kodelyth-ecc 1.5.9 → 1.7.0

package/skills/supply-chain-verification/SKILL.md

@@ -0,0 +1,201 @@
+---
+name: supply-chain-verification
+description: Generate CycloneDX SBOMs, content manifests, and verify installed copies of kodelyth-ecc against shipped manifests. Use when an enterprise / security team asks "where does this code come from, is it tampered, and where is the SBOM".
+trigger:
+  - supply chain
+  - SBOM
+  - CycloneDX
+  - SLSA
+  - provenance
+  - manifest
+  - tamper
+  - integrity check
+  - verify install
+---
+
+# Skill: supply-chain-verification
+
+## What this skill does
+
+Phase 2.9 of the Devil Roadmap. Three pure-function libraries plus three CLI subcommands give every kodelyth-ecc release **enterprise-grade supply-chain credentials**:
+
+| Capability | What it produces | Format |
+|---|---|---|
+| **SBOM** | CycloneDX 1.5 software bill of materials for the package + every transitive dep in the lockfile | JSON |
+| **Manifest** | sha256 content manifest of every shipped asset (agents, skills, commands, rules, hooks, scripts, bin, bundles, root files) | JSON |
+| **Verify** | Compares an installed copy against a manifest and reports `ok` / `modified` / `missing` / `extra` | JSON or pretty |
+
+Plus, every release published via `.github/workflows/publish.yml` ships with **SLSA Level 3 build provenance** courtesy of `npm publish --provenance` (sigstore-backed).
+
+---
+
+## When to use this skill
+
+Use **explicitly** by name when:
+
+- An enterprise / SOC 2 / FedRAMP-adjacent team asks for an SBOM to ingest into Dependency-Track, Snyk, or Anchore.
+- A user reports a suspicious install — verify against the shipped manifest to confirm tamper or local mod.
+- You're preparing an audit response and need provenance + bill-of-materials in one shot.
+- You want to ship a third-party reproducibility check for a downstream consumer.
+
+```bash
+use supply-chain-verification
+
+# Generate a CycloneDX 1.5 SBOM
+npx kodelyth-ecc sbom --out sbom.cdx.json
+
+# Generate a content manifest
+npx kodelyth-ecc manifest --out manifest.json
+
+# Verify a downloaded / installed copy
+npx kodelyth-ecc verify --manifest manifest.json
+```
+
+Implicit triggers (the AI should route here automatically):
+
+- "is my install of kodelyth-ecc tampered?"
+- "give me an SBOM"
+- "where is the SLSA provenance for this release?"
+- "compliance team needs supply-chain attestation for this package"
+
+---
+
+## CLI surface
+
+### `kodelyth-ecc sbom`
+
+```
+kodelyth-ecc sbom [--root DIR] [--out FILE] [--json]
+```
+
+Produces a CycloneDX 1.5 BOM:
+
+```json
+{
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5",
+  "serialNumber": "urn:uuid:...",
+  "metadata": {
+    "timestamp": "2026-05-10T17:00:00Z",
+    "tools": [{ "vendor": "kodelyth-ecc", "name": "kodelyth-ecc-sbom", "version": "1.7.0" }],
+    "component": { "type": "application", "name": "kodelyth-ecc", "version": "1.7.0", "purl": "pkg:npm/kodelyth-ecc@1.7.0" }
+  },
+  "components": [/* one per lockfile entry */],
+  "dependencies": [{ "ref": "kodelyth-ecc@1.7.0", "dependsOn": [/* direct deps */] }]
+}
+```
+
+Pure: no network, no exec. Reads `package.json` + `package-lock.json` only. Components carry purl, license, and SHA-512 hash from npm SRI when present.
+
+### `kodelyth-ecc manifest`
+
+```
+kodelyth-ecc manifest [--root DIR] [--out FILE] [--json]
+```
+
+Walks every shipped directory + root file. Produces:
+
+```json
+{
+  "schema": "kodelyth.content-manifest/v1",
+  "package": "kodelyth-ecc",
+  "pkg_version": "1.7.0",
+  "generated_at": "2026-05-10T17:00:00Z",
+  "file_count": 730,
+  "digest": "<sha256 over deterministic JSON of the entries array>",
+  "files": [
+    { "path": "agents/code-reviewer.md", "size": 4521, "sha256": "…" },
+    …
+  ]
+}
+```
+
+Output is deterministic (sorted by path, stable sha256), so two runs against the same source tree produce identical files modulo `generated_at`.
+
+### `kodelyth-ecc verify`
+
+```
+kodelyth-ecc verify [--root DIR] [--manifest FILE] [--json]
+```
+
+Compares disk against manifest:
+
+| Category | Meaning | Fails verify? |
+|---|---|---|
+| `ok` | sha256 matches | No |
+| `modified` | file present, hash differs | **Yes** |
+| `missing` | file in manifest but not on disk | **Yes** |
+| `extra` | file on disk not in manifest | No (advisory) |
+
+Exits **0** if `ok=true`, **1** otherwise. Pair with `--json` for CI gates.
+
+---
+
+## What ships with each release
+
+The `.github/workflows/publish.yml` pipeline does **all five** of:
+
+1. Verify `package.json.version` matches the release tag.
+2. Run the full test suite (255 tests).
+3. `npm publish --provenance` → **SLSA Level 3** build provenance via npm + sigstore.
+4. Generate `kodelyth-ecc-sbom.cdx.json` and attach to the GitHub release.
+5. Generate `kodelyth-ecc-manifest.json` and attach to the GitHub release.
+
+Three artifacts ship with every release:
+
+```
+v1.X.Y/
+├── kodelyth-ecc-sbom.cdx.json    ← CycloneDX 1.5
+├── kodelyth-ecc-manifest.json    ← sha256 content manifest
+└── (npm sigstore provenance)     ← visible on npmjs.com
+```
+
+---
+
+## Programmatic API
+
+```js
+const { generateSBOM }       = require('kodelyth-ecc/scripts/supply-chain/sbom.js');
+const { generateManifest }   = require('kodelyth-ecc/scripts/supply-chain/manifest.js');
+const { verifyAgainstManifest } = require('kodelyth-ecc/scripts/supply-chain/verify.js');
+
+const bom = generateSBOM({ rootDir: '/path/to/installed/kodelyth-ecc' });
+const m   = generateManifest({ rootDir: '/path/to/installed/kodelyth-ecc' });
+const r   = verifyAgainstManifest({ rootDir: '/path/to/installed/kodelyth-ecc', manifest: m });
+
+if (!r.ok) {
+  console.error('Tamper detected:', r.summary);
+  process.exit(1);
+}
+```
+
+All three are pure functions. Safe to call from a CI step, an MCP tool, or any external automation.
+
+---
+
+## Hard rules
+
+1. **Never** weaken `verify`. Modified or missing files MUST exit non-zero. Extras stay advisory.
+2. SBOM `serialNumber` is derived deterministically from `name@version + timestamp`. If you need a true random UUID per build, set `timestamp` to the build timestamp.
+3. Manifest `digest` is the sha256 of the deterministic JSON of `files`. Reproducible across runs at the same source state.
+4. Don't include `node_modules/`, `.git/`, `.DS_Store`, `__pycache__/`, or `*.pyc` in the manifest. The skip list is in `scripts/supply-chain/manifest.js`.
+5. Treat the published manifest as authoritative for tamper detection of an installed copy. Don't substitute a freshly-generated one.
+
+---
+
+## Pairing with other ECC features
+
+| Pair with | What you get |
+|---|---|
+| **Phase 2.10 safety hooks** | The token-budget hook + this skill cover "trust" (no PII leakage + no tampered code). |
+| **MCP server (Phase 2.1)** | Expose `verify` as an MCP tool downstream agents can call to confirm their toolkit is clean. |
+| **Swarm orchestrator (Phase 2.7)** | Run `verify` as a pre-flight check before spawning N parallel workers. |
+| **Replay (Phase 2.8)** | Bundles can carry the manifest of the source ECC version that produced them, enabling reproducible replays. |
+
+---
+
+## See also
+
+- `commands/verify-supply-chain.md` — `/verify-supply-chain` slash command form
+- `docs/supply-chain.md` — full reference + downstream verification guide
+- `.github/workflows/publish.yml` — release pipeline that issues all three artifacts

package/skills/swarm-orchestrator/SKILL.md

@@ -0,0 +1,177 @@
+---
+name: swarm-orchestrator
+description: Run N ECC specialist agents in parallel inside isolated git worktrees coordinated by a tmux session. Generalizes /devil-mode to arbitrary task + agent combinations. Use when one agent isn't enough — you want a parallel sweep across security, code quality, perf, UX, tests, architecture, and docs simultaneously.
+origin: ECC
+---
+
+# Swarm Orchestrator — Parallel Agent Execution at Scale
+
+The "team-of-specialists" pattern. Where `/devil-mode` is a fixed adversarial sweep with 4–8 specific agents, swarm is the **generalized form**: pick any task, pick any agents (or let ECC pick from task signals), get N parallel worktrees + a tmux session ready to attach.
+
+> Phase 2.7 of the [Devil Roadmap](../../README.md). Promotes the existing `tmux-worktree-orchestrator` infrastructure to a first-class CLI surface.
+
+---
+
+## When to invoke
+
+Trigger this skill when:
+
+- A task is too cross-cutting for one specialist (touches security AND perf AND API AND tests).
+- The user asks for "parallel review", "multi-agent sweep", "parallel agents", or "team review".
+- A change is high-stakes and you want defense-in-depth (security audit + UX + perf + arch in 15 min instead of 60).
+- The user has 4+ cores and wants throughput.
+
+Don't invoke when:
+
+- The task is genuinely single-axis (just security → use `security-reviewer` directly).
+- The repo is tiny enough that worktree overhead exceeds review time.
+- The user is on a machine without tmux/git worktree support.
+
+---
+
+## CLI surface
+
+```bash
+# Auto-pick agents from task signals.
+npx kodelyth-ecc swarm --task "audit the new oauth flow for security regressions" --agents 4
+
+# Explicit agent list.
+npx kodelyth-ecc swarm --task "ship v2.0" \
+  --agents release-captain,security-reviewer,e2e-runner,code-reviewer \
+  --execute
+
+# Different harness (codex / opencode / windsurf).
+npx kodelyth-ecc swarm --task "refactor payment module" --agents 6 --harness codex --execute
+
+# Power-user: hand-written plan.
+npx kodelyth-ecc swarm --plan plan.json --execute
+```
+
+Three execution modes:
+
+| Mode | Effect |
+|---|---|
+| (default) dry-run | Prints the plan. Doesn't spawn anything. Safe to inspect. |
+| `--write-only` | Materializes coordination files (`task.md`, `handoff.md`, `status.md`) but doesn't spawn worktrees or tmux. |
+| `--execute` | Creates git worktrees, spawns tmux session, launches each agent in its own pane. |
+
+---
+
+## Smart agent picking
+
+When you pass `--agents N` (a number), the swarm picks specialists in this priority order:
+
+1. **Signal-driven** — task keywords match agent specialties (security → `security-reviewer`, perf → `performance-optimizer`, API → `api-guardian`, etc.). 14 signal classes.
+2. **Baseline anchors** — `code-reviewer` and `pair-programmer` are added if not already picked (every task benefits from generalist eyes).
+3. **Rotation fill** — fills remaining slots from a 4 / 6 / 8-agent default rotation tuned for breadth.
+
+You can always override with `--agents code-reviewer,security-reviewer,architect`.
+
+---
+
+## Harness adapters
+
+| `--harness` | Launcher | Notes |
+|---|---|---|
+| `claude` | `claude --print --dangerously-skip-permissions ...` | Default. Works with Claude Code. |
+| `codex` | `bash scripts/orchestrate-codex-worker.sh ...` | Codex CLI worker with full status tracking. |
+| `opencode` | `opencode run --task-file ...` | OpenCode harness. |
+| `windsurf` | `windsurf-cli run --task-file ...` | Windsurf agent. |
+| `echo` | trivial echo | For dry-run validation only. |
+
+Use `--launcher-cmd "<your-template>"` to plug a custom harness. Available placeholders:
+
+```
+{worker_name} {worker_slug} {session_name} {repo_root}
+{worktree_path} {branch_name} {task_file} {handoff_file} {status_file}
+```
+
+Add `_sh` suffix for shell-quoted variants (`{task_file_sh}`, etc.).
+
+---
+
+## Coordination protocol
+
+Every worker gets three files in the coordination dir:
+
+- **`task.md`** — agent-shaped task with required handoff sections (Summary, Files Changed, Validation, Remaining Risks). Generated automatically.
+- **`handoff.md`** — where the worker writes its output. Watched by the launcher.
+- **`status.md`** — running / completed / failed marker for monitoring scripts and the future dashboard.
+
+Workers run in **isolated git worktrees** branched from `--base-ref` (default: `HEAD`). Each gets a unique branch (`orchestrator-<session>-<slug>`). Cleanup is automatic on failure (rolls back worktrees, branches, and tmux session).
+
+---
+
+## Pairing with the rest of ECC
+
+| Pairs with | How |
+|---|---|
+| **`/devil-mode`** | Devil-mode is a hardcoded swarm of adversarial agents. Swarm generalizes it to arbitrary specialists. |
+| **Phase 2.4 cost router** | Each worker gets the same model-tier recommendation; security/incident workers force hard tier. |
+| **Phase 2.10 token-budget hook** | Each worker has its own session token-budget — one rogue worker can't burn the whole budget. |
+| **Phase 2.5 MCP client mode** | Workers can call registered external MCP servers (github, postgres, brave). |
+| **kodelyth-memory** | Capture the merged handoff bundle as a memory: `kodelyth-ecc remember "swarm 2026-05-10 oauth audit" --approach "..."`. |
+| **release-captain** | After a swarm, run `release-captain` to merge the best work and ship. |
+
+---
+
+## Examples
+
+### Pre-launch full sweep (8 agents, parallel)
+
+```bash
+npx kodelyth-ecc swarm \
+  --task "Pre-launch sweep for v2.0 — security, perf, UX, API contracts, docs, tests, release readiness" \
+  --agents 8 \
+  --replace \
+  --execute
+
+# Attach when ready:
+tmux attach -t swarm-2026-05-10-8a
+```
+
+### Production incident: 3-agent parallel triage
+
+```bash
+npx kodelyth-ecc swarm \
+  --task "Production is down. Auth service throwing 502s. Triage and propose fixes." \
+  --agents incident-commander,debug-detective,silent-failure-hunter \
+  --base-ref main \
+  --execute
+```
+
+### Refactor sprint with seeded files
+
+```bash
+npx kodelyth-ecc swarm \
+  --task "Refactor the payments module for testability without changing behavior" \
+  --agents refactor-cleaner,code-simplifier,type-design-analyzer,tdd-guide \
+  --seed src/payments \
+  --seed tests/payments \
+  --execute
+```
+
+---
+
+## Hard rules
+
+1. **Never run `--execute` without inspecting the dry-run first.** Worktree creation mutates the repo; bad plans waste disk.
+2. **Don't mix incompatible agents in one swarm.** Putting `release-captain` and `migration-guide` in the same swarm produces conflicting handoffs.
+3. **Cap N at 8 for a single repo.** Worktree contention + tmux pane crowding hurts past 8.
+4. **Never share tmux sessions across swarms.** Use `--session NAME` explicitly when running multiple swarms.
+5. **Always merge handoffs through human review** — don't auto-apply changes from N parallel agents without a human pass.
+
+---
+
+## Implementation
+
+- Plan builder: `scripts/swarm/build-plan.js` (pure function, fully tested).
+- Orchestrator: `scripts/lib/tmux-worktree-orchestrator.js` (the existing infrastructure).
+- Worker (codex): `scripts/orchestrate-codex-worker.sh`.
+- CLI: `npx kodelyth-ecc swarm`.
+- Slash command: `/swarm`.
+- Full reference: `docs/swarm.md`.
+
+---
+
+Built into [Kodelyth ECC](../../README.md). MIT licensed.

package/social/card-install.svg

@@ -37,7 +37,7 @@
   <text x="48" y="200" font-family="'Courier New', Courier, monospace" font-size="12" fill="#e6edf3"> npx kodelyth-ecc --target windsurf-project</text>
   <text x="48" y="216" font-family="'Courier New', Courier, monospace" font-size="11" fill="#484f58"> # or Antigravity:</text>
   <text x="48" y="232" font-family="'Courier New', Courier, monospace" font-size="12" fill="#e6edf3"> npx kodelyth-ecc --target antigravity</text>
-  <text x="48" y="256" font-family="'Courier New', Courier, monospace" font-size="11" fill="#10b981"> Installing v1.5.3 — 62 agents, 188 skills, 80 commands...</text>
+  <text x="48" y="256" font-family="'Courier New', Courier, monospace" font-size="11" fill="#10b981"> Installing v1.7.0 — 70 agents, 194 skills, 97 commands...</text>
   <text x="48" y="292" font-family="'Courier New', Courier, monospace" font-size="11" fill="#10b981"> Done. Type /kodelyth-quickstart to begin.</text>
 
   <!-- Footer -->

package/social/facebook-group/POST.md

@@ -0,0 +1,121 @@
+# Facebook Group Posts — Kodelyth ECC
+
+Three images are in this folder, available as both SVG (source) and PNG (upload-ready). **Use the PNGs** — Facebook compresses SVGs poorly and sometimes refuses them.
+
+- **fb-1-3am-debug.png** — square (1080×1080). The relatable "tired of debugging at 3am" angle.
+- **fb-2-cpu-upgrade.png** — square (1080×1080). Plays directly on the group's "Coffee Processing Unit" cover joke. **Best fit for Programming Jokes & MeMes specifically.**
+- **fb-3-before-after.png** — landscape (1200×1080). Classic before/after meme format. Highest comment-bait potential.
+
+---
+
+## POST OPTION A — For "Programming Jokes & MeMes" (matches the group's CPU/coffee joke)
+
+> **Use with:** `fb-2-cpu-upgrade.png`
+
+```
+"Programmers are a Coffee Processing Unit" — bro, that's the group cover and it lives rent-free in my head.
+
+So I went ahead and built the actual upgrade for that CPU.
+
+It's called Kodelyth ECC. Basically a power-up pack for whatever AI coding assistant you already use (Claude Code, Cursor, Windsurf, Codex, Antigravity, OpenCode — pick your poison).
+
+What it does:
+🤖 62 specialist AI agents — debug-detective, security-reviewer, code-reviewer, the whole crew
+🧠 Local memory — actually remembers your codebase, your style, the bugs you already fixed
+🎯 Intent routing — type "been stuck on this bug for 2 days" and it fires 3 debug agents in parallel automatically
+📦 One install command. Done.
+
+The honest part:
+- 100% free
+- 100% local (zero cloud, zero telemetry, your code never leaves your machine)
+- Open source
+- I'm not selling anything, no email signup, no "pro tier" — just markdown files installed into your IDE config
+
+Try it:
+$ npx kodelyth-ecc
+
+GitHub: github.com/sifxprime/kodelyth-ecc
+
+If you find it useful, a star would mean a lot 🙏
+
+P.S. — works whether you're a "vibe coder" or someone who debugs at 3am with 5 AI specialists screaming at you. Both valid.
+```
+
+---
+
+## POST OPTION B — Straight & punchy (general dev groups)
+
+> **Use with:** `fb-3-before-after.png` or `fb-1-3am-debug.png`
+
+```
+Spent the last few months building this. Finally good enough to share.
+
+Kodelyth ECC — open-source toolkit that turns your AI coding assistant from a generic chatbot into a real engineering team.
+
+Before:
+- Re-explaining "we use pnpm here" every session
+- Generic AI advice that doesn't know your codebase
+- One AI doing security + reviews + debugging badly
+
+After:
+- 62 specialist agents (each one only does one thing well)
+- Local memory that learns your style across sessions
+- Intent routing — describe your problem in plain words, right specialist auto-runs
+- Parallel commands like /debug-blitz, /security-audit, /pre-release
+
+Works with: Claude Code, Cursor, Windsurf, Codex, Antigravity, OpenCode
+
+Install (one command):
+npx kodelyth-ecc
+
+100% free. 100% local. Zero telemetry. Zero cloud calls. Your code never leaves your machine.
+
+GitHub → github.com/sifxprime/kodelyth-ecc
+npm → npmjs.com/package/kodelyth-ecc
+
+Genuinely curious what you'd want me to add. Drop suggestions 👇
+```
+
+---
+
+## POST OPTION C — Short & meme-coded (for high-engagement reposts)
+
+> **Use with:** `fb-1-3am-debug.png`
+
+```
+Built this because I was tired of debugging alone at 3 AM.
+
+62 AI specialist agents. 188 skills. Local memory. Zero cloud bullshit.
+
+$ npx kodelyth-ecc
+
+That's it. That's the post.
+
+github.com/sifxprime/kodelyth-ecc 🚀
+```
+
+---
+
+## Posting tips for max engagement
+
+1. **Post timing** — Tuesday/Thursday 8-10 PM (BD time) or 9-11 AM hits highest dev engagement.
+2. **First comment** — drop a follow-up comment yourself within 1 minute with a screenshot of it actually working in your IDE. This doubles reach.
+3. **Reply to every comment in the first 30 min** — Facebook's algo boosts posts with high reply velocity. Even just "thanks!" works.
+4. **Don't drop links in the post body** — Facebook deprioritizes external links. Put `github.com/sifxprime/kodelyth-ecc` in the FIRST COMMENT instead, and write "link in comments" in the post.
+5. **Cross-post** — same content fits these groups too:
+   - Programming Jokes & MeMes (1M)
+   - Memes we relate to
+   - BCUB / BNCP (BD groups — friendly to indie tools)
+   - r/programming-style FB groups
+
+---
+
+## Recommended sequence (3-day campaign)
+
+| Day | Group | SVG | Post Option |
+|---|---|---|---|
+| Day 1 | Programming Jokes & MeMes | fb-2-cpu-upgrade.png | A (matches group culture) |
+| Day 3 | Other dev groups | fb-3-before-after.png | B (substance) |
+| Day 5 | Repost in original group | fb-1-3am-debug.png | C (short hook) |
+
+Don't post the same thing twice in the same group within 7 days — Facebook flags it as spam.

package/social/facebook-group/fb-1-3am-debug.svg

@@ -0,0 +1,97 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1080 1080" width="1080" height="1080">
+  <defs>
+    <linearGradient id="bg1" x1="0" y1="0" x2="1" y2="1">
+      <stop offset="0" stop-color="#0d1117"/>
+      <stop offset="1" stop-color="#161b22"/>
+    </linearGradient>
+    <linearGradient id="purpleGlow" x1="0" y1="0" x2="0" y2="1">
+      <stop offset="0" stop-color="#a78bfa"/>
+      <stop offset="1" stop-color="#7c3aed"/>
+    </linearGradient>
+    <linearGradient id="greenGlow" x1="0" y1="0" x2="0" y2="1">
+      <stop offset="0" stop-color="#10b981"/>
+      <stop offset="1" stop-color="#059669"/>
+    </linearGradient>
+    <filter id="glow1" x="-50%" y="-50%" width="200%" height="200%">
+      <feGaussianBlur stdDeviation="6" result="coloredBlur"/>
+      <feMerge>
+        <feMergeNode in="coloredBlur"/>
+        <feMergeNode in="SourceGraphic"/>
+      </feMerge>
+    </filter>
+  </defs>
+
+  <rect width="1080" height="1080" fill="url(#bg1)"/>
+
+  <!-- Subtle code pattern background -->
+  <g opacity="0.06" font-family="'Courier New', Courier, monospace" font-size="14" fill="#10b981">
+    <text x="40" y="80">$ git commit -m "fix: probably broken"</text>
+    <text x="40" y="110">$ npm install --save-dev sanity</text>
+    <text x="40" y="140">TypeError: undefined is not a function</text>
+    <text x="40" y="170">at line 42, you know the one</text>
+    <text x="40" y="200">$ rm -rf node_modules &amp;&amp; npm install</text>
+    <text x="40" y="950">// TODO: refactor this on Sunday (it has been 3 years)</text>
+    <text x="40" y="980">// HACK: don't touch this, no one knows why it works</text>
+    <text x="40" y="1010">$ git push --force # I'm the only one on this branch</text>
+    <text x="40" y="1040">// here be dragons 🐉</text>
+  </g>
+
+  <!-- Time stamp top right -->
+  <g opacity="0.5">
+    <rect x="820" y="48" width="220" height="40" rx="20" fill="#21262d" stroke="#30363d" stroke-width="1"/>
+    <text x="930" y="74" font-family="'Courier New', Courier, monospace" font-size="14" fill="#8b949e" text-anchor="middle">🌙 03:47 AM</text>
+  </g>
+
+  <!-- Top label -->
+  <g>
+    <rect x="60" y="60" width="200" height="32" rx="16" fill="#7c3aed" fill-opacity="0.2" stroke="#a78bfa" stroke-opacity="0.5" stroke-width="1"/>
+    <text x="160" y="82" font-family="system-ui, sans-serif" font-size="13" font-weight="700" fill="#a78bfa" text-anchor="middle" letter-spacing="1">FOR THE 3AM DEBUGGERS</text>
+  </g>
+
+  <!-- Hero text -->
+  <text x="540" y="220" font-family="system-ui, -apple-system, sans-serif" font-size="64" font-weight="900" fill="#ffffff" text-anchor="middle" letter-spacing="-2">Tired of debugging</text>
+  <text x="540" y="290" font-family="system-ui, -apple-system, sans-serif" font-size="64" font-weight="900" fill="#ffffff" text-anchor="middle" letter-spacing="-2">alone at 3 AM?</text>
+
+  <!-- Subline -->
+  <text x="540" y="350" font-family="system-ui, sans-serif" font-size="22" fill="#8b949e" text-anchor="middle">Same. So I built a fix.</text>
+
+  <!-- The "team" card -->
+  <rect x="90" y="410" width="900" height="380" rx="20" fill="#161b22" stroke="#30363d" stroke-width="2"/>
+
+  <!-- Decorative bracket -->
+  <text x="120" y="470" font-family="'Courier New', Courier, monospace" font-size="40" fill="url(#purpleGlow)" font-weight="700">{</text>
+  <text x="940" y="780" font-family="'Courier New', Courier, monospace" font-size="40" fill="url(#purpleGlow)" font-weight="700" text-anchor="end">}</text>
+
+  <text x="540" y="475" font-family="system-ui, sans-serif" font-size="20" font-weight="600" fill="#10b981" text-anchor="middle" letter-spacing="3">YOUR NEW LATE-NIGHT TEAM</text>
+
+  <!-- Stats grid -->
+  <g font-family="system-ui, sans-serif">
+    <text x="245" y="570" font-size="64" font-weight="900" fill="#ffffff" text-anchor="middle">62</text>
+    <text x="245" y="610" font-size="13" fill="#8b949e" text-anchor="middle" letter-spacing="2">SPECIALIST AGENTS</text>
+
+    <text x="540" y="570" font-size="64" font-weight="900" fill="#ffffff" text-anchor="middle">188</text>
+    <text x="540" y="610" font-size="13" fill="#8b949e" text-anchor="middle" letter-spacing="2">SKILLS</text>
+
+    <text x="835" y="570" font-size="64" font-weight="900" fill="#ffffff" text-anchor="middle">90</text>
+    <text x="835" y="610" font-size="13" fill="#8b949e" text-anchor="middle" letter-spacing="2">COMMANDS</text>
+  </g>
+
+  <line x1="160" y1="650" x2="920" y2="650" stroke="#30363d" stroke-width="1"/>
+
+  <!-- Tagline rows -->
+  <g font-family="system-ui, sans-serif" font-size="22" fill="#e6edf3">
+    <text x="540" y="695" text-anchor="middle">debug-detective fights bugs while you drink coffee.</text>
+    <text x="540" y="730" text-anchor="middle">security-reviewer catches what you missed.</text>
+    <text x="540" y="765" text-anchor="middle">62 of them. Working in parallel.</text>
+  </g>
+
+  <!-- Install bar -->
+  <rect x="180" y="850" width="720" height="80" rx="12" fill="#0d1117" stroke="#10b981" stroke-width="2" filter="url(#glow1)"/>
+  <text x="220" y="900" font-family="'Courier New', Courier, monospace" font-size="28" fill="#10b981" font-weight="700">$</text>
+  <text x="252" y="900" font-family="'Courier New', Courier, monospace" font-size="28" fill="#ffffff" font-weight="700">npx kodelyth-ecc</text>
+  <text x="880" y="900" font-family="system-ui, sans-serif" font-size="13" fill="#8b949e" text-anchor="end" letter-spacing="2">FREE · LOCAL · NO CLOUD</text>
+
+  <!-- Footer -->
+  <text x="540" y="985" font-family="system-ui, sans-serif" font-size="16" fill="#6e7681" text-anchor="middle">Works with Claude Code · Cursor · Windsurf · Codex · Antigravity</text>
+  <text x="540" y="1020" font-family="system-ui, sans-serif" font-size="14" fill="#484f58" text-anchor="middle" letter-spacing="1">github.com/sifxprime/kodelyth-ecc</text>
+</svg>