novahiz 0.2.3 → 0.3.1

package/NOTICE.md

@@ -4,35 +4,56 @@ Novahiz is licensed under Apache-2.0. See [LICENSE](LICENSE).
 
 ## Bundled skills
 
-The `skills/` and `bundled-skills/` directories ship curated agent skills so the system works right after installation. Each skill is its own folder, and that folder's license governs it when one is recorded, in this order:
+The `skills/` directory ships curated agent skills so the system works right after installation. Each skill is its own folder, and that folder's license governs it when one is recorded, in this order:
 
 1. A `LICENSE`, `LICENSE.txt`, or `NOTICE` file inside the folder.
 2. A `license:` field in the skill's frontmatter.
-3. Otherwise the skill belongs to Novahiz and ships under Apache-2.0.
+3. Otherwise the folder ships under Apache-2.0 with the rest of Novahiz.
 
 ### Novahiz-owned skills
 
-Every skill under `skills/` is authored by Novahiz and ships under Apache-2.0 unless its frontmatter declares otherwise. Two pipeline skills keep `license: MIT`: `novahiz-humanizer` and `novahiz-security`. The twelve skills that began as third-party material (`mcp-server-builder`, `anti-AI-design`, `frontend-design-taste`, `design-system-tokens`, `apple-hig-audit`, `engineering-code-standards`, `ai-security`, `dependency-auditor`, `env-secrets-manager`, `skill-creator`, `write-a-skill`, `playwright-agent`) were fully reinvented from primary sources and now carry `author: Novahiz` and `license: Apache-2.0`. `prompt-rewriter`, `gate`, and `memory` are also Novahiz-owned (Apache-2.0).
+Every skill under `skills/` is authored by Novahiz and ships under Apache-2.0 unless its frontmatter declares otherwise. Two pipeline skills keep `license: MIT`: `novahiz-humanizer` and `novahiz-security`. Twelve skills that began as third-party material were renamed and fully reinvented from primary sources under Novahiz authorship: `anti-AI-design` → `ui-slop-remover`, `frontend-design-taste` → `ui-craft-rules`, `design-system-tokens` → `design-token-pipeline`, `apple-hig-audit` → `apple-ui-audit`, `engineering-code-standards` → `code-standards`, `ai-security` → `llm-threat-review`, `dependency-auditor` → `package-risk-audit`, `env-secrets-manager` → `secrets-hygiene`, `mcp-server-builder` → `openapi-mcp-server`, `skill-creator` → `skill-eval-loop`, `write-a-skill` → `skill-authoring`, `playwright-agent` → `browser-session`. Each carries `author: Novahiz` and `license: Apache-2.0`. `prompt-rewriter`, `gate`, and `memory` are also Novahiz-owned (Apache-2.0).
 
-### Third-party skills with a recorded upstream
+`supabase` and `supabase-postgres-best-practices` appear in the catalog for the `database-supabase` category but are not vendored in this repository. Install them from Supabase when you need them; their upstream licenses apply.
 
-| Skill | Upstream | License |
-|---|---|---|
-| `supabase-postgres-best-practices` | Supabase | MIT, declared in its frontmatter |
-| `supabase` | Supabase | not recorded |
-| `android-reverse-engineering` | Simone Avogadro (SimoneAvogadro/android-reverse-engineering-skill) | Apache-2.0, see `bundled-skills/android-reverse-engineering/LICENSE` |
+The former third-party folders `a11y-audit`, `code-reviewer`, `defuddle`, `review-changes`, and `security-guidance` were replaced by the Novahiz-owned `novahiz-*` skills and removed from the bundle; `clean-code`, `zero-hallucination-coder`, `adversarial-reviewer`, `typescript-expert`, `postgresql-optimization`, `anti-pattern-detector`, `api-design-reviewer`, `challenge`, `code-understand`, `database-designer`, `fix`, `migrate`, `senior-architect`, `senior-backend`, `senior-secops`, and `spec-driven-workflow` were removed as redundant with the `novahiz-*` pipeline or outside this project's scope. The twelve legacy folders listed above under their old names are gone; only the renamed Novahiz-owned folders remain.
 
-All other entries previously listed here (`skill-creator`, `write-a-skill`, `playwright-agent`, `novahiz-humanizer`, `novahiz-security`) were reinvented as original Novahiz work and no longer carry an upstream attribution.
+If you hold rights to a skill and want a different attribution or a removal, open an issue on the repository.
 
-### Third-party skills with no recorded upstream
+## Providers
 
-None at present. Former entries `env-secrets-manager`, `skill-creator`, and `write-a-skill` now have recorded licenses (table above). The former third-party folders `a11y-audit`, `code-reviewer`, `defuddle`, `review-changes`, and `security-guidance` were replaced by the Novahiz-owned `novahiz-*` skills and removed from the bundle; `clean-code`, `zero-hallucination-coder`, `adversarial-reviewer`, `typescript-expert`, `postgresql-optimization`, `anti-pattern-detector`, `api-design-reviewer`, `challenge`, `code-understand`, `database-designer`, `fix`, `migrate`, `senior-architect`, `senior-backend`, `senior-secops`, and `spec-driven-workflow` were removed as redundant with the `novahiz-*` pipeline or outside this project's scope.
+Providers are referenced by install command, never vendored. Each lists its upstream package, repository, and SPDX license in `catalog/providers.json`.
 
-If you hold rights to a bundled skill and want a different attribution or a removal, open an issue on the repository.
+| Id | Upstream package | Repository | License |
+| --- | --- | --- | --- |
+| `playwright` | `@playwright/mcp` | https://github.com/microsoft/playwright-mcp | Apache-2.0 |
+| `security` | `security-mcp` | https://github.com/AbrahamOO/security-mcp | MIT |
+| `narsil` | `narsil-mcp` | https://github.com/postrv/narsil-mcp | MIT OR Apache-2.0 |
+| `context7` | `@upstash/context7-mcp` | https://github.com/upstash/context7 | MIT |
+| `cron` | `scheduler-mcp` (local venv clone) | https://github.com/PhialsBasement/scheduler-mcp | MIT |
+| `novahiz` | local Novahiz MCP | https://github.com/novahiz/novahiz | Apache-2.0 |
+| `dart` | Dart SDK (`dart mcp-server`) | https://github.com/dart-lang/ai (pkgs/dart_mcp_server) | BSD-3-Clause |
 
-## Providers
+## Skill packs (upstream, not vendored)
+
+Installed on demand with `npx skills add` (or an upstream tarball when git transport fails); this repository does not copy their files.
+
+| Id | Repository | License |
+| --- | --- | --- |
+| `flutter-skills` | https://github.com/flutter/agent-plugins | BSD-3-Clause |
+| `dart-skills` | https://github.com/dart-lang/skills | BSD-3-Clause |
+| `expo-skills` | https://github.com/expo/skills | MIT |
+
+## opencode plugins (third-party)
+
+`opencode.jsonc` `plugin[]` holds only the Novahiz adapter. The former npm plugins were removed on 2026-09-26 (see `docs/HARNESSES.md`):
+
+| Package | Repository | License | Status |
+| --- | --- | --- | --- |
+| `@mohak34/opencode-notifier` | https://github.com/mohak34/opencode-notifier | MIT | removed 2026-09-26 |
+| `@tarquinen/opencode-dcp` | https://github.com/Opencode-DCP/opencode-dynamic-context-pruning | AGPL-3.0-or-later | removed 2026-09-26 |
 
-Providers are referenced by install command, never vendored. Each lists its upstream license in `catalog/providers.json`.
+The Novahiz adapter (`adapters/opencode/novahiz.ts`) is first-party under Apache-2.0.
 
 ## Dependencies
 

package/README.md

@@ -2,7 +2,7 @@
 
 > **Zero-dependency enforcement layer for AI coding agents** — classifies prompts, assigns execution roadmaps, blocks unsafe edits, and injects session-level skills, all deterministically without model calls.
 
-15 categories, 173 skills, 12 gate rules, 10 MCP providers — all deterministic, all local, all JSON.
+17 categories, 95 skills, 11 gate rules, 7 MCP providers — all deterministic, all local, all JSON.
 
 ```
 ┌─────────────────────────────────────────────────────────────────────┐
@@ -52,7 +52,7 @@
 └──────────────────────────────────────────────────────────────────────────┘
 ```
 
-**15 categories**, **173 skills**, **12 gate rules**, **10 MCP providers** — all deterministic, all local, all JSON.
+**17 categories**, **95 skills**, **11 gate rules**, **7 MCP providers** — all deterministic, all local, all JSON.
 
 ---
 
@@ -89,7 +89,7 @@ npx Novahiz doctor
 
 ## The Classifier
 
-Every user prompt passes through the classifier. It scores keywords against 15 categories and picks the top matches.
+Every user prompt passes through the classifier. It scores keywords against 17 categories and picks the top matches.
 
 ```mermaid
 flowchart LR
@@ -107,7 +107,7 @@ flowchart LR
 | Prompt | Top Category | Confidence | Skills Required |
 |--------|-------------|------------|-----------------|
 | "fix the auth bug" | `debug` | 0.60 | novahiz-plan, novahiz-analyse, novahiz-implement, novahiz-converge |
-| "add a landing page" | `design-ui` | 0.50 | novahiz-humanizer, anti-AI-design |
+| "add a landing page" | `design-ui` | 0.50 | novahiz-humanizer, ui-slop-remover |
 | "create supabase migration" | `database-supabase` | 0.60 | novahiz-supabase, novahiz-postgres, novahiz-plan, novahiz-implement |
 
 ---
@@ -121,7 +121,7 @@ flowchart TD
     A[Tool Call: edit / write / patch] --> B[File Class Detection]
     B --> C{Rule Matching}
     
-    C --> D[R1: Content contains prose?<br/>require novahiz-humanizer]
+    C --> D[R13: Design-ui prompt or style file?<br/>require humanizer + ui-slop + ui-craft]
     C --> F[R3: Prompt was Supabase?<br/>require novahiz-supabase + postgres]
     C --> G[R4: Prompt was browser?<br/>require novahiz-browser]
     C --> H[R6: Workflow prompt?<br/>require plan/clarify/analyse/implement/converge]
@@ -157,10 +157,8 @@ flowchart TD
 
 | Rule | Triggers on | Requires |
 |------|-------------|----------|
-| R1-code-prose | Code or design file whose change contains prose | novahiz-humanizer |
-| R1-docs | Text, data or config file, or a docs-writing prompt | novahiz-humanizer |
 | R3-supabase | A Supabase path or a Supabase prompt | novahiz-supabase, novahiz-postgres |
-| R4-playwright | A browser prompt category | novahiz-browser |
+| R4-playwright | A browser prompt category, or a browser test path (`**/*.spec.ts`, `**/e2e/**`, `**/playwright/**`, …) | novahiz-browser |
 | R6-Novahiz | A prompt in a workflow category | novahiz-plan, -clarify, -analyse, -implement, -converge |
 | R7-assessment | An assessment prompt | novahiz-assess-intake, -research, -define, -shape, -decide |
 | R8-docs | Edits under `novahiz-docs/**/*.md` | novahiz-docs |
@@ -168,6 +166,10 @@ flowchart TD
 | R10-security | An audit or security prompt | novahiz-security |
 | R11-accessibility | A design-ui or audit prompt | novahiz-wcag-audit |
 | R12-web-extract | A research prompt | novahiz-web-extract |
+| R13-design-craft | A design-ui prompt or a style file (css/scss/less/html) | novahiz-humanizer, ui-slop-remover, ui-craft-rules |
+| R14-impeccable | A design-ui prompt or a style file (css/scss/less/html) | impeccable |
+
+`novahiz-humanizer` and `ui-slop-remover` are required only on frontend design tasks (R13); `impeccable` loads the same way (R14) so critique, audit and polish playbooks stay reachable.
 
 ---
 
@@ -240,18 +242,19 @@ flowchart TD
 
 ## Installed skills
 
-Novahiz ships with 173 skills across all categories:
+Novahiz ships with 95 skills across all categories:
 
 | Category | Skills | Purpose |
 |----------|--------|---------|
-| `code` | novahiz-code-review, engineering-code-standards, mcp-server-builder, ... | Code quality, patterns, architecture |
-| `debug` | debug-issue, novahiz-analyse, ... | Root cause analysis, code navigation |
-| `review` | novahiz-code-review, review-pr, ... | Structured review, blast radius |
-| `database-supabase` | supabase, supabase-postgres-best-practices, novahiz-postgres, ... | Schema, RLS, migrations, optimization |
-| `design-ui` | anti-AI-design, frontend-design-taste, apple-hig-audit, ... | UI/UX, visual hierarchy, native feel |
-| `docs-writing` | novahiz-humanizer, copywriting, copy-editing, humanizer, ... | Prose, marketing copy, AI de-tell |
-| `browser` | novahiz-browser, playwright-agent, novahiz-web-extract, computer-use, ... | Web automation, screenshots, extraction |
-| `audit` | novahiz-security, narsil-*, dependency-auditor, ai-security, ... | Security, compliance, vulnerability |
+| `code` | novahiz-code-review, code-standards, openapi-mcp-server, ... | Code quality, patterns, architecture |
+| `debug` | novahiz-analyse, ... | Root cause analysis |
+| `review` | novahiz-code-review, novahiz-delta-review, ... | Structured review, blast radius |
+| `database-supabase` | novahiz-postgres, novahiz-supabase, ... | Schema, RLS, migrations, optimization |
+| `design-ui` | novahiz-humanizer, ui-slop-remover, ui-craft-rules, apple-ui-audit, ... | UI/UX, visual hierarchy, native feel |
+| `docs-writing` | ... | Prose, marketing copy, AI de-tell |
+| `browser` | novahiz-browser, browser-session, novahiz-web-extract, ... | Web automation, screenshots, extraction |
+| `audit` | novahiz-security, package-risk-audit, llm-threat-review, ... | Security, compliance, vulnerability |
+| `expo` | expo-overview, expo-router, expo-module, expo-dev-client, ... | Expo / React Native: routes, native modules, builds |
 
 Run `npx Novahiz skills --all` to see the full list.
 
@@ -261,19 +264,19 @@ Run `npx Novahiz skills --all` to see the full list.
 
 Novahiz auto-registers external MCP servers based on the prompt category:
 
-| Provider | Purpose | Categories |
-|----------|---------|------------|
-| context7 | Library documentation | all |
-| narsil | Code intelligence, security scan | code, debug, review, audit |
-| novahiz-web-extract | Clean markdown from URLs | research, docs-writing |
-| playwright | Browser automation | browser, design |
-| supabase | Database operations | database-supabase |
-| supabase-postgres-best-practices | Postgres optimization | database-supabase |
-| security | Security orchestration | audit |
-| cron | Scheduled tasks | devops |
-| dart | Dart/Flutter tools | code |
-
-See [docs/PROVIDERS.md](docs/PROVIDERS.md) for full details.
+| Provider | Package | License | Categories |
+|----------|---------|---------|------------|
+| context7 | `@upstash/context7-mcp` | MIT | code |
+| narsil | `narsil-mcp` | MIT OR Apache-2.0 | code, review |
+| novahiz | local (`mcp/novahiz-tools`) | Apache-2.0 | code, planning |
+| playwright | `@playwright/mcp` | Apache-2.0 | browser, design-ui |
+| security | `security-mcp` | MIT | audit |
+| cron | `scheduler-mcp` (local venv clone) | MIT | devops |
+| dart | `dart mcp-server` (Dart SDK) | BSD-3-Clause | code, debug, design-ui, flutter |
+
+Skill packs (installed from official repos, never vendored): `flutter/agent-plugins` (25 skills), `dart-lang/skills` (15 skills), `expo/skills` (17 skills, the `expo-*` group only; `eas-*` paid services excluded). See [docs/PROVIDERS.md](docs/PROVIDERS.md).
+
+Upstream repositories and full provenance for MCP providers and opencode plugins: [docs/PROVIDERS.md](docs/PROVIDERS.md), [docs/HARNESSES.md](docs/HARNESSES.md), [NOTICE.md](NOTICE.md).
 
 ---
 

package/adapters/README.md

@@ -4,7 +4,7 @@ Novahiz keeps every decision in the CLI. An adapter only translates a harness ev
 
 ## opencode
 
-`adapters/opencode/novahiz.ts` is a plugin. It classifies each user message, injects the roadmap checklist and expected skills, tracks loaded skills per session, and calls `Novahiz gate` on `edit`, `write`, `patch`, `apply_patch`, `bash`, and `shell`. The gate is content-aware, so `novahiz-humanizer` is required only when the change contains prose. It registers the MCP server through the plugin `config` hook, and persists every skill launch with `Novahiz session-load`.
+`adapters/opencode/novahiz.ts` is a plugin. It classifies each user message, injects the roadmap checklist and expected skills, tracks loaded skills per session, and calls `Novahiz gate` on `edit`, `write`, `patch`, `apply_patch`, `bash`, and `shell`. The gate requires `novahiz-humanizer`, `ui-slop-remover` and `ui-craft-rules` only on frontend design tasks (R13), and `impeccable` on the same selectors (R14). It registers the MCP server through the plugin `config` hook, and persists every skill launch with `Novahiz session-load`.
 
 `adapters/opencode/agent/novahiz.md` is the primary agent. It carries `permission: { question: allow, plan_enter: allow }`, because opencode denies `question` to every agent by default and only its built-in `build` and `plan` agents re-allow it.
 

package/adapters/opencode/agent/novahiz.md

@@ -25,9 +25,8 @@ Work in this order for every request:
 
 Rules:
 
-- Humanizer is required for any text meant for a reader; never for raw navigation or research.
-- anti-AI-design and frontend-design-taste are required for design work (R13-design-craft); impeccable is not installed.
+- novahiz-humanizer, ui-slop-remover and ui-craft-rules are required only for frontend design tasks (R13-design-craft); impeccable is installed and required on the same design selectors (R14-impeccable). After creating or substantially changing UI, run its critique, an audit when warranted, and a polish pass before ship.
 - Load the Supabase skills for any Supabase work.
 - Be honest. Avoid false good ideas. Keep a critical stance. Zero simulation: never pretend to have run, tested, or verified something you did not.
 - Criticize the request when it is inconsistent, ambiguous, risky, or suboptimal, and propose an alternative.
-- If the gate blocks you, load the missing skills it names, then retry. Do not try to route around the gate with a shell write.
+- Gate auto-repair: when a call fails with "Novahiz gate blocked", do not stop and do not ask the user. Execute the AUTO-REPAIR block from the error verbatim: load every skill it names with `skill({ name: "..." })`, then retry the exact same call once and continue the user's task where it left off. If the identical skills are reported missing again, the loads did not register — run `novahiz doctor`, report honestly to the user, and stop. Never bypass the gate with a shell write, an alternate tool, or NOVAHIZ_GATE.

package/adapters/opencode/instructions.md

@@ -28,8 +28,9 @@ Playwright uses a **persistent profile** that preserves data across sessions (co
 
 ## Behavioral & Quality Rules
 
-1. **Mandatory humanizer on text and code** — On every code or text modification meant for a reader, load the `novahiz-humanizer` skill and apply its rules (remove AI writing tics: not-X-but-Y contrasts, forced triads, excessive dashes, empty phrases, marketing jargon). Browser tasks (navigation, search, extraction) proceed as direct actions without a roadmap.
-2. **Supabase** — On any Supabase task (database, auth, RLS, Edge Functions, migrations, Storage, Realtime, CLI/MCP), load the `novahiz-supabase` and `novahiz-postgres` skills before acting.
+1. **Mandatory design skills on frontend design tasks** — `novahiz-humanizer`, `ui-slop-remover` and `ui-craft-rules` are required only on frontend design work (design-ui prompts and style files). Load them with `skill({name})` before any design edit. Outside design, they are not required by the gate. Browser tasks (navigation, search, extraction) proceed as direct actions without a roadmap.
+2. **Impeccable after UI work** — `impeccable` is installed and required on the same design selectors (gate rule R14). Whenever a page, component, section, or screen design is created or substantially changed, run its critique systematically afterwards, an audit when the change warrants it (a11y, performance, responsive), and a polish pass before shipping. The design-ui roadmap carries optional `impeccable-critique`, `impeccable-audit`, and `impeccable-polish` steps for exactly this.
+3. **Supabase** — On any Supabase task (database, auth, RLS, Edge Functions, migrations, Storage, Realtime, CLI/MCP), load the `novahiz-supabase` and `novahiz-postgres` skills before acting.
 5. **Honesty and critical thinking** — Always be honest. Avoid false good ideas. Maintain critical thinking. **Zero simulation objective:** never claim to have executed, tested, or verified what was not. Explicitly report uncertainties and assumptions.
 6. **Propose next steps** — After completing a task, always honestly propose the relevant next step. Do not invent unnecessary work or mask failures.
 7. **Challenge the request** — Take the initiative to question the user's request when it is inconsistent, ambiguous, risky, or suboptimal. Explain why and propose an alternative.