sinapse-ai 1.0.0

package/squad-claude/knowledge-base/mcp-integration-patterns.md

@@ -0,0 +1,284 @@
+# MCP Integration Patterns
+
+## Overview
+
+The Model Context Protocol (MCP) extends Claude Code with tools from external services. MCP servers expose tools that Claude Code can invoke just like built-in tools. This guide covers transport types, setup patterns, security, and common integrations.
+
+## Transport Types
+
+### stdio (Standard I/O)
+
+**How it works:** Claude Code spawns a local process and communicates via stdin/stdout using JSON-RPC.
+
+**Best for:** Local CLI tools, language servers, file processors, custom scripts.
+
+**Configuration:**
+```json
+{
+  "mcpServers": {
+    "my-server": {
+      "type": "stdio",
+      "command": "node",
+      "args": ["/path/to/server.js"],
+      "env": {
+        "API_KEY": "${MY_API_KEY}"
+      }
+    }
+  }
+}
+```
+
+**Characteristics:**
+- Fastest transport (no network overhead)
+- Process lifecycle managed by Claude Code
+- Environment variables for configuration
+- Works offline (for local-only tools)
+- One process per session
+
+### SSE (Server-Sent Events)
+
+**How it works:** Claude Code connects to a remote HTTP server that streams responses via Server-Sent Events.
+
+**Best for:** Remote services, shared servers, cloud-hosted tools, team-wide integrations.
+
+**Configuration:**
+```json
+{
+  "mcpServers": {
+    "remote-server": {
+      "type": "sse",
+      "url": "https://mcp.example.com/sse",
+      "headers": {
+        "Authorization": "Bearer ${MCP_TOKEN}"
+      }
+    }
+  }
+}
+```
+
+**Characteristics:**
+- Network latency applies
+- Server managed externally (always running)
+- Authentication via headers
+- Supports multiple concurrent clients
+- Requires network access
+
+### Docker
+
+**How it works:** Claude Code runs an MCP server inside a Docker container, communicating via stdio or mapped ports.
+
+**Best for:** Isolated environments, servers with complex dependencies, security-sensitive tools, reproducible setups.
+
+**Configuration:**
+```json
+{
+  "mcpServers": {
+    "docker-server": {
+      "type": "stdio",
+      "command": "docker",
+      "args": ["run", "--rm", "-i", "mcp/server-image:latest"],
+      "env": {
+        "DB_URL": "${DATABASE_URL}"
+      }
+    }
+  }
+}
+```
+
+**Characteristics:**
+- Full isolation (filesystem, network, processes)
+- Reproducible environment
+- Higher startup time (container launch)
+- Docker must be installed
+- Can map volumes for file access
+
+---
+
+## Transport Selection Guide
+
+| Factor | stdio | SSE | Docker |
+|--------|-------|-----|--------|
+| Latency | Lowest | Medium | Medium-High |
+| Security isolation | Low (same user) | High (network only) | Highest (container) |
+| Setup complexity | Low | Medium | Medium-High |
+| Offline capability | Yes | No | Yes (if image cached) |
+| Multi-user sharing | No | Yes | Possible |
+| Dependency management | Manual | Server-side | Container image |
+| Best use case | Local tools | Team services | Sensitive operations |
+
+---
+
+## Common MCP Servers
+
+### Supabase MCP
+
+**Purpose:** Database operations, migrations, edge functions, project management.
+
+**Tools provided:** `execute_sql`, `apply_migration`, `list_tables`, `get_logs`, `deploy_edge_function`, and 20+ more.
+
+**Setup:**
+```json
+{
+  "mcpServers": {
+    "supabase": {
+      "type": "stdio",
+      "command": "npx",
+      "args": ["-y", "@supabase/mcp-server"],
+      "env": {
+        "SUPABASE_ACCESS_TOKEN": "${SUPABASE_ACCESS_TOKEN}"
+      }
+    }
+  }
+}
+```
+
+### GitHub MCP
+
+**Purpose:** Repository management, issues, PRs, code search, Actions.
+
+**Setup:**
+```json
+{
+  "mcpServers": {
+    "github": {
+      "type": "stdio",
+      "command": "npx",
+      "args": ["-y", "@modelcontextprotocol/server-github"],
+      "env": {
+        "GITHUB_PERSONAL_ACCESS_TOKEN": "${GITHUB_TOKEN}"
+      }
+    }
+  }
+}
+```
+
+### Figma MCP
+
+**Purpose:** Design inspection, component discovery, design token extraction.
+
+**Tools provided:** `get_screenshot`, `get_metadata`, `get_design_context`, `get_code_connect_suggestions`.
+
+### Notion MCP
+
+**Purpose:** Document management, database queries, page creation and updates.
+
+**Tools provided:** `notion-search`, `notion-create-pages`, `notion-update-page`, `notion-fetch`.
+
+### Gmail MCP
+
+**Purpose:** Email reading, drafting, label management.
+
+**Tools provided:** `gmail_search_messages`, `gmail_read_message`, `gmail_create_draft`.
+
+### Context7
+
+**Purpose:** Library documentation lookup with up-to-date information.
+
+**Tools provided:** `resolve-library-id`, `get-library-docs`.
+
+---
+
+## Agent-as-MCP Pattern
+
+A Claude Code agent can be exposed as an MCP server, allowing other agents or systems to invoke it as a tool.
+
+**Architecture:**
+```
+External System → MCP Protocol → Agent Wrapper → Claude Code Agent → Result
+```
+
+**Use cases:**
+- Expose a code review agent as a CI/CD tool
+- Let other AI systems delegate to specialized Claude Code agents
+- Create reusable agent services across projects
+
+**Implementation approach:**
+1. Create an MCP server that wraps agent invocation
+2. Define tools that map to agent capabilities
+3. Handle authentication and rate limiting
+4. Return structured results
+
+---
+
+## Docker MCP Toolkit
+
+The Docker MCP Toolkit provides a managed way to run MCP servers in containers.
+
+**Key features:**
+- Pre-built images for common servers
+- Health monitoring and auto-restart
+- Network isolation between servers
+- Volume management for persistent data
+- Log aggregation
+
+**Setup:**
+```bash
+# Install Docker MCP gateway
+docker run -d --name mcp-gateway \
+  -p 8080:8080 \
+  -v /var/run/docker.sock:/var/run/docker.sock \
+  mcp/gateway:latest
+
+# Register a server
+curl -X POST http://localhost:8080/servers \
+  -d '{"name": "supabase", "image": "mcp/supabase:latest", "env": {"TOKEN": "..."}}'
+```
+
+---
+
+## Security Considerations
+
+### Environment Variable Management
+- NEVER hardcode secrets in settings.json
+- Use `${ENV_VAR}` syntax for variable substitution
+- Store secrets in .env files (gitignored) or OS keychain
+- Rotate API keys regularly
+
+### Network Security
+- SSE servers should use HTTPS only
+- Docker servers should use internal networks (not exposed to host)
+- Limit MCP server network access with Docker network policies
+- Monitor outbound connections from MCP servers
+
+### Tool-Level Permissions
+- Review which tools each MCP server exposes
+- Use Claude Code's permission system to restrict MCP tool access
+- Deny MCP tools that can modify production data in development environments
+- Log all MCP tool invocations for audit
+
+### Data Flow Security
+- Understand what data flows through each MCP server
+- Ensure sensitive data is not logged by MCP servers
+- Use encryption for data at rest and in transit
+- Comply with data residency requirements
+
+---
+
+## Troubleshooting
+
+### Common Issues
+
+| Issue | Cause | Fix |
+|-------|-------|-----|
+| "Server not found" | MCP config not in settings.json | Add server config to correct settings file |
+| "Connection refused" | Server not running / wrong port | Start server, check URL/port |
+| "Tool not found" | Server connected but tool not registered | Check server implements the tool, restart server |
+| "Authentication failed" | Invalid or expired token | Rotate token, check env var name |
+| "Timeout" | Server too slow | Increase timeout, check server performance |
+| "Permission denied" | Tool blocked by deny list | Update permissions in settings.json |
+
+### Diagnostic Commands
+
+```bash
+# Check if MCP server process is running (stdio)
+ps aux | grep mcp-server
+
+# Test SSE endpoint
+curl -N https://mcp.example.com/sse
+
+# Test Docker MCP container
+docker logs mcp-server-name
+
+# Verify environment variables
+echo $SUPABASE_ACCESS_TOKEN | head -c 10
+```

package/squad-claude/squad.yaml

@@ -0,0 +1,11 @@
+name: squad-claude
+version: "1.0.0"
+short-title: "Claude Code Mastery Squad"
+description: "Squad especialista em Claude Code: hooks, MCP servers, subagents, skills, configuracao, context engineering, integracao de projetos e roadmap tracking."
+slashPrefix: SINAPSE
+tags: [claude-code, hooks, mcp, subagents, skills, context-engineering, configuration]
+components:
+  agents: [cm-orchestrator.md, hooks-architect.md, mcp-integrator.md, swarm-orchestrator.md, config-engineer.md, skill-craftsman.md, project-integrator.md, roadmap-sentinel.md]
+  tasks: [audit-setup.md, setup-wizard.md, diagnose.md, hook-designer.md, audit-hooks.md, configure-settings.md, audit-settings.md, create-rules.md, claude-md-engineer.md, permission-strategy.md, mcp-integration-plan.md, mcp-workflow.md, create-team-topology.md, parallel-decomposition.md, worktree-strategy.md, create-agent-definition.md, optimize-context.md, context-rot-audit.md, optimize-workflow.md, integrate-project.md, brownfield-setup.md, setup-repository.md, multi-project-setup.md, ci-cd-setup.md, enterprise-config.md, sandbox-setup.md, system-prompt-design.md, chain-of-thought-optimization.md, few-shot-example-library.md, prompt-testing-framework.md, multi-turn-conversation-design.md, mcp-server-design.md, mcp-integration-audit.md, tool-orchestration-pattern.md, claude-code-hooks-setup.md, automated-code-review-pipeline.md, ai-testing-automation.md, batch-processing-workflow.md, context-window-audit.md, memory-system-design.md, knowledge-retrieval-optimization.md, claude-code-project-setup.md, slash-command-library-design.md, agent-persona-creation.md, multi-agent-orchestration.md, end-to-end-ai-workflow.md, human-in-the-loop-design.md, knowledge-base-architecture.md, content-curation-pipeline.md]
+  knowledge-base: [claude-code-hooks-reference.md, mcp-integration-patterns.md, context-engineering-guide.md, agent-team-patterns.md, claude-code-configuration-reference.md]
+  workflows: [project-setup-cycle.yaml, optimization-cycle.yaml]

package/squad-claude/tasks/agent-persona-creation.md

@@ -0,0 +1,107 @@
+---
+task: agent-persona-creation
+responsavel: "@config-engineer"
+responsavel_type: Agent
+atomic_layer: Task
+elicit: false
+Entrada:
+  - campo: context
+    tipo: object
+    origem: "workflow ou manual"
+    obrigatorio: true
+Saida:
+  - campo: resultado
+    tipo: document
+    destino: "stakeholders"
+Checklist:
+  - "[ ] Validar inputs"
+  - "[ ] Executar steps"
+  - "[ ] Verificar qualidade"
+  - "[ ] Gerar output"
+---
+
+# Agent Persona Creation
+
+## Objective
+
+Create effective AI agent personas with distinct identities, expertise domains, behavioral rules, communication styles, and operational boundaries. Produce complete agent definition files that can be activated within Claude Code or multi-agent orchestration systems.
+
+## Pre-Conditions
+
+- Agent's role and domain clearly defined
+- Team of existing agents documented (to avoid overlap)
+- Delegation matrix established (who does what)
+- Communication patterns between agents designed
+- Agent file format and storage location determined
+
+## Steps
+
+1. **Define Agent Identity** — Choose a unique name (short, memorable, thematic), assign a role title, and write a one-paragraph identity statement. The identity should make the agent immediately recognizable and establish its authority in its domain. Example: "Aria, the Architect — designs system architecture with a focus on scalability and simplicity."
+2. **Map Expertise Domain** — Define exactly what the agent knows deeply: primary expertise (core domain), secondary expertise (adjacent knowledge), and explicit non-expertise (what the agent should defer to others). Use a knowledge boundary table.
+3. **Design Communication Style** — Define how the agent communicates: tone (authoritative, collaborative, cautious), verbosity level (concise, detailed, adaptive), formatting preferences (tables, bullet points, code blocks), and signature patterns (how the agent starts and ends interactions).
+4. **Establish Behavioral Rules** — Write explicit MUST/MUST NOT rules: what the agent always does (validates before acting), what it never does (modify files outside its domain), how it handles uncertainty (ask before assuming), and how it handles conflicts (escalate to orchestrator).
+5. **Define Command Interface** — Design the agent's commands: activation command (@agent-name or /namespace:agent), available sub-commands (*help, *status, *execute), parameter formats, and output conventions. Each command should have a clear purpose and usage example.
+6. **Create Dependency Map** — Document the agent's relationships: which agents it delegates to (and for what), which agents delegate to it, shared resources, and handoff protocols. Reference the agent-handoff protocol for context compaction rules.
+7. **Write the Agent Definition File** — Produce the complete agent definition in the project's format (YAML frontmatter + Markdown body): metadata (name, role, version), persona description, commands, dependencies, behavioral rules, and activation instructions.
+8. **Design Memory Configuration** — Define the agent's memory needs: what it should remember across sessions (decisions, patterns, preferences), where memories are stored (MEMORY.md), memory format, and cleanup rules. Reference the memory-system-design task.
+9. **Test Persona Consistency** — Validate the agent persona across scenarios: does it maintain character when asked to act outside its domain? Does it correctly defer to other agents? Does it follow its behavioral rules under pressure? Does its communication style remain consistent?
+10. **Create Persona Evaluation Rubric** — Build a rubric for ongoing persona quality: identity clarity (is the agent distinguishable from others?), expertise accuracy (does it know what it should?), boundary respect (does it stay in its lane?), and communication quality (is its style effective?).
+
+## Output
+
+```markdown
+# Agent Definition: {Agent Name}
+
+## Identity
+- **Name:** {name}
+- **Role:** {title}
+- **Domain:** {primary expertise}
+- **Version:** v{X.Y}
+
+## Persona
+{1-2 paragraph persona description}
+
+## Expertise
+| Level | Domain | Examples |
+|-------|--------|----------|
+| Primary | {domain} | {specific skills} |
+| Secondary | {domain} | {specific skills} |
+| Defers to | {agent} | {what it defers} |
+
+## Communication Style
+- Tone: {description}
+- Verbosity: {level}
+- Format preferences: {list}
+
+## Behavioral Rules
+### MUST
+- {rule 1}
+- {rule 2}
+
+### MUST NOT
+- {rule 1}
+- {rule 2}
+
+## Commands
+| Command | Description | Parameters |
+|---------|------------|-----------|
+| *help | Show available commands | none |
+
+## Dependencies
+| Agent | Relationship | Trigger |
+|-------|-------------|---------|
+
+## Memory Configuration
+- Storage: {location}
+- Categories: {list}
+- Cleanup: {policy}
+```
+
+## Quality Criteria
+
+- Agent must be distinguishable from all existing agents in the team (no role overlap)
+- Behavioral rules must cover at least 5 MUST and 3 MUST NOT directives
+- Command interface must include at least *help, one domain-specific command, and *exit
+- Persona must maintain consistency across 5+ simulated interactions in testing
+- Dependency map must be bidirectional (both this agent and related agents reference each other)
+- Agent definition file must be under 2000 tokens (efficient for context loading)

package/squad-claude/tasks/ai-testing-automation.md

@@ -0,0 +1,95 @@
+---
+task: ai-testing-automation
+responsavel: "@hooks-architect"
+responsavel_type: Agent
+atomic_layer: Task
+elicit: false
+Entrada:
+  - campo: context
+    tipo: object
+    origem: "workflow ou manual"
+    obrigatorio: true
+Saida:
+  - campo: resultado
+    tipo: document
+    destino: "stakeholders"
+Checklist:
+  - "[ ] Validar inputs"
+  - "[ ] Executar steps"
+  - "[ ] Verificar qualidade"
+  - "[ ] Gerar output"
+---
+
+# AI Testing Automation
+
+## Objective
+
+Design and implement AI-assisted testing automation that leverages Claude Code to generate, maintain, and execute test suites. Create a system that automatically generates tests from code changes, identifies untested paths, and maintains test quality over time.
+
+## Pre-Conditions
+
+- Testing framework configured (Jest, Vitest, Playwright, etc.)
+- Code coverage tools installed and baseline measured
+- Existing test suite (even if minimal) available for pattern learning
+- CI/CD pipeline accessible for test integration
+- Code quality standards and testing requirements documented
+
+## Steps
+
+1. **Analyze Current Test Coverage** — Run coverage tools to establish baseline: line coverage, branch coverage, function coverage. Identify critical paths with zero coverage and high-risk areas (payment processing, authentication, data mutation) that need priority testing.
+2. **Design Test Generation Strategy** — Define the AI test generation approach: for unit tests, analyze function signatures and generate tests for happy path, error cases, and boundary values; for integration tests, analyze API endpoints and generate request/response tests; for E2E tests, analyze user flows and generate scenario tests.
+3. **Create Test Templates** — Build templates that Claude Code uses when generating tests: describe/it structure, arrange-act-assert pattern, mock setup conventions, fixture patterns, and assertion style. Templates must match the project's existing test patterns.
+4. **Implement Change-Triggered Generation** — Set up PostToolUse hooks that detect when source files are modified and automatically suggest or generate corresponding test updates. Track which source files have tests and which don't.
+5. **Build Test Quality Validation** — Create checks for generated tests: tests must actually test behavior (not just call functions), assertions must be meaningful (not `expect(true).toBe(true)`), mocks must be realistic, and tests must be deterministic (no flaky tests).
+6. **Design Edge Case Discovery** — Implement a system that analyzes function signatures, type definitions, and error handling paths to identify edge cases: null/undefined inputs, empty arrays, boundary numbers, concurrent access, timeout scenarios, and type coercion traps.
+7. **Create Mutation Testing Integration** — Set up mutation testing to validate test effectiveness: introduce small code changes (mutations), run tests, verify that tests catch the mutations. Track mutation score alongside coverage.
+8. **Implement Test Maintenance Workflow** — Design a workflow for when tests break due to code changes: detect broken tests, analyze the diff to determine if tests need updating or if the code change introduced a bug, suggest test fixes, and update automatically when safe.
+9. **Build Reporting Dashboard** — Create a test health report: coverage trends, test generation rate, flaky test tracker, mutation score, untested critical paths, and recommended next tests to write.
+10. **Configure CI Integration** — Wire the testing automation into the CI pipeline: generate tests as part of PR creation, run generated tests in CI, block merge if coverage drops, and report test quality metrics on the PR.
+
+## Output
+
+```markdown
+# AI Testing Automation Setup
+
+## Coverage Baseline
+| Metric | Current | Target | Gap |
+|--------|---------|--------|-----|
+| Line coverage | {%} | {%} | {%} |
+| Branch coverage | {%} | {%} | {%} |
+| Function coverage | {%} | {%} | {%} |
+
+## Test Generation Config
+| Source Pattern | Test Pattern | Strategy | Template |
+|---------------|-------------|----------|----------|
+
+## Hook Configuration
+{hooks for change-triggered test generation}
+
+## Test Templates
+### Unit Test Template
+{template code}
+
+### Integration Test Template
+{template code}
+
+## Edge Case Patterns
+| Pattern | Detection Rule | Test Strategy |
+|---------|---------------|---------------|
+
+## CI Integration
+{pipeline configuration}
+
+## Reporting
+- Dashboard location: {path}
+- Update frequency: {cadence}
+```
+
+## Quality Criteria
+
+- Generated tests must pass on first run (no manual fixes needed) at least 85% of the time
+- Generated tests must achieve meaningful assertion coverage (not trivial assertions)
+- Change-triggered generation must detect source-test relationships accurately
+- Mutation testing score must improve by at least 10% after automation is applied
+- Test maintenance workflow must correctly classify broken tests as "test needs update" vs. "bug detected" at least 80% of the time
+- Full test generation cycle must complete within 60 seconds per source file

package/squad-claude/tasks/audit-hooks.md

@@ -0,0 +1,76 @@
+---
+task: audit-hooks
+responsavel: "@hooks-architect"
+responsavel_type: Agent
+atomic_layer: Task
+elicit: false
+Entrada:
+  - campo: context
+    tipo: object
+    origem: "workflow ou manual"
+    obrigatorio: true
+Saida:
+  - campo: resultado
+    tipo: document
+    destino: "stakeholders"
+Checklist:
+  - "[ ] Validar inputs"
+  - "[ ] Executar steps"
+  - "[ ] Verificar qualidade"
+  - "[ ] Gerar output"
+---
+
+# Audit Hooks
+
+## Objective
+
+Audit all existing Claude Code hooks for completeness, correctness, performance, and security. Identify missing automation opportunities, redundant hooks, and potential failure points.
+
+## Inputs
+
+- Current hook configurations (settings.json hooks section or .claude/hooks.json)
+- Project automation requirements
+- Known hook-related issues (if any)
+
+## Steps
+
+1. **Inventory All Hooks** — List every configured hook with its event, matcher, command, timeout, and error handling. Create a complete registry.
+2. **Check Event Coverage** — Map hooks to the full event list (PreToolUse, PostToolUse, Notification, Stop, SubagentStop, etc.). Identify unhandled events that could benefit from automation.
+3. **Validate Matchers** — Verify each matcher pattern is correct, specific enough (no overly broad matches), and does not conflict with other hooks on the same event.
+4. **Test Commands** — For each hook command, verify it exists, is executable, handles the expected payload schema, and returns within the configured timeout.
+5. **Assess Performance** — Check timeout configurations against event type requirements. Flag PreToolUse hooks with > 500ms timeout. Identify hooks that could cause latency spikes.
+6. **Review Security** — Check if any hooks execute untrusted commands, expose sensitive data in payloads, or could be exploited via crafted tool inputs.
+7. **Identify Gaps** — Based on project requirements, recommend hooks that should exist but don't (e.g., no auto-lint hook, no security gate, no notification routing).
+8. **Generate Report** — Produce a scored audit report with findings and recommendations.
+
+## Quality Gates
+
+- Every configured hook must be validated
+- Performance assessment must include measured or estimated latency
+- Security review must cover command injection and data exposure risks
+- Recommendations must be actionable with specific hook configurations
+
+## Output Format
+
+```markdown
+# Hook Audit Report
+
+## Hook Inventory
+| # | Event | Matcher | Command | Timeout | Status |
+|---|-------|---------|---------|---------|--------|
+| 1 | PreToolUse | ... | ... | 5000ms | OK/WARN/FAIL |
+
+## Coverage Map
+- PreToolUse: X hooks (coverage: Y%)
+- PostToolUse: X hooks
+- ...
+
+## Issues Found
+1. [CRITICAL] ...
+2. [WARNING] ...
+
+## Missing Hooks (Recommendations)
+1. ...
+
+## Score: X/5
+```

package/squad-claude/tasks/audit-settings.md

@@ -0,0 +1,72 @@
+---
+task: audit-settings
+responsavel: "@config-engineer"
+responsavel_type: Agent
+atomic_layer: Task
+elicit: false
+Entrada:
+  - campo: context
+    tipo: object
+    origem: "workflow ou manual"
+    obrigatorio: true
+Saida:
+  - campo: resultado
+    tipo: document
+    destino: "stakeholders"
+Checklist:
+  - "[ ] Validar inputs"
+  - "[ ] Executar steps"
+  - "[ ] Verificar qualidade"
+  - "[ ] Gerar output"
+---
+
+# Audit Settings
+
+## Objective
+
+Audit existing Claude Code settings for security gaps, permission inconsistencies, deprecated options, missing configurations, and optimization opportunities. Produce a scored report with specific fixes.
+
+## Inputs
+
+- .claude/settings.json (project level)
+- ~/.claude/settings.json (user level, if accessible)
+- Managed policies (if applicable)
+- .claude/settings.local.json (if exists)
+
+## Steps
+
+1. **Read All Settings Layers** — Collect settings from all levels: managed policies, user global, project, and local. Document the effective merged configuration.
+2. **Check Permission Consistency** — Verify no contradictions between layers. Check that deny rules at higher levels are not overridden at lower levels (they should not be).
+3. **Assess Security Posture** — Flag overly permissive auto-approve lists, missing deny rules for dangerous operations (rm -rf, git push --force, etc.), and exposed secrets.
+4. **Validate MCP Configurations** — Check each MCP server entry for correct schema, valid environment variable references, and appropriate transport type.
+5. **Identify Deprecated Options** — Flag any configuration keys that are deprecated in the current Claude Code version.
+6. **Check Completeness** — Compare against a reference configuration for the project's stack. Identify missing permissions, unregistered MCP servers, and absent behavioral flags.
+7. **Generate Recommendations** — Produce prioritized fixes ordered by security impact, then usability impact.
+
+## Quality Gates
+
+- All settings layers must be examined
+- Security issues must be flagged with severity (critical/high/medium/low)
+- Each finding must include the specific fix
+- Report must distinguish between project settings and user settings issues
+
+## Output Format
+
+```markdown
+# Settings Audit Report
+
+## Effective Configuration Summary
+{merged settings overview}
+
+## Security Findings
+| # | Severity | Finding | Fix |
+|---|----------|---------|-----|
+
+## Consistency Issues
+...
+
+## Missing Configurations
+...
+
+## Score: X/5
+```