create-genia-os 2.4.0 → 3.0.0

package/template/.claude/commands/synapse/utils/manifest-parser-reference.md

@@ -0,0 +1,134 @@
+# SYNAPSE Manifest & Domain File Format Reference
+
+Reference for the KEY=VALUE format used by the SYN-1 domain-loader parser.
+
+---
+
+## Manifest Format (`.synapse/manifest`)
+
+The manifest is the central registry of all SYNAPSE domains. Each domain has entries with specific suffixes.
+
+### Domain Entry Suffixes
+
+| Suffix | Required | Values | Description |
+|--------|----------|--------|-------------|
+| `_STATE` | Yes | `active`, `inactive` | Whether domain rules are loaded |
+| `_RECALL` | No | comma-separated keywords | Keywords that trigger domain loading via L6 |
+| `_EXCLUDE` | No | comma-separated keywords | Keywords that suppress domain loading |
+| `_ALWAYS_ON` | No | `true`, `false` | Domain loads on every prompt (L0, L1) |
+| `_NON_NEGOTIABLE` | No | `true`, `false` | Rules cannot be overridden (L0 only) |
+| `_AGENT_TRIGGER` | No | agent_id | Domain loads when agent is active (L2) |
+| `_WORKFLOW_TRIGGER` | No | workflow_id | Domain loads when workflow is active (L3) |
+
+### Global Keys
+
+| Key | Values | Description |
+|-----|--------|-------------|
+| `DEVMODE` | `true`, `false` | Enable debug/development output |
+| `GLOBAL_EXCLUDE` | comma-separated | Global exclusion keywords |
+
+### Example Manifest
+
+```ini
+# SYNAPSE Manifest — Central Domain Registry
+# Format: KEY=VALUE (parsed by domain-loader.js)
+
+# Layer 0: Constitution (NON-NEGOTIABLE)
+CONSTITUTION_STATE=active
+CONSTITUTION_ALWAYS_ON=true
+CONSTITUTION_NON_NEGOTIABLE=true
+
+# Layer 1: Global
+GLOBAL_STATE=active
+GLOBAL_ALWAYS_ON=true
+
+# Layer 1: Context brackets
+CONTEXT_STATE=active
+CONTEXT_ALWAYS_ON=true
+
+# Layer 2: Agent domains
+AGENT_DEV_STATE=active
+AGENT_DEV_AGENT_TRIGGER=dev
+
+AGENT_QA_STATE=active
+AGENT_QA_AGENT_TRIGGER=qa
+
+# Layer 3: Workflow domains
+WORKFLOW_STORY_DEV_STATE=active
+WORKFLOW_STORY_DEV_WORKFLOW_TRIGGER=story_development
+
+# Layer 7: Star-commands
+COMMANDS_STATE=active
+
+# Global settings
+DEVMODE=false
+GLOBAL_EXCLUDE=
+```
+
+---
+
+## Domain File Format (`.synapse/{domain-name}`)
+
+Domain files contain the actual rules. Two formats are supported.
+
+### Format 1: KEY=VALUE (Recommended)
+
+```ini
+# Domain: agent-dev
+AGENT_DEV_RULE_0=Always use kebab-case for file names
+AGENT_DEV_RULE_1=Follow conventional commits format
+AGENT_DEV_RULE_2=Write tests for every feature
+```
+
+- Key format: `{DOMAIN_KEY}_RULE_{N}=text`
+- `N` starts at 0 and auto-increments
+- Domain key is UPPERCASE_SNAKE_CASE (e.g., `AGENT_DEV`)
+
+### Format 2: Plain Text
+
+```
+# Domain: agent-dev
+Always use kebab-case for file names
+Follow conventional commits format
+Write tests for every feature
+```
+
+- Each non-empty, non-comment line is a rule
+- Auto-detected by parser (no `_RULE_\d+` pattern found)
+
+### Parsing Rules
+
+- Lines starting with `#` are comments (ignored)
+- Empty lines are ignored
+- Split on first `=` only (values may contain `=`)
+- Windows CRLF and Unix LF both supported
+- Malformed lines (no `=` in KEY=VALUE mode) are skipped
+
+---
+
+## Naming Conventions
+
+| Context | Format | Example |
+|---------|--------|---------|
+| Manifest keys | UPPERCASE_SNAKE_CASE | `AGENT_DEV_STATE` |
+| Domain file names | lowercase-kebab-case | `agent-dev` |
+| Domain key derivation | Remove suffix, keep prefix | `AGENT_DEV_STATE` -> domain key `AGENT_DEV` |
+| File name derivation | Key to kebab-case | `AGENT_DEV` -> file `agent-dev` |
+
+---
+
+## Star-Command Block Format (`.synapse/commands`)
+
+```ini
+[*command-name] COMMAND:
+COMMANDS_CMD_COMMAND_NAME_0=First instruction
+COMMANDS_CMD_COMMAND_NAME_1=Second instruction
+```
+
+- Block header: `[*command-name] COMMAND:`
+- Command rules use format: `COMMANDS_{CMD_KEY}_{N}=text` (note: no `_RULE_` suffix, unlike domain rules)
+- Command key derived from name: `*dev` -> `CMD_DEV`, `*quick-fix` -> `CMD_QUICK_FIX`
+
+---
+
+*Reference for SYN-9 CRUD commands. Source: SYN-1 domain-loader.js parser.*

package/template/.claude/hooks/README.md

@@ -0,0 +1,194 @@
+# Claude Code Hooks
+
+Sistema de governança automática para regras do CLAUDE.md.
+
+## Arquitetura
+
+```
+UserPromptSubmit Hooks
+└── (all prompts)  → synapse-engine.cjs
+
+PreToolUse Hooks
+├── Read          → read-protection.py
+├── Write|Edit    → enforce-architecture-first.py
+│                 → write-path-validation.py
+│                 → mind-clone-governance.py
+│                 → code-intel-pretool.cjs
+└── Bash          → sql-governance.py
+                  → slug-validation.py
+
+PreCompact Hooks
+└── (manual+auto)  → precompact-session-digest.cjs
+```
+
+## Hooks Disponíveis
+
+### 1. read-protection.py
+**Trigger:** `Read`
+**Comportamento:** BLOQUEIA (exit 2)
+
+Impede leitura parcial (`limit`/`offset`) em arquivos protegidos:
+- `.claude/CLAUDE.md`
+- `.claude/rules/*.md`
+- `.aiox-core/development/agents/*.md`
+- `supabase/docs/SCHEMA.md`
+- `package.json`, `tsconfig.json`
+- `app/components/ui/icons/icon-map.ts`
+
+### 2. enforce-architecture-first.py
+**Trigger:** `Write|Edit`
+**Comportamento:** BLOQUEIA (exit 2)
+
+Exige documentação aprovada antes de criar código em paths protegidos:
+- `supabase/functions/` → requer doc em `docs/architecture/` ou `docs/approved-plans/`
+- `supabase/migrations/` → requer doc ou permite edição de arquivo existente
+
+### 3. write-path-validation.py
+**Trigger:** `Write|Edit`
+**Comportamento:** AVISA (exit 0 + stderr)
+
+Avisa quando documentos parecem estar no path errado:
+- Sessions/handoffs → `docs/sessions/YYYY-MM/`
+- Architecture → `docs/architecture/`
+- Guides → `docs/guides/`
+
+### 4. sql-governance.py
+**Trigger:** `Bash`
+**Comportamento:** BLOQUEIA (exit 2)
+
+Intercepta comandos SQL perigosos:
+- `CREATE TABLE/VIEW/FUNCTION/TRIGGER`
+- `ALTER TABLE`
+- `DROP TABLE/VIEW/FUNCTION`
+- `CREATE TABLE AS SELECT` (backup proibido)
+
+**Exceções permitidas:**
+- `supabase migration` (CLI oficial)
+- `pg_dump` (backup/export)
+
+### 5. slug-validation.py
+**Trigger:** `Bash`
+**Comportamento:** BLOQUEIA (exit 2)
+
+Valida formato snake_case em slugs:
+- Pattern: `^[a-z0-9]+(_[a-z0-9]+)*$`
+- ✅ `jose_carlos_amorim`
+- ❌ `jose-carlos-amorim` (hyphen)
+- ❌ `JoseAmorim` (camelCase)
+
+### 6. mind-clone-governance.py
+**Trigger:** `Write|Edit`
+**Comportamento:** BLOQUEIA (exit 2)
+
+Impede criação de mind clones sem DNA extraído previamente.
+
+**O que é bloqueado:**
+- Criar novo arquivo `squads/*/agents/*.md` que pareça ser um mind clone
+- Mind clones = agents baseados em pessoas reais (não funcionais)
+
+**O que NÃO é bloqueado:**
+- Editar arquivos existentes (permite updates)
+- Agents funcionais (identificados por sufixo):
+  - `-chief`, `-orchestrator`, `-chair`
+  - `-validator`, `-calculator`, `-generator`, `-extractor`, `-analyzer`
+  - `-architect`, `-mapper`, `-designer`, `-engineer`
+  - `tools-*`, `process-*`, `workflow-*`
+
+**Locais de DNA verificados:**
+- `squads/{pack}/data/minds/{agent_id}_dna.yaml`
+- `squads/{pack}/data/minds/{agent_id}_dna.md`
+- `squads/{pack}/data/{agent_id}-dna.yaml`
+- `outputs/minds/{agent_id}/`
+
+**Solução quando bloqueado:**
+1. Execute o pipeline de extração de DNA: `/squad-creator` → `*collect-sources` → `*extract-voice-dna` → `*extract-thinking-dna`
+2. OU se é agent funcional, renomeie com sufixo apropriado
+
+## Exit Codes
+
+| Code | Significado |
+|------|-------------|
+| 0 | Permitido (operação continua) |
+| 2 | Bloqueado (operação cancelada, mostra stderr) |
+| Outro | Erro não-bloqueante |
+
+## Input Format
+
+Hooks recebem JSON via stdin:
+
+```json
+{
+  "session_id": "abc123",
+  "hook_event_name": "PreToolUse",
+  "tool_name": "Read",
+  "tool_input": {
+    "file_path": "/path/to/file",
+    "limit": 100
+  },
+  "cwd": "/Users/alan/Code/mmos"
+}
+```
+
+## Debugging
+
+Para testar um hook manualmente:
+
+```bash
+echo '{"tool_name": "Read", "tool_input": {"file_path": ".claude/CLAUDE.md", "limit": 100}}' | python3 .claude/hooks/read-protection.py
+echo $?  # Deve retornar 2 (bloqueado)
+```
+
+## Configuração
+
+Hooks são registrados em `.claude/settings.json` (framework, commitado) ou `.claude/settings.local.json` (overrides locais).
+
+**IMPORTANTE:** Claude Code NÃO usa filesystem discovery. Cada hook DEVE ser registrado explicitamente com o evento correto.
+
+### Registro de Hooks JS (.cjs)
+
+| Hook | Evento | Matcher | Descrição |
+|------|--------|---------|-----------|
+| `synapse-engine.cjs` | `UserPromptSubmit` | — | SYNAPSE context engine |
+| `code-intel-pretool.cjs` | `PreToolUse` | `Write\|Edit` | Code intelligence injection |
+| `precompact-session-digest.cjs` | `PreCompact` | — | Session digest capture |
+
+### Exemplo de Configuração
+
+```json
+{
+  "hooks": {
+    "UserPromptSubmit": [
+      {
+        "hooks": [{ "type": "command", "command": "node \"$CLAUDE_PROJECT_DIR/.claude/hooks/synapse-engine.cjs\"", "timeout": 10 }]
+      }
+    ],
+    "PreToolUse": [
+      {
+        "matcher": "Write|Edit",
+        "hooks": [{ "type": "command", "command": "node \"$CLAUDE_PROJECT_DIR/.claude/hooks/code-intel-pretool.cjs\"", "timeout": 10 }]
+      }
+    ],
+    "PreCompact": [
+      {
+        "hooks": [{ "type": "command", "command": "node \"$CLAUDE_PROJECT_DIR/.claude/hooks/precompact-session-digest.cjs\"", "timeout": 10 }]
+      }
+    ]
+  }
+}
+```
+
+O installer (`ide-config-generator.js`) usa `HOOK_EVENT_MAP` para registrar automaticamente cada hook no evento correto durante `npx aiox-core install`.
+
+## Manutenção
+
+Para adicionar novo hook:
+
+1. Criar arquivo `.claude/hooks/novo-hook.cjs` (deve ler stdin JSON, mesmo pattern do synapse-engine.cjs)
+2. Adicionar mapeamento em `HOOK_EVENT_MAP` no `ide-config-generator.js`
+3. Documentar neste README
+4. Testar com casos reais
+
+---
+
+*Criado: 2026-01-24*
+*Arquitetura: docs/architecture/claude-md-governance-system.md*

package/template/.claude/hooks/enforce-architecture-first.py

@@ -0,0 +1,196 @@
+#!/usr/bin/env python3
+"""
+Hook: Enforce Architecture-First Development
+
+REGRA: Código só pode ser criado/editado se existir documentação prévia.
+
+Este hook intercepta Write/Edit em paths de código e verifica se existe
+documentação aprovada antes de permitir a operação.
+
+Exit Codes:
+- 0: Permitido (doc existe ou path não requer doc)
+- 2: Bloqueado (doc não existe para path protegido)
+"""
+
+import json
+import sys
+import os
+from pathlib import Path
+
+# =============================================================================
+# CONFIGURAÇÃO: Paths que EXIGEM documentação prévia
+# =============================================================================
+
+PROTECTED_PATHS = [
+    # Edge Functions - exigem docs/architecture/{function-name}.md
+    {
+        "pattern": "supabase/functions/",
+        "doc_patterns": [
+            "docs/architecture/{name}.md",
+            "docs/architecture/{name}-architecture.md",
+            "docs/approved-plans/{name}.md",
+        ],
+        "extract_name": lambda p: p.split("supabase/functions/")[1].split("/")[0] if "supabase/functions/" in p else None,
+    },
+    # Migrations - exigem documentação de schema changes
+    {
+        "pattern": "supabase/migrations/",
+        "doc_patterns": [
+            "docs/approved-plans/migration-{name}.md",
+            "docs/architecture/database-changes.md",
+        ],
+        "extract_name": lambda p: Path(p).stem if "supabase/migrations/" in p else None,
+        "allow_if_exists": True,  # Permite editar migrations existentes
+    },
+]
+
+# Paths que são SEMPRE permitidos (não exigem doc)
+ALWAYS_ALLOWED = [
+    ".claude/",
+    "docs/",
+    "outputs/",
+    "squads/",
+    ".aiox-core/",
+    ".aiox-custom/",
+    "node_modules/",
+    ".git/",
+    "package.json",
+    "package-lock.json",
+    "tsconfig.json",
+    ".env",
+    "README.md",
+]
+
+# =============================================================================
+# LÓGICA DO HOOK
+# =============================================================================
+
+def get_project_root():
+    """Obtém o root do projeto via variável de ambiente ou cwd."""
+    return os.environ.get("CLAUDE_PROJECT_DIR", os.getcwd())
+
+def is_always_allowed(file_path: str) -> bool:
+    """Verifica se o path está na lista de sempre permitidos."""
+    for allowed in ALWAYS_ALLOWED:
+        if allowed in file_path:
+            return True
+    return False
+
+def find_matching_protection(file_path: str) -> dict | None:
+    """Encontra a regra de proteção que corresponde ao path."""
+    for protection in PROTECTED_PATHS:
+        if protection["pattern"] in file_path:
+            return protection
+    return None
+
+def check_documentation_exists(file_path: str, protection: dict, project_root: str) -> tuple[bool, str]:
+    """
+    Verifica se existe documentação para o path protegido.
+
+    Returns:
+        (exists: bool, doc_path: str | None)
+    """
+    extract_fn = protection.get("extract_name")
+    if not extract_fn:
+        return True, None
+
+    name = extract_fn(file_path)
+    if not name:
+        return True, None
+
+    # Verificar cada padrão de documentação
+    for doc_pattern in protection["doc_patterns"]:
+        doc_path = doc_pattern.format(name=name)
+        full_doc_path = os.path.join(project_root, doc_path)
+
+        if os.path.exists(full_doc_path):
+            return True, doc_path
+
+    # Se allow_if_exists e o arquivo já existe, permitir edição
+    if protection.get("allow_if_exists"):
+        full_file_path = os.path.join(project_root, file_path) if not file_path.startswith("/") else file_path
+        if os.path.exists(full_file_path):
+            return True, "(arquivo existente)"
+
+    return False, None
+
+def format_required_docs(protection: dict, name: str) -> str:
+    """Formata a lista de documentos aceitos."""
+    docs = []
+    for pattern in protection["doc_patterns"]:
+        docs.append(f"  - {pattern.format(name=name)}")
+    return "\n".join(docs)
+
+def main():
+    # Ler input do stdin
+    try:
+        input_data = json.load(sys.stdin)
+    except json.JSONDecodeError:
+        # Se não conseguir parsear, permitir (fail-open)
+        sys.exit(0)
+
+    tool_name = input_data.get("tool_name", "")
+    tool_input = input_data.get("tool_input", {})
+    file_path = tool_input.get("file_path", "")
+
+    # Só processar Write e Edit
+    if tool_name not in ["Write", "Edit"]:
+        sys.exit(0)
+
+    # Normalizar path (remover prefixo absoluto se presente)
+    project_root = get_project_root()
+    relative_path = file_path
+    if file_path.startswith(project_root):
+        relative_path = file_path[len(project_root):].lstrip("/")
+
+    # Verificar se é sempre permitido
+    if is_always_allowed(relative_path):
+        sys.exit(0)
+
+    # Verificar se path está protegido
+    protection = find_matching_protection(relative_path)
+    if not protection:
+        # Path não protegido, permitir
+        sys.exit(0)
+
+    # Verificar se documentação existe
+    doc_exists, doc_path = check_documentation_exists(relative_path, protection, project_root)
+
+    if doc_exists:
+        # Documentação existe, permitir
+        sys.exit(0)
+
+    # BLOQUEAR: Documentação não existe
+    name = protection["extract_name"](relative_path) or "unknown"
+    required_docs = format_required_docs(protection, name)
+
+    error_message = f"""
+╔══════════════════════════════════════════════════════════════════════════════╗
+║  🛑 ARCHITECTURE-FIRST: Documentação obrigatória antes de código             ║
+╠══════════════════════════════════════════════════════════════════════════════╣
+║                                                                              ║
+║  Arquivo bloqueado: {relative_path[:50]:<50} ║
+║                                                                              ║
+║  REGRA: Antes de criar/editar código em paths protegidos, você DEVE:         ║
+║                                                                              ║
+║  1. Documentar o plano de arquitetura                                        ║
+║  2. Obter aprovação do usuário                                               ║
+║  3. Criar o arquivo de documentação                                          ║
+║                                                                              ║
+║  Documentos aceitos para '{name}':                                           ║
+{required_docs}
+║                                                                              ║
+║  AÇÃO: Crie um dos documentos acima com o plano aprovado, depois tente       ║
+║        novamente a operação de código.                                       ║
+║                                                                              ║
+║  DICA: Use `*create-doc architecture` para criar doc de arquitetura          ║
+║        Ou crie docs/approved-plans/{name}.md com o plano resumido             ║
+║                                                                              ║
+╚══════════════════════════════════════════════════════════════════════════════╝
+"""
+
+    print(error_message, file=sys.stderr)
+    sys.exit(2)  # Exit code 2 = bloqueia o tool
+
+if __name__ == "__main__":
+    main()

package/template/.claude/hooks/enforce-git-push-authority.sh

@@ -0,0 +1,33 @@
+#!/bin/bash
+# enforce-git-push-authority.sh
+# PreToolUse hook: blocks "git push" commands in Bash tool
+# Only meant to run when agent is NOT @devops
+# Uses node (not jq) for JSON parsing — works on Windows/Git Bash
+# FAIL-CLOSED: if parsing fails, blocks the command (exit 2)
+
+INPUT=$(cat)
+
+# Extract command from JSON using node (available on all AIOX systems)
+COMMAND=$(echo "$INPUT" | node -e "
+  let d='';
+  process.stdin.on('data',c=>d+=c);
+  process.stdin.on('end',()=>{
+    try{console.log(JSON.parse(d).tool_input.command||'')}
+    catch(e){process.exit(1)}
+  });
+" 2>/dev/null)
+
+# Fail-closed: if node parsing failed, block the command
+if [ $? -ne 0 ]; then
+  echo '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"Hook failed to parse input — blocking for safety. Contact @devops."}}'
+  exit 0
+fi
+
+# Block git push in all forms (push, push --force, push origin, etc.)
+if echo "$COMMAND" | grep -qiE '\bgit\s+push\b'; then
+  echo '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"Git push is EXCLUSIVE to @devops agent. Activate @devops for push operations."}}'
+  exit 0
+fi
+
+# Allow all other commands
+exit 0

package/template/.claude/hooks/install-hooks.sh

@@ -0,0 +1,41 @@
+#!/bin/bash
+# Install AIOX Git Hooks
+# Version: 1.0
+
+set -e
+
+echo "🔧 Installing AIOX Git Hooks..."
+
+# Get script directory
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+HOOKS_DIR="$PROJECT_ROOT/.git/hooks"
+
+# Ensure hooks directory exists
+if [ ! -d "$HOOKS_DIR" ]; then
+    echo "❌ Error: .git/hooks directory not found"
+    echo "Are you in a git repository?"
+    exit 1
+fi
+
+# Install pre-commit hook (MMOS architecture guard)
+echo "Installing pre-commit hook (MMOS architecture guard)..."
+ln -sf ../../.aiox-core/hooks/pre-commit-mmos-guard.sh "$HOOKS_DIR/pre-commit"
+chmod +x "$HOOKS_DIR/pre-commit"
+
+echo "✅ Pre-commit hook installed"
+
+# Make all hooks executable
+chmod +x "$SCRIPT_DIR"/*.sh
+
+echo ""
+echo "✅ All hooks installed successfully!"
+echo ""
+echo "Installed hooks:"
+echo "  - pre-commit: MMOS architecture guard"
+echo ""
+echo "To test:"
+echo "  .aiox-core/hooks/pre-commit-mmos-guard.sh"
+echo ""
+echo "To uninstall:"
+echo "  rm .git/hooks/pre-commit"