synapse-hub 2.1.0 → 2.2.0

package/.agents/agents/orchestrator.md

@@ -41,3 +41,10 @@ tools:
 - `tools/test_impact.py`: Determines impacted test cases prior to task assignment.
 - `tools/lookup_tc.py`: Fast lookup of existing test cases, acceptance criteria, and IDs.
 - `tools/mcp_server.py`: Exposes standardized JSON-RPC 2.0 endpoints for all AI clients.
+
+## Single Front-Door FSM Workflow (Deterministic 5 Stages):
+1. **Stage 1 (Discovery):** Invoke `live-explorer` to inspect DOM/AOM and verify selectors under 200ms.
+2. **Stage 2 (Synthesis):** Pass Data Contract to `pom-crafter` to generate Clean POM classes and flat test scripts.
+3. **Stage 3 (Execution):** Dispatch headless execution via `test-runner`.
+4. **Stage 4 (Autopsy):** If test fails, invoke `failure-analyst` to perform RCA and auto-heal.
+5. **Stage 5 (Acceptance):** Trigger `quality-gatekeeper` to verify all 8 Quality Gates and mutation score >= 80%.

package/.agents/rules/lessons-learned.md

@@ -17,6 +17,7 @@ description: Critical anti-patterns, past mistakes, and strict avoidance rules (
 | **5** | **Flaky timing on CI/CD** | `Thread.sleep` failed under variable network lag. | Replace 100% with Smart Wait: Angular `isStable()` and CDP `Network Idle 0`. |
 | **6** | **DB polluted with test junk** | Created entities without executing deletion. | Every data creation test case **must** execute idempotent teardown cleanup. |
 | **7** | **Graphify/CLI ran on Skill Hub instead of target project** | Defaulted to `CWD = Agent Skill` without checking Active Workspaces. | **Agent Skill folder = read-only hub, NEVER a CLI target.** Always identify the real target project from `Active Workspaces` (the non-hub workspace). If multiple project workspaces exist, ask the user. All outputs (graphify-out/, reports) must land inside the target project folder. |
+| **8** | **Target test code pollution on Hub** | Created/committed target tests inside Hub repo. | **Synapse-Hub is strictly read-only for business automation tests.** All page classes, specs, and test cases must reside in the target project workspace. Pre-commit guard rejects business code in Hub. |
 
 ### Memory Management & Consolidation Protocol:
 - **Max capacity:** 8 active rules in prompt hot memory.

package/.agents/skills/agent-orchestration-multi-agent-optimize/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: agent-orchestration-multi-agent-optimize
-description: "Optimize multi-agent systems with coordinated profiling, workload distribution, and cost-aware orchestration. Use when improving agent performance, throughput, or reliability."
+description: "Profile, benchmark, and orchestrate multi-agent test workloads and token throughput."
 ---
 
 # Multi-Agent Optimization Toolkit

package/.agents/skills/antigravity-test-sentinel/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: antigravity-test-sentinel
-description: >-
-  Verification-first sentinel for test automation in Antigravity. Strictly locks task completion until test runner commands (verify_all.py, KRE CLI, Playwright) return exit code 0. Forbids declaring completion on unverified code.
+description: "Enforce verification-first discipline: blocks task completion until tests and quality gates pass."
 ---
 
 # Antigravity Test Sentinel — Verification-First Gatekeeper

package/.agents/skills/api-network-mocking-interception/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: api-network-mocking-interception
-description: Runtime HTTP/GraphQL request interception, route stubbing (page.route), and chaos network resilience testing (latency, 502/503/504 faults, offline, circuit breaker) during UI execution.
+description: "Intercept HTTP/GraphQL traffic, stub routes, and simulate chaos network failures."
 ---
 
 # API Network Mocking, Interception & Resilience Skill

package/.agents/skills/api-spec-to-e2e-matrix/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: api-spec-to-e2e-matrix
-description: >-
-  Transforms OpenAPI/Swagger specifications and JSON schemas into automated E2E positive, boundary value, and negative test matrices.
+description: "Generate automated positive, boundary, and negative test matrices from OpenAPI specifications."
 ---
 
 # API Spec to E2E Matrix — Contract-Based Test Generator
@@ -68,6 +67,14 @@ python tools/generate_api_matrix.py --spec path/to/openapi.json --format md -o d
 # 2. Generate JSON matrix for programmatic ingestion
 python tools/generate_api_matrix.py --spec path/to/openapi.json --format json -o tools/api_matrix.json
 
-# 3. Export directly to Postman Collection v2.1.0 with auto-assertions
-python tools/export_postman_collection.py --spec path/to/openapi.json -o postman_collection.json --env-output postman_env.json
+# 3. Export directly to Postman Collection v2.1.0 with AJV JSON Schema & DDT
+python tools/export_postman_collection.py --spec path/to/openapi.json -o postman_collection.json --env-output postman_env.json --ddt-output test_data.csv
+
+# 4. Zero-Input Autonomous Synthesis (No input file provided!)
+agent-qa export-postman --domain banking -o banking_col.json --env-output env.json --ddt-output ddt.csv
+agent-qa export-postman --domain ecommerce -o ecom_col.json
+
+# 5. Execute Newman & Enforce CI/CD Quality Gate
+newman run postman_collection.json -e postman_env.json -d test_data.csv -r cli,json --reporter-json-export report.json
+agent-qa analyze-newman report.json --max-failures 0 --sla-avg 500 --markdown pr_report.md
 ```

package/.agents/skills/architecture-decision-records/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: architecture-decision-records
-description: Write and maintain Architecture Decision Records (ADRs) following best practices for technical decision documentation. Use when documenting significant technical decisions, reviewing past architectural choices, or establishing decision processes.
+description: "Record, structure, and maintain technical Architecture Decision Records (ADRs)."
 ---
 
 # Architecture Decision Records

package/.agents/skills/auth-session-and-cookie-manager/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: auth-session-and-cookie-manager
-description: Manage browser authentication sessions, JWT tokens, storageState, and multi-user roles for zero-second logins. Use on-demand when tests require authentication bypass or multi-role workflows.
+description: "Manage browser authentication sessions, storageState, JWT tokens, and multi-role state."
 ---
 
 # Auth Session & Cookie Manager Skill

package/.agents/skills/backend-load-and-stress-patterns/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: backend-load-and-stress-patterns
-description: Enterprise backend load, stress, and endurance test orchestration using k6 and Locust. Directs AI agents in modeling concurrent Virtual Users (VUs), establishing SLA threshold assertions (P95/P99 latency, throughput/RPS, error rate < 0.1%), executing stress break-point tests, and soak/endurance validation.
+description: "Orchestrate k6 and Locust backend load, stress, and SLA endurance test suites."
 ---
 
 # Backend Load & Stress Testing Patterns (k6 & Locust Orchestrator)
@@ -204,17 +204,38 @@ locust -f tests/load/locustfile.py --headless -u 100 -r 10 --run-time 5m \
        --exit-code-on-error 1
 ```
 
-### Autonomous Apache JMeter Plan Generation & Execution
-Hub provides `tools/generate_jmx_plan.py` to auto-generate JMeter 5.x test plans (.jmx) directly from OpenAPI specs or Postman collections:
-```bash
-# 1. Generate JMeter Test Plan (100 VUs, 10 min, SLA < 500ms)
-python tools/generate_jmx_plan.py --spec swagger.json -o perf_plan.jmx --vus 100 --duration 600
-
-# 2. Convert existing Postman collection to JMeter Plan
-python tools/generate_jmx_plan.py --postman postman_collection.json -o perf_plan.jmx --vus 50
+### Autonomous Apache JMeter 360° Pinnacle Suite (Full-Stack & Multi-Protocol)
+Hub provides complete enterprise lifecycle automation for Apache JMeter 5.x via `generate_jmx_plan.py`, `jtl_analyzer.py`, and `telemetry_correlator.py`:
 
-# 3. Execute headless JMeter in CI/CD pipeline
-jmeter -n -t perf_plan.jmx -l results.jtl -e -o ./html_report
+```bash
+# 1. Generate Full Enterprise Plan with Pareto Traffic Shaping (70/20/10) & Deep Correlation
+agent-qa generate-jmx --spec swagger.json -o perf_plan.jmx \
+  --workload spike --vus 200 --duration 600 \
+  --weighted-mix "70:Browse,20:Cart,10:Checkout" \
+  --csv-data users.csv --deep-correlation --jsr223-hmac
+
+# 2. Multi-Protocol Load Plans (WebSocket, gRPC, Kafka, JDBC)
+agent-qa generate-jmx --ws-sample -o websocket_plan.jmx      # Real-time WebSocket feed
+agent-qa generate-jmx --grpc-sample -o grpc_plan.jmx        # Microservices Unary RPC
+agent-qa generate-jmx --kafka-sample -o kafka_plan.jmx      # Event-driven message broker
+agent-qa generate-jmx --jdbc-sample -o jdbc_plan.jmx        # Direct Database SQL pool
+
+# 3. Live APM Telemetry & PerfMon Hardware Agent
+agent-qa generate-jmx --spec swagger.json -o perf_plan.jmx \
+  --influxdb-url http://influxdb:8086/write?db=jmeter \
+  --perfmon-server 192.168.1.50:4444
+
+# 4. Distributed Cluster Execution (Master + 3 Slaves)
+docker-compose -f tools/templates/jmeter-distributed/docker-compose.yml up -d
+jmeter -n -t perf_plan.jmx -R slave1,slave2,slave3 -l results.jtl
+
+# 5. CI/CD SLA Quality Gate Enforcement (Exit code 0 on Pass, 1 on Breach)
+agent-qa analyze-jtl results.jtl --sla-p95 500 --max-error-rate 1.0 \
+  --markdown pr_perf_report.md --json metrics.json
+
+# 6. Full-Stack APM & Server Infrastructure RCA Correlator
+agent-qa correlate-telemetry --jtl results.jtl --server-metrics server_metrics.csv \
+  --markdown rca_report.md
 ```
 
 ---

package/.agents/skills/bats-testing-patterns/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: bats-testing-patterns
-description: Master Bash Automated Testing System (Bats) for testing bash/sh scripts, CI/CD pipelines, exit codes, and mock CLI execution.
+description: "Test bash/sh scripts, CLI tools, and CI/CD pipelines with Bats."
 ---
 
 # Bats Testing Patterns (Bash Automated Testing System)

package/.agents/skills/clean-pom-crafter/SKILL.md

@@ -1,9 +1,6 @@
 ---
 name: clean-pom-crafter
-description: >-
-  Standardized Clean Page Object Model (POM) development and Flat Architecture enforcement across enterprise automation test suites.
-  Ensures 100% UTF-8 No BOM, zero hardcoded XPaths in scripts, dynamic test data generation via uniqueCode,
-  and standardized two-phase search, edit, calendar, multiselect, and deletion behaviors.
+description: "Build and refactor Clean POM Page Classes adhering to Flat Architecture standards."
 ---
 
 # Clean POM Crafter — Enterprise Clean POM Architecture Standards

package/.agents/skills/code-refactoring-refactor-clean/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: code-refactoring-refactor-clean
-description: "Master code refactoring and technical debt remediation. Enforces clean code principles, SOLID patterns, code smell elimination, dead code cleanup, and measurable debt reduction."
+description: "Eliminate technical debt and refactor code using SOLID and Clean Code patterns."
 ---
 
 # Refactor, Clean Code & Technical Debt Remediation

package/.agents/skills/db-state-verifier-and-seeder/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: db-state-verifier-and-seeder
-description: Verify database records, seed isolated test fixtures, and assert database mutations across SQL (PostgreSQL, MySQL, Oracle) and NoSQL (MongoDB, Redis). Use on-demand when testing backend state mutations or DB consistency.
+description: "Seed isolated test fixtures and assert database mutations across SQL and NoSQL."
 ---
 
 # Database State Verifier & Seeder Skill

package/.agents/skills/e2e-testing-patterns/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: e2e-testing-patterns
-description: Master architectural and organizational patterns for multi-browser E2E testing (Playwright, Cypress) focusing on test suite structure, parallel sharding, and retry governance.
+description: "Design robust multi-browser E2E test architectures, parallel sharding, and retry governance."
 ---
 
 # E2E Testing Architectural Patterns

package/.agents/skills/failure-autopsy-and-healing/SKILL.md

@@ -1,8 +1,6 @@
 ---
 name: failure-autopsy-and-healing
-description: >-
-  Automated failure triage, visual error autopsy from Screenshots/FAILED_*.png and Allure reports,
-  cross-platform JUnit XML parsing, and in-place Page Class code healing across automated test suites.
+description: "Triage test failures from JUnit XML/screenshots and heal broken Page Class locators."
 ---
 
 # Failure Autopsy & Auto-Healing (Diagnostic & Self-Healing Engine)

package/.agents/skills/file-and-report-validator/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: file-and-report-validator
-description: Validate uploaded and downloaded enterprise files (Excel .xlsx/.xls, CSV, PDF) for correct schemas, row counts, tabular data integrity, and PDF text/layout. Use on-demand when testing export/import workflows.
+description: "Validate downloaded and uploaded files (Excel, CSV, PDF) schemas and tabular integrity."
 ---
 
 # File & Report Validator Skill

package/.agents/skills/flaky-test-sentinel-and-quarantine/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: flaky-test-sentinel-and-quarantine
-description: Enterprise flaky test detection, scoring, and automated quarantine governance. Detects non-deterministic test behavior via multi-run repetition (e.g., 5 iterations), computes flakiness index, isolates unstable tests from blocking CI/CD merges via quarantine tagging (@quarantine / @flaky), and tracks MTBF until remediation.
+description: "Detect non-deterministic flaky tests, calculate flakiness scores, and manage quarantine."
 ---
 
 # Flaky Test Sentinel & Quarantine Protocol

package/.agents/skills/github-actions-templates/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: github-actions-templates
-description: Create production-ready GitHub Actions workflows for automated testing, building, and deploying applications. Use when setting up CI/CD with GitHub Actions, automating development workflows, or creating reusable workflow templates.
+description: "Create production-ready GitHub Actions workflows for automated test suites and CI/CD."
 ---
 
 # GitHub Actions Templates

package/.agents/skills/graphify-impact-analyzer/SKILL.md

@@ -1,8 +1,6 @@
 ---
 name: graphify-impact-analyzer
-description: >-
-  AST Knowledge Graph exploration, Architecture Navigation, and Zero-Waste Test Impact Analysis
-  across multi-module test cases using Graphify and tools/test_impact.py.
+description: "Analyze code change blast radius and scope impacted test cases via AST."
 ---
 
 # Graphify Impact Analyzer — AST Knowledge Graph Navigation & Zero-Waste Impact Analysis

package/.agents/skills/katalon-cli-runner/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: katalon-cli-runner
-description: Adaptive CLI execution manager for Katalon / Gradle headless test runners, supporting licensing fallback, zombie driver termination, and Allure report compilation. Use specifically when running enterprise Groovy/Katalon test suites.
+description: "Execute headless Katalon and Gradle test runners with automatic driver cleanup."
 ---
 
 # Katalon CLI & Enterprise Runner — Dual-Mode Execution Management

package/.agents/skills/lam-script-generator/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: lam-script-generator
-description: >-
-  Large Action Model (LAM) script generator inspired by LaVague. Transforms natural language user stories and acceptance criteria into 100% Clean POM automation scripts with zero token replayability.
+description: "Transform user stories and acceptance criteria into Clean POM automation scripts."
 ---
 
 # LAM Script Generator — Large Action Model for Test Automation

package/.agents/skills/playwright-live-interaction/SKILL.md

@@ -1,9 +1,6 @@
 ---
 name: playwright-live-interaction
-description: >-
-  Fast live web interaction and interactive debugging via Playwright MCP.
-  Use for rapid feedback, testing selectors, verifying Angular/PrimeNG components,
-  and executing test actions across enterprise web test suites without restarting Katalon/Selenium.
+description: "Probe live web DOM/AOM and verify selectors under 200ms using headless Playwright."
 ---
 
 # Playwright Live Interaction & Fast Debugging Handbook (Enterprise Web & Clean POM)

package/.agents/skills/security-dast-sentinel/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: security-dast-sentinel
-description: Dynamic Application Security Testing (DAST) and OWASP Top 10 automated verification for web apps and APIs. Audits security response headers (CSP, HSTS, X-Frame-Options), detects sensitive data leaks (PII, tokens, internal stacktraces), asserts BOLA/IDOR authorization boundaries via role token swapping, and validates CORS configurations.
+description: "Run dynamic security audits: OWASP Top 10, security headers, IDOR, and token leakage."
 ---
 
 # Security DAST Sentinel (Dynamic Application Security & OWASP Top 10)

package/.agents/skills/self-healing-locator/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: self-healing-locator
-description: >-
-  Token-efficient self-healing locator skill using Accessibility Tree (AOM) and semantic DOM diffing with Role > Label > TestId hierarchy, avoiding raw HTML bloat.
+description: "Heal broken locators using semantic AOM diffing with Role, Label, and TestId hierarchy."
 ---
 
 # Self-Healing Locator Skill — Token-Efficient AOM Diffing

package/.agents/skills/skillspector-security-guard/SKILL.md

@@ -0,0 +1,115 @@
+---
+name: skillspector-security-guard
+description: "Audit and verify AI agent skills, prompts, and MCP configurations against 71 vulnerability vectors inspired by NVIDIA SkillSpector."
+---
+
+# SkillSpector Security Guard — AI Agent & MCP Security Sentinel
+
+> **Purpose:** Autonomous security auditing, vulnerability vetting, and supply-chain inspection for AI Agent skills, prompt instruction files, Model Context Protocol (MCP) server configurations, and automation scripts.  
+> **Upstream Heritage:** Synthesized and adapted from **[NVIDIA/SkillSpector](https://github.com/NVIDIA/SkillSpector)** (Apache 2.0).
+
+---
+
+## 1. The Threat Model for AI Agent Skills
+
+AI agent skills execute with user-level permissions, terminal shell execution rights, and implicit trust. Unvetted third-party skills, instructions, or MCP configs can introduce severe vulnerabilities:
+- **Prompt Injection:** Overriding core system safety rules, steering model logic covertly, or forcing jailbreaks.
+- **Data Exfiltration:** Covertly shipping conversation memory, user secrets, or environment keys to external URLs.
+- **Privilege Escalation:** Running root/sudo commands, mounting `/var/run/docker.sock`, or stealing SSH/AWS keys.
+- **Agent Snooping:** Reading configuration stores (`~/.claude`, `~/.gemini`, `~/.codex`) or parsing `mcp.json` to steal tokens.
+- **MCP Tool Poisoning:** Injecting hidden instructions in tool metadata (HTML comments, Unicode homoglyphs, Base64).
+
+```mermaid
+flowchart TD
+    CandidateSkill["Candidate Skill / MCP Config / Prompt"] --> Scanner["<b>SkillSpector Sentinel</b><br/>(tools/skillspector.py)"]
+    
+    subgraph Vectors["71 Detection Vectors across 17 Categories"]
+        V1["Prompt Injection & Jailbreaks (P1-P4, P9)"]
+        V2["Data Exfiltration & Sinks (E1-E5)"]
+        V3["Privilege Escalation (PE1-PE5)"]
+        V4["Agent Snooping (~/.claude, mcp.json) (AS1-AS3)"]
+        V5["Tool Poisoning & Homoglyphs (TP1-TP4)"]
+        V6["Behavioral AST & Deserialization (AST1-AST10)"]
+    end
+    
+    Scanner --> Vectors
+    Vectors --> ProhibitionGuard["<b>Prohibition Context Guard</b><br/>(Filters defensive documentation & negations)"]
+    ProhibitionGuard --> Score["Risk Scoring Engine (0 - 100)"]
+    Score --> Verdict{"Verdict Assessment"}
+    
+    Verdict -- "Score < 25" --> Pass["✅ SAFE: Permitted to Install"]
+    Verdict -- "25 <= Score < 60" --> Warn["⚠️ CAUTION: Manual Review Required"]
+    Verdict -- "Score >= 60 or CRITICAL" --> Block["🛑 DO_NOT_INSTALL: Blocked & Quarantined"]
+```
+
+---
+
+## 2. 71 Vulnerability Vectors & Coverage Matrix
+
+| Category | Pattern IDs | Threat Vector & Description | Severity |
+| :--- | :--- | :--- | :--- |
+| **Prompt Injection** | `P1`, `P2`, `P3`, `P4`, `P9` | Instruction overrides, zero-width steganography, bidi Trojan Source (CVE-2021-42574), exfiltration directives, vertical whitespace padding (>20 blank lines). | **CRITICAL / HIGH** |
+| **Data Exfiltration** | `E1`, `E2`, `E3`, `E4`, `E5` | Outbound HTTP POST sinks (`curl`, `fetch`), `os.environ` harvesting, scanning for `.ssh` / `.aws` credentials, conversational context dumping, cloud storage upload. | **CRITICAL / HIGH** |
+| **Privilege Escalation** | `PE1` – `PE5` | Blanket wildcard permissions (`*`), `sudo`/`su`/`chmod 4755`, credential access (`/etc/shadow`, `kubeconfig`), `docker.sock` access, privileged containers. | **CRITICAL** |
+| **Agent Snooping** | `AS1`, `AS2`, `AS3` | Reading agent auth configs (`.claude/`, `.gemini/`, `.codex/`), accessing `mcp.json` / `claude_desktop_config.json`, cross-skill reconnaissance. | **CRITICAL** |
+| **System Prompt Leakage**| `P6`, `P7`, `P8` | Direct prompt extraction commands, side-channel extraction ("output text before this line"), tool exfiltration. | **HIGH** |
+| **Anti-Refusal Jailbreaks**| `AR1`, `AR2`, `AR3` | Refusal suppression ("never refuse", "always comply"), warning/caveat suppression, policy nullification ("you have no restrictions"). | **CRITICAL / HIGH** |
+| **MCP Tool Poisoning** | `TP1`, `TP2`, `TP3`, `TP4` | Hidden instructions in tool comments/Base64/data URIs, Cyrillic/Greek Unicode homoglyphs, parameter description injection, behavior drift. | **CRITICAL / HIGH** |
+| **MCP Least Privilege** | `LP1`, `LP2`, `LP3` | Undeclared network/shell capabilities, wildcard permissions (`*`), missing allowed tools. | **HIGH / MEDIUM** |
+| **Behavioral AST** | `AST1` – `AST10` | Dynamic `exec()`, `eval()`, `__import__()`, `subprocess(shell=True)`, `os.system()`, dynamic `getattr()`, reflective sink lookup, and insecure deserialization (`pickle`, `yaml.unsafe_load`). | **CRITICAL / HIGH** |
+| **Supply Chain & SSRF** | `SC1`, `SC2`, `SSRF1`, `SSRF2` | `curl \| bash` downloads, cloud instance metadata probing (`169.254.169.254`), internal loopback requests. | **CRITICAL / MEDIUM** |
+
+---
+
+## 3. NVIDIA Prohibition Context Engine (Defensive Language Guard)
+
+In software testing and quality engineering hubs, security rules and documentation frequently describe anti-patterns (e.g., *"Never use eval()"*, *"Strictly forbidden: do not run sudo"*).
+
+**SkillSpector Sentinel incorporates the NVIDIA Prohibition Context Engine:**
+1. **Direct Negative Imperatives:** Matches governed by preceding negations (`never`, `do not`, `don't`, `must not`, `strictly forbidden`, `avoid`) are exempted.
+2. **Defensive Callouts:** Patterns appearing inside `> [!CAUTION]`, `> [!WARNING]`, or `> [!IMPORTANT]` documentation blocks do not trigger false alerts.
+3. **Emoji ZWJ Preservation:** Legitimate Zero-Width Joiner emoji sequences (e.g. `👨‍👩‍👧‍👦`, `🏳️‍🌈`) are preserved, while standalone steganographic zero-width bytes are flagged.
+4. **Request-Anchored SSRF:** Localhost references in documentation or comments are ignored; only active request-issuing functions (`fetch('http://localhost...')`, `curl`) trigger SSRF checks.
+
+---
+
+## 4. Operational Runbook & CLI Usage
+
+### 1. Autonomous Pre-Install Audit
+Before loading or installing any new skill, rule, or MCP tool into the environment, run:
+```bash
+# Scan a single skill file or directory
+python3 tools/skillspector.py path/to/skill/
+
+# Or using the agent-qa unified CLI:
+agent-qa skillspector path/to/skill/
+
+# Or via npx (zero-install):
+npx synapse-hub skillspector path/to/skill/
+```
+
+### 2. Multi-Format Reporting for CI/CD
+```bash
+# Generate GitHub Actions SARIF format (Security Tab integration)
+python3 tools/skillspector.py .agents/skills/ --format sarif --output reports/skillspector.sarif
+
+# Generate JSON for automated policy gating
+python3 tools/skillspector.py .agents/skills/ --format json --output reports/skillspector.json
+
+# Strict gating: Exit with error code 1 if any CRITICAL or DO_NOT_INSTALL findings exist
+python3 tools/skillspector.py .agents/skills/ --strict
+```
+
+### 3. Verdict Interpretation & Action Table
+
+| Risk Score | Verdict | Permitted Action | Mandatory Remediation |
+| :---: | :---: | :---: | :--- |
+| **0 – 24** | **`SAFE`** | ✅ Install & execute freely. | No remediation required; skill is verified clean. |
+| **25 – 59** | **`CAUTION`** | ⚠️ Hold for manual inspection. | Inspect flagged lines; replace unpinned dependencies or wildcards. |
+| **60 – 100** | **`DO_NOT_INSTALL`** | 🛑 Blocked immediately. | Quarantined. Contains active prompt injection, RCE sink, or credential theft. |
+
+---
+
+## 5. Acknowledgments & Upstream Attribution
+
+This skill and its underlying inspection engine (`tools/skillspector.py`) are directly based on the research, pattern definitions, and defensive grammar created by the **NVIDIA AI Security Team** in **[NVIDIA/SkillSpector](https://github.com/NVIDIA/SkillSpector)** (Apache License 2.0).

package/.agents/skills/synthetic-test-data-generator/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: synthetic-test-data-generator
-description: Generate robust, idempotent, and boundary-value synthetic test data (strings, numbers, emails, addresses, enterprise contracts, GIS coordinates) for automated test suites.
+description: "Generate idempotent, boundary-value synthetic test data with unique runtime timestamps."
 ---
 
 # Synthetic Test Data Generator & Edge-Case Fuzzing Skill

package/.agents/skills/token-and-context-optimizer/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: token-and-context-optimizer
-description: Context engineering and token optimization skill for Antigravity, enforcing sparse context retrieval, log distillation, prevention of context degradation (Lost-in-the-Middle, attention sinks), and off-context memory scratchpad protocol.
+description: "Optimize prompt context, distill verbose logs, and prevent context rot in Antigravity."
 ---
 
 # Token & Context Optimizer — Antigravity Engineering Standard

package/.agents/skills/visual-regression-sentinel/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: visual-regression-sentinel
-description: Pixel-level and perceptual visual regression testing with dynamic masking, layout shift detection, and threshold-based visual assertions.
+description: "Run pixel and layout shift visual regression checks with anti-flake masking."
 ---
 
 # Visual Regression Sentinel Skill

package/.agents/skills/wcag-audit-patterns/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: wcag-audit-patterns
-description: Conduct WCAG 2.2 accessibility audits (Level A/AA) with automated AST analysis, keyboard trap verification, ARIA role assertions, and tools/wcag_audit.py.
+description: "Audit WCAG 2.2 accessibility (A/AA), keyboard navigation, and ARIA roles."
 ---
 
 # WCAG 2.2 Accessibility Audit Patterns

package/.agents/skills/web-vitals-and-performance-profiler/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: web-vitals-and-performance-profiler
-description: Profile Core Web Vitals (LCP, CLS, INP/FID, TTFB) and measure page load budgets via Chrome DevTools Protocol (CDP). Use on-demand when auditing UI performance or detecting slow API endpoints.
+description: "Measure Core Web Vitals (LCP, CLS, INP) and network waterfalls via CDP."
 ---
 
 # Web Vitals & Performance Profiler Skill

package/AGENTS.md

@@ -91,6 +91,42 @@ This repository defines specialized multi-agent profiles (configured in `.agents
 6. **Quality Gatekeeper & Sentinel (`quality-gatekeeper`):**
    - Enforces 8 Quality Gates (`verify_all.py`), scans fake passes (`infer_linter.py`), injects AST micro-mutants (`micro_mutator.py` requiring >= 80% mutation score), audits visual regression masks (`smart_visual_masker.py`), and checks DB leaks (`trace_data_flow.py`).
 
+### 4.1 SINGLE FRONT-DOOR PROTOCOL & DETERMINISTIC FSM WORKFLOW
+
+> **Decision Paralysis Prevention Invariant:**  
+> All incoming tasks enter exclusively through the **Single Front-Door (`orchestrator`)**.  
+> Subagents operate in a strictly sequential 5-Stage Finite State Machine (FSM). Out-of-order execution or ambiguous dispatch is prohibited.
+
+```mermaid
+flowchart TD
+    User([User / System Task]) --> Orchestrator["<b>Lead QA Orchestrator</b><br/><i>Single Front-Door Entrypoint</i>"]
+    
+    subgraph FSM["5-Stage Gatekeeper Execution Pipeline (FSM)"]
+        Stage1["<b>Stage 1: Discovery</b><br/>• Subagent: live-explorer<br/>• Probe DOM/AOM under 200ms<br/>• Emit Data Contract JSON"]
+        Stage2["<b>Stage 2: Code Synthesis</b><br/>• Subagent: pom-crafter<br/>• Clean POM + Flat Architecture<br/>• Zero XPaths in scripts"]
+        Stage3["<b>Stage 3: Headless Execution</b><br/>• Subagent: test-runner<br/>• Run headless CLI + distill logs<br/>• Output Pass/Fail status"]
+        Stage4["<b>Stage 4: Failure Autopsy & Healing</b><br/>• Subagent: failure-analyst<br/>• Activated ONLY if Stage 3 Fails<br/>• In-place healing via JUnit XML/Screenshot"]
+        Stage5["<b>Stage 5: Final Acceptance (DoD)</b><br/>• Subagent: quality-gatekeeper<br/>• 8 Quality Gates + Mutation Score >= 80%<br/>• Task Done"]
+        
+        Stage1 --> Stage2 --> Stage3
+        Stage3 -->|Pass| Stage5
+        Stage3 -->|Fail| Stage4
+        Stage4 -->|Healed| Stage3
+    end
+
+    Orchestrator --> Stage1
+```
+
+#### Deterministic Intent-to-Tool Matrix (Zero-Ambiguity Dispatch)
+
+| Specific User / System Intent | Designated Subagent | Situational Tool |
+| :--- | :--- | :--- |
+| **Inspect live DOM / probe selectors** | `live-explorer` | `tools/browser_helpers.js`, `tools/safety_firewall.py` |
+| **Author Page Classes or test scripts** | `pom-crafter` | `tools/repo_map.py`, `tools/universal_ir.py` |
+| **Execute headless suites / CI runs** | `test-runner` | `tools/distill_log.py`, `tools/matrix_sharder.py` |
+| **Triage failed test runs / RCA** | `failure-analyst` | `tools/pinpoint_failure.py`, `tools/auto_heal.py` |
+| **Enforce Quality Gates before commit** | `quality-gatekeeper` | `tools/verify_all.py`, `tools/micro_mutator.py` |
+
 ---
 
 ## 5. CENTRALIZED TOOLS RUNBOOK