novahiz 0.1.0

package/skills/anti-AI-design/SKILL.md

@@ -0,0 +1,189 @@
+---
+name: anti-AI-design
+description: "Use when building any UI, landing page, dashboard, or frontend component to eliminate generic AI-generated design patterns. Detects and fixes visual tells that make sites look machine-made: purple gradients, sparkle icons, centered heroes, identical cards, fade-in-up animations. Apply BEFORE every UI deliverable."
+---
+
+# Anti-AI Design — Eliminate Machine-Made Tells
+
+Every UI deliverable MUST pass this checklist before shipping. These patterns are detected by users in ~50ms and destroy trust.
+
+---
+
+## BANNED ICONS & EMOJIS
+
+Never use these icons/emojis in feature sections, badges, or CTAs:
+
+| Banned | Why | Replace With |
+|--------|-----|-------------|
+| Sparkle (✨) | Signature #1 of v0/Lovable AI output | Contextual icon to the product, or NO icon |
+| Zap (⚡) for "fast" | Top 5 AI Lucide icon | Timer, or remove icon entirely |
+| Shield (🛡) for "secure" | Default AI icon for any "secure" word | Lock, or text-only description |
+| Rocket (🚀) in pill badges | AI pill badge pattern | Delete badge, or use plain text label |
+| Fire (🔥) in pill badges | Same as rocket | Same |
+| Check (✓) in tinted circles | shadcn Pricing example pattern | Simple check without circle, or bold text |
+| BarChart3 for "analytics" | Top 5 AI icons | Donut, TrendingUp, or no icon |
+| ArrowRight on all CTAs | Every AI button has an arrow | Remove arrow, or use distinct button style |
+| Emoji in section headings | Inconsistent rendering, ignores brand color | Inline SVG with currentColor, stroke 1.5-2px |
+| Terminal mockup with 3 macOS dots | Ultra-recognizable AI signature | Real product screenshot, or nothing |
+| DiceBear/Pravatar avatars | Generated = fake = zero trust | Real photos, or remove avatars |
+| 5 amber stars on testimonials | Always 5/5, always amber | Link to real source (G2, Capterra, App Store) |
+
+---
+
+## BANNED COLORS
+
+### Primary Color
+- NEVER use `#3B82F6` (blue-500) or `#6366F1` (indigo-500) as primary
+- Use: Emerald (#10b981), Deep Rose, Amber, Teal, or a REAL brand color
+- 60%+ of AI sites use blue-500 — it screams "nobody chose a brand color"
+
+### Gradients
+- NEVER use `from-purple-500 to-pink-500` (the strongest visual AI tell)
+- NEVER use triple gradients `from-blue-500 via-purple-500 to-pink-500`
+- NEVER use rainbow gradient text (3-stop rainbow on a word)
+- FIX: Single solid accent, or gradient with <60° hue spread using analogous colors
+- FIX: If gradient is essential — 2 stops max, analogous hues, modest saturation
+
+### Shadows
+- NEVER use purple-tinted shadows on cards
+- FIX: Neutral diffusion: `shadow-[0_20px_40px_-15px_rgba(0,0,0,0.08)]`
+- Color comes from the surface, not the shadow
+
+### Backgrounds
+- NEVER use pure `#fff` or `#000` — always add a tint
+- NEVER use `slate-50` (#F8FAFB) — the most common AI background hex
+- Use off-white with warmth: `#f5f0eb`, `#faf7f2`
+- Use dark with tint: `#0a0a0a`, `#1a1a1e`
+
+### Accent Budget
+- Pick 3 accent colors maximum
+- Each appears 3 times maximum on the page
+- Total accent moments: 9 maximum
+- More = slot machine = AI slop
+
+---
+
+## BANNED TYPOGRAPHY
+
+| Banned | Why | Fix |
+|--------|-----|-----|
+| Inter weight 700 for display headlines | Default of every AI tool | Inter weight 400-500 at larger size (size does the work) |
+| Inter alone, no pairing | Inter body = fine, Inter display = tell | Serif display (Fraunces, Playfair) + sans body |
+| `text-[90px]` arbitrary px values | Bypasses type scale | `clamp()` for fluid typography |
+| `tracking-wide uppercase` on eyebrow labels | The "here's thing" of AI pages | Sobre label, normal case, light weight |
+| `text-gray-600` everywhere | Tailwind default = no color system | Semantic token: `text-secondary`, `text-muted` |
+| System font stack as display | Last resort fallback | Geist, Satoshi, Cabinet Grotesque, IBM Plex |
+
+### Typography Rules
+- ONE display font + ONE body font — that's it
+- Display weight: 500 maximum — let size do the work
+- Body weight: 400 — readability
+- Line-height: 1.1 on headings, 1.65 on body — NOT 1.5 everywhere
+- Use `text-wrap: balance` on headlines
+
+---
+
+## BANNED LAYOUTS
+
+| Banned | Why | Fix |
+|--------|-----|-----|
+| `grid-cols-3 gap-6 rounded-2xl shadow-md` | 71% of AI sites have exactly this | Asymmetric: 2+1, bento, unequal mosaic |
+| Centered hero: H1 + p + 2 CTAs | Laziest AI hero composition | Left-aligned hero with editorial 7-5 or 8-4 grid |
+| `rounded-2xl` on EVERYTHING | No hierarchy = flat | `rounded-none` (editorial), `rounded-[2px]`, `rounded-sm` — vary by class |
+| `shadow-md` on all cards | Stripe-era Goldilocks shadow | `shadow-none`, `shadow-sm`, or 1px hairline border |
+| `transition-all duration-300 ease-in-out` | The AI animation on everything | Custom curves: `cubic-bezier(0.22,1,0.36,1)`, variable durations |
+| Identical vertical padding between sections | Metronome rhythm = template | Vary: 160px, 200px, 120px, 96px per section |
+| `max-w-7xl` everywhere | AI default value | Deliberate: 1080px, 1200px, 1440px |
+| Sticky nav with blur backdrop | Glassmorphism tell | Blur ONLY on overlays/modals, not every element |
+| `fade-in-up` on every section | Motion slop — decorative without reason | Functional animations that communicate state |
+| `opacity: 0, y: 20` then `opacity: 1, y: 0` | The AI scroll animation | No animation, or attention-guiding animation |
+
+### Layout Rules
+- At least 1 section must break the vertical rhythm (full-bleed, short, asymmetric)
+- At least 50% of sections must use asymmetric layouts
+- ONE "bold moment" per fold — not five competing visuals
+- ONE border radius on the page — pick a system, apply consistently
+- Section padding: 160px minimum (AI defaults use 64-96px)
+
+---
+
+## BANNED COPY PATTERNS
+
+| Banned | Why | Fix |
+|--------|-----|-----|
+| "Build the future of work" | Generic hero copy | Say WHAT the product does specifically |
+| "Scale without limits" | Same problem | Client language, not marketing language |
+| "Seamless", "Robust", "Cutting-edge" | Empty superlatives | Concrete numbers, client names, use cases |
+| "Empower", "Unlock", "Elevate" | AI default verbs | Specific action verbs |
+| Em-dash in every sentence | AI copywriting signature | Use ; or . or — but rarely |
+| "In today's fast-paced world" | Most cliché AI opening | Start with a fact, question, or direct statement |
+| "Get started", "Learn more", "Watch demo" | Generic CTAs | Context-specific CTAs |
+| Hedging: "May help you" | AI hedges to avoid being wrong | Assert: "This does X" |
+| 5-star testimonials without source | Zero trust | Link to verifiable source |
+| "Trusted by" with fake logos | Immediately fake | Real logos with permission, or nothing |
+| 3 pricing tiers: Starter/Pro/Enterprise | AI pricing pattern | Value-based pricing, not tier comparison |
+
+---
+
+## BANNED STRUCTURES
+
+| Banned | Why | Fix |
+|--------|-----|-----|
+| Navbar > Hero > Features > Testimonials > CTA > Footer | Template waterfall | Reorder, merge, break the sequence |
+| FAQ accordion with chevron | Universal AI pattern | FAQ in prose, or alternating Q&A layout |
+| Footer 4 columns: Product/Company/Resources/Legal | AI default footer | Minimal footer, or creative layout |
+| Glassmorphism on everything | Glass = AI tell 2021-2026 | Blur ONLY on overlays/modals |
+| `backdrop-filter: blur()` everywhere | Same | Same |
+
+---
+
+## BANNED CODE PATTERNS
+
+| Banned | Why | Fix |
+|--------|-----|-----|
+| shadcn/ui defaults unmodified | Default tokens = no design system | Modify radius, colors, spacing, typography |
+| Tailwind via CDN `<script>` | Non-production build signal | Normal CSS build (PostCSS, Tailwind CLI) |
+| `data-v0-*` attributes | v0 brand in DOM | Remove after generation |
+| "Made with Lovable" link | Lovable default footer | Disable in settings |
+| `console.log` in production | Draft-state leak | Remove before push |
+| `style=` inline attributes | Bypasses design system | Tailwind classes or CSS modules |
+| Lucide icons in nav + CTAs | AI default icon library | Phosphor duotone, Tabler filled, or custom SVG |
+
+---
+
+## SELF-CRITIQUE CHECKLIST
+
+Before shipping ANY UI, run this checklist:
+
+1. Gradient check: Is it the same as 100 other sites? Change at least 1 stop
+2. Cards check: Are the 3 cards identical? Make asymmetric
+3. Hero check: Is it centered with H1 + p + 2 buttons? Left-align
+4. Icon check: Is there a sparkle/rocket/fire? Delete or replace
+5. Copy check: Does it say something specific to THIS product? Rewrite
+6. Animation check: Do animations have a functional reason? Delete decorative ones
+7. Avatar check: Are avatars real? Real photos or remove
+8. Favicon check: Is it a globe/emoji? Custom favicon
+9. 404 check: Is it the default Next.js/Vercel? Custom 404 page
+10. Asymmetry check: Is there at least 1 asymmetric layout? Break the uniform grid
+11. Color check: Are there more than 3 accent colors? Reduce to 3 max
+12. Spacing check: Is every section the same padding? Vary the rhythm
+13. Shadow check: Are shadows purple-tinted? Switch to neutral rgba(0,0,0,0.08)
+14. Radius check: Is everything rounded-2xl? Mix rounded-none, rounded-sm, rounded-[2px]
+15. Font check: Is Inter weight 700 the display font? Switch to weight 500 or pair with serif
+
+---
+
+## POSITIVE CRAFT SIGNALS
+
+These patterns signal human craftsmanship and LOWER the AI score:
+
+- Custom selection colors (`::selection` styled)
+- Custom focus-visible states (not browser default)
+- Proper dark mode palette (tested, not adapted from light)
+- Semantic color tokens (not raw Tailwind values)
+- Editorial typography (mixed weights 300/500/700, display face with intent)
+- Real content density (600+ words on feature pages, not 80 words + 6 icons)
+- Numbers, dates, version strings — proof of craft
+- Negative space used aggressively — not everything needs a card
+- At most one border-radius on the page — pick a system
+- Reference images over adjectives — "Look at Linear's density" > "Make it premium"

package/skills/anti-pattern-detector/SKILL.md

@@ -0,0 +1,185 @@
+---
+name: anti-pattern-detector
+description: "Detects and prevents common performance, concurrency, caching, monitoring, infrastructure, and build anti-patterns in code. Use when reviewing code for reliability issues, debugging race conditions or deadlocks, optimizing cache strategies, auditing monitoring coverage, validating infrastructure configs, or checking build/deploy safety. Triggers on: anti-pattern, race condition, deadlock, cache stampede, retry storm, circuit breaker, log flooding, SPOF, config drift, dependency hell, docker bloat, migration safety, fire-and-forget, TOCTOU, ABA problem, thundering herd, cold start."
+---
+
+# Anti-Pattern Detector
+
+Detects and prevents common reliability anti-patterns across performance, concurrency, caching, monitoring, infrastructure, and build/deploy. Complements `clean-code` (quality), `security-reviewer` (security), and `devops-engineer` (Docker/K8s) by covering operational reliability gaps.
+
+## When to Use
+
+- Code review for reliability issues (auto-triggers with `code-review-excellence`)
+- Debugging race conditions, deadlocks, or performance regressions
+- Auditing cache strategies and invalidation patterns
+- Reviewing monitoring, logging, and alerting coverage
+- Validating infrastructure configs (Terraform, Docker, K8s manifests)
+- Checking build/deploy safety (dependencies, migrations, rollbacks)
+- Pre-deployment reliability checks
+
+## Do not use when
+
+- Task is purely about code style or formatting (use `clean-code`)
+- Task is purely about security vulnerabilities (use `security-reviewer`)
+- Task is purely about Dockerfile optimization (use `docker-expert`)
+- Task is purely about Kubernetes manifests (use `kubernetes-specialist`)
+
+## Core Workflow
+
+### Phase 1 — Scan
+
+Try tool-based detection first, fall back to manual analysis.
+
+**Automated tools (run if available):**
+```bash
+# Concurrency + performance patterns
+semgrep --config=auto --include-pattern='*.py' .
+semgrep --config=auto --include-pattern='*.js' .
+semgrep --config=auto --include-pattern='*.ts' .
+
+# Python-specific
+bandit -r ./src
+flake8 --select=G,C,N .
+
+# JavaScript/TypeScript
+eslint --plugin=sonarjs .
+npx eslint-plugin-n eslint .
+
+# Secrets in git
+gitleaks detect --source=.
+trufflehog git file://./ --only-verified
+
+# Dependency audit
+npm audit --audit-level=moderate
+pip-audit
+cargo audit
+
+# Docker
+hadolint Dockerfile
+trivy fs .
+```
+
+**Manual analysis:** If tools are unavailable or for patterns tools miss, load the relevant `references/` file and scan using the detection patterns.
+
+### Phase 2 — Classify
+
+For each finding, determine:
+
+| Field | Values |
+|-------|--------|
+| **Category** | `concurrency` · `cache` · `async-network` · `monitoring` · `cloud-infra` · `build-deploy` · `language-specific` |
+| **Severity** | `Critical` · `High` · `Medium` · `Low` · `Info` |
+| **Confidence** | `High` (clear pattern match) · `Medium` (likely but needs context) · `Low` (possible, needs verification) |
+| **Location** | `file:line` reference |
+
+**Severity rules:**
+
+| Severity | Criteria |
+|----------|----------|
+| **Critical** | Data loss, security breach, production outage, deadlocking under load |
+| **High** | Memory leak, performance degradation >10x, missing error handling on critical path |
+| **Medium** | Suboptimal pattern, missing best practice, potential issue under specific conditions |
+| **Low** | Code smell, minor inefficiency, style-adjacent reliability issue |
+| **Info** | Informational, no action required, FYI |
+
+### Phase 3 — Report
+
+Use this output template:
+
+```markdown
+## Anti-Pattern Report
+
+### Executive Summary
+- **Critical:** X | **High:** Y | **Medium:** Z | **Low:** W
+- **Categories affected:** concurrency, cache, ...
+- **Files scanned:** N
+
+### Findings
+
+| # | Severity | Category | File:Line | Pattern | Confidence |
+|---|----------|----------|-----------|---------|------------|
+| 1 | Critical | concurrency | src/api.py:42 | Race condition on shared counter | High |
+| 2 | High | cache | src/cache.py:15 | Missing cache invalidation | Medium |
+
+### Detailed Findings
+
+#### FIND-001: Race condition on shared counter
+- **Severity:** Critical (CVSS-like: availability impact)
+- **File:** `src/api.py:42`
+- **Pattern:** Concurrent increment without atomicity
+- **Impact:** Counter corruption under concurrent requests, incorrect data
+- **Remediation:**
+  - Minimal: Add threading.Lock around increment
+  - Better: Use atomic operations (threading.atomic, AtomicInteger)
+  - Complete: Use lock-free data structure or database atomic counter
+- **References:** CWE-362, CWE-662
+```
+
+### Phase 4 — Remediate
+
+For each finding, provide three levels of fix:
+
+1. **Minimal fix** — Quick win, mergeable immediately, addresses the symptom
+2. **Better fix** — Recommended, covers edge cases, addresses the cause
+3. **Complete fix** — Best practice, production-ready, prevents recurrence
+
+## Reference Guide
+
+Load the relevant reference file based on the finding category:
+
+| Category | Reference | Load When |
+|----------|-----------|-----------|
+| Concurrency | `references/concurrency-patterns.md` | Race conditions, deadlocks, TOCTOU, ABA, thundering herd |
+| Cache | `references/cache-patterns.md` | Cache stampede, avalanche, penetration, cold start, TTL issues |
+| Async/Network | `references/async-network-patterns.md` | Fire-and-forget, retry storms, circuit breaker, event listener leaks |
+| Monitoring | `references/monitoring-patterns.md` | Log flooding, missing structured logging, PII in logs, alert fatigue |
+| Cloud/Infra | `references/cloud-infra-patterns.md` | SPOF, auto-scaling, costs, config drift, secrets in git |
+| Build/Deploy | `references/build-deploy-patterns.md` | Dependency hell, docker bloat, migration safety, unpinned deps |
+| Language-specific | `references/language-specific-patterns.md` | JS/Python/Go/Rust/Java specific pitfalls |
+
+## Novahiz Integration
+
+This skill auto-triggers during `code-review-excellence`. The workflow:
+
+1. `novahiz-gate` checks that `anti-pattern-detector` is loaded
+2. During code review, findings are added to the review output
+3. Critical/High findings are flagged in the Todo as blockers
+4. `novahiz-audit` verifies all Critical findings were addressed
+
+## Tool Availability Matrix
+
+| Tool | What it detects | Install |
+|------|-----------------|---------|
+| `semgrep` | Concurrency, performance, security patterns | `pip install semgrep` |
+| `bandit` | Python security + anti-patterns | `pip install bandit` |
+| `eslint-plugin-sonarjs` | JS/TS code smells + anti-patterns | `npm i -D eslint-plugin-sonarjs` |
+| `gitleaks` | Secrets in git history | `brew install gitleaks` |
+| `hadolint` | Dockerfile best practices | `brew install hadolint` |
+| `trivy` | Container + dependency vulnerabilities | `brew install trivy` |
+| `pip-audit` | Python dependency vulnerabilities | `pip install pip-audit` |
+| `cargo audit` | Rust dependency vulnerabilities | `cargo install cargo-audit` |
+
+When tools are not available, proceed with manual analysis using the reference files.
+
+## Constraints
+
+### MUST DO
+- Run automated tools before manual analysis when available
+- Provide specific file/line locations for every finding
+- Include CWE/OWASP references where applicable
+- Offer three levels of remediation (minimal/better/complete)
+- Classify severity consistently using the criteria above
+- Check for secrets in code (gitleaks or manual scan)
+- Flag Critical findings immediately
+
+### MUST NOT DO
+- Skip manual review when tools report zero findings (tools miss context)
+- Report false positives without noting confidence level
+- Suggest fixes that introduce new anti-patterns
+- Mix security findings with reliability findings (use `security-reviewer` for security)
+- Override existing skills' domain (don't rewrite Dockerfiles — use `docker-expert`)
+
+## Limitations
+- Use this skill only when the task clearly matches the scope described above.
+- Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
+- Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.