills. Enterprise frameworks. Multi-runtime. One install.
 
 ```bash
 npx arkaos install

package/VERSION

@@ -1 +1 @@
-4.18.0
+4.20.0

package/arka/SKILL.md

@@ -25,7 +25,7 @@ measures citation compliance per turn.
 # ArkaOS — Main Orchestrator
 
 > **The Operating System for AI Agent Teams**
-> 86 agents. 17 departments. 279 skills. Multi-runtime. Dashboard. Knowledge RAG.
+> 86 agents. 17 departments. 287 skills. Multi-runtime. Dashboard. Knowledge RAG.
 
 ## ⛔ Evidence flow — 4 gates (NON-NEGOTIABLE)
 

package/config/agents-provenance.yaml

@@ -3,8 +3,8 @@
 # Mirror of config/skills-provenance.yaml for the agent tree. The parser
 # (core/agents/provenance.py) closes every way of writing a BROKEN
 # provenance block, but it cannot see an agent that never writes one:
-# absence reads as first-party, which is exactly what a forgotten ECC
-# agent port looks like.
+# absence reads as first-party, which is exactly what a forgotten
+# third-party agent port looks like.
 #
 # EVERY agent YAML must be CLASSIFIED — listed in `first_party` below,
 # listed in `derived` below, or declaring a `provenance:` block in its
@@ -19,9 +19,9 @@
 #
 # What the baseline is and is not:
 #   ASSERTED: these are ArkaOS originals.
-#   PROVEN: none can be ECC-derived — every one was created before
-#     2026-07-14, the day we first read that repository (git log
-#     --diff-filter=A; verified once).
+#   PROVEN: none can be externally derived — every one was created
+#     before 2026-07-14, when this campaign began studying external
+#     repositories (git log --diff-filter=A; verified once).
 #   The property the control rests on is that the set is CLOSED:
 #     anything new must classify itself.
 #
@@ -29,7 +29,7 @@
 #
 # derived format:
 #   departments/<dept>/agents/<slug>.yaml:
-#     origin: <lowercase-slug>      # e.g. ecc-derived, community
+#     origin: <lowercase-slug>      # e.g. vendor-derived, community
 #     source: https://...
 #     license: MIT
 

package/config/skills-provenance.yaml

@@ -30,10 +30,11 @@
 #   ASSERTED, not independently verified: that these 275 are ArkaOS
 #   originals. Nobody re-derived each one from scratch to prove it.
 #
-#   PROVEN, for the lineage that matters: none of them can be
-#   ECC-derived. `git log --diff-filter=A` puts every creation between
-#   2026-03-14 and 2026-07-13 — all of them before 2026-07-14, the day
-#   we first read that repository. Zero exceptions.
+#   PROVEN, for the lineage that matters: none of them can be derived
+#   from an external source. `git log --diff-filter=A` puts every
+#   creation between 2026-03-14 and 2026-07-13 — all of them before
+#   2026-07-14, when this campaign began studying external repositories.
+#   Zero exceptions.
 #
 #   The property the control actually rests on is neither: it is that
 #   the set is CLOSED. Anything new must classify itself, whatever the
@@ -52,32 +53,13 @@
 #
 # derived format:
 #   departments/<dept>/skills/<slug>:
-#     origin: <lowercase-slug>      # e.g. ecc-derived, community
+#     origin: <lowercase-slug>      # e.g. vendor-derived, community
 #     source: https://...           # where it came from
 #     license: MIT                  # what we are bound by
 
 baseline_date: 2026-07-14
 
-derived:
-  # ECC review lenses (Track C1) — specialised review skills ArkaOS
-  # lacked, ported from the MIT-licensed everything-claude-code repo and
-  # rewritten in ArkaOS voice with ArkaOS personas.
-  departments/dev/skills/silent-failure-hunter:
-    origin: ecc-derived
-    source: https://github.com/affaan-m/ecc
-    license: MIT
-  departments/dev/skills/type-design-analyzer:
-    origin: ecc-derived
-    source: https://github.com/affaan-m/ecc
-    license: MIT
-  departments/dev/skills/pr-test-analyzer:
-    origin: ecc-derived
-    source: https://github.com/affaan-m/ecc
-    license: MIT
-  departments/dev/skills/click-path-audit:
-    origin: ecc-derived
-    source: https://github.com/affaan-m/ecc
-    license: MIT
+derived: {}
 
 first_party:
   - arka

package/core/agents/provenance.py

@@ -1,19 +1,18 @@
 """Agent provenance — supply-chain lineage for every agent YAML.
 
-The skill tree got provenance in v4.17.0; agents did not, and the ECC
-teardown puts ~15 derived agents on the roadmap. An ECC agent ported
-today would land with exactly the hole skill provenance closes: no
-origin, no licence trail, indistinguishable from an ArkaOS original.
-This is the agent-side mirror, and it must land before the first agent
-port.
+The skill tree got provenance in v4.17.0; agents did not. If a
+third-party agent is ever ported in, it would land with exactly the
+hole skill provenance closes: no origin, no licence trail,
+indistinguishable from an ArkaOS original. This is the agent-side
+mirror, and it guards that boundary before any such port.
 
 An agent YAML may carry a top-level ``provenance`` block:
 
-    id: silent-failure-hunter
+    id: example-agent
     name: ...
     provenance:
-      origin: ecc-derived
-      source: https://github.com/affaan-m/ecc
+      origin: vendor-derived
+      source: https://example.com/upstream
       license: MIT
 
 Absent means first-party. The validation rules are the shared

package/core/cognition/memory/schemas.py

@@ -98,7 +98,7 @@ class KnowledgeEntry(BaseModel):
 # Instinct confidence lives in a band, never at the poles. 0.3 is a weak
 # hypothesis worth keeping; 0.9 is strong but never certainty (an agent
 # that is "certain" from a handful of observations is the failure the
-# band prevents). Mirrors the ECC continuous-learning instinct model.
+# band prevents). Follows an established continuous-learning instinct model.
 INSTINCT_CONFIDENCE_MIN = 0.3
 INSTINCT_CONFIDENCE_MAX = 0.9
 INSTINCT_SCOPES = ("project", "global")
@@ -107,7 +107,7 @@ INSTINCT_SCOPES = ("project", "global")
 class ActionableInsight(BaseModel):
     """Actionable insight — generated by agents for proactive presentation.
 
-    Carries the ECC-style instinct fields (confidence, scope,
+    Carries the instinct fields (confidence, scope,
     evidence_count) so an insight can strengthen on corroboration, weaken
     on contradiction, and be promoted from project to global once the
     same signal is seen across enough projects with high enough mean

package/core/skills/provenance.py

@@ -9,12 +9,12 @@ author who ported it moves on.
 Contract (opt-in, absence means first-party):
 
     ---
-    name: dev/silent-failure-hunter
+    name: dev/example-skill
     description: ...
     allowed-tools: [Read, Grep, Glob]
     metadata:
-      origin: ecc-derived
-      source: https://github.com/affaan-m/ecc
+      origin: vendor-derived
+      source: https://example.com/upstream
       license: MIT
     ---
 

package/core/workflow/config_guard.py

@@ -3,8 +3,7 @@
 An agent that hits a lint or type error has two ways out: fix the code,
 or edit the config so the check stops firing. The second is faster and
 almost always wrong — it silences the signal for the whole team, not
-just this change. The ECC teardown found a hook for exactly this
-(`config-protection`), and it is the cheapest high-value control in the
+just this change. This gate is the cheapest high-value control in the
 set: refuse edits to linter/formatter/type-checker configs, and the
 agent is left with the honest path.
 

package/departments/dev/skills/click-path-audit/SKILL.md

@@ -13,9 +13,7 @@ description: >
   brand/design-review wins.
 allowed-tools: [Read, Grep, Glob]
 metadata:
-  origin: ecc-derived
-  source: https://github.com/affaan-m/ecc
-  license: MIT
+  origin: arkaos
 ---
 
 # Click-Path Audit — `/dev click-path-audit`
@@ -33,11 +31,13 @@ clicks.
 
 ## The bug this catches
 
-A "New Email" button called `setComposeMode(true)` then `selectThread(null)`.
-Each call was correct on its own, but `selectThread` reset `composeMode`
-back to false as a side effect, so the button opened nothing — no type
-error, no crash, and no unit test to catch it. Tracing the two calls in
-order makes the reset obvious on the page.
+An "Apply filters" button called `setFilters(next)` and then, to close the
+panel, `resetPanel()`. Each worked alone — but `resetPanel` cleared the
+draft filter state as part of tidying up, so the store ended with the old
+filters and the list never changed. No type error, no crash, no failing
+unit test; the two setters simply fought and the second won. Walking the
+handler's calls in order puts the cleared write next to the one it
+cancelled, and the bug is visible without ever running the app.
 
 ## Process
 

package/departments/dev/skills/exploit-triage/SKILL.md

@@ -0,0 +1,77 @@
+---
+name: dev/exploit-triage
+description: >
+  Reviews code for the vulnerabilities that are actually reachable and
+  actually exploitable — SSRF, auth bypass, injection, insecure
+  deserialisation, IDOR — biased toward a remote, unauthenticated
+  attacker, and discards the theoretical. Answers "can someone reach and
+  weaponise this?", not "is this textbook-perfect?". TRIGGER: "/dev
+  exploit-triage", "is this exploitable", "attack surface", "can this be
+  reached", "SSRF/IDOR/auth bypass", "isto é explorável?", "que dano real
+  se tira daqui?"; run on a diff touching auth, input handling, requests,
+  deserialisation, or file/db access. SKIP: broad OWASP/quality pass ->
+  dev/security-audit wins; adversarially breaking a diff (abuse cases,
+  threat-modelling a change) -> dev/adversarial-review wins; planning a
+  full offensive engagement (signed RoE, ATT&CK campaign) -> dev/red-team
+  wins; agent/prompt-injection threats -> dev/ai-security wins.
+allowed-tools: [Read, Grep, Glob]
+metadata:
+  origin: arkaos
+---
+
+# Exploit Triage — `/dev exploit-triage`
+
+> **Agent:** Bruno (Security Engineer) | **Framework:** Reachability-first, attacker-economics, CWE Top 25
+
+A security review that lists every theoretical weakness buries the one
+that gets you breached. This lens inverts the priority: it starts from a
+remote, unauthenticated attacker and asks, of each finding, whether they
+can reach the code path and whether reaching it actually pays. A missing
+security header on an internal admin page is a note; an SSRF on a
+user-supplied URL that reaches the cloud metadata endpoint is the report.
+Reachability and impact rank everything; the textbook comes second.
+
+## What to hunt (reachability-first)
+
+| Class | The question that decides severity |
+|-------|-----------------------------------|
+| **SSRF** (CWE-918) | Does a user-controlled URL/host reach a fetch, and can it hit internal services or a metadata endpoint? |
+| **Auth / access bypass** (CWE-287/862, IDOR CWE-639) | Can the check be skipped, or an object accessed by ID without ownership (IDOR)? |
+| **Injection** (CWE-74: SQLi/command/template) | Does untrusted input reach a query, a shell, or a template unparameterised? |
+| **Insecure deserialisation** (CWE-502) | Is attacker-controlled data deserialised into objects (pickle, unsafe YAML, native serialisers)? |
+| **Path traversal / upload** | Can a user steer a file path or upload an executable/served type? |
+| **Secrets & SSRF-adjacent** | A leaked credential or an open redirect that chains into the above. |
+
+## Process
+
+1. Map the **entry points** in the diff — what an unauthenticated request can reach, then what an authenticated-but-untrusted user can.
+2. For each candidate, trace the taint: does attacker input reach the sink, and is there a real control in the way?
+3. Rank by **reachability × impact**, not by CWE checklist order. Discard the theoretically-imperfect-but-unreachable with a one-line note, so the real findings are not buried.
+4. For each real finding, give the **concrete attack** (the request an attacker sends) and the fix.
+
+## Proactive Triggers
+
+Surface these WITHOUT being asked:
+
+- a user-supplied URL or hostname flowing into an HTTP client → the SSRF, and whether it can reach the metadata endpoint
+- an object fetched by an ID from the request with no ownership check → the IDOR and the horizontal access it grants
+- `pickle.loads` / `yaml.load` / a native deserialiser on request data → the deserialisation-to-RCE path
+
+## Output
+
+```markdown
+## Exploit Triage
+
+**Scope:** {diff / entry points reviewed}
+**Attacker model:** {remote unauth / authenticated untrusted}
+
+### Exploitable (reachable + impactful)
+- **{class}** {file}:{line}
+  - **Reach:** {how the attacker gets input to the sink}
+  - **Attack:** {the concrete request/payload}
+  - **Impact:** {what it grants}
+  - **Fix:** {the specific control}
+
+### Noted, not exploitable (unreachable or low impact)
+- {finding} — {why it does not pay}, one line each
+```

package/departments/dev/skills/laravel-review/SKILL.md

@@ -0,0 +1,82 @@
+---
+name: dev/laravel-review
+description: >
+  Laravel/PHP review against ArkaOS conventions — mass assignment, N+1
+  queries, Blade XSS, business logic leaking into controllers, missing
+  FormRequests, and strict-types gaps — with the fix each one needs.
+  TRIGGER: "/dev laravel-review", "review this Laravel", "review the PHP",
+  "revê este controller", "revê o Eloquent", "isto está seguro em
+  Laravel?", any diff touching *.php, Blade, or Eloquent models. SKIP:
+  language-agnostic pre-merge review -> dev/code-review wins; database
+  schema/migration design -> dev/db-design wins; a security audit of the
+  whole app -> dev/security-audit wins.
+allowed-tools: [Read, Grep, Glob, Bash]
+metadata:
+  origin: arkaos
+---
+
+# Laravel Review — `/dev laravel-review`
+
+> **Agent:** Gonçalo (Laravel Specialist) | **Framework:** Laravel conventions, OWASP, ArkaOS Services+Repositories standard
+
+Laravel makes the wrong thing easy: `create($request->all())` is one line
+and a mass-assignment hole, an Eloquent relation in a Blade loop is one
+property access and an N+1, `{!! $x !!}` is shorter than the escaped form
+and an XSS. This review reads a PHP diff for the specific ways the
+framework's convenience turns into a defect, and holds it to the ArkaOS
+Laravel standard — Services and Repositories, FormRequests everywhere,
+`declare(strict_types=1)`, not just to PSR-12.
+
+## Review Priorities
+
+### Critical — Security
+- **Mass assignment**: `create($request->all())` or `$guarded = []` → whitelist `$fillable`, or pass `$request->validated()` from a FormRequest.
+- **SQL injection**: `DB::raw()`/`whereRaw()`/string-interpolated queries with user input → parameterised bindings or Eloquent.
+- **Blade XSS**: `{!! $userInput !!}` without HTMLPurifier → `{{ }}`, or purify explicitly.
+- **Command/path**: `exec`/`shell_exec`/`system` or `Storage` paths from user input → validate and sanitise.
+- **Unvalidated uploads**: no MIME/size/extension check on file inputs.
+- **Weak crypto / secrets**: MD5 for passwords, hardcoded keys.
+
+### Critical — Error handling
+- **Swallowed exceptions**: `catch (\Throwable $e) {}` with no log and no re-throw.
+- **Missing validation**: a controller action with no FormRequest and no inline rules.
+
+### High — ArkaOS Laravel standard
+- **Business logic in controllers** → extract to a Service or Action; the controller orchestrates, it does not decide.
+- **Data access outside a Repository** where the ecosystem uses them.
+- **No FormRequest** on a write endpoint → `$request->validated()`, never `$request->all()`.
+- **Missing `declare(strict_types=1)`** in non-view PHP; untyped public method params/returns.
+- **N+1**: an Eloquent relation accessed in a loop or serialisation with no `with()`/`$with`.
+- **Missing `$fillable`/`$casts`** on models; **missing Feature test** (`RefreshDatabase`) on the changed behaviour.
+
+## Process
+
+1. `git diff -- '*.php' '*.blade.php'` to scope the change.
+2. Run PHPStan/Pint if configured — read their output, do not just report their absence.
+3. Read each changed controller/model/service against the priorities, heaviest first.
+
+## Proactive Triggers
+
+Surface these WITHOUT being asked:
+
+- `$request->all()` reaching a `create`/`update`/`fill` → the mass-assignment hole; name the fields it exposes
+- a relation accessed inside `@foreach` or an API Resource with no eager load → the N+1 and the `with()` that fixes it
+- a controller method over ~15 lines carrying query + business logic → the Service/Action to extract
+
+## Output
+
+```markdown
+## Laravel Review
+
+**Scope:** {changed PHP / Blade}
+**Verdict:** {APPROVED / CHANGES REQUESTED}
+
+### Critical
+- [ ] {file}:{line} — {the hole} → {the fix}
+
+### High (ArkaOS standard)
+- [ ] {file}:{line} — {the convention broken} → {the fix}
+
+### Positive
+{what follows the standard well}
+```

package/departments/dev/skills/ml-adoption-playbook/SKILL.md

@@ -0,0 +1,88 @@
+---
+name: dev/ml-adoption-playbook
+description: >
+  Decides whether a problem needs ML at all, then adds it to a non-ML
+  codebase the cheap way — heuristic baseline first, a defined metric and
+  mistake budget, data readiness, and a decoupled seam before any model.
+  TRIGGER: "/dev ml-adoption-playbook", "should we use ML for this", "add
+  ML to", "is this an ML problem", "machine learning for X", "vale a pena
+  ML aqui?", "adicionar ML ao projeto", "modelo ou regras?". SKIP: the
+  model is already chosen and the job is to productionise it ->
+  dev/mle-workflow wins; a ranking/feed pipeline's plumbing ->
+  dev/rag-architect or dev/architecture-design wins.
+allowed-tools: [Read, Grep, Glob]
+metadata:
+  origin: arkaos
+---
+
+# ML Adoption Playbook — `/dev ml-adoption-playbook`
+
+> **Agent:** Salvador (AI Engineering Specialist) | **Framework:** Heuristic-first, metric-and-mistake-budget, incremental adoption
+
+The most expensive way to add machine learning to a product is to reach
+for a model before asking whether rules would do. A regex, a threshold,
+or a lookup table ships in an afternoon, is trivial to debug, and is
+often within a few points of what a model would give — and if it is not,
+it becomes the baseline the model has to beat. This playbook decides
+whether the problem is really an ML problem, and if it is, adds ML to a
+codebase that has none of the scaffolding, one committed step at a time.
+
+## Phase 1 — Framing & feasibility (before any model)
+
+- **Heuristic check.** Could a rule, threshold, or lookup solve this
+  acceptably? If yes, ship that first — it is the baseline and often the
+  answer. A model that cannot beat a well-tuned heuristic is not worth
+  its operational cost.
+- **Metric.** Define how success is measured, tied to the product
+  decision — before touching data. No metric, no project.
+- **Mistake budget.** State what a wrong prediction costs and how many
+  are tolerable. This sets the bar the model must clear and whether a
+  human stays in the loop.
+- **Data reality.** Do labelled examples exist, or a path to them? Is the
+  outcome observable, and when? A problem with no labels and no path to
+  them is not yet an ML problem.
+
+## Phase 2 — Data readiness
+
+- Locate the data that would feed the model; assess volume, quality, and
+  bias before assuming it is usable.
+- Confirm the label is available at the time a prediction is needed, not
+  only in hindsight.
+
+## Phase 3 — Architectural seam
+
+- Add a decoupled boundary where the prediction plugs in — an interface
+  the current heuristic satisfies too, so the model can replace the rule
+  without rewiring the app.
+- Keep the heuristic as the fallback and the regression baseline.
+
+## Phase 4 — Baseline model
+
+- Integrate the simplest model that could work behind the seam; compare
+  it to the heuristic on the defined metric and mistake budget.
+- Promote only if it clears the bar. If it does not, the heuristic stays
+  and the finding is recorded — a negative result is still a result.
+
+## Proactive Triggers
+
+Surface these WITHOUT being asked:
+
+- a request to "use ML" for something a threshold or lookup handles → propose the heuristic baseline first and the bar the model must beat
+- an ML plan with no defined metric or mistake budget → stop; those come before data
+- no labelled data and no path to it → this is not yet an ML problem; name what would make it one
+
+## Output
+
+```markdown
+## ML Adoption Assessment
+
+**Problem:** {what decision needs to be made}
+**Heuristic baseline:** {the rule that ships today, and how close it gets}
+**Verdict:** {ML justified? / heuristic suffices / not yet an ML problem}
+
+### If ML is justified
+- **Metric & bar:** {measure + threshold the model must beat the baseline by}
+- **Mistake budget:** {cost of a wrong call + human-in-loop or not}
+- **Data readiness:** {labels? volume? label latency?}
+- **Seam:** {the interface where the model plugs in, heuristic as fallback}
+```

package/departments/dev/skills/mle-workflow/SKILL.md

@@ -0,0 +1,97 @@
+---
+name: dev/mle-workflow
+description: >
+  Turns model work into a production ML system — data contracts,
+  reproducible training, measurable eval gates, a deployable artifact,
+  and monitoring with a rollback path — using only the lanes the system
+  needs. TRIGGER: "/dev mle-workflow", "productionise this model", "ML
+  pipeline", "ranking/recommender/classifier/forecasting system", "model
+  refresh", "pôr o modelo em produção", "notebook para pipeline", "eval
+  gate do modelo". SKIP: RAG retrieval/context design -> dev/rag-architect
+  wins; the app/API around the model with no ML lifecycle concern ->
+  dev/architecture-design wins; prompt-injection/model-abuse threats ->
+  dev/ai-security wins.
+allowed-tools: [Read, Grep, Glob, Bash]
+metadata:
+  origin: arkaos
+---
+
+# ML Engineering Workflow — `/dev mle-workflow`
+
+> **Agent:** Salvador (AI Engineering Specialist) | **Framework:** Data contracts, reproducible training, eval-gated promotion, monitored rollout
+
+A model in a notebook is a result; a model in production is a system that
+has to keep being right as the data underneath it moves. The gap between
+the two is not the algorithm — it is the plumbing that makes a prediction
+reproducible, gated on measured quality, deployable as an artifact, and
+observable once real traffic arrives. This workflow builds that plumbing,
+using only the lanes the system in front of you actually needs.
+
+## Scope calibration first
+
+Not every model has labels, online serving, a feature store, GPUs, or A/B
+tests. Pick the lanes that fit and make the missing ones explicit
+assumptions. A change that a data contract, a baseline, an eval script,
+and a rollback note would make reviewable does not need a feature store.
+
+## Lanes
+
+### 1. Data contract
+- Define the input schema, types, and allowed ranges; version it. A model is only as trustworthy as the guarantee on what reaches it.
+- Name the label source and its latency (is the outcome known now, or in 30 days?). Undelayed evaluation of a delayed-label problem is a lie.
+- Guard against **leakage**: a feature that encodes the target, or is computed with information unavailable at prediction time.
+
+### 2. Reproducible training
+- Pin the data snapshot, code version, dependency lockfile/environment, seed, and hyperparameters — a training run nobody can reproduce is not evidence.
+- Separate train/validation/test by the axis that matches production (time-based split for anything time-ordered, not random).
+- Emit a single versioned artifact (weights + preprocessing + the input schema it expects).
+
+### 3. Eval gate (promotion criteria)
+- State the metric and the threshold BEFORE training, tied to the decision the model drives — not accuracy for its own sake.
+- Evaluate on **slices**, not just the aggregate: a model that is 95% overall and 40% on the segment that matters is a failure.
+- Offline gate to promote; where traffic exists, an online check (shadow or canary) before full rollout.
+
+### 4. Deployable artifact & serving
+- The serving path must run the **same** preprocessing as training — train/serve skew is the most common silent production failure.
+- Batch vs online: choose by the freshness the decision needs, not by default.
+- Idempotent, versioned, with a health check.
+
+### 5. Monitoring & rollback
+- Watch input drift, prediction distribution, and — when labels arrive — realised quality against the offline estimate.
+- A **rollback path** to the previous artifact that can be triggered without a retrain.
+- Preserve every production failure (bad feature, stale label, artifact mismatch, drift) as a regression case.
+
+## Process
+
+1. Map the change onto the five lanes; mark which apply and which are explicit assumptions.
+2. Find the existing training/feature/serving/eval paths before adding a parallel ML stack (`git grep`, read them).
+3. Build the data contract and the eval gate first — they define what "done" means before any model work.
+
+## Proactive Triggers
+
+Surface these WITHOUT being asked:
+
+- a feature computed from data unavailable at prediction time → the leakage, and the realistic offline score once it is removed
+- a random train/test split on time-ordered data → the optimistic metric it produces and the time-based split that fixes it
+- preprocessing written twice (once in training, once in serving) → the train/serve skew waiting to happen; share the code path
+
+## Output
+
+```markdown
+## ML Engineering Plan
+
+**System:** {what the model decides} · **Lanes in scope:** {of the five}
+**Explicit assumptions:** {labels / serving / traffic / monitoring owner}
+
+### Data contract
+{schema, label source + latency, leakage checks}
+
+### Training & eval gate
+{reproducibility pins, split axis, metric + threshold + slices}
+
+### Serving & monitoring
+{batch/online, skew guard, drift signals, rollback trigger}
+
+### Risks
+- {the failure mode} → {the guard}
+```

package/departments/dev/skills/pr-test-analyzer/SKILL.md

@@ -12,9 +12,7 @@ description: >
   dev/silent-failure-hunter wins.
 allowed-tools: [Read, Grep, Glob, Bash]
 metadata:
-  origin: ecc-derived
-  source: https://github.com/affaan-m/ecc
-  license: MIT
+  origin: arkaos
 ---
 
 # PR Test Analyzer — `/dev pr-test-analyzer`

package/departments/dev/skills/python-review/SKILL.md

@@ -0,0 +1,80 @@
+---
+name: dev/python-review
+description: >
+  Python review against ArkaOS conventions — missing type hints, mutable
+  default arguments, bare excepts, unvalidated boundaries, injection, and
+  Pydantic/FastAPI mistakes — with the fix each needs. TRIGGER: "/dev
+  python-review", "review this Python", "review the FastAPI", "revê o
+  Python", "revê este endpoint", "isto está pythonico?", any diff touching
+  *.py. SKIP: language-agnostic pre-merge review -> dev/code-review wins;
+  pytest coverage of the change -> dev/pr-test-analyzer wins; swallowed-error
+  hunt across the codebase -> dev/silent-failure-hunter wins.
+allowed-tools: [Read, Grep, Glob, Bash]
+metadata:
+  origin: arkaos
+---
+
+# Python Review — `/dev python-review`
+
+> **Agent:** Diogo (Python Backend Specialist) | **Framework:** Type hints, Pydantic validation, PEP 8, ArkaOS core conventions
+
+Python trusts the author, and that trust is where the bugs live: a
+mutable default argument shared across every call, a bare `except` that
+buries the traceback, a function with no type hints that the checker
+cannot help. This review reads a Python diff against the ArkaOS core
+standard — type hints on every signature, Pydantic at the boundary,
+functions under thirty lines — and for the runtime traps the interpreter
+will happily let ship.
+
+## Review Priorities
+
+### Critical — Correctness traps
+- **Mutable default argument**: `def f(x=[])` / `={}` → default to `None`, build inside.
+- **Bare `except:` / `except Exception: pass`** → catch the specific type, log, re-raise or handle.
+- **Late-binding closure in a loop** capturing the loop variable → bind explicitly.
+
+### Critical — Boundary & security
+- **Unvalidated input** used as a trusted shape → a Pydantic model at the boundary, not a raw dict.
+- **Injection**: f-string/`%`-built SQL or `subprocess`/`os.system` with user input → parameterise / `shlex`, never interpolate.
+- **`eval`/`exec`/`pickle`** on untrusted data; hardcoded secrets.
+
+### High — ArkaOS core standard
+- **Missing type hints** on a public signature → hint params and return.
+- **A function over 30 lines** or nesting past 3 → decompose (`.claude/rules/python-core.md`).
+- **Pydantic misuse**: validation logic in a route instead of a `field_validator`; a model that admits an illegal state.
+- **Dataclass over Pydantic** where validation is needed; a broad `dict`/`Any` where a model belongs.
+
+### High — Idiom
+- A manual index loop where a comprehension/`enumerate` reads clearer; a `try` used for flow control; string concatenation in a hot loop.
+
+## Process
+
+1. `git diff -- '*.py'` to scope the change.
+2. Run `ruff`/`mypy`/`pytest` if configured — read the output, do not just note their absence.
+3. Read each changed function against the priorities, correctness traps first.
+
+## Proactive Triggers
+
+Surface these WITHOUT being asked:
+
+- a mutable default argument in the diff → the shared-state bug across calls
+- a `dict` passed through several layers as if typed → the Pydantic model that should guard the boundary
+- a function that grew past 30 lines in the diff → the seam to split it on
+
+## Output
+
+```markdown
+## Python Review
+
+**Scope:** {changed Python}
+**Verdict:** {APPROVED / CHANGES REQUESTED}
+
+### Critical
+- [ ] {file}:{line} — {the trap} → {the fix}
+
+### High (ArkaOS standard)
+- [ ] {file}:{line} — {the convention broken} → {the fix}
+
+### Positive
+{what is idiomatic and well-typed}
+```

package/departments/dev/skills/safety-review/SKILL.md

@@ -0,0 +1,75 @@
+---
+name: dev/safety-review
+description: >
+  Audits a change or an automation for destructive, irreversible
+  operations — bulk deletes, DROP/TRUNCATE, force pushes, mass emails,
+  raw disk or filesystem writes — and checks each has a guard: a scope
+  limit, a dry-run, a confirmation, a backup, a rollback. TRIGGER: "/dev
+  safety-review", "is this safe to run", "destructive operation", "will
+  this delete/overwrite", "review this migration/script/cron", "isto
+  apaga alguma coisa?", "revê este script destrutivo", "posso correr isto
+  em produção?"; run before shipping a migration, a bulk job, a cron, or
+  an autonomous automation. SKIP: exploitable-vulnerability review ->
+  dev/exploit-triage wins; general code review -> dev/code-review wins;
+  the deploy/rollout mechanics themselves -> dev/deploy wins.
+allowed-tools: [Read, Grep, Glob]
+metadata:
+  origin: arkaos
+---
+
+# Safety Review — `/dev safety-review`
+
+> **Agent:** Bruno (Security Engineer) | **Framework:** Blast-radius analysis, reversibility, guard-before-execute
+
+The dangerous change is rarely the one that fails — it is the one that
+succeeds at the wrong scope. A migration that runs, a cleanup cron that
+fires, a bulk update that commits: each does exactly what it was told, to
+more rows or files or people than the author pictured. This pass finds
+the destructive and irreversible operations in a change or an automation
+and checks that every one is fenced — scoped, reversible, dry-runnable,
+or gated behind a confirmation — before it can run unattended.
+
+## What to flag
+
+| Operation | The guard it needs |
+|-----------|--------------------|
+| **Bulk delete / update** (`DELETE`/`UPDATE` without a tight `WHERE`, `deleteMany`, `rm -rf`) | An explicit scope, a row-count check, and a backup or soft-delete |
+| **Schema destruction** (`DROP`, `TRUNCATE`, a down-migration that loses data) | Reversibility or a snapshot; never irreversible without sign-off |
+| **Force / history rewrite** (`git push --force`, `reset --hard`, `filter-branch`) | Branch scoping; never on a shared branch |
+| **Mass outbound** (bulk email/notification/webhook) | A dry-run count, a rate limit, a test-recipient path |
+| **Raw disk / filesystem** (`dd`, recursive writes, `chmod -R`) | Path scoping and a confirmation |
+| **Unbounded loop / job** over production data | A limit, idempotency, and a resumable/rollback path |
+
+## Process
+
+1. Grep the change/automation for the destructive verbs — `DELETE`, `DROP`, `TRUNCATE`, `deleteMany`, `rm`, `--force`, `reset --hard`, bulk-send calls.
+2. For each, determine the **blast radius**: what is the maximum it can affect if a parameter is wrong or empty (an empty `WHERE` deletes the table; a null filter matches everything)?
+3. Check the guard is present and correct: scope, dry-run, confirmation, backup, rollback. A destructive op with no guard, or a guard that fails open, is a finding.
+4. Rank by reversibility — an irreversible op with no backup is critical; a scoped, reversible one is clean.
+
+## Proactive Triggers
+
+Surface these WITHOUT being asked:
+
+- a `DELETE`/`UPDATE` whose `WHERE` could evaluate to empty or all-rows → the full-table blast radius and the scope/guard it needs
+- a down-migration or `DROP`/`TRUNCATE` with no snapshot → the irreversible data loss
+- an automation that runs unattended (cron, agent, CI job) touching production data with no dry-run or rollback → the guard to add before it ships
+
+## Output
+
+```markdown
+## Safety Review
+
+**Scope:** {change / automation reviewed}
+**Verdict:** {SAFE TO RUN / GUARDS REQUIRED}
+
+### Destructive operations
+- **{operation}** {file}:{line}
+  - **Blast radius:** {worst case if a parameter is wrong/empty}
+  - **Reversible?** {yes + how / no}
+  - **Guard present?** {scope/dry-run/confirmation/backup — or missing}
+  - **Fix:** {the guard to add before this runs}
+
+### Safe
+{operations already correctly fenced}
+```

package/departments/dev/skills/silent-failure-hunter/SKILL.md

@@ -13,9 +13,7 @@ description: >
   dev/pr-test-analyzer wins.
 allowed-tools: [Read, Grep, Glob]
 metadata:
-  origin: ecc-derived
-  source: https://github.com/affaan-m/ecc
-  license: MIT
+  origin: arkaos
 ---
 
 # Silent Failure Hunter — `/dev silent-failure-hunter`

package/departments/dev/skills/type-design-analyzer/SKILL.md

@@ -12,9 +12,7 @@ description: >
   schema of a new feature -> dev/db-design or dev/ddd-model wins.
 allowed-tools: [Read, Grep, Glob]
 metadata:
-  origin: ecc-derived
-  source: https://github.com/affaan-m/ecc
-  license: MIT
+  origin: arkaos
 ---
 
 # Type Design Analyzer — `/dev type-design-analyzer`

package/departments/dev/skills/typescript-review/SKILL.md

@@ -0,0 +1,81 @@
+---
+name: dev/typescript-review
+description: >
+  TypeScript/Node review for the holes the compiler waves through — `any`
+  and unsafe casts, unhandled promise rejections, missing input validation
+  at the boundary, and injection in queries or shell calls — with the fix
+  each needs. TRIGGER: "/dev typescript-review", "review this TS", "review
+  the Node", "revê o TypeScript", "revê este endpoint Node", "isto está
+  type-safe?", any diff touching *.ts/*.tsx server or API code. SKIP:
+  language-agnostic pre-merge review -> dev/code-review wins; React/Vue
+  component rendering bugs -> dev/vue-review or dev/click-path-audit wins;
+  type-design depth -> dev/type-design-analyzer wins.
+allowed-tools: [Read, Grep, Glob, Bash]
+metadata:
+  origin: arkaos
+---
+
+# TypeScript Review — `/dev typescript-review`
+
+> **Agent:** Vera (Node.js / TypeScript Backend Specialist) | **Framework:** Type safety, async correctness, boundary validation
+
+TypeScript's guarantees stop at the edges of the program, and that is
+where the bugs get in: an `any` erases every check downstream, a JSON
+body typed as its interface is a lie until something validates it, a
+floating promise swallows the error the caller needed. This review reads
+a TS diff for the places the type system was told to look away, and for
+the async and boundary mistakes no compiler flags.
+
+## Review Priorities
+
+### Critical — Type safety holes
+- **`any` / `as` casts** on external data → validate into a real type (Zod, a type guard); an `any` is an unchecked check for everything it touches.
+- **Non-null `!`** on a value that can be null at runtime → handle the null.
+- **`@ts-ignore` / `@ts-expect-error`** hiding a real type error → fix the type, do not silence it.
+
+### Critical — Async correctness
+- **Floating promise**: an `async` call with no `await` and no `.catch` → the rejection is lost.
+- **`await` in a loop** where `Promise.all` is correct → serial latency; and the reverse, unbounded `Promise.all` over a large list.
+- **Missing try/catch** around an `await` on I/O, or a catch that swallows.
+
+### Critical — Boundary
+- **Unvalidated input**: a request body/query/param used as its TS type with no runtime schema → validate at the boundary.
+- **Injection**: string-built SQL or `exec`/`child_process` with user input → parameterise / sanitise.
+- **Secrets**: hardcoded keys; secrets logged.
+
+### High — Standards
+- Public function signatures untyped or returning inferred `any`.
+- `Promise<void>` swallowing a result the caller needs; error thrown as a bare string.
+- Mutating a shared object where an immutable update belongs.
+
+## Process
+
+1. `git diff -- '*.ts' '*.tsx'` to scope the change.
+2. Run `tsc --noEmit` and the linter if configured — read the output.
+3. Read each changed handler/service for the priorities, type holes first.
+
+## Proactive Triggers
+
+Surface these WITHOUT being asked:
+
+- a request body used as `req.body as SomeType` with no validation → the boundary hole and the schema that closes it
+- an `async` function called with no `await`/`.catch` → the floating rejection
+- an `any` introduced in the diff → what it stops the compiler from checking downstream
+
+## Output
+
+```markdown
+## TypeScript Review
+
+**Scope:** {changed TS}
+**Verdict:** {APPROVED / CHANGES REQUESTED}
+
+### Critical
+- [ ] {file}:{line} — {the hole} → {the fix}
+
+### High
+- [ ] {file}:{line} — {the issue} → {the fix}
+
+### Positive
+{what is genuinely type-safe and correct}
+```

package/departments/dev/skills/vue-review/SKILL.md

@@ -0,0 +1,80 @@
+---
+name: dev/vue-review
+description: >
+  Vue 3 / Nuxt review for the framework's own traps — lost reactivity,
+  SSR hydration mismatches, missing keys, uncleaned watchers, and props
+  mutated in place — with the fix each needs. Composition API and
+  TypeScript assumed. TRIGGER: "/dev vue-review", "review this Vue",
+  "review the Nuxt", "revê este componente Vue", "revê o composable",
+  "porque é que a reactividade não funciona?", any diff touching
+  *.vue/composables. SKIP: language-agnostic review -> dev/code-review
+  wins; a handler-ordering/state-cancellation bug -> dev/click-path-audit
+  wins; visual/brand review -> brand/design-review wins.
+allowed-tools: [Read, Grep, Glob]
+metadata:
+  origin: arkaos
+---
+
+# Vue Review — `/dev vue-review`
+
+> **Agent:** Diana (Senior Frontend Developer) | **Framework:** Vue 3 Composition API, Nuxt SSR, reactivity correctness
+
+Most Vue bugs are not wrong logic — they are the reactivity system doing
+exactly what you told it, which was not what you meant. Destructure a
+`reactive` object and the binding is gone; read a value during SSR that
+only exists on the client and hydration tears; forget a `:key` and the
+list reuses the wrong DOM. This review reads a Vue/Nuxt diff for those
+framework-specific traps, on the assumption of Composition API and
+TypeScript throughout.
+
+## Review Priorities
+
+### Critical — Reactivity
+- **Destructured reactivity**: `const { x } = reactive(...)` or a destructured prop → `toRefs`/`toRef`, or access through the object; the destructured copy is inert.
+- **Ref unwrapped wrong**: `.value` missing in script, or added in template; a `ref` stored in a plain object it is read from without unwrapping.
+- **Prop mutated in place** → emit an event or use a local copy; props are one-way.
+
+### Critical — SSR / Nuxt hydration
+- **Client-only value read during SSR** (`window`, `localStorage`, `Date.now()` in setup) → guard with `import.meta.client`/`onMounted`; the mismatch tears hydration.
+- **Non-deterministic render** between server and client (random, unstable order).
+- **Data fetched without `useAsyncData`/`useFetch`** where SSR needs it → double fetch or hydration gap.
+
+### High — Correctness
+- **Missing `:key`** on a `v-for`, or `:key="index"` on a reorderable list → wrong-DOM reuse.
+- **Watcher/interval/listener not cleaned up** in `onUnmounted` → leak.
+- **`v-if` + `v-for` on the same element**; heavy work in a computed with side effects.
+
+### High — Standards
+- Options API in new code where the project is Composition API; `any`-typed props; a composable that is not prefixed `use` or leaks state across instances.
+
+## Process
+
+1. `git diff -- '*.vue'` plus changed composables to scope the change.
+2. Read each component's `setup`/template against the priorities, reactivity first.
+3. Trace any SSR-sensitive value from setup to template.
+
+## Proactive Triggers
+
+Surface these WITHOUT being asked:
+
+- a destructured `reactive`/props in the diff → the binding that is now dead and the `toRefs` fix
+- a `window`/`localStorage`/`Date` read in `setup` of an SSR page → the hydration mismatch it causes
+- a `v-for` with no `:key` or a keyed index on a list that reorders → the DOM-reuse bug
+
+## Output
+
+```markdown
+## Vue Review
+
+**Scope:** {changed components / composables}
+**Verdict:** {APPROVED / CHANGES REQUESTED}
+
+### Critical
+- [ ] {file}:{line} — {the reactivity/SSR trap} → {the fix}
+
+### High
+- [ ] {file}:{line} — {the issue} → {the fix}
+
+### Positive
+{what handles reactivity and SSR correctly}
+```

package/knowledge/skills-manifest.json

@@ -1,7 +1,7 @@
 {
   "_meta": {
     "generator": "scripts/marketplace_gen.py",
-    "version": "4.18.0",
+    "version": "4.20.0",
     "marketplace": "arkaos"
   },
   "structural": {
@@ -580,9 +580,7 @@
       ],
       "collision": false,
       "provenance": {
-        "origin": "ecc-derived",
-        "source": "https://github.com/affaan-m/ecc",
-        "license": "MIT"
+        "origin": "arkaos"
       }
     },
     "code-review": {
@@ -1097,6 +1095,19 @@
         "origin": "arkaos"
       }
     },
+    "exploit-triage": {
+      "depts": [
+        "dev"
+      ],
+      "curated": false,
+      "plugins": [
+        "arkaos-dev@arkaos"
+      ],
+      "collision": false,
+      "provenance": {
+        "origin": "arkaos"
+      }
+    },
     "extract-data": {
       "depts": [
         "strategy"
@@ -1438,6 +1449,19 @@
         "origin": "arkaos"
       }
     },
+    "laravel-review": {
+      "depts": [
+        "dev"
+      ],
+      "curated": false,
+      "plugins": [
+        "arkaos-dev@arkaos"
+      ],
+      "collision": false,
+      "provenance": {
+        "origin": "arkaos"
+      }
+    },
     "launch-execute": {
       "depts": [
         "saas"
@@ -1622,6 +1646,32 @@
         "origin": "arkaos"
       }
     },
+    "ml-adoption-playbook": {
+      "depts": [
+        "dev"
+      ],
+      "curated": false,
+      "plugins": [
+        "arkaos-dev@arkaos"
+      ],
+      "collision": false,
+      "provenance": {
+        "origin": "arkaos"
+      }
+    },
+    "mle-workflow": {
+      "depts": [
+        "dev"
+      ],
+      "curated": false,
+      "plugins": [
+        "arkaos-dev@arkaos"
+      ],
+      "collision": false,
+      "provenance": {
+        "origin": "arkaos"
+      }
+    },
     "moat-analysis": {
       "depts": [
         "strategy"
@@ -2127,9 +2177,7 @@
       ],
       "collision": false,
       "provenance": {
-        "origin": "ecc-derived",
-        "source": "https://github.com/affaan-m/ecc",
-        "license": "MIT"
+        "origin": "arkaos"
       }
     },
     "premortem": {
@@ -2238,6 +2286,19 @@
         "origin": "arkaos"
       }
     },
+    "python-review": {
+      "depts": [
+        "dev"
+      ],
+      "curated": false,
+      "plugins": [
+        "arkaos-dev@arkaos"
+      ],
+      "collision": false,
+      "provenance": {
+        "origin": "arkaos"
+      }
+    },
     "quality-management": {
       "depts": [
         "ops"
@@ -2453,6 +2514,19 @@
         "origin": "arkaos"
       }
     },
+    "safety-review": {
+      "depts": [
+        "dev"
+      ],
+      "curated": false,
+      "plugins": [
+        "arkaos-dev@arkaos"
+      ],
+      "collision": false,
+      "provenance": {
+        "origin": "arkaos"
+      }
+    },
     "scaffold": {
       "depts": [
         "dev"
@@ -2587,9 +2661,7 @@
       ],
       "collision": false,
       "provenance": {
-        "origin": "ecc-derived",
-        "source": "https://github.com/affaan-m/ecc",
-        "license": "MIT"
+        "origin": "arkaos"
       }
     },
     "skill-audit": {
@@ -2891,9 +2963,20 @@
       ],
       "collision": false,
       "provenance": {
-        "origin": "ecc-derived",
-        "source": "https://github.com/affaan-m/ecc",
-        "license": "MIT"
+        "origin": "arkaos"
+      }
+    },
+    "typescript-review": {
+      "depts": [
+        "dev"
+      ],
+      "curated": false,
+      "plugins": [
+        "arkaos-dev@arkaos"
+      ],
+      "collision": false,
+      "provenance": {
+        "origin": "arkaos"
       }
     },
     "unit-economics": {
@@ -3024,6 +3107,19 @@
         "origin": "arkaos"
       }
     },
+    "vue-review": {
+      "depts": [
+        "dev"
+      ],
+      "curated": false,
+      "plugins": [
+        "arkaos-dev@arkaos"
+      ],
+      "collision": false,
+      "provenance": {
+        "origin": "arkaos"
+      }
+    },
     "webinar-funnel": {
       "depts": [
         "landing"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arkaos",
-  "version": "4.18.0",
+  "version": "4.20.0",
   "description": "The Operating System for AI Agent Teams",
   "type": "module",
   "bin": {

package/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "arkaos-core"
-version = "4.18.0"
+version = "4.20.0"
 description = "Core engine for ArkaOS — The Operating System for AI Agent Teams"
 readme = "README.md"
 license = {text = "MIT"}