clckernel 1.2.19 → 2.0.0

package/src/adapters/go.js

@@ -1,6 +1,6 @@
 /**
  * CLC Kernel — Go Stack Adapter
- * Supports Golang apps, `go test`, golangci-lint AST, and Domain/UseCase Clean Architecture.
+ * Supports Golang apps, `go test`, golangci-lint, and Domain/UseCase Clean Architecture.
  */
 
 const fs = require('fs');
@@ -18,27 +18,29 @@ class GoAdapter extends BaseAdapter {
 
   getSafeguards() {
     return [
-      'golangci-lint Code Quality & AST Linter',
+      'golangci-lint Code Quality Linter (external CLI)',
       'Go Clean Architecture Guard (Domain -> UseCase -> Handler)',
-      'go test Red-to-Green TDD Validator',
+      'Red→Green TDD Verifier (runs changed tests with go test)',
       'Secret & Private Key Leak Scanner',
       'Educational Audit Gate (05-audit-report.md)',
-      'Memory Guard (Engram / Graphify ADR Sync)'
+      'Memory protocol (agent-enforced; Engram / Graphify optional, not checked by a guard)'
     ];
   }
 
   /**
    * Returns the tool manifest for Go projects.
-   * External CLIs only — no custom guard scripts bundled.
+   * External CLIs plus the bundled JS guards (secret scan, TDD verifier, custom rules).
    * @returns {Array<{name: string, language: string, path: string, command: string, description: string, extCLI?: string}>}
    */
   getTools() {
     const baseTools = [
-      { name: 'check_custom',   language: 'js',       path: 'check_custom.js', command: 'node tools/check_custom.js', description: 'Runs user-defined custom rules from .clc-forge.yml' },
-      { name: 'golangci-lint', language: 'external', path: '', command: 'golangci-lint run',  description: 'Go linter and static analysis', extCLI: 'golangci-lint' },
-      { name: 'go_test',       language: 'external', path: '', command: 'go test ./...',       description: 'Go test runner', extCLI: 'go' },
+      { name: 'scan_secrets', language: 'js',       path: 'scan_secrets.js', command: 'node tools/scan_secrets.js', description: 'Scans for leaked secrets and API keys' },
+      { name: 'verify_tdd',   language: 'js',       path: 'verify_tdd.js',   command: 'node tools/verify_tdd.js',   description: 'Runs changed tests (go test) against BASE (must fail) and the staged code (must pass)' },
+      { name: 'check_custom',   language: 'js',       path: 'check_custom.js', command: 'node tools/check_custom.js', description: 'Runs user-defined custom rules from .clckernel.yaml' },
+      { name: 'golangci-lint', language: 'external', path: '', command: 'golangci-lint run',  description: 'Go linter and static analysis', extCLI: 'golangci-lint', availableIf: 'command -v golangci-lint' },
+      { name: 'go_test',       language: 'external', path: '', command: 'go test ./...',       description: 'Go test runner', extCLI: 'go', availableIf: 'command -v go' },
     ];
-    return this._mergeTechTools(baseTools);
+    return baseTools;
   }
 
   provision(targetDir, config) {

package/src/adapters/laravel.js

@@ -1,6 +1,6 @@
 /**
  * CLC Kernel — PHP / Laravel Stack Adapter
- * Supports Laravel, Pest / PHPUnit, PHPStan AST, and Eloquent migration idempotency.
+ * Supports Laravel, Pest / PHPUnit, and PHPStan static analysis.
  */
 
 const fs = require('fs');
@@ -20,27 +20,29 @@ class LaravelAdapter extends BaseAdapter {
 
   getSafeguards() {
     return [
-      'PHPStan / PHP_CodeSniffer AST Code Quality Linter',
-      'Laravel Migration Idempotency & Schema Guard',
-      'Pest / PHPUnit Red-to-Green TDD Validator',
+      'PHPStan Static Analysis (external CLI)',
+      'Laravel Migration Reversibility protocol (agent-enforced; no migration guard installed for this stack)',
+      'Red→Green TDD Verifier (runs changed tests with PHPUnit or Pest)',
       'Secret & Private Key Leak Scanner',
       'Educational Audit Gate (05-audit-report.md)',
-      'Memory Guard (Engram / Graphify ADR Sync)'
+      'Memory protocol (agent-enforced; Engram / Graphify optional, not checked by a guard)'
     ];
   }
 
   /**
    * Returns the tool manifest for Laravel projects.
-   * External CLIs only — no custom guard scripts bundled.
+   * External CLIs plus the bundled JS guards (secret scan, TDD verifier, custom rules).
    * @returns {Array<{name: string, language: string, path: string, command: string, description: string, extCLI?: string}>}
    */
   getTools() {
     const baseTools = [
-      { name: 'check_custom', language: 'python',   path: 'check_custom.py', command: 'python3 tools/check_custom.py', description: 'Runs user-defined custom rules from .clc-forge.yml' },
-      { name: 'phpstan',  language: 'external', path: '', command: './vendor/bin/phpstan analyse', description: 'PHP static analysis', extCLI: 'phpstan' },
-      { name: 'artisan',  language: 'external', path: '', command: 'php artisan test',            description: 'Laravel test runner', extCLI: 'artisan' },
+      { name: 'scan_secrets', language: 'js',       path: 'scan_secrets.js', command: 'node tools/scan_secrets.js', description: 'Scans for leaked secrets and API keys' },
+      { name: 'verify_tdd',   language: 'js',       path: 'verify_tdd.js',   command: 'node tools/verify_tdd.js',   description: 'Runs changed tests (Pest / PHPUnit) against BASE (must fail) and the staged code (must pass)' },
+      { name: 'check_custom', language: 'js',       path: 'check_custom.js', command: 'node tools/check_custom.js', description: 'Runs user-defined custom rules from .clckernel.yaml' },
+      { name: 'phpstan',  language: 'external', path: '', command: './vendor/bin/phpstan analyse', description: 'PHP static analysis', extCLI: 'phpstan', availableIf: '[ -x vendor/bin/phpstan ]' },
+      { name: 'artisan',  language: 'external', path: '', command: 'php artisan test',            description: 'Laravel test runner', extCLI: 'artisan', availableIf: '[ -f artisan ] && command -v php' },
     ];
-    return this._mergeTechTools(baseTools);
+    return baseTools;
   }
 
   provision(targetDir, config) {

package/src/adapters/nextjs.js

@@ -37,8 +37,9 @@ class NextjsAdapter extends BaseAdapter {
       'Zod API Contract Guard (services response schema parsing)',
       'Performance & Next/Image Guard (next/image & tree-shaking)',
       'Storybook Story Coverage Guard (.stories.tsx)',
+      'Red→Green TDD Verifier (runs changed tests with vitest / jest / node:test)',
       'Educational Audit Gate (05-audit-report.md)',
-      'Memory Guard & PR Generator (.github/pull_request_body.md)'
+      'Memory protocol (agent-enforced; Engram / Graphify optional, not checked by a guard)'
     ];
   }
 
@@ -56,11 +57,12 @@ class NextjsAdapter extends BaseAdapter {
       { name: 'check_ui_reuse',     language: 'js',       path: 'check_ui_reuse.js',     command: 'node tools/check_ui_reuse.js',     description: 'Enforces UI primitive reuse from components/ui/' },
       { name: 'check_architecture', language: 'js',       path: 'check_architecture.js', command: 'node tools/check_architecture.js', description: 'Validates Next.js Server Component boundaries' },
       { name: 'check_performance',  language: 'js',       path: 'check_performance.js',  command: 'node tools/check_performance.js',  description: 'Checks next/image and bundle optimization' },
-      { name: 'check_custom',        language: 'js',       path: 'check_custom.js',       command: 'node tools/check_custom.js',       description: 'Runs user-defined custom rules from .clc-forge.yml' },
-      { name: 'tsc',                language: 'external', path: '', command: 'npx tsc --noEmit',        description: 'TypeScript type checking', extCLI: 'tsc' },
-      { name: 'lint',               language: 'external', path: '', command: 'npx lint-staged',         description: 'Lint staged files', extCLI: 'lint-staged' },
+      { name: 'verify_tdd',         language: 'js',       path: 'verify_tdd.js',         command: 'node tools/verify_tdd.js',         description: 'Runs changed tests (vitest / jest / node:test) against BASE (must fail) and the staged code (must pass)' },
+      { name: 'check_custom',        language: 'js',       path: 'check_custom.js',       command: 'node tools/check_custom.js',       description: 'Runs user-defined custom rules from .clckernel.yaml' },
+      { name: 'tsc',                language: 'external', path: '', command: 'npx tsc --noEmit',        description: 'TypeScript type checking', extCLI: 'tsc', availableIf: '[ -x node_modules/.bin/tsc ]' },
+      { name: 'lint',               language: 'external', path: '', command: 'npx lint-staged',         description: 'Lint staged files', extCLI: 'lint-staged', availableIf: '[ -x node_modules/.bin/lint-staged ]' },
     ];
-    return this._mergeTechTools(baseTools);
+    return baseTools;
   }
 
   provision(targetDir, config) {

package/src/adapters/rails.js

@@ -1,6 +1,6 @@
 /**
  * CLC Kernel — Ruby on Rails Stack Adapter
- * Supports Rails, RSpec, RuboCop AST, Brakeman Security, and migration idempotency.
+ * Supports Rails, RSpec, RuboCop, and Brakeman security scanning.
  */
 
 const fs = require('fs');
@@ -20,29 +20,31 @@ class RailsAdapter extends BaseAdapter {
 
   getSafeguards() {
     return [
-      'RuboCop Code Style & AST Security Guard',
+      'RuboCop Code Style Linter (external CLI)',
       'Brakeman Rails Vulnerability Scanner',
-      'Rails Migration Idempotency Guard (schema drift protection)',
-      'RSpec / Minitest Red-to-Green TDD Validator',
+      'Rails Migration Reversibility protocol (agent-enforced; no migration guard installed for this stack)',
+      'Red→Green TDD Verifier (runs changed tests with RSpec or Minitest)',
       'Secret & Private Credential Leak Scanner',
       'Educational Audit Gate (05-audit-report.md)',
-      'Memory Guard (Engram / Graphify ADR Sync)'
+      'Memory protocol (agent-enforced; Engram / Graphify optional, not checked by a guard)'
     ];
   }
 
   /**
    * Returns the tool manifest for Rails projects.
-   * External CLIs only — no custom guard scripts bundled.
+   * External CLIs plus the bundled JS guards (secret scan, TDD verifier, custom rules).
    * @returns {Array<{name: string, language: string, path: string, command: string, description: string, extCLI?: string}>}
    */
   getTools() {
     const baseTools = [
-      { name: 'check_custom', language: 'js',       path: 'check_custom.js', command: 'node tools/check_custom.js', description: 'Runs user-defined custom rules from .clc-forge.yml' },
-      { name: 'rubocop',  language: 'external', path: '', command: 'bundle exec rubocop --parallel', description: 'Ruby linter', extCLI: 'rubocop' },
-      { name: 'brakeman', language: 'external', path: '', command: 'bundle exec brakeman -q',        description: 'Rails vulnerability scanner', extCLI: 'brakeman' },
-      { name: 'rspec',    language: 'external', path: '', command: 'bundle exec rspec',               description: 'Test runner', extCLI: 'rspec' },
+      { name: 'scan_secrets', language: 'js',       path: 'scan_secrets.js', command: 'node tools/scan_secrets.js', description: 'Scans for leaked secrets and API keys' },
+      { name: 'verify_tdd',   language: 'js',       path: 'verify_tdd.js',   command: 'node tools/verify_tdd.js',   description: 'Runs changed tests (RSpec / Minitest) against BASE (must fail) and the staged code (must pass)' },
+      { name: 'check_custom', language: 'js',       path: 'check_custom.js', command: 'node tools/check_custom.js', description: 'Runs user-defined custom rules from .clckernel.yaml' },
+      { name: 'rubocop',  language: 'external', path: '', command: 'bundle exec rubocop --parallel', description: 'Ruby linter', extCLI: 'rubocop', availableIf: "grep -q '^    rubocop ' Gemfile.lock" },
+      { name: 'brakeman', language: 'external', path: '', command: 'bundle exec brakeman -q',        description: 'Rails vulnerability scanner', extCLI: 'brakeman', availableIf: "grep -q '^    brakeman ' Gemfile.lock" },
+      { name: 'rspec',    language: 'external', path: '', command: 'bundle exec rspec',               description: 'Test runner', extCLI: 'rspec', availableIf: "grep -q '^    rspec-core ' Gemfile.lock" },
     ];
-    return this._mergeTechTools(baseTools);
+    return baseTools;
   }
 
   provision(targetDir, config) {

package/src/adapters/rust.js

@@ -18,28 +18,30 @@ class RustAdapter extends BaseAdapter {
 
   getSafeguards() {
     return [
-      'cargo clippy AST Code Quality Linter',
+      'cargo clippy Linter (external CLI)',
       'cargo audit Security Vulnerability Scanner',
-      'cargo test Red-to-Green TDD Validator',
+      'Red→Green TDD Verifier (runs changed tests with cargo test)',
       'Secret & Private Key Leak Scanner',
       'Educational Audit Gate (05-audit-report.md)',
-      'Memory Guard (Engram / Graphify ADR Sync)'
+      'Memory protocol (agent-enforced; Engram / Graphify optional, not checked by a guard)'
     ];
   }
 
   /**
    * Returns the tool manifest for Rust projects.
-   * External CLIs only — no custom guard scripts bundled.
+   * External CLIs plus the bundled JS guards (secret scan, TDD verifier, custom rules).
    * @returns {Array<{name: string, language: string, path: string, command: string, description: string, extCLI?: string}>}
    */
   getTools() {
     const baseTools = [
-      { name: 'check_custom',  language: 'js',       path: 'check_custom.js', command: 'node tools/check_custom.js', description: 'Runs user-defined custom rules from .clc-forge.yml' },
-      { name: 'cargo_clippy',  language: 'external', path: '', command: 'cargo clippy -- -D warnings', description: 'Rust linter and static analysis', extCLI: 'clippy' },
-      { name: 'cargo_audit',   language: 'external', path: '', command: 'cargo audit',                description: 'Security vulnerability scanner', extCLI: 'cargo-audit' },
-      { name: 'cargo_test',    language: 'external', path: '', command: 'cargo test',                  description: 'Rust test runner', extCLI: 'cargo' },
+      { name: 'scan_secrets', language: 'js',       path: 'scan_secrets.js', command: 'node tools/scan_secrets.js', description: 'Scans for leaked secrets and API keys' },
+      { name: 'verify_tdd',   language: 'js',       path: 'verify_tdd.js',   command: 'node tools/verify_tdd.js',   description: 'Runs changed tests (cargo test integration tests) against BASE (must fail) and the staged code (must pass)' },
+      { name: 'check_custom',  language: 'js',       path: 'check_custom.js', command: 'node tools/check_custom.js', description: 'Runs user-defined custom rules from .clckernel.yaml' },
+      { name: 'cargo_clippy',  language: 'external', path: '', command: 'cargo clippy -- -D warnings', description: 'Rust linter and static analysis', extCLI: 'clippy', availableIf: 'cargo clippy --version' },
+      { name: 'cargo_audit',   language: 'external', path: '', command: 'cargo audit',                description: 'Security vulnerability scanner', extCLI: 'cargo-audit', availableIf: 'command -v cargo-audit' },
+      { name: 'cargo_test',    language: 'external', path: '', command: 'cargo test',                  description: 'Rust test runner', extCLI: 'cargo', availableIf: 'command -v cargo' },
     ];
-    return this._mergeTechTools(baseTools);
+    return baseTools;
   }
 
   provision(targetDir, config) {

package/src/catalog.js

@@ -2,9 +2,11 @@
  * CLC Kernel — Central Safeguard Catalog
  *
  * Single source of truth describing every safeguard/guard the clckernel
- * framework knows about. Drives config validation (src/config.js),
- * config-driven harness generation (src/generator.js), doctor checks, and
- * the future safeguard audit.
+ * framework knows about: descriptions and audit lenses (tools/audit.js).
+ * It does not choose what install puts in a project (the
+ * adapters' manifests do) and its severity/gate_mode fields are not
+ * configurable here: the audit honours the guard's own `level` and the
+ * `severities` key of .clckernel.yaml instead (sdds/audit-cli).
  *
  * Entry shape (design §1.2, additive fields noted):
  *   name        {string}        guard script basename WITHOUT extension
@@ -14,124 +16,131 @@
  *   applies_when{string}        applicability predicate key (stack/project conditions)
  *   severity    {string}        'error' | 'warning' | 'advisory' (catalog default)
  *   gate_mode   {string}        'hard' | 'advisory' (catalog default)
- *   config_keys {string[]}      .clc-forge.yml keys this safeguard consumes
+ *   config_keys {string[]}      .clckernel.yaml keys this safeguard reads (tools/_config.js)
  *   phase       {string}        10-phase harness phase: 'audit' | 'test' | 'review' | 'handover'
  *   file        {string|null}   bundled tools/ file(s), '+' separated; null = external CLI
  *   manifest    {boolean}       true = declared by >=1 adapter manifest (design §1.2)
  *   planned     {boolean}       true = tool file not yet materialized (future slice)
- *
- * The catalog is a JOIN, not a rewrite: the no-config adapter path never
- * consults it; only the config-driven generation path does.
  */
 
 const SAFEGUARD_CATALOG = [
   { name: 'scan_secrets', labels: ['scan_secrets', 'scan_secrets.js', 'scan_secrets.py'],
     checks: 'Secret & private-key leak scan', verify: ['verify_secret_leaks', 'verify_no_hardcoded_secrets'],
-    applies_when: 'always', severity: 'error', gate_mode: 'hard', config_keys: ['scope', 'exclude_paths'],
+    applies_when: 'always', severity: 'error', gate_mode: 'hard', config_keys: ['exclude_paths'],
     phase: 'audit', file: 'scan_secrets.js+scan_secrets.py', manifest: true, planned: false, lens: 'security' },
 
   { name: 'check_architecture', labels: ['check_architecture', 'check_architecture.js', 'check_architecture.py'],
     checks: 'Clean Architecture layer / server-component boundaries', verify: ['verify_architecture_layers', 'verify_server_component_boundaries'],
-    applies_when: 'frontend,backend', severity: 'error', gate_mode: 'hard', config_keys: ['scope', 'exclude_paths'],
+    applies_when: 'frontend,backend', severity: 'error', gate_mode: 'hard', config_keys: ['exclude_paths'],
     phase: 'audit', file: 'check_architecture.js+check_architecture.py', manifest: true, planned: false, lens: 'architecture' },
 
   { name: 'check_custom', labels: ['check_custom', 'check_custom.js', 'check_custom.py'],
-    checks: 'User-defined regex rules from `.clc-forge.yml`', verify: ['verify_custom_rules', 'verify_user_defined_regex_rules'],
-    applies_when: 'always', severity: 'error', gate_mode: 'hard', config_keys: ['scope', 'exclude_paths'],
+    checks: 'User-defined regex rules from `.clckernel.yaml`', verify: ['verify_custom_rules', 'verify_user_defined_regex_rules'],
+    applies_when: 'always', severity: 'error', gate_mode: 'hard', config_keys: ['rules', 'exclude_paths'],
     phase: 'audit', file: 'check_custom.js+check_custom.py', manifest: true, planned: false, lens: 'architecture' },
 
   { name: 'check_a11y', labels: ['check_a11y', 'check_a11y.js'],
     checks: 'ARIA + alt accessibility', verify: ['verify_a11y', 'verify_accessibility'],
-    applies_when: 'frontend', severity: 'error', gate_mode: 'hard', config_keys: ['scope', 'exclude_paths'],
+    applies_when: 'frontend', severity: 'error', gate_mode: 'hard', config_keys: ['exclude_paths'],
     phase: 'audit', file: 'check_a11y.js', manifest: true, planned: false, lens: 'correctness' },
 
   { name: 'check_ui_reuse', labels: ['check_ui_reuse', 'check_ui_reuse.js'],
     checks: 'UI primitive reuse from components/ui/', verify: ['verify_ui_reuse', 'verify_component_reuse'],
-    applies_when: 'frontend', severity: 'warning', gate_mode: 'advisory', config_keys: ['scope', 'exclude_paths'],
+    applies_when: 'frontend', severity: 'warning', gate_mode: 'advisory', config_keys: ['exclude_paths'],
     phase: 'audit', file: 'check_ui_reuse.js', manifest: true, planned: false, lens: 'architecture' },
 
   { name: 'check_performance', labels: ['check_performance', 'check_performance.js'],
     checks: 'next/image + tree-shaking', verify: ['verify_performance', 'verify_image_optimization'],
-    applies_when: 'frontend', severity: 'warning', gate_mode: 'advisory', config_keys: ['scope', 'exclude_paths'],
+    applies_when: 'frontend', severity: 'warning', gate_mode: 'advisory', config_keys: ['exclude_paths'],
     phase: 'audit', file: 'check_performance.js', manifest: true, planned: false, lens: 'performance' },
 
   { name: 'check_responsive', labels: ['check_responsive', 'check_responsive.js'],
     checks: 'Mobile-first responsiveness, fixed-width overflow & touch target size', verify: ['verify_responsive', 'verify_mobile_adaptability'],
-    applies_when: 'frontend', severity: 'warning', gate_mode: 'advisory', config_keys: ['scope', 'exclude_paths'],
+    applies_when: 'frontend', severity: 'warning', gate_mode: 'advisory', config_keys: ['exclude_paths'],
     phase: 'audit', file: 'check_responsive.js', manifest: true, planned: false, lens: 'performance' },
 
   { name: 'check_seo', labels: ['check_seo', 'check_seo.js'],
     checks: 'SEO metadata, OpenGraph, GEO tags, semantic HTML & LCP priority', verify: ['verify_seo', 'verify_geo_metadata', 'verify_core_web_vitals'],
-    applies_when: 'frontend', severity: 'warning', gate_mode: 'advisory', config_keys: ['scope', 'exclude_paths'],
+    applies_when: 'frontend', severity: 'warning', gate_mode: 'advisory', config_keys: ['exclude_paths'],
     phase: 'audit', file: 'check_seo.js', manifest: true, planned: false, lens: 'performance' },
 
   { name: 'check_storybook', labels: ['check_storybook', 'check_storybook.js'],
     checks: 'Storybook coverage (`.stories.tsx`)', verify: ['verify_storybook_coverage'],
-    applies_when: 'frontend', severity: 'warning', gate_mode: 'advisory', config_keys: ['scope', 'exclude_paths'],
+    applies_when: 'frontend', severity: 'warning', gate_mode: 'advisory', config_keys: ['exclude_paths'],
     phase: 'audit', file: 'check_storybook.js', manifest: true, planned: false, lens: 'performance' },
 
   { name: 'check_api_contracts', labels: ['check_api_contracts', 'check_api_contracts.js'],
     checks: 'Zod response-schema parsing', verify: ['verify_api_contracts', 'verify_response_schemas'],
-    applies_when: 'frontend', severity: 'error', gate_mode: 'hard', config_keys: ['scope', 'exclude_paths'],
+    applies_when: 'frontend', severity: 'error', gate_mode: 'hard', config_keys: ['exclude_paths'],
     phase: 'audit', file: 'check_api_contracts.js', manifest: true, planned: false, lens: 'correctness' },
 
   { name: 'check_migrations', labels: ['check_migrations', 'check_migrations.py'],
-    checks: 'Alembic/Django migration idempotency', verify: ['verify_migration_idempotency'],
-    applies_when: 'backend,fastapi,django', severity: 'error', gate_mode: 'hard', config_keys: ['scope', 'exclude_paths'],
+    checks: 'Alembic/Django migration reversibility (upgrade/downgrade, destructive operations)', verify: ['verify_migration_idempotency'],
+    applies_when: 'backend,fastapi,django', severity: 'error', gate_mode: 'hard', config_keys: ['exclude_paths'],
     phase: 'audit', file: 'check_migrations.py', manifest: true, planned: false, lens: 'architecture' },
 
-  { name: 'verify_tdd', labels: ['verify_tdd', 'verify_tdd.py'],
-    checks: 'Real red→green TDD validation', verify: ['verify_tdd_red_green', 'verify_tdd_evidence'],
-    applies_when: 'backend', severity: 'error', gate_mode: 'hard', config_keys: ['scope', 'exclude_paths'],
-    phase: 'audit', file: 'verify_tdd.py', manifest: false, planned: false, lens: 'correctness' },
+  { name: 'verify_tdd', labels: ['verify_tdd', 'verify_tdd.js', 'verify_tdd.py'],
+    checks: 'red→green (pytest / vitest / jest / node:test / go test / cargo test / RSpec / Minitest / PHPUnit / Pest): changed tests fail on BASE and pass on the staged code', verify: ['verify_tdd_red_green', 'verify_tdd_evidence'],
+    applies_when: 'frontend,backend,agent-os', severity: 'error', gate_mode: 'hard', config_keys: ['tdd', 'exclude_paths'],
+    phase: 'audit', file: 'verify_tdd.js+verify_tdd.py', manifest: true, planned: false, lens: 'correctness' },
 
   { name: 'check_scope', labels: ['check_scope', 'check_scope.py'],
     checks: 'git-diff vs SDD-authorization scope guardrail', verify: ['verify_scope_authorization', 'verify_sdd_scope'],
-    applies_when: 'always', severity: 'error', gate_mode: 'hard', config_keys: ['scope', 'exclude_paths'],
+    applies_when: 'always', severity: 'error', gate_mode: 'hard', config_keys: ['exclude_paths'],
     phase: 'audit', file: 'check_scope.py', manifest: false, planned: false, lens: 'correctness' },
 
   { name: 'celery_guard', labels: ['celery_guard', 'celery_guard.py'],
     checks: 'Broker URL exposure, ignore_result, result backend', verify: ['verify_celery_broker_config'],
-    applies_when: 'celery', severity: 'error', gate_mode: 'hard', config_keys: ['scope', 'exclude_paths'],
+    applies_when: 'celery', severity: 'error', gate_mode: 'hard', config_keys: ['exclude_paths'],
     phase: 'audit', file: 'celery_guard.py', manifest: true, planned: false, lens: 'security' },
 
   { name: 'redis_guard', labels: ['redis_guard', 'redis_guard.py'],
     checks: 'decode_responses, connect timeout, hardcoded URLs', verify: ['verify_redis_config'],
-    applies_when: 'redis', severity: 'error', gate_mode: 'hard', config_keys: ['scope', 'exclude_paths'],
+    applies_when: 'redis', severity: 'error', gate_mode: 'hard', config_keys: ['exclude_paths'],
     phase: 'audit', file: 'redis_guard.py', manifest: true, planned: false, lens: 'security' },
 
   { name: 'postgres_guard', labels: ['postgres_guard', 'postgres_guard.py'],
     checks: 'Raw SQL string formatting, hstore misuse', verify: ['verify_postgres_sql_usage'],
-    applies_when: 'postgresql', severity: 'error', gate_mode: 'hard', config_keys: ['scope', 'exclude_paths'],
+    applies_when: 'postgresql', severity: 'error', gate_mode: 'hard', config_keys: ['exclude_paths'],
     phase: 'audit', file: 'postgres_guard.py', manifest: true, planned: false, lens: 'security' },
 
   { name: 'docker_guard', labels: ['docker_guard', 'docker_guard.py'],
     checks: 'Non-root USER, ENV secrets, missing HEALTHCHECK', verify: ['verify_dockerfile_security'],
-    applies_when: 'docker', severity: 'error', gate_mode: 'hard', config_keys: ['scope', 'exclude_paths'],
+    applies_when: 'docker', severity: 'error', gate_mode: 'hard', config_keys: ['exclude_paths'],
     phase: 'audit', file: 'docker_guard.py', manifest: true, planned: false, lens: 'security' },
 
   { name: 'check_symlinks', labels: ['check_symlinks', 'check_symlinks.js'],
-    checks: 'AI IDE symlinks and rule mirror verification', verify: ['verify_symlinks', 'verify_rule_mirrors'],
-    applies_when: 'agent-os', severity: 'error', gate_mode: 'hard', config_keys: ['scope'],
+    checks: 'AI IDE rule mirrors (CLAUDE.md, GEMINI.md, .cursorrules, .windsurfrules) point to AGENTS.md: symlink or identical copy', verify: ['verify_symlinks', 'verify_rule_mirrors'],
+    applies_when: 'agent-os', severity: 'error', gate_mode: 'hard', config_keys: ['mirrors'],
     phase: 'audit', file: 'check_symlinks.js', manifest: true, planned: false, lens: 'architecture' },
 
   { name: 'check_hitl', labels: ['check_hitl', 'check_hitl.js'],
-    checks: 'Human-in-the-Loop review checkpoint validator in subagent skills', verify: ['verify_hitl', 'verify_human_review_checkpoints'],
-    applies_when: 'agent-os', severity: 'error', gate_mode: 'hard', config_keys: ['scope'],
+    checks: 'Explicit Human-in-the-Loop marker (`HITL:` line or `## Human checkpoint` section) in changed skills and playbooks', verify: ['verify_hitl', 'verify_human_review_checkpoints'],
+    applies_when: 'agent-os', severity: 'error', gate_mode: 'hard', config_keys: ['hitl', 'exclude_paths'],
     phase: 'audit', file: 'check_hitl.js', manifest: true, planned: false, lens: 'architecture' },
 
-  { name: 'check_domain_data', labels: ['check_domain_data', 'check_domain_data.js'],
-    checks: 'Domain deliverables schema and clean state integrity', verify: ['verify_domain_data', 'verify_clean_state_metrics'],
-    applies_when: 'agent-os', severity: 'error', gate_mode: 'hard', config_keys: ['scope'],
-    phase: 'audit', file: 'check_domain_data.js', manifest: true, planned: false, lens: 'architecture' },
+  { name: 'check_data_files', labels: ['check_data_files', 'check_data_files.js'],
+    checks: 'Every changed .json file parses (snapshot content, any folder); reports the file and the parse error', verify: ['verify_data_files_parse'],
+    applies_when: 'agent-os', severity: 'error', gate_mode: 'hard', config_keys: [],
+    phase: 'audit', file: 'check_data_files.js', manifest: true, planned: false, lens: 'correctness' },
+
+  { name: 'check_skills', labels: ['check_skills', 'check_skills.js'],
+    checks: 'SKILL.md frontmatter: non-empty lowercase `name` unique in the repository, non-empty `description` of at most 1024 characters', verify: ['verify_skill_frontmatter'],
+    applies_when: 'agent-os', severity: 'error', gate_mode: 'hard', config_keys: [],
+    phase: 'audit', file: 'check_skills.js', manifest: true, planned: false, lens: 'correctness' },
+
+  { name: 'check_links', labels: ['check_links', 'check_links.js'],
+    checks: 'Relative links in changed Markdown point to files present in the commit', verify: ['verify_relative_links'],
+    applies_when: 'agent-os', severity: 'error', gate_mode: 'hard', config_keys: [],
+    phase: 'audit', file: 'check_links.js', manifest: true, planned: false, lens: 'correctness' },
 
-  { name: 'check_test_calendar_sync', labels: ['check_test_calendar_sync', 'check_test_calendar_sync.js'],
-    checks: 'Test calendar harness synchronization and parity check', verify: ['verify_calendar_sync', 'verify_test_calendar_sync'],
-    applies_when: 'agent-os', severity: 'error', gate_mode: 'hard', config_keys: ['scope'],
-    phase: 'audit', file: 'check_test_calendar_sync.js', manifest: true, planned: false, lens: 'performance' },
+  { name: 'check_placeholders', labels: ['check_placeholders', 'check_placeholders.js'],
+    checks: 'Forgotten draft placeholders in changed Markdown, YAML and JSON (double-brace slots allowed in templates/)', verify: ['verify_no_placeholders'],
+    applies_when: 'agent-os', severity: 'error', gate_mode: 'hard', config_keys: [],
+    phase: 'audit', file: 'check_placeholders.js', manifest: true, planned: false, lens: 'correctness' },
 
   { name: 'ruff', labels: ['ruff'],
-    checks: 'Python AST linter (external CLI)', verify: ['verify_python_lint'],
+    checks: 'Python linter (external CLI)', verify: ['verify_python_lint'],
     applies_when: 'backend', severity: 'warning', gate_mode: 'advisory', config_keys: [],
     phase: 'test', file: null, manifest: true, planned: false, lens: 'correctness' },
 
@@ -162,17 +171,17 @@ const SAFEGUARD_CATALOG = [
 
   { name: 'check_openapi_drift', labels: ['check_openapi_drift', 'check_openapi_drift.py'],
     checks: 'FastAPI OpenAPI schema drift vs app routes', verify: ['verify_openapi_drift'],
-    applies_when: 'fastapi', severity: 'error', gate_mode: 'hard', config_keys: ['scope', 'exclude_paths'],
+    applies_when: 'fastapi', severity: 'error', gate_mode: 'hard', config_keys: ['exclude_paths'],
     phase: 'audit', file: 'check_openapi_drift.py', manifest: true, planned: true, lens: 'correctness' },
 
   { name: 'check_db_efficiency', labels: ['check_db_efficiency', 'check_db_efficiency.py'],
-    checks: 'ORM N+1 / select_related / prefetch_related', verify: ['verify_db_efficiency', 'verify_no_n_plus_1'],
-    applies_when: 'django|sqlalchemy', severity: 'error', gate_mode: 'hard', config_keys: ['scope', 'exclude_paths'],
+    checks: 'N+1 heuristic: ORM-like calls inside loops (Python AST)', verify: ['verify_db_efficiency', 'verify_no_n_plus_1'],
+    applies_when: 'django|sqlalchemy', severity: 'error', gate_mode: 'hard', config_keys: ['exclude_paths'],
     phase: 'audit', file: 'check_db_efficiency.py', manifest: true, planned: false, lens: 'performance' },
 
   { name: 'check_observability', labels: ['check_observability', 'check_observability.py'],
     checks: 'structlog structured logging; bare print/logger ban', verify: ['verify_structured_logging'],
-    applies_when: 'backend', severity: 'warning', gate_mode: 'advisory', config_keys: ['scope', 'exclude_paths'],
+    applies_when: 'backend', severity: 'warning', gate_mode: 'advisory', config_keys: ['exclude_paths'],
     phase: 'audit', file: 'check_observability.py', manifest: true, planned: true, lens: 'performance' },
 ];
 
@@ -192,10 +201,10 @@ const VALID_PHASES = ['audit', 'test', 'review', 'handover'];
 const VALID_APPLIES_WHEN = [
   'always', 'frontend', 'backend', 'fastapi', 'django', 'django|sqlalchemy',
   'celery', 'redis', 'postgresql', 'docker', 'frontend,backend', 'backend,fastapi,django',
-  'agent-os',
+  'agent-os', 'frontend,backend,agent-os',
 ];
 
-/** Canonical 4 RDD Lenses */
+/** The 4 RDD lenses guard results are grouped into */
 const VALID_LENSES = ['correctness', 'security', 'architecture', 'performance'];
 
 /** Normalize an input label for catalog lookup. */
@@ -229,7 +238,7 @@ function gateFor(name) {
   return entry ? entry.gate_mode : null;
 }
 
-/** Canonical RDD review lens for a guard name/label; null when unknown. */
+/** RDD review lens a guard's results are grouped into; null when unknown. */
 function lensFor(name) {
   const entry = applyTo(name);
   return entry ? entry.lens : null;