claude-code-arcane 1.0.0

package/skills/cs-onboard/references/interview-guide.md

@@ -0,0 +1,173 @@
+# Interview Craft Guide
+
+Deep operational guide for conducting the `/cs:setup` founder interview. Not a script — a thinking tool. Read before every interview. Internalize it, then put it away.
+
+---
+
+## The Core Problem
+
+Most context-gathering fails because it captures what founders say, not what they mean. Founders are practiced storytellers. They have investor pitches, board narratives, team rallies. They tell good stories. Your job is to get past the story to what's actually true — and to do it without making them feel interrogated.
+
+The best interview doesn't feel like an interview. It feels like a conversation with a smart advisor who gets it.
+
+---
+
+## Before You Start
+
+Set the frame:
+
+> "This isn't a quiz. There are no right answers. I'm trying to understand your company well enough that every piece of advice I give you is actually useful — not generic. The more honest you are, the more useful this gets. Nothing leaves this conversation."
+
+Then shut up and let them talk.
+
+---
+
+## Reading the Room
+
+Pay attention to:
+
+- **Energy shifts.** Where do they speed up? What makes them lean in? That's what they care about. What makes them vague or flat? That's where the real issue lives.
+- **What they lead with.** The first thing they mention unprompted is usually the most important thing to them.
+- **Repetition.** If a topic comes up twice, it's significant. Three times and it's the real problem.
+- **Hedging language.** "We're pretty much aligned on..." / "Things are mostly fine..." / "It's not really a problem yet..." — probe these. "Pretty much" is doing a lot of work there.
+- **Skips.** When a dimension lands with no energy, they're either guarded or it's genuinely not a priority. Figure out which.
+
+---
+
+## Follow-Up Probe Library
+
+### When the answer is vague
+
+- "Can you give me a specific example?"
+- "What does that look like on a Tuesday morning?"
+- "If I asked your co-founder / direct report, what would they say?"
+- "How would you know if that was actually true?"
+
+### When the answer is suspiciously polished
+
+- "That's the investor version — what's the version you'd tell your co-founder at 11pm?"
+- "If that's true, what explains [specific contradicting data point]?"
+- "What would a skeptic say about that?"
+
+### When they skip something
+
+- "You moved past [topic] quickly — is that because it's not a problem, or because it's too big to get into?"
+- "Come back to [topic] — tell me more about that."
+
+### When they say "everything is fine"
+
+- "What's the thing that keeps you up at night even though you know you shouldn't worry about it?"
+- "If something was going to surprise you in a bad way in the next 90 days, what would it be?"
+- "What would your board member who's most worried about the company say?"
+
+### When they're guarded
+
+- Slow down. Don't push harder — push softer.
+- "You don't have to share numbers if you're not comfortable — ranges are fine."
+- Acknowledge the complexity: "This stuff is genuinely hard to talk about."
+- Share back first: "A lot of founders at this stage struggle with X — is that something you recognize?"
+
+### When they go long
+
+Let them run for a bit. Then: "Let me make sure I captured what matters here — is it that [summary]?"
+It helps you confirm understanding and signals you're tracking.
+
+---
+
+## Red Flag Patterns and What to Do
+
+### "We have no real competition."
+**Red flag:** They're either in a genuinely new market (rare) or they've defined competition too narrowly (common).
+**Probe:** "What would someone do today if your product didn't exist? Who benefits if you fail?"
+
+### "Our values are X, Y, Z."
+**Red flag:** If they come out immediately and cleanly, they're probably from the website.
+**Probe:** "Tell me about a time you had to actually enforce one of those values — when it cost something."
+
+### "The team is great. Everyone's aligned."
+**Red flag:** Either they've built something exceptional, or they're not seeing the tensions.
+**Probe:** "What's the last thing you disagreed with someone on the team about? How did it go?"
+
+### "I don't really have blind spots."
+**Red flag:** Everyone has blind spots. Founders who can't name theirs are the most dangerous.
+**Probe:** "What would your co-founder say if I asked them what you should stop doing?"
+**Or:** "When you look back on hard moments in this company, what's the pattern of what you got wrong?"
+
+### "Revenue is good, things are growing."
+**Red flag:** "Good" is not a number.
+**Probe:** "Give me a range — is this $100K ARR, $1M, $10M? I'm not sharing it anywhere."
+
+### "We just need more customers."
+**Red flag:** This is almost never the root problem.
+**Probe:** "What's driving the growth you have? Why aren't more customers finding you, or converting, or staying?"
+
+---
+
+## Capturing Implicit Context
+
+The most valuable context is often what they don't say. Document it.
+
+**Capture in the "Key Themes & Implicit Signals" section:**
+
+- What they mentioned first (reveals priority)
+- What they glossed over (reveals avoidance or comfort)
+- Where the energy was (reveals passion vs obligation)
+- What they contradicted between dimensions (reveals gaps)
+- The adjective they used most often (reveals self-perception)
+
+**Examples of implicit signals:**
+
+- Founder talks about product with energy, team with fatigue → probably underinvested in people management
+- Mission sounds borrowed, not owned → founder-market fit risk
+- Strong on vision, weak on operational specifics → execution gap
+- Detailed on competition, vague on advantage → defensive posture, not confident in differentiation
+- Runway question answered precisely → financially aware. Answered vaguely → either worried or detached.
+
+---
+
+## Handling Reluctant Founders
+
+Some founders are guarded. Usually for one of three reasons:
+
+1. **They don't trust you yet.** Give it time. Ask easier questions first. Build rapport.
+2. **They're in denial.** Something is wrong and they're not ready to say it. Circles around topics, comes back to them.
+3. **They're protecting someone.** A co-founder, investor, or key employee is the real problem and they won't name them.
+
+**Tactics:**
+- Give them an out: "You don't have to answer this specifically — just give me the shape of it."
+- Normalize the problem: "A lot of founders at this stage are dealing with X..."
+- Ask about others: "What advice would you give a founder in your exact situation?"
+- Come back later: If they shut down a dimension, note it and return after trust is built.
+
+---
+
+## After the Interview
+
+Before generating the file:
+
+1. **Read back your notes.** Find the 3–5 most important things. They should be in the output.
+2. **Identify the biggest gap** — what's the thing they didn't say that the questions should have surfaced?
+3. **Synthesize tensions** — where did what they said in one dimension contradict another?
+4. **Write the Watch List** — what needs to be re-checked in 90 days?
+
+Then generate the context file. The last section — "Key Themes & Implicit Signals" — is the most important one. Don't skip it.
+
+---
+
+## Quality Check
+
+Before finishing, ask yourself:
+
+- [ ] Could the C-suite advisors give specific advice based on this context?
+- [ ] Does this capture what's real vs what's aspirational?
+- [ ] Is the Watch List honest about what's uncertain or worrying?
+- [ ] Does the founder profile feel like a real person, not a LinkedIn bio?
+- [ ] Did I capture implicit signals, not just explicit answers?
+
+If any answer is no, go back and fill it in.
+
+---
+
+## The One-Sentence Version
+
+Your job is to understand this company well enough that every advisor response feels like it came from someone who's been in the room for six months — not someone who just read the website.

package/skills/cs-onboard/templates/company-context-template.md

@@ -0,0 +1,144 @@
+# Company Context
+
+**Last updated:** [DATE]
+**Status:** fresh | stale (>90 days)
+**Interview type:** full | update
+
+---
+
+## 1. Company Identity
+
+**What we do:**
+[One paragraph — product/service, who it's for, core use case]
+
+**Why we exist (founding reason):**
+[The real reason, not the pitch]
+
+**One-sentence pitch:**
+[Sharpened during interview]
+
+**Non-negotiable values:**
+- [Value 1] — [what would violate it]
+- [Value 2] — [what would violate it]
+- [Value 3] — [what would violate it]
+
+---
+
+## 2. Stage & Scale
+
+**Team size:** [N full-time] + [N contractors/part-time]
+**Revenue:** [ARR/MRR range, e.g., "$500K–$1M ARR"]
+**Runway:** [N months]
+**Stage:** pre-PMF | scaling | optimizing
+
+**What broke recently (last 90 days):**
+[Specific failure, cost, and root cause if known]
+
+---
+
+## 3. Founder Profile
+
+**Name / Role:**
+
+**Superpower:**
+[What they do better than almost anyone on their team]
+
+**Blind spots:**
+[Acknowledged or revealed — be specific]
+
+**Founder archetype:** product | sales | technical | operator
+
+**What keeps them up at night:**
+[The real concern, not the investor-safe version]
+
+---
+
+## 4. Team & Culture
+
+**Team in 3 words:** [word], [word], [word]
+
+**Culture — what's real:**
+[Which values are actually lived]
+
+**Culture — what's aspirational:**
+[Which values are poster-on-the-wall]
+
+**Strongest leader:**
+[Role / what makes them strong]
+
+**Weakest seat:**
+[Role / what the risk is]
+
+**Last significant conflict:**
+[What happened, how it resolved, what it revealed]
+
+---
+
+## 5. Market & Competition
+
+**Who's winning right now:**
+[Market leader + honest reason why]
+
+**Unfair advantage (honest version):**
+[Not the pitch — the real structural edge]
+
+**Kill-shot risk:**
+[The one competitor move that would actually hurt]
+
+**Market dynamics:**
+[Tailwinds, headwinds, timing factors]
+
+---
+
+## 6. Current Challenges
+
+**Priority stack-rank:**
+1. [Highest priority: product/growth/people/money/operations]
+2.
+3.
+4.
+5.
+
+**The avoided decision:**
+[What they've been putting off — and why]
+
+**The "one extra day" answer:**
+[What they'd actually work on — reveals true priority]
+
+---
+
+## 7. Goals & Ambition
+
+**12-month target:**
+[Specific — revenue, product milestone, market position]
+
+**36-month target:**
+[Directional — where does this company go]
+
+**Exit orientation:** building to exit | building to run | undecided
+
+**Personal success definition:**
+[Separate from company — what does winning look like for them personally]
+
+---
+
+## Key Themes & Implicit Signals
+
+**Patterns observed:**
+[What came up repeatedly, what they rushed past, emotional charge on topics]
+
+**Implicit tensions:**
+[Gaps between stated and revealed — e.g., "says people are fine, but conflict story suggests otherwise"]
+
+**Watch list:**
+[Things to check on in the next update — risks, avoided decisions, relationships to monitor]
+
+---
+
+## Context Metadata
+
+- **Interview conducted:** [DATE]
+- **Duration:** [N minutes]
+- **Interview type:** full | update
+- **Next refresh due:** [DATE + 90 days]
+- **Confidence level:** high | medium | low (low = founder was guarded)

package/skills/csp-headers/SKILL.md

@@ -0,0 +1,53 @@
+---
+name: csp-headers
+description: "Configure security headers (CSP, HSTS, Permissions-Policy, COOP/COEP) for Go/TS backends and Cloudflare. Prevents XSS and clickjacking."
+category: "security"
+argument-hint: "[stack: go|ts|cloudflare]"
+user-invocable: true
+allowed-tools: Read, Glob, Grep, Bash, Write, Edit, Task
+---
+# CSP & Security Headers
+
+Default deny, nonces en CSP, report-only antes de enforce. Stack: Go + TS backends, React+Vite frontends, Cloudflare CDN.
+
+## Headers Críticos
+
+| Header | Objetivo | Criticidad |
+|---|---|---|
+| `Content-Security-Policy` | Prevenir XSS, data exfiltration | ALTA |
+| `Strict-Transport-Security` | Forzar HTTPS | ALTA |
+| `X-Content-Type-Options: nosniff` | Evitar MIME sniffing | MEDIA |
+| `Referrer-Policy: strict-origin-when-cross-origin` | No leak URLs | MEDIA |
+| `Permissions-Policy` | Deshabilitar APIs no usadas (cam/mic/geo) | MEDIA |
+| `Cross-Origin-Opener-Policy: same-origin` | Aislar browsing context | MEDIA |
+| `X-Frame-Options: DENY` | Clickjacking (legacy; CSP frame-ancestors lo supera) | MEDIA |
+
+`X-XSS-Protection` está **deprecado** — solo CSP.
+
+## CSP Default Educabot
+
+`default-src 'self'` + `script-src 'self' 'nonce-{RANDOM}' 'strict-dynamic'` + `style-src 'self' 'nonce-{RANDOM}'` + img/font/connect whitelists + `frame-ancestors 'none'` + `base-uri 'self'` + `form-action 'self'` + `upgrade-insecure-requests` + `report-uri`.
+
+**Nonces:** 128-bit crypto-random por request. Inyectar en `<script nonce>` y `<style nonce>` server-side. NUNCA `unsafe-inline` junto con nonce.
+
+**strict-dynamic:** scripts con nonce cargan otros dinámicamente. Reemplaza whitelist de dominios (débil contra JSONP bypass).
+
+**Vite SPA (sin SSR):** `vite-plugin-csp-guard` (hashes SHA256 en build time), o proxy que inyecta nonce, o SSR con nonce por request.
+
+## Report-Only → Enforce
+
+1. **Report-only 2-4 semanas:** `Content-Security-Policy-Report-Only` + endpoint `/csp-report`
+2. **Analizar:** agrupar por blocked-uri/violated-directive → whitelist/remover/mover
+3. **Enforce:** `Content-Security-Policy`
+
+## HSTS
+
+`max-age=63072000; includeSubDomains; preload`. Empezar con max-age corto (300s), escalar. Preload: difícil salir (meses). Submit en hstspreload.org.
+
+## Permissions-Policy
+
+Default: `camera=(), microphone=(), geolocation=(), interest-cohort=()`. Apps educativas con webcam: `camera=(self), microphone=(self)`.
+
+> → Read references/implementation.md for Go, TS, Cloudflare implementation details, iframe/embedding config, testing tools
+
+> → Read references/anti-patterns-checklist.md for anti-patterns and pre-deployment checklist

package/skills/csp-headers/references/anti-patterns-checklist.md

@@ -0,0 +1,26 @@
+# Anti-patterns & Checklist — CSP & Security Headers
+
+## Anti-patterns
+
+- `unsafe-inline`/`unsafe-eval` en script-src, `*` en directivas
+- CSP solo en `<meta>` (bypasseable), HSTS sin includeSubDomains
+- Headers solo en algunas rutas (debe ser middleware global)
+- No monitorear reports, enforce sin report-only phase
+- `X-XSS-Protection: 1; mode=block` (deprecado)
+- Whitelist dominios en vez de strict-dynamic, nonces con Math.random
+- Mismo nonce entre requests, report-uri sin endpoint real
+
+## Checklist
+
+- [ ] CSP report-only 2-4 semanas antes de enforce
+- [ ] Endpoint /csp-report existe con dashboard/alertas
+- [ ] Nonces CSPRNG, sin unsafe-inline/unsafe-eval
+- [ ] strict-dynamic en vez de whitelist dominios
+- [ ] HSTS includeSubDomains + preload (si aplica)
+- [ ] X-Content-Type-Options: nosniff
+- [ ] Referrer-Policy, Permissions-Policy, frame-ancestors
+- [ ] Headers como middleware global
+- [ ] Score A+ en securityheaders.com
+- [ ] X-XSS-Protection removido
+- [ ] Cloudflare no duplica/pisa headers origin
+- [ ] Dev/staging mismos headers que prod (solo report-only cambia)

package/skills/csp-headers/references/implementation.md

@@ -0,0 +1,18 @@
+# Implementation Details — CSP & Security Headers
+
+## Go
+Middleware genera nonce (`crypto/rand`), inyecta en context + CSP header (nonce interpolado), setea todos los headers. Template accede nonce via context.
+
+## TS (Express)
+`helmet` con CSP override (useDefaults: false), nonce via `res.locals.cspNonce` (`crypto.randomBytes`), Permissions-Policy manual. `reportOnly` configurable via env.
+
+## Cloudflare
+Preferir headers desde origin (mas testeable). Si necesario: Transform Rules (estaticos, no nonces) o Workers (nonces per-request + HTMLRewriter para inyectar).
+
+## Iframes / Embedding
+
+Educabot embebe contenido educativo: `frame-src 'self' youtube-nocookie.com view.genially.com classroom.google.com`. `frame-ancestors 'none'` salvo LMS externo (whitelist explicito).
+
+## Testing
+
+securityheaders.com (A+), csp-evaluator.withgoogle.com, hstspreload.org, `curl -I | grep`, DevTools Network headers, Console violations en report-only.

package/skills/cto-advisor/SKILL.md

@@ -0,0 +1,95 @@
+---
+name: cto-advisor
+description: "Technical leadership for engineering teams, architecture decisions, and technology strategy. Tech debt assessment, DORA metrics, build-vs-buy analysis, and engineering org scaling."
+argument-hint: ""
+category: "clevel-advisors"
+user-invocable: true
+allowed-tools: Read, Glob, Grep, Bash
+---
+
+# CTO Advisor
+
+Technical leadership frameworks for architecture, engineering teams, technology strategy, and technical decision-making.
+
+## Core Responsibilities
+
+### 1. Technology Strategy
+Align technology investments with business priorities: technology vision (3-year), architecture roadmap, innovation budget (10-20% of capacity), build vs buy decisions, and technical debt strategy. See `references/technology_evaluation_framework.md`.
+
+### 2. Engineering Team Leadership
+Scale the engineering org's productivity — not individual output. Hire for the next stage. Every 3x in team size requires a reorg. Manager:IC ratio: 5-8 direct reports optimal. See `references/engineering_metrics.md`.
+
+### 3. Architecture Governance
+Create the framework for making good decisions — not making every decision yourself. Every significant decision gets an ADR: context, options, decision, consequences. See `references/architecture_decision_records.md`.
+
+### 4. Vendor & Platform Management
+Every vendor is a dependency. Every dependency is a risk. Evaluate: Does it solve a real problem? Can we migrate away? What's the total cost?
+
+### 5. Crisis Management
+Incident response, security breaches, major outages. Your role: ensure the right people are on it, communication is flowing, business is informed. Post-crisis: blameless retrospective within 48 hours.
+
+## Workflows
+
+See `references/workflows.md` for detailed step-by-step workflows:
+- **Tech Debt Assessment** — Run analyzer, interpret severity scores, build prioritized remediation plan
+- **ADR Creation** — Identify decision, draft using template, validate, communicate
+- **Build vs Buy Analysis** — Define requirements, score vendors, document decision as ADR
+
+## Key Questions a CTO Asks
+
+- "What's our biggest technical risk right now — not the most annoying, the most dangerous?"
+- "If we 10x our traffic tomorrow, what breaks first?"
+- "How much of our engineering time goes to maintenance vs new features?"
+- "Are we building this because it's the right solution, or because it's the interesting one?"
+
+## CTO Metrics Dashboard
+
+| Category | Metric | Target | Frequency |
+|----------|--------|--------|-----------|
+| **Velocity** | Deployment frequency | Daily (or per-commit) | Weekly |
+| **Velocity** | Lead time for changes | < 1 day | Weekly |
+| **Quality** | Change failure rate | < 5% | Weekly |
+| **Quality** | MTTR | < 1 hour | Weekly |
+| **Debt** | Tech debt ratio | < 25% | Monthly |
+| **Team** | Engineering satisfaction | > 7/10 | Quarterly |
+| **Architecture** | System uptime | > 99.9% | Monthly |
+| **Cost** | Cloud spend / revenue ratio | Declining trend | Monthly |
+
+## Red Flags
+
+- Tech debt ratio > 30% and growing faster than it's being paid down
+- Deployment frequency declining over 4+ weeks
+- No ADRs for the last 3 major decisions
+- Single points of failure on critical systems with no mitigation plan
+
+## Integration with C-Suite Roles
+
+| When... | CTO works with... | To... |
+|---------|-------------------|-------|
+| Roadmap planning | CPO | Align technical and product roadmaps |
+| Budget planning | CFO | Cloud costs, tooling, headcount budget |
+| Security posture | CISO | Architecture review, compliance requirements |
+| Hard calls | Executive Mentor | "Should we rewrite?" "Should we switch stacks?" |
+
+## Proactive Triggers
+
+- Deployment frequency dropping → early signal of team health issues
+- Tech debt ratio > 30% → recommend a tech debt sprint
+- Cloud costs growing faster than revenue → cost optimization review
+- Security audit overdue (> 12 months) → escalate to CISO
+
+## Reasoning Technique: ReAct (Reason then Act)
+
+Research the technical landscape first. Analyze options against constraints. Then recommend action. Always ground recommendations in evidence.
+
+## Communication
+
+All output passes the Internal Quality Loop before reaching the founder (see `agent-protocol/SKILL.md`).
+- Output format: Bottom Line → What (with confidence) → Why → How to Act → Your Decision
+- Every finding tagged: verified, medium confidence, or assumed.
+
+## Resources
+- `references/technology_evaluation_framework.md` — Build vs buy, vendor evaluation, technology radar
+- `references/engineering_metrics.md` — DORA metrics, engineering health dashboard, team productivity
+- `references/architecture_decision_records.md` — ADR templates, decision governance, review process
+- `references/workflows.md` — Tech debt assessment, ADR creation, build vs buy workflows