kodelyth-ecc 2.5.4 → 2.7.0

package/CHANGELOG.md

@@ -2,6 +2,121 @@
 
 All notable changes to Kodelyth ECC are documented here.
 
+## v2.7.0 — The Arena: GOD vs EVIL loop (phase 3) (August 2026)
+
+The two crews now fight. GOD builds, EVIL attacks, verified findings return to GOD as mandatory work, and the loop repeats **until the attacker gives up**.
+
+### Added — `scripts/arena/arena.js` + `/arena`
+
+A **state machine**, not an agent dispatcher — it decides what happens next and grades what comes back, so the entire loop is testable without spending a token. Agent invocation is driven by the AI through `/arena`.
+
+```
+round N:  god_build → evil_hunt → evil_verify → round_close
+                                                     │
+                   converged / out of budget / out of rounds? ──→ report
+```
+
+- **`nextAction(run)`** — the loop's brain. Returns the next step, its briefs, and a token estimate the budget can veto.
+- **Findings carry forward.** Round 1 builds; every later round *fixes what EVIL proved*, with the findings injected into GOD's brief as mandatory items. **Refuted findings are never carried** — a false positive can no longer consume an entire fix round.
+- **Later EVIL rounds know what's already known** and are told to hunt what the last pass missed.
+- **Phase guards** — submitting out of order throws instead of silently corrupting a run.
+- **`affordOrAbort()`** — aborts cleanly *before* an unaffordable step. A readable partial result beats a surprise bill.
+- **Resumable** — a crash mid-loop reloads from disk with phase and spend intact.
+- **`buildReport()`** — markdown report with the trend histogram, per-round detail, still-open findings ranked by real risk, and a refuted section so the same false positive is never re-litigated.
+
+### Added — CLI
+
+```bash
+kodelythecc arena start --task "harden the webhook" --scope src/ --max-rounds 3
+kodelythecc arena next <run-id>          # what the loop wants next (JSON)
+kodelythecc arena report <run-id> --md   # full markdown report
+```
+
+### Verified end-to-end
+
+Simulated a realistic run at true cost (~191k tokens/round):
+
+```
+round 1    3 new  ████████████████████████
+round 2    1 new  ████████
+round 3    0 new  ·
+round 4    0 new  ·
+**Converged** — two consecutive rounds surfaced nothing new.
+```
+
+- Convergence fires on 2 quiet rounds; a fresh finding **restarts** the streak
+- Rounds where GOD left an artifact unproven or a critical unaddressed are flagged **incomplete** in the report
+- A refuting verdict zeroed the finding and kept `openRisk` honest
+- **The budget guard fired for real** — an earlier run at the 400k default aborted at round 3 with a clean partial report, exactly as designed
+- **463 tests, 0 failures** across 33 files (up from 444) — 19 new arena-loop tests
+
+### Honest cost note
+
+~200k tokens per round (GOD ≈ 90k + EVIL ≈ 96k + verification). Defaults are deliberately conservative: **3 rounds, 400k tokens, 45 min**. Use `/god-mode` or `/evil-mode` alone when you don't need the full loop — the arena is for work that must not break.
+
+### Assets
+
+`social/card-arena.svg`; SVG badges → v2.7.0; 8K PNGs re-rendered.
+
+## v2.6.0 — GOD mode + EVIL mode v2 (Arena phases 0-2) (August 2026)
+
+The foundation of the **adversarial arena**: two opposed crews that will eventually fight each other until the attacker gives up. Phases 0-2 of 6 — the contract, the adversary, and the builder. The arena loop itself lands in a later release, only once it is verified end-to-end.
+
+### Added — Phase 0: the contract (`scripts/arena/`)
+
+- **`contract.js`** — the shared schema GOD and EVIL exchange. `Finding` (severity × confidence × exploitability → risk), `Artifact`, `RoundVerdict`, stable FNV-1a fingerprints so the same issue dedupes across rounds even when wording drifts, and `hasConverged()`.
+  - **Refuted findings carry zero effective risk** — verification can genuinely zero out a false positive.
+  - Certainty outweighs raw severity: a *confirmed/high/trivial* outranks a *speculative/critical/theoretical*, so noise sinks.
+- **`state.js`** — resumable run state in `~/.kodelythecc/arena/`. Rounds are appended, so a crash or budget abort never loses rounds already paid for.
+  - **Hard stops, not advisory:** max rounds, token budget, wall-clock. `canAffordRound()` refuses *before* spending.
+
+### Added — Phase 1: EVIL mode v2 (`scripts/arena/evil.js`, `/evil-mode`)
+
+The 8 adversarial agents already hunted well; what they lacked was judgment.
+
+- **Scoring** — every finding gets a risk score instead of landing in a flat pile.
+- **Adversarial verification** — each top finding is challenged by a fresh agent told to **REFUTE it**, defaulting to refuted when uncertain. False positives die before they can waste GOD mode's next round.
+- **Loop-until-dry** — later rounds tell each agent what is already known and to hunt what the last pass *missed*.
+- `selectForVerification()` is budget-bounded (default 12) and skips settled or near-zero-risk findings.
+- `/devil-mode` still works — `/evil-mode` is the upgraded entry point.
+
+### Added — Phase 2: GOD mode (`scripts/arena/god.js`, `/god-mode`)
+
+Not "fire nine agents at once" — that is `/project-launch`. A six-stage pipeline with three things the parallel commands lack:
+
+| Stage | Agents |
+|---|---|
+| **Recall** | — (memory lookup; never invents a memory) |
+| **Design** ∥ | `architect` + `code-architect` |
+| **Build** → | `pair-programmer` + `tdd-guide` |
+| **Self-critique** ∥ | `type-design-analyzer` + `api-guardian` + `ux-reviewer` |
+| **Harden** ∥ | `performance-optimizer` + `refactor-cleaner` |
+| **Prove** | — (runs the verification command) |
+
+- **It recalls before it builds.**
+- **Proof gate:** `verifyArtifacts()` marks work verified only when a command actually ran and exited clean — a truthy claim is explicitly not proof.
+- **`roundComplete()` blocks** on any unverified artifact or unaddressed critical/high finding. A refuted finding never blocks.
+
+### Added — CLI
+
+```bash
+kodelythecc god  --task "add rate limiting"    # plan + cost estimate
+kodelythecc evil src/auth --all                # crew + cost estimate
+kodelythecc arena list                         # past runs
+kodelythecc arena report <run-id>              # rounds, trend, open risk
+```
+
+### Verified
+
+- **444 tests, 0 failures** across 32 files (up from 388) — 56 new arena tests
+- Simulated a 4-round run: new-findings trend **[2, 1, 0, 0] → converged**, stop reason *"attacker gave up"*
+- Both CLI surfaces render real plans with real cost estimates
+- Traversal-safe run ids, budget refusal, and convergence-streak reset all covered by tests
+
+### Assets
+
+- `social/card-god.svg` + `social/card-evil.svg`; SVG badges → v2.6.0; 8K PNGs re-rendered.
+
 ## v2.5.4 — Memory: direct capture CLI + aggressive auto-capture (July 2026)
 
 Two memory improvements after an end-to-end verification pass confirmed the pipeline works but only captured when the user said "thanks".

package/VERSION

@@ -1 +1 @@
-2.5.4
+2.7.0

package/bin/kodelyth-ecc.js

@@ -424,6 +424,143 @@ if (args[0] === 'memory') {
   } catch (e) { process.stderr.write(`[memory] ${e.message}\n`); process.exit(1); }
 }
 
+// ── Subcommand: god / evil / arena (the adversarial arena) ──────────────────
+// Usage:
+//   kodelythecc god  --task "<task>" [--json]        plan a GOD-mode build
+//   kodelythecc evil [scope] [--all|--license|...]   plan an EVIL-mode sweep
+//   kodelythecc arena list                           list past arena runs
+//   kodelythecc arena report <run-id>                show a run's report
+if (args[0] === 'god' || args[0] === 'evil' || args[0] === 'arena') {
+  const mode = args[0];
+  const rest = args.slice(1);
+  const w = (m) => process.stdout.write(m + '\n');
+  const wantJson = rest.includes('--json');
+  function flag(name, dflt) {
+    const i = rest.indexOf('--' + name);
+    return i >= 0 && rest[i + 1] && !rest[i + 1].startsWith('--') ? rest[i + 1] : dflt;
+  }
+  try {
+    if (mode === 'god') {
+      const god = require(path.join(ROOT, 'scripts', 'arena', 'god.js'));
+      const task = flag('task') || rest.find(a => !a.startsWith('--'));
+      if (!task) { process.stderr.write('usage: kodelythecc god --task "<what to build>"\n'); process.exit(2); }
+      const plan = god.planBuild({ task });
+      if (wantJson) { w(JSON.stringify(plan, null, 2)); process.exit(0); }
+      w('');
+      w(`\x1b[1mGOD mode\x1b[0m — ${plan.task}`);
+      w('─'.repeat(60));
+      for (const s of plan.stages) {
+        const agents = s.agents.length ? s.agents.join(', ') : '(no agent — local operation)';
+        w(`\x1b[32m${String(s.id).padEnd(9)}\x1b[0m ${s.label.padEnd(14)} ${s.parallel ? '∥' : '→'} ${agents}`);
+      }
+      w('─'.repeat(60));
+      w(`${plan.stages.length} stages · est. ~${(plan.estimatedTokens / 1000).toFixed(0)}k tokens`);
+      w(`Run it in your AI tool with: \x1b[36m/god-mode ${plan.task}\x1b[0m`);
+      w('');
+      process.exit(0);
+    }
+
+    if (mode === 'evil') {
+      const evil = require(path.join(ROOT, 'scripts', 'arena', 'evil.js'));
+      const scope = rest.find(a => !a.startsWith('--')) || '.';
+      const plan = evil.planSweep({ scope, flags: rest.filter(a => a.startsWith('--')) });
+      if (wantJson) { w(JSON.stringify(plan, null, 2)); process.exit(0); }
+      w('');
+      w(`\x1b[1mEVIL mode\x1b[0m — adversarial sweep of \x1b[33m${scope}\x1b[0m`);
+      w('─'.repeat(60));
+      for (const agent of plan.crew) {
+        w(`\x1b[31m✗\x1b[0m ${agent.padEnd(26)} ${evil.CREW[agent].hunts}`);
+      }
+      w('─'.repeat(60));
+      w(`${plan.crew.length} hunters · est. ~${(plan.estimatedTokens / 1000).toFixed(0)}k tokens`);
+      w('Findings are scored (severity × confidence × exploitability) and');
+      w('adversarially verified — unreproducible findings get refuted.');
+      w(`Run it in your AI tool with: \x1b[36m/evil-mode ${scope}\x1b[0m`);
+      w('');
+      process.exit(0);
+    }
+
+    // arena
+    const state = require(path.join(ROOT, 'scripts', 'arena', 'state.js'));
+    const arena = require(path.join(ROOT, 'scripts', 'arena', 'arena.js'));
+    const sub = rest[0] || 'list';
+
+    if (sub === 'start') {
+      const task = flag('task') || rest.slice(1).find(a => !a.startsWith('--'));
+      if (!task) { process.stderr.write('usage: kodelythecc arena start --task "<goal>" [--scope src/] [--max-rounds 3] [--budget 400000]\n'); process.exit(2); }
+      const limits = {};
+      if (flag('max-rounds')) limits.maxRounds = Number(flag('max-rounds'));
+      if (flag('budget')) limits.tokenBudget = Number(flag('budget'));
+      const run = arena.startArena({
+        task,
+        scope: flag('scope', '.'),
+        flags: rest.filter(a => ['--all', '--license', '--theft', '--jailbreak', '--chaos', '--pre-public', '--pre-launch'].includes(a)),
+        limits,
+      });
+      const first = arena.nextAction(run);
+      if (wantJson) { w(JSON.stringify({ run: state.summarize(run), next: first }, null, 2)); process.exit(0); }
+      w('');
+      w(`\x1b[1mArena started\x1b[0m — ${run.task}`);
+      w(`  run id:   \x1b[36m${run.runId}\x1b[0m`);
+      w(`  scope:    ${run.scope}`);
+      w(`  limits:   ${run.limits.maxRounds} rounds · ${run.limits.tokenBudget.toLocaleString()} tokens · ${Math.round(run.limits.wallClockMs / 60000)} min`);
+      w(`  next:     \x1b[32m${first.action}\x1b[0m (round ${first.round}, ~${((first.estimatedTokens || 0) / 1000).toFixed(0)}k tokens)`);
+      w('');
+      w(`Drive the loop in your AI tool: \x1b[36m/arena ${run.task}\x1b[0m`);
+      w(`Inspect anytime:                kodelythecc arena report ${run.runId}`);
+      w('');
+      process.exit(0);
+    }
+
+    if (sub === 'next') {
+      const runId = rest[1];
+      if (!runId) { process.stderr.write('usage: kodelythecc arena next <run-id>\n'); process.exit(2); }
+      const run = state.load(runId);
+      if (!run) { process.stderr.write(`no such run: ${runId}\n`); process.exit(1); }
+      const action = arena.nextAction(run);
+      w(JSON.stringify(action, null, 2));
+      process.exit(0);
+    }
+
+    if (sub === 'list') {
+      const runs = state.listRuns();
+      if (!runs.length) { w('No arena runs yet.'); process.exit(0); }
+      w('');
+      w(`\x1b[1mArena runs\x1b[0m (${runs.length})`);
+      for (const r of runs.slice(0, 20)) {
+        const icon = r.status === 'converged' ? '\x1b[32m✓\x1b[0m' : r.status === 'running' ? '\x1b[33m•\x1b[0m' : '\x1b[31m✗\x1b[0m';
+        w(`  ${icon} ${r.runId}  ${String(r.rounds).padStart(2)} rounds  risk ${String(r.openRisk).padStart(6)}  ${r.task.slice(0, 40)}`);
+      }
+      w('');
+      process.exit(0);
+    }
+    if (sub === 'report') {
+      const runId = rest[1];
+      if (!runId) { process.stderr.write('usage: kodelythecc arena report <run-id>\n'); process.exit(2); }
+      const run = state.load(runId);
+      if (!run) { process.stderr.write(`no such run: ${runId}\n`); process.exit(1); }
+      const s = state.summarize(run);
+      if (wantJson) { w(JSON.stringify({ summary: s, rounds: run.rounds }, null, 2)); process.exit(0); }
+      if (rest.includes('--md')) { w(arena.buildReport(run)); process.exit(0); }
+      w('');
+      w(`\x1b[1mArena report\x1b[0m — ${s.runId}`);
+      w(`  task:        ${s.task}`);
+      w(`  status:      ${s.status}${s.stopReason ? ` (${s.stopReason})` : ''}`);
+      w(`  rounds:      ${s.rounds}`);
+      w(`  new/round:   ${s.trend.join(' → ') || '—'}   ${s.trend.length > 1 && s.trend[s.trend.length - 1] === 0 ? '\x1b[32m(attacker gave up)\x1b[0m' : ''}`);
+      w(`  open issues: ${s.openFindings} (${s.confirmed} confirmed) · open risk ${s.openRisk}`);
+      w(`  tokens:      ${s.tokensSpent.toLocaleString()}`);
+      w('');
+      process.exit(0);
+    }
+    process.stderr.write('unknown arena subcommand. try: list | report <run-id>\n');
+    process.exit(2);
+  } catch (e) {
+    process.stderr.write(`[${mode}] ${e.message}\n`);
+    process.exit(1);
+  }
+}
+
 if (args[0] === 'doctor') {
   const { run, PASS, WARN, FAIL } = require(path.join(ROOT, 'scripts', 'doctor-health.js'));
   const report = run();

package/commands/arena.md

@@ -0,0 +1,101 @@
+---
+description: The Arena — GOD builds, EVIL attacks, repeat until the attacker gives up. The adversarial loop with scored findings, verification, convergence detection, and hard budget stops.
+argument-hint: "<goal> [--scope src/] [--max-rounds 3] [--all]"
+---
+
+# /arena — GOD vs EVIL, until the attacker gives up
+
+The two crews fight over your code. GOD builds and hardens. EVIL attacks and tries to break it. Verified findings go back to GOD. Repeat until **two consecutive rounds surface nothing new** — then you ship, knowing an adversary already tried and failed.
+
+> **This is the expensive one.** ~200k tokens per round (GOD ≈ 90k + EVIL ≈ 96k + verification). Defaults are 3 rounds / 400k tokens, and the budget guard aborts *before* overspending. Use `/god-mode` or `/evil-mode` alone when you don't need the full loop.
+
+## The loop
+
+```
+round N:  GOD builds/fixes  →  EVIL hunts  →  EVIL verifies  →  close round
+                                                                    │
+                          converged? out of budget? out of rounds? ─┤
+                                    no → round N+1                  │
+                                                                   yes → report
+```
+
+**Convergence = the win condition.** Not "zero findings" — findings may remain open and accepted. It means attacking harder stopped yielding anything new.
+
+## Usage
+
+```
+/arena harden the payment webhook
+/arena add rate limiting --scope src/api --max-rounds 2
+/arena prepare this repo for open-source --all
+```
+
+Start and inspect from the terminal:
+```bash
+kodelythecc arena start --task "harden the webhook" --scope src/ --max-rounds 3
+kodelythecc arena next <run-id>          # what the loop wants next (JSON)
+kodelythecc arena report <run-id> --md   # full markdown report
+kodelythecc arena list
+```
+
+## Instructions to the assistant
+
+### 0. Start the run
+```bash
+kodelythecc arena start --task "<goal>" --scope "<path>" [--max-rounds N]
+```
+Capture the **run id**. Every step below is driven by:
+```bash
+kodelythecc arena next <run-id>
+```
+which returns the next action, its briefs, and a token estimate. **Follow it — do not improvise the order.**
+
+### 1. `god_build`
+Run the GOD-mode stages from the action's `stages` array (see `/god-mode`). Round 1 builds; later rounds **fix what EVIL proved** — those findings arrive in the brief as mandatory work items.
+
+Finish by reporting artifacts, each with a `verifyCommand` you **actually ran**.
+
+### 2. `evil_hunt`
+Launch the crew from `briefs` **in parallel** via the Task tool. On round 2+, agents are told what's already known and to hunt what the last pass missed.
+
+### 3. `evil_verify`
+For each target, launch a **fresh** agent with the supplied refute-brief. Its job is to **disprove** the finding. Default to `refuted` when uncertain.
+
+### 4. `round_close`
+Record the round. The state machine decides whether to loop again or stop.
+
+### 5. `report`
+When the action is `report`, print the full markdown:
+```bash
+kodelythecc arena report <run-id> --md
+```
+
+## Rules that keep this honest
+
+- **Never skip verification.** Unverified findings waste GOD's next entire round — that's the expensive failure mode this design exists to prevent.
+- **Never claim a fix you didn't prove.** An artifact counts only when its command exited clean. A round with an unverified artifact is flagged incomplete in the report.
+- **Never invent findings to look thorough.** An empty confirmed list is a good result.
+- **Respect the budget guard.** If it aborts, report the partial result — a readable partial beats a surprise bill.
+- Convergence is the goal, not zero findings. Accepted risk, stated plainly, is a legitimate outcome.
+
+## Reading the report
+
+The trend line is the whole story:
+
+```
+round 1   12 new  ████████████████████████
+round 2    4 new  ████████
+round 3    0 new  ·
+round 4    0 new  ·
+**Converged** — two consecutive rounds surfaced nothing new.
+```
+
+Falling to zero means the attacker ran out of ideas. A flat or rising line means **stop and think** — either the code has deep problems, or EVIL is finding new surface each pass because the scope is too broad.
+
+## When to use which
+
+| Situation | Command |
+|---|---|
+| Build something properly | `/god-mode` |
+| Audit what already exists | `/evil-mode` |
+| Ship something that must not break | `/arena` |
+| Before open-sourcing | `/arena --all` |

package/commands/evil-mode.md

@@ -0,0 +1,106 @@
+---
+description: EVIL mode — adversarial sweep with scored findings, adversarial verification, and loop-until-dry. The upgrade of /devil-mode — unreproducible findings get refuted instead of padding the report.
+argument-hint: "[scope] [--all|--license|--theft|--jailbreak|--chaos|--pre-public|--pre-launch]"
+---
+
+# /evil-mode — Attack Your Own Code
+
+Eight red-team specialists hunt your repository the way an attacker would. Unlike a plain sweep, EVIL mode **grades its own findings** and then **tries to disprove them** — so what reaches you is what survived scrutiny, not everything anyone thought of.
+
+> Findings will be uncomfortable. That is the point. This attacks **your own** codebase so real attackers find nothing left.
+
+## What makes this different from a one-shot scan
+
+| | Plain sweep | EVIL mode |
+|---|---|---|
+| Output | Flat list | Scored: severity × confidence × exploitability |
+| False positives | You triage them | **Adversarially refuted** before you see them |
+| Coverage | One pass | **Loops until two rounds find nothing new** |
+| Handoff | Prose | Structured findings `/god-mode` can consume |
+
+## The crew
+
+**Core (always):** `prompt-injection-hunter` · `supply-chain-auditor` · `secret-hunter` · `backdoor-hunter`
+
+**Opt-in:** `--license` · `--theft` · `--jailbreak` · `--chaos` · `--all`
+
+**Presets:** `--pre-public` (license + theft) · `--pre-launch` (jailbreak + chaos)
+
+## Usage
+
+```
+/evil-mode                      # core 4 on the whole repo
+/evil-mode src/auth             # focus a module
+/evil-mode --all                # all 8 hunters
+/evil-mode --pre-public         # before open-sourcing
+```
+
+Preview crew and cost first:
+```bash
+kodelythecc evil src/auth --all
+```
+
+## Instructions to the assistant
+
+### Stage 1 — Hunt (parallel)
+Launch the selected crew **simultaneously** via the Task tool. Give each agent its scope and tell it:
+
+- `evidence` must **quote the actual offending code**, not describe it.
+- `repro` must be concrete steps or a command.
+- Only claim `confirmed` when you have actually reproduced it.
+- **Do not pad.** Five confirmed findings beat forty guesses.
+
+Each finding comes back as:
+```json
+{ "title", "severity": "critical|high|medium|low|info",
+  "confidence": "confirmed|likely|suspected|speculative",
+  "exploitability": "trivial|moderate|hard|theoretical",
+  "file", "line", "evidence", "repro", "fix" }
+```
+
+### Stage 2 — Verify (the part that matters)
+Take the top findings by risk and, for each, launch a **fresh** agent whose job is to **REFUTE it**:
+
+1. Read the actual code — does the evidence match reality?
+2. Do guards, framework behaviour, or callers already neutralise it?
+3. Try to reproduce it.
+
+Return `confirmed` / `refuted` / `needs_context`. **Default to `refuted` when uncertain.** A finding that cannot be demonstrated is not a finding.
+
+Refuted findings stay in the record (so the same false positive isn't re-litigated) but count as **zero risk**.
+
+### Stage 3 — Loop until dry
+If this is an arena run, sweep again — telling each agent which findings are already known and to hunt what the last pass **missed**. Stop when two consecutive rounds surface nothing new.
+
+### Stage 4 — Report
+
+```
+EVIL MODE — <scope> — round <n>
+  swept:     <agents>
+  found:     <n> · confirmed <n> · refuted <n>
+  open risk: <sum of surviving risk>
+
+CONFIRMED (fix these)
+  [risk] title — file:line
+         repro: <command or steps>
+         fix:   <what to change>
+
+REFUTED (checked, not real)
+  title — why it is not exploitable
+```
+
+Order strictly by risk. Never lead with a `speculative` finding.
+
+## Rules
+
+- **Never invent findings to look thorough.** An empty confirmed list is a valid, good result.
+- **Never report a finding you could not reproduce** without marking it `speculative`.
+- This is for auditing **code you own or are authorised to test**. It is a defensive tool.
+
+## Handoff
+
+```
+/god-mode fix the confirmed findings from the EVIL sweep
+```
+
+GOD mode treats confirmed findings as mandatory work items — each must be fixed or explicitly accepted as risk.

package/commands/god-mode.md

@@ -0,0 +1,85 @@
+---
+description: GOD mode — the constructive crew. Recalls past solutions, designs, builds test-first, self-critiques, hardens, and proves the work with a command that actually runs.
+argument-hint: "<what to build or harden>"
+---
+
+# /god-mode — Build It Properly
+
+Nine specialists in a six-stage pipeline. This is **not** `/project-launch` (which fires everyone at once) — GOD mode is sequential where sequence matters, parallel where it doesn't, and it refuses to call anything done that it hasn't proven.
+
+## The pipeline
+
+| Stage | Agents | What happens |
+|---|---|---|
+| **Recall** | — | Search local memory for prior solutions to this problem |
+| **Design** ∥ | `architect` + `code-architect` | Blueprint: files, interfaces, data flow, build order |
+| **Build** → | `pair-programmer` + `tdd-guide` | Implement test-first; tests must actually run |
+| **Self-critique** ∥ | `type-design-analyzer` + `api-guardian` + `ux-reviewer` | Attack our own work before anyone else can |
+| **Harden** ∥ | `performance-optimizer` + `refactor-cleaner` | Hot spots and dead weight, no behaviour change |
+| **Prove** | — | Run the verification commands |
+
+∥ = parallel · → = sequential
+
+## Usage
+
+```
+/god-mode add rate limiting to the payments API
+/god-mode harden the webhook signature verification
+/god-mode                      # asks what to build
+```
+
+Preview the plan and cost from the terminal first:
+```bash
+kodelythecc god --task "add rate limiting to the payments API"
+```
+
+## Instructions to the assistant
+
+Run the stages **in order**. Do not skip Recall and do not skip Prove.
+
+### Stage 1 — Recall (do this first, always)
+Search local memory for prior work on this problem:
+- Use the `recall_memory` MCP tool, or `kodelythecc memory recall "<task>"`.
+- For each relevant hit, state: the past problem, the approach that worked, and whether it applies here.
+- **If nothing relevant exists, say so plainly.** Never invent a memory.
+
+### Stage 2 — Design (parallel)
+Launch `architect` and `code-architect` together via the Task tool. Produce one concrete blueprint: exact files, interfaces, data flow, build order. No hand-waving.
+
+### Stage 3 — Build (sequential)
+Launch `pair-programmer` and `tdd-guide`. Write the test first, watch it fail, implement, watch it pass. Report which files you created or changed.
+
+### Stage 4 — Self-critique (parallel)
+Launch `type-design-analyzer`, `api-guardian`, and `ux-reviewer` together. Be genuinely adversarial about your own output — it is far cheaper to find a problem here than to let `/evil-mode` find it later.
+
+### Stage 5 — Harden (parallel)
+Launch `performance-optimizer` and `refactor-cleaner`. Improve without changing behaviour. Tests must stay green.
+
+### Stage 6 — Prove (mandatory)
+**Run the verification command.** A test suite, a build, a benchmark — something that exits 0.
+
+- If it passes: report the command and its output.
+- If it fails: **the round is not complete.** Fix it and re-run. Do not report success.
+- "Should work" / "looks correct" is a failure of this stage.
+
+## The output contract
+
+End every GOD-mode run with:
+
+```
+GOD MODE — <task>
+  files:    <what you created or changed>
+  verified: <the command you ran> → <pass/fail + evidence>
+  memory:   <what you recalled, or "no prior art">
+  open:     <anything you deliberately did not do, and why>
+```
+
+## Handoff
+
+When the work touches security, auth, payments, user input, or dependencies, follow with:
+
+```
+/evil-mode <the files you changed>
+```
+
+That is the adversarial half — it will try to break exactly what you just built.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kodelyth-ecc",
-  "version": "2.5.4",
+  "version": "2.7.0",
   "description": "Production-grade AI coding toolkit — 70 agents (incl. devil-mode adversarial crew), 194 skills, 97 commands, parallel multi-agent commands, semantic intent routing, self-learning memory, and a built-in MCP server (16 tools / 6 prompts / 377 resources) that bridges to Claude Desktop, LangGraph, AutoGen, CrewAI, and OpenAI Agents SDK. Works with Claude Code, Windsurf, Cursor, Codex, Antigravity, OpenCode, Cline, RooCode, Aider, Kimi, and Gemini CLI.",
   "author": "Kodelyth <github.com/sifxprime>",
   "license": "MIT",