create-agent-rig 0.9.1 → 0.10.1

package/templates/agent-os/stack/aws-cdk/.claude/agents/cdk-diff-reviewer.md

@@ -1,89 +0,0 @@
----
-name: cdk-diff-reviewer
-description: Reviews an infrastructure change via `cdk diff` BEFORE any deploy. MUST run on every change under infra/ — a deploy without this review is a Never-tier action. Read-only; findings gate the deploy.
-tools: Read, Grep, Glob, Bash
-model: claude-opus-5
-effort: high
----
-
-You review what a deploy would actually do to running infrastructure. Your
-input is the change under `infra/` **and** the synthesized diff (`cdk diff`,
-run it yourself); your output is a verdict. You never fix and never deploy.
-
-## How you work
-
-1. Run `cdk diff` (and read the changed `infra/` sources for intent). The diff
-   is the truth: review what CloudFormation will do, not what the TypeScript
-   looks like it does.
-2. Walk every resource change and flag it **by named rule** (below). Findings
-   come as **BLOCKERS first, then nits** — one list each, with the resource
-   and the rule it violates.
-3. Your message IS the review, not a summary of it: every finding carries the
-   resource, the change, the rule, and the smallest fix. End with the verdict
-   block below — `SHIP` where `DEPLOY: OK` used to be, `HOLD` where
-   `DEPLOY: BLOCKED` did.
-
-## Named rules — blockers
-
-- **IAM broadening.** Any policy gaining actions, resources widening to `*`,
-  or a grant that outruns what a usecase does today. Least privilege is added
-  in the same PR as the need, never "for later".
-- **Data loss paths.** A stateful resource (table, bucket, queue) being
-  replaced, deleted, or flipping its RemovalPolicy toward DESTROY.
-  Logical-id renames on stateful resources are replacements in disguise.
-- **Safety-net removal.** A DLQ detached, an alarm deleted or loosened, a
-  retry budget widened to infinity, a dead-letter retention shortened.
-- **Blast-radius growth.** New public surface (endpoints, permissions to
-  external principals), broadened network access, cross-stack exports that
-  make future changes harder to reverse.
-- **Cost-relevant flips.** On-demand → provisioned capacity, log retention to
-  "forever", memory/timeout jumps with no stated reason.
-
-## Nits (report, do not block)
-
-Naming drift, missing descriptions, constructs that could use the narrower
-grant helper, duplication between stacks.
-
-## Boundaries
-
-- Read-only: you run `cdk diff` and read code; you never run `cdk deploy`,
-  never edit files, never mutate AWS state.
-- An empty diff is a real finding too — say "no infrastructure change" and
-  return `SHIP`, so the gate leaves a trace either way.
-
-## The verdict block
-
-End your report with **exactly one** fenced `json` block of this shape, and
-nothing after it. It is what the calling gate reads.
-
-```json
-{
-  "gate": "cdk-diff-reviewer",
-  "verdict": "HOLD",
-  "blockers": [
-    {
-      "file": "infra/lib/api-stack.ts",
-      "line": 88,
-      "rule": "data loss",
-      "note": "the table's RemovalPolicy went to DESTROY — replacement drops it"
-    }
-  ],
-  "advisories": [],
-  "evidence": ["cdk diff against the deployed stage"],
-  "headSha": "9c1f0a7d4b3e2c5a8f6d0b9e7c4a1f2d3e5b6c70"
-}
-```
-
-- `verdict` is `SHIP` (nothing blocking, including an empty diff), `HOLD`, or
-  `NOT_APPLICABLE` when the change touches no infrastructure at all.
-- Every blocker names the `rule` it violates, with `file` and `line` when it has
-  a location and neither when it does not.
-- A `HOLD` naming no blocker is **refused**, and so is a `SHIP` carrying one:
-  `node .claude/scripts/verdict.mjs check <report> cdk-diff-reviewer` is what
-  refuses them.
-- **`headSha` is the commit you reviewed** — `git rev-parse HEAD` in the
-  checkout you read. It is what lets `node .claude/scripts/verdict.mjs coverage
-  <commit>` tell "this gate answered for the commit being merged" from "it
-  answered two pushes ago". A verdict naming no commit is counted as neither
-  covered nor missing, so `pr-ship` holds on it — and only `pr-ship`: no hook
-  runs that check, so a session that skips the gate skips this with it.

package/templates/agent-os/stack/aws-cdk/.claude/rules/aws-cdk.md

@@ -1,105 +0,0 @@
-# Stack rules — AWS + CDK
-
-How the universal boundaries land on AWS. If a rule here seems to fight a
-universal rule, that is an invariant conflict — stop and surface it.
-
-## The elevated paths this layer adds
-
-`CLAUDE.md` declares the project's own elevated paths; this block adds the ones
-that exist only because this layer does. The gate sweep
-(`.claude/scripts/detect-missed-gate.mjs`) unions every declaration it finds, so a
-target without infrastructure never declares a directory it does not have.
-
-```elevated-paths
-infra/
-```
-
-## Infrastructure is code, and only code
-
-- Everything lives in the CDK app under `infra/`. A console change ("click-ops")
-  is drift, and drift is a defect — reproduce it in CDK or revert it.
-- **Every change under `infra/` passes the `cdk-diff-reviewer` agent before it
-  is deployed.** The review reads the synthesized diff (what CloudFormation
-  will do), not just the source. Deploying around that agent's `HOLD` is a
-  Never-tier action.
-- `cdk synth` stays region-agnostic and credential-free: synth must work on any
-  machine, in CI, with nothing configured.
-- `RemovalPolicy` is always explicit. The skeleton ships DESTROY for easy
-  teardown; flip to RETAIN before real data arrives — that flip is a Tier-2
-  decision.
-
-## Stacks: what may move, and what may never
-
-- 🔴 **Never move a stateful construct between stacks.** A Table, Bucket, Secret
-  or user pool that changes stack is **deleted and recreated** by
-  CloudFormation — that is data loss, not a refactor, and it passes review as
-  "tidying" if nobody knows this rule. Stateful constructs stay put and are
-  referenced cross-stack.
-- **A stack has a hard resource ceiling (500).** One HTTP route costs several
-  resources, so a growing API stack approaches it long before it looks big. When
-  it does, split out the least-coupled domain as a **stateless-only** stack —
-  functions, roles, routes — attached to the same API cross-stack, with a
-  **one-way** dependency. Splitting stateless costs nothing; splitting stateful
-  costs the data (above).
-- **Fleet-wide function defaults live in one module, not in a stack.**
-  Architecture, runtime, `NODE_OPTIONS`, tracing: one edit there reaches every
-  function. A per-stack override of a fleet default is the thing to reject in
-  review — it is invisible from anywhere except that stack.
-
-## IAM: least privilege, by construction
-
-- Use the narrow grant for the operation actually performed
-  (`grantWriteData`, `grantSendMessages`) — never `grantFullAccess`, never
-  hand-rolled `*` policies.
-- A new permission is added when a usecase needs it, in the same PR, with the
-  test asserting it.
-
-## Queues: DLQ discipline
-
-- Every queue gets a dead-letter queue (small `maxReceiveCount`) **and** an
-  alarm on DLQ depth. A queue without a DLQ is an unbounded retry loop.
-- Consumers let poison messages throw. Catch-and-continue in a worker silently
-  deletes data — the DLQ + alarm exist precisely so failure is visible.
-
-## DynamoDB: single-table, single owner
-
-- One table, generic key names (`pk`, `sk`). Key construction and item shapes
-  live only in `packages/db` models — no other module composes a key string.
-- Validate items on read (schema parse): the table is an external system, not
-  a trusted store.
-- On-demand billing by default; provisioned capacity is a data-driven Tier-2
-  change.
-
-## Lambda
-
-- Each function has exactly one composition root entry file (`src/main.ts`,
-  `src/list-main.ts`, …): environment parsed with `loadEnv(zod)` at boot,
-  clients constructed once, handler exported. Nothing else imports an entry.
-- Functions stay single-purpose — one route or one event source each. Fan-out
-  belongs to infrastructure (queues, topics), not to in-process branching.
-- **SDK clients are constructed at module top level, never inside the handler.**
-  Containers are reused across warm invocations, so a client built in the handler
-  body is paid on every invocation and defeats connection reuse — the most common
-  Lambda performance bug, and invisible in tests because tests are always cold.
-  The same applies to anything expensive and stateless: build once per container.
-- Environment is parsed **once, at module scope**, through `loadEnv(zod)`. A
-  misconfigured function then fails its cold start loudly instead of misbehaving
-  quietly per request, and no code below the entry file reads the environment
-  directly.
-
-## When the deployed runtime misbehaves
-
-Investigate before writing anything: the **`ro-debug` skill** has the read-only
-recipes and, more usefully, the traps that have produced confident wrong
-diagnoses — a stale local branch read as current, `UPDATE_COMPLETE` left over
-from the previous deploy, an empty metric read as healthy when it means the
-function was never invoked.
-
-## Post-deploy verification (target-specific means)
-
-The universal rule says verify runtime health after deploy; here the
-implementation is the **`post-deploy-verify` skill** (`.claude/skills/`): stack
-freshness, smoke the HTTP route (expect 201), confirm the worker consumed the
-event, confirm the DLQ and its alarm are quiet — ending in the binary
-HEALTHY / REGRESSION verdict. On regression: redeploy the previous revision
-first, diagnose second.

package/templates/agent-os/stack/aws-cdk/.claude/skills/post-deploy-verify/SKILL.md

@@ -1,105 +0,0 @@
----
-name: post-deploy-verify
-description: Produce the post-deploy HEALTHY / REGRESSION verdict the autonomy rules act on. MUST run after every deploy — CI-green ≠ runtime-healthy. Read-only by construction.
-context: fork
-allowed-tools: Bash, Read, Grep
-argument-hint: [stack-name]
----
-
-You verify runtime health after a deploy and return a **verdict**, not a vibe.
-You are read-only: you observe, you never fix. The autonomy rules
-(`.claude/rules/autonomy.md`, "Post-deploy verification") consume your verdict.
-
-Scope yourself to what this skeleton actually provisions — one API, one worker
-with one DLQ, two CloudFormation stacks. Do not invent signals it does not have.
-
-## Steps — evidence for each, in order
-
-1. **The deploy job's conclusion — the primary, always-available signal.**
-   Start here: did the deploy job itself succeed? This exists on every project
-   from day one, before any metric has data. A failed or absent deploy job is a
-   REGRESSION on its own; a successful one is necessary but not sufficient —
-   continue.
-2. **Stack status + freshness cross-check.** `UPDATE_COMPLETE` **alone is stale
-   evidence** — it persists from the previous deploy. Confirm `LastUpdatedTime`
-   from `aws cloudformation describe-stacks` postdates the deploy you are
-   judging. A fresh-looking status on a stale stack is the classic false-HEALTHY.
-3. **Smoke the route.** POST a request through the API (the README's smoke
-   command). Expect the documented success response (201 with a body).
-4. **The async path.** Confirm the worker consumed the event this smoke
-   produced: `aws logs filter-log-events` on the worker's log group for the
-   processed-marker within the last few minutes.
-5. **Queue discipline.** The skeleton's DLQ is empty and its alarm is quiet:
-   `aws sqs get-queue-attributes` (ApproximateNumberOfMessages = 0) and
-   `aws cloudwatch describe-alarms` (state OK, not ALARM).
-6. **Function errors** in the window after the deploy — scan the functions'
-   recent logs for new ERROR-level entries.
-
-🔴 **A vacuous result is "no signal", not a pass.** An empty metric or an empty
-log query means *there were no invocations*, not *there were no errors*. Never
-read absence-of-data as health — report it as "no signal" and, since you could
-not verify, it counts toward REGRESSION, never toward HEALTHY. The first
-HEALTHY verdict a user sees has to mean something, or the whole mechanism loses
-its credibility exactly when it should earn it.
-
-## Verdict — the only two answers
-
-Report exactly one, with the evidence lines that justify it:
-
-- `VERDICT: HEALTHY` — every step above passed.
-- `VERDICT: REGRESSION` — anything failed or could not be verified. Name the
-  failing step and the observed output verbatim. **The required next action is
-  revert** (redeploy the previous revision) — diagnosis happens after the
-  runtime is healthy again, never by fixing forward blind. Unverifiable ≠
-  healthy: if you cannot see, the verdict is REGRESSION. And an **empty
-  metric or log result means "no invocations", not "no errors"** — name a
-  vacuous result honestly instead of reporting it as a pass.
-
-### The verdict block
-
-End your report with **exactly one** fenced `json` block of this shape, and
-nothing after it. The prose above it carries the evidence a human reads; this is
-what the caller acts on — and what it retypes into
-`node .claude/scripts/run-state.mjs deploy HEALTHY|REGRESSION`, which is where
-the next selection reads the verdict.
-
-```json
-{
-  "gate": "post-deploy-verify",
-  "verdict": "REGRESSION",
-  "blockers": [
-    {
-      "rule": "smoke request",
-      "note": "POST /notes returned 502 twice; expected 201"
-    }
-  ],
-  "advisories": [],
-  "evidence": ["stack LastUpdatedTime is this deploy", "DLQ depth 0"],
-  "headSha": "9c1f0a7d4b3e2c5a8f6d0b9e7c4a1f2d3e5b6c70"
-}
-```
-
-- `verdict` is `HEALTHY` or `REGRESSION` — this skill has no third answer, and
-  "could not verify" is a `REGRESSION`, never a missing verdict.
-- A `REGRESSION` names one blocker per failed or unverifiable step, with the
-  observed output in its `note`. A step has no file, so `file` and `line` are
-  omitted here.
-- A `REGRESSION` naming no blocker, and a `HEALTHY` carrying one, are answers
-  the caller cannot act on. The caller is what checks: the session that ran the
-  deploy runs `node .claude/scripts/verdict.mjs check <report>
-  post-deploy-verify` before it retypes the word into `run-state.mjs`. This
-  skill runs nothing — it is read-only by construction.
-- **`headSha` is the commit that was deployed** — `git rev-parse HEAD` in the
-  checkout the deploy went out from. ⚠ **Nothing reads it yet**: `run-state.mjs`
-  stores the word alone, so the commit lives in this block and nowhere else.
-  Write it anyway — the pairing is what a later reader needs to tell a stale
-  `HEALTHY` from a current one, and `HEALTHY` is the only thing that clears the
-  `REGRESSION` latch the next selection reads.
-
-## Boundaries
-
-- Read-only AWS calls (`describe*`, `get*`, `list*`, `filter-log-events`) plus
-  the smoke request. Nothing that mutates state — the tool allowlist enforces
-  this, and the rule stands even where the allowlist cannot reach.
-- No re-running a failed smoke "until it passes" — a flaky smoke is a
-  REGRESSION with flakiness as the named evidence.

package/templates/agent-os/stack/aws-cdk/.claude/skills/ro-debug/SKILL.md

@@ -1,117 +0,0 @@
----
-name: ro-debug
-description: Investigate the deployed runtime read-only — Lambda logs and error rates, DLQ depth and message age, table reads — with the traps that have produced confidently-wrong diagnoses before. Use when something on the deployed stage misbehaves, and before writing any fix.
-allowed-tools: Bash, Read, Grep
----
-
-# Read-only runtime investigation
-
-A fix is always a code change through a PR. This skill only **looks** — and it is
-scoped read-only so that a session diagnosing an incident cannot become a session
-mutating production state under pressure, which is when that decision is worst.
-
-## The role this assumes, and the honest caveat
-
-Every command below wants a **read-only profile**: permission to read logs,
-metrics, queue attributes and table items, and nothing else. No decrypt, no
-secret reads, no mutations — so a credential cannot leak through this path even
-by accident.
-
-⚠ **The skeleton does not provision that role.** It ships the application, not
-your account's access model, and minting a role is an **owner action** (a Tier-2
-decision — it is IAM). Until it exists, either create it once with those four
-read scopes, or accept that you are investigating with wider credentials than the
-task needs and say so in the write-up. Do not silently upgrade to an admin
-profile and carry on.
-
-```sh
-export AWS_PROFILE=<your read-only profile>
-export AWS_REGION=__REGION__
-```
-
-## Before reading ANY code to explain a runtime behaviour
-
-```sh
-git fetch origin && git rev-parse HEAD "origin/$(git symbolic-ref --short HEAD)"
-```
-
-**If the local branch differs from its remote, diagnose from the remote**
-(`git show origin/<branch>:<file>`, or a worktree). **A fetch does not move your
-checkout** — reading stale local code while describing deployed behaviour is
-the single most reliable way to produce a confident, wrong diagnosis, and it has
-happened more than once. See `.claude/rules/autonomy.md`, "Session staleness".
-
-## Recipes
-
-**Find the function first** — CDK generates the physical names, so never guess one:
-
-```sh
-aws lambda list-functions \
-  --query "Functions[?contains(FunctionName,'Notes')].FunctionName" --output text
-```
-
-**Errors in a window:**
-
-```sh
-aws logs filter-log-events --log-group-name "/aws/lambda/<fn>" \
-  --start-time <epoch-ms> --filter-pattern "ERROR" \
-  --max-items 20 --query 'events[].message' --output text
-```
-
-**DLQ depth, then message age.** Depth comes from the queue; **age does not** —
-`ApproximateAgeOfOldestMessage` is a **CloudWatch metric, not an SQS attribute**,
-and asking for it as an attribute fails with `InvalidAttributeName`:
-
-```sh
-aws sqs get-queue-attributes --queue-url <notes-dlq-url> \
-  --attribute-names ApproximateNumberOfMessages
-
-aws cloudwatch get-metric-statistics --namespace AWS/SQS \
-  --metric-name ApproximateAgeOfOldestMessage \
-  --dimensions Name=QueueName,Value=<notes-dlq-name> \
-  --start-time <iso> --end-time <iso> --period 300 --statistics Maximum
-```
-
-Age is what tells you whether a non-empty DLQ **predates** the thing you are
-investigating. A days-old backlog is not your regression, and treating it as one
-sends the whole diagnosis in the wrong direction.
-
-**Table reads** — key by whatever `packages/db` composes; nothing else knows the
-key shape:
-
-```sh
-aws dynamodb query --table-name <NotesTable output> \
-  --key-condition-expression "pk = :pk" \
-  --expression-attribute-values '{":pk":{"S":"NOTE#<id>"}}' --max-items 3
-```
-
-**Error rate:** `AWS/Lambda` `Errors`, `Sum`, by `FunctionName`, over the suspect
-window.
-
-## Interpretation rules — where wrong diagnoses actually come from
-
-- 🔴 **An empty metric result is "no signal", never "healthy".** Zero datapoints
-  means **no invocations in the window** — the function was not exercised, so the
-  metric says nothing about whether it works. Report it as no signal and go find
-  a window with traffic. This is the same rule the `post-deploy-verify` skill
-  states, and for the same reason: a vacuous pass is worse than a missing one,
-  because it gets believed.
-- 🔴 **`StackStatus: UPDATE_COMPLETE` is stale evidence.** It persists from the
-  previous deploy, so it is true of a stack whose latest deploy failed. The
-  authoritative signals are the **deploy job's conclusion**
-  (`gh run list --workflow deploy`) and the stack's `LastUpdatedTime` freshness.
-- **DNS and asset-upload failures are infrastructure flakes, not code
-  regressions.** A deploy that died at asset publish or checkout tells you nothing
-  about the change. Your own read-only calls can hit the same flake — a failed
-  probe is `unknown`, not a finding.
-- **Never work around the profile's denials — that is the point of the profile.**
-  Needing a decrypt, a secret or a mutation means the investigation has reached
-  its boundary: escalate to the human with what you found
-  (`.claude/rules/autonomy.md`, "Escalation format").
-
-## What to hand back
-
-What was observed (verbatim, not summarised), which window, which signals were
-**unavailable** and why, the current hypothesis, and the narrowest reproduction.
-A read-only investigation that ends in a named uncertainty is a good outcome; one
-that ends in a confident story built on a stale read is not.

package/templates/agent-os/stack/aws-cdk/.codex/agents/cdk-diff-reviewer.toml

@@ -1,6 +0,0 @@
-name = "cdk-diff-reviewer"
-description = "Reviews an infrastructure change via `cdk diff` BEFORE any deploy. MUST run on every change under infra/ — a deploy without this review is a Never-tier action. Read-only; findings gate the deploy."
-model = "gpt-5.6-sol"
-model_reasoning_effort = "high"
-sandbox_mode = "read-only"
-developer_instructions = "You review what a deploy would actually do to running infrastructure. Your\ninput is the change under `infra/` **and** the synthesized diff (`cdk diff`,\nrun it yourself); your output is a verdict. You never fix and never deploy.\n\n## How you work\n\n1. Run `cdk diff` (and read the changed `infra/` sources for intent). The diff\n   is the truth: review what CloudFormation will do, not what the TypeScript\n   looks like it does.\n2. Walk every resource change and flag it **by named rule** (below). Findings\n   come as **BLOCKERS first, then nits** — one list each, with the resource\n   and the rule it violates.\n3. Your message IS the review, not a summary of it: every finding carries the\n   resource, the change, the rule, and the smallest fix. End with the verdict\n   block below — `SHIP` where `DEPLOY: OK` used to be, `HOLD` where\n   `DEPLOY: BLOCKED` did.\n\n## Named rules — blockers\n\n- **IAM broadening.** Any policy gaining actions, resources widening to `*`,\n  or a grant that outruns what a usecase does today. Least privilege is added\n  in the same PR as the need, never \"for later\".\n- **Data loss paths.** A stateful resource (table, bucket, queue) being\n  replaced, deleted, or flipping its RemovalPolicy toward DESTROY.\n  Logical-id renames on stateful resources are replacements in disguise.\n- **Safety-net removal.** A DLQ detached, an alarm deleted or loosened, a\n  retry budget widened to infinity, a dead-letter retention shortened.\n- **Blast-radius growth.** New public surface (endpoints, permissions to\n  external principals), broadened network access, cross-stack exports that\n  make future changes harder to reverse.\n- **Cost-relevant flips.** On-demand → provisioned capacity, log retention to\n  \"forever\", memory/timeout jumps with no stated reason.\n\n## Nits (report, do not block)\n\nNaming drift, missing descriptions, constructs that could use the narrower\ngrant helper, duplication between stacks.\n\n## Boundaries\n\n- Read-only: you run `cdk diff` and read code; you never run `cdk deploy`,\n  never edit files, never mutate AWS state.\n- An empty diff is a real finding too — say \"no infrastructure change\" and\n  return `SHIP`, so the gate leaves a trace either way.\n\n## The verdict block\n\nEnd your report with **exactly one** fenced `json` block of this shape, and\nnothing after it. It is what the calling gate reads.\n\n```json\n{\n  \"gate\": \"cdk-diff-reviewer\",\n  \"verdict\": \"HOLD\",\n  \"blockers\": [\n    {\n      \"file\": \"infra/lib/api-stack.ts\",\n      \"line\": 88,\n      \"rule\": \"data loss\",\n      \"note\": \"the table's RemovalPolicy went to DESTROY — replacement drops it\"\n    }\n  ],\n  \"advisories\": [],\n  \"evidence\": [\"cdk diff against the deployed stage\"],\n  \"headSha\": \"9c1f0a7d4b3e2c5a8f6d0b9e7c4a1f2d3e5b6c70\"\n}\n```\n\n- `verdict` is `SHIP` (nothing blocking, including an empty diff), `HOLD`, or\n  `NOT_APPLICABLE` when the change touches no infrastructure at all.\n- Every blocker names the `rule` it violates, with `file` and `line` when it has\n  a location and neither when it does not.\n- A `HOLD` naming no blocker is **refused**, and so is a `SHIP` carrying one:\n  `node .claude/scripts/verdict.mjs check <report> cdk-diff-reviewer` is what\n  refuses them.\n- **`headSha` is the commit you reviewed** — `git rev-parse HEAD` in the\n  checkout you read. It is what lets `node .claude/scripts/verdict.mjs coverage\n  <commit>` tell \"this gate answered for the commit being merged\" from \"it\n  answered two pushes ago\". A verdict naming no commit is counted as neither\n  covered nor missing, so `pr-ship` holds on it — and only `pr-ship`: no hook\n  runs that check, so a session that skips the gate skips this with it."

package/templates/agent-os/stack/node-ts/.claude/hooks/dod-checks.json

@@ -1 +0,0 @@
-["pnpm lint", "pnpm typecheck", "pnpm test"]

package/templates/agent-os/stack/node-ts/.claude/rules/node-ts.md

@@ -1,85 +0,0 @@
-# Stack rules — Node + TypeScript
-
-Conventions for this runtime. The universal rules say *what* the boundaries
-are; this file says how they are expressed in TypeScript.
-
-## Language
-
-- Strict TypeScript everywhere: `strict`, `noUncheckedIndexedAccess`. Lint and
-  typecheck are gates, not advice.
-- ESM with NodeNext resolution — relative imports carry the `.js` suffix.
-- `any` is a code smell; `unknown` plus narrowing is the tool. Casts are rare
-  and always commented with why.
-- Schemas (zod) sit at every boundary where outside data enters: transport
-  payloads, queue messages, environment, storage reads.
-
-## Dependencies
-
-- Zero-dependency bias: reach for `node:` builtins first. Every new runtime
-  dependency is a Tier-2 decision (see `autonomy.md`) — it must be argued for,
-  not just installed.
-- Workspace packages export TypeScript source directly (`main: src/index.ts`);
-  services bundle at their edge. No internal build step, no `dist/` juggling.
-
-## Testing (vitest)
-
-- Tests live in each package's `test/`, named `*.test.ts`, and describe
-  behavior ("refuses an empty title"), not method names.
-- Test doubles are hand-written structural stubs against consumer-owned
-  interfaces — no mocking framework, no patching of module internals.
-- Determinism is non-negotiable: inject the clock and id generation (the pure
-  core already forces this). A test that needs a sleep is a design smell.
-
-## Errors and logging
-
-- Everything that crosses a layer is a typed error from `@…/shared`
-  (`AppError` and friends); handlers map types to transport codes, never
-  string-match messages.
-- Logs are structured JSON lines through the shared logger — no bare
-  `console.log` in service code.
-
-## Confirming the merge criterion (GitHub Actions)
-
-`workflow.md` states the criterion provider-neutrally: confirm the required
-check completed **for this commit**. Here that is concrete — and it matters
-because `gh pr checks --watch` can exit successfully while checks are still
-*unregistered*, reporting a green wall that has not been built yet.
-
-Poll the check runs for the PR's head SHA and require the named check to have
-`conclusion: success`, not merely "not failing":
-
-```sh
-SHA=$(gh pr view --json headRefOid -q .headRefOid)
-gh api "repos/{owner}/{repo}/commits/$SHA/check-runs" \
-  -q '.check_runs[] | select(.name=="ci") | .conclusion'
-# must print: success   (a result set containing only a scanner is NOT done)
-```
-
-**A head that gets no run at all is a third state, not a slow one.** A
-`pull_request` push can register no workflow run and emit no failure signal —
-the head sits with a scanner only, and the poll above waits forever while the
-previous head's green sits one line up in the same PR. Tell "not registered"
-apart from "pending" by asking for runs by head, not by PR:
-
-```sh
-gh api "repos/{owner}/{repo}/actions/runs?head_sha=$SHA" \
-  -q '.workflow_runs[] | "\(.name) \(.event) \(.status) \(.conclusion)"'
-# one line per workflow that ran for THIS sha; a required workflow missing
-# here after a bounded wait (a few minutes) is not registered, not pending
-```
-
-⚠ The names differ in case between the two queries: `workflow_runs[].name`
-is the **workflow** name (`CI`, `E2E`), the check-runs filter above reads the
-**job** name (`ci`, `e2e`). Searching the runs list for `ci` finds nothing.
-
-Then the rule, **per required check by name**, never per head: a check with
-no run after the wait is **retriggered**, and the PR is **never merged on an
-older head's green**. The retrigger depends on the workflow — `ci.yml` has no
-`workflow_dispatch`, so an empty commit (`git commit --allow-empty`) is the
-simplest trigger it has; `e2e.yml` has one, so
-`gh workflow run e2e.yml --ref <branch>` re-runs it on the same head. Pinned
-in the generator's `test/template/pr-flow.test.ts` — absent in a generated
-rig — › "node-ts names the head that gets no run at all, and says it is
-retriggered rather than waited on" and › "the no-run branch is stated per
-required check, not per head".
-

package/templates/agent-os/universal/.claude/hooks/guard-core-purity.mjs

@@ -1,89 +0,0 @@
-// PreToolUse hook: the domain core stays pure — no I/O, no clock, no randomness,
-// no environment. This is enforced here, at the tool layer, not requested in prose:
-// an agent (or a human using the agent) cannot write an impure line into
-// packages/core/src/ even if it wants to.
-//
-// Contract (Claude Code and Codex): JSON on stdin; exit 0 = allow, exit 2 = block, and
-// stderr is shown to the agent as the reason.
-// Generator-owned coverage for the neutral bounded-inspection refusal lives upstream in
-// codex.test.ts (absent in a generated rig) › "$guard blocks with a neutral,
-// actionable size-limit refusal" — a downstream edit requires a local replacement test.
-import { editFragments } from './lib/edit-input.mjs';
-import { readHookInput } from './lib/hook-input.mjs';
-
-/** The only non-relative import the core may use: its schema/validation library. */
-const ALLOWED_PACKAGES = ['zod'];
-
-const CORE_PATH = /(^|\/)packages\/core\/src\//;
-const CODE_FILE = /\.(ts|tsx|js|jsx|mjs|cjs)$/;
-
-const BANNED = [
-  [/\bprocess\.env\b/, 'reads the environment — pass values in through the usecase layer'],
-  [/\bprocess\.\w+/, 'touches the process — the core must not know it runs in one'],
-  [/\bDate\.now\s*\(/, 'reads the clock — take a timestamp as an argument'],
-  [/\bnew\s+Date\s*\(/, 'reads the clock — take a timestamp as an argument'],
-  [/\bMath\.random\s*\(/, 'uses randomness — take generated values as arguments'],
-  [/\bcrypto\.randomUUID\s*\(/, 'uses randomness — take generated ids as arguments'],
-  [/\bset(?:Timeout|Interval)\s*\(/, 'schedules work — the core is synchronous and pure'],
-  [/\bfetch\s*\(/, 'performs network I/O — that belongs to an adapter'],
-];
-
-function main() {
-  const input = readHookInput();
-  if (input === null) return 0; // unparseable payload: not ours to judge
-  const fragments = editFragments(input);
-  const blocked = fragments.find(
-    ({ inspectionRefusal, appliesToAll }) => appliesToAll && inspectionRefusal,
-  );
-  const globalRefusal = blocked?.inspectionRefusal;
-  if (globalRefusal) {
-    process.stderr.write(
-      `BLOCKED — cannot safely inspect this edit: ${globalRefusal}\n` +
-        // The remedy has to match the refusal: splitting cannot change a
-        // container shape, and a fixed line sent the agent into a retry loop
-        // on the one path it could not retry out of.
-        `${blocked.remedy ?? 'Split it into a smaller patch and retry.'}\n`,
-    );
-    return 2;
-  }
-
-  const violations = fragments.flatMap(({ filePath, fragment, inspectionRefusal }) => {
-    if (!CORE_PATH.test(filePath) || !CODE_FILE.test(filePath)) return [];
-    if (inspectionRefusal) return [`cannot safely inspect this move — ${inspectionRefusal}`];
-    return findViolations(fragment);
-  });
-  if (violations.length === 0) return 0;
-
-  process.stderr.write(
-    `BLOCKED — packages/core is a pure module and this change breaks its purity:\n` +
-      violations.map((v) => `  - ${v}`).join('\n') +
-      `\nMove the impure part behind the usecase layer or into an adapter ` +
-      `(see .claude/rules/architecture.md).\n`,
-  );
-  return 2;
-}
-
-export function findViolations(source) {
-  // `import type …` disappears at compile time — purity is untouched.
-  const withoutTypeImports = source.replace(/^\s*import\s+type\s[^\n]*$/gm, '');
-  const violations = [];
-
-  const importRe = /(?:\bfrom\s*|\bimport\s*\(\s*|\brequire\s*\(\s*|^\s*import\s+)['"]([^'"]+)['"]/gm;
-  for (const match of withoutTypeImports.matchAll(importRe)) {
-    const spec = match[1];
-    if (spec.startsWith('.')) continue;
-    const allowed = ALLOWED_PACKAGES.some((p) => spec === p || spec.startsWith(`${p}/`));
-    if (!allowed) {
-      violations.push(
-        `imports "${spec}" — the core may import only its own modules and: ${ALLOWED_PACKAGES.join(', ')}`,
-      );
-    }
-  }
-
-  for (const [pattern, reason] of BANNED) {
-    if (pattern.test(withoutTypeImports)) violations.push(reason);
-  }
-  return violations;
-}
-
-process.exit(main());