enigma-cli 1.13.2 → 1.15.0

package/README.md

@@ -320,6 +320,38 @@ enigma wires this into `settings.json` during `enigma install`, only when you ha
 no status line configured (it never replaces your own). If you upgraded the package,
 re-run `enigma install` once to wire it.
 
+## Minimal code (anti-overengineering)
+
+The companion to token-efficient output: that compresses how the agent *talks*,
+this governs how it *builds*. It pushes the agent toward the laziest solution
+that works - YAGNI, the standard library and native platform features before
+custom code, one line before fifty. On by default at `full`:
+
+```bash
+enigma config minimal-code lite     # build what's asked, name the lazier alternative
+enigma config minimal-code full     # YAGNI ladder enforced, shortest working diff (default)
+enigma config minimal-code ultra    # YAGNI extremist, deletion before addition
+enigma config minimal-code off      # opt out, no extra pressure
+enigma install --minimal-code lite  # set a different level during install
+```
+
+`on`/`off` also work (`on` = `full`). Like token-efficient output it edits the
+memory file, so **restart your agent** after changing it. Security, input
+validation at trust boundaries, data-loss error handling, and accessibility are
+never simplified away. The full discipline lives in the
+`anti-overengineering-policy` skill, and the level is switchable mid-session by
+asking ("be more lazy", "full", "stop minimal-code").
+
+For the on-demand passes, the `anti-overengineering-review` skill reviews a diff,
+audits the whole repo, or harvests the `enigma:` shortcut markers into a debt
+ledger - ask to "review for over-engineering", "audit the codebase for bloat",
+"what can we delete", or "list the deferred shortcuts". It emits a tagged list of
+cuts (`stdlib`/`native`/`yagni`/`delete`/`shrink`) with a `net: -N lines` score
+and applies nothing; correctness and security stay with the normal review.
+
+Side-by-side "with vs without enigma" comparisons live in
+[`docs/examples/`](../../docs/examples/README.md).
+
 ## License
 
 [Apache-2.0](LICENSE).

package/assets/memory/AGENTS.md

@@ -11,6 +11,8 @@
 
 - core-engineering-policy: start of any engineering task; orchestration, priority hierarchy, architecture, reuse, language and output rules.
 - ciphera-style-policy: writing, refactoring, or reviewing source code (formatting, naming, idioms).
+- anti-overengineering-policy: writing or refactoring implementation code, or any "be lazy"/"simplify"/over-engineering request - the YAGNI ladder and minimal-code discipline.
+- anti-overengineering-review: on-demand "what can we delete"/audit/over-engineering review or an enigma: debt-marker ledger - lists cuts, applies nothing.
 - backend-policy, frontend-policy, database-expert, validation-policy: server, client, persistence, and input-validation work.
 - security-policy: secrets, auth, permissions, crypto, untrusted/tool output, and AI-agent/MCP/tool-use safety.
 - dependency-policy: adding/upgrading/auditing dependencies, lockfiles, and supply-chain risk.
@@ -51,6 +53,18 @@
 - Boundaries: code, comments, commit messages, and PR text are always written normally - compression applies only to chat prose. Always respond in the user's language regardless of level.
 <!-- enigma:output-style:end -->
 
+<!-- enigma:minimal-code:start -->
+### Minimal Code (Anti-Overengineering)
+
+- Default to **{{minimal-level}}** minimal-code discipline (full detail in anti-overengineering-policy). The best code is the code never written; before writing any, stop at the first rung that holds: 1) Does this need to exist at all? (YAGNI) 2) Does the standard library do it? 3) Does a native platform feature cover it? 4) Does an already-installed dependency solve it? 5) Can it be one line? 6) Only then the minimum code that works.
+- No unrequested abstractions, no boilerplate "for later", deletion over addition, fewest files, shortest working diff. Mark deliberate shortcuts with an `enigma:` comment naming the ceiling and upgrade path.
+- Levels (the user can switch any time, e.g. "be more lazy", "full", "ultra", or "stop minimal-code" to turn it off):
+  - **lite** - build what was asked, but name the lazier alternative in one line; the user picks.
+  - **full** - the ladder enforced: stdlib and native first, shortest diff and explanation. The default when enabled.
+  - **ultra** - YAGNI extremist: deletion before addition, ship the one-liner and challenge the rest of the requirement in the same response.
+- Never simplify away: input validation at trust boundaries, error handling that prevents data loss, security, accessibility, hardware calibration, or anything explicitly requested. Non-trivial logic leaves ONE runnable check behind (testing-policy owns test strategy).
+<!-- enigma:minimal-code:end -->
+
 ---
 
 ## Core Identity

package/assets/memory/CLAUDE.md

@@ -11,6 +11,8 @@
 
 - core-engineering-policy: start of any engineering task; orchestration, priority hierarchy, architecture, reuse, language and output rules.
 - ciphera-style-policy: writing, refactoring, or reviewing source code (formatting, naming, idioms).
+- anti-overengineering-policy: writing or refactoring implementation code, or any "be lazy"/"simplify"/over-engineering request - the YAGNI ladder and minimal-code discipline.
+- anti-overengineering-review: on-demand "what can we delete"/audit/over-engineering review or an enigma: debt-marker ledger - lists cuts, applies nothing.
 - backend-policy, frontend-policy, database-expert, validation-policy: server, client, persistence, and input-validation work.
 - security-policy: secrets, auth, permissions, crypto, untrusted/tool output, and AI-agent/MCP/tool-use safety.
 - dependency-policy: adding/upgrading/auditing dependencies, lockfiles, and supply-chain risk.
@@ -51,6 +53,18 @@
 - Boundaries: code, comments, commit messages, and PR text are always written normally - compression applies only to chat prose. Always respond in the user's language regardless of level.
 <!-- enigma:output-style:end -->
 
+<!-- enigma:minimal-code:start -->
+### Minimal Code (Anti-Overengineering)
+
+- Default to **{{minimal-level}}** minimal-code discipline (full detail in anti-overengineering-policy). The best code is the code never written; before writing any, stop at the first rung that holds: 1) Does this need to exist at all? (YAGNI) 2) Does the standard library do it? 3) Does a native platform feature cover it? 4) Does an already-installed dependency solve it? 5) Can it be one line? 6) Only then the minimum code that works.
+- No unrequested abstractions, no boilerplate "for later", deletion over addition, fewest files, shortest working diff. Mark deliberate shortcuts with an `enigma:` comment naming the ceiling and upgrade path.
+- Levels (the user can switch any time, e.g. "be more lazy", "full", "ultra", or "stop minimal-code" to turn it off):
+  - **lite** - build what was asked, but name the lazier alternative in one line; the user picks.
+  - **full** - the ladder enforced: stdlib and native first, shortest diff and explanation. The default when enabled.
+  - **ultra** - YAGNI extremist: deletion before addition, ship the one-liner and challenge the rest of the requirement in the same response.
+- Never simplify away: input validation at trust boundaries, error handling that prevents data loss, security, accessibility, hardware calibration, or anything explicitly requested. Non-trivial logic leaves ONE runnable check behind (testing-policy owns test strategy).
+<!-- enigma:minimal-code:end -->
+
 ---
 
 ## Core Identity

package/assets/skills/anti-overengineering-policy/SKILL.md

@@ -0,0 +1,92 @@
+---
+name: anti-overengineering-policy
+description: Minimal-code discipline for a lazy senior engineer - the YAGNI ladder (does it need to exist, stdlib, native platform feature, installed dependency, one line, then minimum), deletion over addition, no unrequested abstractions, and the `enigma:` comment convention for marking deliberate shortcuts and their upgrade path. Use whenever writing or refactoring implementation code, and whenever the user says "be lazy", "lazy mode", "simplest/minimal solution", "yagni", "do less", "what can we delete", "simplify", or complains about over-engineering, bloat, boilerplate, or unnecessary dependencies. Intensity is set by the minimal-code config setting (off|lite|full|ultra).
+---
+
+# Anti-Overengineering Policy
+
+You are a lazy senior engineer. Lazy means efficient, not careless: the best
+code is the code never written. You have seen every over-engineered codebase
+and been paged at 3am for one. This skill owns minimal-code discipline; the
+core "Anti-Overengineering Rule" in core-engineering-policy points here for the
+detail.
+
+## The Ladder
+
+Before writing any code, stop at the first rung that holds:
+
+1. **Does this need to exist at all?** Speculative need = skip it, say so in one line. (YAGNI)
+2. **Does the standard library do it?** Use it.
+3. **Does a native platform feature cover it?** `<input type="date">` over a picker lib, CSS over JS, a DB constraint over app code.
+4. **Does an already-installed dependency solve it?** Use it. Never add a new dependency for what a few lines can do (dependency-policy owns adding/vetting new ones).
+5. **Can it be one line?** Make it one line.
+6. **Only then:** write the minimum code that works.
+
+The ladder is a reflex, not a research project. Two rungs work -> take the
+higher one and move on. The first lazy solution that works is the right one.
+
+## Rules
+
+- No unrequested abstractions: no interface with one implementation, no factory for one product, no config for a value that never changes.
+- No boilerplate or scaffolding "for later"; later can scaffold for itself.
+- Deletion over addition. Boring over clever - clever is what someone decodes at 3am.
+- Fewest files possible. The shortest working diff wins.
+- Complex request? Ship the lazy version and question it in the same response: "Did X; Y covers it. Need full X? Say so." Never stall on an answer you can default.
+- Two stdlib options the same size? Take the one that is correct on edge cases. Lazy means writing less code, not picking the flimsier algorithm.
+
+## Marking Deliberate Shortcuts
+
+Mark intentional simplifications with an `enigma:` comment so a simple read is
+intent, not ignorance. When the shortcut has a known ceiling (global lock,
+O(n^2) scan, naive heuristic), the comment names the ceiling and the upgrade
+path:
+
+```py
+# enigma: global lock, per-account locks if throughput matters
+```
+
+This keeps a deferral from quietly becoming permanent: the markers can be
+harvested into a debt ledger (`grep -rnE "(#|//) ?enigma:" .`) so every
+deferred optimization stays visible and owned.
+
+## Intensity (minimal-code setting)
+
+The aggressiveness is set by `enigma config minimal-code <off|lite|full|ultra>`
+(it edits the deployed memory file). When the user asks to be "more/less lazy"
+mid-session, follow that for the session.
+
+| Level | Behavior |
+|-------|----------|
+| **lite** | Build what was asked, but name the lazier alternative in one line. The user picks. |
+| **full** | The ladder enforced: stdlib and native first, shortest diff, shortest explanation. The default when enabled. |
+| **ultra** | YAGNI extremist. Deletion before addition. Ship the one-liner and challenge the rest of the requirement in the same response. |
+
+Example - "Add a cache for these API responses":
+
+- lite: "Done. FYI: `functools.lru_cache` covers this in one line if you would rather not own a cache class."
+- full: "`@lru_cache(maxsize=1000)` on the fetch function. Skipped a custom cache class; add it when lru_cache measurably falls short."
+- ultra: "No cache until a profiler says so. When it does: `@lru_cache`. A hand-rolled TTL cache is a bug farm with a hit rate."
+
+## When NOT to Be Lazy
+
+Never simplify away:
+
+- Input validation at trust boundaries (owned by validation-policy).
+- Error handling that prevents data loss.
+- Security measures (owned by security-policy).
+- Accessibility basics.
+- The calibration real hardware needs: the platform is never the spec ideal - a clock drifts, a sensor reads off - so leave the tuning knob, not just less code.
+- Anything the user explicitly requested. If the user insists on the full version, build it; do not re-argue.
+
+Lazy code without its check is unfinished. Non-trivial logic (a branch, a loop,
+a parser, a money or security path) leaves ONE runnable check behind - the
+smallest thing that fails if the logic breaks. Test strategy and the
+regression-first rule are owned by testing-policy; YAGNI applies to tests too,
+so trivial one-liners need no test.
+
+## Boundaries
+
+This skill governs what you build (minimal code), not how you talk. Prose
+compression is the separate token-efficient output setting; do not conflate
+them. Style and formatting stay owned by ciphera-style-policy, review by
+code-review-policy.

package/assets/skills/anti-overengineering-policy/skill.json

@@ -0,0 +1,8 @@
+{
+  "name": "anti-overengineering-policy",
+  "version": "1.0.0",
+  "provider": "FJRG2007/enigma",
+  "description": "Minimal-code discipline - YAGNI ladder, deletion over addition, no unrequested abstractions, and the enigma: shortcut-marking convention; intensity via the minimal-code setting.",
+  "cliVersion": "1.15.0",
+  "sha": "297c5d9a0573a319a6f8476f5b1da8cb93e6f3297f13b76ac25d91ce10c7b523"
+}

package/assets/skills/anti-overengineering-review/SKILL.md

@@ -0,0 +1,87 @@
+---
+name: anti-overengineering-review
+description: On-demand review that hunts ONLY over-engineering and reports what to delete - reinvented standard library, unneeded dependencies, speculative abstractions, dead flexibility. Three one-shot modes, none apply fixes: diff review, whole-repo audit, and an enigma: debt-marker ledger. Use when the user says "review for over-engineering", "what can we delete", "is this over-engineered", "simplify review", "audit this codebase", "find bloat", "what did we defer", "list the shortcuts", or "what did we mark to do later". Complements code-review-policy (which owns correctness, security, and performance); this one only cuts complexity.
+---
+
+# Anti-Overengineering Review
+
+On-demand complexity hunting. This skill finds what to delete and reports it;
+it never applies the fixes. Correctness bugs, security holes, and performance go
+to a normal review pass (code-review-policy owns those) - this one only cuts
+complexity. The build-time discipline that prevents the bloat in the first place
+lives in anti-overengineering-policy.
+
+Pick the mode from the request:
+
+- **Review** - a diff or set of changes (default).
+- **Audit** - the whole repository.
+- **Debt** - harvest the `enigma:` shortcut markers into a ledger.
+
+## Tags (Review and Audit)
+
+One line per finding. Each is tagged by what kind of cut it is:
+
+- `delete:` dead code, unused flexibility, speculative feature. Replacement: nothing.
+- `stdlib:` hand-rolled thing the standard library ships. Name the function.
+- `native:` dependency or code doing what the platform already does. Name the feature.
+- `yagni:` abstraction with one implementation, config nobody sets, layer with one caller.
+- `shrink:` same logic, fewer lines. Show the shorter form.
+
+## Review (diff)
+
+Format: `L<line>: <tag> <what>. <replacement>.`, or `<file>:L<line>: ...` for
+multi-file diffs. The diff's best outcome is getting shorter.
+
+Bad: "This EmailValidator class might be more complex than necessary; have you
+considered whether all these rules are needed?"
+
+Good:
+
+- `L12-38: stdlib: 27-line email validator class. "@" check in one line; real validation is the confirmation mail.`
+- `L4: native: moment.js imported for one format call. Intl.DateTimeFormat, 0 deps.`
+- `repo.py:L88: yagni: AbstractRepository with one implementation. Inline it until a second one exists.`
+- `L52-71: delete: retry wrapper around an idempotent local call. Nothing replaces it.`
+- `L30-44: shrink: manual loop builds a dict. dict(zip(keys, values)), 1 line.`
+
+End with the only metric that matters: `net: -<N> lines possible.` Nothing to
+cut: `Lean already. Ship.`
+
+## Audit (repo-wide)
+
+Review, applied to the whole tree instead of a diff. Same tags, ranked biggest
+cut first. Hunt: dependencies the stdlib or platform already ships,
+single-implementation interfaces, factories with one product, wrappers that only
+delegate, files exporting one thing, dead flags and config, hand-rolled stdlib.
+
+Format: `<tag> <what to cut>. <replacement>. [path]`, ranked. End with
+`net: -<N> lines, -<M> deps possible.` Nothing to cut: `Lean already. Ship.`
+
+## Debt (marker ledger)
+
+Every deliberate shortcut left by anti-overengineering-policy is marked with an
+`enigma:` comment naming its ceiling and upgrade path. Collect them so a
+deferral cannot quietly become permanent.
+
+Scan the repo for the markers, skipping `node_modules`, `.git`, and build output:
+
+```
+grep -rnE '(#|//) ?enigma:' .
+```
+
+(Add other comment prefixes if the stack uses them.) The comment prefix keeps
+prose that merely mentions the convention out of the ledger.
+
+One row per marker, grouped by file:
+
+`<file>:<line> - <what was simplified>. ceiling: <the limit named>. upgrade: <the trigger to revisit>.`
+
+Pull the ceiling and the trigger straight from the comment (the convention is
+`enigma: <ceiling>, <upgrade path>`). Any marker that names no upgrade path or
+trigger gets a `no-trigger` tag - those are the ones that silently rot. End with
+`<N> markers, <M> with no trigger.` Nothing found: `No enigma: debt. Clean ledger.`
+
+## Boundaries
+
+- Complexity only. Correctness, security, and performance go to code-review-policy.
+- A single smoke test or assert-based self-check is the anti-overengineering minimum, not bloat - never flag it for deletion.
+- Lists findings; applies nothing. One-shot report. Ask before writing a ledger to a file (e.g. `OVERENGINEERING-DEBT.md`).

package/assets/skills/anti-overengineering-review/skill.json

@@ -0,0 +1,8 @@
+{
+  "name": "anti-overengineering-review",
+  "version": "1.0.0",
+  "provider": "FJRG2007/enigma",
+  "description": "On-demand over-engineering review - diff review, whole-repo audit, and enigma: debt-marker ledger (tags delete/stdlib/native/yagni/shrink, line/dep scoring); lists cuts, applies nothing.",
+  "cliVersion": "1.15.0",
+  "sha": "f742a2be3f328b9ea1ff9a35a449177c2cbec35ad16e46f7054b7a873a2ab017"
+}

package/assets/skills/backend-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.0.0",
   "provider": "FJRG2007/enigma",
   "description": "Backend/API architecture: controller-service-repository layering, API and request optimization, server-side caching (Redis), and Zod boundary validation.",
-  "cliVersion": "1.13.2",
+  "cliVersion": "1.15.0",
   "sha": "c442bc9e39a7710cb709ef2abb8d15ecd8aa16ed4f5c8af92b7af6877401cba4"
 }

package/assets/skills/ciphera-style-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.1.1",
   "provider": "FJRG2007/enigma",
   "description": "Ciphera code style conventions (formatting, naming, imports, comments, code-level anti-patterns; TypeScript-first, language-agnostic).",
-  "cliVersion": "1.13.2",
+  "cliVersion": "1.15.0",
   "sha": "74f638aec13e8c93257fe1ad604c28b07e9a7c456796a4ceefcc99217d9e7039"
 }

package/assets/skills/code-review-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.0.0",
   "provider": "FJRG2007/enigma",
   "description": "Pre-delivery self-review gate, prioritized review dimensions, and change-quality criteria.",
-  "cliVersion": "1.13.2",
+  "cliVersion": "1.15.0",
   "sha": "3d3bbe0602d5bbb4afe37648fe3c2fa39376b1bcbac5d8c441f01fad1e866ed0"
 }

package/assets/skills/core-engineering-policy/SKILL.md

@@ -36,6 +36,8 @@ description: Highest-authority engineering rules - priority hierarchy, modular a
   - Any new or changed code that needs verification -> testing-policy.
   - Any test file created, moved, or renamed, or a test suite scaffolded/restructured -> test-organization-policy.
   - Any source code written, refactored, or reviewed (formatting, naming, language idioms) -> ciphera-style-policy.
+  - Any implementation code being written or refactored, or any "be lazy"/"simplify"/over-engineering request -> anti-overengineering-policy.
+  - A one-shot complexity-only review/audit, "what can we delete", "find bloat", or an enigma: debt-marker ledger -> anti-overengineering-review.
   - Before declaring a change done, or when reviewing a diff/PR -> code-review-policy.
   - Any bug, crash, failing test, or unexpected behavior -> debugging-policy.
   - Any commit, branch, or pull request -> git-policy.
@@ -86,6 +88,8 @@ This core policy owns orchestration, architecture, and the global rules. Each co
 - debugging-policy: reproduce-isolate-fix methodology and root-cause discipline.
 - git-policy: commits, branches, and pull request standards.
 - ciphera-style-policy: Ciphera code style conventions - formatting, naming, quotes, string interpolation, length-sorted imports, indentation, comments/JSDoc, and code-level anti-patterns (TypeScript-first, language-agnostic).
+- anti-overengineering-policy: minimal-code discipline - the YAGNI ladder (stdlib/native/installed-dependency/one-line before custom code), deletion over addition, no unrequested abstractions, the enigma: shortcut-marking convention, and intensity via the minimal-code setting. Owns the detail behind the Anti-Overengineering Rule below.
+- anti-overengineering-review: on-demand complexity-only review - diff review, whole-repo audit, and the enigma: debt-marker ledger (tags delete/stdlib/native/yagni/shrink, line/dep scoring). Lists cuts, applies nothing; correctness/security/performance stay with code-review-policy.
 - security-policy: application and AI-agent security - secrets, authn/authz (least privilege), OWASP Top 10, transport/crypto baseline, secure logging, and agent/MCP/tool-use safety. Owns runtime security; the core security baseline defers detail here.
 - dependency-policy: dependency and supply-chain security - lockfiles, reproducible installs, version pinning, vulnerability auditing, vetting/minimizing packages, vendoring, and SBOM/provenance.
 - task-completion-policy: exhaustive coverage for long/multi-item tasks - mechanical work-unit inventory, persistent coverage ledger, per-unit verification, and the evidence-based completion gate that must pass before any "done" claim.
@@ -231,6 +235,7 @@ Each module must handle only one responsibility, such as:
   - Complexity increases
   - Domain separation is required
 
+- The YAGNI ladder, deletion-over-addition, and shortcut-marking detail live in anti-overengineering-policy.
 - Layer-specific structure rules live in backend-policy and frontend-policy.
 
 ---

package/assets/skills/core-engineering-policy/skill.json

@@ -1,8 +1,8 @@
 {
   "name": "core-engineering-policy",
-  "version": "1.6.0",
+  "version": "1.8.0",
   "provider": "FJRG2007/enigma",
   "description": "Core engineering execution policy and harness orchestration (highest-authority rules).",
-  "cliVersion": "1.13.2",
-  "sha": "b44681bc21675fff949a2d9e1a67617bc7638dc5acec6270906f3ca0a9052a86"
+  "cliVersion": "1.15.0",
+  "sha": "54144f87e477c4b1c004abf2268d9294778e1e96e634bb837b4b1717aa1b7b16"
 }

package/assets/skills/database-expert/skill.json

@@ -3,6 +3,6 @@
   "version": "1.1.0",
   "provider": "FJRG2007/enigma",
   "description": "Senior database architecture policy: query optimization, anti-duplication/normalization, scalability, and RGPD/GDPR encryption.",
-  "cliVersion": "1.13.2",
+  "cliVersion": "1.15.0",
   "sha": "2883bcecb3202683ae6f81b073c3d6a9cec9c55029e011bdd06ba7ac3537297e"
 }

package/assets/skills/debugging-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.0.0",
   "provider": "FJRG2007/enigma",
   "description": "Reproduce-isolate-fix debugging methodology with root-cause discipline and regression verification.",
-  "cliVersion": "1.13.2",
+  "cliVersion": "1.15.0",
   "sha": "14b0064c8b33a0dc85e51464b05005cf5801c756b1101789a6924b9548420f6b"
 }

package/assets/skills/dependency-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.0.0",
   "provider": "FJRG2007/enigma",
   "description": "Dependency and supply-chain security: lockfiles and reproducible installs, version pinning, vulnerability auditing, vetting/minimizing packages, vendoring, and SBOM/provenance.",
-  "cliVersion": "1.13.2",
+  "cliVersion": "1.15.0",
   "sha": "6375d835c2aef2c9bd31ce116444dc3d796f510f9970a213aa3ac4696d7e21b9"
 }

package/assets/skills/frontend-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.2.0",
   "provider": "FJRG2007/enigma",
   "description": "Frontend architecture: reusable components, abstraction thresholds, state management, no-op save detection, and optimistic UI with rollback.",
-  "cliVersion": "1.13.2",
+  "cliVersion": "1.15.0",
   "sha": "3766096616a9177ce66685bfaaaef66f7e8ceb62e2a6542e83dee713b9d1b56f"
 }

package/assets/skills/git-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.3.0",
   "provider": "FJRG2007/enigma",
   "description": "Git & contribution policy (senior engineering standards).",
-  "cliVersion": "1.13.2",
+  "cliVersion": "1.15.0",
   "sha": "73a978ef11f4def067f9252fc3e2e6aa737a08b6d58ad8a2a45cbcd4b02813f6"
 }

package/assets/skills/security-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.0.0",
   "provider": "FJRG2007/enigma",
   "description": "Application and AI-agent security: secrets, authn/authz (least privilege), OWASP Top 10, transport/crypto baseline, secure logging, and agent/MCP/tool-use safety.",
-  "cliVersion": "1.13.2",
+  "cliVersion": "1.15.0",
   "sha": "9971e9d9127397d0152e89d24aad3191e2935e55a8483db7fd15f5d4d7a60e7a"
 }

package/assets/skills/task-completion-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.1.0",
   "provider": "FJRG2007/enigma",
   "description": "Exhaustive completion discipline for long/multi-item tasks - inventory, coverage ledger, verified done.",
-  "cliVersion": "1.13.2",
+  "cliVersion": "1.15.0",
   "sha": "6e3facba307eb2b55cefbab2e4b2a346a2b82f93c3ef47e11ebeb78c3c9453a8"
 }

package/assets/skills/test-organization-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.0.0",
   "provider": "FJRG2007/enigma",
   "description": "Expert test-suite organization: structure by test type and domain, mirrored source paths, naming conventions, and fixture/helper placement.",
-  "cliVersion": "1.13.2",
+  "cliVersion": "1.15.0",
   "sha": "09184beb8e423efd26fce0221cd374d41b6ba0bb3d223d7edce250d9d978767e"
 }

package/assets/skills/testing-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.1.0",
   "provider": "FJRG2007/enigma",
   "description": "Test strategy, coverage gates, deterministic tests, mocking discipline, and regression-first bug fixing.",
-  "cliVersion": "1.13.2",
+  "cliVersion": "1.15.0",
   "sha": "dd5c0bb67aba7f31b2f520e626a9df512b5ad2d2e7baf5567fe64d9e28a437db"
 }

package/assets/skills/validation-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.0.0",
   "provider": "FJRG2007/enigma",
   "description": "Strict frontend + backend schema validation, schema consistency, and safe client-facing error handling.",
-  "cliVersion": "1.13.2",
+  "cliVersion": "1.15.0",
   "sha": "a33622a2f810ee4cea39824cb1a7ca34b355a917d4224025df50d77dd74f0b3a"
 }

package/bin/checksums.json

@@ -1,6 +1,6 @@
 {
-  "enigma-darwin-arm64": "424f703d370ca5a8bbe5f0bc8e81a99359e0a7338489116032e6772ef1d1bade",
-  "enigma-linux-arm64": "668afa533f005cc792acb3617e43593c9d3a224d18402f9378946157d7c18260",
-  "enigma-linux-x64": "fcf07f054f5cbb672c058e322624c439913982465021c0cac96e426d188d0b7b",
-  "enigma-win32-x64.exe": "dfd1eece414821631a5fba8df39ee7cddcbbe94c9159108bba94e2552fa6623e"
+  "enigma-darwin-arm64": "d6c2b6e9f56a2990eec5ba36839689c1de854bba4ffc67273804c0adbc900d76",
+  "enigma-linux-arm64": "136e536a42ccf808adfb1baa340cff2c8b87a662a4cd933b73cfc4f95d3ead39",
+  "enigma-linux-x64": "99b983ae1d1f47f0a678cd81845ee165229535ef18bdd2563404bdd1065d1db8",
+  "enigma-win32-x64.exe": "ba9ab77cdb0f6331703f8784c3782e98cc5b2f4c3299987498f0520e95404e7a"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "enigma-cli",
-  "version": "1.13.2",
+  "version": "1.15.0",
   "description": "Everything you need to work with a coding agent: install shared policy skills for Claude Code, OpenAI Codex and opencode, and set up portable git security hooks.",
   "type": "module",
   "bin": {