azcodr 1.0.0

package/.agents/skills/compliance-audit/SKILL.md

@@ -0,0 +1,120 @@
+---
+name: compliance-audit
+description: Use when conducting a security, compliance, or vulnerability audit against SOC 2 Type II, ISO/IEC 27001, or OWASP Top 10 controls using open-source scanners (Trivy, Semgrep, Gitleaks, Steampipe, Syft, Grype). Do not use for writing application business logic or routine test authoring.
+---
+
+# Compliance & Security Audit Skill (100% Open-Source)
+
+> **Core Purpose:** Execute systematic compliance and vulnerability evaluations against SOC 2 Type II Trust Services Criteria, ISO/IEC 27001 ISMS standards, and the OWASP Top 10 using exclusively open-source security toolchains.
+
+---
+
+## 1. When to Use This Skill
+- Preparing for or validating SOC 2 Type II readiness (access controls, tamper-evident audit logging, encryption).
+- Verifying ISO/IEC 27001 Annex A technical security controls.
+- Running comprehensive static analysis and vulnerability scans before a production release.
+- Generating software bill of materials (SBOM) and container vulnerability reports.
+- Reviewing sensitive data handling and GDPR/privacy erasure compliance.
+
+---
+
+## 2. Step-by-Step Audit Workflow
+
+```
+1. Secrets & Credentials ──► 2. SAST Analysis ──► 3. Dependency CVEs ──► 4. Architecture & Access ──► 5. Audit Report
+```
+
+### Step 1: Secret & Credential Scan (Open-Source)
+Run open-source secret scanners to verify zero committed keys, tokens, or credentials:
+```bash
+# Using open-source Gitleaks
+gitleaks detect --source . -v
+# Using open-source Secretlint
+npx secretlint "**/*"
+```
+*Pass Criteria:* 0 detected secrets or private keys in git history and working tree.
+
+### Step 2: Static Application Security Testing (SAST)
+Run open-source `semgrep` with security rulesets to detect injection flaws, insecure deserialization, and dangerous sinks:
+```bash
+semgrep --config p/security-audit --config p/owasp-top-ten .
+```
+*Pass Criteria:* 0 High or Critical vulnerabilities.
+
+### Step 3: Dependency & Container Vulnerability Scan
+Run open-source `trivy` and `grype` to audit lockfiles and containers for known CVEs:
+```bash
+# Filesystem CVE scan via Trivy
+trivy fs --severity HIGH,CRITICAL --scanners vuln,misconfig .
+# Generate CycloneDX SBOM via Syft
+syft dir:. -o cyclonedx-json=bom.json
+# Scan SBOM via Grype
+grype sbom:bom.json
+```
+*Pass Criteria:* 0 unpatched Critical or High CVEs in production dependencies.
+
+### Step 4: SOC 2 & ISO 27001 Control Verification
+Audit architectural implementation against compliance baselines:
+- **Audit Logging (CC7.2 / A.12)**: Are all state mutations logged with `{ timestamp, actorId, tenantId, action, entityType, entityId, ipAddress, userAgent, changes: { before, after } }`? Are audit logs write-only and tamper-evident?
+- **Access Control & RBAC (CC6.1 / A.9)**: Are built-in roles protected against mutation (`403 Forbidden`)? Is tenant isolation enforced on every query (`tenantId` predicate)?
+- **Cryptography (CC6.6 / A.10)**: Is TLS 1.3 enforced? Are passwords hashed using Argon2id or bcrypt? Is AES-256-GCM used for sensitive data at rest?
+- **Data Erasure & GDPR**: Does the tenant deletion endpoint cascade purge or pseudonymize user PII across all entities?
+
+---
+
+## 3. Gotchas & What NOT to Do
+
+- **DO NOT** use proprietary cloud security scanners when open-source equivalents exist (`trivy`, `semgrep`, `gitleaks`, `syft`, `grype`).
+- **DO NOT** ignore medium/low secrets warnings if they indicate staging credentials or API endpoints.
+- **DO NOT** pass an audit if audit logs lack the `actorId` or `tenantId`. Traceability is a mandatory SOC 2 requirement.
+- **DO NOT** accept raw SQL concatenation anywhere in the codebase. All queries must be parameterized.
+- **DO NOT** recommend disabling security checks or silencing scanner rules without a documented ADR exception in `memory.md`.
+
+---
+
+## 4. Structured Audit Output Template
+
+```markdown
+# Security & Compliance Audit Report
+
+- **Date:** [YYYY-MM-DD]
+- **Auditor:** AI Assistant (Compliance Audit Skill)
+- **Frameworks Evaluated:** SOC 2 Type II, ISO/IEC 27001, OWASP Top 10
+
+---
+
+## 1. Executive Summary
+- **Overall Status:** [PASS / CONDITIONAL PASS / FAIL]
+- **Critical Issues:** [Count]
+- **High Issues:** [Count]
+
+---
+
+## 2. Open-Source Tool Execution Evidence
+| Tool | Target | Status | Findings |
+|---|---|---|---|
+| `gitleaks` | Git Tree | PASS | 0 secrets found |
+| `semgrep` | Source Code | PASS | 0 critical SAST flaws |
+| `trivy` | Dependencies | PASS | 0 high/critical CVEs |
+
+---
+
+## 3. Compliance Control Evaluation Matrix
+| Framework | Control ID | Control Description | Status | Evidence / Notes |
+|---|---|---|---|---|
+| **SOC 2** | CC6.1 | Least-privilege RBAC & tenant isolation | PASS | Scoped queries in Prisma |
+| **SOC 2** | CC7.2 | Tamper-evident mutation audit logging | PASS | Audit table with actor tracing |
+| **ISO 27001** | A.10.1 | Cryptographic controls (AES-256, TLS 1.3) | PASS | TLS 1.3 configured, Argon2id auth |
+| **OWASP** | A01 | Broken Access Control checks | PASS | Server-side guards on all routes |
+
+---
+
+## 4. Required Remediation Actions
+1. [Action item #1 with assigned file and timeline]
+```
+
+---
+
+## 5. Subdirectories & Progressive Resources
+- [references/soc2_iso_controls.md](./references/soc2_iso_controls.md): Detailed mapping of SOC 2 Trust Services Criteria and ISO 27001 Annex A controls.
+- [references/owasp_top10_controls.md](./references/owasp_top10_controls.md): OWASP Top 10 verification checklist and remediation patterns.

package/.agents/skills/compliance-audit/references/owasp_top10_controls.md

@@ -0,0 +1,16 @@
+# OWASP Top 10 Verification Reference
+
+Verification guidelines for evaluating codebase resistance against the OWASP Top 10 vulnerabilities.
+
+| Vulnerability | Verification Target | Required Implementation Pattern |
+|---|---|---|
+| **A01: Broken Access Control** | Controllers, Route Guards | Server-side role and tenant checks on every endpoint. No client-only route security. |
+| **A02: Cryptographic Failures** | Config, Auth Services | TLS 1.3, Argon2id/Bcrypt for passwords, AES-256-GCM for sensitive fields. No custom hashing. |
+| **A03: Injection** | Database queries, OS calls | Parameterized Prisma queries; prohibit string template concatenation in SQL; avoid `child_process.exec`. |
+| **A04: Insecure Design** | Architectural Flows | Rate-limiting on public/auth routes via Redis; defense-in-depth threat modeling. |
+| **A05: Security Misconfig** | HTTP Headers, Errors | Helmet headers (`CSP`, `HSTS`, `nosniff`); mask stack traces via Standard Error Envelope. |
+| **A06: Vulnerable Components** | Dependencies | Zero high/critical CVEs in `npm audit` / `trivy fs .`; lockfiles committed and verified. |
+| **A07: Auth Failures** | Auth Controller, JWT | In-memory access tokens, HttpOnly refresh cookies, instant Redis JTI blocklisting. |
+| **A08: Software Integrity** | CI/CD, Dependencies | Lockfile SHA-512 hashes enforced; open-source `cosign` container signing. |
+| **A09: Logging Failures** | Logging, Middleware | Structured JSON logs (`pino`) with `x-request-id`; zero credentials or PII in logs. |
+| **A10: SSRF** | Outbound HTTP Clients | Block outbound requests to internal/private IPs (`127.0.0.1`, `10.0.0.0/8`, `169.254.169.254`). |

package/.agents/skills/compliance-audit/references/soc2_iso_controls.md

@@ -0,0 +1,28 @@
+# SOC 2 Type II & ISO 27001 Controls Reference
+
+Mapping of technical compliance controls to concrete software verification steps.
+
+---
+
+## 1. Access Control (SOC 2 CC6.1 / ISO 27001 A.9)
+- **Tenant Boundary Isolation**: Every database interaction must filter by the authenticated tenant ID (`where: { tenantId, ... }`). Cross-tenant access must return 403 or 404.
+- **Role Immutability**: Built-in system roles (e.g. `SUPER_ADMIN`, `SYSTEM`) must reject modification or deletion with an explicit `403 Forbidden` response.
+- **Session Expiry**: User access tokens must have short lifespans (15–30 minutes) stored in-memory; refresh tokens must be revoked immediately upon logout via Redis blocklist.
+
+---
+
+## 2. Audit Trails & Monitoring (SOC 2 CC7.2 / ISO 27001 A.12)
+- **Immutable Log Storage**: All state mutations must write an audit record with:
+  - `timestamp`: ISO-8601 UTC string.
+  - `actorId`: User ID initiating the mutation.
+  - `tenantId`: Tenant context ID.
+  - `action`: e.g. `CREATE_ROLE`, `DELETE_MEMBER`, `UPDATE_PAYMENT`.
+  - `entityType` & `entityId`.
+  - `ipAddress` & `userAgent`.
+- **Log Integrity**: Audit records must never be updated or deleted by standard application operations.
+
+---
+
+## 3. Cryptography & Data Protection (SOC 2 CC6.6 / ISO 27001 A.10)
+- **In-Transit**: TLS 1.3 enforced on reverse proxy / ingress. Strict Transport Security (`HSTS`) header enabled with `max-age=31536000; includeSubDomains`.
+- **At-Rest**: Database disks encrypted via AES-256; sensitive tokens or credentials stored as salted hashes (`argon2id` or `bcrypt`) or encrypted payloads.

package/.agents/skills/lets-build/SKILL.md

@@ -0,0 +1,164 @@
+---
+name: lets-build
+description: Use when initializing or bootstrapping a new project from this template workspace, or when the user invokes '/lets-build' to conduct deep research and relentless questioning across language, stack, frameworks, package managers, databases, and architectural layers, followed by scaffolding the finalized project. Do not use for routine bug fixing, editing existing code features, or auditing already bootstrapped projects.
+---
+
+# Let's Build: Interactive Architecture Research & Project Bootstrapper
+
+> **Core Purpose:** Conduct an exhaustive, relentless architectural interview across all 18 systemic dimensions to finalize technical choices (language, runtime, frameworks, package managers, databases, tenancy, auth, workflows, observability, CI/CD) with zero assumptions, synthesize an approved ADR, and bootstrap the project following strict Hexagonal architecture.
+
+---
+
+## 1. When to Use This Skill
+
+- When the user starts a fresh project by copying this workspace into a new directory.
+- When the user explicitly invokes `/lets-build` or asks to initialize/scaffold a new application.
+- When transforming or re-architecting an existing project to adhere to the 41 atomic domain rules.
+- **Do NOT use for**:
+  - Routine bug fixes or minor edits on an already bootstrapped codebase.
+  - Adding a single endpoint or modifying an existing domain model.
+  - Running security audits (use `compliance-audit`).
+  - Refactoring existing code smells (use `clean-code-refactor`).
+
+---
+
+## 2. Step-by-Step Execution Workflow
+
+Progress through five mandatory stages:
+
+```
+1. DISCOVER (Toolchain & Root) ──► 2. INTERROGATE (Relentless Interview) ──► 3. SYNTHESIZE (ADR & Blueprint) ──► 4. BOOTSTRAP (Scaffold Code) ──► 5. VERIFY (Prove Health)
+```
+
+---
+
+### Phase 1: Discover (Toolchain & Workspace Inspection)
+1. Inspect the workspace root: confirm whether this is a fresh copy or an existing codebase.
+2. Check for pre-installed development runtimes and CLI tools (`go`, `rustc`/`cargo`, `python3`/`uv`, `node`/`pnpm`, `docker`, `atlas`, `semgrep`).
+3. Verify that `AGENTS.md`, `memory.md`, and `docs/rules/` exist and remain intact.
+
+---
+
+### Phase 2: Interrogate (The Relentless Architecture Interview)
+Do NOT guess or assume any technology or stack choice. Execute the relentless interrogation using [references/architecture_interview_matrix.md](./references/architecture_interview_matrix.md). Group questions logically into digestible batches:
+
+#### Batch 1: Domain, Performance & Language
+1. **Domain & Problem Statement:** What is the business problem, expected scale (RPS, active tenants), and compliance requirements (SOC 2, ISO 27001, GDPR)?
+2. **Primary Programming Language & Runtime:** Go, Rust, Python, TypeScript, Java/Kotlin, C#, or Polyglot microservices?
+3. **Package Manager & Toolchain:** Specific package manager (e.g. `uv` vs `poetry`, `cargo`, `pnpm`, `go modules`) and task runner?
+
+#### Batch 2: Transports, Protocols & Persistence
+4. **Transport & Network:** REST (OpenAPI 3.1), gRPC (Protobuf v3 via `buf`), GraphQL, or Event-Driven? Which web/transport framework?
+5. **Database & Storage Engine:** Relational (PostgreSQL, MySQL, CockroachDB, SQLite) vs Document (MongoDB) vs Hybrid? ORM vs Query Builder vs raw SQL? Canonical 6 Total Audit Fields?
+6. **Database Migration Tooling:** Declarative migrations (**Atlas**) vs versioned SQL (**Flyway**, **Liquibase**, **Goose**)?
+7. **Multi-Tenancy Isolation Model:** AST query interceptor, Database RLS, Schema-per-tenant, or Database-per-tenant?
+8. **Dynamic Schemas & Extensibility:** Universal **JSON Schema Draft 2020-12** in semi-structured columns, EAV, or virtual columns?
+
+#### Batch 3: Pluggable Logic, Security & Identity
+9. **Dynamic Business Logic:** Common Expression Language (CEL), GoF Strategy registries, or WebAssembly (Extism) sandboxes?
+10. **Workflow Orchestration:** Temporal.io durable execution vs Camunda/Zeebe (BPMN 2.0) vs statecharts?
+11. **Authentication & Identity:** OIDC, OAuth 2.1 with PKCE, Passkeys (FIDO2/WebAuthn), PASETO, or JWT with JWKS rotation?
+12. **Authorization Engine:** Open Policy Agent (OPA Rego via HTTP/Wasm), OpenFGA (Zanzibar ReBAC), or Cerbos?
+
+#### Batch 4: Presentation, Infrastructure & Quality
+13. **Frontend & Presentation:** Web (React/Vue/Svelte/Web Components), Mobile (Flutter/Native), Server-Driven UI (SDUI), and W3C DTCG Design Tokens?
+14. **Caching & Locks:** Redis, Valkey, Dragonfly, Memcached, or local LRU with XFetch stampede defense?
+15. **Event Streaming:** Apache Kafka, NATS JetStream, RabbitMQ, SQS, with Transactional Outbox?
+16. **Observability:** OpenTelemetry OTLP traces/metrics/logs over gRPC/HTTP with W3C trace context?
+17. **DevSecOps & Verification:** Semgrep SAST, Gitleaks, Trivy scanning, CycloneDX SBOM, Cosign, and Outside-In TDD (London School) with 100% coverage gates?
+18. **Containerization & Deployment:** Minimal OCI Distroless/Scratch, Docker Compose, Kubernetes, and OpenTofu IaC?
+
+#### Batch 5: Lifecycles, State Machines & Ubiquitous Language
+19. **State Invariant Separation:** Core Invariant States (Hard FSM in Aggregate Root) vs Tenant-Configurable Operational Workflow Stages (Soft FSM via transition matrices and CEL guards)?
+20. **Ubiquitous Language Agreement:** Living glossary contract (`ubiquitous_language.md`) with AST linter denylists and branded nominal types?
+
+---
+
+### Phase 3: Synthesize (Architecture Blueprint & User Sign-Off)
+1. Consolidate the user's answers into a formal **Consolidated Architectural Blueprint** (using Section 4 template).
+2. Author an Architectural Decision Record in `memory.md` (e.g. `ADR-006: Target Technology Stack & Scaffolding Baseline`).
+3. **STOP AND ASK FOR EXPLICIT CONFIRMATION**: Present the blueprint and ADR to the user. Do NOT write scaffolding code until the user approves the blueprint.
+
+---
+
+### Phase 4: Bootstrap (Deterministic Technical Scaffolding)
+Upon user confirmation:
+1. Run the deterministic workspace initialization script:
+   ```bash
+   bash .agents/skills/lets-build/scripts/bootstrap_workspace.sh . <language>
+   ```
+2. Generate base infrastructure and open specification foundations in `specs/`:
+   - `specs/openapi/v1/openapi.yaml` (minimal health probe and API versioning metadata)
+   - `specs/tokens/tokens.json` (W3C DTCG design tokens baseline)
+3. Scaffold initial Hexagonal application technical skeleton following [references/hexagonal_bootstrap_scaffolds.md](./references/hexagonal_bootstrap_scaffolds.md):
+   - Pure architecture ports and adapters layout (`src/domain/`, `src/ports/`, `src/adapters/`).
+   - Minimal system health probes (`/healthz`, `/readyz`).
+   - Strict isolation: **Do NOT scaffold application business features or fabricate domain entities yet.**
+4. Generate build manifests (`go.mod`, `Cargo.toml`, `pyproject.toml`, or `package.json`), linter/formatter configurations, minimal multi-stage `Dockerfile`, and `docker-compose.yml`.
+5. Scaffold initial test runner and boundary verification smoke test (`scripts/smoke_test.sh`).
+6. **Replace Starter README with Project-Specific README**:
+   Generate a clean, project-specific `README.md` using [references/project_readme_template.md](./references/project_readme_template.md), completely replacing the starter/meta-template content with the project's actual name, mission, stack highlights, quickstart commands, directory tree, and links to `docs/rules/`.
+
+---
+
+### Phase 5: Verify & Handover to Domain Analysis
+1. Run the workspace validation script:
+   ```bash
+   bash .agents/skills/agentic-architect/scripts/validate_agentic_configs.sh
+   ```
+2. Execute toolchain dependency checks, build commands, and health probe tests:
+   - Compile code and verify zero compiler or lint errors.
+   - Verify direct backend and reverse proxy health probes (`/healthz`).
+3. **Mandatory Handover to Domain Analysis (STOP & PIVOT):**
+   - **`lets-build` IS NOW COMPLETE.** Do NOT proceed to write domain business entities, repositories, or application features.
+   - Present the bootstrapped technical skeleton to the user.
+   - Instruct the user to invoke `product-analyst` and `relentless-questioner` to initiate the **Domain Discovery & Requirements Engineering Phase** (Ubiquitous Language, Bounded Contexts, Aggregate Boundaries, INVEST User Stories, and Gherkin Acceptance Criteria) before any domain feature code is written.
+
+---
+
+## 3. Gotchas & What NOT to Do
+
+- **MAJOR DONT: DO NOT invent, assume, or scaffold application domain entities, business logic, or feature pages during `/lets-build`.** The `lets-build` skill is strictly an infrastructure and technical stack bootstrapper. Fabricating business domain features without dedicated domain analysis and relentless questioning of the user is a fatal architectural defect.
+- **DO NOT** assume the stack. Never start writing Go, Rust, Python, or TypeScript before asking the user.
+- **DO NOT** scaffold all options at once. Follow the user's chosen stack strictly.
+- **DO NOT** couple domain entities to ORMs, database libraries, or HTTP frameworks. The domain core must remain pure.
+- **DO NOT** proceed to code generation without presenting the blueprint and receiving explicit user approval.
+- **DO NOT** skip or delete the 41 atomic domain rules in `docs/rules/` during bootstrapping. The rules govern the ongoing lifecycle of the newly bootstrapped project.
+- **DO NOT** create monolithic files (> 300 lines) or large functions (> 30 lines). Maintain strict Clean Code standards.
+
+---
+
+## 4. Structured Output Templates
+
+### Consolidated Architectural Blueprint Template
+```markdown
+# Architectural Specification & Technology Blueprint
+
+## 1. Core Profile
+- **Project Domain:** <domain>
+- **Primary Language & Runtime:** <language / version>
+- **Package Manager & Build Tool:** <tool>
+
+## 2. Interface & Transport
+- **Protocols:** <REST / gRPC / CloudEvents>
+- **Transport Framework:** <framework>
+- **Contracts:** <specs/openapi / specs/protobuf>
+
+## 3. Persistence & Isolation
+- **Storage Engine:** <engine & version>
+- **Migration Engine:** <Atlas / Flyway / Goose>
+- **Tenancy Isolation:** <Model A / B / C / D>
+- **Dynamic Schemas:** <JSON Schema Draft 2020-12>
+
+## 4. Logic, Workflows & Identity
+- **Dynamic Logic:** <Common Expression Language / Wasm Extism>
+- **Workflows:** <Temporal / Camunda / Statecharts>
+- **Authentication:** <OIDC / WebAuthn Passkeys / PASETO>
+- **Authorization:** <OPA Rego / OpenFGA ReBAC>
+
+## 5. Operations & Quality
+- **Caching & Streams:** <Cache Engine / Broker>
+- **Observability:** <OpenTelemetry OTLP>
+- **DevSecOps:** <Semgrep / Trivy / Gitleaks / Syft>
+- **Testing:** Outside-In TDD (100.00% coverage gate)
+```

package/.agents/skills/lets-build/references/architecture_interview_matrix.md

@@ -0,0 +1,188 @@
+# Comprehensive Architecture Interview Matrix
+
+> **Source of Truth:** Exhaustive taxonomy across 20 architectural dimensions to interrogate before bootstrapping any enterprise project.
+
+---
+
+## Dimension 1: Architectural Paradigm & Monolith-to-Service Boundary
+- **System Topology:** Modular Monolith (Modulith), Event-Driven Architecture (EDA), Service-Oriented (SOA), or Microservices?
+- **Domain Decoupling:** Hexagonal Ports & Adapters, Clean Architecture, Onion Architecture, or Pragmatic Layered?
+- **Language Bias:** Zero language bias; pure business domain core decoupled from infrastructure adapters.
+
+---
+
+## Dimension 2: Core Programming Languages & Runtimes
+- **Primary Languages:**
+  - Systems / High-Performance: Rust, Go, or C++23
+  - Enterprise / JVM: Java 21+ (Loom virtual threads) or Kotlin
+  - Web / Full-Stack: TypeScript (Node.js / Bun)
+  - Data / ML / Scripting: Python 3.12+ or Elixir (BEAM concurrency)
+- **Language Invariants:** Strict static sound typing; zero unhandled exceptions at domain boundaries.
+
+---
+
+## Dimension 3: Package Managers, Workspaces & Monorepo Tooling
+- **Package Manager:**
+  - Node/TS: `pnpm` (with strict isolated node_modules), `bun`, or `yarn` (Berry)
+  - Rust: `cargo` (with cargo workspaces)
+  - Go: Go Modules (with multi-module workspaces)
+  - Python: `uv`, `poetry`, or `pixi`
+- **Monorepo Build Orchestration:** Turborepo, Nx, or Bazel/Buck2 with remote caching?
+
+---
+
+## Dimension 4: Containerization, Base OS & Cloud-Native Runtime
+- **Container Strategy:**
+  - Zero-cve distroless (`gcr.io/distroless/*`) or `scratch` base images?
+  - Rootless container execution (`USER nonroot:nonroot`)?
+  - Multi-stage Dockerfiles with build caching?
+- **Cloud-Native Invariants:** 12-Factor (2026 Edition); stateless runtime isolates; graceful `SIGTERM` draining.
+
+---
+
+## Dimension 5: API Protocols, Transports & Network Contracts
+- **Primary Transport:**
+  - RESTful HTTP/JSON (RFC 7807 problem details + OpenAPI 3.1)
+  - gRPC / Protocol Buffers (v3 / Buf CLI)
+  - GraphQL (Apollo / GraphQL-Yoga with code-first or schema-first SDL)
+  - WebSockets / Server-Sent Events (SSE) for real-time push
+- **API Versioning Strategy:** URI Path (`/v1/`), Request Header, or Media Type negotiation?
+
+---
+
+## Dimension 6: Database & Persistence Engine
+- **Primary Storage Engine:**
+  - Relational: PostgreSQL, MySQL / MariaDB, SQLite, CockroachDB, or TiDB
+  - Document / NoSQL: MongoDB, DynamoDB, or Cassandra
+  - Multi-Model / Hybrid: Relational core with document extension
+- **Persistence Pattern:** Repository Pattern with raw SQL / query builders (e.g. `sqlx`, `pgx`, `Kysely`, `jOOQ`) vs ORM (e.g. Prisma, SQLAlchemy, GORM, Hibernate)?
+- **Mandatory Universal Audit Columns:**
+  - Standardize on **The Canonical 6 Total Audit Fields** (`createdAt`, `createdBy`, `updatedAt`, `updatedBy`, `deletedAt`, `deletedBy`) across all mutable relational entities?
+  - Strictly immutable append-only ledgers (`createdAt`, `createdBy` only; updates/deletions prohibited)?
+
+---
+
+## Dimension 7: Database Migration & Schema Evolution
+- **Migration Engine:** Declarative schema management (**Atlas**), versioned SQL migrations (**Flyway**, **Liquibase**, **Goose**, or **Bytebase**)?
+- **Zero-Downtime Expand-Contract:** Does the project commit to the 5-phase expand-contract deployment lifecycle?
+
+---
+
+## Dimension 8: Multi-Tenancy Data Isolation Model
+- **Isolation Strategy:**
+  1. **Model A: Universal AST Query Interceptor** (Tenant column + automatic SQL/query AST rewriting)
+  2. **Model B: Database Row-Level Security (RLS)** (Session-scoped `set_config` / session variables)
+  3. **Model C: Schema-per-Tenant** (Dedicated database schema namespace per tenant)
+  4. **Model D: Database-per-Tenant** (Physical instance routing via connection pool manager)
+  5. **Model E: Storage Proxy** (Envoy / ProxySQL / Vitess)
+
+---
+
+## Dimension 9: Dynamic Schemas & Extensible Entities
+- **Dynamic Field Storage:** Semi-structured JSON column with **JSON Schema Draft 2020-12** validation vs Entity-Attribute-Value (EAV) vs Virtual Column projection?
+- **Meta-Schema Virtual Entities:** Will tenants define completely custom entities at runtime without code deployments?
+
+---
+
+## Dimension 10: Pluggable Business Logic & Workflows
+- **Dynamic Rules:** Google's **Common Expression Language (CEL)** vs JSON Logic vs Strategy Registries?
+- **Workflow Orchestration:** **Temporal.io** durable execution vs **Camunda 8 / Zeebe (BPMN 2.0)** vs state machine libraries?
+- **Sandboxed Scripting:** **WebAssembly (Extism / Wasmtime)** micro-sandboxes vs isolated interpreters?
+
+---
+
+## Dimension 11: Authentication & Identity
+- **Protocols:** OpenID Connect (OIDC), OAuth 2.1 with PKCE, SAML 2.0 federation, or local credentials?
+- **Passkeys / Passwordless:** W3C / FIDO2 WebAuthn passkey support?
+- **Token Format:** PASETO (Platform-Agnostic Security Tokens) vs RFC 7519 JWT with JWKS asymmetric key rotation?
+- **Token Rotation:** Cryptographic Refresh Token Rotation (RTR) with family invalidation on replay detection?
+
+---
+
+## Dimension 12: Authorization & Policy-as-Code
+- **Policy Engine:**
+  - **Open Policy Agent (OPA)** (Rego language via REST/gRPC or embedded `.wasm` module)
+  - **OpenFGA** (Google Zanzibar Relationship-Based Access Control - ReBAC)
+  - **Cerbos** (Stateless policy-as-code)
+  - Application-level RBAC / ABAC guard wrappers
+
+---
+
+## Dimension 13: Presentation, Client & Server-Driven UI (SDUI)
+- **Frontend Framework & Architecture:**
+  - Web: React, Vue, Svelte, Solid, Angular, or Web Components?
+  - Mobile: Flutter, React Native, iOS SwiftUI, or Android Jetpack Compose?
+  - Hypermedia / SSR: HTMX / HTML-over-the-wire?
+  - Server-Driven UI (SDUI): Declarative JSON layout schemas rendered by client registries?
+- **UI Component Primitives & Styling:**
+  - Standardize on `shadcn/ui` with `@radix-ui` headless primitives + Tailwind CSS?
+  - Accessible dialogs, focus trapping, and zero native alerts per `accessibility.md`?
+- **Server-State Caching & Data Synchronization:**
+  - **TanStack Query (`@tanstack/react-query`)** with query keys, stale-while-revalidate, and automatic mutation invalidation vs SWR vs raw fetch?
+- **Form State Management & Validation:**
+  - **React Hook Form (`react-hook-form` + `@hookform/resolvers/zod`)** or **TanStack Form (`@tanstack/react-form`)** with **Zod** schema contracts?
+- **Data Grids & Table Virtualization:**
+  - **TanStack Table (`@tanstack/react-table`)** for headless sorting, filtering, and pagination?
+- **Client Stores & Global State:**
+  - **Zustand** vs Jotai vs Redux Toolkit for shared client-only state?
+- **Design Tokens:** W3C Design Tokens Community Group (DTCG) `tokens.json` processed via Style Dictionary?
+
+---
+
+## Dimension 14: Caching, Distributed Locks & Session State
+- **Caching Engine:** Redis, Valkey, Dragonfly, KeyDB, Memcached, or local in-memory LRU?
+- **Cache Pattern:** Cache-Aside with jittered TTLs, XFetch probabilistic stampede defense, and event-driven invalidation?
+- **Distributed Locks:** Redis Redlock / atomic SETNX with bounded TTLs?
+
+---
+
+## Dimension 15: Distributed Messaging & Event Streaming
+- **Message Broker:** Apache Kafka / Redpanda, NATS JetStream, RabbitMQ, AWS SQS, or Redis Streams?
+- **Event Specification:** CNCF CloudEvents v1.0.2 format?
+- **Transactional Outbox:** Polling relay (`FOR UPDATE SKIP LOCKED`) or Change Data Capture (CDC via Debezium)?
+
+---
+
+## Dimension 16: Observability, Telemetry & Logging
+- **Standard:** 100% CNCF OpenTelemetry (OTel) with OTLP export over gRPC/HTTP?
+- **Tracing:** W3C Trace Context (`traceparent`, `tracestate`)?
+- **Logging Format:** Structured JSON conforming to Elastic Common Schema (ECS) or OpenTelemetry Resource Schema?
+
+---
+
+## Dimension 17: DevSecOps, Supply Chain & Security
+- **SAST:** Polyglot Semgrep rules for security and code quality?
+- **Secret Detection:** Pre-commit Gitleaks or Secretlint hooks?
+- **Vulnerability Scanning:** Trivy container and lockfile scanning in CI?
+- **SBOM & Provenance:** Syft CycloneDX 1.6 SBOM generation and Cosign artifact signing?
+
+---
+
+## Dimension 18: Testing & Verification Strategy
+- **TDD Methodology:** Outside-In TDD (London School) double loop?
+- **BDD Acceptance:** Executable Cucumber / Gherkin `.feature` criteria?
+- **Contract Testing:** Consumer-Driven Contract testing via Pact?
+- **Property-Based Testing:** Schemathesis OpenAPI / GraphQL automated fuzzing?
+- **Coverage Gate:** Mandatory 100.00% coverage thresholds across all suites?
+
+---
+
+## Dimension 19: State Machines, Workflows & Lifecycle Configurability
+- **State Taxonomy & Invariant Separation:**
+  - **Core Invariant States (Hard FSM):** Enforced strictly inside compiled Domain Aggregate Roots? (Financial/legal integrity states like `SETTLED`, `CANCELLED` cannot be user-rewritten).
+  - **Operational Workflow Stages (Soft FSM):** Tenant-configurable review funnels, approval tiers, or sub-statuses managed via Declarative State Transition Matrices?
+- **Transition Guards & Rule Evaluation:**
+  - Standardize on Common Expression Language (CEL) or embedded Wasm sandboxing for tenant-defined guards?
+- **Workflow Orchestration:**
+  - Durable workflow engine (Temporal.io, Camunda 8 / Zeebe BPMN 2.0) for multi-step distributed sagas?
+- **Transition Audit Trail:**
+  - Mandatory append-only state transition log (`transitionId`, `entityType`, `entityId`, `fromState`, `toState`, `event`, `actorId`, `createdAt`)?
+
+---
+
+## Dimension 20: Ubiquitous Language & Domain-Code Agreement
+- **Living Glossary:** Authoritative `docs/knowledge/ubiquitous_language.md` mapping domain terms, business definitions, and exact code identifiers?
+- **Linguistic Drift Defenses:**
+  - Mechanical AST / Linter rules (ESLint `id-denylist`) prohibiting banned synonyms?
+  - Branded nominal types (`type UserId = string & { readonly __brand: unique symbol }`) preventing primitive obsession and cross-domain identifier confusion?
+- **Anti-Corruption Layer (ACL):** Adapters at system perimeters converting external vendor terminology into the canonical Ubiquitous Language?

package/.agents/skills/lets-build/references/hexagonal_bootstrap_scaffolds.md

@@ -0,0 +1,113 @@
+# Hexagonal Bootstrap Scaffolds & Templates
+
+> **Core Purpose:** Standardized directory trees and foundational templates for bootstrapping projects across any language following the Hexagonal (Ports & Adapters) architecture.
+
+---
+
+## 1. Universal Directory Topology
+
+Regardless of language, all bootstrapped projects must follow this high-level separation:
+
+```
+<project-root>/
+├── .agents/skills/                   # Specialized agentic workflows (carried from azcodr template)
+├── docs/
+│   ├── knowledge/                    # System knowledge graph, issue log, DO's/DONT's
+│   └── rules/                        # 41 atomic single-responsibility domain rules
+├── specs/                            # Canonical contract specifications
+│   ├── protobuf/                     # gRPC service definitions (*.proto)
+│   ├── openapi/                      # OpenAPI 3.1 REST specifications (*.yaml)
+│   ├── schemas/                      # Universal JSON Schema Draft 2020-12 (*.json)
+│   └── tokens/                       # W3C DTCG Design Tokens (tokens.json)
+├── src/                              # Application source code
+│   ├── domain/                       # Core Invariant Domain (Entities, Value Objects, Invariants)
+│   ├── ports/                        # Primary (driving) and Secondary (driven) Ports
+│   │   ├── primary/                  # Inbound Use Cases, Commands, and Queries
+│   │   └── secondary/                # Outbound Repositories, Caches, Event Brokers
+│   └── adapters/                     # Concrete Polyglot Implementations
+│       ├── primary/                  # HTTP controllers, gRPC handlers, CLI commands
+│       └── secondary/                # SQL/NoSQL repositories, Redis caches, Kafka brokers
+├── tests/
+│   ├── unit/                         # Fast unit tests using test doubles
+│   ├── integration/                  # Adapter integration tests with transactional rollback
+│   ├── contracts/                    # Pact / OpenAPI contract verification
+│   └── acceptance/                   # BDD Gherkin / Cucumber end-to-end features
+├── deploy/                           # Deployment & Infrastructure as Code
+│   ├── docker/                       # Minimal OCI Distroless/Scratch Dockerfiles
+│   ├── compose/                      # Docker Compose multi-service topologies
+│   └── k8s/                          # Kubernetes manifests or OpenTofu / Crossplane
+├── AGENTS.md                         # Authoritative lean root directives (< 120 lines)
+├── CLAUDE.md -> AGENTS.md            # Symlink for harness parity
+├── agents.md -> AGENTS.md            # Symlink for harness parity
+├── memory.md                         # Master memory hub & Lightweight ADR ledger
+└── README.md                         # Project documentation
+```
+
+---
+
+## 2. Language-Specific Source Layouts
+
+### Go Scaffold (`go.mod`)
+```
+src/
+├── domain/
+│   ├── entity/user.go
+│   └── valueobject/tenant_id.go
+├── ports/
+│   ├── in/create_user_usecase.go
+│   └── out/user_repository_port.go
+└── adapters/
+    ├── in/http/user_handler.go
+    └── out/sql/pgx_user_repository.go
+```
+
+### Rust Scaffold (`Cargo.toml`)
+```
+src/
+├── domain/
+│   ├── entities/user.rs
+│   └── value_objects/tenant_id.rs
+├── ports/
+│   ├── primary/create_user.rs
+│   └── secondary/user_repository.rs
+└── adapters/
+    ├── primary/axum_handler.rs
+    └── secondary/sqlx_repository.rs
+```
+
+### Python Scaffold (`pyproject.toml` / `uv`)
+```
+src/
+├── domain/
+│   ├── entities/user.py
+│   └── value_objects/tenant_id.py
+├── ports/
+│   ├── primary/create_user_usecase.py
+│   └── secondary/user_repository_port.py
+└── adapters/
+    ├── primary/fastapi_router.py
+    └── secondary/asyncpg_repository.py
+```
+
+### TypeScript Scaffold (`package.json` / `pnpm`)
+```
+src/
+├── domain/
+│   ├── entities/user.ts
+│   └── value-objects/tenant-id.ts
+├── ports/
+│   ├── primary/create-user.usecase.ts
+│   └── secondary/user-repository.port.ts
+└── adapters/
+    ├── primary/fastify-router.ts
+    └── secondary/kysely-user-repository.ts
+```
+
+---
+
+## 3. Foundational Scaffold Invariants
+
+1. **Domain Isolation**: Code in `src/domain/` must have **zero imports** from `src/adapters/`, external web frameworks, or database drivers.
+2. **Ports as Pure Contracts**: Code in `src/ports/` contains abstract interfaces, Command DTOs, Query DTOs, and Result containers.
+3. **Adapters Depend on Ports**: `src/adapters/` implements ports defined in `src/ports/`. Adapters never depend directly on other adapters.
+4. **Contract-First Synchronization**: Whenever an API or event interface changes, the canonical contract in `specs/` must be updated and validated before adapter code is generated or modified.