rust-intel-cc 0.4.5

package/LICENSE-APACHE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 rust-intel contributors
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/LICENSE-MIT

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 phpcraftdream@gmail.com and contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,211 @@
+בס״ד
+
+לכבוד הקדוש ברוך הוא — *for the glory of the Holy One, blessed be He*
+
+# rust-intel
+
+A living specification that defends against the systematic mistakes LLMs make when writing Rust.
+
+## What this is
+
+An empirically-grounded ruleset for the Rust mistakes that **survive `cargo build` and `cargo test`** but still wreck things in production or rot the codebase over time. Every category is backed by a specific study, production incident, or systematically observed LLM output pattern — see [`docs/sources.md`](docs/sources.md).
+
+> **Per-rule grounding ≠ measured coverage.** Each category is grounded individually (above), but there is no regression corpus yet that measures *what fraction* of real silent-failure bugs the spec catches. Building that corpus — `examples/` with deliberately broken Rust per category, exercised through `/rust-cc-audit` — is the next infrastructure step, tracked in [`docs/roadmap.md`](docs/roadmap.md) §4. Completeness, until then, is author-asserted.
+
+The premise: Rust's compiler catches a large class of LLM mistakes (a known empirical finding is that **76.3% of all compilation failures from LLM agents** fall into just two categories — project organization and type/trait semantics, per Rust-SWE-Bench). Categories where the failure mode is a compile error are *deliberately omitted* from this spec — the compiler is sufficient. What this spec covers is what's left after `rustc`, `clippy`, and `cargo test` have all said "fine":
+
+- **Silent correctness bugs** — `HashMap` corruption from inconsistent `Hash`/`Eq`, `tokio::sync::Mutex` held across `.await`, lost `JoinHandle`s, `RefCell` runtime panics under contention.
+- **Design hazards** — `Deref` used for inheritance, manual `unsafe impl Send` without invariant, reflexive `Arc<Mutex<HashMap>>` where a single owner exists.
+- **Runtime data corruption** — `serde` "absent" vs "null" conflation, `#[serde(untagged)]` overlap, `select!`-cancelled side effects.
+- **Performance and resource leaks** — async `Drop` that doesn't drop, blocking calls on async runtime, unbounded channels.
+- **Cryptographic and security pitfalls** — non-constant-time comparison, `OsRng` skipped for `thread_rng`, nonce reuse.
+
+The exact category count is given in the spec itself; the count is allowed to evolve.
+
+## Status
+
+**v0.4.5 — substitution catalog + plugin/npm distribution (2026-06-17).** A Tier E appendix in `data-and-types.md`: a pattern → cheaper-representation lookup table (~22 rows, 4 groups — ownership/allocation, lookup/complexity, the hasher ladder, concurrent maps by access shape), every row gated by §E6 measure-first; no new categories (still **58**). Plus two clone-free install paths: the repo is now a Claude Code **plugin + marketplace** (`/plugin marketplace add PHPCraftdream/rust-intel`) and an **npm package** (`npx rust-intel-cc`), published by CI on every release tag. See [`CHANGELOG.md`](CHANGELOG.md).
+
+**v0.4.4 — §D1a gains the façade fitted to the test (2026-06-15).** One bullet, no new categories (still **58**). A fourth shape under §D1a oracle validity: where the *circular oracle* writes the test from the code, the *façade fitted to the test* writes the code from the test — given the goal "make this test pass," an agent emits the declaration the test probes (a config key, header, status string) without the behavior behind it; tests are green, the feature is absent. Grounded in Chacon 2026, "Grit" (Rust-Git reimplementation, 360k LOC, 99.3% tests green, "not *tested*"). See [`CHANGELOG.md`](CHANGELOG.md).
+
+**v0.4.3 — siblings of safe-looking primitives (2026-06-15).** Three bullets, no new categories (still **58**): §C2 path-traversal recipe gains a TOCTOU caveat (`canonicalize` + `starts_with` defeats the static symlink, not a racing one — CWE-367; use `openat`+`O_NOFOLLOW` / `cap-std` when the tree is attacker-mutable); §B9 gains `std::thread::scope` as the sync mirror of §B21 (auto-join on the closing brace can deadlock; child panic re-panics the parent); §B16 gains a ReDoS sibling-of-HashDoS bullet (`regex` is linear by construction; `fancy-regex`/`onig`/`pcre2` reintroduce catastrophic backtracking — CWE-1333). Plus a README recall-honesty note (per-rule grounding ≠ measured coverage). See [`CHANGELOG.md`](CHANGELOG.md).
+
+**v0.4.2 — concurrency/hang/flaky-test patterns (2026-06-14).** Two new numbered categories + a lettered sub-section + three extensions, extracted from real fixes: §B3a (coordinator-loop livelock — release leadership and exit on persistent error), §D4 (filtered test-runner output hides hangs — `pipefail` + nextest SLOW/TIMEOUT), §D5 (Windows LNK1104 from zombie test process, defense-in-depth on top of §D4). Extensions: §B2 (DashMap `Ref` across `.await` is an invisible shard lock), §B21 (periodic task must hold `Weak`, not `Arc`), §D1 (`interval` + `start_paused` tick discipline). **56 → 58 categories.** See [`CHANGELOG.md`](CHANGELOG.md).
+
+**v0.4.1 — Tier F semantic conformance (2026-06-10).** Added Tier F (§F1–§F4): defects of *meaning* — code that compiles, passes tests, implements the wrong thing. Plus §D1a (oracle validity) and §D3 (test/prod divergence). **51 → 56 categories, 5 → 6 tiers (A–F).** See [`CHANGELOG.md`](CHANGELOG.md).
+
+**v0.4.0 — fan-out audit workflow (2026-06-10).** Shipped `audit-project.workflow.js` — one agent per module, async split into two, runtime slicing of trigger tables (zero duplication), structured findings schema, synthesized `/rust-cc-audit` report. Module headers enriched with tier badges + audit semantics. `audit.md` gains fan-out-preferred note. Installers deliver the workflow. See [`CHANGELOG.md`](CHANGELOG.md).
+
+**v0.3.3 — accuracy pass (2026-06-10).** Factual/dating fixes (F1–F4): `clippy::await_holding_lock` group history corrected, MSRV 1.84→1.85, §C7 resolver v1/v2 qualification, `never_type_fallback` dating 1.92→1.85. Three minor clarifications (§B2, §B9, §B12, §B15a). No category changes (still **51**). See [`CHANGELOG.md`](CHANGELOG.md).
+
+**v0.3.2 — four content additions (2026-06-09).** From a study of Microsoft's *Rust Patterns & Engineering How-Tos*: §C1a (`#[non_exhaustive]` producer-side semver rule, 🟡), §B18a (variance/`PhantomData` soundness in raw-pointer wrappers, 🔴), expanded §B4 (memory-vs-resource `Drop` at exit, recursive `Drop` stack overflow, drop-order shutdown deadlock), and §B5 (unsafe→safe boundary principle: value-invariant guards vs relational invariants). Still **51** categories (sub-sections counted under parent). See [`CHANGELOG.md`](CHANGELOG.md).
+
+**v0.3.1 — structural repackaging (2026-05-31).** The single-file spec is now a **modular skill**: `SKILL.md` (core — protocols, enforcement tiers, the trigger table, and a category→module map) plus nine theme modules under `skill/` holding the category bodies. No rule or category changes (still **51**) — content is byte-complete vs 0.3.0. `SKILL.md` also tells the agent to run a full audit/review by **fanning out one sub-agent per module** (via a workflow) instead of holding all categories in one context. Installers ship the modules; the single-file reference is retired (kept in git history). See [`CHANGELOG.md`](CHANGELOG.md).
+
+**v0.3.0 — content release (2026-05-29).** The first tagged release since 0.2.2 — it collapses all interim work (drafted under provisional 0.3.x / 0.4.0 labels, never tagged) into one version. The spec was reframed to cover only bugs that compile and pass tests but still break, then grown from **26 to 51 categories** across **five tiers (A–E)**: silent correctness bugs (async cancellation, `Mutex`-across-`.await`, UB, TOCTOU, crypto, FFI, lossy numeric/`as`-casts, wall-clock vs monotonic, UTF-8 boundaries, iterator/slice adapter traps), architecture/ergonomics, testing/CI gaps, and a top-level **Tier E — Systemic cost** (latency, allocation, complexity, contention; enforced 🟡/🟢, never 🔴). Includes an external multi-agent review pass — evidence-base accuracy fixes, build-time supply-chain coverage (§A1), and anti-dogmatism calibration. Slash commands unchanged. See [`CHANGELOG.md`](CHANGELOG.md) for full notes.
+
+## Layout
+
+```
+rust-intel/
+├── .claude-plugin/                     # Claude Code plugin + marketplace manifests
+│   ├── plugin.json                     # Plugin manifest (skills/commands paths, version)
+│   └── marketplace.json                # This repo is its own marketplace (/plugin marketplace add PHPCraftdream/rust-intel)
+├── skill/                              # The skill (this is what installs) — modular
+│   ├── SKILL.md                        # Core: protocols, enforcement tiers, trigger table, category→module map
+│   ├── <theme>.md                      # Theme modules (async, unsafe-and-ffi, security, … — the category bodies)
+│   └── audit-project.workflow.js       # Fan-out project audit (one agent per module)
+├── bin/install.js                      # npx installer (npm package: rust-intel-cc)
+├── package.json                        # npm package manifest (published on release tags by CI)
+├── .github/workflows/npm-publish.yml   # Publishes rust-intel-cc to npm on every v* tag
+├── README.md                           # This file
+├── CHANGELOG.md                        # Version history
+├── .gitattributes                      # Line-ending rules (LF for source, CRLF for .ps1/.bat)
+├── .gitignore                          # Ignores /.claude/ (project-local install target) and target/
+├── rust-cc-install.sh / rust-cc-install.ps1 / rust-cc-install.bat       # One-command install (project-local by default; --user for global)
+├── rust-cc-uninstall.sh / rust-cc-uninstall.ps1 / rust-cc-uninstall.bat # Inverse of install
+├── commands/
+│   ├── README.md
+│   └── rust-intel-cc/                  # Repo umbrella dir (installer flattens to /rust-cc-* commands)
+│       ├── audit.md                    # /rust-cc-audit  — scan existing code
+│       ├── fix.md                      # /rust-cc-fix    — diagnose an error
+│       └── plan.md                     # /rust-cc-plan   — pre-flight a new task
+└── docs/
+    ├── roadmap.md                      # Roadmap: open directions and structural notes
+    └── sources.md                      # Empirical sources and citations
+```
+
+## How to use it
+
+### Install — three ways
+
+#### 1. Claude Code plugin (recommended — one command, auto-updates)
+
+Inside any Claude Code session:
+
+```
+/plugin marketplace add PHPCraftdream/rust-intel
+/plugin install rust-intel@rust-intel
+```
+
+That's it — no clone, cross-platform, and updates arrive via `/plugin` (or `claude plugin update rust-intel`). The plugin ships the skill (auto-activates on Rust tasks) plus the commands under the plugin namespace: `/rust-intel:audit`, `/rust-intel:fix`, `/rust-intel:plan`.
+
+#### 2. npx (no clone, flat `/rust-cc-*` command names)
+
+```bash
+npx rust-intel-cc                # project-local: ./.claude/
+npx rust-intel-cc --user        # user-global:   ~/.claude/
+npx rust-intel-cc --uninstall   # inverse (add --user for global)
+```
+
+Same layout as the shell installers below: skill in `<target>/skills/rust-intel/`, commands flattened to `/rust-cc-audit`, `/rust-cc-fix`, `/rust-cc-plan`. Published to npm automatically on every release tag.
+
+#### 3. Shell installers (from a clone; `--symlink` for development)
+
+**Default is project-local** — files land in `./.claude/` of whatever directory you ran the installer from. Pass `--user` (or `-User` on PowerShell) to install to the user-global `~/.claude/` instead.
+
+```bash
+# macOS / Linux
+./rust-cc-install.sh                  # project-local: $PWD/.claude/
+./rust-cc-install.sh --user           # user-global:   $HOME/.claude/
+./rust-cc-install.sh --symlink        # symlink instead of copy (tracks repo updates)
+
+# Windows (PowerShell)
+.\rust-cc-install.ps1                 # project-local
+.\rust-cc-install.ps1 -User           # user-global
+
+# Windows (cmd.exe)
+rust-cc-install.bat                   # project-local
+rust-cc-install.bat -User             # user-global
+
+# Note: --symlink is bash-only. PowerShell and cmd.exe installers always copy.
+```
+
+`CLAUDE_CONFIG_DIR` env var overrides the target for the npx and shell installers if set.
+
+The installer copies:
+- `skill/*.md` → `<target>/skills/rust-intel/` (the modular skill — `SKILL.md` core plus theme modules; Claude Code activates it automatically on Rust tasks)
+- `commands/rust-intel-cc/{audit,fix,plan}.md` → `<target>/commands/rust-cc-{audit,fix,plan}.md` (the three slash commands; installer flattens with a `rust-cc-` prefix on copy)
+
+It also sweeps any prior install at the same target — including the legacy v0.1.x flat layout (`commands/rust-audit.md`, `commands/rust-fix.md`, `commands/rust-plan.md`, and the very early `commands/rust-intel.md`) — so re-running it cleanly migrates from any older version.
+
+### Uninstall
+
+```bash
+# macOS / Linux
+./rust-cc-uninstall.sh                # project-local
+./rust-cc-uninstall.sh --user         # user-global
+
+# Windows (PowerShell)
+.\rust-cc-uninstall.ps1
+.\rust-cc-uninstall.ps1 -User
+
+# Windows (cmd.exe)
+rust-cc-uninstall.bat
+rust-cc-uninstall.bat -User
+```
+
+Only touches the paths the installer creates. Other skills and commands under the target `.claude/` are not touched.
+
+### Verify
+
+Start `claude` inside the directory you installed to (or anywhere if you used `--user`), ask for any Rust task, and the assistant should reference rules from §A1–§F4 unprompted. Try:
+
+```
+/rust-cc-audit src/
+/rust-cc-fix  E0277: the trait bound `T: Send` is not satisfied
+/rust-cc-plan write a tokio task that consumes a sqlx stream and pushes to a websocket
+```
+
+### As a checklist for humans
+
+The document reads top-to-bottom. The minimum bar before committing any non-trivial Rust: walk the **Pre-flight checklist** (7 questions at the end of the spec) and the **Post-flight checklist** (the list of things to surface in a summary).
+
+### Commands
+
+Three commands live under [`commands/rust-intel-cc/`](commands/rust-intel-cc/) and share a single source of truth — the skill itself, never a copy:
+
+| Command | Trigger | Use case |
+|---|---|---|
+| [`audit`](commands/rust-intel-cc/audit.md) | `/rust-cc-audit [path]` | Scan existing Rust against all categories from the spec, return a triaged report with concrete fixes. |
+| [`fix`](commands/rust-intel-cc/fix.md) | `/rust-cc-fix <error>` | Map a compiler / clippy / panic / runtime symptom onto a category, propose a root-cause fix. |
+| [`plan`](commands/rust-intel-cc/plan.md) | `/rust-cc-plan <task>` | Run a task description through the trigger table and Pre-flight checklist before any code is written. |
+
+Details: [`commands/README.md`](commands/README.md).
+
+## Spec architecture
+
+Six tiers plus a meta-layer:
+
+| Tier | Coverage | Categories |
+|---|---|---|
+| Self-monitoring | Prompt-trigger table (phrase- *and* code-pattern-based) → activates relevant categories | top of spec |
+| **Tier A** | Compile-fix reflexes that leave silent residue — the LLM "fixes" the red squiggle in a way that compiles while leaving a real defect behind | §A1–§A3 |
+| **Tier B** | Silent correctness bugs, caught only in production | §B1–§B29 |
+| **Tier C** | Architecture and ergonomics, expensive to undo | §C1–§C11 |
+| **Tier D** | Testing and CI gaps — tests pass not because the code is correct but because the tests are blind | §D1–§D5 |
+| **Tier E** | Systemic cost (performance / scale / contention) — correct in the small, wrong at scale — cost that survives correctness; enforced 🟡/🟢, never 🔴 | §E1–§E6 |
+| **Tier F** | Semantic conformance — defects of *meaning*: spec/reference divergence, violated documented guarantees, boundary/error-path resource lifecycle, missing round-trip obligations. Found by reading the *claim*, not by pattern-matching | §F1–§F4 |
+
+The A/B/C/D/F tiers classify *what kind* of bug a category targets. Orthogonally, the spec's **Enforcement tiers** (🔴 surface-always / may block · 🟡 apply silently while writing · 🟢 delegate to clippy) say *how strictly* to act on each — so a post-flight summary stays short and every line is worth acting on, instead of flagging every cast and clone. See the "Enforcement tiers" section in the spec.
+
+A Tier A category for trait bounds / type mismatches (E0277/E0308) was present in earlier drafts and retired in v0.3.0: compile-only failures are out of scope, the compiler is sufficient. The remaining Tier A categories were renumbered to close the gap.
+
+Tier B is the centre of the spec: silent correctness bugs that survive `rustc`, `clippy`, and `cargo test`. Each category cites a published study, production incident, or systematically observed LLM output pattern.
+
+## Principles for evolving the spec
+
+1. **Every category must be grounded.** No rule lands without one of (a) a published study with numbers, (b) a documented production incident, or (c) a systematically observed LLM output pattern.
+2. **The spec defends against LLMs, not humans.** Categories where LLMs don't err more often than humans don't belong here — that's just Rust style.
+3. **Proof before rule.** If a category lacks a sharp BANNED/REQUIRED formulation, it stays in the roadmap, not the main spec.
+4. **Sources are transparent.** Every number in the spec maps to an entry in `docs/sources.md`.
+
+## Contributing
+
+See [`docs/roadmap.md`](docs/roadmap.md) for open directions. A new category is accepted if it meets the principles above and ships with a source.
+
+## License
+
+Dual-licensed under either **MIT** ([`LICENSE-MIT`](LICENSE-MIT)) or **Apache License 2.0** ([`LICENSE-APACHE`](LICENSE-APACHE)), at your option — the standard Rust-ecosystem convention. SPDX-License-Identifier: `MIT OR Apache-2.0`.
+
+Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you, as defined in the Apache-2.0 license, shall be dual-licensed as above, without any additional terms or conditions.

package/bin/install.js

@@ -0,0 +1,119 @@
+#!/usr/bin/env node
+// rust-intel installer for npx — mirrors rust-cc-install.sh / .ps1.
+// Zero dependencies; Node >= 16.
+//
+//   npx rust-intel-cc            install into ./.claude   (project-local)
+//   npx rust-intel-cc --user     install into ~/.claude   (global; honors CLAUDE_CONFIG_DIR)
+//   npx rust-intel-cc --uninstall [--user]
+//   npx rust-intel-cc --help
+//
+// Prefer the native Claude Code plugin instead when possible:
+//   /plugin marketplace add PHPCraftdream/rust-intel
+//   /plugin install rust-intel@rust-intel
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+
+const PKG_ROOT = path.resolve(__dirname, '..');
+const SKILL_SRC = path.join(PKG_ROOT, 'skill');
+const COMMANDS_SRC = path.join(PKG_ROOT, 'commands', 'rust-intel-cc');
+const COMMANDS = ['audit', 'fix', 'plan']; // -> rust-cc-<name>.md (flattened, same as the shell installers)
+
+function usage() {
+  console.log(`rust-intel installer
+
+Usage:
+  npx rust-intel-cc              install into ./.claude (project-local)
+  npx rust-intel-cc --user       install into ~/.claude (global; honors CLAUDE_CONFIG_DIR)
+  npx rust-intel-cc --uninstall  remove a project-local install (add --user for global)
+  npx rust-intel-cc --help       this text
+
+Installs:
+  <target>/skills/rust-intel/           the skill (SKILL.md + theme modules + audit workflow)
+  <target>/commands/rust-cc-audit.md    /rust-cc-audit
+  <target>/commands/rust-cc-fix.md      /rust-cc-fix
+  <target>/commands/rust-cc-plan.md     /rust-cc-plan
+
+Tip: the native Claude Code plugin is the recommended install (auto-updates):
+  /plugin marketplace add PHPCraftdream/rust-intel
+  /plugin install rust-intel@rust-intel`);
+}
+
+function fail(msg) {
+  console.error(`error: ${msg}`);
+  process.exit(1);
+}
+
+function targetDir(user) {
+  if (user) return process.env.CLAUDE_CONFIG_DIR || path.join(os.homedir(), '.claude');
+  return path.join(process.cwd(), '.claude');
+}
+
+function rmrf(p) {
+  fs.rmSync(p, { recursive: true, force: true });
+}
+
+function main() {
+  const args = process.argv.slice(2);
+  if (args.includes('--help') || args.includes('-h')) return usage();
+  const user = args.includes('--user');
+  const uninstall = args.includes('--uninstall');
+  const unknown = args.filter((a) => !['--user', '--uninstall'].includes(a));
+  if (unknown.length) fail(`unknown argument(s): ${unknown.join(' ')} (see --help)`);
+
+  const target = targetDir(user);
+  const skillDst = path.join(target, 'skills', 'rust-intel');
+  const commandsDst = path.join(target, 'commands');
+
+  if (uninstall) {
+    console.log(`Uninstalling rust-intel from ${target} ...`);
+    rmrf(skillDst);
+    for (const c of COMMANDS) rmrf(path.join(commandsDst, `rust-cc-${c}.md`));
+    console.log('Done.');
+    return;
+  }
+
+  if (!fs.existsSync(SKILL_SRC) || !fs.existsSync(path.join(SKILL_SRC, 'SKILL.md'))) {
+    fail(`package is missing skill/SKILL.md (looked in ${SKILL_SRC})`);
+  }
+  if (!fs.existsSync(COMMANDS_SRC)) {
+    fail(`package is missing commands/rust-intel-cc/ (looked in ${COMMANDS_SRC})`);
+  }
+
+  console.log(`Installing rust-intel into ${target} ...`);
+
+  // Clean previous install (mirrors the shell installers).
+  if (fs.existsSync(skillDst)) {
+    console.log(`  cleaning   ${skillDst} (previous install)`);
+    rmrf(skillDst);
+  }
+  fs.mkdirSync(skillDst, { recursive: true });
+  fs.mkdirSync(commandsDst, { recursive: true });
+
+  for (const entry of fs.readdirSync(SKILL_SRC)) {
+    if (!entry.endsWith('.md') && !entry.endsWith('.js')) continue;
+    fs.copyFileSync(path.join(SKILL_SRC, entry), path.join(skillDst, entry));
+    console.log(`  copied     ${path.join(skillDst, entry)}`);
+  }
+
+  for (const c of COMMANDS) {
+    const src = path.join(COMMANDS_SRC, `${c}.md`);
+    if (!fs.existsSync(src)) fail(`package is missing ${src}`);
+    const dst = path.join(commandsDst, `rust-cc-${c}.md`);
+    fs.copyFileSync(src, dst);
+    console.log(`  copied     ${dst}`);
+  }
+
+  console.log(`
+Done. Verify by starting 'claude' ${user ? 'anywhere' : 'in this directory'} and trying:
+  /rust-cc-audit
+  /rust-cc-fix  <error message>
+  /rust-cc-plan <task description>
+
+The skill 'rust-intel' will activate automatically on any Rust task.`);
+}
+
+main();