nubos-pilot 1.2.2 → 1.2.3

package/lib/nubosloop.cjs

@@ -24,6 +24,7 @@ const ROUTE_TABLE = {
   'lint-violation': 'executor',
   'critic-error': 'stuck',
   'rule-9-violation': 'executor',
+  'skill-bar-unconsulted': 'executor',
   'missing-test': 'executor',
   'edge-case-gap': 'executor',
   'weak-assertion': 'executor',
@@ -311,6 +312,10 @@ const {
   auditToolUse,
   recordSearchEvidence,
   searchEvidenceForRound,
+  recordSkillEvidence,
+  recordExpectedSkills,
+  skillFindingsFromState,
+  markSkillFindingsRoutedInArray,
   readToolUseAudit,
   auditFindingsForRound,
   auditFindingsFromAudits,
@@ -502,6 +507,10 @@ module.exports = {
   auditToolUse,
   recordSearchEvidence,
   searchEvidenceForRound,
+  recordSkillEvidence,
+  recordExpectedSkills,
+  skillFindingsFromState,
+  markSkillFindingsRoutedInArray,
   readToolUseAudit,
   auditFindingsForRound,
   auditFindingsFromAudits,

package/lib/tier-classify.cjs

@@ -0,0 +1,67 @@
+'use strict';
+
+const { VALID_TIERS } = require('./model-profiles.cjs');
+
+// ADR-0013: a tier is a routing/meta property derived from OBSERVABLE task
+// signals (files touched + risk keywords), never invented from implementation
+// detail. classifyTier is advisory — the planner remains the decider; this
+// helper only makes that decision evidence-based. Output is deterministic
+// (no clock, no randomness) so a given task always classifies the same way.
+
+const RISK_RE = /\b(auth|authn|authz|authoriz\w*|login|crypto|encrypt\w*|decrypt\w*|password|secret|credential|token|jwt|oauth|saml|session|payment|billing|invoice|permission|role|access[\s-]?control|migrat\w*|schema)\b/i;
+const ARCH_RE = /\b(architect\w*|cross[\s-]?cutting|multi[\s-]?module|redesign|breaking[\s-]?change|public[\s-]?api|contract|interface|protocol|state[\s-]?machine|concurren\w*|distributed|orchestrat\w*)\b/i;
+const TRIVIAL_RE = /\b(typo|comment|rename|docs?|readme|changelog|copy(?:writing)?|wording|spelling|version[\s-]?bump|bump[\s-]?version|lint|format(?:ting)?|whitespace|config[\s-]?value|constant|string[\s-]?literal)\b/i;
+
+const SIZE_TO_TIER = Object.freeze({ trivial: 'haiku', standard: 'sonnet', large: 'opus' });
+
+const LARGE_FILE_THRESHOLD = 6;
+
+function _text(name, desc) {
+  return [String(name || ''), String(desc || '')].join(' ');
+}
+
+/**
+ * @param {{files_modified?: string[], name?: string, desc?: string}} task
+ * @returns {{tier: string, size: string, rationale: string, signals: {file_count: number, risk: boolean, arch: boolean, trivial: boolean}}}
+ */
+function classifyTier(task) {
+  const t = task || {};
+  const files = Array.isArray(t.files_modified) ? t.files_modified : [];
+  const fileCount = files.length;
+  const haystack = _text(t.name, t.desc) + ' ' + files.join(' ');
+
+  const risk = RISK_RE.test(haystack);
+  const arch = ARCH_RE.test(haystack);
+  const trivial = TRIVIAL_RE.test(haystack);
+
+  let size;
+  let rationale;
+  if (risk) {
+    size = 'large';
+    rationale = 'security/data-sensitive surface (auth, crypto, secrets, or migration) — escalate to the strongest tier';
+  } else if (arch || fileCount >= LARGE_FILE_THRESHOLD) {
+    size = 'large';
+    rationale = arch
+      ? 'architectural / cross-cutting change — invariants span multiple units'
+      : 'broad change touching ' + fileCount + ' files — cross-file invariants likely';
+  } else if (fileCount <= 1 && trivial) {
+    size = 'trivial';
+    rationale = 'single-file mechanical edit (docs/rename/format/config) — narrow, low-risk';
+  } else {
+    size = 'standard';
+    rationale = 'ordinary single-concern implementation';
+  }
+
+  return {
+    tier: SIZE_TO_TIER[size],
+    size,
+    rationale,
+    signals: { file_count: fileCount, risk, arch, trivial },
+  };
+}
+
+function isValidTier(tier) {
+  return VALID_TIERS.includes(tier);
+}
+
+module.exports = { classifyTier, isValidTier, SIZE_TO_TIER, LARGE_FILE_THRESHOLD };

package/lib/tier-classify.test.cjs

@@ -0,0 +1,67 @@
+'use strict';
+
+const { test } = require('node:test');
+const assert = require('node:assert');
+const { classifyTier, isValidTier, SIZE_TO_TIER } = require('./tier-classify.cjs');
+
+test('TC-1: security keyword forces large→opus regardless of file count', () => {
+  const r = classifyTier({ files_modified: ['app/Auth.php'], name: 'Add password reset flow' });
+  assert.strictEqual(r.size, 'large');
+  assert.strictEqual(r.tier, 'opus');
+  assert.strictEqual(r.signals.risk, true);
+});
+
+test('TC-2: migration path escalates to large', () => {
+  const r = classifyTier({ files_modified: ['db/migrations/003_add_col.sql'], name: 'add column' });
+  assert.strictEqual(r.tier, 'opus');
+  assert.strictEqual(r.signals.risk, true);
+});
+
+test('TC-3: many files → large even without risk/arch keywords', () => {
+  const r = classifyTier({ files_modified: ['a.ts', 'b.ts', 'c.ts', 'd.ts', 'e.ts', 'f.ts'], name: 'wire feature' });
+  assert.strictEqual(r.size, 'large');
+  assert.strictEqual(r.tier, 'opus');
+});
+
+test('TC-4: architectural keyword → large', () => {
+  const r = classifyTier({ files_modified: ['svc.ts'], name: 'refactor the orchestration interface' });
+  assert.strictEqual(r.size, 'large');
+  assert.strictEqual(r.signals.arch, true);
+});
+
+test('TC-5: single-file doc/typo → trivial→haiku', () => {
+  const r = classifyTier({ files_modified: ['README.md'], name: 'fix typo in readme' });
+  assert.strictEqual(r.size, 'trivial');
+  assert.strictEqual(r.tier, 'haiku');
+  assert.strictEqual(r.signals.trivial, true);
+});
+
+test('TC-6: ordinary single-concern → standard→sonnet', () => {
+  const r = classifyTier({ files_modified: ['app/Service.php', 'app/Service.test.php'], name: 'add discount calculation' });
+  assert.strictEqual(r.size, 'standard');
+  assert.strictEqual(r.tier, 'sonnet');
+});
+
+test('TC-7: trivial keyword but multiple files is NOT trivial', () => {
+  const r = classifyTier({ files_modified: ['a.ts', 'b.ts'], name: 'rename helper' });
+  assert.strictEqual(r.size, 'standard');
+});
+
+test('TC-8: empty/missing input → standard, no throw', () => {
+  const r = classifyTier({});
+  assert.strictEqual(r.size, 'standard');
+  assert.strictEqual(r.signals.file_count, 0);
+  const r2 = classifyTier(null);
+  assert.strictEqual(r2.size, 'standard');
+});
+
+test('TC-9: every emitted tier is a valid tier', () => {
+  for (const size of Object.keys(SIZE_TO_TIER)) {
+    assert.ok(isValidTier(SIZE_TO_TIER[size]), size + ' maps to a valid tier');
+  }
+});
+
+test('TC-10: deterministic — same input twice yields identical result', () => {
+  const input = { files_modified: ['x.ts'], name: 'add token validation' };
+  assert.deepStrictEqual(classifyTier(input), classifyTier(input));
+});

package/np-tools.cjs

@@ -26,6 +26,10 @@ const initWorkflows = {
 
 const topLevelCommands = {
   'agent-skills': require('./bin/np-tools/agent-skills.cjs'),
+  'derive-tier':  require('./bin/np-tools/derive-tier.cjs'),
+  'verify-reliability': require('./bin/np-tools/verify-reliability.cjs'),
+  'learnings':    require('./bin/np-tools/learnings.cjs'),
+  'skill-audit':  require('./bin/np-tools/skill-audit.cjs'),
 
   'commit-task':  require('./bin/np-tools/commit-task.cjs'),
   'checkpoint':   require('./bin/np-tools/checkpoint.cjs'),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nubos-pilot",
-  "version": "1.2.2",
+  "version": "1.2.3",
   "description": "Self-hosted AI pilot for any codebase. Researcher and critic agents plan, execute and verify each change.",
   "homepage": "https://pilot.nubos.cloud",
   "repository": {

package/skills/np-access-control/SKILL.md

@@ -0,0 +1,42 @@
+---
+name: np-access-control
+description: "Quality bar for any change that adds or modifies authorization — roles, permissions, policies, scopes, resource ownership, RBAC/ABAC rules, or the checks that gate a protected action. Triggered for executor and architect work on policies, guards, middleware, permission tables, ownership lookups, or anywhere code decides what an identity may do. Encodes authorization rules the change MUST satisfy before commit — not a document to author. Language- and framework-agnostic."
+user-invocable: false
+---
+
+# Access Control
+
+Authorization decides what an authenticated identity may do. It is the layer attackers reach *after* login, so a logged-in user is not an authorized one. Apply this bar to every access decision the change adds or touches. A missing check is a blocking finding, not a nit.
+
+## Before editing
+
+- Read the existing authz model: `node .nubos-pilot/bin/np-tools.cjs knowledge-search "authorization policy roles permissions" --task $TASK_ID`. Match the established enforcement pattern, role names, and policy idiom; do not introduce a second one.
+- Locate the single point where access is enforced for this surface. Add your check there, not in a new ad-hoc spot.
+
+## Deny by default
+
+- Access is granted explicitly, never assumed. A new action, route, field, or resource starts forbidden and is opened deliberately.
+- A missing or unrecognized role/permission means deny, not allow. No fail-open branches, no "if no rule matched, proceed".
+- Adding a route or handler never silently widens access.
+
+## Enforce server-side, at the right object
+
+- Every protected action is authorized on the server. Client-side hiding is UX, never a control — the agent and the user can both call the endpoint directly.
+- Check against the *acting* identity, resolved from the session/token — never a role, user id, or `isAdmin` supplied in the request body or params.
+- Check against the *specific* resource (object-level authz). Prevent IDOR: a resource id from the request is untrusted until an ownership/permission lookup confirms this identity may act on *that* object. Listing endpoints filter to the caller's scope; they do not return all rows and trim client-side.
+
+## Model least privilege, keep it auditable
+
+- Grant the narrowest role/scope that makes the change work. No "admin to ship it", no wildcard scope where a specific one suffices.
+- Separate authentication from authorization: who-you-are and what-you-may-do are distinct decisions; passing the first never implies the second.
+- Roles, permissions, and policies are modeled explicitly and centrally — readable as data/code, not scattered as inline `if user.email ==` conditionals across handlers.
+- Privilege changes (grant, revoke, role change) take effect immediately on the next request — no stale cached grant — and are logged with who/what/when.
+
+## Verification bar (must hold before commit)
+
+- Every protected action has a server-side check on the acting identity and the specific resource; no IDOR path remains.
+- Default is deny: unmatched/unknown permissions reject, and the new surface is not reachable without an explicit grant.
+- The change uses the existing authz model and the narrowest privilege that works — no scattered, no client-trusted, no over-broad grant.
+- Grant/revoke takes effect immediately and is logged.
+- The forbidden case is proven forbidden: a negative-path test asserts an unauthorized identity and a wrong-owner resource are denied — not just that the happy path is allowed. Pair with [np-test-strategy] for those negative cases, [np-secure-code-review] for the surrounding input/auth surface, and [np-secure-design] when the change introduces a new trust boundary or privilege tier.
+- If any item cannot be satisfied within task scope, stop and surface it as an authorization finding — do not commit around it.

package/skills/np-accessibility-audit/SKILL.md

@@ -0,0 +1,41 @@
+---
+name: np-accessibility-audit
+description: "Quality bar for changes that add or modify any UI surface — components, pages, forms, or markup (.tsx/.jsx/.vue/.svelte, views/components/pages). Triggered for executor work on user-facing rendering; encodes a WCAG 2.x AA checklist the change MUST satisfy before commit, not an audit document to author. Language- and framework-agnostic."
+user-invocable: false
+---
+
+# Accessibility Audit
+
+Any UI you build or touch must be usable with a keyboard, a screen reader, and at low vision. This is a bar to meet, not a report to write. Automated checkers catch only part of WCAG — reason about the rest.
+
+## Before editing
+- Read existing conventions: `node .nubos-pilot/bin/np-tools.cjs knowledge-search "accessibility component conventions" --task $TASK_ID`.
+
+## Semantics first
+- Use real elements: `button` for actions, `a[href]` for navigation, `nav`/`main`/`header`/`footer` landmarks, real list and table markup. Never a `div`/`span` with a click handler when an element exists.
+- One `h1` per page; headings descend in order (no skipped levels) and describe structure, not styling.
+- Reach for ARIA only to fill a gap native HTML cannot. Wrong or redundant ARIA is worse than none — no `role="button"` on a `button`, no `aria-label` that contradicts visible text.
+
+## Keyboard and focus
+- Everything interactive is reachable and operable by keyboard alone, in a logical tab order; no keyboard trap.
+- Focus is always visible — never strip the outline without an equal-or-better replacement.
+- Custom widgets implement their expected keys (Esc closes, arrows move within a group, Enter/Space activate).
+- Manage focus on change: move focus into an opened modal and restore it on close; move focus on route change so it doesn't sit on stale content.
+
+## Names, contrast, and signal
+- Every input has a programmatically associated label (`label[for]` or wrapping). Icon-only controls get an accessible name.
+- Meaningful images have descriptive `alt`; decorative images have empty `alt=""`. Use `aria-label` only when there is no visible text to name the element.
+- Text contrast meets AA: 4.5:1 normal, 3:1 large text and UI/graphical boundaries.
+- Never use color as the only carrier of meaning — pair it with text, icon, or shape (errors, status, required fields).
+
+## Dynamic and motion
+- Form errors are associated with their field (`aria-describedby`) and announced; do not signal validity by color alone.
+- Asynchronous updates (toasts, async results, validation) are announced via a live region.
+- Respect `prefers-reduced-motion`: gate non-essential animation and avoid motion that could trigger vestibular issues.
+
+## Verification bar (must hold before commit)
+- The full flow is operable with keyboard only — tab order is logical, focus stays visible, nothing is trapped.
+- Run an automated checker (axe/Lighthouse or equivalent) with zero violations, then manually confirm what it cannot: semantics, focus order, names, and meaningful contrast.
+- Every control and image has an accessible name; no information is conveyed by color alone.
+- Modal/route/async transitions manage focus and announce updates correctly.
+- Cross-check visual choices against [np-web-design-guidelines] and [np-frontend-design]; accessibility constrains, never contradicts, them.

package/skills/np-adr/SKILL.md

@@ -0,0 +1,37 @@
+---
+name: np-adr
+description: "Quality bar for the reasoning behind an architecturally significant decision — a datastore choice, sync vs async, a new external dependency, an auth model, a public contract, or any choice that is costly to reverse, spans multiple components, or constrains future work. Triggered for architect/planner/executor work that makes such a call (typically captured in the milestone ARCHITECTURE artifact). Encodes the decision-recording discipline the reasoning MUST satisfy, not a mandate to author a separate document. Language- and framework-agnostic."
+user-invocable: false
+---
+
+# Architecture Decision Records
+
+A significant decision with no recorded alternatives is a guess wearing a suit. This bar governs the reasoning you commit when you make an architecturally significant call — np's architect already emits ADR-style decisions into the milestone ARCHITECTURE artifact; this is the quality bar for that reasoning, not an instruction to spawn new files.
+
+## Before editing
+
+- Check whether the decision is already recorded or constrained: `node .nubos-pilot/bin/np-tools.cjs knowledge-search "<decision topic>" --task $TASK_ID`. If a prior ADR-style decision already covers this, you are superseding it — say so explicitly; don't silently contradict it.
+
+## What is worth recording
+
+- **Significant only.** Record a decision when it is costly to reverse, affects multiple components, introduces a new external dependency, or constrains future choices: datastore choice, sync vs async, an auth/permission model, a public contract, a serialization format. Ignore the trivial — a local variable name or a one-file refactor is not an ADR.
+- **One decision per record.** Don't bundle "we'll use Postgres and also restructure auth" — split them. Each stands or falls on its own forces.
+
+## What the record must capture
+
+- **Context / forces.** The constraints and pressures that make this a real decision — load, team, deadlines, existing stack, compliance. Without forces the decision looks arbitrary later.
+- **The decision.** Stated plainly, in the active voice: what was chosen.
+- **Consequences, good and bad.** Name what this buys you *and* what it costs — the lock-in, the new failure mode, the operational burden. A record listing only upsides is marketing, not engineering.
+- **Alternatives considered and why rejected (load-bearing).** This is the value. At least one real alternative with the concrete reason it lost. "We considered X but rejected it because Y" — no Y means no decision was actually made.
+
+## Timing & immutability
+
+- **Record at decision time, not retroactively.** Reconstructed reasoning launders out the forces that were actually live; capture it while the trade-off is still in your hands.
+- **Immutable once accepted.** Don't rewrite an accepted decision — supersede it with a new one that references the old. The history of *why we changed our minds* is itself the asset.
+
+## Verification bar (must hold before commit)
+
+- The decision is genuinely significant (hard to reverse / cross-component / constrains the future) — trivial calls are not recorded as ADRs.
+- At least one real rejected alternative is named *with* its reason; consequences list both the wins and the costs.
+- It is a single decision, recorded now (not reconstructed), and any prior decision it overrides is explicitly superseded, not silently edited.
+- The forces tie to the actual system constraints — cross-check the structural framing against [np-system-design] and any boundary impact against [np-service-boundary].

package/skills/np-api-design/SKILL.md

@@ -0,0 +1,34 @@
+---
+name: np-api-design
+description: "Quality bar for changes that add or modify an API surface — HTTP/REST endpoints, RPC handlers, GraphQL resolvers, public library/SDK functions, CLI flags, or any contract another system consumes. Triggered for executor work on controllers, routes, handlers, resolvers, or public interfaces. Encodes contract-design rules the change MUST satisfy before commit, not a spec document to author. Language- and framework-agnostic."
+user-invocable: false
+---
+
+# API Design
+
+An API is a promise. Every endpoint, flag, or exported function you add or touch is a contract you will have to keep. Apply this bar to the contract you are about to commit.
+
+## Before editing
+
+- Read the project's existing API conventions first: `node .nubos-pilot/bin/np-tools.cjs knowledge-search "api endpoint conventions" --task $TASK_ID`. Match the established naming, versioning, error-shape, and pagination idiom — consistency beats personal preference.
+
+## Contract rules
+
+- **Names describe resources and intent**, not implementation. Plural nouns for collections, verbs only where REST nouns don't fit (RPC/CLI). No leaking internal table/class names into the public surface.
+- **Inputs are validated and documented at the boundary.** Required vs optional is explicit; unknown fields are rejected or ignored deliberately, never silently mutating behavior.
+- **Responses are stable and typed.** One consistent envelope/error shape across the surface. Don't return a bare array where the rest of the API returns an object — additive evolution requires room to grow.
+- **Errors are actionable and consistent.** Correct status/category, a stable machine-readable code, and a message that tells the caller what to fix. Same error model everywhere.
+- **Idempotency & methods match semantics.** Safe methods don't mutate; retries of idempotent operations don't double-apply. State this for any write path.
+- **Pagination, filtering, sorting** follow the existing pattern for any collection that can grow unbounded. No unbounded list endpoints.
+
+## Compatibility (load-bearing)
+
+- A change to an *existing* contract is breaking until proven otherwise: removed/renamed fields, narrowed types, new required inputs, changed defaults, altered error codes. If breaking, either version it or stop and surface it — never silently break consumers.
+- Additive change is the default safe move: new optional input, new field, new endpoint.
+
+## Verification bar (must hold before commit)
+
+- Every new/changed input is validated; every response and error follows the surface's existing shape.
+- No accidental breaking change to an existing contract (or it is explicitly versioned + flagged).
+- Auth and rate/abuse considerations for the new surface are handled — pair with [np-secure-code-review] for any authenticated or input-accepting endpoint.
+- The contract is discoverable: types/signatures are explicit enough that a consumer needs no source-reading to call it correctly.

package/skills/np-caching-strategy/SKILL.md

@@ -0,0 +1,38 @@
+---
+name: np-caching-strategy
+description: "Quality bar for changes that add or modify a cache — in-memory caches, Redis/Memcached or other distributed caches, HTTP/CDN response caching, or memoization of a computed value. Triggered for executor work that introduces or alters any layer that stores and reuses a previously computed or fetched result. Encodes caching-correctness rules the change MUST satisfy before commit, not a design document to author. Language- and framework-agnostic."
+user-invocable: false
+---
+
+# Caching Strategy
+
+A cache is a correctness liability you take on to buy speed, not a free win. Every entry you store is a second source of truth that can lie. Apply this bar to the cache you are about to commit.
+
+## Before editing
+
+- Read the project's existing caching conventions first: `node .nubos-pilot/bin/np-tools.cjs knowledge-search "cache invalidation TTL key" --task $TASK_ID`. Match the established cache layer, key prefix, serialization, and invalidation idiom — don't introduce a second caching mechanism alongside one that already works.
+
+## Justify the cache
+
+- **Cache only when measurement shows it helps and correctness allows it.** Have a real number — the cost being avoided (slow query, expensive computation, remote call) and the hit rate you expect. No cache "just in case"; an unmeasured cache adds risk and buys nothing.
+- **The cache is an optimization, not a dependency.** The system MUST stay correct with the cache empty or unavailable — same answer, slower. A miss recomputes the true value; the cache never becomes the only place data lives.
+
+## Key & correctness
+
+- **The key captures every input that changes the value.** Identity, tenant, locale, permission scope, feature flags, API version — anything that varies the result varies the key. A cache that serves one user's data to another is a security incident, not a performance bug.
+- **Never store per-user secrets or sensitive data in a shared cache.** Scope sensitive entries per principal or keep them out entirely — pair with [np-secure-code-review] for anything auth- or PII-adjacent.
+
+## Invalidation & bounds (load-bearing)
+
+- **Every cache has an explicit invalidation story** — TTL, write-through, or event-based. "Stale forever" is a bug. State, for this cache, how an entry becomes wrong and what removes or refreshes it; write paths that change cached data must invalidate or update it.
+- **The cache is bounded.** Max size plus an eviction policy (LRU/TTL) so it cannot grow until it exhausts memory. An unbounded cache is a memory leak with a delay.
+- **Expiry handles the stampede.** When a hot key expires, concurrent misses must not all stampede the backing store — use a lock/single-flight, staggered TTLs, or stale-while-revalidate.
+
+## Verification bar (must hold before commit)
+
+- A measured reason this cache exists; the system is provably correct with the cache empty (miss recomputes the true value).
+- The key includes every value-varying input (identity/tenant/locale/permissions) — no cross-principal or cross-context bleed.
+- An explicit invalidation path exists and every write that changes the cached value triggers it — no path leaves an entry stale forever.
+- The cache is size-bounded with an eviction policy; expiry of a hot key cannot stampede the backing store.
+- No per-user secret or sensitive value lands in a shared cache — pair with [np-secure-code-review].
+- Cross-link [np-performance] for the hit-rate / latency claim and [np-data-modeling] for what the cached shape represents and how it stays consistent with its source.

package/skills/np-data-modeling/SKILL.md

@@ -0,0 +1,37 @@
+---
+name: np-data-modeling
+description: "Quality bar for changes that touch a data model, database schema, or migration — new tables/columns/entities, type or nullability changes, constraints, indexes, ORM model edits, or any backfill/transform of persisted data. Triggered for executor work on migrations, schema definitions, entity/model classes, or data-shape changes. Encodes modeling-correctness and migration-safety rules the change MUST satisfy before commit, not a schema document to author. Language- and database-agnostic."
+user-invocable: false
+---
+
+# Data Modeling
+
+Persisted data outlives the code that writes it. A schema change is a one-way door under load: it runs against live data, against the old code still in flight, and it cannot be casually undone. Apply this bar to the change you are about to commit.
+
+## Before editing
+
+- Read the project's existing schema and migration conventions first: `node .nubos-pilot/bin/np-tools.cjs knowledge-search "schema migration conventions" --task $TASK_ID`. Match the established naming, key strategy, timestamp/soft-delete idiom, and migration tooling — consistency beats personal preference.
+
+## Modeling correctness
+
+- **Model the domain, not the screen.** Shape tables around entities and their real relationships, not around one view's convenience. Normalize by default; denormalize only with a stated reason.
+- **Types and precision are exact.** Money is not a float; timestamps carry timezone/UTC intent; enums/identifiers use a bounded type. No string-typing of structured data.
+- **Nullability and defaults are deliberate.** NULL must mean "unknown/absent" by design, never "I didn't decide." Every default is chosen, not inherited by accident.
+- **Invariants live in the database.** Enforce with FK, unique, and check constraints — not application code alone. App-only invariants drift the moment a second writer or a backfill appears.
+- **Index what you query, not everything.** Add indexes for real read paths and FK lookups; each index taxes every write, so don't over-index. Justify composite-column order.
+
+## Migration safety (load-bearing)
+
+- **Backward-compatible and reversible.** Old and new code must both work during rollout. Provide a real down/rollback path, or stop and surface why none exists.
+- **Expand then contract** for any rename, type change, or drop: add the new column → backfill → switch reads then writes → drop the old — as separate, independently deployable steps. Never rename/drop in the same step that introduces the replacement.
+- **No long locks, no online table rewrites.** Adding NOT NULL or a default to a large table, or rewriting it in place, must not hold a blocking lock. Split into add-nullable → batched backfill → enforce.
+- **Backfills are batched and idempotent.** Process in bounded chunks; re-running the migration must not double-apply or corrupt. No single statement that rewrites an unbounded table at once.
+- **Destructive is never silent.** Dropping a column/table, narrowing a type, or deleting rows requires an explicit, surfaced accepted-risk finding — never folded quietly into an unrelated change.
+
+## Verification bar (must hold before commit)
+
+- Types, nullability, and defaults are each a deliberate decision, not a copy-paste default; structured data is not string-typed.
+- Every modeled invariant is backed by a DB constraint, not only app code.
+- The migration is reversible and backward-compatible: old code keeps working mid-rollout, and renames/drops/type-changes use separate expand-then-contract steps.
+- No long lock or unbatched rewrite on a large table; backfills are chunked and idempotent.
+- Any destructive operation carries an explicit, surfaced accepted-risk finding — see [np-secure-code-review] for data exposure and retention, [np-performance] for index/query-shape impact.

package/skills/np-data-privacy/SKILL.md

@@ -0,0 +1,39 @@
+---
+name: np-data-privacy
+description: "Quality bar for executor or architect work that collects, stores, processes, exports, or logs personal or sensitive data — user profiles, contact data, identifiers, location, tracking and analytics events, anything tied to a natural person. Triggered for changes touching such flows: the change MUST satisfy these privacy obligations before commit, not a GDPR essay or DPIA document to author. Jurisdiction-agnostic, GDPR-informed. Language- and framework-agnostic."
+user-invocable: false
+---
+
+# Data Privacy (PII)
+
+Personal data is a liability, not a free asset. Every field you collect, store, or move is something the system must protect, justify, and eventually delete. This bar applies the moment a change touches data tied to a person.
+
+## Before editing
+- Read existing data-handling conventions/classification: `node .nubos-pilot/bin/np-tools.cjs knowledge-search "<query>" --task $TASK_ID`.
+
+## Classify and minimize
+- Know which fields you touch are personal or sensitive (identity, contact, location, health, financial, biometric, behavioral). Treat anything that singles out a person as PII.
+- Collect only what the stated purpose needs. No fields gathered "just in case" or because the schema had room.
+- Prefer references and derived signals over raw PII where the feature allows; pseudonymize or anonymize when identity is not required for the use case.
+
+## Purpose and retention
+- Data collected for one purpose is not silently reused for another. A new use of existing data is a new decision, not a convenience.
+- Every piece of personal data has a defined lifetime and a real deletion path — including derived copies, caches, search indexes, message queues, exports, and backups. Retention with no expiry is a bug.
+- Deletion must actually remove or irreversibly anonymize, not just hide a row behind a flag, unless a flag is a documented soft-delete with a real purge job.
+
+## Boundaries that leak
+- Never write PII into logs, traces, analytics events, error reports, crash dumps, or LLM prompts. Redact or tokenize before it crosses those seams.
+- Do not pass raw personal data to third-party services or models unless the purpose and lawful basis explicitly cover it.
+- Access to personal data is least-privilege and auditable. A read of someone's record leaves a trail.
+
+## Subject rights
+- If the system promises export or deletion of a person's data, the change must keep that promise reachable — new stores and copies are included in export and erasure, not orphaned.
+
+## Verification bar (must hold before commit)
+- Every personal/sensitive field the change introduces is identified and justified by a concrete purpose; nothing is collected speculatively.
+- Each new store of PII has a defined retention and a deletion/anonymization path that also covers caches, indexes, and backups.
+- No PII reaches logs, analytics, error reporting, or LLM prompts — verified against [np-observability] redaction conventions.
+- Data is not reused beyond its original purpose without an explicit, recorded decision.
+- Sensitive personal data at rest and in transit is encrypted per [np-encryption]; access is least-privilege and audited per [np-access-control].
+- Export and deletion flows the system promises still cover every store this change adds.
+- Any new high-risk processing flow (large-scale, sensitive, profiling, or cross-border) is flagged for privacy review before it ships, not after.

package/skills/np-dependency-audit/SKILL.md

@@ -0,0 +1,47 @@
+---
+name: np-dependency-audit
+description: "Quality bar for changes that add or upgrade a third-party dependency — a new package/library, a version bump, or an edit to a manifest (package.json, composer.json, go.mod, Cargo.toml, requirements/pyproject, Gemfile, pom/gradle) or its lockfile. Triggered for executor work that touches dependency declarations or lockfiles. Encodes supply-chain and dependency-hygiene rules the change MUST satisfy before commit, not a document to author. Language- and ecosystem-agnostic."
+user-invocable: false
+---
+
+# Dependency Audit
+
+Every dependency you add is a permanent liability you now maintain and a new surface for a supply-chain attack. The bar is not "does it work" — it is "is this dependency justified, vetted, pinned, and minimal." Apply it to the manifest/lockfile change you are about to commit.
+
+## Before editing
+
+- Check what's already in the tree and prior decisions: `node .nubos-pilot/bin/np-tools.cjs knowledge-search "dependency for <need>" --task $TASK_ID`. A capability already pulled in transitively, or a deliberately-rejected package, beats a new top-level dep.
+
+## Justify it
+
+- **Default to no.** Could a few lines of your own code cover the need? Trivial things (padding, slug, uuid, simple debounce) are not worth a dependency and its update treadmill.
+- **Prefer the standard library / platform.** Reach for a dependency only when it earns its keep over what the language or runtime already gives you.
+- **Don't duplicate the tree.** If something equivalent is already a dependency, use it instead of adding a second one for the same job.
+
+## Vet it before adding
+
+- **Maintained and alive** — recent commits/releases, issues being addressed, not a one-commit abandonware repo.
+- **Healthy adoption** — real usage, not a near-zero-install package that happens to match the name you typed.
+- **Sane license** — compatible with the project's licensing; no copyleft/unknown license slipping into a proprietary build.
+- **No known critical vulnerabilities** in the version you pick (run the ecosystem's audit/advisory check).
+- **Exact name, no typosquat** — verify the precise package identifier and namespace/scope; a transposed letter or look-alike org is a known attack.
+- **Wary of install hooks** — postinstall/build scripts run arbitrary code on every machine that installs; treat their presence as a reason to look closer, not a default to accept.
+
+## Minimize the surface
+
+- A small package that drags in 50 transitive sub-deps is a big dependency — judge the whole subtree, not the top-level line.
+- Avoid pulling a heavy framework-grade dep for one function.
+
+## Pin and record
+
+- **Pin the version and commit the lockfile** so every build resolves identically — no floating ranges that silently upgrade a transitive package under you.
+- **An upgrade is a change, not a chore.** Read the changelog for breaking changes, and confirm the bump does not introduce a vulnerable or yanked transitive version.
+- **Stay SBOM-aware** — know what actually ships; don't leave dead or unused deps declared.
+
+## Verification bar (must hold before commit)
+
+- The dependency is justified (own code / stdlib / existing dep was considered and rejected for a reason) — not added on reflex.
+- It is vetted: maintained, adopted, license-clean, free of known critical CVEs in the pinned version, exact-name-verified, install-hooks reviewed.
+- Version is pinned and the lockfile is committed; the transitive surface was weighed, not ignored.
+- For an upgrade: changelog read for breaking changes, and no vulnerable transitive version pulled in.
+- Anything the new dep can reach (network, filesystem, credentials, deserialization) is treated as new attack surface — pair with [np-secure-design] for what it touches and [np-secure-code-review] for how it's wired in.

package/skills/np-encryption/SKILL.md

@@ -0,0 +1,47 @@
+---
+name: np-encryption
+description: "Quality bar for any change that encrypts, decrypts, hashes, signs, or verifies data; stores or checks passwords; sets up TLS or certificate handling; generates tokens, nonces, IVs, or salts; or reads, writes, or rotates keys and secrets. Triggered for executor work touching cryptography, password storage, transport security, signing/HMAC, or key/secret management. Encodes crypto rules the change MUST satisfy before commit — not a spec to author. Language- and framework-agnostic."
+user-invocable: false
+---
+
+# Encryption & Key Management
+
+Crypto code is not done when it round-trips in a test — it is done when it would survive a hostile reviewer. The failure mode is silent: a broken cipher mode, a reused nonce, or a leaked key produces output that looks correct. Apply every relevant section to the diff. A single unaddressed item is a blocking finding, not a nit.
+
+## Before editing
+
+- Read existing crypto conventions / locked decisions: `node .nubos-pilot/bin/np-tools.cjs knowledge-search "<query>" --task $TASK_ID`. Reuse the project's chosen library and key store; do not introduce a second.
+- Locked decisions in RULES/CONTEXT (cipher, hasher, key source, rotation policy) override every generic default below.
+
+## Never roll your own
+
+- Use the platform's vetted, current high-level crypto library — not raw block-cipher calls, not a hand-built construction. If you are choosing modes, padding, or combining primitives by hand, stop.
+- Pick the right tool. Hashing is one-way (integrity, dedup, fingerprints). Encryption is reversible (confidentiality). Signing/HMAC proves authenticity. Do not substitute one for another.
+
+## Hashing & passwords
+
+- Passwords go through a slow, salted password hasher (argon2/bcrypt/scrypt or the project's chosen one) with a per-secret salt. Never MD5/SHA1/plain-SHA256 for passwords.
+- General-purpose fast hashes are for integrity/identity only, never for secrets that must resist guessing.
+
+## Encryption
+
+- Use authenticated encryption (AEAD, e.g. AES-GCM / ChaCha20-Poly1305). Never ECB. Never unauthenticated CBC where tampering matters.
+- A fresh IV/nonce per message from a CSPRNG. Never a static, zero, or reused IV/nonce — reuse breaks the cipher.
+- Encrypt sensitive data in transit: TLS everywhere, verify certificates, no protocol/cipher downgrade, no disabled verification. Encrypt at rest where the threat model requires it.
+
+## Keys, secrets & randomness
+
+- Keys and secrets live in a secret store / KMS / env — NEVER in source, config-in-repo, fixtures, or logs. No key material in error messages or URLs.
+- Scope keys to purpose and plan rotation: rotation must not orphan data encrypted under the old key.
+- Use a CSPRNG for anything security-relevant — tokens, IVs, salts, session ids. Never a normal/seedable RNG.
+- Compare secrets, tokens, MACs, and signatures in constant time. Never `==` on a secret.
+
+## Verification bar (must hold before commit)
+
+- No home-rolled crypto; a vetted current primitive/library is used for the right job (hash vs encrypt vs sign).
+- Passwords use a slow salted hasher; no MD5/SHA1 for any secret.
+- Encryption is AEAD with a CSPRNG-fresh IV/nonce; no ECB, no static/reused nonce.
+- Data is encrypted in transit with verified TLS; at rest where the threat model demands it.
+- No key or secret introduced into source, config-in-repo, or logs; rotation and scoping are accounted for.
+- All security-relevant randomness is CSPRNG; secret comparisons are constant-time.
+- If any item cannot be satisfied within task scope, stop and surface it as a finding — do not commit around it. Pair with [np-secure-code-review] for the sink-level review, [np-secure-design] when the change adds a new key or trust boundary, and [np-data-privacy] when the data is personal/regulated.

package/skills/np-error-handling/SKILL.md

@@ -0,0 +1,37 @@
+---
+name: np-error-handling
+description: "Quality bar for changes that touch backend, service, integration, or IO code that can fail — network calls, database writes, external APIs, file/queue/process work, batch loops. Triggered for executor work on any failure-prone path; encodes the resilience checklist the change MUST satisfy before commit (fail loud, preserve cause, timeouts, bounded retries, idempotency, resource cleanup, actionable errors), not a doc to author. Language- and framework-agnostic."
+user-invocable: false
+---
+
+# Error Handling & Resilience
+
+Code that can fail must fail predictably. The bar below is about what the change does on the unhappy path, not the happy one.
+
+## Before editing
+- Read existing conventions: `node .nubos-pilot/bin/np-tools.cjs knowledge-search "error handling retry conventions" --task $TASK_ID`. Match the established error/retry idiom rather than inventing a new one.
+
+## Fail loud, preserve context
+- No empty catch and no catch-and-continue that hides a failure. If you catch, you handle, rethrow, or log-and-escalate.
+- Distinguish recoverable errors (retry, fallback, degrade) from programmer errors (bug — let it crash, don't paper over).
+- When wrapping an error, preserve the original cause/stack/chain. Never discard the inner error to throw a vague new one.
+- Surface actionable errors to callers: enough to act on, no internals (no stack traces, secrets, SQL, or host details leaking across a trust boundary).
+
+## Outbound calls & retries
+- Every outbound or blocking IO call (network, DB, queue, subprocess, lock) has an explicit timeout. No unbounded waits.
+- Retry only idempotent operations. Use backoff with a hard attempt/time cap — no tight retry loops, no retry storms against a struggling dependency.
+- Write paths that may be retried are idempotent (idempotency key, upsert, or dedup) so a retry can't double-apply.
+
+## Cleanup & partial failure
+- The failure path releases what the success path acquired: connections, file handles, locks, temp files, transactions. Prefer finally/defer/with-style guarantees over manual unwind.
+- Validate inputs before mutating state where cheap; otherwise make partial mutation recoverable. Don't leave half-written state on error.
+- Batch/loop work decides explicitly: fail-fast or collect-and-report. Don't let one bad item silently drop the rest or mask which items failed.
+
+## Verification bar (must hold before commit)
+- No silent swallow: every catch handles, rethrows with cause, or escalates — verified, not assumed.
+- Every new outbound/IO call has a timeout; every retry has backoff and a cap; retried writes are idempotent.
+- Failure paths free all acquired resources; no leaked handles, locks, or open transactions.
+- Caller-facing errors are actionable and leak no internals; batch work reports partial failures.
+- Error and retry paths are covered, not just the happy path — see [np-test-strategy].
+- Failures and retries are observable (logged/metered with cause and context) — see [np-observability].
+- Error shapes and status codes returned across an API boundary are consistent — see [np-api-design].