enigma-cli 1.12.2 → 1.13.1

package/assets/memory/AGENTS.md

@@ -15,6 +15,7 @@
 - security-policy: secrets, auth, permissions, crypto, untrusted/tool output, and AI-agent/MCP/tool-use safety.
 - dependency-policy: adding/upgrading/auditing dependencies, lockfiles, and supply-chain risk.
 - testing-policy, code-review-policy, debugging-policy, git-policy: tests, pre-delivery review, debugging, and commits/PRs.
+- task-completion-policy: long or multi-item tasks (1:1 ports, migrations, repo-wide changes) - work-unit inventory, persistent coverage ledger, and verified completion before any "done" claim.
 
 ### Always-On Rules (never skipped, even if no skill loads)
 
@@ -29,6 +30,9 @@
 
 - For long or complex tasks - or any task you judge to warrant it - break the work into smaller, well-scoped subtasks and complete them incrementally, validating each subtask before moving to the next.
 - Map the dependencies between subtasks before starting, and do only the decomposition the task genuinely needs - never over-decompose simple work.
+- For multi-item work (ports, migrations, batch changes), enumerate the FULL inventory of work units with deterministic commands before implementing, persist it as a checklist (file or todo system), and mark a unit done only after verifying it - never because a similar unit worked.
+- Never declare a task complete while any unit is pending, stubbed, or unverified. Before saying "done": reconcile counts against the inventory, build/typecheck the whole artifact, and grep for TODO/stub markers you introduced. If anything remains, say exactly what remains instead of rounding up to "done". Never silently skip or stub an item - record it with a reason and report it.
+- Never offload doable work to the user: "you can adjust/refresh X yourself" in a final report is a hidden deferral. If you can execute the action, do it before reporting; hand off only what genuinely requires the user (credentials, irreversible/destructive choices, business decisions) or what they explicitly approved deferring.
 
 <!-- enigma:parallel-subagents:start -->
 - When subtasks are genuinely independent and your runtime can spawn sub-agents (parallel task or sub-agent tools), delegate them to sub-agents that run in parallel to finish faster, then reconcile their results into a coherent whole. If the runtime has no sub-agent support, execute the subtasks sequentially.

package/assets/memory/CLAUDE.md

@@ -15,6 +15,7 @@
 - security-policy: secrets, auth, permissions, crypto, untrusted/tool output, and AI-agent/MCP/tool-use safety.
 - dependency-policy: adding/upgrading/auditing dependencies, lockfiles, and supply-chain risk.
 - testing-policy, code-review-policy, debugging-policy, git-policy: tests, pre-delivery review, debugging, and commits/PRs.
+- task-completion-policy: long or multi-item tasks (1:1 ports, migrations, repo-wide changes) - work-unit inventory, persistent coverage ledger, and verified completion before any "done" claim.
 
 ### Always-On Rules (never skipped, even if no skill loads)
 
@@ -29,6 +30,9 @@
 
 - For long or complex tasks - or any task you judge to warrant it - break the work into smaller, well-scoped subtasks and complete them incrementally, validating each subtask before moving to the next.
 - Map the dependencies between subtasks before starting, and do only the decomposition the task genuinely needs - never over-decompose simple work.
+- For multi-item work (ports, migrations, batch changes), enumerate the FULL inventory of work units with deterministic commands before implementing, persist it as a checklist (file or todo system), and mark a unit done only after verifying it - never because a similar unit worked.
+- Never declare a task complete while any unit is pending, stubbed, or unverified. Before saying "done": reconcile counts against the inventory, build/typecheck the whole artifact, and grep for TODO/stub markers you introduced. If anything remains, say exactly what remains instead of rounding up to "done". Never silently skip or stub an item - record it with a reason and report it.
+- Never offload doable work to the user: "you can adjust/refresh X yourself" in a final report is a hidden deferral. If you can execute the action, do it before reporting; hand off only what genuinely requires the user (credentials, irreversible/destructive choices, business decisions) or what they explicitly approved deferring.
 
 <!-- enigma:parallel-subagents:start -->
 - When subtasks are genuinely independent and your runtime can spawn sub-agents (parallel task or sub-agent tools), delegate them to sub-agents that run in parallel to finish faster, then reconcile their results into a coherent whole. If the runtime has no sub-agent support, execute the subtasks sequentially.

package/assets/skills/backend-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.0.0",
   "provider": "FJRG2007/enigma",
   "description": "Backend/API architecture: controller-service-repository layering, API and request optimization, server-side caching (Redis), and Zod boundary validation.",
-  "cliVersion": "1.12.2",
+  "cliVersion": "1.13.1",
   "sha": "c442bc9e39a7710cb709ef2abb8d15ecd8aa16ed4f5c8af92b7af6877401cba4"
 }

package/assets/skills/ciphera-style-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.1.1",
   "provider": "FJRG2007/enigma",
   "description": "Ciphera code style conventions (formatting, naming, imports, comments, code-level anti-patterns; TypeScript-first, language-agnostic).",
-  "cliVersion": "1.12.2",
+  "cliVersion": "1.13.1",
   "sha": "74f638aec13e8c93257fe1ad604c28b07e9a7c456796a4ceefcc99217d9e7039"
 }

package/assets/skills/code-review-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.0.0",
   "provider": "FJRG2007/enigma",
   "description": "Pre-delivery self-review gate, prioritized review dimensions, and change-quality criteria.",
-  "cliVersion": "1.12.2",
+  "cliVersion": "1.13.1",
   "sha": "3d3bbe0602d5bbb4afe37648fe3c2fa39376b1bcbac5d8c441f01fad1e866ed0"
 }

package/assets/skills/core-engineering-policy/SKILL.md

@@ -38,6 +38,7 @@ description: Highest-authority engineering rules - priority hierarchy, modular a
   - Before declaring a change done, or when reviewing a diff/PR -> code-review-policy.
   - Any bug, crash, failing test, or unexpected behavior -> debugging-policy.
   - Any commit, branch, or pull request -> git-policy.
+  - Any long, multi-item, or porting/migration task (1:1 ports, "migrate all", repo-wide changes, work spanning many files or sessions) -> task-completion-policy.
 - When a task spans multiple domains, compose the relevant skills instead of re-deriving their rules.
 - Never duplicate a specialized skill's rules inside another skill; reference it.
 
@@ -85,6 +86,7 @@ This core policy owns orchestration, architecture, and the global rules. Each co
 - ciphera-style-policy: Ciphera code style conventions - formatting, naming, quotes, string interpolation, length-sorted imports, indentation, comments/JSDoc, and code-level anti-patterns (TypeScript-first, language-agnostic).
 - security-policy: application and AI-agent security - secrets, authn/authz (least privilege), OWASP Top 10, transport/crypto baseline, secure logging, and agent/MCP/tool-use safety. Owns runtime security; the core security baseline defers detail here.
 - dependency-policy: dependency and supply-chain security - lockfiles, reproducible installs, version pinning, vulnerability auditing, vetting/minimizing packages, vendoring, and SBOM/provenance.
+- task-completion-policy: exhaustive coverage for long/multi-item tasks - mechanical work-unit inventory, persistent coverage ledger, per-unit verification, and the evidence-based completion gate that must pass before any "done" claim.
 
 ---
 
@@ -101,6 +103,7 @@ This core policy owns orchestration, architecture, and the global rules. Each co
 
 - Do not over-decompose simple tasks.
 - Only apply multi-agent simulation when task complexity justifies it.
+- Inventory, coverage tracking, and completion claims for long or multi-item tasks live in task-completion-policy.
 
 ---
 

package/assets/skills/core-engineering-policy/skill.json

@@ -1,8 +1,8 @@
 {
   "name": "core-engineering-policy",
-  "version": "1.4.0",
+  "version": "1.5.0",
   "provider": "FJRG2007/enigma",
   "description": "Core engineering execution policy and harness orchestration (highest-authority rules).",
-  "cliVersion": "1.12.2",
-  "sha": "c9c69c59516794311cb7b306ed4d4ad971824de3689a39c2b86c7669c73f2e8b"
+  "cliVersion": "1.13.1",
+  "sha": "e4e8be13e5923cb2d1f57e1bad6e78f54b02611e834e16af165c18c5478d9453"
 }

package/assets/skills/database-expert/skill.json

@@ -3,6 +3,6 @@
   "version": "1.1.0",
   "provider": "FJRG2007/enigma",
   "description": "Senior database architecture policy: query optimization, anti-duplication/normalization, scalability, and RGPD/GDPR encryption.",
-  "cliVersion": "1.12.2",
+  "cliVersion": "1.13.1",
   "sha": "2883bcecb3202683ae6f81b073c3d6a9cec9c55029e011bdd06ba7ac3537297e"
 }

package/assets/skills/debugging-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.0.0",
   "provider": "FJRG2007/enigma",
   "description": "Reproduce-isolate-fix debugging methodology with root-cause discipline and regression verification.",
-  "cliVersion": "1.12.2",
+  "cliVersion": "1.13.1",
   "sha": "14b0064c8b33a0dc85e51464b05005cf5801c756b1101789a6924b9548420f6b"
 }

package/assets/skills/dependency-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.0.0",
   "provider": "FJRG2007/enigma",
   "description": "Dependency and supply-chain security: lockfiles and reproducible installs, version pinning, vulnerability auditing, vetting/minimizing packages, vendoring, and SBOM/provenance.",
-  "cliVersion": "1.12.2",
+  "cliVersion": "1.13.1",
   "sha": "6375d835c2aef2c9bd31ce116444dc3d796f510f9970a213aa3ac4696d7e21b9"
 }

package/assets/skills/frontend-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.2.0",
   "provider": "FJRG2007/enigma",
   "description": "Frontend architecture: reusable components, abstraction thresholds, state management, no-op save detection, and optimistic UI with rollback.",
-  "cliVersion": "1.12.2",
+  "cliVersion": "1.13.1",
   "sha": "3766096616a9177ce66685bfaaaef66f7e8ceb62e2a6542e83dee713b9d1b56f"
 }

package/assets/skills/git-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.3.0",
   "provider": "FJRG2007/enigma",
   "description": "Git & contribution policy (senior engineering standards).",
-  "cliVersion": "1.12.2",
+  "cliVersion": "1.13.1",
   "sha": "73a978ef11f4def067f9252fc3e2e6aa737a08b6d58ad8a2a45cbcd4b02813f6"
 }

package/assets/skills/security-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.0.0",
   "provider": "FJRG2007/enigma",
   "description": "Application and AI-agent security: secrets, authn/authz (least privilege), OWASP Top 10, transport/crypto baseline, secure logging, and agent/MCP/tool-use safety.",
-  "cliVersion": "1.12.2",
+  "cliVersion": "1.13.1",
   "sha": "9971e9d9127397d0152e89d24aad3191e2935e55a8483db7fd15f5d4d7a60e7a"
 }

package/assets/skills/task-completion-policy/SKILL.md

@@ -0,0 +1,71 @@
+---
+name: task-completion-policy
+description: Exhaustive completion discipline for long, complex, or multi-item tasks (1:1 ports, migrations, sweeping refactors, batch changes) - mechanical inventory of every work unit, a persistent coverage ledger, per-item verification, and an evidence-based completion gate that forbids declaring done while anything is missing. Use whenever a task spans many files or items, is likely to outlive one context window, or asks to port, migrate, convert, or replicate something completely.
+---
+
+# Task Completion Policy (Exhaustive Coverage & Verified Done)
+
+## Activation Scope
+
+- Apply to any task with more than a handful of work units: 1:1 ports, language/framework migrations, repo-wide refactors, "implement all X", multi-feature builds, large integrations.
+- Owns inventory, coverage tracking, and completion claims. Subtask decomposition lives in core-engineering-policy; per-change review lives in code-review-policy; test strategy lives in testing-policy.
+
+---
+
+## Core Principle
+
+- Completeness is measured against an enumerated inventory, never against memory or impression. "It looks done" is not evidence; an empty pending list plus passing verification is.
+- An unfinished task reported honestly is acceptable. A finished-sounding report with silent gaps is a failure, and the most common failure mode of long tasks - this policy exists to prevent it.
+
+---
+
+## Phase 1 - Inventory (Before Any Implementation)
+
+- Enumerate EVERY unit of work mechanically, with deterministic commands, not by recalling or sampling:
+  - Port/migration: all source files, public symbols/exports, endpoints, CLI commands, config keys, assets (file listings, grep counts, compiler/AST symbol dumps).
+  - Multi-item feature work: every item from the spec, issue, or user message, one per line.
+- Record the counts (e.g. "src: 87 files, 412 exported functions"). Counts are the completion oracle for Phase 3.
+- Persist the inventory as a checklist artifact that survives context loss: a file in the working tree (e.g. `.task/coverage.md`) or the runtime's persistent todo/task system. One line per unit with status `pending`, `done`, `blocked(<reason>)`, or `deferred(<user-approved reason>)`.
+- If the full inventory cannot be enumerated, that is a blocker to surface and resolve (narrow the scope with the user) - never silently work on a sample of it.
+
+---
+
+## Phase 2 - Execute Against the Ledger
+
+- Work unit by unit (or in coherent batches). Flip a unit to `done` only after its own verification - it compiles/typechecks, its tests pass, or a smoke check ran - never because a similar unit worked.
+- Never silently skip, stub, or simplify a unit. A stub, TODO, or partial implementation keeps the unit `pending` or `blocked` with the reason recorded. Schedule hard units early; difficulty is a reason to start sooner, not to defer.
+- On context compaction, session resume, or sub-agent handback: re-read the ledger FIRST and continue from it. Never reconstruct progress from memory - that is where items get dropped.
+- Sub-agents must report which ledger units they completed and how each was verified; unverified claims stay `pending`.
+
+---
+
+## Phase 3 - Completion Gate (Before Saying "Done")
+
+A completion claim is forbidden unless ALL of these hold:
+
+1. The ledger has zero `pending` and zero `blocked` units. `deferred` units require the user's explicit approval and must appear in the final report.
+2. Counts reconcile mechanically: target counts match the inventory (files ported vs source files, symbols vs symbols, endpoints vs endpoints). Run the comparison commands; never estimate.
+3. The whole artifact builds/compiles/typechecks and the test suite (or smoke run) passes - not just the last file touched.
+4. A final sweep finds no incompleteness markers introduced by this task: grep the produced code for TODO, FIXME, "not implemented", placeholder/stub patterns. Every hit is fixed or explicitly reported.
+5. Self-review per code-review-policy.
+
+- If any check fails, the task is NOT done: state exactly what remains and keep working (or report the blocker). Never say "everything is complete", "fully ported", or "all done" while the ledger has open units.
+- Words like "complete", "all", "every", and "fully" in a final report are claims that must be backed by checks 1-4.
+
+---
+
+## Honest Reporting
+
+- The final report must state: total units, done, deferred (with approval), and the verification evidence (commands run and their results).
+- Anything that could not be verified is reported as unverified. Never upgrade unverified to done.
+- Never offload doable work to the user. "You can adjust X yourself", "refresh the lockfile if you prefer", "wire the remaining seam when needed" in a final report are deferrals in disguise: if the agent can execute the action (edit the pin, refresh the freeze, run the migration, wire the seam), it does so BEFORE reporting. Hand work to the user only when it genuinely requires them - credentials or access the agent lacks, irreversible or destructive choices, or business decisions - or when the user explicitly approved deferring it.
+
+---
+
+## Token Efficiency (Coverage Without Burning Tokens)
+
+- Enumerate and count with shell commands (ls/find/grep/wc, compiler output), not by reading files into context. The ledger lives on disk, not in the conversation.
+- Read each source unit once, when implementing it; do not re-read finished units. The ledger status is the cache - never re-verify unchanged units.
+- Verify per unit with the cheapest sufficient check (typecheck one file, run its tests); reserve full-suite runs for batch boundaries and the completion gate.
+- Batch trivial units (constants, type-only files) into one pass and spend the saved tokens on the hard units.
+- Update the ledger with small status-line edits, not full rewrites.

package/assets/skills/task-completion-policy/skill.json

@@ -0,0 +1,8 @@
+{
+  "name": "task-completion-policy",
+  "version": "1.1.0",
+  "provider": "FJRG2007/enigma",
+  "description": "Exhaustive completion discipline for long/multi-item tasks - inventory, coverage ledger, verified done.",
+  "cliVersion": "1.13.1",
+  "sha": "6e3facba307eb2b55cefbab2e4b2a346a2b82f93c3ef47e11ebeb78c3c9453a8"
+}

package/assets/skills/testing-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.0.0",
   "provider": "FJRG2007/enigma",
   "description": "Test strategy, coverage gates, deterministic tests, mocking discipline, and regression-first bug fixing.",
-  "cliVersion": "1.12.2",
+  "cliVersion": "1.13.1",
   "sha": "d19fa8ec7985ed231478be504d3c80360897f555d0bc0624bea19c091f459fb0"
 }

package/assets/skills/validation-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.0.0",
   "provider": "FJRG2007/enigma",
   "description": "Strict frontend + backend schema validation, schema consistency, and safe client-facing error handling.",
-  "cliVersion": "1.12.2",
+  "cliVersion": "1.13.1",
   "sha": "a33622a2f810ee4cea39824cb1a7ca34b355a917d4224025df50d77dd74f0b3a"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "enigma-cli",
-  "version": "1.12.2",
+  "version": "1.13.1",
   "description": "Everything you need to work with a coding agent: install shared policy skills for Claude Code, OpenAI Codex and opencode, and set up portable git security hooks.",
   "type": "module",
   "bin": {