claudeos-core 1.6.2 → 1.7.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claudeos-core",
-  "version": "1.6.2",
+  "version": "1.7.1",
   "description": "Auto-generate Claude Code documentation from your actual source code — Standards, Rules, Skills, and Guides tailored to your project",
   "main": "bin/cli.js",
   "bin": {

package/pass-prompts/templates/common/pass3-footer.md

@@ -1,3 +1,23 @@
-
-After completion, run the following commands in order:
-1. npx claudeos-core health
+
+CRITICAL — No Hallucination Guard:
+You may ONLY reference technologies that are explicitly present in the two files you read:
+project-analysis.json (stack detection results) and pass2-merged.json (code analysis results).
+If a library, framework, tool, or pattern does NOT appear in either of these files,
+you MUST NOT mention it, generate code examples for it, or assume it exists — not in
+standards, rules, skills, guides, database docs, or CLAUDE.md.
+Do NOT infer or guess technologies from other detected technologies.
+Examples of violations:
+- Writing "React Query caching" when pass2-merged.json has no TanStack Query / React Query entry
+- Adding "Zustand store pattern" when pass2-merged.json has no Zustand usage
+- Generating "Prisma schema" examples when project-analysis.json ORM is not Prisma
+- Assuming React Query exists because Orval was detected (inference is NOT detection)
+When in doubt, omit. Missing content is fixable; hallucinated content erodes trust.
+
+CRITICAL — Skill Orchestrator Completeness:
+The orchestrator file (e.g., 01.scaffold-page-feature.md, 01.scaffold-crud-feature.md)
+MUST list ALL sub-skill files in its execution order table with no gaps.
+Every sub-skill file generated in the scaffold directory MUST have a corresponding row.
+Do NOT skip any number in the sequence.
+
+After completion, run the following commands in order:
+1. npx claudeos-core health

package/pass-prompts/templates/node-vite/pass1.md

@@ -0,0 +1,117 @@
+Read claudeos-core/generated/project-analysis.json and
+perform a deep analysis of the following domains only: {{DOMAIN_GROUP}}
+
+For each domain, select one representative file per layer, read its code, and analyze it.
+Prioritize files with the richest patterns.
+
+Analysis items (per domain):
+
+1. Page/Routing Patterns
+   - Client-side routing (React Router, TanStack Router, custom)
+   - Route definition approach (file-based, config-based, lazy loading)
+   - Layout structure (nested layouts, outlet, wrapper components)
+   - Dynamic routes and route parameters
+   - Route guards and authentication redirects
+   - Error/404 handling
+
+2. Component Patterns
+   - Component structure (functional, forwardRef, memo)
+   - Props type definition (interface vs type, Generic usage)
+   - State management (useState, useReducer, external libraries)
+   - Styling approach and exact import paths (e.g., `import styles from './index.module.scss'`, `import { cn } from '@/lib/utils'`)
+   - Styling utility functions: record the EXACT import path used in source code
+   - UI library and exact package names (e.g., `@mui/material`, `antd`, `@shadcn/ui`)
+   - Component classification (UI, Feature, Layout, Page)
+   - Component entry file pattern: is the main file `index.tsx` or `ComponentName.tsx`? Record exactly.
+   - Directory structure pattern: record exact convention
+   - export pattern: default export vs named export in component files
+   - Reuse patterns (composition, compound components, render props)
+   - Accessibility (ARIA, semantic HTML, keyboard navigation)
+
+3. Data Fetching Patterns
+   - Client-side data fetching (TanStack Query, SWR, useEffect, axios)
+   - API client configuration (base URL, interceptors, error handling)
+   - Request/response typing
+   - Caching strategy (query keys, stale time, refetch)
+   - Error/loading state handling
+   - Optimistic updates
+   - Pagination/infinite scroll patterns
+
+4. State Management Patterns
+   - Global state (Zustand, Redux Toolkit, Jotai, Recoil, Context)
+   - Server state (TanStack Query, SWR)
+   - URL state (searchParams, useNavigate)
+   - Form state (React Hook Form, Formik)
+   - Local component state patterns
+
+5. Configuration/Environment Patterns
+   - Environment variable management (VITE_ prefix convention, .env separation)
+   - vite.config settings (proxy, aliases, plugins)
+   - Build optimization (chunk splitting, dynamic imports)
+   - Path aliases (@/, src/)
+
+6. Logging/Monitoring Patterns
+   - Client error tracking (Sentry, DataDog RUM)
+   - Performance monitoring
+   - Analytics tools (Google Analytics, PostHog, Mixpanel)
+
+7. Testing Patterns
+   - Test framework (Vitest, Jest, Playwright, Cypress)
+   - Component testing (React Testing Library, Storybook)
+   - E2E testing strategy
+   - Mocking strategy (MSW, vi.mock)
+   - Test naming conventions
+
+8. Domain-Specific Patterns
+   - Authentication/authorization (session, token, OAuth)
+   - Internationalization (i18next, react-intl)
+   - File upload patterns
+   - Real-time features (WebSocket, SSE)
+   - API versioning strategy
+
+9. Anti-patterns / Inconsistencies
+   - Patterns inconsistent with other domains
+   - Performance issues (unnecessary re-renders, bundle size)
+   - Type safety issues
+   - Accessibility issues
+   - Security issues (XSS, CSRF)
+
+Do not create or modify source files. Analysis only.
+Save results to claudeos-core/generated/pass1-{{PASS_NUM}}.json in the following format:
+
+{
+  "analyzedAt": "ISO timestamp",
+  "passNum": {{PASS_NUM}},
+  "domains": ["auth", "dashboard", "settings", "shared"],
+  "analysisPerDomain": {
+    "dashboard": {
+      "representativeFiles": {
+        "page": "src/pages/dashboard/index.tsx",
+        "component": "src/components/dashboard/StatsCard.tsx",
+        "hook": "src/hooks/useDashboardData.ts",
+        "api": "src/api/dashboard.ts"
+      },
+      "patterns": {
+        "page": { ... },
+        "component": {
+          "entryFilePattern": "index.tsx or ComponentName.tsx",
+          "exportPattern": "default export or named export",
+          "stylingImport": "exact import statement used for styling utility",
+          "uiLibraryImport": "exact import statement for UI components",
+          ...
+        },
+        "dataFetching": { ... },
+        "stateManagement": { ... },
+        "config": { ... },
+        "logging": { ... },
+        "testing": { ... }
+      },
+      "specialPatterns": [],
+      "antiPatterns": []
+    }
+  },
+  "crossDomainCommon": {
+    "description": "Patterns commonly used across domains in this group",
+    "patterns": []
+  }
+}

package/pass-prompts/templates/node-vite/pass2.md

@@ -0,0 +1,78 @@
+Read all pass1-*.json files from the claudeos-core/generated/ directory and
+merge all domain analysis results into a single unified report.
+
+Merge items:
+
+1. Universal Patterns (shared by 100% of all domains)
+   - Page/routing structure (React Router / TanStack Router / custom)
+   - Component writing conventions (functional, Props types, styling)
+   - Data fetching strategy (TanStack Query, SWR, axios patterns)
+   - State management approach
+   - Error/loading handling patterns
+   - Route guard/protection patterns
+
+2. Majority Patterns (shared by 50%+ of domains)
+   - Specify which domains share them
+
+3. Domain-Specific Patterns (unique to a single domain)
+   - Auth: which domain
+   - Real-time features: which domain
+   - File upload: which domain
+   - i18n: which domain
+
+4. Anti-pattern Summary
+   - Consolidate all inconsistencies found across domains
+   - Classify by severity (CRITICAL / HIGH / MEDIUM / LOW)
+
+5. Naming Conventions Summary
+   - File/directory naming (kebab-case, PascalCase)
+   - Component entry file pattern (index.tsx vs ComponentName.tsx — pick ONE that the project actually uses)
+   - Component export pattern (default export vs named export)
+   - Hook naming (use* prefix)
+   - API function patterns
+
+6. Shared Types/Components List
+   - Common UI components with EXACT import paths
+   - Shared hooks with exact import paths
+   - Utility functions with EXACT import paths
+   - Path aliases used in the project (e.g., `@/` -> `src/`)
+   - Environment variable types
+   - Constants/Enum management
+
+7. Security/Authentication Patterns
+   - Authentication approach (JWT, session, OAuth)
+   - Route protection strategy
+   - CSRF/XSS prevention
+   - Environment variable management (VITE_ convention)
+
+8. Database Patterns
+   - API endpoint conventions
+   - Request/response format
+   - Error response handling
+
+9. Testing Strategy Summary
+   - Test coverage level
+   - Test classification system (unit/component/E2E)
+   - Mocking strategy (MSW, vi.mock)
+   - Storybook usage
+   - Test naming conventions
+
+10. Logging/Monitoring Strategy
+    - Error tracking approach (Sentry, DataDog)
+    - Analytics tools
+    - Performance monitoring
+
+11. Performance Patterns
+    - Code splitting strategy (lazy, Suspense)
+    - Bundle optimization (chunk splitting, tree shaking)
+    - Image optimization
+    - Caching strategy
+
+12. Code Quality Tools
+    - Lint/Format tools (ESLint, Prettier, Biome)
+    - Pre-commit hooks (husky, lint-staged)
+    - TypeScript strict mode
+    - CI integration status
+
+Do not generate code. Merge only.
+Save results to claudeos-core/generated/pass2-merged.json.

package/pass-prompts/templates/node-vite/pass3.md

@@ -0,0 +1,103 @@
+Read claudeos-core/generated/project-analysis.json and
+claudeos-core/generated/pass2-merged.json, then
+generate all ClaudeOS-Core files based on the analysis results.
+
+Do not read the original source code again. Reference only the analysis results.
+
+CRITICAL — Package Manager Consistency:
+Check `stack.packageManager` in project-analysis.json (e.g., "pnpm", "yarn", "npm").
+ALL generated files MUST use ONLY that detected package manager's commands.
+NEVER mix npm/yarn/pnpm commands. Also check `scripts` field in the project's package.json
+for actual script names.
+
+CRITICAL — Cross-file Consistency:
+Rules (.claude/rules/) and Standards (claudeos-core/standard/) MUST NOT contradict each other.
+
+CRITICAL — Code Example Accuracy:
+ALL code examples in rules and standards MUST use EXACT method names, class names,
+and signatures from pass2-merged.json analysis data.
+Do NOT paraphrase, rename, or infer API names.
+
+CRITICAL — CLAUDE.md Reference Table Completeness:
+The reference table in CLAUDE.md MUST list ALL generated standard files.
+
+Generation targets:
+
+1. CLAUDE.md (project root)
+   - Role definition (based on detected stack — Vite + React SPA)
+   - Build & Run Commands (use ONLY the detected packageManager)
+   - Core architecture diagram (client-side SPA, routing, state management)
+   - Directory structure description
+   - Standard/Skills/Guide reference table
+
+2. claudeos-core/standard/ (active domains only)
+   - 00.core/01.project-overview.md — Stack, routing approach, deployment environment
+   - 00.core/02.architecture.md — SPA structure, component hierarchy, data flow
+   - 00.core/03.naming-conventions.md — File/component/hook/type naming conventions
+   - 20.frontend-ui/01.component-patterns.md — Component writing rules, Props patterns, reuse
+   - 20.frontend-ui/02.page-routing-patterns.md — Client-side routing, layouts, route guards, lazy loading
+   - 20.frontend-ui/03.data-fetching.md — API client, TanStack Query/SWR, caching, error handling
+   - 20.frontend-ui/04.state-management.md — Global/server/URL/form state management
+   - 20.frontend-ui/05.styling-patterns.md — Styling rules, theming, responsive, accessibility
+   - 30.security-db/01.security-auth.md — Auth patterns, token management, route protection, environment variables
+   - 40.infra/01.environment-config.md — Environment variables (VITE_ prefix), vite.config, build optimization
+   - 40.infra/02.logging-monitoring.md — Error tracking, analytics tools, performance monitoring
+   - 40.infra/03.cicd-deployment.md — CI/CD, static hosting deployment (Nginx, S3, Vercel, Netlify)
+   - 50.verification/01.development-verification.md — Build, startup, dev server
+   - 50.verification/02.testing-strategy.md — Testing strategy (Vitest, RTL, E2E, Storybook)
+
+   Each file MUST include:
+   - Correct examples (code blocks)
+   - Incorrect examples (code blocks)
+   - Key rules summary table
+
+3. .claude/rules/ (active domains only)
+   - Write the full rule content directly in each file (self-contained, no external references)
+   - Include 5-15 lines of key rules with concrete examples
+   - Do NOT use @import — it is not a Claude Code feature and does not work
+   - Each rule file MUST end with a `## Reference` section linking to the corresponding standard file(s):
+     ```
+     ## Reference
+     > For detailed patterns and examples, Read: claudeos-core/standard/20.frontend-ui/01.component-patterns.md
+     ```
+   - `paths:` frontmatter per rule category:
+     - `00.core/*` rules: `paths: ["**/*"]`
+     - `20.frontend/*` rules: `paths: ["**/*"]`
+     - `30.security-db/*` rules: `paths: ["**/*"]`
+     - `40.infra/*` rules: `paths: ["**/*.json", "**/*.env*", "**/vite.config.*", "**/Dockerfile*", "**/*.yml", "**/*.yaml"]`
+     - `50.sync/*` rules: `paths: ["**/claudeos-core/**", "**/.claude/**"]`
+   - MUST generate `.claude/rules/00.core/00.standard-reference.md` — directory of all standard files.
+
+4. .claude/rules/50.sync/ (3 sync rules)
+   - 01.standard-sync.md — Remind AI to update plan/10 when standard is modified
+   - 02.rules-sync.md — Remind AI to update plan/20 when rules is modified
+   - 03.skills-sync.md — Remind AI to update plan/30 when skills is modified
+
+5. claudeos-core/skills/ (active domains only)
+   - 20.frontend-page/01.scaffold-page-feature.md (orchestrator)
+   - 20.frontend-page/scaffold-page-feature/01~08 (sub-skills: page, layout, component, hook, api-client, test, style, index)
+   - 00.shared/MANIFEST.md (skill registry)
+
+6. claudeos-core/guide/ (all)
+   - 01.onboarding/01.overview.md
+   - 01.onboarding/02.quickstart.md
+   - 01.onboarding/03.glossary.md
+   - 02.usage/01.faq.md
+   - 02.usage/02.real-world-examples.md
+   - 02.usage/03.do-and-dont.md
+   - 03.troubleshooting/01.troubleshooting.md
+   - 04.architecture/01.file-map.md
+   - 04.architecture/02.pros-and-cons.md
+
+7. claudeos-core/plan/ (Master Plan)
+   - 10.standard-master.md — CLAUDE.md + all standard/ files as <file> blocks
+   - 20.rules-master.md — All rules/ (except sync) as <file> blocks
+   - 21.sync-rules-master.md — All sync rules (code block format)
+   - 30.frontend-skills-master.md — All frontend skills as <file> blocks
+   - 40.guides-master.md — All guide/ files as <file> blocks
+
+8. claudeos-core/database/
+   - 01.schema-overview.md — API endpoint catalog, request/response schemas (if applicable)
+
+9. claudeos-core/mcp-guide/
+   - 01.mcp-overview.md — List of MCP servers in use, integration methods

package/pass-prompts/templates/python-flask/pass1.md

@@ -0,0 +1,119 @@
+Read claudeos-core/generated/project-analysis.json and
+perform a deep analysis of the following domains only: {{DOMAIN_GROUP}}
+
+For each domain, select one representative file per layer, read its code, and analyze it.
+Prioritize files with the richest patterns.
+
+Analysis items (per domain):
+
+1. Route/Blueprint Patterns
+   - Blueprint structure (Blueprint registration, url_prefix, naming)
+   - Route decorators (@app.route, @bp.route with methods)
+   - URL patterns and naming conventions
+   - View function structure (function-based vs class-based MethodView)
+   - Request handling (request.args, request.form, request.json, request.files)
+   - Response patterns (jsonify, make_response, Response, redirect, abort)
+   - If a custom response wrapper exists, record its EXACT function/class name, EXACT import path
+   - **Response wrapping layer (CRITICAL)**: Which layer formats the response?
+     Does the route handler call it directly, or does a service layer return formatted data?
+   - Error handling (errorhandler, abort, custom exception classes)
+   - Authentication (flask-login, flask-jwt-extended, custom decorators)
+   - API documentation (flask-restx, flask-smorest, flasgger)
+   - Pagination patterns
+
+2. Data Model Patterns
+   - ORM (SQLAlchemy, Flask-SQLAlchemy, Peewee)
+   - Model structure (db.Model, relationships, mixins)
+   - Serialization (marshmallow, flask-marshmallow, manual to_dict)
+   - Form validation (WTForms, Flask-WTF, manual)
+   - Request/Response schema separation
+   - Enum/constant management
+
+3. Data Access Patterns
+   - Session management (db.session, scoped_session)
+   - Repository/DAO pattern vs direct model queries
+   - Migration (Flask-Migrate / Alembic)
+   - Query optimization (eager loading, lazy loading)
+   - Connection management (pool, teardown_appcontext)
+   - Transaction management
+
+4. Application Structure Patterns
+   - Application factory (create_app)
+   - Configuration (app.config, from_object, from_envvar)
+   - Extension initialization (db.init_app, login_manager.init_app)
+   - Context (application context, request context, g, current_app)
+   - Before/after request hooks (before_request, after_request, teardown_request)
+   - Import paths: record EXACT import conventions
+   - Utility function locations: record EXACT module paths
+
+5. Configuration/Environment Patterns
+   - Environment variable management (python-dotenv, os.environ)
+   - Config classes (DevelopmentConfig, ProductionConfig)
+   - Per-environment branching
+   - Secret management (SECRET_KEY, database URL)
+
+6. Logging Patterns
+   - Logger usage (app.logger, structlog, loguru, logging)
+   - Log level policy
+   - Request/response logging
+   - Error logging
+
+7. Testing Patterns
+   - Test framework (pytest, unittest)
+   - Test client (app.test_client, pytest fixtures)
+   - Application factory testing (create_app with test config)
+   - Fixture management (conftest, client fixture)
+   - DB test strategy (test DB, SQLite in-memory, transaction rollback)
+   - Mocking (unittest.mock, pytest-mock, responses)
+
+8. Domain-Specific Patterns
+   - Template rendering (Jinja2, render_template) vs JSON API
+   - File upload (request.files, werkzeug FileStorage)
+   - Background tasks (Celery, RQ, APScheduler)
+   - WebSocket (Flask-SocketIO)
+   - External API integration (requests, httpx)
+   - Caching (Flask-Caching, Redis)
+   - Session management (server-side, Flask-Session)
+   - CSRF protection (Flask-WTF CSRFProtect)
+
+9. Anti-patterns / Inconsistencies
+   - Circular imports
+   - Missing application factory
+   - Global state misuse
+   - Missing error handlers
+   - Security issues (injection, missing CSRF, debug mode in production)
+   - Performance issues (blocking I/O, N+1 queries)
+
+Do not create or modify source files. Analysis only.
+Save results to claudeos-core/generated/pass1-{{PASS_NUM}}.json in the following format:
+
+{
+  "analyzedAt": "ISO timestamp",
+  "passNum": {{PASS_NUM}},
+  "domains": ["auth", "users", "orders", "products"],
+  "analysisPerDomain": {
+    "users": {
+      "representativeFiles": {
+        "routes": "app/users/routes.py",
+        "models": "app/users/models.py",
+        "forms": "app/users/forms.py",
+        "services": "app/users/services.py"
+      },
+      "patterns": {
+        "routes": { ... },
+        "models": { ... },
+        "dataAccess": { ... },
+        "appStructure": { ... },
+        "config": { ... },
+        "logging": { ... },
+        "testing": { ... }
+      },
+      "specialPatterns": [],
+      "antiPatterns": []
+    }
+  },
+  "crossDomainCommon": {
+    "description": "Patterns commonly used across domains in this group",
+    "patterns": []
+  }
+}

package/pass-prompts/templates/python-flask/pass2.md

@@ -0,0 +1,85 @@
+Read all pass1-*.json files from the claudeos-core/generated/ directory and
+merge all domain analysis results into a single unified report.
+
+Merge items:
+
+1. Universal Patterns (shared by 100% of all domains)
+   - Route/Blueprint style (decorators, response format, status codes)
+   - **Response flow**: Which layer wraps the response? (route handler vs service layer)
+     Record the definitive answer. If an orchestration layer exists, describe it.
+   - Model/serialization conventions (SQLAlchemy, marshmallow)
+   - Data access patterns (session management, queries)
+   - Application factory structure (create_app, extensions)
+   - Error handling patterns
+   - Before/after request hooks
+
+2. Majority Patterns (shared by 50%+ of domains)
+   - Specify which domains share them
+
+3. Domain-Specific Patterns (unique to a single domain)
+   - File upload: which domain
+   - WebSocket: which domain
+   - Background tasks: which domain
+   - External API: which domain
+   - Caching: which domain
+   - Template rendering: which domain
+
+4. Anti-pattern Summary
+   - Consolidate all inconsistencies found across domains
+   - Classify by severity (CRITICAL / HIGH / MEDIUM / LOW)
+
+5. Naming Conventions Summary
+   - Module/package naming (snake_case)
+   - Blueprint naming conventions
+   - Model/schema naming conventions
+   - Route URL patterns
+   - File structure conventions
+
+6. Common Models/Utilities List
+   - Base model mixins with EXACT import paths
+   - Shared utility functions with EXACT module paths
+   - Constants/Enum management with EXACT locations
+   - Extension instances (db, login_manager, etc.)
+
+7. Security/Authentication Patterns
+   - Authentication method (flask-login, flask-jwt-extended, custom)
+   - Authorization decorators (login_required, custom)
+   - CSRF protection
+   - CORS configuration
+   - Environment variable management
+
+8. Database Patterns
+   - Table naming (__tablename__)
+   - Migration strategy (Flask-Migrate)
+   - Seed data management
+   - Audit fields (created_at, updated_at)
+   - Relationship patterns
+   - Index/constraints
+
+9. Testing Strategy Summary
+   - Test coverage level
+   - Test classification system (unit/integration/E2E)
+   - Test client setup (app.test_client)
+   - Fixture/Factory strategy
+   - Mocking strategy
+   - DB test strategy
+
+10. Logging/Monitoring Strategy
+    - Logger standard (app.logger vs custom)
+    - Log level policy
+    - Request/response logging
+
+11. Performance Patterns
+    - Caching strategy (Flask-Caching)
+    - Connection pool configuration
+    - Query optimization
+    - Static file serving
+
+12. Code Quality Tools
+    - Lint/Format tools (ruff, black, isort, mypy, flake8)
+    - Pre-commit hooks
+    - Type Checking (mypy, pyright)
+    - CI integration status
+
+Do not generate code. Merge only.
+Save results to claudeos-core/generated/pass2-merged.json.

package/pass-prompts/templates/python-flask/pass3.md

@@ -0,0 +1,103 @@
+Read claudeos-core/generated/project-analysis.json and
+claudeos-core/generated/pass2-merged.json, then
+generate all ClaudeOS-Core files based on the analysis results.
+
+Do not read the original source code again. Reference only the analysis results.
+
+CRITICAL — Package Manager Consistency:
+Check `stack.packageManager` in project-analysis.json (e.g., "poetry", "pipenv", "pip").
+ALL generated files MUST use ONLY that detected package manager's commands.
+NEVER mix pip/poetry/pipenv commands. Also check actual script names in pyproject.toml or Makefile.
+
+CRITICAL — Cross-file Consistency:
+Rules (.claude/rules/) and Standards (claudeos-core/standard/) MUST NOT contradict each other.
+
+CRITICAL — Code Example Accuracy:
+ALL code examples in rules and standards MUST use EXACT method names, class names,
+and signatures from pass2-merged.json analysis data.
+Do NOT paraphrase, rename, or infer API names.
+
+CRITICAL — Response Flow Consistency:
+Determine from pass2-merged.json which layer (route handler vs service layer) formats
+the response. This MUST be identical across architecture.md, route-patterns.md,
+and all rules files.
+
+CRITICAL — CLAUDE.md Reference Table Completeness:
+The reference table in CLAUDE.md MUST list ALL generated standard files.
+
+Generation targets:
+
+1. CLAUDE.md (project root)
+   - Role definition (based on detected stack — Flask)
+   - Build & Run Commands (pip/poetry, flask run, gunicorn, docker)
+   - Core architecture diagram (application factory, Blueprint structure)
+   - Module structure
+   - Standard/Skills/Guide reference table
+
+2. claudeos-core/standard/ (active domains only)
+   - 00.core/01.project-overview.md — Stack, modules, server info
+   - 00.core/02.architecture.md — Application factory, Blueprint hierarchy, request flow
+   - 00.core/03.naming-conventions.md — Module/model/blueprint/route naming conventions
+   - 10.backend-api/01.route-blueprint-patterns.md — Blueprint structure, route decorators, request/response handling
+   - 10.backend-api/02.model-schema-patterns.md — SQLAlchemy models, marshmallow/WTForms serialization
+   - 10.backend-api/03.service-patterns.md — Service layer, business logic separation
+   - 10.backend-api/04.response-error-patterns.md — Response formatting, error handlers, custom exceptions
+   - 30.security-db/01.security-auth.md — Authentication, CSRF, session management, environment variables
+   - 30.security-db/02.database-patterns.md — SQLAlchemy patterns, migrations, relationships
+   - 40.infra/01.environment-config.md — Config classes, environment variables, extension initialization
+   - 40.infra/02.logging-monitoring.md — app.logger, request logging, error tracking
+   - 40.infra/03.cicd-deployment.md — CI/CD, gunicorn, Docker deployment
+   - 50.verification/01.development-verification.md — Build, startup, flask run
+   - 50.verification/02.testing-strategy.md — pytest, test_client, fixtures, DB testing
+
+   Each file MUST include:
+   - Correct examples (code blocks)
+   - Incorrect examples (code blocks)
+   - Key rules summary table
+
+3. .claude/rules/ (active domains only)
+   - Write the full rule content directly in each file (self-contained)
+   - Include 5-15 lines of key rules with concrete examples
+   - Do NOT use @import
+   - Each rule file MUST end with a `## Reference` section linking to the corresponding standard
+   - `paths:` frontmatter per rule category:
+     - `00.core/*` rules: `paths: ["**/*"]`
+     - `10.backend/*` rules: `paths: ["**/*"]`
+     - `30.security-db/*` rules: `paths: ["**/*"]`
+     - `40.infra/*` rules: `paths: ["**/*.json", "**/*.env*", "**/*.cfg", "**/Dockerfile*", "**/*.yml", "**/*.yaml"]`
+     - `50.sync/*` rules: `paths: ["**/claudeos-core/**", "**/.claude/**"]`
+   - MUST generate `.claude/rules/00.core/00.standard-reference.md` — directory of all standard files
+
+4. .claude/rules/50.sync/ (3 sync rules)
+   - 01.standard-sync.md
+   - 02.rules-sync.md
+   - 03.skills-sync.md
+
+5. claudeos-core/skills/ (active domains only)
+   - 10.backend-crud/01.scaffold-crud-feature.md (orchestrator)
+   - 10.backend-crud/scaffold-crud-feature/01~08 (sub-skills: blueprint, routes, model, schema, service, migration, test, index)
+   - 00.shared/MANIFEST.md (skill registry)
+
+6. claudeos-core/guide/ (all)
+   - 01.onboarding/01.overview.md
+   - 01.onboarding/02.quickstart.md
+   - 01.onboarding/03.glossary.md
+   - 02.usage/01.faq.md
+   - 02.usage/02.real-world-examples.md
+   - 02.usage/03.do-and-dont.md
+   - 03.troubleshooting/01.troubleshooting.md
+   - 04.architecture/01.file-map.md
+   - 04.architecture/02.pros-and-cons.md
+
+7. claudeos-core/plan/ (Master Plan)
+   - 10.standard-master.md — CLAUDE.md + all standard/ files as <file> blocks
+   - 20.rules-master.md — All rules/ (except sync) as <file> blocks
+   - 21.sync-rules-master.md — All sync rules (code block format)
+   - 30.backend-skills-master.md — All backend skills as <file> blocks
+   - 40.guides-master.md — All guide/ files as <file> blocks
+
+8. claudeos-core/database/
+   - 01.schema-overview.md — DB schema, model relationships, migration guide
+
+9. claudeos-core/mcp-guide/
+   - 01.mcp-overview.md — MCP server integration