kodelyth-ecc 2.19.0 → 2.20.0

package/.aider-ecc/skills/security-review/cloud-infrastructure-security.md

@@ -1,361 +0,0 @@
-| name | description |
-|------|-------------|
-| cloud-infrastructure-security | Use this skill when deploying to cloud platforms, configuring infrastructure, managing IAM policies, setting up logging/monitoring, or implementing CI/CD pipelines. Provides cloud security checklist aligned with best practices. |
-
-# Cloud & Infrastructure Security Skill
-
-This skill ensures cloud infrastructure, CI/CD pipelines, and deployment configurations follow security best practices and comply with industry standards.
-
-## When to Activate
-
-- Deploying applications to cloud platforms (AWS, Vercel, Railway, Cloudflare)
-- Configuring IAM roles and permissions
-- Setting up CI/CD pipelines
-- Implementing infrastructure as code (Terraform, CloudFormation)
-- Configuring logging and monitoring
-- Managing secrets in cloud environments
-- Setting up CDN and edge security
-- Implementing disaster recovery and backup strategies
-
-## Cloud Security Checklist
-
-### 1. IAM & Access Control
-
-#### Principle of Least Privilege
-
-```yaml
-# PASS: CORRECT: Minimal permissions
-iam_role:
-  permissions:
-    - s3:GetObject  # Only read access
-    - s3:ListBucket
-  resources:
-    - arn:aws:s3:::my-bucket/*  # Specific bucket only
-
-# FAIL: WRONG: Overly broad permissions
-iam_role:
-  permissions:
-    - s3:*  # All S3 actions
-  resources:
-    - "*"  # All resources
-```
-
-#### Multi-Factor Authentication (MFA)
-
-```bash
-# ALWAYS enable MFA for root/admin accounts
-aws iam enable-mfa-device \
-  --user-name admin \
-  --serial-number arn:aws:iam::123456789:mfa/admin \
-  --authentication-code1 123456 \
-  --authentication-code2 789012
-```
-
-#### Verification Steps
-
-- [ ] No root account usage in production
-- [ ] MFA enabled for all privileged accounts
-- [ ] Service accounts use roles, not long-lived credentials
-- [ ] IAM policies follow least privilege
-- [ ] Regular access reviews conducted
-- [ ] Unused credentials rotated or removed
-
-### 2. Secrets Management
-
-#### Cloud Secrets Managers
-
-```typescript
-// PASS: CORRECT: Use cloud secrets manager
-import { SecretsManager } from '@aws-sdk/client-secrets-manager';
-
-const client = new SecretsManager({ region: 'us-east-1' });
-const secret = await client.getSecretValue({ SecretId: 'prod/api-key' });
-const apiKey = JSON.parse(secret.SecretString).key;
-
-// FAIL: WRONG: Hardcoded or in environment variables only
-const apiKey = process.env.API_KEY; // Not rotated, not audited
-```
-
-#### Secrets Rotation
-
-```bash
-# Set up automatic rotation for database credentials
-aws secretsmanager rotate-secret \
-  --secret-id prod/db-password \
-  --rotation-lambda-arn arn:aws:lambda:region:account:function:rotate \
-  --rotation-rules AutomaticallyAfterDays=30
-```
-
-#### Verification Steps
-
-- [ ] All secrets stored in cloud secrets manager (AWS Secrets Manager, Vercel Secrets)
-- [ ] Automatic rotation enabled for database credentials
-- [ ] API keys rotated at least quarterly
-- [ ] No secrets in code, logs, or error messages
-- [ ] Audit logging enabled for secret access
-
-### 3. Network Security
-
-#### VPC and Firewall Configuration
-
-```terraform
-# PASS: CORRECT: Restricted security group
-resource "aws_security_group" "app" {
-  name = "app-sg"
-
-  ingress {
-    from_port   = 443
-    to_port     = 443
-    protocol    = "tcp"
-    cidr_blocks = ["10.0.0.0/16"]  # Internal VPC only
-  }
-
-  egress {
-    from_port   = 443
-    to_port     = 443
-    protocol    = "tcp"
-    cidr_blocks = ["0.0.0.0/0"]  # Only HTTPS outbound
-  }
-}
-
-# FAIL: WRONG: Open to the internet
-resource "aws_security_group" "bad" {
-  ingress {
-    from_port   = 0
-    to_port     = 65535
-    protocol    = "tcp"
-    cidr_blocks = ["0.0.0.0/0"]  # All ports, all IPs!
-  }
-}
-```
-
-#### Verification Steps
-
-- [ ] Database not publicly accessible
-- [ ] SSH/RDP ports restricted to VPN/bastion only
-- [ ] Security groups follow least privilege
-- [ ] Network ACLs configured
-- [ ] VPC flow logs enabled
-
-### 4. Logging & Monitoring
-
-#### CloudWatch/Logging Configuration
-
-```typescript
-// PASS: CORRECT: Comprehensive logging
-import { CloudWatchLogsClient, CreateLogStreamCommand } from '@aws-sdk/client-cloudwatch-logs';
-
-const logSecurityEvent = async (event: SecurityEvent) => {
-  await cloudwatch.putLogEvents({
-    logGroupName: '/aws/security/events',
-    logStreamName: 'authentication',
-    logEvents: [{
-      timestamp: Date.now(),
-      message: JSON.stringify({
-        type: event.type,
-        userId: event.userId,
-        ip: event.ip,
-        result: event.result,
-        // Never log sensitive data
-      })
-    }]
-  });
-};
-```
-
-#### Verification Steps
-
-- [ ] CloudWatch/logging enabled for all services
-- [ ] Failed authentication attempts logged
-- [ ] Admin actions audited
-- [ ] Log retention configured (90+ days for compliance)
-- [ ] Alerts configured for suspicious activity
-- [ ] Logs centralized and tamper-proof
-
-### 5. CI/CD Pipeline Security
-
-#### Secure Pipeline Configuration
-
-```yaml
-# PASS: CORRECT: Secure GitHub Actions workflow
-name: Deploy
-
-on:
-  push:
-    branches: [main]
-
-jobs:
-  deploy:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read  # Minimal permissions
-
-    steps:
-      - uses: actions/checkout@v4
-
-      # Scan for secrets
-      - name: Secret scanning
-        uses: trufflesecurity/trufflehog@main
-
-      # Dependency audit
-      - name: Audit dependencies
-        run: npm audit --audit-level=high
-
-      # Use OIDC, not long-lived tokens
-      - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
-        with:
-          role-to-assume: arn:aws:iam::123456789:role/GitHubActionsRole
-          aws-region: us-east-1
-```
-
-#### Supply Chain Security
-
-```json
-// package.json - Use lock files and integrity checks
-{
-  "scripts": {
-    "install": "npm ci",  // Use ci for reproducible builds
-    "audit": "npm audit --audit-level=moderate",
-    "check": "npm outdated"
-  }
-}
-```
-
-#### Verification Steps
-
-- [ ] OIDC used instead of long-lived credentials
-- [ ] Secrets scanning in pipeline
-- [ ] Dependency vulnerability scanning
-- [ ] Container image scanning (if applicable)
-- [ ] Branch protection rules enforced
-- [ ] Code review required before merge
-- [ ] Signed commits enforced
-
-### 6. Cloudflare & CDN Security
-
-#### Cloudflare Security Configuration
-
-```typescript
-// PASS: CORRECT: Cloudflare Workers with security headers
-export default {
-  async fetch(request: Request): Promise<Response> {
-    const response = await fetch(request);
-
-    // Add security headers
-    const headers = new Headers(response.headers);
-    headers.set('X-Frame-Options', 'DENY');
-    headers.set('X-Content-Type-Options', 'nosniff');
-    headers.set('Referrer-Policy', 'strict-origin-when-cross-origin');
-    headers.set('Permissions-Policy', 'geolocation=(), microphone=()');
-
-    return new Response(response.body, {
-      status: response.status,
-      headers
-    });
-  }
-};
-```
-
-#### WAF Rules
-
-```bash
-# Enable Cloudflare WAF managed rules
-# - OWASP Core Ruleset
-# - Cloudflare Managed Ruleset
-# - Rate limiting rules
-# - Bot protection
-```
-
-#### Verification Steps
-
-- [ ] WAF enabled with OWASP rules
-- [ ] Rate limiting configured
-- [ ] Bot protection active
-- [ ] DDoS protection enabled
-- [ ] Security headers configured
-- [ ] SSL/TLS strict mode enabled
-
-### 7. Backup & Disaster Recovery
-
-#### Automated Backups
-
-```terraform
-# PASS: CORRECT: Automated RDS backups
-resource "aws_db_instance" "main" {
-  allocated_storage     = 20
-  engine               = "postgres"
-
-  backup_retention_period = 30  # 30 days retention
-  backup_window          = "03:00-04:00"
-  maintenance_window     = "mon:04:00-mon:05:00"
-
-  enabled_cloudwatch_logs_exports = ["postgresql"]
-
-  deletion_protection = true  # Prevent accidental deletion
-}
-```
-
-#### Verification Steps
-
-- [ ] Automated daily backups configured
-- [ ] Backup retention meets compliance requirements
-- [ ] Point-in-time recovery enabled
-- [ ] Backup testing performed quarterly
-- [ ] Disaster recovery plan documented
-- [ ] RPO and RTO defined and tested
-
-## Pre-Deployment Cloud Security Checklist
-
-Before ANY production cloud deployment:
-
-- [ ] **IAM**: Root account not used, MFA enabled, least privilege policies
-- [ ] **Secrets**: All secrets in cloud secrets manager with rotation
-- [ ] **Network**: Security groups restricted, no public databases
-- [ ] **Logging**: CloudWatch/logging enabled with retention
-- [ ] **Monitoring**: Alerts configured for anomalies
-- [ ] **CI/CD**: OIDC auth, secrets scanning, dependency audits
-- [ ] **CDN/WAF**: Cloudflare WAF enabled with OWASP rules
-- [ ] **Encryption**: Data encrypted at rest and in transit
-- [ ] **Backups**: Automated backups with tested recovery
-- [ ] **Compliance**: GDPR/HIPAA requirements met (if applicable)
-- [ ] **Documentation**: Infrastructure documented, runbooks created
-- [ ] **Incident Response**: Security incident plan in place
-
-## Common Cloud Security Misconfigurations
-
-### S3 Bucket Exposure
-
-```bash
-# FAIL: WRONG: Public bucket
-aws s3api put-bucket-acl --bucket my-bucket --acl public-read
-
-# PASS: CORRECT: Private bucket with specific access
-aws s3api put-bucket-acl --bucket my-bucket --acl private
-aws s3api put-bucket-policy --bucket my-bucket --policy file://policy.json
-```
-
-### RDS Public Access
-
-```terraform
-# FAIL: WRONG
-resource "aws_db_instance" "bad" {
-  publicly_accessible = true  # NEVER do this!
-}
-
-# PASS: CORRECT
-resource "aws_db_instance" "good" {
-  publicly_accessible = false
-  vpc_security_group_ids = [aws_security_group.db.id]
-}
-```
-
-## Resources
-
-- [AWS Security Best Practices](https://aws.amazon.com/security/best-practices/)
-- [CIS AWS Foundations Benchmark](https://www.cisecurity.org/benchmark/amazon_web_services)
-- [Cloudflare Security Documentation](https://developers.cloudflare.com/security/)
-- [OWASP Cloud Security](https://owasp.org/www-project-cloud-security/)
-- [Terraform Security Best Practices](https://www.terraform.io/docs/cloud/guides/recommended-practices/)
-
-**Remember**: Cloud misconfigurations are the leading cause of data breaches. A single exposed S3 bucket or overly permissive IAM policy can compromise your entire infrastructure. Always follow the principle of least privilege and defense in depth.

package/.aider-ecc/skills/security-scan/SKILL.md

@@ -1,165 +0,0 @@
----
-name: security-scan
-description: Scan your Claude Code configuration (.claude/ directory) for security vulnerabilities, misconfigurations, and injection risks using AgentShield. Checks CLAUDE.md, settings.json, MCP servers, hooks, and agent definitions.
-origin: ECC
----
-
-# Security Scan Skill
-
-Audit your Claude Code configuration for security issues using [AgentShield](https://github.com/kodelyth/agentshield).
-
-## When to Activate
-
-- Setting up a new Claude Code project
-- After modifying `.claude/settings.json`, `CLAUDE.md`, or MCP configs
-- Before committing configuration changes
-- When onboarding to a new repository with existing Claude Code configs
-- Periodic security hygiene checks
-
-## What It Scans
-
-| File | Checks |
-|------|--------|
-| `CLAUDE.md` | Hardcoded secrets, auto-run instructions, prompt injection patterns |
-| `settings.json` | Overly permissive allow lists, missing deny lists, dangerous bypass flags |
-| `mcp.json` | Risky MCP servers, hardcoded env secrets, npx supply chain risks |
-| `hooks/` | Command injection via interpolation, data exfiltration, silent error suppression |
-| `agents/*.md` | Unrestricted tool access, prompt injection surface, missing model specs |
-
-## Prerequisites
-
-AgentShield must be installed. Check and install if needed:
-
-```bash
-# Check if installed
-npx ecc-agentshield --version
-
-# Install globally (recommended)
-npm install -g ecc-agentshield
-
-# Or run directly via npx (no install needed)
-npx ecc-agentshield scan .
-```
-
-## Usage
-
-### Basic Scan
-
-Run against the current project's `.claude/` directory:
-
-```bash
-# Scan current project
-npx ecc-agentshield scan
-
-# Scan a specific path
-npx ecc-agentshield scan --path /path/to/.claude
-
-# Scan with minimum severity filter
-npx ecc-agentshield scan --min-severity medium
-```
-
-### Output Formats
-
-```bash
-# Terminal output (default) — colored report with grade
-npx ecc-agentshield scan
-
-# JSON — for CI/CD integration
-npx ecc-agentshield scan --format json
-
-# Markdown — for documentation
-npx ecc-agentshield scan --format markdown
-
-# HTML — self-contained dark-theme report
-npx ecc-agentshield scan --format html > security-report.html
-```
-
-### Auto-Fix
-
-Apply safe fixes automatically (only fixes marked as auto-fixable):
-
-```bash
-npx ecc-agentshield scan --fix
-```
-
-This will:
-- Replace hardcoded secrets with environment variable references
-- Tighten wildcard permissions to scoped alternatives
-- Never modify manual-only suggestions
-
-### Opus 4.6 Deep Analysis
-
-Run the adversarial three-agent pipeline for deeper analysis:
-
-```bash
-# Requires ANTHROPIC_API_KEY
-export ANTHROPIC_API_KEY=your-key
-npx ecc-agentshield scan --opus --stream
-```
-
-This runs:
-1. **Attacker (Red Team)** — finds attack vectors
-2. **Defender (Blue Team)** — recommends hardening
-3. **Auditor (Final Verdict)** — synthesizes both perspectives
-
-### Initialize Secure Config
-
-Scaffold a new secure `.claude/` configuration from scratch:
-
-```bash
-npx ecc-agentshield init
-```
-
-Creates:
-- `settings.json` with scoped permissions and deny list
-- `CLAUDE.md` with security best practices
-- `mcp.json` placeholder
-
-### GitHub Action
-
-Add to your CI pipeline:
-
-```yaml
-- uses: kodelyth/agentshield@v1
-  with:
-    path: '.'
-    min-severity: 'medium'
-    fail-on-findings: true
-```
-
-## Severity Levels
-
-| Grade | Score | Meaning |
-|-------|-------|---------|
-| A | 90-100 | Secure configuration |
-| B | 75-89 | Minor issues |
-| C | 60-74 | Needs attention |
-| D | 40-59 | Significant risks |
-| F | 0-39 | Critical vulnerabilities |
-
-## Interpreting Results
-
-### Critical Findings (fix immediately)
-- Hardcoded API keys or tokens in config files
-- `Bash(*)` in the allow list (unrestricted shell access)
-- Command injection in hooks via `${file}` interpolation
-- Shell-running MCP servers
-
-### High Findings (fix before production)
-- Auto-run instructions in CLAUDE.md (prompt injection vector)
-- Missing deny lists in permissions
-- Agents with unnecessary Bash access
-
-### Medium Findings (recommended)
-- Silent error suppression in hooks (`2>/dev/null`, `|| true`)
-- Missing PreToolUse security hooks
-- `npx -y` auto-install in MCP server configs
-
-### Info Findings (awareness)
-- Missing descriptions on MCP servers
-- Prohibitive instructions correctly flagged as good practice
-
-## Links
-
-- **GitHub**: [github.com/kodelyth/agentshield](https://github.com/kodelyth/agentshield)
-- **npm**: [npmjs.com/package/ecc-agentshield](https://www.npmjs.com/package/ecc-agentshield)

package/.aider-ecc/skills/self-evolving-memory/SKILL.md

@@ -1,175 +0,0 @@
----
-name: self-evolving-memory
-description: Phase 3.4 — turn repeated memory hits and routing misses into proposed skill / routing-rule upgrades. Never auto-applies; produces PR-ready drafts the user reviews and commits.
-trigger:
-  - self-evolving memory
-  - skill proposals
-  - routing proposals
-  - memory feedback loop
-  - kodelyth evolve
-  - propose skill
-  - propose routing
----
-
-# Skill: self-evolving-memory
-
-## What this skill does
-
-Closes the learning loop on the BM25 memory system. Two signals drive proposals:
-
-| Signal | Source | Outcome when threshold hit |
-|---|---|---|
-| **Memory reuse** | Auto-recall hook bumps a counter every time a memory is surfaced to the user | Propose **promoting the memory to a draft `SKILL.md`** |
-| **Routing miss** | Auto-recall hook logs substantive prompts where memory recall returned nothing | Propose **adding a routing entry** to `rules/common/agent-intent-routing.md` |
-
-Both proposals are written to a local proposal log. **Nothing is ever auto-applied.** The user reviews, accepts (which writes a draft file), edits, and commits.
-
----
-
-## When to use this skill
-
-Use **explicitly** by name when:
-
-- You've been running ECC for weeks and want to surface what the toolkit has learned about your work.
-- A pattern keeps coming back in your sessions and you want to formalize it as a skill.
-- You suspect there's a gap in the routing rule (you keep getting the wrong agent for a class of prompts).
-- You want to inspect how the self-learning loop is doing without committing to anything.
-
-```bash
-use self-evolving-memory
-
-# See what signals have been collected
-npx kodelyth-ecc evolve stats
-
-# Generate proposals from current signals
-npx kodelyth-ecc evolve analyze
-
-# Review what's pending
-npx kodelyth-ecc evolve list
-
-# Inspect a specific proposal end-to-end (incl. proposed file content)
-npx kodelyth-ecc evolve show <proposalId>
-
-# Accept → writes a draft file. NEVER auto-commits.
-npx kodelyth-ecc evolve accept <proposalId>
-
-# Reject — appends a state event with optional note
-npx kodelyth-ecc evolve reject <proposalId> --note "covered by existing agent"
-```
-
-Implicit triggers (the AI should route here automatically):
-
-- "what has ECC learned from my sessions?"
-- "promote this memory to a skill"
-- "add this to the routing rule"
-- "what's missing from the routing intent rule?"
-
----
-
-## CLI surface
-
-### `kodelyth-ecc evolve stats`
-
-Snapshot of currently recorded signals:
-
-- **Reuse:** memories tracked, total surfaces, top reused entries.
-- **Routing misses:** total misses, unique prompts, top clusters.
-
-### `kodelyth-ecc evolve analyze`
-
-Reads signals + your `~/.kodelythecc/memory/` store, applies thresholds, and writes proposals to `~/.kodelythecc/evolve/proposals.jsonl`. Idempotent — re-running with the same evidence produces the same proposal IDs and does NOT duplicate.
-
-| Flag | Default | Effect |
-|---|---|---|
-| `--reuse-min N` | 3 | Memory must have surfaced ≥ N times to be eligible |
-| `--reuse-min-sessions N` | 2 | …across ≥ N distinct sessions |
-| `--miss-min N` | 3 | A token cluster must have ≥ N total miss events |
-| `--miss-min-distinct N` | 2 | …with ≥ N distinct prompts |
-| `--json` | off | Stream the full report instead of the pretty summary |
-
-### `kodelyth-ecc evolve list [--status pending|accepted|rejected|applied]`
-
-Show proposals filtered by state. Proposals are append-only — every state change is a new event, full audit trail preserved.
-
-### `kodelyth-ecc evolve show <id>`
-
-Print the full proposed file content + evidence. **Always preview before accepting.**
-
-### `kodelyth-ecc evolve accept <id> [--root DIR] [--overwrite]`
-
-Writes the proposed `diff` to its `target_path` under `--root` (defaults to package root). **Refuses to overwrite an existing file** unless `--overwrite` is passed. After writing, marks the proposal `accepted` with the absolute `applied_path`.
-
-The user must still review the draft, edit, and commit. The CLI does not stage or commit anything.
-
-### `kodelyth-ecc evolve reject <id> [--note "..."]`
-
-Marks a proposal `rejected`. Optional `--note` is preserved for the audit trail.
-
----
-
-## How signals are recorded
-
-The auto-recall hook (`hooks/memory/auto-recall.js`) does two things in addition to its normal job:
-
-1. **On a memory surface** — calls `evolve.recordSurface({ memoryId, sessionId, projectRoot })`. This bumps the per-memory counter in `~/.kodelythecc/evolve/reuse.json`. Idempotent per `(memoryId, sessionId)` — you can't game the counter by surfacing the same memory ten times in one session.
-2. **On a substantive prompt with zero memory matches** — calls `evolve.recordRoutingMiss({ prompt, sessionId, projectRoot })`. Appends one line to `~/.kodelythecc/evolve/routing-misses.jsonl`. The prompt is capped to 1000 chars and stored alongside its top tokens for clustering.
-
-Both calls are **fire-and-forget**: any error is swallowed silently. The hook NEVER blocks recall on stats failure.
-
----
-
-## How proposals are generated
-
-`scripts/evolve/analyze.js` is pure, deterministic, no I/O.
-
-**Skill upgrade** — for every memory whose reuse meets thresholds, build a draft `SKILL.md` from the memory's problem / approach / tags / language. Target path: `skills/<slug>/SKILL.md`.
-
-**Routing addition** — cluster routing-miss entries by their top-K tokens (≥2-token overlap). For every cluster meeting thresholds, build a draft markdown block to add to `rules/common/agent-intent-routing.md`. Target path: the rule itself (the diff is meant to be merged in by hand under the right priority tier — the agent name in the draft is intentionally `TODO-agent`).
-
-Proposal IDs are deterministic over their evidence — the same evidence always produces the same ID, so re-running `analyze` does not duplicate.
-
----
-
-## Hard rules
-
-1. **NEVER auto-apply.** `accept` writes a draft file. The user reviews, edits, and commits. No git operations.
-2. **NEVER overwrite by default.** `accept` refuses to clobber an existing file unless `--overwrite` is explicit.
-3. **NEVER block the recall hook.** All evolve recording is fire-and-forget with try/catch around every call.
-4. **NEVER auto-route to a `TODO-agent` proposal.** The routing-addition diff intentionally names `TODO-agent` so accepting it cannot accidentally flip routing behavior. The user must rename + place it under the right priority tier.
-5. **Idempotent IDs.** Re-running `analyze` does not duplicate proposals. Stable evidence → stable ID.
-6. **Append-only proposal log.** Every state change is a new event. Full audit trail preserved.
-
----
-
-## Pairing with other ECC features
-
-| Pair with | What you get |
-|---|---|
-| **BM25 memory store** | Source of reuse signals. Without captured memories, this skill has nothing to learn from. |
-| **`/memory remember`** | Manual capture. Explicitly captured memories that get reused → skill proposals. |
-| **`rules/common/agent-intent-routing.md`** | The exact target for routing-addition proposals. |
-| **Phase 2.7 swarm** | Repeated swarm tasks that surface the same memories → those memories become skills the swarm can pick automatically. |
-| **Phase 2.8 replay** | Replay bundles can re-trigger reuse signals when the same memory is surfaced again. |
-| **Phase 2.10 token-budget hook** | Promoting memories → skills means cheaper recalls (skills are loaded once, memories are recalled per-prompt). |
-
----
-
-## Storage layout
-
-```
-~/.kodelythecc/evolve/
-├── reuse.json               # per-memory reuse counters
-├── routing-misses.jsonl     # append-only miss log
-└── proposals.jsonl          # append-only proposal events
-```
-
-Override with `KODELYTH_EVOLVE_DIR`. All zero telemetry. All local.
-
----
-
-## See also
-
-- `commands/evolve.md` — `/evolve` slash command
-- `docs/evolve.md` — full reference + worked example
-- `scripts/evolve/{stats,analyze,proposals}.js` — pure-function implementation
-- `hooks/memory/auto-recall.js` — signal capture (Phase 3.4 augmentation)