izanagi-ai 2.0.0

package/skills/scalability-expert.md

@@ -0,0 +1,73 @@
+# Skill: Scalability Expert
+
+> Version 1.0.0 | Priority: High
+> Dependencies: Performance Optimizer, DevOps Engineer, Software Architect
+> Compatibility: ">=1.0.0"
+
+---
+
+## Identity
+
+Scalability Expert ensures systems handle growth in users, data, and traffic without degradation. Designs horizontal scaling, caching layers, database sharding, CDN strategy, and async processing pipelines.
+
+---
+
+## Scaling Dimensions
+
+```yaml
+horizontal: add more servers (web, API, workers)
+vertical: bigger servers (limited ceiling)
+
+cache:
+  - Browser: CDN for static assets
+  - Application: Redis for hot data
+  - Database: query cache, read replicas
+
+database:
+  - Read replicas for read-heavy workloads
+  - Sharding for write-heavy workloads
+  - Connection pooling (PgBouncer, ProxySQL)
+
+async:
+  - Queues for time-consuming tasks (email, export)
+  - Event-driven for decoupling services
+  - Stream processing for real-time data
+```
+
+---
+
+## Horizontal Scaling Checklist
+
+- [ ] Application is stateless (session in Redis, not local)
+- [ ] Static assets served from CDN
+- [ ] Database has read replicas
+- [ ] Queues can scale independently
+- [ ] No file storage on local disk (use S3/CDN)
+- [ ] Health checks and auto-scaling configured
+- [ ] Load balancer configured (round-robin or least connections)
+- [ ] Cache invalidation works across nodes
+- [ ] Graceful shutdown (drain connections before stopping)
+- [ ] Metrics track requests per second per node
+
+---
+
+## Database Sharding
+
+```yaml
+strategy: "modular sharding by user_id"
+shards: 4
+key: "user_id % 4"
+
+challenges:
+  - Cross-shard queries (avoid or use fan-out)
+  - Rebalancing when adding shards
+  - Backup and restore per shard
+
+alternative: "NoSQL (DynamoDB, CosmosDB) for automatic sharding"
+```
+
+---
+
+## Changelog
+
+### 1.0.0 — Initial release. Scaling dimensions, checklist, sharding.

package/skills/security-privacy/SKILL.md

@@ -0,0 +1,98 @@
+---
+name: security-privacy
+description: |
+  Skill de Seguranca e Privacidade para o Portal. Aborda OWASP Top 10, LGPD/GDPR,
+  seguranca de APIs, authentication, authorization, cryptography e secure coding.
+  Use esta skill para implementar ou revisar aspectos de seguranca e protecao de dados.
+---
+
+# Skill Security & Privacy — Portal
+
+## OWASP Top 10
+
+| # | Risco | Prevencao |
+|---|-------|-----------|
+| 1 | Broken Access Control | RLS no Supabase, middleware de role verification |
+| 2 | Cryptographic Failures | TLS 1.3, hashing (bcrypt), encryption at rest |
+| 3 | Injection | Zod validation, prepared statements (Supabase), sanitizacao |
+| 4 | Insecure Design | Threat modeling, security review no design |
+| 5 | Security Misconfiguration | Environment-specific configs, secrets management |
+| 6 | Vulnerable Components | Dependabot, `npm audit`, renovate bot |
+| 7 | Auth Failures | Supabase Auth + MFA, rate limiting |
+| 8 | Data Integrity Failures | CSP headers, Subresource Integrity (SRI) |
+| 9 | Logging Failures | Audit logging, never log PII |
+| 10 | SSRF | URL validation, allowlist de dominios |
+
+---
+
+## LGPD (Lei Geral de Protecao de Dados)
+
+### Direitos do Titular
+- **Acesso**: API para usuario baixar seus dados
+- **Correcao**: editar dados pessoais no perfil
+- **Exclusao**: deletar conta + dados associados (anonimizar logs)
+- **Portabilidade**: exportar dados em JSON
+- **Revogacao de consentimento**: opt-out de comunicacoes
+
+### Obrigacoes Tecnicas
+- Mapeamento de dados pessoais (o que, onde, por que, por quanto tempo)
+- Consentimento explicito para coleta de dados nao essenciais
+- Aviso de privacidade claro (politica de privacidade)
+- DPO (Encarregado) com canal de contato
+- Notificacao de vazamento em 72h (ANPD)
+
+---
+
+## Secure Coding
+
+### Input Validation (Zod)
+```tsx
+import { z } from "zod";
+
+const contactSchema = z.object({
+  name: z.string().min(2).max(100),
+  email: z.string().email(),
+  phone: z.string().regex(/^\(\d{2}\)\s\d{4,5}-\d{4}$/),
+  message: z.string().min(10).max(1000),
+});
+```
+
+### CSP Headers
+```
+Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' https:; font-src 'self'; connect-src 'self' https://*.supabase.co;
+```
+
+### API Security
+- Rate limiting (express-rate-limit ou Vercel WAF)
+- CORS restrito (allowlist de dominios)
+- Request size limiting (10kb body max)
+- Idempotency keys em mutations
+- Audit logging (quem, o que, quando)
+
+---
+
+## Authentication & Authorization
+
+### Supabase Auth
+```tsx
+// Server-side middleware
+export async function middleware(req: NextRequest) {
+  const session = await supabase.auth.getSession();
+  if (!session) return NextResponse.redirect("/admin/login");
+}
+
+// RLS policy
+CREATE POLICY "Admins can read all posts" ON posts
+  FOR SELECT USING (auth.role() = 'admin');
+```
+
+---
+
+## Cryptography
+
+| Uso | Algoritmo |
+|-----|-----------|
+| Hashing de senha | bcrypt (cost 12) |
+| JWT signing | RS256 (asymmetric) |
+| TLS | TLS 1.3 (min 1.2) |
+| Dados sensiveis em repouso | AES-256-GCM |

package/skills/self-correction.md

@@ -0,0 +1,54 @@
+# Skill: Self Correction
+
+> Version 1.0.0 | Priority: High
+> Dependencies: Reflection Engine, Evolution Engine
+> Compatibility: ">=1.0.0"
+
+---
+
+## Identity
+
+Self Correction detects when the agent has made an error in its own output, acknowledges it, explains the mistake, and provides the corrected version.
+
+---
+
+## Detection
+
+```yaml
+detection_methods:
+  - User points out the error
+  - Contradiction detected in own output (I say X here but ~X there)
+  - Violation of a rule in RULES.md
+  - Security gate catches it (post-delivery scan)
+  - Code example contains syntax error
+```
+
+## Correction Protocol
+
+```
+1. Acknowledge — "I made an error in my previous response."
+2. Explain — "I suggested using X, but Y is better because..."
+3. Correct — Provide the corrected version.
+4. Prevent — Update skill/rule to prevent recurrence.
+5. Log — Record in reflection log.
+```
+
+---
+
+## Example
+
+```
+Previous response:
+❌ "Use localStorage for storing JWT tokens."
+
+Self correction:
+✅ Acknowledge: I made an error. localStorage is vulnerable to XSS.
+✅ Correction: Use httpOnly cookies for JWT storage.
+✅ Prevention: Updated Security Engineer skill rule: "never suggest localStorage for tokens."
+```
+
+---
+
+## Changelog
+
+### 1.0.0 — Initial release. Detection, protocol, example.

package/skills/self-critique.md

@@ -0,0 +1,42 @@
+# Skill: Self Critique
+
+> Version 1.0.0 | Priority: Medium
+> Dependencies: Reflection Engine
+> Compatibility: ">=1.0.0"
+
+---
+
+## Identity
+
+Self Critique proactively reviews its own output for potential improvements before the user points them out. Aims to find at least one improvement per response.
+
+---
+
+## Critique Questions
+
+```
+- Is this the clearest way to explain this?
+- Could a beginner understand this?
+- Did I include all relevant options?
+- Did I explain my reasoning?
+- Is there a simpler approach I missed?
+- Did I consider security implications?
+- Did I consider edge cases?
+- Is this the most efficient solution?
+```
+
+## Critique Process
+
+```
+1. Generate initial response
+2. Run self-critique (5 questions minimum)
+3. If improvement found: revise before delivery
+4. If no improvement: deliver as is
+5. Log critique result (improvements found/none)
+```
+
+---
+
+## Changelog
+
+### 1.0.0 — Initial release. Questions, process.

package/skills/senior-code-reviewer.md

@@ -0,0 +1,193 @@
+# Skill: Senior Code Reviewer
+
+> Version 1.0.0
+> Priority: High
+> Dependencies: SOLID Validator, Clean Code Validator, Security Engineer, Performance Optimizer
+> Compatibility: ">=1.0.0"
+
+---
+
+## Identity
+
+The Senior Code Reviewer analyzes code with the eye of an experienced engineer. It checks for correctness, security, performance, style, maintainability, and testability. Every review produces a structured report with severity levels, actionable fixes, and teaching moments.
+
+---
+
+## Goals
+
+- Catch bugs before they reach production.
+- Ensure code follows project conventions and best practices.
+- Identify security vulnerabilities in every review.
+- Suggest performance improvements without premature optimization.
+- Leave the code better than found (boy scout rule).
+- Teach the author something new with every review.
+
+---
+
+## Triggers
+
+| Condition | Action |
+|-----------|--------|
+| `task == "review"` | Full code review with report |
+| `task == "pr"` or `task == "merge"` | PR review mode |
+| User says "review this code" | Full review |
+| User shares code snippet | Quick scan + review |
+
+---
+
+## Review Dimensions
+
+| Dimension | Weight | Focus |
+|-----------|--------|-------|
+| Correctness | 30% | Logic, edge cases, off-by-one, null safety |
+| Security | 25% | OWASP, secrets, input validation, auth |
+| Maintainability | 15% | Naming, structure, comments, DRY |
+| Performance | 10% | N+1 queries, loops, caching |
+| Style | 10% | Conventions, formatting, consistency |
+| Testability | 10% | Coupling, mocks, coverage |
+
+---
+
+## Review Report Format
+
+```yaml
+review:
+  file: "app/Http/Controllers/UserController.php"
+  overall_score: 7.5 / 10
+  verdict: "APPROVED WITH COMMENTS"
+  
+  findings:
+    - severity: "critical"
+      line: 42
+      message: "SQL injection vulnerability — using raw concatenation"
+      rule: "A03: Injection"
+      fix: "Use parameterized query: DB::select(... ?, [$id])"
+    
+    - severity: "major"
+      line: 15
+      message: "Controller has too many responsibilities"
+      rule: "SOLID — Single Responsibility"
+      fix: "Extract business logic to UserService"
+    
+    - severity: "minor"
+      line: 88
+      message: "Method name getUserDetails is vague"
+      rule: "Clean Code — Meaningful Names"
+      fix: "Rename to findById or loadProfile"
+    
+    - severity: "nitpick"
+      line: 120
+      message: "Trailing whitespace"
+      rule: "PSR-12"
+      fix: "Auto-fixable"
+  
+  positives:
+    - "Good use of Form Request validation"
+    - "Pest tests are well-structured"
+  
+  teaching:
+    - topic: "SQL Injection Prevention"
+      concept: "Always use parameterized queries"
+      example: "DB::select('SELECT * FROM users WHERE id = ?', [$id])"
+```
+
+---
+
+## Severity Levels
+
+| Level | Color | Meaning | Action Required |
+|-------|-------|---------|----------------|
+| 🔴 Critical | Red | Bug, vulnerability, or data loss | Must fix before merge |
+| 🟠 Major | Orange | Violates best practice, maintainability risk | Should fix |
+| 🟡 Minor | Yellow | Style, naming, minor improvement | Consider fixing |
+| ⚪ Nitpick | Gray | Trivial (whitespace, formatting) | Optional |
+
+---
+
+## Review Algorithms
+
+### Score Calculation
+
+```
+score = 0
+score += correctness * 0.30
+score += security * 0.25
+score += maintainability * 0.15
+score += performance * 0.10
+score += style * 0.10
+score += testability * 0.10
+
+verdict:
+  if score >= 9.0: "APPROVED"
+  elif score >= 7.0: "APPROVED WITH COMMENTS"
+  elif score >= 5.0: "CHANGES REQUESTED"
+  else: "REJECTED"
+```
+
+### Finding Priority
+
+```
+priority = severity_score * impact * likelihood
+
+severity_score:
+  critical: 5
+  major: 3
+  minor: 1
+  nitpick: 0.5
+
+impact:
+  affects production: 3
+  affects development: 2
+  cosmetic only: 1
+
+likelihood:
+  certain: 3
+  likely: 2
+  possible: 1
+```
+
+---
+
+## Rules
+
+### Always
+
+- ✅ Provide severity levels for every finding.
+- ✅ Explain why a pattern is wrong, not just that it is wrong.
+- ✅ Include positives — acknowledge what was done well.
+- ✅ Offer specific, actionable fixes.
+- ✅ Include at least one teaching moment per review.
+
+### Never
+
+- ❌ Be dismissive or rude ("this is terrible code").
+- ❌ Suggest changes without explaining the reasoning.
+- ❌ Skip security review — always run OWASP checks.
+- ❌ Request changes for style preferences not in the project conventions.
+- ❌ Leave a review without a clear verdict.
+
+---
+
+## Metrics
+
+| Metric | Target | How to Measure |
+|--------|--------|---------------|
+| Findings per review | ≥ 3 | Count findings |
+| Critical findings found | 100% pre-merge | Bugs caught / total bugs |
+| Actionable fix rate | ≥ 90% | Findings with specific fix / total |
+| Teaching moments per review | ≥ 1 | Count teaching items |
+| User satisfaction | ≥ 4.0 / 5 | Follow-up rating |
+
+---
+
+## Changelog
+
+### 1.0.0 (2026-07-17)
+
+- Initial release
+- 6-dimension review scoring with weights
+- 4 severity levels (critical → nitpick)
+- Structured YAML report format
+- Priority calculation algorithm
+- Positive feedback always included
+- Teaching moment integration

package/skills/sequence-diagram-builder.md

@@ -0,0 +1,56 @@
+# Skill: Sequence Diagram Builder
+
+> Version 1.0.0 | Priority: Low
+> Dependencies: UML Generator
+> Compatibility: ">=1.0.0"
+
+---
+
+## Identity
+
+Sequence Diagram Builder generates sequence diagrams from API flow descriptions. Shows request/response flow between client, API, services, and database.
+
+---
+
+## PlantUML Sequence
+
+```plantuml
+@startuml
+actor User
+participant "Client" as C
+participant "API" as A
+participant "Service" as S
+participant "Database" as DB
+
+User -> C: Submit form
+C -> A: POST /api/v1/users
+A -> S: validate(request)
+A -> S: create(data)
+S -> DB: INSERT users
+DB --> S: user
+S --> A: User
+A --> C: 201 JSON
+C --> User: Success page
+@enduml
+```
+
+## Mermaid Sequence
+
+```mermaid
+sequenceDiagram
+    User->>Client: Submit form
+    Client->>API: POST /api/v1/users
+    API->>Service: validate(request)
+    API->>Service: create(data)
+    Service->>Database: INSERT users
+    Database-->>Service: user
+    Service-->>API: User
+    API-->>Client: 201 JSON
+    Client-->>User: Success page
+```
+
+---
+
+## Changelog
+
+### 1.0.0 — Initial release. PlantUML, Mermaid sequence diagrams.

package/skills/serverless-edge/SKILL.md

@@ -0,0 +1,103 @@
+---
+name: serverless-edge
+description: |
+  Skill de Serverless e Edge Computing para o Portal. Aborda AWS Lambda, Cloudflare
+  Workers, Vercel Edge Functions, serverless patterns, cold start optimization e edge caching.
+  Use esta skill para implementar funcionalidades serverless e edge computing.
+---
+
+# Skill Serverless & Edge — Portal
+
+## Plataformas
+
+### Vercel Serverless Functions (Preferido)
+```tsx
+// app/api/hello/route.ts
+export async function GET(req: NextRequest) {
+  return NextResponse.json({ message: "Hello from Edge!" });
+}
+```
+- **Runtime**: Node.js 20, Edge Runtime
+- **Max duration**: 10s (serverless), 30s (pro), 900s (Enterprise)
+- **Memory**: 128MB a 1024MB
+- **Cold start**: ~100ms (Node), ~50ms (Edge)
+
+### AWS Lambda
+- **Runtime**: Node.js 20, Python 3.12
+- **Max duration**: 900s
+- **Memory**: 128MB a 10240MB
+- **Cold start**: ~200ms (Node), ~1s (Java/.NET)
+- **Triggers**: API Gateway, SQS, S3, DynamoDB Streams, EventBridge
+
+### Cloudflare Workers (Edge)
+- **Runtime**: Service Worker API (V8 isolates)
+- **Limites**: 30ms CPU por request, 128MB memory
+- **Casos de uso**: redirects, rewrites, A/B testing, geolocation routing
+
+---
+
+## Serverless Patterns
+
+### Lambda + API Gateway
+```
+Client → API Gateway → Lambda → DynamoDB/S3/External API
+```
+
+### Event-driven
+```
+S3 Event → Lambda → Process → DynamoDB or SQS → Next Step
+```
+
+### Fan-out
+```
+SQS → Lambda (process) → SNS → SQS A → Lambda A
+                       → SQS B → Lambda B
+```
+
+---
+
+## Cold Start Optimization
+
+| Estrategia | Impacto |
+|------------|---------|
+| Provisioned Concurrency (Lambda) | Elimina cold start |
+| Keep warm (ping regular) | Reduz (nao elimina) |
+| Lighter dependencies | Reduz tempo de carga |
+| SnapStart (Lambda Java) | ~90% reducao |
+| Edge Runtime (Vercel) | ~50ms cold start |
+| Workers (Cloudflare) | Zero cold start |
+
+---
+
+## Edge Computing
+
+### Edge Functions (Vercel)
+- **Geolocation**: rotear conteudo por pais/regiao
+- **A/B testing**: servir diferentes variantes
+- **Redirects**: redirecionar por dispositivo/idioma
+- **Headers**: modificar security headers no edge
+- **Authentication**: verificar JWT no edge (reduz latencia)
+
+### Next.js Edge Middleware
+```tsx
+// middleware.ts
+export function middleware(req: NextRequest) {
+  const country = req.geo?.country ?? "BR";
+  const url = req.nextUrl.clone();
+  if (country !== "BR" && url.pathname === "/") {
+    url.pathname = "/internacional";
+    return NextResponse.redirect(url);
+  }
+}
+```
+
+---
+
+## Costs & Limits
+
+| Recurso | Limite | Custo |
+|---------|--------|-------|
+| Vercel Serverless | 100k requests/mes (Hobby) | Gratuito |
+| Vercel Edge | 100k requests/mes (Hobby) | Gratuito |
+| AWS Lambda | 1M requests/mes | Sempre gratis |
+| Cloudflare Workers | 100k requests/dia | Gratuito |