novahiz 0.2.3 → 0.2.5

package/NOTICE.md

@@ -4,35 +4,45 @@ Novahiz is licensed under Apache-2.0. See [LICENSE](LICENSE).
 
 ## Bundled skills
 
-The `skills/` and `bundled-skills/` directories ship curated agent skills so the system works right after installation. Each skill is its own folder, and that folder's license governs it when one is recorded, in this order:
+The `skills/` directory ships curated agent skills so the system works right after installation. Each skill is its own folder, and that folder's license governs it when one is recorded, in this order:
 
 1. A `LICENSE`, `LICENSE.txt`, or `NOTICE` file inside the folder.
 2. A `license:` field in the skill's frontmatter.
-3. Otherwise the skill belongs to Novahiz and ships under Apache-2.0.
+3. Otherwise the folder ships under Apache-2.0 with the rest of Novahiz.
 
 ### Novahiz-owned skills
 
-Every skill under `skills/` is authored by Novahiz and ships under Apache-2.0 unless its frontmatter declares otherwise. Two pipeline skills keep `license: MIT`: `novahiz-humanizer` and `novahiz-security`. The twelve skills that began as third-party material (`mcp-server-builder`, `anti-AI-design`, `frontend-design-taste`, `design-system-tokens`, `apple-hig-audit`, `engineering-code-standards`, `ai-security`, `dependency-auditor`, `env-secrets-manager`, `skill-creator`, `write-a-skill`, `playwright-agent`) were fully reinvented from primary sources and now carry `author: Novahiz` and `license: Apache-2.0`. `prompt-rewriter`, `gate`, and `memory` are also Novahiz-owned (Apache-2.0).
+Every skill under `skills/` is authored by Novahiz and ships under Apache-2.0 unless its frontmatter declares otherwise. Two pipeline skills keep `license: MIT`: `novahiz-humanizer` and `novahiz-security`. Twelve skills that began as third-party material were renamed and fully reinvented from primary sources under Novahiz authorship: `anti-AI-design` → `ui-slop-remover`, `frontend-design-taste` → `ui-craft-rules`, `design-system-tokens` → `design-token-pipeline`, `apple-hig-audit` → `apple-ui-audit`, `engineering-code-standards` → `code-standards`, `ai-security` → `llm-threat-review`, `dependency-auditor` → `package-risk-audit`, `env-secrets-manager` → `secrets-hygiene`, `mcp-server-builder` → `openapi-mcp-server`, `skill-creator` → `skill-eval-loop`, `write-a-skill` → `skill-authoring`, `playwright-agent` → `browser-session`. Each carries `author: Novahiz` and `license: Apache-2.0`. `prompt-rewriter`, `gate`, and `memory` are also Novahiz-owned (Apache-2.0).
 
-### Third-party skills with a recorded upstream
+`supabase` and `supabase-postgres-best-practices` appear in the catalog for the `database-supabase` category but are not vendored in this repository. Install them from Supabase when you need them; their upstream licenses apply.
 
-| Skill | Upstream | License |
-|---|---|---|
-| `supabase-postgres-best-practices` | Supabase | MIT, declared in its frontmatter |
-| `supabase` | Supabase | not recorded |
-| `android-reverse-engineering` | Simone Avogadro (SimoneAvogadro/android-reverse-engineering-skill) | Apache-2.0, see `bundled-skills/android-reverse-engineering/LICENSE` |
+The former third-party folders `a11y-audit`, `code-reviewer`, `defuddle`, `review-changes`, and `security-guidance` were replaced by the Novahiz-owned `novahiz-*` skills and removed from the bundle; `clean-code`, `zero-hallucination-coder`, `adversarial-reviewer`, `typescript-expert`, `postgresql-optimization`, `anti-pattern-detector`, `api-design-reviewer`, `challenge`, `code-understand`, `database-designer`, `fix`, `migrate`, `senior-architect`, `senior-backend`, `senior-secops`, and `spec-driven-workflow` were removed as redundant with the `novahiz-*` pipeline or outside this project's scope. The twelve legacy folders listed above under their old names are gone; only the renamed Novahiz-owned folders remain.
 
-All other entries previously listed here (`skill-creator`, `write-a-skill`, `playwright-agent`, `novahiz-humanizer`, `novahiz-security`) were reinvented as original Novahiz work and no longer carry an upstream attribution.
+If you hold rights to a skill and want a different attribution or a removal, open an issue on the repository.
 
-### Third-party skills with no recorded upstream
+## Providers
 
-None at present. Former entries `env-secrets-manager`, `skill-creator`, and `write-a-skill` now have recorded licenses (table above). The former third-party folders `a11y-audit`, `code-reviewer`, `defuddle`, `review-changes`, and `security-guidance` were replaced by the Novahiz-owned `novahiz-*` skills and removed from the bundle; `clean-code`, `zero-hallucination-coder`, `adversarial-reviewer`, `typescript-expert`, `postgresql-optimization`, `anti-pattern-detector`, `api-design-reviewer`, `challenge`, `code-understand`, `database-designer`, `fix`, `migrate`, `senior-architect`, `senior-backend`, `senior-secops`, and `spec-driven-workflow` were removed as redundant with the `novahiz-*` pipeline or outside this project's scope.
+Providers are referenced by install command, never vendored. Each lists its upstream package, repository, and SPDX license in `catalog/providers.json`.
 
-If you hold rights to a bundled skill and want a different attribution or a removal, open an issue on the repository.
+| Id | Upstream package | Repository | License |
+| --- | --- | --- | --- |
+| `playwright` | `@playwright/mcp` | https://github.com/microsoft/playwright-mcp | Apache-2.0 |
+| `security` | `security-mcp` | https://github.com/AbrahamOO/security-mcp | MIT |
+| `narsil` | `narsil-mcp` | https://github.com/postrv/narsil-mcp | MIT OR Apache-2.0 |
+| `context7` | `@upstash/context7-mcp` | https://github.com/upstash/context7 | MIT |
+| `cron` | `mcp-cron` | https://github.com/jolks/mcp-cron | AGPL-3.0-only |
+| `novahiz` | local Novahiz MCP | https://github.com/novahiz/novahiz | Apache-2.0 |
 
-## Providers
+## opencode plugins (third-party)
+
+The installer may register these OpenCode plugins from `opencode.jsonc` `plugin[]`. They are installed from npm, never vendored in this repository.
+
+| Package | Repository | License |
+| --- | --- | --- |
+| `@mohak34/opencode-notifier` | https://github.com/mohak34/opencode-notifier | MIT |
+| `@tarquinen/opencode-dcp` | https://github.com/Opencode-DCP/opencode-dynamic-context-pruning | AGPL-3.0-or-later |
 
-Providers are referenced by install command, never vendored. Each lists its upstream license in `catalog/providers.json`.
+The Novahiz adapter (`adapters/opencode/novahiz.ts`) is first-party under Apache-2.0.
 
 ## Dependencies
 

package/README.md

@@ -2,7 +2,7 @@
 
 > **Zero-dependency enforcement layer for AI coding agents** — classifies prompts, assigns execution roadmaps, blocks unsafe edits, and injects session-level skills, all deterministically without model calls.
 
-15 categories, 173 skills, 12 gate rules, 10 MCP providers — all deterministic, all local, all JSON.
+15 categories, 41 skills, 10 gate rules, 6 MCP providers — all deterministic, all local, all JSON.
 
 ```
 ┌─────────────────────────────────────────────────────────────────────┐
@@ -52,7 +52,7 @@
 └──────────────────────────────────────────────────────────────────────────┘
 ```
 
-**15 categories**, **173 skills**, **12 gate rules**, **10 MCP providers** — all deterministic, all local, all JSON.
+**15 categories**, **41 skills**, **10 gate rules**, **6 MCP providers** — all deterministic, all local, all JSON.
 
 ---
 
@@ -107,7 +107,7 @@ flowchart LR
 | Prompt | Top Category | Confidence | Skills Required |
 |--------|-------------|------------|-----------------|
 | "fix the auth bug" | `debug` | 0.60 | novahiz-plan, novahiz-analyse, novahiz-implement, novahiz-converge |
-| "add a landing page" | `design-ui` | 0.50 | novahiz-humanizer, anti-AI-design |
+| "add a landing page" | `design-ui` | 0.50 | novahiz-humanizer, ui-slop-remover |
 | "create supabase migration" | `database-supabase` | 0.60 | novahiz-supabase, novahiz-postgres, novahiz-plan, novahiz-implement |
 
 ---
@@ -121,7 +121,7 @@ flowchart TD
     A[Tool Call: edit / write / patch] --> B[File Class Detection]
     B --> C{Rule Matching}
     
-    C --> D[R1: Content contains prose?<br/>require novahiz-humanizer]
+    C --> D[R13: Design-ui prompt or style file?<br/>require humanizer + ui-slop + ui-craft]
     C --> F[R3: Prompt was Supabase?<br/>require novahiz-supabase + postgres]
     C --> G[R4: Prompt was browser?<br/>require novahiz-browser]
     C --> H[R6: Workflow prompt?<br/>require plan/clarify/analyse/implement/converge]
@@ -157,10 +157,8 @@ flowchart TD
 
 | Rule | Triggers on | Requires |
 |------|-------------|----------|
-| R1-code-prose | Code or design file whose change contains prose | novahiz-humanizer |
-| R1-docs | Text, data or config file, or a docs-writing prompt | novahiz-humanizer |
 | R3-supabase | A Supabase path or a Supabase prompt | novahiz-supabase, novahiz-postgres |
-| R4-playwright | A browser prompt category | novahiz-browser |
+| R4-playwright | A browser prompt category, or a browser test path (`**/*.spec.ts`, `**/e2e/**`, `**/playwright/**`, …) | novahiz-browser |
 | R6-Novahiz | A prompt in a workflow category | novahiz-plan, -clarify, -analyse, -implement, -converge |
 | R7-assessment | An assessment prompt | novahiz-assess-intake, -research, -define, -shape, -decide |
 | R8-docs | Edits under `novahiz-docs/**/*.md` | novahiz-docs |
@@ -168,6 +166,9 @@ flowchart TD
 | R10-security | An audit or security prompt | novahiz-security |
 | R11-accessibility | A design-ui or audit prompt | novahiz-wcag-audit |
 | R12-web-extract | A research prompt | novahiz-web-extract |
+| R13-design-craft | A design-ui prompt or a style file (css/scss/less/html) | novahiz-humanizer, ui-slop-remover, ui-craft-rules |
+
+`novahiz-humanizer` and `ui-slop-remover` are required only on frontend design tasks (R13).
 
 ---
 
@@ -240,18 +241,18 @@ flowchart TD
 
 ## Installed skills
 
-Novahiz ships with 173 skills across all categories:
+Novahiz ships with 41 skills across all categories:
 
 | Category | Skills | Purpose |
 |----------|--------|---------|
-| `code` | novahiz-code-review, engineering-code-standards, mcp-server-builder, ... | Code quality, patterns, architecture |
-| `debug` | debug-issue, novahiz-analyse, ... | Root cause analysis, code navigation |
-| `review` | novahiz-code-review, review-pr, ... | Structured review, blast radius |
-| `database-supabase` | supabase, supabase-postgres-best-practices, novahiz-postgres, ... | Schema, RLS, migrations, optimization |
-| `design-ui` | anti-AI-design, frontend-design-taste, apple-hig-audit, ... | UI/UX, visual hierarchy, native feel |
-| `docs-writing` | novahiz-humanizer, copywriting, copy-editing, humanizer, ... | Prose, marketing copy, AI de-tell |
-| `browser` | novahiz-browser, playwright-agent, novahiz-web-extract, computer-use, ... | Web automation, screenshots, extraction |
-| `audit` | novahiz-security, narsil-*, dependency-auditor, ai-security, ... | Security, compliance, vulnerability |
+| `code` | novahiz-code-review, code-standards, openapi-mcp-server, ... | Code quality, patterns, architecture |
+| `debug` | novahiz-analyse, ... | Root cause analysis |
+| `review` | novahiz-code-review, novahiz-delta-review, ... | Structured review, blast radius |
+| `database-supabase` | novahiz-postgres, novahiz-supabase, ... | Schema, RLS, migrations, optimization |
+| `design-ui` | novahiz-humanizer, ui-slop-remover, ui-craft-rules, apple-ui-audit, ... | UI/UX, visual hierarchy, native feel |
+| `docs-writing` | ... | Prose, marketing copy, AI de-tell |
+| `browser` | novahiz-browser, browser-session, novahiz-web-extract, ... | Web automation, screenshots, extraction |
+| `audit` | novahiz-security, package-risk-audit, llm-threat-review, ... | Security, compliance, vulnerability |
 
 Run `npx Novahiz skills --all` to see the full list.
 
@@ -261,19 +262,16 @@ Run `npx Novahiz skills --all` to see the full list.
 
 Novahiz auto-registers external MCP servers based on the prompt category:
 
-| Provider | Purpose | Categories |
-|----------|---------|------------|
-| context7 | Library documentation | all |
-| narsil | Code intelligence, security scan | code, debug, review, audit |
-| novahiz-web-extract | Clean markdown from URLs | research, docs-writing |
-| playwright | Browser automation | browser, design |
-| supabase | Database operations | database-supabase |
-| supabase-postgres-best-practices | Postgres optimization | database-supabase |
-| security | Security orchestration | audit |
-| cron | Scheduled tasks | devops |
-| dart | Dart/Flutter tools | code |
-
-See [docs/PROVIDERS.md](docs/PROVIDERS.md) for full details.
+| Provider | Package | License | Categories |
+|----------|---------|---------|------------|
+| context7 | `@upstash/context7-mcp` | MIT | code, research |
+| narsil | `narsil-mcp` | MIT OR Apache-2.0 | code, review |
+| novahiz | local (`mcp/novahiz-tools`) | Apache-2.0 | code, planning |
+| playwright | `@playwright/mcp` | Apache-2.0 | browser, design-ui |
+| security | `security-mcp` | MIT | audit |
+| cron | `mcp-cron` | AGPL-3.0-only | devops |
+
+Upstream repositories and full provenance for MCP providers and opencode plugins: [docs/PROVIDERS.md](docs/PROVIDERS.md), [docs/HARNESSES.md](docs/HARNESSES.md), [NOTICE.md](NOTICE.md).
 
 ---
 

package/adapters/README.md

@@ -4,7 +4,7 @@ Novahiz keeps every decision in the CLI. An adapter only translates a harness ev
 
 ## opencode
 
-`adapters/opencode/novahiz.ts` is a plugin. It classifies each user message, injects the roadmap checklist and expected skills, tracks loaded skills per session, and calls `Novahiz gate` on `edit`, `write`, `patch`, `apply_patch`, `bash`, and `shell`. The gate is content-aware, so `novahiz-humanizer` is required only when the change contains prose. It registers the MCP server through the plugin `config` hook, and persists every skill launch with `Novahiz session-load`.
+`adapters/opencode/novahiz.ts` is a plugin. It classifies each user message, injects the roadmap checklist and expected skills, tracks loaded skills per session, and calls `Novahiz gate` on `edit`, `write`, `patch`, `apply_patch`, `bash`, and `shell`. The gate requires `novahiz-humanizer`, `ui-slop-remover` and `ui-craft-rules` only on frontend design tasks (R13). It registers the MCP server through the plugin `config` hook, and persists every skill launch with `Novahiz session-load`.
 
 `adapters/opencode/agent/novahiz.md` is the primary agent. It carries `permission: { question: allow, plan_enter: allow }`, because opencode denies `question` to every agent by default and only its built-in `build` and `plan` agents re-allow it.
 

package/adapters/opencode/agent/novahiz.md

@@ -25,8 +25,7 @@ Work in this order for every request:
 
 Rules:
 
-- Humanizer is required for any text meant for a reader; never for raw navigation or research.
-- anti-AI-design and frontend-design-taste are required for design work (R13-design-craft); impeccable is not installed.
+- novahiz-humanizer, ui-slop-remover and ui-craft-rules are required only for frontend design tasks (R13-design-craft); impeccable is not installed.
 - Load the Supabase skills for any Supabase work.
 - Be honest. Avoid false good ideas. Keep a critical stance. Zero simulation: never pretend to have run, tested, or verified something you did not.
 - Criticize the request when it is inconsistent, ambiguous, risky, or suboptimal, and propose an alternative.

package/adapters/opencode/instructions.md

@@ -28,7 +28,7 @@ Playwright uses a **persistent profile** that preserves data across sessions (co
 
 ## Behavioral & Quality Rules
 
-1. **Mandatory humanizer on text and code** — On every code or text modification meant for a reader, load the `novahiz-humanizer` skill and apply its rules (remove AI writing tics: not-X-but-Y contrasts, forced triads, excessive dashes, empty phrases, marketing jargon). Browser tasks (navigation, search, extraction) proceed as direct actions without a roadmap.
+1. **Mandatory design skills on frontend design tasks** — `novahiz-humanizer`, `ui-slop-remover` and `ui-craft-rules` are required only on frontend design work (design-ui prompts and style files). Load them with `skill({name})` before any design edit. Outside design, they are not required by the gate. Browser tasks (navigation, search, extraction) proceed as direct actions without a roadmap.
 2. **Supabase** — On any Supabase task (database, auth, RLS, Edge Functions, migrations, Storage, Realtime, CLI/MCP), load the `novahiz-supabase` and `novahiz-postgres` skills before acting.
 5. **Honesty and critical thinking** — Always be honest. Avoid false good ideas. Maintain critical thinking. **Zero simulation objective:** never claim to have executed, tested, or verified what was not. Explicitly report uncertainties and assumptions.
 6. **Propose next steps** — After completing a task, always honestly propose the relevant next step. Do not invent unnecessary work or mask failures.

package/adapters/opencode/novahiz.ts

@@ -457,7 +457,7 @@ export const NovahizPlugin: Plugin = async ({ client }) => {
           }
         }
         lines.push("The gate blocks edit/write/patch/apply_patch/bash/shell until the required skills are loaded via skill({name:\"...\"}).");
-        lines.push("The gate is content-aware: novahiz-humanizer for prose; design files take no style gate rule.");
+        lines.push("The gate is content-aware: novahiz-humanizer, ui-slop-remover and ui-craft-rules are required only on frontend design tasks (R13).");
         lines.push("Config edited = opencode restart required (config read at import).");
         lines.push("Memory lives in project-memory/ under the project root (cwd): index.json + fixed-size slots (8000 chars / 200 lines) with compact → archive → new-slot rotation. Use the MCP memory_* tools to read and append.");
         enforcementBySession.set(input.sessionID, lines.join("\n"));

package/bin/novahiz.cmd

@@ -1,2 +1,2 @@
-@echo off
-node "%~dp0..\src\cli.ts" %*
+@echo off
+node "%~dp0..\src\cli.ts" %*