novahiz 0.2.2 → 0.2.5

package/catalog/overrides.json

@@ -8,8 +8,7 @@
         "quality"
       ],
       "categories": [
-        "code",
-        "docs-writing"
+        "design-ui"
       ]
     },
     "novahiz-supabase": {
@@ -100,7 +99,7 @@
         "general"
       ]
     },
-    "anti-AI-design": {
+    "ui-slop-remover": {
       "power": 5,
       "stars": null,
       "tags": [
@@ -111,7 +110,7 @@
         "design-ui"
       ]
     },
-    "engineering-code-standards": {
+    "code-standards": {
       "power": 4,
       "stars": null,
       "tags": [
@@ -136,7 +135,7 @@
         "code"
       ]
     },
-    "frontend-design-taste": {
+    "ui-craft-rules": {
       "power": 5,
       "stars": null,
       "tags": [
@@ -147,7 +146,7 @@
         "design-ui"
       ]
     },
-    "design-system-tokens": {
+    "design-token-pipeline": {
       "power": 4,
       "stars": null,
       "tags": [
@@ -158,7 +157,7 @@
         "design-ui"
       ]
     },
-    "apple-hig-audit": {
+    "apple-ui-audit": {
       "power": 4,
       "stars": null,
       "tags": [
@@ -192,7 +191,7 @@
         "audit"
       ]
     },
-    "ai-security": {
+    "llm-threat-review": {
       "power": 4,
       "stars": null,
       "tags": [
@@ -203,7 +202,7 @@
         "audit"
       ]
     },
-    "dependency-auditor": {
+    "package-risk-audit": {
       "power": 3,
       "stars": null,
       "tags": [
@@ -214,7 +213,7 @@
         "audit"
       ]
     },
-    "env-secrets-manager": {
+    "secrets-hygiene": {
       "power": 3,
       "stars": null,
       "tags": [
@@ -226,7 +225,7 @@
         "audit"
       ]
     },
-    "skill-creator": {
+    "skill-eval-loop": {
       "power": 3,
       "stars": null,
       "tags": [
@@ -236,7 +235,7 @@
         "general"
       ]
     },
-    "write-a-skill": {
+    "skill-authoring": {
       "power": 3,
       "stars": null,
       "tags": [
@@ -246,7 +245,7 @@
         "general"
       ]
     },
-    "mcp-server-builder": {
+    "openapi-mcp-server": {
       "power": 4,
       "stars": null,
       "tags": [

package/catalog/providers.json

@@ -3,70 +3,54 @@
     "id": "playwright",
     "label": "Playwright MCP",
     "kind": "mcp",
-    "command": ["npx", "-y", "@anthropic-ai/mcp-playwright@latest"],
+    "command": ["npx", "-y", "@playwright/mcp@latest"],
+    "source": "https://github.com/microsoft/playwright-mcp",
+    "license": "Apache-2.0",
     "categories": ["browser", "design-ui"]
   },
   {
     "id": "security",
     "label": "Security MCP",
     "kind": "mcp",
-    "command": ["npx", "-y", "@anthropic-ai/mcp-security@latest"],
-    "categories": ["security"]
+    "command": ["npx", "-y", "security-mcp@latest", "serve"],
+    "source": "https://github.com/AbrahamOO/security-mcp",
+    "license": "MIT",
+    "categories": ["audit"]
   },
   {
     "id": "narsil",
     "label": "Narsil Code Intelligence",
     "kind": "mcp",
-    "command": ["npx", "-y", "@anthropic-ai/mcp-narsil@latest"],
+    "command": ["npx", "-y", "narsil-mcp@latest", "--repos", "."],
+    "source": "https://github.com/postrv/narsil-mcp",
+    "license": "MIT OR Apache-2.0",
     "categories": ["code", "review"]
   },
   {
     "id": "context7",
     "label": "Context7 Documentation",
     "kind": "mcp",
-    "command": ["npx", "-y", "@anthropic-ai/mcp-context7@latest"],
+    "command": ["npx", "-y", "@upstash/context7-mcp@latest"],
+    "source": "https://github.com/upstash/context7",
+    "license": "MIT",
     "categories": ["code"]
   },
-  {
-    "id": "sequential-thinking",
-    "label": "Sequential Thinking",
-    "kind": "mcp",
-    "command": ["npx", "-y", "@anthropic-ai/mcp-sequential-thinking@latest"],
-    "categories": ["code", "planning"]
-  },
   {
     "id": "cron",
     "label": "Cron Scheduler",
     "kind": "mcp",
-    "command": ["npx", "-y", "@anthropic-ai/mcp-cron@latest"],
+    "command": ["npx", "-y", "mcp-cron@latest"],
+    "source": "https://github.com/jolks/mcp-cron",
+    "license": "AGPL-3.0-only",
     "categories": ["devops"]
   },
-  {
-    "id": "obsidian",
-    "label": "Obsidian Vault",
-    "kind": "mcp",
-    "command": ["npx", "-y", "@anthropic-ai/mcp-obsidian@latest"],
-    "categories": ["docs-writing"]
-  },
-  {
-    "id": "dart",
-    "label": "Dart/Flutter",
-    "kind": "mcp",
-    "command": ["npx", "-y", "@anthropic-ai/mcp-dart@latest"],
-    "categories": ["code"]
-  },
-  {
-    "id": "expo",
-    "label": "Expo/EAS",
-    "kind": "mcp",
-    "command": ["npx", "-y", "@anthropic-ai/mcp-expo@latest"],
-    "categories": ["code"]
-  },
   {
     "id": "novahiz",
     "label": "novahiz",
     "kind": "mcp",
     "command": ["node", "C:/Users/hiz/.config/novahiz/mcp/novahiz-tools/index.mjs"],
+    "source": "https://github.com/novahiz/novahiz",
+    "license": "Apache-2.0",
     "categories": ["code", "planning"]
   }
 ]

package/catalog/rules.json

@@ -1,22 +1,4 @@
 [
-  {
-    "id": "R1-code-prose",
-    "description": "Load novahiz-humanizer when code or design changes contain prose.",
-    "when": {
-      "fileClasses": ["code", "design"],
-      "contentMatches": ["prose"]
-    },
-    "require": ["novahiz-humanizer"]
-  },
-  {
-    "id": "R1-docs",
-    "description": "Load novahiz-humanizer on text, documentation, and written content.",
-    "when": {
-      "fileClasses": ["text", "data", "config"],
-      "contentMatches": ["prose"]
-    },
-    "require": ["novahiz-humanizer"]
-  },
   {
     "id": "R3-supabase",
     "description": "Load Supabase skills on any Supabase task.",
@@ -29,9 +11,20 @@
   },
   {
     "id": "R4-playwright",
-    "description": "Load novahiz-browser on any task using Playwright.",
+    "description": "Load novahiz-browser on any task using Playwright or targeting browser tests.",
     "when": {
-      "promptCategories": ["browser"]
+      "match": "any",
+      "promptCategories": ["browser"],
+      "pathGlobs": [
+        "**/*.spec.ts",
+        "**/*.spec.js",
+        "**/*.e2e.ts",
+        "**/*.e2e.js",
+        "**/*.pw.ts",
+        "**/e2e/**",
+        "**/playwright/**",
+        "**/*.cy.ts"
+      ]
     },
     "require": ["novahiz-browser"]
   },
@@ -98,7 +91,7 @@
   },
   {
     "id": "R13-design-craft",
-    "description": "Load anti-AI-design and frontend-design-taste on design UI prompts or style file edits.",
+    "description": "Load novahiz-humanizer, ui-slop-remover and ui-craft-rules on frontend design tasks only.",
     "when": {
       "match": "any",
       "promptCategories": ["design-ui"],
@@ -111,6 +104,6 @@
         "**/*.htm"
       ]
     },
-    "require": ["anti-AI-design", "frontend-design-taste"]
+    "require": ["novahiz-humanizer", "ui-slop-remover", "ui-craft-rules"]
   }
 ]

package/docs/ARCHITECTURE.md

@@ -73,7 +73,7 @@ Three versioned JSON files under `catalog/`:
 
 ### Content rules and roadmaps
 
-`src/content.ts` provides `changeText`, `hasProse`, and `hasStyle`. Rules in `catalog/rules.json` use them through `when.contentMatches` and `when.contentExcludes`, so `novahiz-humanizer` is required only for prose changes. `when.match` combines class, path, and category selectors.
+`src/content.ts` provides `changeText`, `hasProse`, and `hasStyle`. Rules in `catalog/rules.json` use them through `when.contentMatches` and `when.contentExcludes`. `novahiz-humanizer` and `ui-slop-remover` are required only by R13 on frontend design tasks. `when.match` combines class, path, and category selectors.
 
 Each category carries a `roadmap`. The classifier returns the category order, the primary category, the union of required skills, and the roadmaps. The gate adds the primary roadmap `skill` steps to its requirements.
 
@@ -121,7 +121,7 @@ The core runs on Node with no dependencies. A new harness adapter needs two thin
 
 ## Installer
 
-`install/install.mjs` detects whether opencode is installed (auto-installs it if missing), copies the core, the bundled skills, and the plugin into place. It backs up any user file it overwrites (`*.novahiz-bak`) and records what it created in `.novahiz-install.json`, so `install/uninstall.mjs` can restore and reverse.
+`install/install.mjs` detects whether opencode is installed (auto-installs it if missing), copies the core, the skills, and the plugin into place. It backs up any user file it overwrites (`*.novahiz-bak`) and records what it created in `.novahiz-install.json`, so `install/uninstall.mjs` can restore and reverse.
 
 ## MCP server
 

package/docs/CATALOG.md

@@ -8,7 +8,7 @@ The catalog is the knowledge base of Novahiz. It defines what categories exist,
 catalog/
 ├── categories.json    # 15 categories with keywords, skills, roadmaps
 ├── rules.json         # 6 pre-edit rules (file class + content triggers)
-├── providers.json     # 12 external MCP servers and skill packs
+├── providers.json     # 6 external MCP servers and skill packs
 └── overrides.json     # Manual skill curation (power, stars, tags)
 ```
 
@@ -66,13 +66,14 @@ Each rule triggers skill requirements based on file class, path, prompt category
 
 ```json
 {
-  "id": "R1-code-prose",
-  "description": "Load humanizer when code changes contain prose",
+  "id": "R13-design-craft",
+  "description": "Load novahiz-humanizer, ui-slop-remover and ui-craft-rules on frontend design tasks only.",
   "when": {
-    "fileClasses": ["code", "design"],
-    "contentMatches": ["prose"]
+    "match": "any",
+    "promptCategories": ["design-ui"],
+    "pathGlobs": ["**/*.css", "**/*.scss", "**/*.html"]
   },
-  "require": ["humanizer"]
+  "require": ["novahiz-humanizer", "ui-slop-remover", "ui-craft-rules"]
 }
 ```
 

package/docs/CONFIGURATION.md

@@ -20,7 +20,7 @@ These files live in `catalog/` and are part of the git repository:
 ```json
 {
   "dbPath": "novahiz.sqlite",
-  "skillRoots": ["./skills", "./bundled-skills"],
+  "skillRoots": ["./skills"],
   "gate": {
     "enabled": true,
     "mode": "block",
@@ -58,10 +58,10 @@ These files live in `catalog/` and are part of the git repository:
 | Key | Default | Purpose |
 |-----|---------|---------|
 | `dbPath` | `novahiz.sqlite` | SQLite database path |
-| `skillRoots` | `["./skills", "./bundled-skills"]` | Directories to scan for skills |
+| `skillRoots` | `["./skills"]` | Directories to scan for skills |
 | `gate.enabled` | `true` | Enable/disable the gate |
 | `gate.mode` | `block` | `block`, `warn`, or `audit` |
-| `gate.envEscape` | `NOVAHIZ_GATE` | Env var to disable the gate |
+| `gate.envEscape` | `NOVAHIZ_GATE` | Schema field only. The kill-switch name is hardcoded to `NOVAHIZ_GATE` in the CLI, MCP gate, and plugin; a config value cannot redirect it. |
 | `gate.tools` | `[edit, write, patch, ...]` | Tools to intercept |
 | `gate.placeholders` | `true` | Block edits with placeholder markers |
 | `classify.minScore` | `1` | Minimum score to match a category |
@@ -79,7 +79,7 @@ These files live in `catalog/` and are part of the git repository:
 | Variable | Purpose |
 |----------|---------|
 | `NOVAHIZ_HOME` | Override Novahiz home directory |
-| `NOVAHIZ_GATE` | Set to `off` to disable the gate |
+| `NOVAHIZ_GATE` | Set to `off` to disable the gate (hardcoded name; not configurable) |
 | `NOVAHIZ_NODE` | Override node executable path |
 | `NOVAHIZ_DB` | Override database path |
 | `OPENCODE_CONFIG_DIR` | Override opencode config directory |
@@ -88,7 +88,7 @@ These files live in `catalog/` and are part of the git repository:
 
 The installer generates `opencode.jsonc` with:
 
-- MCP server registrations (context7, narsil, cron, playwright, supabase, expo)
+- MCP server registrations (context7, narsil, cron, playwright, supabase)
 - Skill paths
 - Plugin list
 - Compaction settings

package/docs/CONSTITUTION.md

@@ -19,7 +19,7 @@ Rationale: auditability and simple installation. The tool is meant to be read an
 ### III. Enforce Before Writing
 The gate blocks file mutations until the skills required by the prompt's category are loaded. Advice that can be ignored is not enforcement.
 - `edit`, `write`, `patch`, `apply_patch`, and shell writes are gated. Read-only tools are not.
-- Rules are content-aware: `novahiz-humanizer` is required only for prose.
+- Rules are content-aware: `novahiz-humanizer` and `ui-slop-remover` are required only on frontend design tasks.
 - A block states what is missing and why. A silent or unexplained block counts as a bug.
 Rationale: the tool exists to make quality gates unavoidable. A gate that can be waved through is theatre.
 
@@ -40,13 +40,13 @@ Rationale: the enforcement promise is only as strong as the evidence behind it.
 ## Additional Constraints
 
 - Versioned configuration is code. Changes to `catalog/categories.json`, `catalog/rules.json`, and `catalog/overrides.json` go through review like source.
-- The published package ships `src`, `adapters`, `catalog`, `install`, `bin`, `mcp`, `skills`, `bundled-skills`, `docs`, `tsconfig.json`, `README.md`, `NOTICE.md`, `novahiz.config.example.json`, and `LICENSE`. It never carries secrets, the local database, or machine-specific config.
-- License is Apache-2.0. The source is public. Anything derived from bundled third-party skills keeps its own attribution.
+- The published package ships `src`, `adapters`, `catalog`, `install`, `bin`, `mcp`, `skills`, `docs`, `tsconfig.json`, `README.md`, `NOTICE.md`, `novahiz.config.example.json`, and `LICENSE`. It never carries secrets, the local database, or machine-specific config.
+- License is Apache-2.0. The source is public. Anything derived from third-party material keeps its own attribution.
 
 ## Development Workflow
 
 - Run `npx tsc --noEmit` and `node --test` locally. Both must be green before a commit.
-- Dogfood the rules. Load `novahiz-humanizer` for prose changes, because the gate requires it of everyone.
+- Dogfood the rules. Load `novahiz-humanizer` and `ui-slop-remover` on frontend design changes, because the gate requires them there.
 - Commit messages describe the behavior change, not the file touched.
 - Before 1.0 the public interface may move. Such changes are called out in the commit and, when relevant, in the README.
 

package/docs/GATE.md

@@ -30,17 +30,13 @@ The gate is the enforcement mechanism. It inspects every file edit and decides w
 │                                                             │
 │  For each rule in catalog/rules.json:                       │
 │                                                             │
-│  R1-code-prose:                                             │
-│    fileClasses: ["code", "design"] ✓                       │
-│    contentMatches: ["prose"] → check content                │
-│    → Does the diff contain prose?                           │
-│      If YES: require novahiz-humanizer                 │
-│                                                             │
-│  R1-docs:                                                   │
-│    fileClasses: ["text", "data", "config"] ✓                │
-│    contentMatches: ["prose"] → check content                │
-│    → Does the diff contain prose?                           │
-│      If YES: require novahiz-humanizer                 │
+│  R13-design-craft:                                          │
+│    match: any                                               │
+│    promptCategories: ["design-ui"] OR pathGlobs: css/html   │
+│    → Is this a frontend design task?                        │
+│      If YES: require novahiz-humanizer                      │
+│              + ui-slop-remover + ui-craft-rules             │
+│    (Humanizer and ui-slop-remover are design-only.)         │
 │                                                             │
 │  R3-supabase:                                               │
 │    promptCategories: ["database-supabase"]                  │

package/docs/HARNESSES.md

@@ -17,6 +17,17 @@ opencode denies the `question` tool to every agent by default. Only the built-in
 
 Source: opencode plugin docs (`~/.config/opencode/plugins/`).
 
+### Third-party opencode plugins
+
+Besides the Novahiz adapter, the bootstrap and installer may pin these packages in `opencode.jsonc` under `plugin[]`. They ship from npm and are not vendored here.
+
+| Package | Repository | License |
+| --- | --- | --- |
+| `@mohak34/opencode-notifier` | https://github.com/mohak34/opencode-notifier | MIT |
+| `@tarquinen/opencode-dcp` | https://github.com/Opencode-DCP/opencode-dynamic-context-pruning | AGPL-3.0-or-later |
+
+`opencode-dcp` is AGPL-3.0-or-later. Installing it accepts that license for the plugin package. Full provider MCP provenance lives in [PROVIDERS.md](PROVIDERS.md) and `catalog/providers.json`.
+
 ## Other clients
 
 Any harness with a stdio MCP client can use the same server, `mcp/novahiz-tools/index.mjs`, for `classify`, `catalog`, `roadmap`, `providers`, `deps`, `step`, `list_skills`, `gate`, `task`, and `dispatch`. Register it with that client's own MCP command. Novahiz writes no other harness's configuration.

package/docs/INSTALL.md

@@ -19,7 +19,7 @@ node /path/to/novahiz/install/install.mjs --home ~/.config/novahiz
 
 The installer runs `git`-free and never deletes your files. When run in a terminal it is interactive: it prints the plan and the provider list, then asks before writing anything or installing packages. It:
 
-1. Copies the core, the bundled skills, and the plugin into place.
+1. Copies the core, the skills, and the plugin into place.
 2. Merges `skills/` into your opencode skills directory, skipping any skill that another scanned root already provides.
 3. Drops the opencode plugin into the plugins directory.
 4. Writes `novahiz.config.json` only if it does not exist.
@@ -27,15 +27,15 @@ The installer runs `git`-free and never deletes your files. When run in a termin
 6. Verifies provider dependencies, and installs them when you confirm or `--install-providers` is set.
 7. Installs the Novahiz agent into `~/.config/opencode/agent/novahiz.md` and the four slash commands into `~/.config/opencode/commands/`.
 
-Restart opencode afterward. The plugin registers the Novahiz MCP server automatically, so you do not edit `opencode.jsonc` by hand. See [HARNESSES.md](HARNESSES.md) for the exact paths.
+Restart opencode afterward. The plugin in `~/.config/opencode/plugins/novahiz.ts` is auto-discovered (confirmed by `opencode debug config`: `file:///…/plugins/novahiz.ts`, scope local), so it is not listed in `plugin[]` and you do not edit `opencode.jsonc` by hand. See [HARNESSES.md](HARNESSES.md) for the exact paths.
 
 ## Options
 
 - `--home <path>` installs the core to a custom location.
 - `--scope project` targets `./.opencode` instead of the global config.
 - `--dry-run` prints the actions and writes nothing.
-- `--no-skills` skips the bundled skills.
-- `--force-skills` recopies a bundled skill even when another scanned root already provides it.
+- `--no-skills` skips the skills copy.
+- `--force-skills` recopies a skill even when another scanned root already provides it.
 - `--install-providers` runs the provider dependency bootstrap and install commands.
 - `--force` rewrites `novahiz.config.json` (the previous file is backed up as `novahiz.config.json.novahiz-bak`).
 - `--yes` skips every prompt. Use it in scripts and CI, where there is no terminal to answer.
@@ -54,7 +54,9 @@ node ~/.config/novahiz/src/cli.ts doctor
 node ~/.config/novahiz/src/cli.ts clean --dry-run
 ```
 
-`doctor` runs nine checks: Node version, `npx`, the installed-skills index, the referenced skills, the external CLIs the skills call, a gate smoke test, the ledger database, whether the installed plugin copy matches the source, and whether the installed agent grants the `question` tool. It exits non-zero when a blocking check fails, so it works as a pre-flight in scripts.
+`doctor` runs twelve checks: Node 22.18+, `npx`, the installed-skills index, the referenced skills, the external CLIs the skills call, a gate smoke test, the registry database, the schema version, whether the installed plugin copy matches the source, the memory module limits, the five MCP `memory_*` tools, and whether the installed agent is in sync and grants the `question` tool. It exits non-zero when a blocking check fails, so it works as a pre-flight in scripts.
+
+The gate kill-switch environment variable is `NOVAHIZ_GATE` (`off`, `0`, `false`, `no`, or `disabled`). The config key `gate.envEscape` exists only for schema compatibility: it cannot rename the variable. See [CONFIGURATION.md](CONFIGURATION.md).
 
 `clean` trims old rows from the ledger, `novahiz.sqlite`. Targets are `logs` (default), `roadmap`, `sessions`, `tasks`, and `all`; flags are `--days N` (default 30), `--dry-run`, `--apply`, `--vacuum`, and `--json`. Without `--apply` on a terminal it prints the plan and asks; without a terminal it prints the plan and exits 1, so a script cannot delete by accident.
 

package/docs/PLUGIN.md

@@ -13,13 +13,17 @@ The opencode adapter is a thin plugin that bridges the Novahiz core with the ope
 │  3. Check DISABLED flag (env escape or config)              │
 │  4. Register hooks:                                         │
 │     • config → inject MCP server + providers                │
-│     • event → clean up session state on session.deleted     │
+│     • event → session.deleted cleanup;                      │
+│               session.idle → flush autodocs (fail-open)     │
 │     • chat.message → classify prompt, build enforcement     │
 │     • experimental.chat.system.transform → inject into prompt│
 │     • tool.execute.before → gate check on edits             │
+│     • tool.execute.after → mark major path dirty (autodocs)  │
 └─────────────────────────────────────────────────────────────┘
 ```
 
+The plugin is self-contained: prompt rewriting and autodocs helpers are inlined so the installed copy under `~/.config/opencode/plugins/` does not depend on `../../src/*` (that path does not resolve after install).
+
 ## Hooks
 
 ### `config`
@@ -28,8 +32,8 @@ Registers the Novahiz MCP server and any additional providers from `catalog/prov
 
 ```typescript
 config: async (input) => {
-  // Register Novahiz MCP server
-  config.mcp.Novahiz = {
+  // Register Novahiz MCP server (key is lowercase: config.mcp.novahiz)
+  config.mcp.novahiz = {
     type: "local",
     command: [NODE, join(HOME, "mcp", "novahiz-tools", "index.mjs")],
     enabled: true
@@ -108,10 +112,23 @@ The core enforcement hook. Intercepts tool calls and runs the gate:
 │  Gate output:                                               │
 │  • exit 0 → allow                                           │
 │  • exit 2 → BLOCK (throw error with missing skills list)    │
-│  • exit != 0 → allow with warning (gate unavailable)        │
+│  • exit != 0 → BLOCK (fail-closed, same as spawn error)      │
 └─────────────────────────────────────────────────────────────┘
 ```
 
+### `event`
+
+Two event types:
+
+| Event | Behavior |
+|-------|----------|
+| `session.deleted` | Forget in-memory session state |
+| `session.idle` | If autodocs is enabled and state is dirty, spawn `novahiz autodocs --flush` (fail-open, unref'd child) |
+
+### `tool.execute.after`
+
+After an edit-like tool succeeds, if the path is a major source file (`src/…`, `package.json`, `.ts`, …), call the inlined `markDirty` so the next `session.idle` can flush docs. Non-edit tools and non-major paths are ignored. Never throws.
+
 ## Session state
 
 The plugin maintains per-session state in memory:
@@ -145,6 +162,7 @@ When disabled, all hooks return early without doing anything.
 ## Error handling
 
 - If `classify` fails → warning logged, no enforcement injected
-- If `gate` fails with spawn error → tool call allowed (gate unavailable)
-- If `gate` exits non-zero non-two → tool call allowed with warning
+- If `gate` fails with spawn error → tool call **blocked** (fail-closed)
+- If `gate` exits non-zero non-two → tool call **blocked** (fail-closed)
 - If `gate` exits 2 → error thrown, tool call blocked
+- Autodocs flush on `session.idle` and `tool.execute.after` are fail-open

package/docs/PROVIDERS.md

@@ -34,16 +34,18 @@ Novahiz references providers, it never vendors them. Each entry lists the upstre
 
 ## Bundled providers
 
-MCP servers:
-
-| Id | Purpose | Categories |
-| --- | --- | --- |
-| `playwright` | Browser automation | browser, design-ui |
-| `security` | SAST/DAST and compliance | audit |
-| `narsil` | Code intelligence | code, debug, review, audit |
-| `context7` | Library docs | code, research |
-| `sequential-thinking` | Structured reasoning | planning, debug, audit |
-| `cron` | Scheduling | devops, general |
+MCP servers, with provenance from `catalog/providers.json`:
+
+| Id | Package | Upstream | License | Categories |
+| --- | --- | --- | --- | --- |
+| `playwright` | `@playwright/mcp` | [microsoft/playwright-mcp](https://github.com/microsoft/playwright-mcp) | Apache-2.0 | browser, design-ui |
+| `security` | `security-mcp` | [AbrahamOO/security-mcp](https://github.com/AbrahamOO/security-mcp) | MIT | audit |
+| `narsil` | `narsil-mcp` | [postrv/narsil-mcp](https://github.com/postrv/narsil-mcp) | MIT OR Apache-2.0 | code, debug, review, audit |
+| `context7` | `@upstash/context7-mcp` | [upstash/context7](https://github.com/upstash/context7) | MIT | code, research |
+| `cron` | `mcp-cron` | [jolks/mcp-cron](https://github.com/jolks/mcp-cron) | AGPL-3.0-only | devops, general |
+| `novahiz` | local (`mcp/novahiz-tools`) | [novahiz/novahiz](https://github.com/novahiz/novahiz) | Apache-2.0 | code, planning |
+
+`cron` is AGPL-3.0-only. Enabling it means you accept that license for the install command, not for Novahiz itself.
 
 Skill and command packs:
 

package/docs/ROADMAPS.md

@@ -55,10 +55,11 @@ When several categories match, the one with the highest score provides the roadm
 
 ## Content-aware rules
 
-`novahiz-humanizer` is governed by rules, not by roadmap steps, so it is required only when it matters:
+`novahiz-humanizer` and `ui-slop-remover` load only through `R13-design-craft` on frontend design tasks:
 
-- `novahiz-humanizer` applies to text and documentation, and to code whose change contains prose.
-- `anti-AI-design` and `frontend-design-taste` load through `R13-design-craft` on design-ui prompts and style file edits (css/scss/less/html). The design-ui roadmap also carries an optional `design-craft` step for guidance; it does not block.
+- Both skills are required on design-ui prompts and style file edits (css/scss/less/html).
+- Outside frontend design, neither skill is required by the gate.
+- The design-ui roadmap also carries an optional `design-craft` step for guidance; it does not block.
 
 Rules express this with `when.contentMatches` (`prose`, `style`, or a regex), `when.contentExcludes`, `when.minChange`, and `when.match` (`any` or `all`) to combine the class, path, and category selectors.
 

package/docs/RULES.md

@@ -6,13 +6,14 @@ A rule describes a condition and the skills that condition requires before a fil
 
 ```json
 {
-  "id": "R1-docs",
-  "description": "Load novahiz-humanizer on text, documentation, and written content.",
+  "id": "R13-design-craft",
+  "description": "Load novahiz-humanizer, ui-slop-remover and ui-craft-rules on frontend design tasks only.",
   "when": {
-    "fileClasses": ["text", "data", "config"],
-    "contentMatches": ["prose"]
+    "match": "any",
+    "promptCategories": ["design-ui"],
+    "pathGlobs": ["**/*.css", "**/*.scss", "**/*.html"]
   },
-  "require": ["novahiz-humanizer"]
+  "require": ["novahiz-humanizer", "ui-slop-remover", "ui-craft-rules"]
 }
 ```
 
@@ -32,16 +33,16 @@ Content conditions are combined with AND against the selectors. A rule with `con
 
 | Id | Condition | Requires |
 | --- | --- | --- |
-| R1-docs | text, data or config file, or a docs-writing prompt | `novahiz-humanizer` |
-| R1-code-prose | code or design file whose change contains prose | `novahiz-humanizer` |
 | R3-supabase | a Supabase path or a Supabase prompt | `novahiz-supabase`, `novahiz-postgres` |
-| R4-playwright | a browser prompt category | `novahiz-browser` |
+| R4-playwright | a browser prompt category, or a browser test path (`**/*.spec.ts`, `**/e2e/**`, `**/playwright/**`, …) | `novahiz-browser` |
 | R6-Novahiz | a prompt in a workflow category | pipeline skills (`novahiz-plan`, `novahiz-clarify`, `novahiz-analyse`, `novahiz-implement`, `novahiz-converge`) |
 | R9-code-review | a review prompt or a code file under review | `novahiz-code-review` |
 | R10-security | an audit or security prompt | `novahiz-security` |
 | R11-accessibility | a design-ui or audit prompt | `novahiz-wcag-audit` |
 | R12-web-extract | a research prompt | `novahiz-web-extract` |
-| R13-design-craft | a design-ui prompt or a style file (css/scss/less/html) | `anti-AI-design`, `frontend-design-taste` |
+| R13-design-craft | a design-ui prompt or a style file (css/scss/less/html) | `novahiz-humanizer`, `ui-slop-remover`, `ui-craft-rules` |
+
+`novahiz-humanizer` and `ui-slop-remover` are required only by R13, on frontend design tasks. They are not required on ordinary text, docs, or code edits.
 
 ## Resolution
 
@@ -75,7 +76,7 @@ The `gate` block in `novahiz.config.json` controls behavior:
 
 - `enabled`: disable the whole gate.
 - `mode`: `block`, `warn`, or `audit`.
-- `envEscape`: the variable that disables the gate for one session. Defaults to `novahiz_GATE`; values `off`, `0`, `false`, `no`, `disabled` disable it. Read by the CLI, the hook mode, the MCP gate tool, and the opencode plugin.
+- `envEscape`: schema field only. The kill-switch variable is hardcoded to `NOVAHIZ_GATE` (not configurable); values `off`, `0`, `false`, `no`, `disabled` disable the gate. Read by the CLI, the hook mode, the MCP gate tool, and the opencode plugin.
 - `tools`: the tool names the gate intercepts.
 - `ignoreFiles`: globs skipped by the gate.