arkaos 4.32.0 → 4.34.0

package/README.md

@@ -2,7 +2,7 @@
 
 **The Operating System for AI Agent Teams.**
 
-89 agents. 17 departments. 330 skills. Enterprise frameworks. Multi-runtime. One install.
+89 agents. 17 departments. 331 skills. Enterprise frameworks. Multi-runtime. One install.
 
 ```bash
 npx arkaos install

package/THE-ARKAOS-GUIDE.md

@@ -1,6 +1,6 @@
 # The ArkaOS Guide
 
-> v4.32.0 — 89 agents, 17 departments, 330 skills, 297 commands, 16 ADRs.
+> v4.34.0 — 89 agents, 17 departments, 331 skills, 297 commands, 16 ADRs.
 > One file, everything you need to start. Generated by `scripts/guide_gen.py` — never hand-edited.
 
 ## What it is

package/VERSION

@@ -1 +1 @@
-4.32.0
+4.34.0

package/arka/SKILL.md

@@ -47,7 +47,7 @@ complementary, not alternatives.
 # ArkaOS — Main Orchestrator
 
 > **The Operating System for AI Agent Teams**
-> 89 agents. 17 departments. 330 skills. Multi-runtime. Dashboard. Knowledge RAG.
+> 89 agents. 17 departments. 331 skills. Multi-runtime. Dashboard. Knowledge RAG.
 
 ## ⛔ Evidence flow — 4 gates (NON-NEGOTIABLE)
 

package/arka/skills/forge/references/workflows.md

@@ -190,6 +190,16 @@ Tell user: "Visual companion available at http://localhost:<port>/forge-<id>.htm
 Note: For `shallow` tier, companion is not generated (`should_suggest_companion()` returns `"none"`).
 For `standard`, it is available on request. For `deep`, proactively suggest it.
 
+**Richer option — plan diagram via `dev/diagram`:** for `standard`/`deep`
+tiers, additionally offer an interactive plan diagram. Load the
+`dev/diagram` skill, author a `workflow` IR from the plan (`plan_phases`
+→ lane nodes in execution order, phase dependencies → edges, key
+deliverables → cards), and deliver it to the same `/tmp` directory as
+`/tmp/diagram-forge-<plan_id>.html` — the `http.server` above serves
+both artifacts side by side. The radar remains the default companion
+(zero Node dependency); if Node is unavailable, the radar is the only
+companion — never block the Forge on the diagram.
+
 ### Step 9 — Handoff (on Approve)
 
 1. Check for repo drift since the snapshot:

package/config/claude-agents/architect.md

@@ -1,7 +1,7 @@
 ---
 name: architect
 description: >
-  Gabriel — Software Architect (dev squad). Executes: system design, domain modeling (event storming, bounded contexts), design patterns (GoF, PoEAA), business / domain analysis.
+  Gabriel — Software Architect (dev squad). Executes: system design, system visualization via dev/diagram (architecture + dataflow diagrams delivered as browser artifacts), domain modeling (event storming, bounded contexts), design patterns (GoF, PoEAA).
 model: sonnet
 ---
 

package/config/claude-agents/backend-dev.md

@@ -1,7 +1,7 @@
 ---
 name: backend-dev
 description: >
-  Andre — Backend Core Lead (dev squad). Executes: Laravel 11 / PHP 8.3, PostgreSQL / Supabase, REST API design, Service + Repository pattern.
+  Andre — Backend Core Lead (dev squad). Executes: Laravel 11 / PHP 8.3, PostgreSQL / Supabase, REST API design, API flow visualization via dev/diagram (sequence diagrams for endpoint contracts and async jobs).
 model: sonnet
 ---
 

package/config/claude-agents/devops-eng.md

@@ -1,7 +1,7 @@
 ---
 name: devops-eng
 description: >
-  Carlos — DevOps Lead (dev squad). Executes: CI/CD pipelines (GitHub Actions, GitLab CI), container orchestration (Docker, Kubernetes), infrastructure as code (Terraform, Pulumi), cloud platforms (Vercel, Azure, AWS).
+  Carlos — DevOps Lead (dev squad). Executes: CI/CD pipelines (GitHub Actions, GitLab CI), release visualization via dev/diagram (lifecycle + workflow diagrams for pipelines and rollouts), container orchestration (Docker, Kubernetes), infrastructure as code (Terraform, Pulumi).
 model: sonnet
 ---
 

package/config/claude-agents/frontend-dev.md

@@ -1,7 +1,7 @@
 ---
 name: frontend-dev
 description: >
-  Diana — Senior Frontend Developer (dev squad). Executes: Vue 3 (Composition API), motion-reference analysis via dev/watch (scroll/animation benchmarks from frames + transcript before implementing), Nuxt 3, React 19 / Next.js 15.
+  Diana — Senior Frontend Developer (dev squad). Executes: Vue 3 (Composition API), motion-reference analysis via dev/watch (scroll/animation benchmarks from frames + transcript before implementing), user-flow visualization via dev/diagram (workflow diagrams for page and interaction flows), Nuxt 3.
 model: opus
 ---
 

package/config/claude-agents/ops-lead.md

@@ -1,7 +1,7 @@
 ---
 name: ops-lead
 description: >
-  Daniel — Operations Lead (ops squad). Executes: workflow automation (Zapier, Make, n8n), process mapping & optimization, SOP creation & management, bottleneck analysis.
+  Daniel — Operations Lead (ops squad). Executes: workflow automation (Zapier, Make, n8n), SOP/process visualization via dev/diagram (workflow + lifecycle diagrams for automations and runbooks), process mapping & optimization, SOP creation & management.
 model: sonnet
 ---
 

package/config/claude-agents/pm-director.md

@@ -1,7 +1,7 @@
 ---
 name: pm-director
 description: >
-  Carolina — Product Manager (pm squad). Executes: continuous product discovery (daily habit), weekly customer interviewing, dual-track agile (discovery + delivery), product risk assessment (value/usability/feasibility/viability).
+  Carolina — Product Manager (pm squad). Executes: continuous product discovery (daily habit), deliverable visualization via dev/diagram (workflow diagrams so stakeholders see scope before build), weekly customer interviewing, dual-track agile (discovery + delivery).
 model: sonnet
 ---
 

package/config/claude-agents/strategy-director.md

@@ -1,7 +1,7 @@
 ---
 name: strategy-director
 description: >
-  Tomas — Chief Strategist (strategy squad). Executes: competitive strategy, market analysis, business model design, positioning.
+  Tomas — Chief Strategist (strategy squad). Executes: competitive strategy, business-flow visualization via dev/diagram (architecture + dataflow diagrams of business models and value chains), market analysis, business model design.
 model: sonnet
 ---
 

package/config/hooks/session-start.sh

@@ -32,6 +32,6 @@ fi
 
 # ─── Degraded fallback: static banner, valid JSON, exit 0 ──────────────
 cat <<'EOF'
-{"systemMessage": "\n╔══════════════════════════════════════════════╗\n║              A R K A   O S                   ║\n║   The Operating System for AI Teams          ║\n╚══════════════════════════════════════════════╝\nOlá, founder (WizardingCode)\nArkaOS (degraded: no usable interpreter — run npx arkaos doctor)"}
+{"systemMessage": "\n  ▲  A R K A   O S\n     The Operating System for AI Agent Teams\n\n  Olá, founder\n  degraded: no usable interpreter — run npx arkaos doctor"}
 EOF
 exit 0

package/config/skills-curated.yaml

@@ -24,8 +24,8 @@ curated_subskills:
   community: [moderation]
   content: [calendar, hook-write]
   dev: [api-design, architecture-design, clean-code-review, code-review,
-        db-design, refactor-plan, runbook, security-audit, spec, tdd-cycle,
-        watch]
+        db-design, diagram, refactor-plan, runbook, security-audit, spec,
+        tdd-cycle, watch]
   ecom: [cart-recovery, store-audit]
   finance: [financial-model, unit-economics]
   kb: [search-kb, zettelkasten-process]

package/config/skills-provenance.yaml

@@ -97,6 +97,13 @@ derived:
     origin: community
     source: https://github.com/bradautomates/claude-video
     license: MIT
+  # Diagram absorption campaign — visual spec/plan output derived from
+  # tt-a1i/archify v2.11.0 (MIT; portions Cocoon AI), vendored verbatim
+  # under vendor/ and maintained natively.
+  departments/dev/skills/diagram:
+    origin: community
+    source: https://github.com/tt-a1i/archify
+    license: MIT
   # Marketing skills integration campaign — derived from
   # coreyhaines31/marketingskills (MIT). Frontmatter metadata must match
   # each entry field-for-field (test_registry_matches_frontmatter_field_for_field).

package/config/statusline.sh

@@ -173,7 +173,12 @@ if [ -f "$ARKA_CONFIG" ]; then
 fi
 
 # ─── Build Line 1: Context bar ───────────────────────────────────────────
-LINE1="${C_CYAN}▲ARKA${C_RESET}  ${C_WHITE}${DIR_NAME}${C_RESET}"
+# Version from the stable snapshot (one cat, no spawn storm on re-render).
+ARKA_VER=""
+if [ -f "$HOME/.arkaos/lib/VERSION" ]; then
+  ARKA_VER=$(tr -d '[:space:]' < "$HOME/.arkaos/lib/VERSION" 2>/dev/null)
+fi
+LINE1="${C_CYAN}▲ARKA${C_RESET}${ARKA_VER:+ ${C_DIM}v${ARKA_VER}${C_RESET}}  ${C_WHITE}${DIR_NAME}${C_RESET}"
 
 # Git branch (hidden on main/master to reduce noise)
 if [ -n "$BRANCH" ] && [ "$BRANCH" != "main" ] && [ "$BRANCH" != "master" ]; then

package/core/hooks/session_start.py

@@ -7,13 +7,15 @@ print) with ONE python process that emits the full ``systemMessage``.
 Measured baseline before this consolidation: 251ms p50 (isolated floor,
 benchmarks/results.md); each spawn costs ~20-80ms.
 
-Section order preserved exactly from the shell version:
-    banner+greeting → workflow line → version+forge+drift →
-    evidence-flow contract → meta-tag contract → Model Fabric directive
-    → [SESSION] rehydrator resume → [SESSION-MEMORY] recap → JSON out.
+Presentation contract (Foundation PR-2): the user sees a compact branded
+greeting — ``systemMessage`` carries ONLY banner+greeting, workflow/forge
+state, and the drift warning. Everything the MODEL needs but the user
+should not scroll through (evidence-flow contract, meta-tag contract,
+authority brief, Model Fabric directive, [SESSION] resume,
+[SESSION-MEMORY] recap) ships via ``hookSpecificOutput.
+additionalContext`` — same enforcement, zero wall of text.
 Background side effects (reorganizer trigger, dashboard ensure) stay
-detached and are config-gated; the NEW ``cognition.reorganize_on_session``
-gate lands here (QG F2-1 follow-up, endorsed for this PR).
+detached and are config-gated (``cognition.reorganize_on_session``).
 
 The shell wrapper only resolves the interpreter and ``exec``s this
 module; with no usable venv it emits a static banner (fail-open).
@@ -35,17 +37,21 @@ _BUDGET_MS = 300
 _RECAP_ITEMS = 3
 _SUMMARY_CHARS = 130
 
-_BANNER = (
-    "\n╔══════════════════════════════════════════════╗\n"
-    "║                                              ║\n"
-    "║              A R K A   O S                   ║\n"
-    "║                                              ║\n"
-    "║   The Operating System for AI Teams          ║\n"
-    "║                  by WizardingCode            ║\n"
-    "║                                              ║\n"
-    "╚══════════════════════════════════════════════╝\n"
+# Compact wordmark (Levitation identity: flat apex + floating bar) — the
+# box-drawing wall it replaces read as a default terminal artifact.
+_FALLBACK_BANNER = (
+    "\n  ▲  A R K A   O S\n"
+    "     The Operating System for AI Agent Teams\n"
 )
 
+
+def _banner(version: str, name: str, company: str) -> str:
+    return (
+        f"\n  ▲  A R K A   O S — v{version}\n"
+        f"     The Operating System for AI Agent Teams · {company}\n"
+        f"\n  Olá, {name}\n"
+    )
+
 _EVIDENCE_CONTRACT = (
     "\n\n[ARKA:EVIDENCE-FLOW] NON-NEGOTIABLE. Every non-trivial request runs"
     " the 4-gate evidence flow (constitution rule evidence-flow; source"
@@ -266,27 +272,52 @@ def _authority_brief(cwd: str) -> str:
     return f"\n\n{brief}" if brief else ""
 
 
-def build_message(cwd: str) -> str:
+def build_visible(cwd: str) -> str:
+    """User-facing ``systemMessage``: branded greeting + live state only.
+
+    Owns the background side effects (reorganizer, dashboard ensure) so
+    they fire exactly once per session regardless of which builder a
+    caller combines.
+    """
     repo = repo_path()
     config = _config()
     name, company = _profile()
     version = _version(repo)
-    msg = _BANNER + f"\nOlá, {name} ({company})\n"
+    msg = _banner(version, name, company)
     msg += _workflow_line()
-    msg += f"ArkaOS v{version}"
     msg += _forge_line()
     msg += _drift(version)
-    msg += _EVIDENCE_CONTRACT
-    msg += _META_TAG_CONTRACT
-    msg += _authority_brief(cwd)
-    msg += _model_fabric()
     _trigger_reorganizer(repo, config)
     _ensure_dashboard(repo, config)
-    msg += _session_resume()
+    return msg
+
+
+def build_context(cwd: str) -> str:
+    """Model-only ``additionalContext``: the operating contracts.
+
+    Same text that used to flood the visible banner — the enforcement
+    surfaces (PreToolUse gate, Stop hook) read the model's OUTPUT
+    markers, so moving the injected contracts off-screen changes nothing
+    about enforcement.
+    """
+    parts = [
+        _EVIDENCE_CONTRACT,
+        _META_TAG_CONTRACT,
+        _authority_brief(cwd),
+        _model_fabric(),
+        _session_resume(),
+    ]
     recap = build_recap(cwd)
     if recap:
-        msg += f"\n\n{recap}"
-    return msg
+        parts.append(f"\n\n{recap}")
+    return "".join(parts).lstrip("\n")
+
+
+def build_message(cwd: str) -> str:
+    """Full text (visible + contracts) — legacy single-string view."""
+    visible = build_visible(cwd)
+    context = build_context(cwd)
+    return visible + (f"\n\n{context}" if context else "")
 
 
 def build_recap(cwd: str, budget_ms: int = _BUDGET_MS) -> str:
@@ -336,10 +367,20 @@ def main(stdin_json: dict | None = None) -> int:
         or os.getcwd()
     )
     try:
-        message = build_message(cwd)
+        visible = build_visible(cwd)
     except Exception:  # absolute fail-open: static banner, exit 0
-        message = _BANNER + "\nOlá, founder (WizardingCode)\nArkaOS"
-    print(json.dumps({"systemMessage": message}))
+        visible = _FALLBACK_BANNER + "\n  Olá, founder\n"
+    try:
+        context = build_context(cwd)
+    except Exception:  # contracts are best-effort; greeting never breaks
+        context = ""
+    payload: dict = {"systemMessage": visible}
+    if context:
+        payload["hookSpecificOutput"] = {
+            "hookEventName": "SessionStart",
+            "additionalContext": context,
+        }
+    print(json.dumps(payload))
     return 0
 
 

package/departments/dev/agents/architect.yaml

@@ -50,6 +50,7 @@ authority:
 expertise:
   domains:
     - system design
+    - system visualization via dev/diagram (architecture + dataflow diagrams delivered as browser artifacts)
     - domain modeling (event storming, bounded contexts)
     - design patterns (GoF, PoEAA)
     - business / domain analysis

package/departments/dev/agents/backend-dev.yaml

@@ -53,6 +53,7 @@ expertise:
     - Laravel 11 / PHP 8.3
     - PostgreSQL / Supabase
     - REST API design
+    - API flow visualization via dev/diagram (sequence diagrams for endpoint contracts and async jobs)
     - Service + Repository pattern
     - Database migrations & indexing
     - Queue systems (Horizon)

package/departments/dev/agents/devops-eng.yaml

@@ -46,6 +46,7 @@ authority:
 expertise:
   domains:
     - CI/CD pipelines (GitHub Actions, GitLab CI)
+    - release visualization via dev/diagram (lifecycle + workflow diagrams for pipelines and rollouts)
     - container orchestration (Docker, Kubernetes)
     - infrastructure as code (Terraform, Pulumi)
     - cloud platforms (Vercel, Azure, AWS)

package/departments/dev/agents/frontend-dev.yaml

@@ -48,6 +48,7 @@ expertise:
   domains:
     - Vue 3 (Composition API)
     - motion-reference analysis via dev/watch (scroll/animation benchmarks from frames + transcript before implementing)
+    - user-flow visualization via dev/diagram (workflow diagrams for page and interaction flows)
     - Nuxt 3
     - React 19 / Next.js 15
     - TypeScript

package/departments/dev/agents/tech-lead.yaml

@@ -50,6 +50,7 @@ authority:
 expertise:
   domains:
     - workflow orchestration
+    - visual spec/plan companions via dev/diagram (typed IR -> interactive HTML the user opens before build)
     - code quality enforcement
     - sprint/cycle management
     - technical decision-making

package/departments/dev/skills/diagram/SKILL.md

@@ -0,0 +1,175 @@
+---
+name: dev/diagram
+description: >
+  Turn a spec, plan, or system description into an interactive diagram the
+  user opens in a browser — one self-contained HTML file, five typed modes
+  (architecture, workflow, sequence, dataflow, lifecycle). The agent authors
+  a JSON IR, a vendored zero-dependency Node CLI validates it against JSON
+  Schemas, renders it, runs semantic gates (clean-flow/clean-label), and
+  emits a sha256 receipt. TRIGGER: "diagrama", "desenha a arquitetura",
+  "mostra-me visualmente", "visual da spec", "quero ver o fluxo", "diagram
+  this", "/dev diagram"; the Visual Spec Companion step in dev/spec; the
+  Forge visual-companion option for MEDIUM/HIGH plans. SKIP: DECIDING or
+  evaluating the architecture itself -> dev/architecture-design (this
+  skill only draws the result); database ERDs -> dev/db-schema (Mermaid
+  ERD); page wireframes/sitemaps -> brand/wireframe and
+  landing/page-architect; data charts and dashboards -> the dataviz
+  skill; the Forge complexity radar -> the Forge's built-in companion
+  (core/forge/renderer.py).
+allowed-tools: [Read, Write, Bash, AskUserQuestion]
+metadata:
+  origin: community
+  source: https://github.com/tt-a1i/archify
+  license: MIT
+---
+
+<!-- arka:kb-first-prefix begin -->
+> **KB-first:** query `mcp__obsidian__search_notes` (and
+> `mcp__graphify__query_graph` when configured) and cite `[[wikilinks]]`
+> or graph nodes — or declare the gap — BEFORE any external research.
+> Full doctrine: `arka/SKILL.md` (KB-First Research).
+<!-- arka:kb-first-prefix end -->
+
+# /diagram — visual output for specs, plans, and systems
+
+> **Agent:** Gabriel (Architect) + Paulo (Tech Lead) | **Framework:** Typed JSON IR, JSON Schema 2020-12, semantic layout gates
+
+The user should SEE what will be built before it is built. This skill turns
+a described system into a single self-contained HTML diagram (~530KB) with
+theme switching, focused exploration, guided views, and PNG/SVG/WebM export
+— no runtime dependencies, no telemetry. The only external reference is an
+async Google Fonts stylesheet (JetBrains Mono) that degrades to system
+monospace offline.
+
+Absorbed from `tt-a1i/archify` v2.11.0 (MIT; portions Cocoon AI) and
+maintained natively by ArkaOS. The upstream engine lives verbatim under
+`vendor/`; you author the IR, the CLI does everything else. NEVER hand-edit
+the generated HTML — fix the IR and re-deliver.
+
+## Resolve `SKILL_DIR` (before any command)
+
+Set `SKILL_DIR` to the absolute path of the directory containing THIS
+SKILL.md (your harness showed it when you Read this file). Guard once:
+
+```bash
+[ -f "$SKILL_DIR/vendor/bin/archify.mjs" ] || { echo "archify.mjs not under $SKILL_DIR" >&2; exit 1; }
+```
+
+## Step 0 — preflight (silent on success)
+
+```bash
+command -v node >/dev/null && node -e 'process.exit(+process.versions.node.split(".")[0] >= 18 ? 0 : 1)'
+```
+
+Non-zero → stop and tell the user plainly: this skill needs Node.js >= 18
+(`brew install node` on macOS, https://nodejs.org elsewhere). There is no
+auto-install. When in doubt about the vendor payload itself, run
+`node "$SKILL_DIR/vendor/bin/archify.mjs" doctor`.
+
+## Step 1 — choose the diagram type
+
+| Type | Best for | IR collections |
+|------|----------|----------------|
+| `architecture` | components, services, storage, trust boundaries | `components` + `connections` |
+| `workflow` | CI/CD, approvals, tool calls, runbooks, plan phases | `nodes` (in `lanes`/`cols`) + `edges` |
+| `sequence` | API calls, cache fallback, auth handshakes, async traces | `participants` + `messages` |
+| `dataflow` | pipelines, lineage, PII paths, consumers | `nodes` + `flows` |
+| `lifecycle` | states, retries, waits, terminal outcomes | `states` + `transitions` |
+
+Unsure? Ask the recommender — it returns a bounded recipe:
+
+```bash
+node "$SKILL_DIR/vendor/bin/archify.mjs" guide "<one-line description of the situation>"
+```
+
+`examples` lists the 10 bundled sample IRs (`vendor/examples/*.json`) —
+Read the one closest to your case as a structural reference.
+
+## Step 2 — author the IR
+
+Write `<slug>.<type>.json` to `/tmp` (or the session scratchpad). Every IR
+needs `schema_version: 1`, `diagram_type: "<type>"`, and `meta.title`;
+`meta` also takes `subtitle`, `visual_preset` (`classic|signal-flow|
+blueprint`), `views` (max 5 guided views), and `animation: "trace"` (motion
+is opt-in — leave it off unless asked). Keep one bounded view: 8–12 core
+nodes, one primary path, supporting detail in `cards` instead of extra
+edges.
+
+For per-mode layout rules (lanes/cols, pinning, sequence ordering,
+architecture `pos` grid), Read ONLY the relevant mode section of the
+upstream deep guide at `$SKILL_DIR/vendor/SKILL.md` — do not load all 61KB.
+
+Validate before delivering; error messages carry the offending node
+`id`/`label` so you can fix the IR surgically:
+
+```bash
+node "$SKILL_DIR/vendor/bin/archify.mjs" validate <type> /tmp/<slug>.<type>.json --json
+```
+
+## Step 3 — deliver
+
+```bash
+node "$SKILL_DIR/vendor/bin/archify.mjs" deliver <type> /tmp/<slug>.<type>.json \
+  /tmp/diagram-<slug>.html --json --open --quality standard
+```
+
+Deliver renders to a staging file, runs the artifact checks, atomically
+renames on pass, and emits a JSON receipt. `--open` opens the artifact
+natively; on a headless/remote session drop `--open` and reuse the Forge
+Step 6a convention instead (`python -m http.server 0 --directory /tmp`,
+then `open http://localhost:<port>/diagram-<slug>.html`). Use
+`--quality showcase` only when the user asks for a presentation-grade
+artifact — it fails on dense-but-legal topologies that `standard` accepts.
+
+## Step 4 — read the receipt, report honestly
+
+Parse the receipt JSON. On success report: artifact path,
+`validation.checksPassed`/`checkCount`, `compositionProfile`/`Status`, and
+`artifact.sha256`. On failure the receipt carries `ok: false`, a `stage`,
+and the failing check — fix the IR accordingly and re-deliver. Two common
+gates: **clean-flow** (an edge crossing an unrelated node is always a hard
+failure — reroute or move the node) and **clean-label** (label mask too
+close to another route — nudge the label or spread lanes).
+
+## Step 5 — persistence (optional)
+
+The HTML is an ephemeral deliverable in `/tmp`. When the diagram belongs to
+a durable deliverable (a spec, a Forge plan, an SOP):
+
+- save the IR JSON (small, regenerable source of truth) to the vault next
+  to the note, e.g. `Projects/<name>/Specs/visuals/SPEC-<slug>.<type>.json`;
+- record the artifact in the note's frontmatter `visuals:` list as
+  `{type, ir, html, sha256}`;
+- copy the HTML itself into the vault only when the user asks.
+
+Ask before writing to the vault when the user did not request persistence.
+
+## Output template
+
+```
+Diagram: <type> — <title>
+IR:       /tmp/<slug>.<type>.json
+Artifact: /tmp/diagram-<slug>.html  (sha256 <first-12>)
+Checks:   <checksPassed>/<checkCount> passed · composition <status>
+Opened:   <natively | http://localhost:<port>/… | not opened (reason)>
+```
+
+## Failure modes
+
+- Node missing or < 18 → stop with the install hint; never degrade to
+  ASCII art silently — say the visual companion is unavailable and why.
+- `validate` fails → fix the IR at the reported `id`/`label`; re-validate.
+- `deliver` fails a gate → the previous artifact (if any) is untouched;
+  fix the IR, never the HTML.
+- Dense topology keeps failing `showcase` → deliver with `standard` and
+  say so; `standard` keeps renderable-but-dense layouts as warnings.
+
+## Security
+
+Local-only: the CLI spawns only `node` subprocesses; the generated HTML
+makes no network calls (no fetch/eval/telemetry) except the optional
+Google Fonts stylesheet, and the footer link (when present) carries only
+the diagram type — never the title, graph, or source. Receipts include the
+artifact sha256 for integrity. Vendored engine: `vendor/` (bin, renderers,
+schemas, recipes, template, examples, test) — byte-identical to upstream
+v2.11.0 except trims listed in `docs/THIRD-PARTY-NOTICES.md`.

package/departments/dev/skills/diagram/examples/archify-repo-grid.architecture.json

@@ -0,0 +1,57 @@
+{
+  "schema_version": 1,
+  "diagram_type": "architecture",
+  "meta": {
+    "title": "Archify Pipeline",
+    "subtitle": "Grid placement demo — row/col instead of manual pos",
+    "output": "examples/archify-repo-grid.html"
+  },
+  "layout": {
+    "mode": "grid",
+    "origin": [40, 100],
+    "cols": 7,
+    "gapX": 24,
+    "gapY": 48,
+    "cellW": 120,
+    "cellH": 60
+  },
+  "components": [
+    { "id": "user", "type": "external", "label": "You", "sublabel": "NL / Mermaid", "row": 1, "col": 0 },
+    { "id": "agents", "type": "frontend", "label": "Agent Hosts", "sublabel": "Claude · Codex", "row": 1, "col": 1 },
+    { "id": "skill", "type": "frontend", "label": "SKILL.md", "sublabel": "layout rules", "row": 0, "col": 1 },
+    { "id": "ir", "type": "messagebus", "label": "JSON IR", "sublabel": "schema v1", "row": 1, "col": 2 },
+    { "id": "schemas", "type": "security", "label": "Schema", "sublabel": "ajv", "row": 0, "col": 2 },
+    { "id": "renderers", "type": "backend", "label": "Renderers ×5", "row": 1, "col": 3 },
+    { "id": "template", "type": "frontend", "label": "template.html", "row": 1, "col": 4 },
+    { "id": "checker", "type": "security", "label": "Output Check", "row": 1, "col": 5 },
+    { "id": "html", "type": "cloud", "label": "HTML", "sublabel": "artifact", "row": 1, "col": 6 }
+  ],
+  "boundaries": [
+    {
+      "kind": "region",
+      "label": "archify/ skill package",
+      "wraps": ["ir", "schemas", "renderers", "template", "checker"]
+    }
+  ],
+  "connections": [
+    { "from": "user", "to": "agents", "variant": "emphasis" },
+    { "from": "agents", "to": "skill", "fromSide": "top", "toSide": "bottom" },
+    { "from": "agents", "to": "ir", "variant": "emphasis" },
+    { "from": "ir", "to": "schemas", "variant": "security", "fromSide": "top", "toSide": "bottom" },
+    { "from": "ir", "to": "renderers", "variant": "emphasis" },
+    { "from": "renderers", "to": "template", "variant": "emphasis" },
+    { "from": "template", "to": "checker", "variant": "emphasis" },
+    { "from": "checker", "to": "html", "variant": "emphasis" }
+  ],
+  "cards": [
+    {
+      "dot": "cyan",
+      "title": "Grid mode",
+      "items": [
+        "Set layout.mode grid and place components with row/col",
+        "pos still overrides a cell when you need fine tuning",
+        "Not auto-layout — fixed cell spacing only"
+      ]
+    }
+  ]
+}

package/departments/dev/skills/diagram/vendor/LICENSE

@@ -0,0 +1,22 @@
+MIT License
+
+Copyright (c) 2026 tt-a1i (Archify)
+Copyright (c) 2025 Cocoon AI (original "architecture-diagram-generator")
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.