chati-dev 4.0.1 → 4.0.2

package/framework/domains/agents/qa-planning.yaml

@@ -1,13 +1,13 @@
 # QA Planning Agent Domain — Authority boundaries and behavioral rules for PRISM L2
 
-mission: "Define test strategy, quality gates, coverage plans, and risk matrices for the project."
+mission: "Validate traceability, consistency, and completeness across all PLAN artifacts (Brief -> PRD -> Phases -> Tasks -> Criteria)."
 
 authority:
   exclusive:
-    - test_strategy_definition
-    - qa_gate_definition
-    - coverage_planning
-    - risk_matrix_creation
+    - traceability_validation
+    - plan_consistency_check
+    - criteria_quality_review
+    - adversarial_planning_review
   allowed:
     - read_any_file
     - read_architecture_docs
@@ -21,10 +21,7 @@ authority:
   redirectMessage: "QA Planning defines the strategy. QA Implementation executes it."
 
 outputs:
-  - qa-plan.yaml
-  - test-strategy.yaml
-  - coverage-plan.yaml
-  - risk-matrix.yaml
+  - qa-planning-report.md
 
 rules:
   - id: qap-score
@@ -45,7 +42,7 @@ rules:
 
   - id: qap-adversarial
     text: >
-      ADVERSARIAL REVIEW: Every planning validation MUST identify minimum 3
+      ADVERSARIAL REVIEW: Every planning validation MUST identify minimum 5
       findings (gaps, improvements, or suggestions). Zero findings is
       suspiciously clean — re-analyze with deeper scrutiny across all
       traceability chains. Findings can be any severity.

package/framework/domains/agents/tasks.yaml

@@ -24,7 +24,7 @@ authority:
   redirectMessage: "Task decomposition is complete. Redirecting to dev agent for implementation."
 
 outputs:
-  - tasks/*.yaml
+  - tasks.md
 
 rules:
   - id: tk-01

package/framework/domains/agents/ux.yaml

@@ -24,9 +24,7 @@ authority:
   redirectMessage: "UX design is complete. Redirecting to dev agent for implementation."
 
 outputs:
-  - ux-spec.yaml
-  - component-map.yaml
-  - wireframes.yaml
+  - ux-specification.md
 
 rules:
   - id: ux-01
@@ -48,3 +46,23 @@ rules:
   - id: ux-05
     text: "MUST NOT design backend logic or data flows; focus on user-facing experience only"
     priority: critical
+
+  - id: ux-06
+    text: "MUST NOT produce centered single-column layouts as default; minimum 2 distinct layout structures per page"
+    priority: high
+
+  - id: ux-07
+    text: "MUST specify all interactive states (default, hover, active, focus, disabled) and all data view states (populated, empty, loading, error, skeleton) for every component"
+    priority: critical
+
+  - id: ux-08
+    text: "MUST NOT use placeholder content (lorem ipsum, John Doe, example.com); all sample data must be domain-realistic"
+    priority: high
+
+  - id: ux-09
+    text: "MUST define Motion System: specify animation library by stack, include animation token layer (duration + easing), and catalogue mandatory micro-interactions and scroll animations with reduced-motion alternatives (Directive 6)"
+    priority: critical
+
+  - id: ux-10
+    text: "MUST perform component discovery via 21st.dev for all Molecules and Organisms before designing custom components; document source or rationale for each (Directive 7)"
+    priority: high

package/framework/domains/constitution.yaml

@@ -2,7 +2,7 @@
 # Source: chati.dev/constitution.md (19 Articles + Preamble)
 
 summary: >
-  Constitution governance: self-validation required (loop until quality >= 95%),
+  Constitution governance: self-validation required (loop until tier-specific threshold met),
   guided options (1,2,3 format), persistent session state, two-layer handoff,
   language protocol (interaction=user lang, artifacts=English),
   deviation protocol, mode governance (planning/build/deploy),
@@ -17,7 +17,7 @@ rules:
     priority: critical
 
   - id: art-ii
-    text: "Quality >= 95% self-validation required. Loop until threshold met."
+    text: "Quality self-validation required. Tiered thresholds: QA >= 95%, standard >= 90%, discovery >= 85%. Loop until met."
     priority: critical
 
   - id: art-iii
@@ -77,7 +77,7 @@ rules:
     priority: high
 
   - id: art-xvii
-    text: "Execution mode governance: autonomous requires gate >= 90%. Safety net with circuit breaker (3 failures)."
+    text: "Execution mode governance: QA gates >= 95%, other agents >= 90%. Safety net with circuit breaker (3 failures)."
     priority: critical
 
 articles:
@@ -89,7 +89,7 @@ articles:
         priority: critical
       - profile-guided: "In guided profile, agents propose actions and wait for user confirmation before writes."
         priority: high
-      - profile-autonomous: "In autonomous profile, agents execute without confirmation when gate scores >= 90%."
+      - profile-autonomous: "In autonomous profile, agents execute without confirmation when gate scores >= 95%."
         priority: critical
       - profile-always-confirm: "Destructive operations, deployments, deviations, and backward transitions always require confirmation regardless of profile."
         priority: critical

package/framework/domains/global.yaml

@@ -28,7 +28,7 @@ rules:
       priority: critical
     - guided-confirmation: "In guided profile, significant writes require user confirmation."
       priority: high
-    - autonomous-gate-check: "Autonomous profile requires cumulative gate scores >= 90%."
+    - autonomous-gate-check: "Autonomous profile requires cumulative gate scores >= 95%."
       priority: critical
     - profile-downgrade: "If quality drops below threshold during autonomous execution, auto-downgrade to guided."
       priority: critical

package/framework/intelligence/context-engine.md

@@ -165,7 +165,7 @@ Memory injection follows the same progressive reinforcement principle: as contex
 
 ---
 
-*Context Engine v2.0 — Chati.dev Intelligence Layer (Progressive Reinforcement Model)*
+*Context Engine v4.0 — Chati.dev Intelligence Layer (Progressive Reinforcement Model)*
 
 ---
 

package/framework/templates/brandbook-tmpl.yaml

@@ -19,6 +19,7 @@ sections:
   - color_philosophy
   - spacing_rhythm
   - iconography_style
+  - motion_philosophy
 
 brand_voice:
   description: "Brand personality, tone, and communication style"
@@ -65,6 +66,9 @@ typography_rationale:
 color_philosophy:
   description: "Color palette rationale and emotional associations"
   fields:
+    - name: industry_specific_reasoning
+      type: string
+      description: "Why these colors for THIS industry/sector — must reference Industry-Specific Palette Reasoning table from Directive 4"
     - name: primary_palette
       type: array
       description: "Primary colors with emotional rationale"
@@ -74,6 +78,9 @@ color_philosophy:
     - name: accessibility_notes
       type: string
       description: "WCAG contrast compliance notes"
+    - name: bias_check
+      type: object
+      description: "Anti-bias validation: confirm primary color is NOT generic SaaS blue, saturation is intentional, neutral scale has 9+ steps"
 
 spacing_rhythm:
   description: "Spacing scale rationale and rhythm system"
@@ -101,6 +108,36 @@ iconography_style:
       type: array
       description: "Guidelines for icon metaphor selection"
 
+motion_philosophy:
+  description: "Animation personality and motion system definition (Directive 6)"
+  fields:
+    - name: scroll_personality
+      type: enum
+      values: [Energetic, Elegant, Minimal, Playful]
+      description: "Animation character aligned with brand visual direction"
+    - name: micro_animation_style
+      type: string
+      description: "Description of hover and interaction animation character"
+    - name: timing_defaults
+      type: object
+      description: "Default duration and easing tokens for this brand"
+      sub_fields:
+        - name: primary_duration
+          type: string
+          description: "Primary animation duration token (e.g. --motion-duration-normal)"
+          default: "--motion-duration-normal (350ms)"
+        - name: primary_easing
+          type: string
+          description: "Primary easing token (e.g. --motion-ease-standard)"
+          default: "--motion-ease-standard"
+    - name: library
+      type: string
+      description: "Animation library for this project's stack"
+      examples:
+        - "motion/react (React/Next.js)"
+        - "@vueuse/motion (Vue 3)"
+        - "CSS animations (plain HTML/CSS)"
+
 rules:
   - id: brand-before-tokens
     text: "Brandbook MUST be completed before design tokens are defined."
@@ -111,3 +148,6 @@ rules:
   - id: brand-voice-artifacts
     text: "All user-facing text in artifacts must follow brand voice guidelines."
     priority: high
+  - id: brand-no-default-blue
+    text: "Primary color MUST NOT be generic SaaS blue (#3B82F6 or similar) unless the brand explicitly requires it with documented rationale."
+    priority: high

package/framework/templates/component-spec-tmpl.yaml

@@ -38,9 +38,53 @@ fields:
     description: "Size variants (xs, sm, md, lg, xl)"
     required: true
   - name: states
-    type: array
-    description: "Interactive states (default, hover, active, focus, disabled, loading, error)"
+    type: object
+    description: "Component states organized by category"
     required: true
+    sub_fields:
+      - name: interactive
+        type: array
+        description: "REQUIRED: default, hover, active, focus, disabled"
+        required: true
+      - name: input
+        type: array
+        description: "For input components: empty, filled, error, success, loading"
+        required: false
+      - name: data_view
+        type: array
+        description: "For data display components: populated, empty, loading, error, skeleton"
+        required: false
+      - name: animation
+        type: object
+        description: "Animation states using motion tokens from Design System Layer 5"
+        required: false
+        sub_fields:
+          - name: entrance
+            type: object
+            description: "How component enters the DOM (opacity + translateY default)"
+            example:
+              property: "opacity + translateY"
+              duration: "--motion-duration-normal"
+              easing: "--motion-ease-decelerate"
+          - name: hover
+            type: object
+            description: "Transform on hover — GPU properties only"
+            example:
+              property: "transform"
+              duration: "--motion-duration-fast"
+              easing: "--motion-ease-spring"
+          - name: exit
+            type: object
+            description: "How component exits the DOM"
+            example:
+              property: "opacity + scale"
+              duration: "--motion-duration-fast"
+              easing: "--motion-ease-accelerate"
+          - name: reduced_motion
+            type: object
+            description: "Fallback for prefers-reduced-motion"
+            example:
+              fallback: "opacity only, duration --motion-duration-fast"
   - name: anatomy
     type: object
     description: "Component parts and their structure"
@@ -70,5 +114,8 @@ rules:
     text: "Every component MUST have ARIA roles and keyboard navigation defined."
     priority: critical
   - id: state-coverage
-    text: "All interactive states must be specified including disabled and loading."
+    text: "All 5 interactive states (default, hover, active, focus, disabled) are mandatory. Data display components must also include populated, empty, loading, error, and skeleton."
+    priority: critical
+  - id: no-placeholder-content
+    text: "All example content in component specs must be domain-realistic. No lorem ipsum or generic names."
     priority: high

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "chati-dev",
-  "version": "4.0.1",
+  "version": "4.0.2",
   "description": "AI-Powered Multi-Agent Orchestration System — Structured vibe coding for Full Stack Development",
   "type": "module",
   "bin": {

package/src/api/index.js

@@ -37,27 +37,18 @@ export { selectAgent } from '../orchestrator/agent-selector.js';
 // Session Management
 // ---------------------------------------------------------------------------
 
-import {
-  initSession as _initSession,
-  loadSession as _loadSession,
-  updateSession as _updateSession,
-  validateSession as _validateSession,
-  getSessionSummary as _getSessionSummary,
-  claimSession as _claimSession,
-  releaseSession as _releaseSession,
-  getSessionOwner as _getSessionOwner,
-} from '../orchestrator/session-manager.js';
+import { initSession as _initSession } from '../orchestrator/session-manager.js';
 
 export {
-  _initSession as initSession,
-  _loadSession as loadSession,
-  _updateSession as updateSession,
-  _validateSession as validateSession,
-  _getSessionSummary as getSessionSummary,
-  _claimSession as claimSession,
-  _releaseSession as releaseSession,
-  _getSessionOwner as getSessionOwner,
-};
+  initSession,
+  loadSession,
+  updateSession,
+  validateSession,
+  getSessionSummary,
+  claimSession,
+  releaseSession,
+  getSessionOwner,
+} from '../orchestrator/session-manager.js';
 
 // ---------------------------------------------------------------------------
 // Autonomy

package/src/autonomy/build-loop.js

@@ -124,7 +124,7 @@ export async function runBuildLoop(config) {
 
     // --- Escalation check (before execution) ---
     const previousAttempts = attemptHistory.get(checkpoint.taskId) || [];
-    let executorOptions = {};
+    const executorOptions = {};
 
     if (checkpoint.attempts > 0 && checkpoint.error) {
       // Analyze the cause of the previous failure

package/src/autonomy/cause-analyzer.js

@@ -147,7 +147,7 @@ function extractRootCause(text, category) {
  * @param {string} rootCause
  * @returns {string}
  */
-function generateSuggestion(category, rootCause) {
+function generateSuggestion(category, _rootCause) {
   const suggestions = {
     [FAILURE_CATEGORIES.SYNTAX_ERROR]: 'Check for missing brackets, semicolons, or malformed expressions. Review the exact line mentioned in the error.',
     [FAILURE_CATEGORIES.TEST_FAILURE]: 'Review the failing test assertions. Ensure the implementation matches the expected behavior described in the test.',

package/src/autonomy/worktree-manager.js

@@ -9,7 +9,7 @@
 
 /**
  * @deprecated Not currently imported by any production module.
- * Retained for potential future integration. Remove if still unused by v4.0.
+ * Retained for potential future integration. Review for removal or integration by v5.0.
  */
 
 import { execSync } from 'child_process';
@@ -32,12 +32,17 @@ const MAX_WORKTREE_AGE_MS = 24 * 60 * 60 * 1000;
 
 /**
  * Execute a git command in a given directory and return trimmed stdout.
+ * Sanitizes `cmd` to reject shell metacharacters (prevents injection).
  *
  * @param {string} cmd - Git command (without the `git` prefix)
  * @param {string} cwd - Working directory
  * @returns {string} Trimmed stdout
+ * @throws {Error} If cmd contains shell metacharacters
  */
 function git(cmd, cwd) {
+  if (/[`$;|&><(){}]/.test(cmd)) {
+    throw new Error(`Unsafe characters in git command: ${cmd}`);
+  }
   return execSync(`git ${cmd}`, {
     cwd,
     encoding: 'utf-8',
@@ -157,7 +162,7 @@ export function mergeWorktree(projectDir, worktreeBranch, mainBranch) {
   try {
     git(`merge "${worktreeBranch}" --no-edit`, absProject);
     return { success: true, conflicts: [] };
-  } catch (err) {
+  } catch {
     // Parse conflicts from error output
     const conflicts = [];
     try {

package/src/config/agent-customizer.js

@@ -103,11 +103,7 @@ export function applyCustomization(agentPrompt, customization) {
   if (customization.skip_sections && Array.isArray(customization.skip_sections)) {
     for (const sectionName of customization.skip_sections) {
       // Match section heading + all content until the next heading of same or higher level, or end of text
-      const pattern = new RegExp(
-        `^#{1,3}\\s+${escapeRegex(sectionName)}\\s*\\n[\\s\\S]*?(?=\\n#{1,3}\\s|\\Z)`,
-        'gm'
-      );
-      // \\Z is not JS — use two-pass: try lookahead for next heading, then fallback to end
+      // Two-pass approach: try lookahead for next heading, then fallback to end
       const headingPattern = new RegExp(
         `^(#{1,3})\\s+${escapeRegex(sectionName)}[^\\n]*\\n([\\s\\S]*?)(?=^#{1,3}\\s)`,
         'gm'

package/src/config/context-file-generator.js

@@ -151,7 +151,7 @@ export function generateAgentsMd(content, contextFiles = null) {
   // Inline context files for full governance parity (Codex has no @import)
   if (contextFiles) {
     const sections = [];
-    for (const [name, fileContent] of Object.entries(contextFiles)) {
+    for (const [, fileContent] of Object.entries(contextFiles)) {
       if (fileContent) {
         // Adapt context for Codex (replace Claude-specific refs)
         let adapted = fileContent;

package/src/context/bracket-tracker.js

@@ -18,19 +18,8 @@
  *   CRITICAL = 5.0% → maximum reinforcement (last interactions before handoff)
  */
 
-/** Provider context window limits (tokens). */
-const PROVIDER_LIMITS = {
-  claude: 200_000,
-  gemini: 1_000_000,
-  codex: 128_000,
-};
-
-const BRACKETS = {
-  FRESH:    { min: 60, max: 100, layers: ['L0', 'L1', 'L2', 'L3', 'L4', 'L5'], budgetRatio: 0.015 },
-  MODERATE: { min: 40, max: 60,  layers: ['L0', 'L1', 'L2', 'L3', 'L5'],       budgetRatio: 0.025 },
-  DEPLETED: { min: 25, max: 40,  layers: ['L0', 'L1', 'L2'],                   budgetRatio: 0.040 },
-  CRITICAL: { min: 0,  max: 25,  layers: ['L0', 'L1'],                         budgetRatio: 0.050 },
-};
+import { PROVIDER_LIMITS } from '../utils/provider-limits.js';
+import { BRACKETS } from '../utils/brackets.js';
 
 /**
  * Memory injection level per bracket.

package/src/decision/engine.js

@@ -2,6 +2,10 @@
  * Decision Engine - Core COMPASS module for chati.dev
  * Analyzes intent and recommends: REUSE (>=90%), ADAPT (60-89%), CREATE (<60%)
  *
+ * NOTE: This module handles entity-level routing (registry lookup).
+ * For intent-level similarity scoring (weighted keyword + purpose),
+ * see `intelligence/decision-engine.js` (calculateIntentSimilarity).
+ *
  * @module decision/engine
  */
 

package/src/health/auto-fix.js

@@ -45,7 +45,7 @@ const STALE_LOCK_AGE_MS = 30_000;
  * @param {object[]} [checkResults=[]] - Results from health checks (for targeted fixes)
  * @returns {AutoFixResult}
  */
-export function autoFix(projectDir, checkResults = []) {
+export function autoFix(projectDir, _checkResults = []) {
   const actions = [];
 
   // Fix 1: Ensure required directories exist

package/src/installer/core.js

@@ -177,6 +177,10 @@ function copyFrameworkFiles(destDir, provider = 'claude') {
     'templates/task-tmpl.yaml',
     'templates/qa-gate-tmpl.yaml',
     'templates/quick-brief-tmpl.yaml',
+    'templates/brandbook-tmpl.yaml',
+    'templates/design-token-tmpl.yaml',
+    'templates/component-spec-tmpl.yaml',
+    'templates/icon-system-tmpl.yaml',
     // Workflows
     'workflows/greenfield-fullstack.yaml',
     'workflows/brownfield-fullstack.yaml',
@@ -184,6 +188,7 @@ function copyFrameworkFiles(destDir, provider = 'claude') {
     'workflows/brownfield-service.yaml',
     'workflows/brownfield-ui.yaml',
     'workflows/quick-flow.yaml',
+    'workflows/standard-flow.yaml',
     // Quality gates
     'quality-gates/planning-gate.md',
     'quality-gates/implementation-gate.md',
@@ -205,6 +210,7 @@ function copyFrameworkFiles(destDir, provider = 'claude') {
     'intelligence/decision-engine.md',
     // Patterns
     'patterns/elicitation.md',
+    'patterns/elicitation-library.yaml',
     // Hooks
     'hooks/prism-engine.js',
     'hooks/mode-governance.js',
@@ -235,6 +241,7 @@ function copyFrameworkFiles(destDir, provider = 'claude') {
     'domains/workflows/brownfield-service.yaml',
     'domains/workflows/brownfield-ui.yaml',
     'domains/workflows/quick-flow.yaml',
+    'domains/workflows/standard-flow.yaml',
     // i18n
     'i18n/en.yaml',
     'i18n/pt.yaml',
@@ -274,7 +281,7 @@ function copyFrameworkFiles(destDir, provider = 'claude') {
  * Configure a specific IDE
  */
 async function configureIDE(targetDir, ideKey, selectedMCPs, options = {}) {
-  const { orchestratorPath, isSecondary } = options;
+  const { orchestratorPath } = options;
   const config = IDE_CONFIGS[ideKey];
   if (!config) return;
 

package/src/intelligence/context-status.js

@@ -1,23 +1,8 @@
 import { existsSync, readFileSync } from 'fs';
 import { join } from 'path';
 
-/** Provider context window limits (tokens). */
-const PROVIDER_LIMITS = {
-  claude: 200_000,
-  gemini: 1_000_000,
-  codex: 128_000,
-};
-
-const BRACKETS = [
-  { name: 'FRESH',    min: 60, max: 100, layers: ['L0', 'L1', 'L2', 'L3', 'L4', 'L5'], budgetRatio: 0.015 },
-  { name: 'MODERATE', min: 40, max: 60,  layers: ['L0', 'L1', 'L2', 'L3', 'L5'],       budgetRatio: 0.025 },
-  { name: 'DEPLETED', min: 25, max: 40,  layers: ['L0', 'L1', 'L2'],                   budgetRatio: 0.040 },
-  { name: 'CRITICAL', min: 0,  max: 25,  layers: ['L0', 'L1'],                         budgetRatio: 0.050 },
-];
-// NOTE: This BRACKETS array is intentionally duplicated from src/context/bracket-tracker.js
-// for module isolation. bracket-tracker.js is the canonical source of truth.
-// Progressive Reinforcement Model (v4.0): budgets as ratio of provider context window.
-// If bracket ranges or ratios change, update BOTH files.
+import { PROVIDER_LIMITS } from '../utils/provider-limits.js';
+import { BRACKETS_LIST as BRACKETS } from '../utils/brackets.js';
 
 /**
  * Get context status based on session state

package/src/intelligence/decision-engine.js

@@ -4,6 +4,9 @@
  * Before creating any new artifact, scores existing registry entities
  * for similarity. Enforces Constitution Article XIV: REUSE > ADAPT > CREATE.
  *
+ * NOTE: This module handles intent-level similarity with weighted scoring.
+ * For entity-level routing (COMPASS registry lookup), see `decision/engine.js`.
+ *
  * Algorithm:
  *   similarity = (keywordOverlap * 0.6) + (purposeSimilarity * 0.4)
  *   >= 90% → REUSE, 60-89% → ADAPT, < 60% → CREATE
@@ -61,7 +64,7 @@ export function evaluateDecision(intent, registryPath) {
   let bestId = null;
 
   for (const entity of entities) {
-    const score = calculateSimilarity(intent, entity);
+    const score = calculateIntentSimilarity(intent, entity);
     if (score > bestScore) {
       bestScore = score;
       bestMatch = entity;
@@ -104,7 +107,7 @@ export function evaluateDecision(intent, registryPath) {
  * @param {{ keywords: string[], purpose: string }} entity
  * @returns {number} 0.0 to 1.0
  */
-export function calculateSimilarity(intent, entity) {
+export function calculateIntentSimilarity(intent, entity) {
   const kwScore = keywordOverlap(intent.keywords, entity.keywords || []);
   const purposeScore = purposeSimilarity(intent.purpose, entity.purpose || '');
   return (kwScore * 0.6) + (purposeScore * 0.4);

package/src/intelligence/timeline.js

@@ -8,7 +8,7 @@
 
 /**
  * @deprecated Not currently imported by any production module.
- * Retained for potential future integration. Remove if still unused by v4.0.
+ * Retained for potential future integration. Review for removal or integration by v5.0.
  */
 
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'fs';

package/src/merger/semantic-merger.js

@@ -165,7 +165,7 @@ export function mergeChanges(changes, strategy = MERGE_STRATEGIES.CONSERVATIVE)
   const merged = [];
   const skipped = [];
 
-  for (const [file, agentChanges] of fileAgentMap.entries()) {
+  for (const [, agentChanges] of fileAgentMap.entries()) {
     const agents = [...new Set(agentChanges.map(c => c.agent))];
 
     if (agents.length === 1) {