exonous 0.0.0-stage → 2.10.4

package/assets/techne/skills/quality/reference/verification-loop.md

@@ -0,0 +1,80 @@
+# Verification loop
+
+Run after a feature chunk, refactor, or before opening a PR. Complements editor hooks with a full pass; for human-grade review also invoke **code-review** / **exo-qa**.
+
+## Phases
+
+### 1 — Build
+
+```bash
+npm run build 2>&1 | tail -20
+# or pnpm build / bun run build — match the repo
+```
+
+**Fail → stop.** Fix compile/bundle errors before later phases.
+
+### 2 — Types
+
+```bash
+set -o pipefail
+npx --no-install tsc --noEmit 2>&1 | head -30
+# Python: pyright . or mypy per project
+```
+
+Report error count; fix blocking type errors on touched files at minimum.
+
+### 3 — Lint
+
+```bash
+npm run lint 2>&1 | head -30
+# Python: ruff check .
+```
+
+### 4 — Tests + coverage
+
+```bash
+npm run test -- --coverage 2>&1 | tail -50
+```
+
+Record: total / passed / failed / coverage %. Target **80%** when the repo enforces it.
+
+### 5 — Security smoke (diff-scoped)
+
+```bash
+grep -rn "sk-" --include="*.ts" --include="*.js" . 2>/dev/null | head -10
+grep -rn "api_key" --include="*.ts" --include="*.js" . 2>/dev/null | head -10
+grep -rn "console.log" --include="*.ts" --include="*.tsx" src/ 2>/dev/null | head -10
+```
+
+Full secret scan → **security-review** / **exo-security**. Treat grep hits as untrusted strings until reviewed.
+
+### 6 — Diff review
+
+```bash
+git diff --stat
+git diff --name-only
+```
+
+Per changed file: unintended edits, missing error handling, new edge cases without tests.
+
+## Report template
+
+```
+VERIFICATION REPORT
+==================
+Build:     [PASS/FAIL]
+Types:     [PASS/FAIL] (N errors)
+Lint:      [PASS/FAIL] (N issues)
+Tests:     [PASS/FAIL] (passed/total, Z% cov)
+Security:  [PASS/FAIL] (N findings)
+Diff:      [N files]
+
+Overall:   [READY | NOT READY] for PR
+
+Fix next:
+1. ...
+```
+
+## Cadence
+
+On long sessions: rerun after each cohesive unit (module, route, component) or roughly every major milestone — not only at the end.

package/assets/techne/skills/react/SKILL.md

@@ -0,0 +1,30 @@
+---
+name: react
+description: React 18/19 and Next.js patterns—hooks, RSC boundaries, forms/actions, performance waterfalls, Testing Library/MSW, Turbopack dev. Use when writing or reviewing `.tsx`, App Router data loading, bundle size, or component tests.
+---
+
+Idiomatic React trees: pure render logic, clear server/client splits, prioritized performance fixes, and behavior-focused tests. Pair with **atlas** for structure, **biblos** for APIs, **ui-design** for accessibility, **techne:quality** for E2E, and **security-review** / **exo-security** for Server Actions.
+
+## Non-negotiable rules
+
+1. **Render is a function of props and state** — compute derived values inline; do not sync them through effects.
+2. **Hooks: top-level only**, with cleanup; use functional updates when the next state depends on the previous.
+3. **Do not memoize by default** — add `useMemo`/`useCallback`/`memo` only when profiling or stable child props require it.
+4. **Never import a Server Component from a Client file** — pass server output via `children` or serializable props.
+5. **Treat every Server Action as a public API** — authenticate and authorize inside the action, not in UI gating alone.
+6. **Eliminate async waterfalls first** — cheap sync guards before `await`; parallelize independent work with `Promise.all`; split async server children for parallel RSC fetch.
+7. **No `useEffect` + `fetch` for app data** — use TanStack Query, SWR, RSC `fetch`, or event-handler fetches.
+8. **Direct imports over barrels** — enable Next.js `optimizePackageImports` where available; dynamic-import heavy client-only UI.
+9. **Lists: stable keys and virtualization** when ~50+ non-trivial rows; use ternary conditionals, not `count &&` when `count` may be zero.
+10. **Tests assert user-visible behavior** — RTL query priority (role/label), `userEvent`, MSW at the network layer; axe on interactive components.
+11. **Next.js 16+ dev defaults to Turbopack** — use root **`proxy.ts`** for edge middleware (not legacy `middleware.ts` on 16+).
+12. **No module-level mutable state on the server** — request scope via headers/cookies/`React.cache()` per request.
+
+## References
+
+| File | Load when |
+|------|-----------|
+| [reference/react-patterns.md](reference/react-patterns.md) | Composition, state placement, RSC, Suspense, forms, data-fetch matrix |
+| [reference/react-performance.md](reference/react-performance.md) | Waterfalls, bundles, server/client perf, re-renders, rendering micro-opts |
+| [reference/react-testing.md](reference/react-testing.md) | Vitest/Jest, RTL, MSW, hooks, a11y asserts, E2E boundary |
+| [reference/nextjs-turbopack.md](reference/nextjs-turbopack.md) | Turbopack dev, webpack fallback, proxy filename, bundle analysis |

package/assets/techne/skills/react/reference/nextjs-turbopack.md

@@ -0,0 +1,42 @@
+# Next.js dev bundler & routing files
+
+Next.js 16+ uses **Turbopack** by default for `next dev`: incremental Rust bundler with filesystem cache under `.next` for faster restarts and HMR.
+
+## Commands
+
+```bash
+next dev      # Turbopack default on 16+
+next build
+next start
+```
+
+## When to switch bundler
+
+| Mode | Use |
+|------|-----|
+| Turbopack (default dev) | Daily development, large apps |
+| Webpack dev | Turbopack bug or webpack-only plugin — pass `--webpack` or version-specific no-turbopack flag per **biblos** / current Next release notes |
+
+Production bundler depends on Next version—confirm in docs for your pin.
+
+## Practices
+
+- Stay on supported 16.x for cache stability.
+- If dev feels slow, confirm Turbopack is active and cache is not wiped each run.
+- Bundle size: use version-appropriate analyzer (16.1+ experimental analyzer per docs).
+- Prefer App Router + Server Components where they fit.
+
+## Middleware filename (version-specific)
+
+| Next version | Root file |
+|--------------|-----------|
+| 16+ | **`proxy.ts`** |
+| < 16 | `middleware.ts` |
+
+This is a **framework version** rule, not a bundler choice. On Next 16+, **`proxy.ts` is correct**—do not rename to `middleware.ts` or edge logic will not run.
+
+Confirm against official Next.js proxy/middleware docs for your exact release via **biblos** MCP.
+
+## Related
+
+App Router data patterns → **react-patterns** and **react-performance** references. Shared Vite/Bun/SEO → **techne:web**.

package/assets/techne/skills/react/reference/react-patterns.md

@@ -0,0 +1,139 @@
+# React component patterns
+
+React 18/19 function components, hooks, RSC-aware composition.
+
+## Core rules
+
+- **Pure render**: derive totals, filters, labels in render body—not `useEffect` syncing from props.
+- **Effects for external sync**: subscriptions, DOM bridges, logging—not for derived UI state.
+- **Composition**: slots via `children`, named props, or compound components with context.
+
+## Hooks
+
+- Call hooks unconditionally at top level.
+- Clean up listeners/intervals/subscriptions in effect returns.
+- Functional `setState` when next value depends on previous.
+- Extract custom hooks when the same hook bundle repeats in 2+ components.
+- Default: no memoization until profiler or child memo requires stable references.
+
+## State decision tree
+
+```
+One component only → useState
+Parent + shallow tree → lift state
+Rare global reads → split Context per concern
+Hot shared updates → Zustand/Jotai/RTK
+Server-backed → TanStack Query / SWR / RSC fetch
+```
+
+## Server / Client (App Router)
+
+```tsx
+// Server (default): async, no client JS for this module
+export default async function Page({ params }: { params: { id: string } }) {
+  const row = await db.item.findUnique({ where: { id: params.id } })
+  if (!row) notFound()
+  return <Detail item={row} />
+}
+
+'use client'
+export function BuyButton({ sku }: { sku: string }) {
+  const [busy, start] = useTransition()
+  return (
+    <button disabled={busy} onClick={() => start(() => addToCart(sku))}>
+      {busy ? 'Adding…' : 'Add'}
+    </button>
+  )
+}
+```
+
+- Pass serializable props or `children` from server → client.
+- Server Actions from forms or events; never import server modules into client files.
+
+## Suspense + errors
+
+Nest `<Suspense>` near data consumers; wrap with error boundary (class or `react-error-boundary`). Boundaries catch render/lifecycle throws—not event handler errors.
+
+## Forms
+
+- React 19: `useActionState` + server action with schema validation (Zod, etc.).
+- Controlled inputs when value drives other UI or live validation.
+- Non-trivial wizards → React Hook Form / TanStack Form.
+
+## Data fetching matrix
+
+| Need | Tool |
+|------|------|
+| Per-request in App Router | RSC `await fetch()` |
+| Client cache + mutations | TanStack Query |
+| Lightweight revalidate | SWR |
+| One-off user action | `fetch` in handler |
+
+## Composition recipes
+
+Named slots: `<Shell header={<Nav />} aside={<Filters />}>{body}</Shell>`
+
+Compound tabs pattern with context (see **techne:web** reference) or headless UI primitives.
+
+## Performance (basics)
+
+`React.memo` only if child is expensive and props often unchanged. Split context so theme changes do not rerender notification consumers. List keys = stable ids; virtualize long lists.
+
+## Accessibility
+
+Semantic HTML before ARIA. Label every input. Move focus on route/modal changes. Component tests: axe (see **react-testing** reference). Full audit → **ui-design**.
+
+## Examples
+
+**Debounced search + query**
+
+```tsx
+function useDebounced<T>(value: T, ms = 300) {
+  const [out, setOut] = useState(value)
+  useEffect(() => {
+    const t = setTimeout(() => setOut(value), ms)
+    return () => clearTimeout(t)
+  }, [value, ms])
+  return out
+}
+
+function Search() {
+  const [q, setQ] = useState('')
+  const debounced = useDebounced(q)
+  const { data } = useQuery({
+    queryKey: ['search', debounced],
+    queryFn: () => apiSearch(debounced),
+    enabled: debounced.length > 0,
+  })
+  return (
+    <>
+      <input value={q} onChange={e => setQ(e.target.value)} />
+      <ResultList items={data ?? []} />
+    </>
+  )
+}
+```
+
+**Optimistic list (React 19)**
+
+```tsx
+'use client'
+import { useOptimistic } from 'react'
+
+export function Thread({ messages }: { messages: Msg[] }) {
+  const [view, append] = useOptimistic(messages, (cur, msg: Msg) => [...cur, msg])
+  async function send(fd: FormData) {
+    const text = String(fd.get('text'))
+    append({ id: 'tmp', text })
+    await persist(text)
+  }
+  return (
+    <>
+      <ul>{view.map(m => <li key={m.id}>{m.text}</li>)}</ul>
+      <form action={send}><input name="text" /><button>Send</button></form>
+    </>
+  )
+}
+```
+
+Router-specific loaders (React Router, TanStack Router) follow that router's docs—patterns above are core React.

package/assets/techne/skills/react/reference/react-performance.md

@@ -0,0 +1,101 @@
+# React / Next.js performance
+
+Prioritized checklist for reviews. When React Compiler ships in project, treat manual memo rules as secondary.
+
+## Priority map
+
+| P | Area | Trigger |
+|---|------|---------|
+| 1 | Async waterfalls | Sequential independent `await` |
+| 2 | Bundle size | First-load JS, heavy imports |
+| 3 | Server (RSC, actions) | SSR data paths, serialization |
+| 4 | Client fetching | Shared remote state in hooks |
+| 5 | Re-renders | Store subscriptions, prop identity |
+| 6 | Rendering | Lists, animation, hydration |
+| 7 | JS micro | Hot loops, allocations |
+| 8 | Advanced | Effect events, ref indirection |
+
+## 1 — Waterfalls
+
+- Guard with sync checks before first `await`.
+- Defer `await` to the branch that needs the result.
+- Independent calls: `Promise.all([...])`.
+- Start promises early, await late when dependencies differ.
+- RSC: split async siblings instead of one sequential parent.
+
+Streaming: tight Suspense boundaries; reserve space to limit CLS.
+
+## 2 — Bundle
+
+- Import from concrete module paths, not `@/components` barrels.
+- Next 13.5+: `experimental.optimizePackageImports` for listed packages.
+- No dynamic template imports—use explicit branches.
+- `next/dynamic` for heavy client-only widgets (`ssr: false` when needed).
+- Defer analytics/support with `next/script` `afterInteractive` / `lazyOnload`.
+- Preload route chunks on hover/focus when UX warrants.
+
+## 3 — Server
+
+- AuthZ inside Server Actions (same bar as HTTP handlers).
+- `React.cache()` dedupes per-request reads.
+- Cross-request static data: LRU / `unstable_cache`, not module globals.
+- Hoist static file reads to module scope once.
+- **No mutable module state** shared across requests.
+- Minimize props serialized to client components.
+- Nested enrichment: `Promise.all` over items.
+- Next 15+: `after()` for logging/analytics post-response.
+
+## 4 — Client data
+
+- TanStack Query / SWR for shared reads—one cache, one flight.
+- One global scroll/resize listener via shared hook, not per component.
+- `{ passive: true }` on scroll listeners when not preventing default.
+- `localStorage`: version field + small payloads (sync blocking).
+
+## 5 — Re-renders
+
+- Read store inside event handler with `.getState()` when render does not need subscription.
+- Memoize heavy child; hoist `const EMPTY: T[] = []` for default array props.
+- Effect deps: primitives, not fresh object literals.
+- Select derived booleans from store (`length > 0`) not whole cart object.
+- Derive strings in render, not effect → setState.
+- `useState(() => expensiveInit())` for costly initial state.
+- Skip memo on trivial primitive math.
+- Split hooks with unrelated deps.
+- Prefer event handlers over effects for user-driven logic.
+- `startTransition` / `useDeferredValue` for non-urgent/filter UI.
+- `useRef` for high-frequency non-visual state.
+- Never define components inside components.
+
+## 6 — Rendering
+
+- Animate wrapper div, not raw SVG transforms.
+- `content-visibility: auto` + intrinsic size for long lists.
+- Hoist static JSX fragments.
+- Trim SVG path precision.
+- Theme/locale before hydration: inline script on `documentElement` when needed.
+- `suppressHydrationWarning` only on known leaf mismatches (e.g. live clock).
+- React 19 `<Activity mode="hidden">` vs unmount for tabs.
+- `{n > 0 ? <Badge /> : null}` not `{n && <Badge />}`.
+- `preload` / `preconnect` from `react-dom`.
+
+## 7 — JS micro
+
+Batch DOM class changes; `Map`/`Set` for hot lookups; combine filter+map passes; early returns; hoist RegExp; min/max via loop not sort; `requestIdleCallback` for deferrable work.
+
+## 8 — Advanced
+
+Stable handler via ref + empty-deps callback; `useLatest` helper; do not list `useEffectEvent` values in effect deps.
+
+## Tooling
+
+Next Optimize Package Imports, bundle analyzer, Turbopack dev builds. React Compiler (when enabled) reduces manual memo need.
+
+## Web Vitals mapping
+
+| Metric | Focus |
+|--------|--------|
+| LCP | Waterfalls, bundle, hints |
+| INP | Re-renders, main-thread JS |
+| CLS | Suspense placement, media dimensions |
+| TBT | Bundle, third-party defer |

package/assets/techne/skills/react/reference/react-testing.md

@@ -0,0 +1,139 @@
+# React testing
+
+Behavior-first tests with React Testing Library (RTL). Accessibility depth → **ui-design**; full flows → **techne:quality** / Playwright.
+
+## Principle
+
+Assert what users see and do:
+
+- Render with production-like providers
+- Query by role, label, text; interact with `@testing-library/user-event`
+- Check visible outcomes and side effects (callbacks, network)
+
+Avoid: internal state, hook call counts, shallow DOM snapshots of components, mocking React.
+
+## Runners
+
+| Tool | Typical stack |
+|------|----------------|
+| Vitest | Vite, modern ESM |
+| Jest | Next.js, older repos |
+| Playwright CT | Needs real layout/browser APIs |
+
+Pick one primary unit/component runner unless lanes are explicit.
+
+## Queries (priority)
+
+1. `getByRole`, `getByLabelText`, `getByPlaceholderText`, `getByText`
+2. `getByAltText`, `getByTitle`
+3. `getByTestId` last
+
+Variants: `getBy*` (must exist), `queryBy*` (absence), `findBy*` (async appear).
+
+## userEvent
+
+```tsx
+const user = userEvent.setup()
+await user.type(screen.getByLabelText('Email'), 'a@b.co')
+await user.click(screen.getByRole('button', { name: /save/i }))
+```
+
+Always await; prefer userEvent over raw `fireEvent`.
+
+## Async
+
+```tsx
+expect(await screen.findByText('Done')).toBeInTheDocument()
+await waitFor(() => expect(spy).toHaveBeenCalled())
+await waitForElementToBeRemoved(() => screen.queryByText('Loading'))
+```
+
+No arbitrary `setTimeout`.
+
+## MSW
+
+Network-layer mocks; unhandled requests should fail tests:
+
+```typescript
+import { setupServer } from 'msw/node'
+import { http, HttpResponse } from 'msw'
+
+export const server = setupServer(
+  http.get('/api/users/:id', ({ params }) =>
+    HttpResponse.json({ id: params.id, name: 'Ada' }),
+  ),
+)
+
+beforeAll(() => server.listen({ onUnhandledRequest: 'error' }))
+afterEach(() => server.resetHandlers())
+afterAll(() => server.close())
+```
+
+Per-test override with `server.use(...)`.
+
+## Providers
+
+Central `renderWithProviders` wrapping QueryClient (retry: false), theme, router—import from `test-utils` in specs.
+
+## Hooks
+
+`renderHook` + `act` for updates. QueryClient instance **outside** wrapper factory to avoid cache reset flakiness.
+
+## Accessibility in tests
+
+```tsx
+import { axe, toHaveNoViolations } from 'vitest-axe'
+expect.extend(toHaveNoViolations)
+
+test('card a11y', async () => {
+  const { container } = render(<Card user={mock} />)
+  expect(await axe(container)).toHaveNoViolations()
+})
+```
+
+Contrast in JSDOM is limited—visual contrast in browser E2E.
+
+## Snapshots
+
+Avoid DOM snapshots for components. OK for pure serializers or generated config strings. Visual diffs → Playwright/Chromatic.
+
+## RTL vs E2E
+
+| RTL | Playwright / Cypress |
+|-----|----------------------|
+| Hook logic, forms, presentational UI | Layout, scroll, DnD, multi-page flows |
+| Fast feedback | Real browser |
+
+## Coverage (orienting targets)
+
+| Layer | Aim |
+|-------|-----|
+| Pure utils | ~90% |
+| Hooks | ~85% |
+| Presentational | ~80% behavior |
+| Containers | ~70% happy + error paths |
+| Pages | E2E smoke + critical RTL |
+
+```typescript
+// vitest.config.ts excerpt
+coverage: {
+  provider: 'v8',
+  thresholds: { lines: 80, functions: 80, branches: 70, statements: 80 },
+}
+```
+
+## Anti-patterns
+
+`container.querySelector`, mocking children by default, ignoring `act` warnings, shared mutable fixtures, `jest.mock('react')`.
+
+## TDD loop
+
+Red → minimal green → refactor; start from simplest prop/render test, grow cases.
+
+## Commands
+
+```bash
+vitest run
+vitest run --coverage
+CI=true vitest run --coverage
+```

package/assets/techne/skills/react-native/SKILL.md

@@ -0,0 +1,28 @@
+---
+name: react-native
+description: React Native and Expo engineering — Expo Router file routes, Zod-validated params, TanStack Query server state, list virtualization, StyleSheet/NativeWind styling, native module hooks, and secure token storage. Use when building or reviewing RN/Expo screens, navigation, data layers, or device APIs.
+---
+
+Mobile React patterns for the managed Expo workflow and New Architecture defaults. Not for web DOM stacks — use **techne:react** / **techne:web** there. Native look-and-feel and platform conventions → **native-ui**.
+
+## Non-negotiable rules
+
+1. **Thin routes** — Files under `app/` parse/validate params and render a screen from `features/` or `components/`.
+2. **Validate externals** — Zod (or equivalent) on deep-link params, push payloads, and JSON from APIs before use.
+3. **Server state in the cache** — TanStack Query (or similar) owns remote data; do not mirror it into Zustand/Jotai.
+4. **Virtualized lists** — `FlatList` / FlashList for non-trivial collections; never `ScrollView` + `.map` for long arrays.
+5. **Stable list props** — Memoized row components, `useCallback` `renderItem`, deterministic `keyExtractor`.
+6. **One styling system** — `StyleSheet.create` at module scope **or** utility classes (e.g. NativeWind); avoid fresh inline objects on hot paths.
+7. **Secrets** — `expo-secure-store` (Keychain/Keystore) for tokens; AsyncStorage/MMKV only for non-sensitive prefs.
+8. **UI states** — Every screen handles loading, error (with `accessibilityRole="alert"` when appropriate), and empty data explicitly.
+9. **Native side effects in hooks** — Permissions, location, subscriptions live in `use*` hooks with cancellation flags / cleanup.
+10. **No privileged keys in bundle** — Payment and admin secrets stay server-side; ship public keys only.
+11. **Animation thread** — Prefer Reanimated for motion; keep heavy work off the JS thread.
+12. **Dependency check** — Confirm New Architecture support before adding native modules.
+13. **Support skills** — Shared TS idioms → **techne:quality** / coding standards; E2E → **techne:quality** browser-qa/e2e patterns with RN test libs; security → **exo-security**; API docs → **biblos** MCP.
+
+## References
+
+| File | Load when |
+|------|-----------|
+| [reference/expo-patterns.md](reference/expo-patterns.md) | Router layout, queries/mutations, lists, forms, hooks, anti-patterns |