tajul-avengers 1.0.0 → 1.0.2

package/README.md

@@ -4,31 +4,32 @@ Zero-dependency CLI tool to inject the **Avengers Protocol Multi-Agent Orchestra
 
 ---
 
-## ⚡ Quick Start with NPX (No installation needed)
+## ⚡ Quick Start with NPX (No installation required)
 
-### 1. Existing Project-এ ব্যবহার করার জন্য:
-আপনার চলমান যেকোনো প্রোজেক্টের ফোল্ডারে টার্মিনাল খুলে এই এক লাইনের কমান্ডটি দিন:
+### 1. Integrate into an Existing Project:
+Open your terminal inside any existing project folder and run:
 
 ```bash
 npx tajul-avengers init
 ```
-> এটি আপনার কোনো পুরনো কোড না ছুঁয়ে শুধু অর্কেস্ট্রেশন লেয়ার (`AGENTS.md`, `project.config.md`, `planning/`, `docs/`, `.agents/`, `scripts/`) বসিয়ে দেবে এবং পরবর্তী প্রম্পটগুলো টার্মিনালে দেখিয়ে দেবে।
+> **What it does:** Injects only the orchestration layer (`AGENTS.md`, `project.config.md`, `planning/`, `docs/`, `.agents/`, `scripts/`) without modifying or moving any of your existing source code. It then displays the exact AI prompts to get started.
 
 ---
 
-### 2. একদম নতুন ফুল-স্ট্যাক প্রজেক্ট তৈরি করার জন্য:
-যেকোনো ফোল্ডারে টার্মিনাল খুলে কমান্ড দিন:
+### 2. Scaffold a Brand-New Full-Stack Project:
+Open your terminal in any directory and run:
 
 ```bash
 npx tajul-avengers create my-new-project
-# অথবা সরাসরি
+# or simply:
 npx tajul-avengers my-new-project
 ```
+> **What it does:** Generates a complete full-stack boilerplate including frontend, backend, docker configurations, test setups, and multi-agent roles.
 
 ---
 
 ### 3. Interactive Mode:
-কোনো আর্গুমেন্ট ছাড়া সরাসরি রান করলে একটি ইন্টারঅ্যাক্টিভ মেনু দেখতে পাবেন:
+Run without arguments to access an interactive setup menu:
 
 ```bash
 npx tajul-avengers
@@ -36,30 +37,53 @@ npx tajul-avengers
 
 ---
 
-## 📦 npmjs-এ কীভাবে পাবলিশ করবেন (How to Publish):
+## 🚀 Two-Command AI Workflow for Existing Projects
 
-1. আপনার টার্মিনালে `cli` ফোল্ডারে যান:
+Once `init` is complete, open your AI coding assistant (Cursor, Claude Code, Antigravity, etc.) and run:
+
+### Command 1: Auto-Discovery & Baseline Audit
+```text
+Iron Man, adapt our Avengers Protocol to this existing codebase:
+1. Scan the full codebase to detect the frontend, backend, database ORM, package manager, and folder paths, then automatically update project.config.md.
+2. Thoroughly analyze what features, database schemas, and APIs currently exist, and document them in docs/EXISTING_PROJECT_SUMMARY.md.
+3. Establish accurate system baselines in docs/07-database-design.md, docs/08-api-contract.md, and docs/context-map.md.
+4. Do not modify or refactor any existing source code. Only generate the documentation baselines and configurations.
+```
+
+### Command 2: Gap Analysis & Feature Execution
+After writing your feature requirements in `planning/new-plan.md`, run:
+```text
+Iron Man, deeply analyze docs/EXISTING_PROJECT_SUMMARY.md (existing baseline) and planning/new-plan.md (new feature):
+1. Perform a Gap Analysis (what already exists vs. what needs to be created). Avoid duplicate models or endpoints.
+2. Deconstruct the feature into isolated sub-tasks with Task IDs ([TASK-001], [TASK-002]) in planning/task.md assigned to specialist agents (Edith, Friday, Thanos).
+3. Update planning/updateplanning.md.
+4. Begin task-by-task execution under the Avengers Protocol and context policy.
+```
+
+---
+
+## 📦 How to Publish to npm (For Maintainers)
+
+1. Navigate to the `cli` directory:
    ```bash
    cd cli
    ```
-2. npm-এ লগইন করুন (যদি আগে না করা থাকে):
+2. Log in to npm (if not already authenticated):
    ```bash
    npm login
    ```
-3. প্যাকেজ পাবলিশ করে দিন:
+3. Publish publicly:
    ```bash
    npm publish --access public
    ```
-
-পাবলিশ হওয়ার সাথে সাথেই পৃথিবীর যেকোনো ডেভেলপার `npx tajul-avengers` রান করতে পারবে!
+   *(If prompted for 2FA, pass your OTP: `npm publish --access public --otp=123456`)*
 
 ---
 
-## 🔄 টেমপ্লেট সিঙ্ক করার নিয়ম (Sync Templates):
-ভবিষ্যতে আপনি যদি মেইন `avengers_end_code` প্রোজেক্টে নতুন কোনো ডকুমেন্ট বা রুলস আপডেট করেন, তবে CLI-এর টেমপ্লেটগুলো আপডেট করতে শুধু চালান:
+## 🔄 Syncing Templates:
+Whenever you update root documents or protocol rules in `avengers_end_code`, sync the CLI bundle by running:
 
 ```bash
 cd cli
 node scripts/sync.js
 ```
-

package/bin/index.js

@@ -37,7 +37,7 @@ function printHelp() {
   printBanner();
   console.log(`
 ${c.bold}Usage:${c.reset}
-  ${c.green}npx tajul-avengers init${c.reset}               Inject protocol into current existing project
+  ${c.green}npx tajul-avengers init${c.reset}               Inject protocol & all guide READMEs into current project
   ${c.green}npx tajul-avengers create <name>${c.reset}      Create a new full-stack Avengers project
   ${c.green}npx tajul-avengers${c.reset}                    Interactive mode
 
@@ -69,7 +69,15 @@ function copyRecursive(src, dest, force = false) {
     fs.mkdirSync(dest, { recursive: true });
     const entries = fs.readdirSync(src);
     for (const entry of entries) {
-      copyRecursive(path.join(src, entry), path.join(dest, entry), force);
+      const srcChild = path.join(src, entry);
+      let destChild = path.join(dest, entry);
+
+      // Protect existing project README.md if present, saving as AVENGERS_README.md
+      if (entry === 'README.md' && fs.existsSync(destChild) && !force) {
+        destChild = path.join(dest, 'AVENGERS_README.md');
+      }
+
+      copyRecursive(srcChild, destChild, force);
     }
   } else {
     if (fs.existsSync(dest) && !force) {
@@ -91,12 +99,12 @@ async function handleInit(force = false) {
   }
 
   console.log(`${c.blue}ℹ${c.reset} Target directory: ${c.bold}${targetDir}${c.reset}`);
-  console.log(`${c.yellow}⏳ Injecting Avengers Protocol Orchestration Layer...${c.reset}`);
+  console.log(`${c.yellow}⏳ Injecting Avengers Protocol Orchestration & Documentation...${c.reset}`);
 
   try {
     copyRecursive(templateDir, targetDir, force);
 
-    console.log(`\n${c.green}${c.bold}✔ Avengers Protocol successfully injected!${c.reset}`);
+    console.log(`\n${c.green}${c.bold}✔ Avengers Protocol & Documentation successfully injected!${c.reset}`);
     console.log(`
 ${c.bold}📂 Files & Folders Added:${c.reset}
   ${c.cyan}├── AGENTS.md${c.reset}                          (Global Multi-Agent Rules)
@@ -104,7 +112,10 @@ ${c.bold}📂 Files & Folders Added:${c.reset}
   ${c.cyan}├── planning/${c.reset}                          (task.md, updateplanning.md, new-plan.md)
   ${c.cyan}├── docs/${c.reset}                              (ai-context-policy.md, context-map.md, etc.)
   ${c.cyan}├── .agents/${c.reset}                           (Specialist Skills)
-  ${c.cyan}└── scripts/${c.reset}                           (Validation & token-clean runners)
+  ${c.cyan}├── scripts/${c.reset}                           (Validation & token-clean runners)
+  ${c.cyan}├── HOW_TO_USE_BN.md & EN.md${c.reset}           (Comprehensive Usage Guides)
+  ${c.cyan}├── HOW_TO_USE_IN_EXISTING_PROJECT...${c.reset}  (Existing Project Guides - BN & EN)
+  ${c.cyan}└── PROJECT_STRUCTURE.md & README${c.reset}      (A-Z Structure & Client Brief)
 
 ${c.magenta}${c.bold}🚀 NEXT STEPS (পরবর্তী করণীয়):${c.reset}
 
@@ -219,7 +230,7 @@ async function main() {
   // Interactive menu if no arguments passed
   printBanner();
   console.log(`${c.bold}What would you like to do?${c.reset}`);
-  console.log(`  ${c.cyan}[1]${c.reset} Inject Avengers Protocol into ${c.bold}this existing project${c.reset} (init)`);
+  console.log(`  ${c.cyan}[1]${c.reset} Inject Avengers Protocol & Docs into ${c.bold}this existing project${c.reset} (init)`);
   console.log(`  ${c.cyan}[2]${c.reset} Create a ${c.bold}new full-stack project${c.reset} from scratch (create)`);
   console.log(`  ${c.cyan}[3]${c.reset} Exit\n`);
 
@@ -243,4 +254,3 @@ main().catch((err) => {
   console.error(`${c.red}Fatal error:${c.reset}`, err);
   process.exit(1);
 });
-

package/package.json

@@ -1,12 +1,18 @@
 {
   "name": "tajul-avengers",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "Zero-dependency CLI tool to inject Avengers Protocol multi-agent orchestration into existing projects or scaffold new ones.",
   "main": "bin/index.js",
   "bin": {
     "tajul-avengers": "bin/index.js",
     "tajul": "bin/index.js"
   },
+  "files": [
+    "bin",
+    "templates",
+    "scripts",
+    "README.md"
+  ],
   "keywords": [
     "avengers",
     "ai-agents",

package/scripts/sync.js

@@ -9,14 +9,20 @@ const fullDir = path.join(cliDir, 'templates/full');
 
 console.log('🔄 Syncing Avengers templates to CLI...');
 
-// Orchestration files & folders
+// Orchestration files & folders (including all documentation & guides)
 const orchItems = [
   'AGENTS.md',
   'project.config.md',
   'planning',
   'docs',
   '.agents',
-  'scripts'
+  'scripts',
+  'HOW_TO_USE_BN.md',
+  'HOW_TO_USE_EN.md',
+  'HOW_TO_USE_IN_EXISTING_PROJECT_BN.md',
+  'HOW_TO_USE_IN_EXISTING_PROJECT_EN.md',
+  'PROJECT_STRUCTURE.md',
+  'README.md'
 ];
 
 // Full project items
@@ -28,12 +34,7 @@ const fullItems = [
   'input',
   '.codex',
   '.editorconfig',
-  '.env.example',
-  'HOW_TO_USE_BN.md',
-  'HOW_TO_USE_EN.md',
-  'HOW_TO_USE_IN_EXISTING_PROJECT_BN.md',
-  'PROJECT_STRUCTURE.md',
-  'README.md'
+  '.env.example'
 ];
 
 fs.mkdirSync(orchDir, { recursive: true });
@@ -56,4 +57,3 @@ for (const item of fullItems) {
 }
 
 console.log('✅ Templates successfully synced!');
-

package/templates/full/.agents/skills/api-contract-validation/SKILL.md

@@ -0,0 +1,34 @@
+---
+name: api-contract-validation
+description: Workflow for validating API request and response contracts between Edith (backend) and Friday/Thor (frontend/mobile).
+---
+
+# API Contract Validation Workflow
+
+## Purpose
+Ensure that frontend client calls and backend endpoint definitions remain strictly synchronized through `docs/08-api-contract.md`, avoiding integration defects and silent assumptions.
+
+## Contract Structure Standard
+For every endpoint documented in `docs/08-api-contract.md`:
+1. **Method & Path**: `POST /api/v1/auth/login`
+2. **Auth & Permissions**: `Public` or `Bearer JWT` (Role: `Admin`, `Member`)
+3. **Request Headers & Query Params**: `page=1&limit=20&sort=desc`
+4. **Request Body Schema**: Strict JSON/TypeScript representation
+5. **Success Response (2xx)**: HTTP code and JSON payload shape
+6. **Error Responses (4xx, 5xx)**: Standard error format:
+   ```json
+   {
+     "statusCode": 400,
+     "message": "Validation failed",
+     "errors": ["email must be an email"]
+   }
+   ```
+
+## Contract Change Procedure
+1. **Change Initiation**: Identify the need for a modified or new endpoint.
+2. **Contract Update**: Edith updates `docs/08-api-contract.md`.
+3. **Notification**: Edith notes the update in `planning/updateplanning.md`.
+4. **Implementation**:
+   - Backend: Edith implements NestJS controller and DTO.
+   - Frontend/Mobile: Friday or Thor implements TanStack Query / Dio client call matching the contract.
+5. **Validation**: Run script `./scripts/validate-contracts.sh` or integration tests.

package/templates/full/.agents/skills/backend-development/SKILL.md

@@ -0,0 +1,44 @@
+---
+name: backend-development
+description: Workflow for implementing NestJS modular architecture, Prisma ORM schemas, PostgreSQL migrations, Redis caching, and REST APIs with Edith.
+---
+
+# Backend Development Workflow (Edith)
+
+## Purpose
+Guide the Backend Specialist (`edith`) to implement scalable, secure, and type-safe server logic in `development/backend/`.
+
+## Architecture Principles
+- **Transport Separation**: Controllers only handle HTTP concerns (request parsing, status codes, calling services).
+- **Domain Services**: Business logic, calculations, and invariants live in domain services.
+- **Data Access**: Prisma Client operations, query optimization, indexing, and transactional boundaries.
+
+## Step-by-Step Procedure
+
+### 1. Database Schema & Migration
+- Open `docs/07-database-design.md` and check the entity relationship.
+- Update `prisma/schema.prisma` with explicit relations, indexes, and constraints.
+- Generate migration:
+  ```bash
+  pnpm --filter backend prisma migrate dev --name <migration_name>
+  ```
+- *Human Approval Gate*: If migration drops columns or tables, stop and ask the user for approval.
+
+### 2. DTO & Validation
+- Define request and response DTOs using `class-validator` and `class-transformer`.
+- Sanitize inputs to prevent SQL injection and parameter tampering.
+
+### 3. Business Logic & Transactions
+- Implement domain logic inside dedicated services.
+- Use `prisma.$transaction` for multi-step mutations where consistency is required.
+
+### 4. Auth & Guards
+- Apply JWT guards or role-based permission guards on protected endpoints.
+- Extract user context securely via custom `@CurrentUser()` decorators.
+
+### 5. Contract Synchronization
+- Document the newly built endpoint in `docs/08-api-contract.md` so Friday and Thor can integrate seamlessly.
+- Run unit/integration tests:
+  ```bash
+  pnpm --filter backend test
+  ```

package/templates/full/.agents/skills/deployment-security/SKILL.md

@@ -0,0 +1,45 @@
+---
+name: deployment-security
+description: Workflow for containerization with Docker, Nginx reverse proxy configuration, CI/CD pipeline setup, and cyber security auditing with Ultron.
+---
+
+# Deployment and Security Workflow (Ultron)
+
+## Purpose
+Guide the DevOps and Security Specialist (`ultron`) to containerize the application, configure reverse proxies, set up automated CI/CD pipelines, and harden system security.
+
+## Key Focus Areas
+- **Containerization**: Multi-stage Docker builds for minimal production image sizes.
+- **Nginx**: Reverse proxy, SSL/TLS termination, rate limiting, gzip/brotli compression.
+- **Cyber Security**: Security headers, CORS, CSRF, cookie security, secret hygiene.
+- **CI/CD**: GitHub Actions workflows for automated linting, testing, and security scanning.
+
+## Step-by-Step Procedure
+
+### 1. Docker Build & Multi-Stage Architecture
+- Frontend Dockerfile: Build Next.js standalone output for ultra-lightweight containers.
+- Backend Dockerfile: Transpile NestJS to JavaScript and prune development dependencies.
+- Docker Compose: Configure app services, PostgreSQL, Redis, and health checks with resource limits.
+
+### 2. Nginx & Reverse Proxy Configuration
+- Set up reverse proxy routing:
+  - `/` -> Frontend Next.js container (port 3000)
+  - `/api/` -> Backend NestJS container (port 4000)
+- Enforce strict security headers:
+  ```nginx
+  add_header X-Frame-Options "DENY" always;
+  add_header X-Content-Type-Options "nosniff" always;
+  add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+  add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; object-src 'none';" always;
+  ```
+
+### 3. Cyber Security Audit
+- Run dependency vulnerability scan:
+  ```bash
+  pnpm audit
+  ```
+- Verify that `.env` files and API secrets are never tracked in Git (check `.gitignore`).
+- Verify rate limiting is active on `/api/v1/auth/*` routes.
+
+### 4. Human Approval Gate
+- Production deployment or changing production environment variables **ALWAYS** requires explicit human confirmation.

package/templates/full/.agents/skills/design-system/SKILL.md

@@ -0,0 +1,34 @@
+---
+name: design-system
+description: Workflow for establishing design tokens, typography scale, color palettes, dark mode, and UI component primitives with Jarvis.
+---
+
+# Design System Workflow (Jarvis)
+
+## Purpose
+Guide the Design Specialist (`jarvis`) to construct a coherent, accessible, and premium design system before mass frontend component implementation begins.
+
+## Key Deliverables
+1. **Design Tokens (`globals.css` / Tailwind Config)**:
+   - Surface colors: `--bg-primary`, `--bg-secondary`, `--bg-card`, `--border-subtle`.
+   - Typography colors: `--text-primary`, `--text-secondary`, `--text-muted`.
+   - Brand colors: `--primary`, `--primary-hover`, `--primary-foreground`.
+   - Feedback colors: `--success`, `--warning`, `--danger`, `--info`.
+   - Elevation shadows: soft, modern 1px delicate borders and layered shadows.
+2. **Typography Scale**:
+   - Central font: Google Fonts (Inter / Plus Jakarta Sans).
+   - Strict hierarchical sizing (H1 to H6, body-sm, body-md, caption).
+3. **Core UI Primitives**:
+   - `Button`: Primary, Secondary, Outline, Ghost, Danger with loading/disabled states.
+   - `Input` & `Textarea`: Clear borders, focus-visible rings, inline error state.
+   - `Card`: Surface elevation, padding rules, header/content/footer slots.
+   - `Skeleton`: Pulsing skeleton shapes for text, avatars, cards, and tables.
+   - `EmptyState`: Centered graphic/icon, title, message, and call-to-action button.
+   - `Badge` / `Tag`: Semantic status indicators.
+
+## Step-by-Step Procedure
+1. Inspect `README.md` for client brand guidelines or Figma URLs.
+2. Update `docs/04-design-system.md` with semantic token values.
+3. Apply variables in `development/frontend/src/styles/globals.css`.
+4. Build reusable primitives in `development/frontend/src/components/ui/`.
+5. Verify contrast ratios against WCAG 2.2 AA (minimum 4.5:1 for normal text).

package/templates/full/.agents/skills/frontend-development/SKILL.md

@@ -0,0 +1,42 @@
+---
+name: frontend-development
+description: Workflow for building Next.js App Router components, screens, client state, forms, and API integrations with Friday.
+---
+
+# Frontend Development Workflow (Friday)
+
+## Purpose
+Guide the Frontend Specialist (`friday`) to implement performant, accessible, and resilient web interfaces in `development/frontend/`.
+
+## Stack Standards
+- Next.js (App Router), TypeScript (strict mode), Tailwind CSS.
+- Client state: Zustand.
+- Server state: TanStack Query (React Query).
+- Forms: React Hook Form + Zod.
+
+## Step-by-Step Procedure
+
+### 1. Contract Verification
+- Open `docs/08-api-contract.md` to review the exact API endpoint, request body, query params, response shape, and error codes.
+- Do not guess or hallucinate backend routes.
+
+### 2. Mandatory 6 UI States Implementation
+Every page, table, and data-bound form must implement:
+1. **Default / Success State**: Clean, crisp UI with active data rendering.
+2. **Loading Skeleton State**: Tailored skeleton loader matching the exact shape of cards/rows.
+3. **Empty State**: Icon, headline, friendly description, and action button.
+4. **Validation & Error State**: Inline red helper text for input fields; toast notifications for API failure.
+5. **Responsive State**: Mobile-first design, fluid grid, collapsible sidebar, table horizontal scroll.
+6. **Interactive & Accessibility State**: Visible focus ring (`focus-visible:ring-2`), hover animations (`transition-all duration-200`), accessible ARIA labels.
+
+### 3. API Integration
+- Use a centralized API client with automatic token attachment and error interceptors.
+- Handle network errors, 401 unauthorized redirects, and 422 validation errors gracefully.
+
+### 4. Verification
+- Run:
+  ```bash
+  pnpm --filter frontend type-check # or npm run type-check
+  pnpm --filter frontend test       # or npm run test
+  ```
+- Inspect responsive behavior and keyboard accessibility.

package/templates/full/.agents/skills/project-planning/SKILL.md

@@ -0,0 +1,57 @@
+---
+name: project-planning
+description: Workflow for analyzing client requirements in README.md, preparing technical documentation in docs/, and initializing tasks in planning/task.md under the Avengers Protocol.
+---
+
+# Project Planning Workflow (Iron Man)
+
+## Purpose
+Guide the Chief Orchestrator (`iron_man`) to translate client requirements into structured technical blueprints and prioritized task boards without inventing details or burning excessive tokens.
+
+## Prerequisites
+- Read root `README.md` (single source of truth for requirements).
+- Read `project.config.md` (stack settings).
+- Read `AGENTS.md` (global rules).
+
+## Execution Steps
+
+### 1. Requirements Discovery
+- Extract functional requirements (`REQ-F-001`, `REQ-F-002`, ...), non-functional requirements, constraints, and external integrations from `README.md`.
+- Identify ambiguities or missing specifications.
+- **Rule**: If a requirement is missing or unclear, record it in `planning/open-questions.md`. Never guess client intent.
+
+### 2. Technical Blueprint Generation (`docs/`)
+Create or incrementally update the core technical specifications:
+- `docs/01-requirements-analysis.md`: Detailed functional/non-functional breakdown.
+- `docs/02-system-architecture.md`: High-level component and data flow.
+- `docs/07-database-design.md`: Tables, models, relations, and indexes.
+- `docs/08-api-contract.md`: Endpoints, request/response DTOs, and error codes.
+- `docs/10-security-plan.md`: Authentication, authorization, and rate limiting.
+- `docs/13-acceptance-criteria.md`: Verifiable completion criteria for each feature.
+
+*Token Optimization Tip: Use compact markdown tables and concise TypeScript/DTO interfaces instead of long conversational text.*
+
+### 3. Task Board Initialization & Granular Decomposition (`planning/tasks/`)
+Decompose the work into sequential and parallel tasks:
+- **Master Board (`planning/task.md`)**: Maintain the high-level Kanban overview linking each task ID to its file in `tasks/TASK-XXX.md`.
+- **Dynamic Granular Task Creation (`planning/tasks/TASK-XXX.md`)**: Generate or update an individual specification markdown file for each task (e.g. `planning/tasks/TASK-001.md`, `TASK-002.md`). Each file must include:
+  1. Status, Assignee, Priority, Dependencies, and Master Board Link.
+  2. Objective and User Story.
+  3. Direct inputs and contract references (`docs/08-api-contract.md`, `DESIGN_GUIDELINES.md`).
+  4. Granular step-by-step execution plan.
+  5. Acceptance criteria checklist.
+  6. Verification evidence block for Thanos.
+  7. Fresh session handoff command.
+- Assign each task to the appropriate hero agent:
+  - `[jarvis]`: Design tokens, UI states, component primitives.
+  - `[edith]`: DB schema, migrations, backend services, REST APIs.
+  - `[friday]`: Next.js web components, forms, client integration.
+  - `[thor]`: Flutter mobile views (if mobile enabled).
+  - `[thanos]`: Verification, tests, acceptance validation.
+  - `[ultron]`: Docker, Nginx, CI/CD, cyber security.
+
+*Token Optimization Tip: Granular task files isolate context so specialist agents only load their active task (~60 lines) instead of reading a massive monolithic document, cutting token consumption by 85–90%.*
+
+### 4. Human Approval Gate
+Present the planning summary to the human developer. Do not start coding until the plan is approved.
+

package/templates/full/.agents/skills/task-execution/SKILL.md

@@ -0,0 +1,47 @@
+---
+name: task-execution
+description: Standard workflow for executing a single assigned task under the Avengers Protocol, including context isolation, focused editing, and progress tracking.
+---
+
+# Task Execution Workflow
+
+## Purpose
+Standard operating procedure for any agent (Jarvis, Friday, Edith, Thor, Thanos, Ultron) when implementing an assigned task from `planning/task.md`.
+
+## Execution Steps
+
+### 1. Task Intake & Ownership
+- Identify the requested `TASK-ID` in `planning/task.md` and load its dedicated file: `planning/tasks/${TASK-ID}.md`.
+- Verify you are the assigned agent (`Assignee`).
+- Check that all prerequisite `Dependencies` are marked `DONE`.
+- Confirm that the task status is `READY`. Change status to `IN_PROGRESS` in both `planning/task.md` and `planning/tasks/${TASK-ID}.md`.
+
+### 2. Context Loading (Isolated & Focused — 90% Token Reduction)
+- Load **only** the direct files required for this task:
+  - The granular task file: `planning/tasks/${TASK-ID}.md`.
+  - The relevant technical contract referenced in the task file (e.g., `docs/08-api-contract.md` or `development/frontend/DESIGN_GUIDELINES.md`).
+  - The specific source code files to modify or test.
+- **Rule**: Do not read unrelated directories or full repository listings.
+
+### 3. Implementation
+- Make focused, surgical changes.
+- Reuse existing components, hooks, domain services, and utilities.
+- Never rewrite entire files when replacing a targeted function or block.
+- Follow the domain rules:
+  - Frontend: 6 UI States, accessible markup, WCAG 2.2 AA.
+  - Backend: DTO validation, service business logic, transaction safety.
+
+### 4. Verification Check
+- Run focused checks (type-check, linter, unit test for modified file).
+- If checks fail, fix the issue immediately before reporting completion.
+
+### 5. Checkpoint & Reporting
+- Update `planning/tasks/${TASK-ID}.md` with actual test verification logs and mark status (`IN_REVIEW` or `DONE`).
+- Synchronize status in the master board: `planning/task.md`.
+- Update `planning/updateplanning.md` with:
+  - Task ID and Assignee.
+  - Files modified.
+  - Verification commands run and results.
+  - Next ready task.
+  - **Fresh Session Handoff Command**: Always output the exact command (`planning/updateplanning.md পড়ে [NEXT-TASK-ID] শুরু করো`) and advise the developer to open a new chat window to eliminate token compounding and maintain 95% token efficiency.
+

package/templates/full/.agents/skills/testing/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: testing
+description: Workflow for verification, unit testing, integration testing, end-to-end testing, and acceptance verification with Thanos.
+---
+
+# Testing and Verification Workflow (Thanos)
+
+## Purpose
+Guide the QA and Verification Specialist (`thanos`) to enforce strict quality control, verify acceptance criteria, and snap bugs out of existence.
+
+## Testing Hierarchy
+1. **Focused Unit Tests**: Verify individual functions, utility methods, React components, and NestJS services. Run immediately after code modification.
+2. **Integration Tests**: Verify interactions between controllers, services, database models, and external APIs.
+3. **End-to-End (E2E) Tests**: Verify complete user flows across frontend and backend boundaries (e.g., registration -> email verification -> login -> dashboard).
+4. **Contract Tests**: Verify that HTTP endpoints return exact JSON shapes as documented in `docs/08-api-contract.md`.
+5. **Acceptance Criteria Verification**: Cross-reference the implementation against `docs/13-acceptance-criteria.md`.
+
+## Step-by-Step Procedure
+
+### 1. Identify Changed Files & Tasks
+- Review Git status or the changed file list reported in `planning/task.md`.
+
+### 2. Execute Focused Verification
+- Run the most focused test first:
+  ```bash
+  # Frontend focused test
+  pnpm --filter frontend test -- path/to/component.test.tsx
+
+  # Backend focused test
+  pnpm --filter backend test -- path/to/service.spec.ts
+  ```
+
+### 3. Diagnose Failures
+When a failure occurs, categorize it:
+- **Code Bug**: Implementation defect -> report exact stack trace and delegate fix to domain agent (Friday/Edith/Thor).
+- **Test Defect**: Flaky test or incorrect assertion -> update test spec.
+- **Environment**: Missing database or `.env` variable -> notify Ultron/developer.
+
+### 4. Acceptance Certification
+A task is certified `DONE` only when:
+- All required acceptance criteria have passed.
+- Actual test execution logs confirm 0 failures.
+- No untested edge cases or console errors are present.