tribunal-kit 3.0.0 → 4.0.0

package/.agent/workflows/tribunal-full.md

@@ -1,133 +1,93 @@
----
-description: Run ALL 11 Tribunal reviewer agents simultaneously. Maximum hallucination coverage. Use before merging any AI-generated code, before production deployments, or when maximum confidence is required.
----
-
-# /tribunal-full — Complete 11-Reviewer Audit
-
-$ARGUMENTS
-
----
-
-## When to Use /tribunal-full
-
-| Use `/tribunal-full` when... | Use targeted tribunal when... |
-|:---|:---|
-| Before merging any AI-generated code | Backend only → `/tribunal-backend` |
-| Before production deployment | Frontend only → `/tribunal-frontend` |
-| Security-critical feature review | DB only → `/tribunal-database` |
-| Code affects auth, payments, or PII | |
-| Maximum confidence required | |
-
----
-
-## 11 Reviewers — All Active Simultaneously
-
-```
-Tier 1: Always active (universal concerns)
-├── logic-reviewer         → Hallucinated methods, impossible logic, undefined refs
-└── security-auditor       → OWASP 2025, injection, JWT, SSRF, IDOR
-
-Tier 2: Code quality
-├── dependency-reviewer    → Fabricated packages, supply chain, version compatibility
-├── type-safety-reviewer   → 'any' epidemic, Zod parse vs cast, unguarded access
-└── sql-reviewer           → Injection, N+1, missing indexes, unscoped mutations
-
-Tier 3: Domain-specific
-├── frontend-reviewer      → React 19 APIs, RSC violations, hook rules, hydration
-├── performance-reviewer   → 2026 CWV targets, re-render cascades, memory leaks
-├── mobile-reviewer        → Reanimated thread safety, FlashList, safe area insets
-├── ai-code-reviewer       → Model name hallucinations, prompt injection, cost explosion
-├── test-coverage-reviewer → Happy path only, brittle selectors, missing edge cases
-└── accessibility-reviewer → WCAG 2.2 AA, ARIA misuse, focus management, live regions
-```
-
----
-
-## Active Reviewers by Code Type
-
-Not all 11 reviewers produce meaningful findings on all code types. Active reviewers detect their first finding immediately — inactive reviewers auto-pass with "N/A for this code type."
-
-| Code Under Review | Critical Reviewers |
-|:---|:---|
-| REST API route | logic, security, dependency, type-safety, sql |
-| React component | logic, frontend, accessibility, type-safety |
-| Database query | logic, security, sql |
-| AI LLM integration | logic, security, ai-code, dependency |
-| Test file | test-coverage, logic |
-| React Native / Expo | mobile, logic, security, performance |
-| Next.js page | logic, frontend, performance, accessibility |
-| Auth/JWT code | security, logic, type-safety |
-
----
-
-## Verdict Aggregation
-
-```
-All 11 verdicts are collected. Aggregated result:
-
-If ANY reviewer = ❌ REJECTED → Global verdict: ❌ REJECTED (must fix before Human Gate)
-If any reviewer = ⚠️ WARNING  → Global verdict: ⚠️ WARNINGS (proceed with attention)
-If all reviewers = ✅ APPROVED → Global verdict: ✅ APPROVED (proceed to Human Gate)
-```
-
----
-
-## Output Format
-
-```
-━━━ Tribunal Full — All 11 Reviewers ━━━━━━━━━━━━━━
-
-logic-reviewer:         ✅ APPROVED
-security-auditor:       ❌ REJECTED (1 critical)
-dependency-reviewer:    ⚠️ WARNING (1 medium)
-type-safety-reviewer:   ✅ APPROVED
-sql-reviewer:           ✅ APPROVED
-frontend-reviewer:      ✅ APPROVED
-performance-reviewer:   ⚠️ WARNING (1 low)
-mobile-reviewer:        N/A — no mobile code
-ai-code-reviewer:       N/A — no AI API calls
-test-coverage-reviewer: ❌ REJECTED (missing error path)
-accessibility-reviewer: ⚠️ WARNING (1 medium)
-
-━━━ GLOBAL VERDICT: ❌ REJECTED ━━━━━━━━━━━━━━━━━━━
-
-Blockers (must fix before Human Gate):
-1. security-auditor: JWT verify missing { algorithms } option in src/lib/auth.ts:45
-2. test-coverage-reviewer: POST /api/orders missing error path test
-
-Warnings (flagged but not blocking):
-- dependency-reviewer: 'zod' version mismatch — package uses 3.22.4, imports from 3.23.0-beta
-- performance-reviewer: LCP image missing priority={true}
-- accessibility-reviewer: icon button at line 67 missing aria-label
-
-━━━ Human Gate ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
-Approve after blockers resolved?  Y = proceed | N = discard | R = revise
-```
-
----
-
-## Retry Protocol
-
-When code is rejected:
-
-```
-Attempt 1: Maker revises with reviewer feedback
-Attempt 2: Maker revises with stricter constraints + full reviewer context
-Attempt 3: Maker revises with maximum constraints + full context dump
-
-After 3 failed attempts:
-  → HALT
-  → Report to human with full failure history
-  → DO NOT retry silently
-```
-
----
-
-## Cross-Workflow Navigation
-
-| Full Tribunal finds... | Go to |
-|:---|:---|
-| Backend security issues | Also run `/review` for deep pattern analysis |
-| Tests incomplete | `/test` to write missing cases |
-| Performance warnings | `/tribunal-performance` for full analysis |
-| After all blockers resolved | Re-run `/tribunal-full` before Human Gate |
+---
+description: Run ALL 11 Tribunal reviewer agents simultaneously. Maximum hallucination coverage. Use before merging any AI-generated code, before production deployments, or when maximum confidence is required.
+---
+
+# /tribunal-full — Complete 11-Reviewer Audit
+
+$ARGUMENTS
+
+---
+
+## When to Use /tribunal-full
+
+|Use `/tribunal-full` when...|Use targeted tribunal when...|
+|:---|:---|
+|Before merging any AI-generated code|Backend only → `/tribunal-backend`|
+|Before production deployment|Frontend only → `/tribunal-frontend`|
+|Security-critical feature review|DB only → `/tribunal-database`|
+|Code affects auth, payments, or PII||
+|Maximum confidence required||
+
+---
+
+## 11 Reviewers — All Active Simultaneously
+
+```
+Tier 1: Always active (universal concerns)
+├── precedence-reviewer    → Checks local repo Case Law for past rejections
+├── logic-reviewer         → Hallucinated methods, impossible logic, undefined refs
+└── security-auditor       → OWASP 2025, injection, JWT, SSRF, IDOR
+
+Tier 2: Code quality
+├── dependency-reviewer    → Fabricated packages, supply chain, version compatibility
+├── type-safety-reviewer   → 'any' epidemic, Zod parse vs cast, unguarded access
+└── sql-reviewer           → Injection, N+1, missing indexes, unscoped mutations
+
+Tier 3: Domain-specific
+├── frontend-reviewer      → React 19 APIs, RSC violations, hook rules, hydration
+├── performance-reviewer   → 2026 CWV targets, re-render cascades, memory leaks
+├── mobile-reviewer        → Reanimated thread safety, FlashList, safe area insets
+├── ai-code-reviewer       → Model name hallucinations, prompt injection, cost explosion
+├── test-coverage-reviewer → Happy path only, brittle selectors, missing edge cases
+└── accessibility-reviewer → WCAG 2.2 AA, ARIA misuse, focus management, live regions
+```
+
+---
+
+## Active Reviewers by Code Type
+
+Not all 11 reviewers produce meaningful findings on all code types. Active reviewers detect their first finding immediately — inactive reviewers auto-pass with "N/A for this code type."
+
+|Code Under Review|Critical Reviewers|
+|:---|:---|
+|REST API route|logic, security, dependency, type-safety, sql|
+|React component|logic, frontend, accessibility, type-safety|
+|Database query|logic, security, sql|
+|AI LLM integration|logic, security, ai-code, dependency|
+|Test file|test-coverage, logic|
+|React Native / Expo|mobile, logic, security, performance|
+|Next.js page|logic, frontend, performance, accessibility|
+|Auth/JWT code|security, logic, type-safety|
+
+---
+
+## Verdict Aggregation
+
+```
+All 11 verdicts are collected. Aggregated result:
+
+If ANY reviewer = ❌ REJECTED → Global verdict: ❌ REJECTED (must fix before Human Gate)
+If any reviewer = ⚠️ WARNING  → Global verdict: ⚠️ WARNINGS (proceed with attention)
+If all reviewers = ✅ APPROVED → Global verdict: ✅ APPROVED (proceed to Human Gate)
+```
+
+---
+
+---
+
+## Retry Protocol
+
+When code is rejected:
+
+```
+Attempt 1: Maker revises with reviewer feedback
+Attempt 2: Maker revises with stricter constraints + full reviewer context
+Attempt 3: Maker revises with maximum constraints + full context dump
+
+After 3 failed attempts:
+  → HALT
+  → Report to human with full failure history
+  → DO NOT retry silently
+```
+
+---

package/.agent/workflows/tribunal-mobile.md

@@ -1,119 +1,95 @@
----
-description: Mobile-specific Tribunal. Runs Logic + Security + Mobile reviewers. Use for React Native, Expo, gesture handlers, animations, navigation, and any iOS/Android-targeted code.
----
-
-# /tribunal-mobile — Mobile Code Audit
-
-$ARGUMENTS
-
----
-
-## When to Use /tribunal-mobile
-
-| Use `/tribunal-mobile` when... | Use something else when... |
-|:---|:---|
-| React Native components | Web-only components → `/tribunal-frontend` |
-| Expo Router navigation | API routes → `/tribunal-backend` |
-| Reanimated animations/gestures | Full audit → `/tribunal-full` |
-| FlashList / FlatList code | |
-| Platform-specific (ios/android) code | |
-
----
-
-## 3 Active Reviewers (All Run Simultaneously)
-
-### logic-reviewer
-- `runOnJS` called inside `onUpdate` instead of `onEnd` (runs every frame)
-- Missing `'worklet'` directive on functions called inside Reanimated
-- FlatList inside ScrollView (disables virtualization)
-- `useSharedValue` vs `useState` confusion (SharedValue on wrong thread)
-
-### security-auditor
-- AsyncStorage storing sensitive data (tokens, PII) unencrypted
-- API keys in source code (should be in EAS Secrets)
-- cleartext HTTP traffic (should be HTTPS on all platforms)
-- Deep link not validated before processing URL scheme
-
-### mobile-reviewer
-- `setState` inside Reanimated `onUpdate` (JS bridge crossing = jank)
-- Missing `'worklet'` on custom functions used in Reanimated
-- FlatList for large lists (use FlashList with `estimatedItemSize`)
-- Hardcoded pixel insets instead of `useSafeAreaInsets()`
-- `Platform.OS === 'ios'` inside StyleSheet.create (not evaluated correctly)
-- Missing `AppState` subscription cleanup (`subscription.remove()`)
-- `react-native Image` used instead of `expo-image` (poor caching)
-
----
-
-## Verdict System
-
-```
-If ANY reviewer → ❌ REJECTED: fix before Human Gate
-If any reviewer → ⚠️ WARNING:  proceed with flagged items
-If all reviewers → ✅ APPROVED: Human Gate
-```
-
----
-
-## Output Format
-
-```
-━━━ Tribunal Mobile ━━━━━━━━━━━━━━━━━━━━━━
-
-logic-reviewer:  ✅ APPROVED
-security-auditor: ⚠️ WARNING
-mobile-reviewer: ❌ REJECTED
-
-━━━ VERDICT: ❌ REJECTED ━━━━━━━━━━━━━━━━━
-
-Blockers:
-- mobile-reviewer: [HIGH] setState inside onUpdate gesture handler — JS bridge crossing every frame
-  Line: onUpdate: (e) => { setState(e.translationX); } // jank at scale
-  Fix:  const tx = useSharedValue(0);
-        onUpdate: (e) => { tx.value = e.translationX; } // pure UI thread
-
-- mobile-reviewer: [HIGH] FlatList with 500+ items — use FlashList
-  Line: <FlatList data={products} renderItem={renderItem} />
-  Fix:  <FlashList data={products} renderItem={renderItem} estimatedItemSize={72} />
-
-Warnings:
-- security-auditor: [MEDIUM] JWT token stored in AsyncStorage — use expo-secure-store
-```
-
----
-
-## Mobile-Specific Hallucination Traps (Common LLM Mistakes)
-
-```tsx
-// ❌ Missing 'worklet' — animation function crashes silently
-const clamp = (val: number, min: number, max: number) => Math.min(Math.max(val, min), max);
-// ✅ Must have worklet directive
-const clamp = (val: number, min: number, max: number): number => {
-  'worklet';
-  return Math.min(Math.max(val, min), max);
-};
-
-// ❌ Expo Router: navigate() was refactored in v4 — old API
-import { navigate } from 'expo-router';   // Named export doesn't exist
-// ✅ Current Expo Router v4
-import { router } from 'expo-router';
-router.push('/products/123');
-
-// ❌ React Native: StyleSheet.create doesn't eval functions
-const styles = StyleSheet.create({
-  box: { paddingTop: Platform.OS === 'ios' ? 20 : 0 } // Doesn't work in all contexts
-});
-// ✅ Use Platform.select or dynamic style object
-const boxStyle = Platform.select({ ios: { paddingTop: 20 }, android: { paddingTop: 0 } });
-```
-
----
-
-## Usage Examples
-
-```
-/tribunal-mobile the SwipeToDelete gesture implementation with Reanimated 3
-/tribunal-mobile the ProductList component using FlashList
-/tribunal-mobile the auth token storage and retrieval functions
-/tribunal-mobile the ProfileScreen with safe area insets
-```
+---
+description: Mobile-specific Tribunal. Runs Logic + Security + Mobile reviewers. Use for React Native, Expo, gesture handlers, animations, navigation, and any iOS/Android-targeted code.
+---
+
+# /tribunal-mobile — Mobile Code Audit
+
+$ARGUMENTS
+
+---
+
+## When to Use /tribunal-mobile
+
+|Use `/tribunal-mobile` when...|Use something else when...|
+|:---|:---|
+|React Native components|Web-only components → `/tribunal-frontend`|
+|Expo Router navigation|API routes → `/tribunal-backend`|
+|Reanimated animations/gestures|Full audit → `/tribunal-full`|
+|FlashList / FlatList code||
+|Platform-specific (ios/android) code||
+
+---
+
+## 3 Active Reviewers (All Run Simultaneously)
+
+### precedence-reviewer    → Checks local repo Case Law for past rejections
+logic-reviewer
+- `runOnJS` called inside `onUpdate` instead of `onEnd` (runs every frame)
+- Missing `'worklet'` directive on functions called inside Reanimated
+- FlatList inside ScrollView (disables virtualization)
+- `useSharedValue` vs `useState` confusion (SharedValue on wrong thread)
+
+### security-auditor
+- AsyncStorage storing sensitive data (tokens, PII) unencrypted
+- API keys in source code (should be in EAS Secrets)
+- cleartext HTTP traffic (should be HTTPS on all platforms)
+- Deep link not validated before processing URL scheme
+
+### mobile-reviewer
+- `setState` inside Reanimated `onUpdate` (JS bridge crossing = jank)
+- Missing `'worklet'` on custom functions used in Reanimated
+- FlatList for large lists (use FlashList with `estimatedItemSize`)
+- Hardcoded pixel insets instead of `useSafeAreaInsets()`
+- `Platform.OS === 'ios'` inside StyleSheet.create (not evaluated correctly)
+- Missing `AppState` subscription cleanup (`subscription.remove()`)
+- `react-native Image` used instead of `expo-image` (poor caching)
+
+---
+
+## Verdict System
+
+```
+If ANY reviewer → ❌ REJECTED: fix before Human Gate
+If any reviewer → ⚠️ WARNING:  proceed with flagged items
+If all reviewers → ✅ APPROVED: Human Gate
+```
+
+---
+
+---
+
+## Mobile-Specific Hallucination Traps (Common LLM Mistakes)
+
+```tsx
+// ❌ Missing 'worklet' — animation function crashes silently
+const clamp = (val: number, min: number, max: number) => Math.min(Math.max(val, min), max);
+// ✅ Must have worklet directive
+const clamp = (val: number, min: number, max: number): number => {
+  'worklet';
+  return Math.min(Math.max(val, min), max);
+};
+
+// ❌ Expo Router: navigate() was refactored in v4 — old API
+import { navigate } from 'expo-router';   // Named export doesn't exist
+// ✅ Current Expo Router v4
+import { router } from 'expo-router';
+router.push('/products/123');
+
+// ❌ React Native: StyleSheet.create doesn't eval functions
+const styles = StyleSheet.create({
+  box: { paddingTop: Platform.OS === 'ios' ? 20 : 0 } // Doesn't work in all contexts
+});
+// ✅ Use Platform.select or dynamic style object
+const boxStyle = Platform.select({ ios: { paddingTop: 20 }, android: { paddingTop: 0 } });
+```
+
+---
+
+## Usage Examples
+
+```
+/tribunal-mobile the SwipeToDelete gesture implementation with Reanimated 3
+/tribunal-mobile the ProductList component using FlashList
+/tribunal-mobile the auth token storage and retrieval functions
+/tribunal-mobile the ProfileScreen with safe area insets
+```