contextos-agents 2.1.1 → 2.3.0

package/.agents/core/skills/ponytail-mindset/SKILL.md

@@ -1,193 +1,41 @@
 ---
 name: ponytail-mindset
-description: >
-  Minimalist coding mindset. Write only what is strictly necessary for the task.
-  7-rung decision ladder before writing any code. Eliminates premature abstraction
-  while keeping all safety, validation, error handling, and security guards intact.
+description: Choose a minimal maintainable implementation for substantive Build tasks while preserving safety and verification.
 ---
 
 # ponytail-mindset
 
 ## Overview
 
-Minimalist engineering discipline that eliminates over-engineering and premature abstraction while maintaining 100% of required validation, type safety, error boundaries, and security invariants.
+Reduce unnecessary code and dependencies without weakening correctness or security.
 
 ## When to Use
 
-Activate on all BUILD phases to prevent bloated implementations and enforce concise, focused solutions.
+Substantive implementation and refactoring during Build.
 
 ## Rules & Patterns
 
-Based on [DietrichGebert/ponytail](https://github.com/DietrichGebert/ponytail).
+Before adding code, check whether the feature is needed and whether existing code, the standard library, the platform, or an installed dependency handles it. Then implement the smallest readable solution. Avoid premature abstractions. Preserve validation, authorization, parameterized queries, meaningful error handling, and required tests.
 
-> _He says nothing. He writes one line. It works._
+The 7-rung ladder: YAGNI; reuse project code; standard library; native platform;
+installed dependencies; a readable one-liner; the minimum maintainable code.
 
-**Core Impact**: Dramatically reduces code footprint by eliminating premature abstraction, YAGNI violations, and boilerplate, while keeping all safety invariants (validation, error handling, security) 100% intact.
-
----
-
-### Core Principle
-
-> **The best code is code you don't write.**  
-> Write only what the task strictly needs. Lazy about the solution, never about reading and understanding.
-
----
-
-### The 7-Rung Decision Ladder
-
-**Before writing ANY code**, stop and check each rung in order. Stop at the first rung that holds:
-
-```text
-1. Does this need to exist?
-   → No: YAGNI — skip it entirely. Don't build for "future use."
-
-2. Already in this codebase or component library?
-   → Yes: Reuse it. Don't rewrite. Call the existing function/component/module.
-   → For UI: Check shadcn/ui FIRST. Before building a complex UI element from scratch, check if it exists in the component library. If yes, generate the install command: npx shadcn@latest add dialog — never manually rewrite what shadcn already provides.
-
-3. Standard library does it?
-   → Yes: Use it. Don't write formatDate() — use Intl.DateTimeFormat or dayjs.
-
-4. Native platform feature?
-   → Yes: Use it. Don't install flatpickr when <input type="date"> exists.
-   → Exception for UI Components: If a native HTML element (like <input type="date"> or <select>) CANNOT be styled consistently across Chrome, Safari, and Firefox to match the premium design system — use the established component library (e.g., shadcn/ui <DatePicker>, <Select>) instead. Cross-browser inconsistency is a legitimate reason to NOT use native.
-
-5. Already-installed dependency?
-   → Yes: Use it. Don't install a new library to do what an existing one can.
-
-6. Can it be done in one line?
-   → Yes: One line. No abstraction layer needed.
-
-7. Only then: write the MINIMUM that works.
-   → No classes when a function works. No module when an inline does.
-```
-
----
-
-### The Rule of Three (Do Not Abstract Early)
-
-- **First occurrence**: Write it inline directly where it is needed.
-- **Second occurrence**: Duplicate it cleanly. Duplication is cheaper than the wrong abstraction.
-- **Third occurrence**: Only now extract a shared helper or utility.
-
----
-
-### 10 Concrete Over-Engineering Red Flags
-
-1. Creating a `GenericRepository<T>` when you only have 2 database tables.
-2. Creating a custom state machine or complex reducer for 2 boolean flags.
-3. Adding a configuration file or environment variables for values that never change.
-4. Writing custom retry/circuit-breaker logic when native `fetch` or SDK already handles it.
-5. Building a generic `BaseService` with 15 hook methods implemented by only one class.
-6. Wrapping every standard library call in a custom helper class (`StringUtils`, `DateUtils`, `ObjectUtils`).
-7. Creating a multi-level folder structure (`domains/auth/adapters/driving/rest/controllers/dto/`) for a 30-line microservice.
-8. Writing custom mock frameworks when Vitest/Jest/Node test runner provide standard mocks.
-9. Installing a 50KB npm package for a 3-line utility (e.g. `left-pad`, `is-number`, `deep-clone`).
-10. Pre-optimizing caching and indexing for endpoints serving 10 requests a day.
-
----
-
-### The Sacred Exceptions (NEVER Cut These)
-
-The ladder applies to features and abstractions. These 4 areas are **non-negotiable** and **never simplified away**:
-
-#### 1. Input Validation
-
-```javascript
-// [GOOD] Always validate — even if "internal" API
-function createUser(data) {
-  if (!data.email || !isValidEmail(data.email)) {
-    throw new ValidationError('Invalid email');
-  }
-  return db.insert('users', data);
-}
-
-// [BAD] Never skip validation for "speed"
-function createUser(data) {
-  return db.insert('users', data); // NEVER
-}
-```
-
-#### 2. Error Handling
-
-```javascript
-// [GOOD] Always handle errors explicitly
-async function fetchUser(id) {
-  try {
-    const user = await db.findById(id);
-    if (!user) throw new NotFoundError(`User ${id} not found`);
-    return user;
-  } catch (err) {
-    logger.error('fetchUser failed', { id, err });
-    throw err;
-  }
-}
-```
-
-#### 3. Security Checks
-
-- Authorization check BEFORE every query or mutation.
-- Parameterized queries everywhere — zero string concatenation in SQL.
-- Strict sanitization of all rendered HTML and markdown.
-
-#### 4. Type Safety & Behavioral Tests
-
-- Strict TypeScript types — no `any` evasion.
-- Tests covering happy path, 4xx, and 5xx edge cases.
-
----
+Read [references/minimalism.md](references/minimalism.md) for detailed procedures and examples only when needed.
 
 ## Code Examples
 
-### Native Platform vs Over-Built Package
-
-**Over-build**:
-
-```bash
-npm install flatpickr
-# Creates DatePickerWrapper.jsx (45 lines) + useDatePicker.js (30 lines) + styles (60 lines)
-```
-
-**Ponytail approach (rung 4)**:
-
-```html
-<input type="date" name="date" aria-label="Appointment date" />
-```
-
-### Next.js App Router Server Action vs REST Endpoint
-
-```typescript
-// Instead of /api/users/[id]/route.ts + custom fetch wrapper:
-"use server";
-
-export async function updateUser(id: string, data: UpdateUserInput) {
-  const session = await getSession(); // auth check — never skip
-  if (session?.userId !== id) throw new Error("Forbidden");
-  return db.users.update(id, data);
-}
-```
-
----
+Reuse the existing date formatter. A shorter database query still needs authorization and validated input.
 
 ## Validation Checklist
 
-- [ ] Every new dependency has been verified: cannot be solved with native platform or existing dependencies.
-- [ ] No single-use abstractions, wrappers, or interfaces created.
-- [ ] Sacred exceptions preserved: 100% input validation, explicit error handling, security checks intact.
-- [ ] All code written passes all existing unit and integration tests.
-
----
+- [ ] The requested outcome is handled.
+- [ ] Relevant verification and safety boundaries are preserved.
+- [ ] Limitations are stated.
 
 ## Common Mistakes
 
-- **Cutting validation to write less code**: The goal is less architecture/boilerplate, never less safety.
-- **Creating utilities "for future use"**: Only write utilities when used 3+ times.
-- **Rewriting component libraries**: Building custom modals, tabs, or tooltips from scratch when shadcn/ui or Radix is already in the project.
-
----
+Repeated approval after authorization; unnecessary ceremonies for routine edits; treating role labels or string checks as behavioral proof.
 
 ## Integration Notes
 
-- Runs at the start of every `[PHASE: Build]` and `[PHASE: Review]`.
-- Enforces minimalism alongside `system-design` (think at scale, implement minimally).
-- Pairs with `impeccable-design` for UI tasks.
+Load relevant domain skills and supporting resources on demand. Compatibility identifiers remain available.

package/.agents/core/skills/ponytail-mindset/references/minimalism.md

@@ -0,0 +1,186 @@
+
+# ponytail-mindset
+
+## Overview
+
+Minimalist engineering discipline that eliminates over-engineering and premature abstraction while maintaining 100% of required validation, type safety, error boundaries, and security invariants.
+
+## When to Use
+
+Activate on all BUILD phases to prevent bloated implementations and enforce concise, focused solutions.
+
+## Rules & Patterns
+
+Based on [DietrichGebert/ponytail](https://github.com/DietrichGebert/ponytail).
+
+> _He says nothing. He writes one line. It works._
+
+**Core Impact**: Dramatically reduces code footprint by eliminating premature abstraction, YAGNI violations, and boilerplate, while keeping all safety invariants (validation, error handling, security) 100% intact.
+
+---
+
+### Core Principle
+
+> **The best code is code you don't write.**\
+> Write only what the task strictly needs. Lazy about the solution, never about reading and understanding.
+
+---
+
+### The 7-Rung Decision Ladder
+
+**Before writing ANY code**, stop and check each rung in order. Stop at the first rung that holds:
+
+```text
+1. Does this need to exist?
+   → No: YAGNI — skip it entirely. Don't build for "future use."
+
+2. Already in this codebase or component library?
+   → Yes: Reuse it. Don't rewrite. Call the existing function/component/module.
+   → For UI: Check shadcn/ui FIRST. Before building a complex UI element from scratch, check if it exists in the component library. If yes, generate the install command: npx shadcn@latest add dialog — never manually rewrite what shadcn already provides.
+
+3. Standard library does it?
+   → Yes: Use it. Don't write formatDate() — use Intl.DateTimeFormat or dayjs.
+
+4. Native platform feature?
+   → Yes: Use it. Don't install flatpickr when <input type="date"> exists.
+   → Exception for UI Components: If a native HTML element (like <input type="date"> or <select>) CANNOT be styled consistently across Chrome, Safari, and Firefox to match the premium design system — use the established component library (e.g., shadcn/ui <DatePicker>, <Select>) instead. Cross-browser inconsistency is a legitimate reason to NOT use native.
+
+5. Already-installed dependency?
+   → Yes: Use it. Don't install a new library to do what an existing one can.
+
+6. Can it be done in one line?
+   → Yes: One line. No abstraction layer needed.
+
+7. Only then: write the MINIMUM that works.
+   → No classes when a function works. No module when an inline does.
+```
+
+---
+
+### The Rule of Three (Do Not Abstract Early)
+
+- **First occurrence**: Write it inline directly where it is needed.
+- **Second occurrence**: Duplicate it cleanly. Duplication is cheaper than the wrong abstraction.
+- **Third occurrence**: Only now extract a shared helper or utility.
+
+---
+
+### 10 Concrete Over-Engineering Red Flags
+
+1. Creating a `GenericRepository<T>` when you only have 2 database tables.
+2. Creating a custom state machine or complex reducer for 2 boolean flags.
+3. Adding a configuration file or environment variables for values that never change.
+4. Writing custom retry/circuit-breaker logic when native `fetch` or SDK already handles it.
+5. Building a generic `BaseService` with 15 hook methods implemented by only one class.
+6. Wrapping every standard library call in a custom helper class (`StringUtils`, `DateUtils`, `ObjectUtils`).
+7. Creating a multi-level folder structure (`domains/auth/adapters/driving/rest/controllers/dto/`) for a 30-line microservice.
+8. Writing custom mock frameworks when Vitest/Jest/Node test runner provide standard mocks.
+9. Installing a 50KB npm package for a 3-line utility (e.g. `left-pad`, `is-number`, `deep-clone`).
+10. Pre-optimizing caching and indexing for endpoints serving 10 requests a day.
+
+---
+
+### The Sacred Exceptions (NEVER Cut These)
+
+The ladder applies to features and abstractions. These 4 areas are **non-negotiable** and **never simplified away**:
+
+#### 1. Input Validation
+
+```javascript
+// [GOOD] Always validate — even if "internal" API
+function createUser(data) {
+  if (!data.email || !isValidEmail(data.email)) {
+    throw new ValidationError('Invalid email');
+  }
+  return db.insert('users', data);
+}
+
+// [BAD] Never skip validation for "speed"
+function createUser(data) {
+  return db.insert('users', data); // NEVER
+}
+```
+
+#### 2. Error Handling
+
+```javascript
+// [GOOD] Always handle errors explicitly
+async function fetchUser(id) {
+  try {
+    const user = await db.findById(id);
+    if (!user) throw new NotFoundError(`User ${id} not found`);
+    return user;
+  } catch (err) {
+    logger.error('fetchUser failed', { id, err });
+    throw err;
+  }
+}
+```
+
+#### 3. Security Checks
+
+- Authorization check BEFORE every query or mutation.
+- Parameterized queries everywhere — zero string concatenation in SQL.
+- Strict sanitization of all rendered HTML and markdown.
+
+#### 4. Type Safety & Behavioral Tests
+
+- Strict TypeScript types — no `any` evasion.
+- Tests covering happy path, 4xx, and 5xx edge cases.
+
+---
+
+## Code Examples
+
+### Native Platform vs Over-Built Package
+
+**Over-build**:
+
+```bash
+npm install flatpickr
+# Creates DatePickerWrapper.jsx (45 lines) + useDatePicker.js (30 lines) + styles (60 lines)
+```
+
+**Ponytail approach (rung 4)**:
+
+```html
+<input type="date" name="date" aria-label="Appointment date" />
+```
+
+### Next.js App Router Server Action vs REST Endpoint
+
+```typescript
+// Instead of /api/users/[id]/route.ts + custom fetch wrapper:
+"use server";
+
+export async function updateUser(id: string, data: UpdateUserInput) {
+  const session = await getSession(); // auth check — never skip
+  if (session?.userId !== id) throw new Error("Forbidden");
+  return db.users.update(id, data);
+}
+```
+
+---
+
+## Validation Checklist
+
+- [ ] Every new dependency has been verified: cannot be solved with native platform or existing dependencies.
+- [ ] No single-use abstractions, wrappers, or interfaces created.
+- [ ] Sacred exceptions preserved: 100% input validation, explicit error handling, security checks intact.
+- [ ] All code written passes all existing unit and integration tests.
+
+---
+
+## Common Mistakes
+
+- **Cutting validation to write less code**: The goal is less architecture/boilerplate, never less safety.
+- **Creating utilities "for future use"**: Only write utilities when used 3+ times.
+- **Rewriting component libraries**: Building custom modals, tabs, or tooltips from scratch when shadcn/ui or Radix is already in the project.
+
+---
+
+## Integration Notes
+
+- Applies during substantive Build work and reviews of implementation complexity.
+- Enforces minimalism alongside `system-design` (think at scale, implement minimally).
+- Pairs with `impeccable-design` for UI tasks.

package/.agents/core/skills/ponytail-mindset/skill.yaml

@@ -1,14 +1,11 @@
 schemaVersion: 2
 name: ponytail-mindset
 type: instruction-only
-description: >
-  Minimalist coding mindset based on DietrichGebert/ponytail.
-  Teaches the AI to write only what is strictly necessary.
-  Uses a 7-rung ladder: YAGNI → reuse → stdlib → platform → deps → one-liner → minimum.
-  Minimizes unnecessary boilerplate and over-engineering while keeping all safety, validation and security guards.
+description: Choose a minimal maintainable implementation for substantive Build tasks while preserving safety and verification.
 version: 1.0.0
 resources:
   - EXAMPLES.md
   - SKILL.md
   - TROUBLESHOOTING.md
   - VALIDATION.json
+  - references/minimalism.md

package/.agents/core/skills/security/skill.yaml

@@ -1,6 +1,7 @@
 schemaVersion: 2
 id: security
 name: Application Security
+description: Protect authentication, authorization, sensitive data, untrusted input, external integrations, and agent tool execution.
 category: backend
 type: instruction-only
 requires: []

package/.agents/ctx.js

@@ -55,10 +55,13 @@ function printHelp() {
   console.log('  watch                           Start continuous file watcher and auto-sync daemon');
   console.log('  init                            Show initialization guide');
   console.log('  install-skill <ref>             Alias for skill add (install a plugin)');
-  console.log('  skill add   <ref>               Install a plugin skill (GitHub or npm)');
+  console.log('  skill add   <ref|--all>         Install a plugin skill or all catalog skills (--all)');
   console.log('  skill remove <name>             Uninstall a plugin skill');
-  console.log('  skill list                      List installed skills (builtin + plugins)');
+  console.log('  skill list [--available]        List installed skills (and available catalog skills)');
   console.log('  skill search [query]            Search the community skill registry');
+  console.log('  skill override <name>           Create editable project copy of an upstream skill');
+  console.log('  skill diff <name>               Show differences between local override and upstream');
+  console.log('  skill eject <name>              Eject upstream skill to standalone project skill');
   console.log('');
   console.log('Plugin ref formats:');
   console.log('  username/repo                    GitHub repo root SKILL.md');
@@ -367,22 +370,22 @@ if (command === 'export') {
 // ── resolve ───────────────────────────────────────────────────────────────────
 } else if (command === 'resolve') {
   const { CanonicalResolver } = require('./resolver/canonical-resolver.js');
-  const promptArgs = args.slice(1).filter(a => !a.startsWith('-')).join(' ');
-  const filesIdx = args.indexOf('--files');
-  const files = filesIdx !== -1 && args[filesIdx + 1] ? args[filesIdx + 1].split(',') : [];
-  const phaseIdx = args.indexOf('--phase');
-  const phase = phaseIdx !== -1 && args[phaseIdx + 1] ? args[phaseIdx + 1] : undefined;
-  const budgetIdx = args.indexOf('--budget');
-  const budget = budgetIdx !== -1 && args[budgetIdx + 1] ? parseInt(args[budgetIdx + 1], 10) : undefined;
-  const explain = args.includes('--explain');
-  const asJson = args.includes('--json');
+  const { parseResolveArgs } = require('./resolver/resolve-args.js');
+  let parsed;
+  try {
+    parsed = parseResolveArgs(args.slice(1));
+  } catch (error) {
+    console.error(error.message);
+    process.exit(1);
+  }
+  const { json: asJson, explain } = parsed;
 
   const resolver = new CanonicalResolver({ rootDir: process.cwd() });
   const result = resolver.resolve({
-    task: promptArgs,
-    files,
-    explicitPhase: phase,
-    contextBudgetTokens: budget,
+    task: parsed.task,
+    files: parsed.files,
+    explicitPhase: parsed.explicitPhase,
+    contextBudgetTokens: parsed.contextBudgetTokens,
   });
 
   if (asJson) {
@@ -634,15 +637,17 @@ if (command === 'export') {
   }
 
   if (subcommand === 'add') {
+    const isAll = args.includes('--all') || ref === '--all' || ref === 'all';
     const forceUnsafe = args.includes('--force-unsafe-prompts') || args.includes('--force-unsafe');
-    plugins.add(ref, { dryRun, checksum, forceUnsafe }).catch(err => {
+    plugins.add(isAll ? '--all' : ref, { dryRun, checksum, forceUnsafe, all: isAll }).catch(err => {
       console.error(`[ERROR] ${err.message}`);
       process.exit(1);
     });
   } else if (subcommand === 'remove') {
     plugins.remove(ref);
   } else if (subcommand === 'list') {
-    plugins.list();
+    const available = args.includes('--available') || args.includes('-a') || args.includes('--all');
+    plugins.list({ available });
   } else if (subcommand === 'search') {
     const query = args.slice(2).join(' ');
     plugins.search(query).catch(err => {

package/.agents/customization-dx.js

@@ -29,6 +29,7 @@ class SkillCustomizationManager {
   }
 
   _findUpstreamSkill(skillName) {
+    if (!/^[a-z0-9-]+$/.test(skillName)) throw new Error('Invalid skill ID');
     const inCore = path.join(this.coreSkillsDir, skillName);
     if (fs.existsSync(inCore)) return inCore;
 
@@ -59,16 +60,19 @@ class SkillCustomizationManager {
       throw err;
     }
 
-    fs.mkdirSync(targetDir, { recursive: true });
-
-    // Copy SKILL.md and skill.yaml if present
-    const files = fs.readdirSync(upstream);
-    for (const file of files) {
-      const srcFile = path.join(upstream, file);
-      if (fs.statSync(srcFile).isFile()) {
-        fs.copyFileSync(srcFile, path.join(targetDir, file));
+    // Validate the complete source tree before creating an override.
+    const { resolveManagedPath } = require('./filesystem/index.js');
+    const inspect = (dir) => {
+      for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+        const source = path.join(dir, entry.name);
+        if (entry.isSymbolicLink()) throw new Error(`Skill override refuses symlink: ${source}`);
+        resolveManagedPath(upstream, path.relative(upstream, source));
+        if (entry.isDirectory()) inspect(source);
       }
-    }
+    };
+    inspect(upstream);
+    resolveManagedPath(this.projectRoot, path.relative(this.projectRoot, targetDir));
+    fs.cpSync(upstream, targetDir, { recursive: true, errorOnExist: true, force: false });
 
     return {
       success: true,

package/.agents/doctor.js

@@ -238,8 +238,8 @@ function checkSecretScanner(projectDir) {
       id: 'secret_scanner',
       status: STATUS.FAIL,
       ok: false,
-      message: 'potential secrets detected in workspace',
-      remediation: 'Run `npm run check:secrets` and resolve flagged secrets or add to allowlist',
+      message: err.status === 1 ? 'potential secrets detected in workspace' : `Secret scanner unavailable (exit ${err.status ?? err.code ?? 'unknown'}): ${(err.stderr || err.message || '').toString().split(/\r?\n/).find(Boolean) || 'execution failed'}`,
+      remediation: err.status === 1 ? 'Run `npm run check:secrets` and resolve flagged secrets or add to allowlist' : 'Run `npm run check:secrets` and resolve the scanner execution error; this does not establish that secrets were found',
     };
   }
 }

package/.agents/generated/claude/skills/context-manager/EXAMPLES.md

@@ -0,0 +1,19 @@
+# context-manager Examples — Anti-patterns vs ContextOS Standard
+
+## Example 1: Context Selection
+
+### Anti-pattern: Context Window Dumping
+
+```text
+Agent reads all 180 files in src/ into context to debug a single button click handler.
+Result: Exhausts 150k tokens, reaches rate limits, and forgets user instructions.
+```
+
+### Best practice: ContextOS Standard (Targeted AST Traversal)
+
+```text
+1. Inspect package.json and AGENTS.md.
+2. Grep for target symbol: grep_search for 'SubmitButton'.
+3. Read ONLY components/SubmitButton.tsx and its direct import types/button.ts.
+Total tokens used: <1,500 tokens. Fast, accurate, zero hallucinations.
+```

package/.agents/generated/claude/skills/context-manager/SKILL.md

@@ -116,32 +116,3 @@ Anti-patterns and things to explicitly avoid. See `TROUBLESHOOTING.md`.
 ## Integration Notes
 
 How this skill interacts with other skills.
-
-
-# context-manager Examples — Anti-patterns vs ContextOS Standard
-
-## Example 1: Context Selection
-
-### Anti-pattern: Context Window Dumping
-
-```text
-Agent reads all 180 files in src/ into context to debug a single button click handler.
-Result: Exhausts 150k tokens, reaches rate limits, and forgets user instructions.
-```
-
-### Best practice: ContextOS Standard (Targeted AST Traversal)
-
-```text
-1. Inspect package.json and AGENTS.md.
-2. Grep for target symbol: grep_search for 'SubmitButton'.
-3. Read ONLY components/SubmitButton.tsx and its direct import types/button.ts.
-Total tokens used: <1,500 tokens. Fast, accurate, zero hallucinations.
-```
-
-# context-manager Troubleshooting & Common Mistakes
-
-## 1. Token Budget Blowout
-
-- **Symptom**: Model performance drops significantly, losing earlier conversational context.
-- **Root Cause**: Loading large JSON mocks, lockfiles, or build directories into prompt.
-- **Fix**: Never read package-lock.json, dist/, or build artifacts unless explicitly debugging bundle outputs.

package/.agents/generated/claude/skills/context-manager/TROUBLESHOOTING.md

@@ -0,0 +1,7 @@
+# context-manager Troubleshooting & Common Mistakes
+
+## 1. Token Budget Blowout
+
+- **Symptom**: Model performance drops significantly, losing earlier conversational context.
+- **Root Cause**: Loading large JSON mocks, lockfiles, or build directories into prompt.
+- **Fix**: Never read package-lock.json, dist/, or build artifacts unless explicitly debugging bundle outputs.

package/.agents/generated/claude/skills/context-manager/VALIDATION.json

@@ -0,0 +1,12 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "type": "object",
+  "properties": {
+    "rules_followed": {
+      "type": "boolean"
+    }
+  },
+  "required": [
+    "rules_followed"
+  ]
+}