mustflow 2.103.3 → 2.103.12

package/dist/core/skill-route-resolution.js

@@ -8,6 +8,7 @@ const SKILL_ROUTER_PATH = '.mustflow/skills/router.toml';
 const SKILL_ROUTES_METADATA_PATH = '.mustflow/skills/routes.toml';
 const SKILL_FRONTMATTER_SOURCE = '.mustflow/skills/*/SKILL.md';
 const EXTERNAL_SKILL_FRONTMATTER_SOURCE = '.mustflow/external-skills/*/SKILL.md';
+const EXTERNAL_SKILL_PROVENANCE_FILE = 'mustflow-skill-source.json';
 const DEFAULT_MAX_CANDIDATES = 5;
 const DEFAULT_MAX_MAIN = 1;
 const DEFAULT_MAX_ADJUNCTS = 2;
@@ -214,6 +215,25 @@ function readSkillFrontmatterRoutes(projectRoot) {
     }
     return routes;
 }
+function hasValidExternalSkillProvenance(projectRoot, skillDirectory) {
+    const provenancePath = path.join(projectRoot, '.mustflow', 'external-skills', skillDirectory, EXTERNAL_SKILL_PROVENANCE_FILE);
+    if (!existsSync(provenancePath)) {
+        return false;
+    }
+    try {
+        const content = readUtf8FileInsideWithoutSymlinks(projectRoot, provenancePath, {
+            maxBytes: MUSTFLOW_TEXT_MAX_BYTES,
+        });
+        const parsed = JSON.parse(content);
+        return (isRecord(parsed) &&
+            parsed.schema_version === '1' &&
+            parsed.kind === 'external_skill_source' &&
+            isRecord(parsed.source));
+    }
+    catch {
+        return false;
+    }
+}
 function readExternalSkillFrontmatterRoutes(projectRoot) {
     const skillRoot = path.join(projectRoot, '.mustflow', 'external-skills');
     if (!existsSync(skillRoot)) {
@@ -227,7 +247,7 @@ function readExternalSkillFrontmatterRoutes(projectRoot) {
     for (const skillDirectory of skillDirectories) {
         const skillPath = `.mustflow/external-skills/${skillDirectory}/SKILL.md`;
         const absoluteSkillPath = path.join(projectRoot, ...skillPath.split('/'));
-        if (!existsSync(absoluteSkillPath)) {
+        if (!existsSync(absoluteSkillPath) || !hasValidExternalSkillProvenance(projectRoot, skillDirectory)) {
             continue;
         }
         const content = readUtf8FileInsideWithoutSymlinks(projectRoot, absoluteSkillPath, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mustflow",
-  "version": "2.103.3",
+  "version": "2.103.12",
   "description": "Agent workflow documents and CLI for mustflow repository roots.",
   "type": "module",
   "license": "MIT-0",
@@ -47,7 +47,7 @@
     "check:package": "node -e \"const fs=require('fs'); JSON.parse(fs.readFileSync('package.json','utf8')); console.log('package.json ok')\"",
     "check:typecheck": "tsc -p tsconfig.json --noEmit",
     "prepack": "npm run build",
-    "check:pack": "npm pack --dry-run --json",
+    "check:pack": "npm pack --dry-run --json --ignore-scripts",
     "check:install": "npm run check:pack && node --test tests/integration/*.test.js",
     "release:check": "npm run check && npm run docs:check && npm run check:install",
     "prepublishOnly": "npm run release:check",

package/schemas/README.md

@@ -124,6 +124,10 @@ Current schemas:
   `mf script-pack run repo/secret-risk-scan scan [path...] --json`, containing plausible
   hardcoded-secret findings with detector names, paths, line numbers, and redacted fingerprints
   without printing secret values
+- `security-pattern-scan-report.schema.json`: output of
+  `mf script-pack run repo/security-pattern-scan scan [path...] --json`, containing high-signal
+  security code-pattern leads with detector names, categories, paths, line numbers, review focus,
+  and redacted fingerprints without printing matched source lines or secret values
 - `text-budget-report.schema.json`: output of
   `mf script-pack run core/text-budget check <path...> --json`, containing
   exact text-budget metrics, input content hashes, policy metadata, findings, and JSON Pointer field
@@ -152,6 +156,9 @@ Current schemas:
 - `repo-approval-gate-report.schema.json`: output of
   `mf script-pack run repo/approval-gate check --action <type> --json`, containing approval policy
   decisions, required-action findings, and unreadable policy issues
+- `repo-deploy-surface-report.schema.json`: output of
+  `mf script-pack run repo/deploy-surface inspect --json`, containing detected local deploy and
+  release surfaces, trigger evidence, required verification, and manual gates
 - `related-files-report.schema.json`: output of
   `mf script-pack run repo/related-files map <path...> --json`, containing conservative related-file
   candidates from direct imports, importers, same-basename siblings, parent configuration files, and

package/schemas/link-integrity-report.schema.json

@@ -86,6 +86,7 @@
         "max_file_bytes": { "type": "integer", "minimum": 1 },
         "default_paths": { "$ref": "#/$defs/stringArray" },
         "path_filters": { "$ref": "#/$defs/stringArray" },
+        "ignored_directories": { "$ref": "#/$defs/stringArray" },
         "checked_link_kinds": {
           "type": "array",
           "items": { "$ref": "#/$defs/linkKind" }

package/schemas/reference-drift-report.schema.json

@@ -86,6 +86,7 @@
         "max_file_bytes": { "type": "integer", "minimum": 1 },
         "default_paths": { "$ref": "#/$defs/stringArray" },
         "path_filters": { "$ref": "#/$defs/stringArray" },
+        "ignored_directories": { "$ref": "#/$defs/stringArray" },
         "checked_reference_kinds": {
           "type": "array",
           "items": { "$ref": "#/$defs/referenceKind" }

package/schemas/repo-deploy-surface-report.schema.json

@@ -0,0 +1,190 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://mustflow.github.io/schemas/repo-deploy-surface-report.schema.json",
+  "title": "mustflow repo deploy-surface report",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema_version",
+    "command",
+    "pack_id",
+    "script_id",
+    "script_ref",
+    "action",
+    "status",
+    "ok",
+    "mustflow_root",
+    "input",
+    "input_hash",
+    "has_deploy_surface",
+    "summary",
+    "surfaces",
+    "required_verification",
+    "manual_gates",
+    "findings",
+    "issues"
+  ],
+  "properties": {
+    "schema_version": { "const": "1" },
+    "command": { "const": "script-pack" },
+    "pack_id": { "const": "repo" },
+    "script_id": { "const": "deploy-surface" },
+    "script_ref": { "const": "repo/deploy-surface" },
+    "action": { "const": "inspect" },
+    "status": { "enum": ["passed", "failed", "error"] },
+    "ok": { "type": "boolean" },
+    "mustflow_root": { "type": "string" },
+    "input": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["scanned_paths", "max_file_bytes"],
+      "properties": {
+        "scanned_paths": {
+          "type": "array",
+          "items": { "type": "string", "minLength": 1 }
+        },
+        "max_file_bytes": { "type": "integer", "minimum": 1 }
+      }
+    },
+    "input_hash": { "$ref": "#/$defs/sha256" },
+    "has_deploy_surface": { "type": "boolean" },
+    "summary": { "$ref": "#/$defs/summary" },
+    "surfaces": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/surface" }
+    },
+    "required_verification": {
+      "type": "array",
+      "items": { "type": "string", "minLength": 1 }
+    },
+    "manual_gates": {
+      "type": "array",
+      "items": { "type": "string", "minLength": 1 }
+    },
+    "findings": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/finding" }
+    },
+    "issues": {
+      "type": "array",
+      "items": { "type": "string" }
+    }
+  },
+  "$defs": {
+    "sha256": {
+      "type": "string",
+      "pattern": "^sha256:[a-f0-9]{64}$"
+    },
+    "summary": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "has_deploy_surface",
+        "surface_count",
+        "workflow_count",
+        "package_script_count",
+        "config_file_count",
+        "package_metadata_count",
+        "manual_gate_count",
+        "required_verification_count"
+      ],
+      "properties": {
+        "has_deploy_surface": { "type": "boolean" },
+        "surface_count": { "type": "integer", "minimum": 0 },
+        "workflow_count": { "type": "integer", "minimum": 0 },
+        "package_script_count": { "type": "integer", "minimum": 0 },
+        "config_file_count": { "type": "integer", "minimum": 0 },
+        "package_metadata_count": { "type": "integer", "minimum": 0 },
+        "manual_gate_count": { "type": "integer", "minimum": 0 },
+        "required_verification_count": { "type": "integer", "minimum": 0 }
+      }
+    },
+    "surface": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "id",
+        "kind",
+        "surface_type",
+        "path",
+        "line",
+        "trigger",
+        "confidence",
+        "evidence",
+        "required_verification",
+        "manual_gates"
+      ],
+      "properties": {
+        "id": { "type": "string", "minLength": 1 },
+        "kind": {
+          "enum": [
+            "deploy_config",
+            "github_actions_workflow",
+            "package_metadata",
+            "package_script"
+          ]
+        },
+        "surface_type": {
+          "enum": [
+            "cloudflare",
+            "container",
+            "generic_deploy",
+            "github_pages",
+            "github_release",
+            "netlify",
+            "npm_publish",
+            "package_release",
+            "vercel"
+          ]
+        },
+        "path": { "type": "string", "minLength": 1 },
+        "line": { "type": ["integer", "null"], "minimum": 1 },
+        "trigger": { "type": ["string", "null"] },
+        "confidence": { "enum": ["low", "medium", "high"] },
+        "evidence": { "$ref": "#/$defs/evidence" },
+        "required_verification": {
+          "type": "array",
+          "items": { "type": "string", "minLength": 1 }
+        },
+        "manual_gates": {
+          "type": "array",
+          "items": { "type": "string", "minLength": 1 }
+        }
+      }
+    },
+    "evidence": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["path", "line", "match"],
+      "properties": {
+        "path": { "type": "string", "minLength": 1 },
+        "line": { "type": ["integer", "null"], "minimum": 1 },
+        "match": { "type": "string", "minLength": 1 }
+      }
+    },
+    "finding": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "code",
+        "severity",
+        "message",
+        "path",
+        "json_pointer",
+        "metric",
+        "actual",
+        "expected"
+      ],
+      "properties": {
+        "code": { "const": "deploy_surface_detected" },
+        "severity": { "enum": ["low", "medium", "high", "critical"] },
+        "message": { "type": "string" },
+        "path": { "type": "string", "minLength": 1 },
+        "json_pointer": { "type": ["string", "null"] },
+        "metric": { "type": ["string", "null"] },
+        "actual": { "type": ["number", "null"] },
+        "expected": { "type": ["number", "null"] }
+      }
+    }
+  }
+}

package/schemas/security-pattern-scan-report.schema.json

@@ -0,0 +1,196 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://mustflow.github.io/schemas/security-pattern-scan-report.schema.json",
+  "title": "mustflow security-pattern-scan report",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema_version",
+    "command",
+    "pack_id",
+    "script_id",
+    "script_ref",
+    "action",
+    "status",
+    "ok",
+    "mustflow_root",
+    "policy",
+    "input_hash",
+    "targets",
+    "summary",
+    "truncated",
+    "findings",
+    "issues"
+  ],
+  "properties": {
+    "schema_version": { "const": "1" },
+    "command": { "const": "script-pack" },
+    "pack_id": { "const": "repo" },
+    "script_id": { "const": "security-pattern-scan" },
+    "script_ref": { "const": "repo/security-pattern-scan" },
+    "action": { "const": "scan" },
+    "status": { "enum": ["passed", "failed", "error"] },
+    "ok": { "type": "boolean" },
+    "mustflow_root": { "type": "string" },
+    "policy": { "$ref": "#/$defs/policy" },
+    "input_hash": { "$ref": "#/$defs/sha256" },
+    "targets": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/target" }
+    },
+    "summary": { "$ref": "#/$defs/summary" },
+    "truncated": { "type": "boolean" },
+    "findings": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/finding" }
+    },
+    "issues": {
+      "type": "array",
+      "items": { "type": "string" }
+    }
+  },
+  "$defs": {
+    "sha256": {
+      "type": "string",
+      "pattern": "^sha256:[a-f0-9]{64}$"
+    },
+    "fingerprint": {
+      "type": "string",
+      "pattern": "^sha256:[a-f0-9]{16}$"
+    },
+    "stringArray": {
+      "type": "array",
+      "items": { "type": "string" }
+    },
+    "policy": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "max_file_bytes",
+        "max_files",
+        "max_findings",
+        "extensions",
+        "ignored_directories",
+        "evidence_mode"
+      ],
+      "properties": {
+        "max_file_bytes": { "type": "integer", "minimum": 1 },
+        "max_files": { "type": "integer", "minimum": 1 },
+        "max_findings": { "type": "integer", "minimum": 1 },
+        "extensions": { "$ref": "#/$defs/stringArray" },
+        "ignored_directories": { "$ref": "#/$defs/stringArray" },
+        "evidence_mode": { "const": "metadata_only" }
+      }
+    },
+    "target": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["input", "path", "exists", "kind"],
+      "properties": {
+        "input": { "type": "string" },
+        "path": { "type": "string" },
+        "exists": { "type": ["boolean", "null"] },
+        "kind": { "enum": ["file", "directory", "missing", "other", "unknown"] }
+      }
+    },
+    "summary": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "target_count",
+        "file_count",
+        "finding_count",
+        "high_or_critical_count",
+        "category_count"
+      ],
+      "properties": {
+        "target_count": { "type": "integer", "minimum": 0 },
+        "file_count": { "type": "integer", "minimum": 0 },
+        "finding_count": { "type": "integer", "minimum": 0 },
+        "high_or_critical_count": { "type": "integer", "minimum": 0 },
+        "category_count": { "type": "integer", "minimum": 0 }
+      }
+    },
+    "detector": {
+      "enum": [
+        "client_controlled_authority",
+        "cors_origin_reflection_with_credentials",
+        "dynamic_regex",
+        "eval_execution",
+        "fs_call_non_literal_path",
+        "insecure_cookie_options",
+        "local_storage_token",
+        "mass_assignment",
+        "native_deserialization",
+        "path_join_user_input",
+        "postmessage_missing_origin_check",
+        "postmessage_wildcard_target",
+        "raw_sensitive_request_logging",
+        "server_fetch_user_url",
+        "shell_true",
+        "sql_template_interpolation",
+        "tls_verification_disabled",
+        "unsafe_yaml_load"
+      ]
+    },
+    "category": {
+      "enum": [
+        "access_control",
+        "browser",
+        "command",
+        "crypto_transport",
+        "filesystem",
+        "injection",
+        "logging",
+        "parser",
+        "token_session"
+      ]
+    },
+    "finding": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["code", "severity", "message", "path"],
+      "properties": {
+        "code": {
+          "enum": [
+            "security_pattern_client_controlled_authority",
+            "security_pattern_cors_origin_reflection_with_credentials",
+            "security_pattern_dynamic_regex",
+            "security_pattern_eval_execution",
+            "security_pattern_file_too_large",
+            "security_pattern_fs_call_non_literal_path",
+            "security_pattern_insecure_cookie_options",
+            "security_pattern_local_storage_token",
+            "security_pattern_mass_assignment",
+            "security_pattern_max_files_exceeded",
+            "security_pattern_max_findings_exceeded",
+            "security_pattern_native_deserialization",
+            "security_pattern_path_join_user_input",
+            "security_pattern_path_outside_root",
+            "security_pattern_postmessage_missing_origin_check",
+            "security_pattern_postmessage_wildcard_target",
+            "security_pattern_raw_sensitive_request_logging",
+            "security_pattern_server_fetch_user_url",
+            "security_pattern_shell_true",
+            "security_pattern_sql_template_interpolation",
+            "security_pattern_tls_verification_disabled",
+            "security_pattern_unreadable_path",
+            "security_pattern_unsafe_yaml_load"
+          ]
+        },
+        "severity": { "enum": ["low", "medium", "high", "critical"] },
+        "message": { "type": "string" },
+        "path": { "type": "string" },
+        "line": { "type": "integer", "minimum": 1 },
+        "detector": { "$ref": "#/$defs/detector" },
+        "category": { "$ref": "#/$defs/category" },
+        "review_focus": { "type": "string" },
+        "fingerprint": { "$ref": "#/$defs/fingerprint" },
+        "json_pointer": { "type": ["string", "null"] },
+        "metric": { "type": ["string", "null"] },
+        "actual": { "type": ["number", "null"] },
+        "expected": { "type": ["number", "null"] }
+      }
+    }
+  }
+}

package/templates/default/i18n.toml

@@ -86,7 +86,7 @@ translations = {}
 [documents."skill.api-contract-change"]
 source = "locales/en/.mustflow/skills/api-contract-change/SKILL.md"
 source_locale = "en"
-revision = 2
+revision = 3
 translations = {}
 
 [documents."skill.backend-reliability-change"]
@@ -116,7 +116,7 @@ translations = {}
 [documents."skill.ai-generated-code-hardening"]
 source = "locales/en/.mustflow/skills/ai-generated-code-hardening/SKILL.md"
 source_locale = "en"
-revision = 2
+revision = 3
 translations = {}
 
 [documents."skill.quality-gaming-guard"]
@@ -194,13 +194,13 @@ translations = {}
 [documents."skill.hot-path-performance-review"]
 source = "locales/en/.mustflow/skills/hot-path-performance-review/SKILL.md"
 source_locale = "en"
-revision = 1
+revision = 2
 translations = {}
 
 [documents."skill.api-request-performance-review"]
 source = "locales/en/.mustflow/skills/api-request-performance-review/SKILL.md"
 source_locale = "en"
-revision = 1
+revision = 2
 translations = {}
 
 [documents."skill.api-failure-triage"]
@@ -326,7 +326,7 @@ translations = {}
 [documents."skill.quadratic-scan-review"]
 source = "locales/en/.mustflow/skills/quadratic-scan-review/SKILL.md"
 source_locale = "en"
-revision = 1
+revision = 2
 translations = {}
 
 [documents."skill.type-state-modeling-review"]
@@ -568,6 +568,12 @@ source_locale = "en"
 revision = 1
 translations = {}
 
+[documents."skill.idea-triage"]
+source = "locales/en/.mustflow/skills/idea-triage/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
 [documents."skill.astro-code-change"]
 source = "locales/en/.mustflow/skills/astro-code-change/SKILL.md"
 source_locale = "en"
@@ -673,7 +679,7 @@ translations = {}
 [documents."skill.react-code-change"]
 source = "locales/en/.mustflow/skills/react-code-change/SKILL.md"
 source_locale = "en"
-revision = 1
+revision = 2
 translations = {}
 
 [documents."skill.python-code-change"]
@@ -769,7 +775,13 @@ translations = {}
 [documents."skill.completion-evidence-gate"]
 source = "locales/en/.mustflow/skills/completion-evidence-gate/SKILL.md"
 source_locale = "en"
-revision = 4
+revision = 5
+translations = {}
+
+[documents."skill.next-action-menu"]
+source = "locales/en/.mustflow/skills/next-action-menu/SKILL.md"
+source_locale = "en"
+revision = 3
 translations = {}
 
 [documents."skill.evidence-stall-breaker"]
@@ -1080,7 +1092,7 @@ translations = {}
 [documents."skill.vertical-slice-tdd"]
 source = "locales/en/.mustflow/skills/vertical-slice-tdd/SKILL.md"
 source_locale = "en"
-revision = 1
+revision = 2
 translations = {}
 
 [documents."skill.llm-service-ux-review"]

package/templates/default/locales/en/.mustflow/skills/ai-generated-code-hardening/SKILL.md

@@ -2,11 +2,11 @@
 mustflow_doc: skill.ai-generated-code-hardening
 locale: en
 canonical: true
-revision: 2
+revision: 3
 lifecycle: mustflow-owned
 authority: procedure
 name: ai-generated-code-hardening
-description: Apply this skill when AI-generated, assistant-authored, vibe-coded, or broad code changes need evidence-backed hardening against symptom-only fixes, pinpoint hardcoding, duplicate helpers or shapes, hidden coupling, weak tests, swallowed errors, excessive complexity, and boundary drift.
+description: Apply this skill when AI-generated, assistant-authored, vibe-coded, or broad code changes need evidence-backed hardening against symptom-only fixes, pinpoint hardcoding, duplicate helpers or shapes, hidden coupling, fake small-sample performance confidence, weak tests, swallowed errors, excessive complexity, and boundary drift.
 metadata:
   mustflow_schema: "1"
   mustflow_kind: procedure
@@ -33,8 +33,8 @@ Use this skill to turn agent-written code from "looks plausible" into maintainab
 repository code. The goal is not style cleanup. The goal is to catch the failure
 modes that appear when an agent forgets the repository between sessions: symptom-only
 patches, pinpoint hardcoding, duplicate helpers, duplicate shapes, hidden coupling,
-weak tests, swallowed errors, accidental public surfaces, and oversized functions or
-files.
+fake confidence from tiny fixtures, hidden repeated work, weak tests, swallowed errors,
+accidental public surfaces, and oversized functions or files.
 
 <!-- mustflow-section: use-when -->
 ## Use When
@@ -51,6 +51,9 @@ files.
   re-export drift.
 - Tests were added or changed and may only check strings, function names, snapshots,
   mocks, or implementation details instead of observable behavior.
+- The code looks clean on sample data but may hide repeated scans, repeated copying,
+  repeated I/O, unbounded fan-out, allocation churn, or response-size growth under
+  realistic data.
 - Error handling, fallback paths, defensive guards, or default values were added in
   multiple callers instead of one boundary.
 - New or changed functions/files are becoming hard to review because of excessive
@@ -189,7 +192,23 @@ files.
    - Split a god file only when the new module has a stable owner, direction, and
      verification path.
 
-8. Harden tests against fake confidence.
+8. Check small-sample performance traps.
+   - Treat fixture-sized success as weak evidence when the path handles users,
+     orders, comments, logs, rows, files, permissions, relations, or rendered list
+     items that can grow.
+   - Search AI-authored code for `map`, `filter`, `find`, `findIndex`, `includes`,
+     `indexOf`, `reduce`, `sort`, `slice`, `splice`, `shift`, spread accumulation,
+     `concat`, `cloneDeep`, `JSON.stringify`, `parse`, `validate`, `sanitize`,
+     `normalize`, and helper names such as `isAllowed`, `canAccess`, `resolve`,
+     `build`, or `format` in repeated paths.
+   - Escalate concrete hidden O(N^2), allocation churn, or request fan-out evidence
+     to `quadratic-scan-review`, `hot-path-performance-review`, or
+     `api-request-performance-review` instead of burying it as style feedback.
+   - Do not claim a performance improvement from static review alone. Mark it as
+     static complexity risk unless configured tests, query counts, traces, profiles,
+     or benchmarks support the claim.
+
+9. Harden tests against fake confidence.
    - Verify behavior and side effects, not only function names, strings, snapshots,
      or the presence of files.
    - For bug fixes, add at least one nearby negative or sibling case when feasible so
@@ -203,7 +222,7 @@ files.
    - If production code gained defensive fallback only to satisfy a brittle test,
      fix the test or move the fallback to the owning boundary.
 
-9. Use enforcement evidence without inventing enforcement.
+10. Use enforcement evidence without inventing enforcement.
    - Run existing configured lint, build, and related test intents when they cover
      the risk.
    - If the repository lacks dependency-boundary, complexity, max-depth,
@@ -212,7 +231,7 @@ files.
    - Never paste outside plugin commands, package-manager commands, or CI recipes
      into mustflow command contracts without command-contract review.
 
-10. Decide fix now, defer, or report.
+11. Decide fix now, defer, or report.
    - Fix now when the issue is in the touched code, small, directly tied to the
      current behavior, and verifiable with configured commands.
    - Defer when the issue needs broad architecture work, new dependencies, new CI
@@ -235,6 +254,8 @@ files.
   duplicated guard/fallback risk is documented.
 - Tests exercise behavior and meaningful side effects, with edge and failure paths
   covered where relevant to the change.
+- Sample-data performance confidence has been checked against realistic data-growth,
+  repeated-work, allocation, and I/O fan-out risks where relevant.
 
 <!-- mustflow-section: verification -->
 ## Verification
@@ -281,5 +302,7 @@ Include:
   found or ruled out.
 - Error-handling and fallback decisions.
 - Test hardening: behavior assertions, side effects, edge cases, and mock boundary.
+- Small-sample performance traps: hidden repeated scans, copy churn, repeated I/O,
+  unbounded fan-out, or response growth fixed, escalated, or reported.
 - Configured verification intents run and their result.
 - Deferred enforcement, lint, or CI guard suggestions, clearly marked as not added.