pi-squad 0.6.5 → 0.7.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-squad",
-  "version": "0.6.5",
+  "version": "0.7.2",
   "description": "Multi-agent collaboration extension for pi — task decomposition, dependency management, parallel execution, TUI panel",
   "type": "module",
   "pi": {
@@ -8,7 +8,12 @@
       "src/index.ts"
     ],
     "skills": [
-      "src/skills/squad-supervisor"
+      "src/skills/squad-supervisor",
+      "src/skills/squad-backend-dev",
+      "src/skills/squad-frontend-dev",
+      "src/skills/squad-qa-testing",
+      "src/skills/squad-security-audit",
+      "src/skills/squad-architecture"
     ]
   },
   "files": [

package/src/index.ts

@@ -352,14 +352,15 @@ export default function (pi: ExtensionAPI) {
 						switch (event.type) {
 							case "squad_completed": {
 								const tasks = store.loadAllTasks(squadId);
+								const summary = tasks
+									.filter((t) => t.status === "done")
+									.map((t) => `- ${t.id} (${t.agent}): ${t.output?.slice(0, 150) || "done"}`)
+									.join("\n");
 								const totalCost = tasks.reduce((sum, t) => sum + t.usage.cost, 0);
 								const s = schedulers.get(squadId); if (s) s.updateContext();
-								const overview = store.loadOverview(squadId);
 								pi.sendMessage({
 									customType: "squad-completed",
-									content: `[squad] Squad "${squadId}" completed all ${tasks.length} tasks.\n\n` +
-										(overview ? `## Squad Overview\n\n${overview}\n\n` : "") +
-										`Total cost: $${totalCost.toFixed(4)}`,
+									content: `[squad] Squad "${squadId}" completed all ${tasks.length} tasks.\n\nSummary:\n${summary}\n\nTotal cost: $${totalCost.toFixed(4)}`,
 									display: true,
 								});
 								schedulers.delete(squadId);
@@ -370,12 +371,9 @@ export default function (pi: ExtensionAPI) {
 								const tasks = store.loadAllTasks(squadId);
 								const failed = tasks.filter((t) => t.status === "failed");
 								const done = tasks.filter((t) => t.status === "done");
-								const overview = store.loadOverview(squadId);
 								pi.sendMessage({
 									customType: "squad-failed",
-									content: `[squad] Squad "${squadId}" has stalled. ${done.length}/${tasks.length} done, ${failed.length} failed.\n` +
-										`Failed: ${failed.map((t) => `${t.id}: ${t.error?.slice(0, 100)}`).join("; ")}` +
-										(overview ? `\n\n## Squad Overview\n\n${overview}` : ""),
+									content: `[squad] Squad "${squadId}" has stalled. ${done.length}/${tasks.length} done, ${failed.length} failed.\nFailed: ${failed.map((t) => `${t.id}: ${t.error?.slice(0, 100)}`).join("; ")}`,
 									display: true,
 								}, { triggerTurn: true });
 								forceWidgetUpdate();
@@ -1229,31 +1227,6 @@ async function startSquad(
 
 	store.saveSquad(squad);
 
-	// Create initial OVERVIEW.md with squad goal, task plan, and design contract
-	const planLines = [
-		`# Squad: ${params.goal}`,
-		``,
-		`**Created:** ${squad.created}`,
-		`**Tasks:** ${plan.tasks.length}`,
-		``,
-		`## Task Plan`,
-		``,
-		...plan.tasks.map((t) => {
-			const deps = t.depends.length > 0 ? ` (after: ${t.depends.join(", ")})` : "";
-			return `- **${t.id}** → ${t.agent}: ${t.title}${deps}`;
-		}),
-		``,
-	];
-
-	// Extract design contract from task descriptions — API paths, schemas,
-	// ports, file conventions — so parallel agents share a single source of truth.
-	const contractLines = buildDesignContract(plan.tasks, params.goal);
-	if (contractLines.length > 0) {
-		planLines.push(...contractLines);
-	}
-
-	store.appendOverview(squadId, planLines.join("\n"));
-
 	// Create task files
 	for (const taskDef of plan.tasks) {
 		const task: Task = {
@@ -1301,6 +1274,10 @@ async function startSquad(
 		switch (event.type) {
 				case "squad_completed": {
 				const tasks = store.loadAllTasks(squadId);
+				const summary = tasks
+					.filter((t) => t.status === "done")
+					.map((t) => `- ${t.id} (${t.agent}): ${t.output?.slice(0, 150) || "done"}`)
+					.join("\n");
 				const totalCost = tasks.reduce((sum, t) => sum + t.usage.cost, 0);
 
 				// Final context update before clearing scheduler
@@ -1309,17 +1286,10 @@ async function startSquad(
 					completedSched.updateContext();
 				}
 
-				// Load the full overview document — contains the narrative of
-				// each task's output, decisions, issues, and files modified.
-				const overview = store.loadOverview(squadId);
-
-				// Send into LLM context (not display-only) so the main agent
-				// knows exactly what happened. No triggerTurn — user decides
-				// what to do next.
 				pi.sendMessage({
 					customType: "squad-completed",
 					content: `[squad] Squad "${squadId}" completed all ${tasks.length} tasks.\n\n` +
-						(overview ? `## Squad Overview\n\n${overview}\n\n` : "") +
+						`Summary:\n${summary}\n\n` +
 						`Total cost: $${totalCost.toFixed(4)}`,
 					display: true,
 				});
@@ -1334,14 +1304,12 @@ async function startSquad(
 				const tasks = store.loadAllTasks(squadId);
 				const failed = tasks.filter((t) => t.status === "failed");
 				const done = tasks.filter((t) => t.status === "done");
-				const overview = store.loadOverview(squadId);
 
 				pi.sendMessage({
 					customType: "squad-failed",
 					content: `[squad] Squad "${squadId}" has stalled. ` +
 						`${done.length}/${tasks.length} tasks done, ${failed.length} failed.\n` +
 						`Failed: ${failed.map((t) => `${t.id}: ${t.error?.slice(0, 100)}`).join("; ")}\n` +
-						(overview ? `\n## Squad Overview\n\n${overview}\n\n` : "\n") +
 						`Use squad_status for details or squad_modify to adjust.`,
 					display: true,
 				}, { triggerTurn: true });
@@ -1403,98 +1371,4 @@ function getSquadSkillPaths(skillsDir: string): string[] {
 		.filter((dir) => fs.existsSync(path.join(dir, "SKILL.md")));
 }
 
-/**
- * Extract a design contract from task descriptions.
- *
- * Scans all tasks for API paths, ports, file names, data schemas, and
- * shared conventions. Produces a "## Design Contract" section in the
- * OVERVIEW.md so that ALL agents (including parallel ones) share a
- * single source of truth before they start working.
- */
-function buildDesignContract(
-	tasks: Array<{ id: string; title: string; description: string; agent: string; depends: string[] }>,
-	goal: string,
-): string[] {
-	const lines: string[] = [];
-
-	// Collect API routes mentioned in any task description
-	const apiRoutes: string[] = [];
-	const ports: string[] = [];
-	const files: string[] = [];
-	const schemas: string[] = [];
-
-	const allText = tasks.map((t) => `${t.title}\n${t.description}`).join("\n") + "\n" + goal;
-
-	// Extract API paths like GET /foo, POST /bar/:id
-	const routePattern = /\b(GET|POST|PUT|PATCH|DELETE|HEAD)\s+(\/[\w\/:]+)/gi;
-	for (const match of allText.matchAll(routePattern)) {
-		const route = `${match[1].toUpperCase()} ${match[2]}`;
-		if (!apiRoutes.includes(route)) apiRoutes.push(route);
-	}
-
-	// Extract port numbers
-	const portPattern = /\b(?:port|PORT|Port)\s*[=:]?\s*(\d{4,5})\b/gi;
-	for (const match of allText.matchAll(portPattern)) {
-		if (!ports.includes(match[1])) ports.push(match[1]);
-	}
-
-	// Extract key file names mentioned (e.g., server.js, index.html)
-	const filePattern = /\b([\w-]+\.(js|ts|json|html|css|sh|mjs|cjs))\b/gi;
-	for (const match of allText.matchAll(filePattern)) {
-		const f = match[1];
-		if (!files.includes(f) && !['package.json'].includes(f)) files.push(f);
-	}
-
-	// Extract data schemas like {field, field, field}
-	const schemaPattern = /\{([a-zA-Z_][\w,\s\[\]?]+)\}/g;
-	for (const match of allText.matchAll(schemaPattern)) {
-		const fields = match[1].trim();
-		if (fields.includes(',') && fields.length > 5 && fields.length < 200) {
-			if (!schemas.includes(fields)) schemas.push(fields);
-		}
-	}
-
-	// Only emit a contract section if we found shared design elements
-	if (apiRoutes.length === 0 && ports.length === 0 && schemas.length === 0) {
-		return [];
-	}
-
-	lines.push(`## Design Contract`);
-	lines.push(``);
-	lines.push(`> **All agents MUST follow these specifications.** Do not invent`);
-	lines.push(`> alternative paths, ports, or schemas. If you need to deviate,`);
-	lines.push(`> document the reason in your output.`);
-	lines.push(``);
-
-	if (ports.length > 0) {
-		lines.push(`### Server`);
-		lines.push(`- Port: **${ports.join(", ")}**`);
-		lines.push(``);
-	}
-
-	if (apiRoutes.length > 0) {
-		lines.push(`### API Endpoints`);
-		for (const r of apiRoutes) {
-			lines.push(`- \`${r}\``);
-		}
-		lines.push(``);
-	}
 
-	if (schemas.length > 0) {
-		lines.push(`### Data Schemas`);
-		for (const s of schemas) {
-			lines.push(`- \`{ ${s} }\``);
-		}
-		lines.push(``);
-	}
-
-	if (files.length > 0) {
-		lines.push(`### Key Files`);
-		for (const f of files) {
-			lines.push(`- \`${f}\``);
-		}
-		lines.push(``);
-	}
-
-	return lines;
-}

package/src/protocol.ts

@@ -11,7 +11,7 @@
  */
 
 import type { AgentDef, KnowledgeEntry, Squad, Task, TaskMessage } from "./types.js";
-import { loadAllKnowledge, loadAllTasks, loadMessages, loadOverview } from "./store.js";
+import { loadAllKnowledge, loadAllTasks, loadMessages } from "./store.js";
 
 // ============================================================================
 // Squad Protocol (injected into every agent)
@@ -54,9 +54,7 @@ The squad system will detect this and route help.
 ## Rules
 - Stay focused on YOUR task — don't do work assigned to other agents
 - Read the dependency outputs below — don't redo completed work
-- **Follow the Design Contract in the Squad Progress Document** — use the exact API paths, ports, schemas, and file names specified. Do NOT invent alternatives
 - Check the modified files list — coordinate before editing shared files
-- When creating APIs, clearly document all endpoints, request/response shapes, and status codes in your completion output
 - Ask for help if stuck — don't spin for more than a few minutes
 - Verify your work before claiming done
 `;
@@ -116,20 +114,6 @@ ${sections.join("\n---\n\n")}
 `;
 }
 
-// ============================================================================
-// Squad Progress Overview
-// ============================================================================
-
-export function buildOverviewSection(squadId: string): string {
-	const content = loadOverview(squadId);
-	if (!content.trim()) return "";
-
-	return `# Squad Progress Document
-
-${content.trim()}
-`;
-}
-
 // ============================================================================
 // Sibling Awareness
 // ============================================================================
@@ -309,7 +293,6 @@ export function buildAgentSystemPrompt(options: ProtocolBuildOptions): string {
 		buildTaskSection(task),
 		buildReworkContext(task, squadId),
 		buildChainContext(task, allTasks, squadId),
-		buildOverviewSection(squadId),
 		buildSiblingAwareness(task, allTasks, modifiedFiles),
 		buildKnowledgeSection(squadId),
 		buildQueuedMessages(queuedMessages),

package/src/scheduler.ts

@@ -463,10 +463,6 @@ export class Scheduler {
 			text: "Task completed",
 		});
 
-		// Reload task after status update so overview has output, completed time, etc.
-		const updatedTask = store.loadTask(this.squadId, taskId) || task;
-		this.appendTaskOverview(updatedTask, taskId, messages);
-
 		this.emit({
 			type: "task_completed",
 			squadId: this.squadId,
@@ -943,88 +939,6 @@ export class Scheduler {
 		return textParts.length > 0 ? textParts.join("\n") : null;
 	}
 
-	// =========================================================================
-	// Overview Document — append task summary after completion
-	// =========================================================================
-
-	/**
-	 * Build a concise markdown summary of a completed task and append it
-	 * to the squad's OVERVIEW.md. This gives subsequent agents a narrative
-	 * understanding of what was accomplished, issues hit, and decisions made.
-	 */
-	private appendTaskOverview(
-		task: Task,
-		taskId: string,
-		messages: import("./types.js").TaskMessage[],
-	): void {
-		try {
-			const lines: string[] = [];
-
-			// Header
-			lines.push(`## ${task.id}: ${task.title}`);
-			lines.push(``);
-			lines.push(`**Agent:** ${task.agent} | **Status:** ${task.status}`);
-			if (task.started && task.completed) {
-				const dur = new Date(task.completed).getTime() - new Date(task.started).getTime();
-				lines.push(`**Duration:** ${formatElapsed(dur)}`);
-			}
-			lines.push(``);
-
-			// Output
-			if (task.output) {
-				lines.push(`### Output`);
-				lines.push(task.output.slice(0, 800));
-				if (task.output.length > 800) lines.push(`... (truncated)`);
-				lines.push(``);
-			}
-
-			// Issues / errors encountered
-			const errors = messages.filter((m) => m.type === "error" && m.from !== "system");
-			if (errors.length > 0) {
-				lines.push(`### Issues Encountered`);
-				for (const err of errors.slice(-5)) {
-					lines.push(`- ${err.text.split("\n")[0].slice(0, 200)}`);
-				}
-				lines.push(``);
-			}
-
-			// Decisions — scan agent text for decision-like language
-			const decisionPatterns = /\b(decided|chose|approach|instead of|trade-?off|opted|going with|switched to|using .+ because)\b/i;
-			const agentTexts = messages.filter((m) => m.from === task.agent && m.type === "text");
-			const decisions: string[] = [];
-			for (const msg of agentTexts) {
-				for (const line of msg.text.split("\n")) {
-					if (decisionPatterns.test(line) && line.trim().length > 10) {
-						decisions.push(line.trim().slice(0, 200));
-					}
-				}
-			}
-			if (decisions.length > 0) {
-				lines.push(`### Decisions`);
-				for (const d of decisions.slice(-5)) {
-					lines.push(`- ${d}`);
-				}
-				lines.push(``);
-			}
-
-			// Files modified
-			const activity = this.pool.getActivity(taskId);
-			if (activity && activity.modifiedFiles.size > 0) {
-				lines.push(`### Files Modified`);
-				for (const f of Array.from(activity.modifiedFiles).slice(0, 15)) {
-					lines.push(`- ${f}`);
-				}
-				if (activity.modifiedFiles.size > 15) {
-					lines.push(`- ... and ${activity.modifiedFiles.size - 15} more`);
-				}
-				lines.push(``);
-			}
-
-			store.appendOverview(this.squadId, lines.join("\n"));
-		} catch (err) {
-			logError("squad-scheduler", `Failed to append overview for ${taskId}: ${(err as Error).message}`);
-		}
-	}
 }
 
 function formatElapsed(ms: number): string {

package/src/skills/squad-architecture/SKILL.md

@@ -0,0 +1,53 @@
+---
+name: squad-architecture
+description: >
+  System architecture practices — project structure, API contracts, shared types,
+  monorepo setup, and technical decision documentation. Use when designing system
+  architecture, defining contracts between components, or setting up project structure.
+version: 1.0.0
+---
+
+# Architecture & System Design
+
+## Project Structure
+- Define clear boundaries between components (backend, frontend, shared)
+- Use a monorepo with workspaces when frontend and backend share types
+- Create a shared types/constants package that both sides import
+- Document the project structure in a README or ARCHITECTURE.md
+
+## API Contract Definition
+When defining API contracts that other agents will implement:
+- List EVERY endpoint with method, path, request body, and response shape
+- Specify exact field names, types, and which fields are optional
+- Define error response format consistently
+- Specify authentication requirements per endpoint
+- Include example request/response pairs
+
+Example:
+```
+POST /api/auth/login
+  Request:  { email: string, password: string }
+  Response: { user: { id, email, name }, accessToken: string, refreshToken: string }
+  Errors:   401 { error: "Invalid credentials" }
+```
+
+## Shared Types
+- Define TypeScript interfaces for all data models
+- Include validation schemas (zod) alongside types
+- Export constants (status enums, priority levels, config values)
+- Version the shared package so consumers know when contracts change
+
+## Technical Decisions
+Document every significant decision in your output:
+- What was decided and why
+- What alternatives were considered
+- What trade-offs were accepted
+
+This helps downstream agents understand the rationale and stay consistent.
+
+## Handoff Quality
+Your output is the contract that all other agents build against. Be precise:
+- Don't leave ambiguity in field names or types
+- Specify exact port numbers, file paths, directory structure
+- Include the database schema with column types and constraints
+- List all environment variables needed

package/src/skills/squad-backend-dev/SKILL.md

@@ -0,0 +1,45 @@
+---
+name: squad-backend-dev
+description: >
+  Backend engineering practices — API design, database patterns, auth implementation,
+  input validation, error handling, and security. Use when building APIs, servers,
+  databases, or backend services.
+version: 1.0.0
+---
+
+# Backend Development
+
+## API Design
+- RESTful conventions: GET (read), POST (create), PUT (replace), PATCH (update), DELETE (remove)
+- Consistent response format: success returns data directly, errors return `{ error: string, code?: string }`
+- Validate all inputs at the boundary (use zod, joi, or manual checks)
+- Paginate list endpoints (limit/offset or cursor-based)
+- Use proper HTTP status codes: 200 OK, 201 Created, 400 Bad Request, 401 Unauthorized, 403 Forbidden, 404 Not Found, 409 Conflict, 500 Server Error
+- Document every endpoint in your completion output (method, path, request/response shape)
+
+## Database
+- Use migrations for schema changes (never ALTER in application code)
+- Add indexes for frequently queried columns and foreign keys
+- Use foreign keys with appropriate ON DELETE behavior (CASCADE, SET NULL)
+- Use transactions for multi-step writes
+- Sanitize all user inputs in queries (parameterized queries, never string interpolation)
+
+## Authentication
+- Never store passwords in plain text — use bcrypt with sufficient rounds (10+)
+- JWT access tokens: short-lived (15min), stateless verification
+- Refresh tokens: longer-lived (7d), stored server-side, rotated on use
+- Validate tokens on every protected endpoint via middleware
+- Return 401 for invalid/expired tokens, 403 for insufficient permissions
+
+## Error Handling
+- Catch errors at route level, don't let unhandled rejections crash the server
+- Log errors with context (request id, user id, endpoint)
+- Never expose stack traces or internal details in API responses
+- Use typed error classes for different error categories
+- Implement graceful shutdown (close DB connections, finish in-flight requests)
+
+## Security
+- Rate-limit public endpoints (login, register, password reset)
+- Set security headers (CORS, Helmet for Express)
+- Validate file uploads (type whitelist, size limits)
+- Never log sensitive data (passwords, tokens, PII)

package/src/skills/{collaboration → squad-collaboration}/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: collaboration
+name: squad-collaboration
 description: Multi-agent collaboration patterns — how to build on others' work, ask questions, share knowledge, and work as a team.
 ---
 

package/src/skills/squad-frontend-dev/SKILL.md

@@ -0,0 +1,51 @@
+---
+name: squad-frontend-dev
+description: >
+  Frontend engineering practices — React patterns, CSS/Tailwind, accessibility,
+  state management, API integration, and responsive design. Use when building
+  UIs, web apps, or frontend components.
+version: 1.0.0
+---
+
+# Frontend Development
+
+## React Patterns
+- Use functional components with hooks (no class components)
+- Extract reusable logic into custom hooks (useAuth, useFetch, useDebounce)
+- Handle all UI states explicitly: loading, error, empty, success
+- Use React.memo only for measured performance bottlenecks
+- Prefer composition over prop drilling — use context for cross-cutting concerns
+- Use controlled components for forms, validate before submit
+
+## State Management
+- Server state: use React Query / TanStack Query (caching, refetching, optimistic updates)
+- Client state: use useState for local, useContext for shared, useReducer for complex
+- URL state: use router params/search params for bookmarkable state
+- Never duplicate server state in client state — let the query cache be the source of truth
+
+## API Integration
+- Create a typed API client module (don't scatter fetch calls across components)
+- Handle 401 responses globally (refresh token, redirect to login)
+- Show loading indicators for any request > 200ms
+- Handle network errors gracefully (offline banner, retry button)
+- Use optimistic updates for snappy UX (revert on error)
+
+## CSS / Tailwind
+- Use utility classes, avoid custom CSS when possible
+- Follow the project's design tokens (colors, spacing, typography)
+- Use responsive prefixes: sm:, md:, lg:, xl:
+- Implement dark mode with dark: prefix when required
+- Ensure consistent spacing scale (don't mix arbitrary values)
+
+## Accessibility
+- All interactive elements must be keyboard-navigable (tab, enter, escape)
+- Use semantic HTML elements (button, nav, main, section, header, footer)
+- Add aria-labels to icon-only buttons and non-text interactive elements
+- Ensure color contrast meets WCAG AA (4.5:1 for normal text, 3:1 for large)
+- Support screen readers: announce dynamic content changes with aria-live
+
+## Build & Performance
+- Verify the build completes without errors before claiming done
+- Code-split routes (React.lazy + Suspense)
+- Optimize images (lazy loading, proper sizing)
+- Minimize bundle size (check for unnecessary dependencies)

package/src/skills/squad-qa-testing/SKILL.md

@@ -0,0 +1,61 @@
+---
+name: squad-qa-testing
+description: >
+  QA and testing practices — test strategy, checklist, evidence requirements,
+  verdict format, and rework flow. Use when verifying, testing, or reviewing
+  implementations.
+version: 1.0.0
+---
+
+# QA & Testing
+
+## Test Strategy
+1. **Build verification**: Does the code compile/build without errors?
+2. **Smoke test**: Does the app start and respond to basic requests?
+3. **Functional tests**: Do all features work as specified?
+4. **Edge cases**: Invalid inputs, empty states, boundary values
+5. **Integration**: Do components work together (API ↔ frontend, auth flow)?
+
+## Before You Start
+- Read the task description and dependency outputs carefully
+- Understand what was built before testing it
+- Start the server/app and verify it's actually running
+- Don't assume anything works — verify everything
+
+## Testing Checklist
+- [ ] App builds without errors (tsc, vite build, etc.)
+- [ ] Server starts and responds to health check
+- [ ] All CRUD operations work (create, read, update, delete)
+- [ ] Authentication flow works (register, login, protected routes)
+- [ ] Input validation rejects bad data (missing fields, wrong types)
+- [ ] Error responses have correct HTTP status codes
+- [ ] Frontend renders without console errors
+- [ ] Navigation between pages works
+- [ ] Forms submit correctly and show feedback
+
+## Evidence Requirements
+Every claim must have evidence. Don't just say "it works" — show it:
+- **API tests**: Show curl commands and their responses
+- **Build tests**: Show the build command output (exit code 0)
+- **UI tests**: Describe what you see, or use screenshots
+- **Error tests**: Show the error response for invalid input
+
+## Verdict Format
+```
+## Verdict: PASS | FAIL
+
+### Issues Found
+| # | Issue | Severity | Details |
+|---|-------|----------|---------|
+| 1 | ...   | Critical/High/Medium/Low | ... |
+
+### Evidence
+[test output, curl commands, screenshots]
+```
+
+## Rework Flow
+If issues are found:
+1. Document each issue with severity, location, and reproduction steps
+2. The squad system will create fix tasks automatically
+3. You will re-test after fixes are applied
+4. On re-test: verify ALL previous issues are fixed, not just the latest

package/src/skills/squad-security-audit/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: squad-security-audit
+description: >
+  Security audit checklist, vulnerability patterns, and remediation guidance.
+  Use when reviewing code for security issues, hardening an application,
+  or performing security verification.
+version: 1.0.0
+---
+
+# Security Audit
+
+## Checklist
+- [ ] No secrets in source code (API keys, passwords, tokens, connection strings)
+- [ ] All user inputs validated and sanitized
+- [ ] SQL injection prevention (parameterized queries, no string interpolation)
+- [ ] XSS prevention (output encoding, CSP headers, no innerHTML with user data)
+- [ ] Authentication on all protected endpoints
+- [ ] Authorization checks (can THIS user perform THIS action on THIS resource?)
+- [ ] Rate limiting on public endpoints (login, register, password reset)
+- [ ] Secure headers configured (CORS, HSTS, X-Frame-Options, X-Content-Type-Options)
+- [ ] File upload validation (type whitelist, size limits)
+- [ ] Error messages don't leak internal details (stack traces, SQL errors, file paths)
+- [ ] Passwords hashed with bcrypt (not MD5, SHA1, or plain text)
+- [ ] JWT tokens validated on every request (signature, expiry, issuer)
+- [ ] Sensitive data not logged (passwords, tokens, credit cards)
+- [ ] Dependencies checked for known vulnerabilities (npm audit)
+
+## Common Vulnerabilities
+- **Broken Access Control**: Missing auth checks, IDOR (accessing other users' data by changing IDs)
+- **Injection**: SQL, NoSQL, command injection via unsanitized inputs
+- **Broken Auth**: Weak passwords allowed, no rate limiting on login, tokens never expire
+- **Security Misconfiguration**: Default credentials, verbose error pages, unnecessary features enabled
+- **Sensitive Data Exposure**: Secrets in client-side code, PII in logs, HTTP instead of HTTPS
+
+## Reporting Format
+```
+## Security Finding: [Title]
+**Severity**: Critical | High | Medium | Low
+**Location**: [file:line or endpoint]
+**Description**: What's wrong
+**Impact**: What could happen if exploited
+**Remediation**: How to fix it (specific code change)
+```

package/src/skills/{verification → squad-verification}/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: verification
+name: squad-verification
 description: Verify work before claiming completion — evidence-based discipline for multi-agent handoffs.
 ---
 

package/src/store.ts

@@ -405,32 +405,6 @@ export function loadAllKnowledge(squadId: string): KnowledgeEntry[] {
 	].sort((a, b) => a.ts.localeCompare(b.ts));
 }
 
-// ============================================================================
-// Overview Document (shared squad summary)
-// ============================================================================
-
-export function getOverviewPath(squadId: string): string {
-	return path.join(getSquadDir(squadId), "OVERVIEW.md");
-}
-
-export function loadOverview(squadId: string): string {
-	try {
-		return fs.readFileSync(getOverviewPath(squadId), "utf-8");
-	} catch {
-		return "";
-	}
-}
-
-export function appendOverview(squadId: string, section: string): void {
-	const filePath = getOverviewPath(squadId);
-	ensureDir(path.dirname(filePath));
-	const existing = loadOverview(squadId);
-	const content = existing
-		? existing.trimEnd() + "\n\n---\n\n" + section.trim() + "\n"
-		: section.trim() + "\n";
-	fs.writeFileSync(filePath, content, "utf-8");
-}
-
 // ============================================================================
 // Rework Helpers
 // ============================================================================