tribunal-kit 4.5.0 → 4.6.0

package/.agent/workflows/generate.md

@@ -1,183 +1,198 @@
----
-description: Generate code using the full Tribunal Anti-Hallucination pipeline. Maker generates grounded in real project context at low temperature → domain-selected reviewers audit in parallel → Human Gate for final approval. Nothing is written to disk without explicit approval.
----
-
-# /generate — Hallucination-Free Code Generation
-
-$ARGUMENTS
-
----
-
-## When to Use /generate
-
-| Use `/generate` when... | Use something else when... |
-|:---|:---|
-| New code needs to be written from scratch | Existing code needs modification → `/enhance` |
-| A single focused piece of code is needed | Multi-domain build → `/create` or `/swarm` |
-| A safe, reviewed snippet is required | You want to understand options first → `/plan` |
-| You need a quick but Tribunal-reviewed piece | Full project structure needed → `/create` |
-
----
-
-## Pipeline Flow
-
-```
-Your request
-    │
-    ▼
-[Phase 6] Context Broker — Skill Selection
-├── Scores all 90+ skills against your task keywords
-├── Level 0 (Essential): top skills — full content, injected first
-├── Level 1 (Supplementary): medium relevance — key rules only
-├── Level 2 (Available): listed for reference only
-└── Large models: Essential + Supplementary | Small models: Essential only
-    │
-    ▼
-Context scan (MANDATORY before first line of code)
-├── Read package.json → verify all imports exist
-├── Read tsconfig.json → understand strictness, paths aliases
-├── Read referenced files → understand actual data shapes
-└── Read .env.example → know available environment variables
-    │
-    ▼
-Maker generates at temperature 0.1
-├── Only methods verified in official docs
-├── Only packages in package.json
-├── // VERIFY: [reason] on any uncertain call
-└── No full application generation — modules only
-    │
-    ▼
-[Phase 6] Inner-Loop Validator (AUTO — runs before you see the code)
-├── Scans generated snippet for OWASP patterns (critical/high/medium/low)
-├── Runs structural heuristics (empty catch, throw strings, env without fallback)
-├── Verdict: APPROVED / WARNING / REJECTED
-│   ├── APPROVED → continues to Tribunal Review
-│   ├── WARNING  → noted, continues with flag
-│   └── REJECTED → Maker auto-corrects (up to 2 inner-loop attempts)
-└── Only clean code reaches the Tribunal reviewers
-    │
-    ▼
-Tribunal Reviewers run in parallel (auto-selected by keyword)
-    │
-    ▼
-Human Gate — verdicts shown + unified diff
-Y = write to disk | N = discard | R = revise with feedback
-```
-
----
-
-## What the Maker Is Not Allowed to Do
-
-```
-❌ Import a package not in package.json
-❌ Call a method not verified in official documentation
-❌ Use TypeScript 'any' without an explanation comment
-❌ Generate an entire application in one shot
-❌ Guess at database column or table names (read schema first)
-❌ Fabricate API response shapes (read existing types first)
-❌ Assume environment variables exist (read .env.example first)
-❌ Use Next.js 14 patterns in a Next.js 15 project (check version!)
-❌ Use React 18 hooks in a React 19 project (useFormState → useActionState)
-❌ Use framer-motion v6 API in a v12 project (exitBeforeEnter → mode="wait")
-❌ Use raw useEffect for GSAP — always useGSAP from @gsap/react
-❌ Hallucinate LLM model names — verify against provider's current model list
-```
-
-When unsure: write `// VERIFY: [specific reason]` instead of hallucinating.
-
----
-
-## Reviewer Auto-Selection
-
-**Always active:**
-```
-precedence-reviewer→ Enforces repository Case Law and past rejections (Runs First)
-logic-reviewer     → Hallucinated methods, undefined refs, impossible logic
-security-auditor   → OWASP vulnerabilities, hardcoded secrets, injection
-```
-
-**Auto-activated by keywords:**
-
-| Keyword in request | Additional Reviewers |
-|:---|:---|
-| `api`, `route`, `endpoint`, `handler`, `server action` | `dependency-reviewer` + `type-safety-reviewer` |
-| `sql`, `query`, `database`, `prisma`, `drizzle`, `orm` | `sql-reviewer` |
-| `component`, `hook`, `react`, `vue`, `jsx`, `tsx` | `frontend-reviewer` + `type-safety-reviewer` + `ui-ux-auditor` |
-| `ui`, `design`, `landing`, `page`, `layout`, `style`, `css` | `ui-ux-auditor` + `accessibility-reviewer` |
-| `animation`, `gsap`, `framer`, `motion`, `scroll` | `frontend-reviewer` + `performance-reviewer` + `ui-ux-auditor` |
-| `test`, `spec`, `vitest`, `jest`, `playwright` | `test-coverage-reviewer` |
-| `slow`, `optimize`, `cache`, `performance`, `bundle` | `performance-reviewer` |
-| `mobile`, `react native`, `expo` | `mobile-reviewer` |
-| `llm`, `openai`, `anthropic`, `gemini`, `embedding`, `ai` | `ai-code-reviewer` |
-| `aria`, `wcag`, `a11y`, `accessibility` | `accessibility-reviewer` + `ui-ux-auditor` |
-| `import`, `package`, `npm`, `require` | `dependency-reviewer` |
-
-> For maximum safety on critical code: use `/tribunal-full` for all 11 reviewers simultaneously.
-
----
-
-## Reviewer Verdicts
-
-| Verdict | Meaning | What Happens |
-|:---|:---|:---|
-| `✅ APPROVED` | No issues found | Proceeds to Human Gate |
-| `⚠️ WARNING` | Non-blocking issue | Human Gate shown with warning highlighted |
-| `❌ REJECTED` | Blocking issue | Maker revises before Human Gate |
-
-**Retry limit:** Maker is revised up to 3 times per REJECTED verdict. After 3 failures, the session halts and reports to the user with full failure history. No silent failures.
-
----
-
-## Output Format
-
-```
-━━━ Tribunal: [Domain] ━━━━━━━━━━━━━━━━━━━━━━
-
-Active reviewers: logic · security · [others]
-
-[Generated code with // VERIFY: tags where uncertain]
-
-━━━ Verdicts ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
-
-logic-reviewer:      ✅ APPROVED
-security-auditor:    ✅ APPROVED  
-dependency-reviewer: ⚠️ WARNING — lodash not in package.json
-
-━━━ Warnings ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
-
-dependency-reviewer:
-  ⚠️ Medium — Line 3: 'lodash' imported but not in package.json
-  Fix: npm install lodash  OR  use built-in Array methods
-
-━━━ Human Gate ━━━━━━━━━━━━━━━━━━━━━━━━━━━━
-Write to disk?  Y = approve | N = discard | R = revise with feedback
-```
-
----
-
-| After /generate shows... | Go to |
-|:---|:---|
-| Multiple files need changing | `/enhance` for impact-zone analysis |
-| Security-critical code was generated | `/tribunal-full` for maximum coverage |
-| DB queries were generated | `/tribunal-database` |
-| New API routes were generated | `/tribunal-backend` |
-| Animation/motion code generated | `/tribunal-frontend` |
-| Tests need to be written next | `/test` |
-| Something was rejected 3 times | Escalate to human with failure report |
-
----
-
-## Usage Examples
-
-```
-/generate a JWT middleware for Express with HS256 algorithm enforcement
-/generate a Prisma query for users with their published posts in last 30 days
-/generate a debounced search hook in React 19 using useDeferredValue
-/generate a parameterized SQL query for paginated order history
-/generate a Zod schema for email + password + role login input
-/generate a Server Action for creating a product with image upload
-/generate a rate-limited fetch wrapper using @upstash/ratelimit
-/generate a Framer Motion page transition with shared element (layoutId)
-/generate a GSAP ScrollTrigger timeline with useGSAP React hook
-/generate an OpenAI structured output call with Zod schema validation
-```
+---
+description: Generate code using the full Tribunal Anti-Hallucination pipeline. Maker generates grounded in real project context at low temperature → domain-selected reviewers audit in parallel → Human Gate for final approval. Nothing is written to disk without explicit approval.
+required-skills: auto-detected from request keywords (see Reviewer Auto-Selection table)
+---
+
+# /generate — Hallucination-Free Code Generation
+
+$ARGUMENTS
+
+---
+
+## $CONTEXT_REQUIRED
+
+```
+Read BEFORE generating any code (MANDATORY — never skip):
+□ package.json      → Verify all imports exist before using them
+□ tsconfig.json     → Understand strictness, paths aliases, target version
+□ context/*.acf     → Load explicit goals, rules, and boundaries
+□ .env.example      → Know available environment variables
+□ Referenced files   → Understand actual data shapes and types
+```
+
+---
+
+## When to Use /generate
+
+| Use `/generate` when...                      | Use something else when...                     |
+| :------------------------------------------- | :--------------------------------------------- |
+| New code needs to be written from scratch    | Existing code needs modification → `/enhance`  |
+| A single focused piece of code is needed     | Multi-domain build → `/create` or `/swarm`     |
+| A safe, reviewed snippet is required         | You want to understand options first → `/plan` |
+| You need a quick but Tribunal-reviewed piece | Full project structure needed → `/create`      |
+
+---
+
+## Pipeline Flow
+
+```
+Your request
+    │
+    ▼
+[Phase 6] Context Broker — Skill Selection
+├── Scores all 90+ skills against your task keywords
+├── Level 0 (Essential): top skills — full content, injected first
+├── Level 1 (Supplementary): medium relevance — key rules only
+├── Level 2 (Available): listed for reference only
+└── Large models: Essential + Supplementary | Small models: Essential only
+    │
+    ▼
+Context scan (MANDATORY before first line of code)
+├── Read package.json → verify all imports exist
+├── Read tsconfig.json → understand strictness, paths aliases
+├── Read referenced files → understand actual data shapes
+└── Read .env.example → know available environment variables
+    │
+    ▼
+Maker generates at temperature 0.1
+├── Only methods verified in official docs
+├── Only packages in package.json
+├── // VERIFY: [reason] on any uncertain call
+└── No full application generation — modules only
+    │
+    ▼
+[Phase 6] Inner-Loop Validator (AUTO — runs before you see the code)
+├── Scans generated snippet for OWASP patterns (critical/high/medium/low)
+├── Runs structural heuristics (empty catch, throw strings, env without fallback)
+├── Verdict: APPROVED / WARNING / REJECTED
+│   ├── APPROVED → continues to Tribunal Review
+│   ├── WARNING  → noted, continues with flag
+│   └── REJECTED → Maker auto-corrects (up to 2 inner-loop attempts)
+└── Only clean code reaches the Tribunal reviewers
+    │
+    ▼
+Tribunal Reviewers run in parallel (auto-selected by keyword)
+    │
+    ▼
+Human Gate — verdicts shown + unified diff
+Y = write to disk | N = discard | R = revise with feedback
+```
+
+---
+
+## What the Maker Is Not Allowed to Do
+
+```
+❌ Import a package not in package.json
+❌ Call a method not verified in official documentation
+❌ Use TypeScript 'any' without an explanation comment
+❌ Generate an entire application in one shot
+❌ Guess at database column or table names (read schema first)
+❌ Fabricate API response shapes (read existing types first)
+❌ Assume environment variables exist (read .env.example first)
+❌ Use Next.js 14 patterns in a Next.js 15 project (check version!)
+❌ Use React 18 hooks in a React 19 project (useFormState → useActionState)
+❌ Use framer-motion v6 API in a v12 project (exitBeforeEnter → mode="wait")
+❌ Use raw useEffect for GSAP — always useGSAP from @gsap/react
+❌ Hallucinate LLM model names — verify against provider's current model list
+```
+
+When unsure: write `// VERIFY: [specific reason]` instead of hallucinating.
+
+---
+
+## Reviewer Auto-Selection
+
+**Always active:**
+
+```
+precedence-reviewer→ Enforces repository Case Law and past rejections (Runs First)
+logic-reviewer     → Hallucinated methods, undefined refs, impossible logic
+security-auditor   → OWASP vulnerabilities, hardcoded secrets, injection
+```
+
+**Auto-activated by keywords:**
+
+| Keyword in request                                          | Additional Reviewers                                           |
+| :---------------------------------------------------------- | :------------------------------------------------------------- |
+| `api`, `route`, `endpoint`, `handler`, `server action`      | `dependency-reviewer` + `type-safety-reviewer`                 |
+| `sql`, `query`, `database`, `prisma`, `drizzle`, `orm`      | `sql-reviewer`                                                 |
+| `component`, `hook`, `react`, `vue`, `jsx`, `tsx`           | `frontend-reviewer` + `type-safety-reviewer` + `ui-ux-auditor` |
+| `ui`, `design`, `landing`, `page`, `layout`, `style`, `css` | `ui-ux-auditor` + `accessibility-reviewer`                     |
+| `animation`, `gsap`, `framer`, `motion`, `scroll`           | `frontend-reviewer` + `performance-reviewer` + `ui-ux-auditor` |
+| `test`, `spec`, `vitest`, `jest`, `playwright`              | `test-coverage-reviewer`                                       |
+| `slow`, `optimize`, `cache`, `performance`, `bundle`        | `performance-reviewer`                                         |
+| `mobile`, `react native`, `expo`                            | `mobile-reviewer`                                              |
+| `llm`, `openai`, `anthropic`, `gemini`, `embedding`, `ai`   | `ai-code-reviewer`                                             |
+| `aria`, `wcag`, `a11y`, `accessibility`                     | `accessibility-reviewer` + `ui-ux-auditor`                     |
+| `import`, `package`, `npm`, `require`                       | `dependency-reviewer`                                          |
+
+> For maximum safety on critical code: use `/tribunal-full` for all 11 reviewers simultaneously.
+
+---
+
+## Reviewer Verdicts
+
+| Verdict       | Meaning            | What Happens                              |
+| :------------ | :----------------- | :---------------------------------------- |
+| `✅ APPROVED` | No issues found    | Proceeds to Human Gate                    |
+| `⚠️ WARNING`  | Non-blocking issue | Human Gate shown with warning highlighted |
+| `❌ REJECTED` | Blocking issue     | Maker revises before Human Gate           |
+
+**Retry limit:** Maker is revised up to 3 times per REJECTED verdict. After 3 failures, the session halts and reports to the user with full failure history. No silent failures.
+
+---
+
+## Output Format
+
+```
+━━━ Tribunal: [Domain] ━━━━━━━━━━━━━━━━━━━━━━
+
+Active reviewers: logic · security · [others]
+
+[Generated code with // VERIFY: tags where uncertain]
+
+━━━ Verdicts ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+logic-reviewer:      ✅ APPROVED
+security-auditor:    ✅ APPROVED
+dependency-reviewer: ⚠️ WARNING — lodash not in package.json
+
+━━━ Warnings ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+dependency-reviewer:
+  ⚠️ Medium — Line 3: 'lodash' imported but not in package.json
+  Fix: npm install lodash  OR  use built-in Array methods
+
+━━━ Human Gate ━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+Write to disk?  Y = approve | N = discard | R = revise with feedback
+```
+
+---
+
+| After /generate shows...             | Go to                                 |
+| :----------------------------------- | :------------------------------------ |
+| Multiple files need changing         | `/enhance` for impact-zone analysis   |
+| Security-critical code was generated | `/tribunal-full` for maximum coverage |
+| DB queries were generated            | `/tribunal-database`                  |
+| New API routes were generated        | `/tribunal-backend`                   |
+| Animation/motion code generated      | `/tribunal-frontend`                  |
+| Tests need to be written next        | `/test`                               |
+| Something was rejected 3 times       | Escalate to human with failure report |
+
+---
+
+## Usage Examples
+
+```
+/generate a JWT middleware for Express with HS256 algorithm enforcement
+/generate a Prisma query for users with their published posts in last 30 days
+/generate a debounced search hook in React 19 using useDeferredValue
+/generate a parameterized SQL query for paginated order history
+/generate a Zod schema for email + password + role login input
+/generate a Server Action for creating a product with image upload
+/generate a rate-limited fetch wrapper using @upstash/ratelimit
+/generate a Framer Motion page transition with shared element (layoutId)
+/generate a GSAP ScrollTrigger timeline with useGSAP React hook
+/generate an OpenAI structured output call with Zod schema validation
+```

package/.agent/workflows/marathon.md

@@ -1,5 +1,6 @@
 ---
 description: Long-running agent harness for multi-session projects. Decomposes specs into atomic features tracked in JSON, ensures clean handoffs between sessions, and provides structured progress tracking. Based on Anthropic's long-running agent patterns.
+required-skills: harness-protocol, agent-organizer
 ---
 
 # /marathon — Long-Running Agent Harness
@@ -8,14 +9,25 @@ $ARGUMENTS
 
 ---
 
+## $CONTEXT_REQUIRED
+
+```
+Read BEFORE marathon start/continue:
+□ progress.json               → See current marathon state
+□ feature_list.json           → View remaining tasks
+□ git log --oneline -5        → Check recent commits
+```
+
+---
+
 ## When to Use /marathon
 
-|Use `/marathon` when...|Use something else when...|
-|:---|:---|
-|A project requires multiple sessions to complete|Quick one-shot task → `/generate`|
-|You need structured progress tracking across context windows|Single feature addition → `/enhance`|
-|Building a complex app from a high-level spec|Planning without execution → `/plan`|
-|Previous agent sessions lost context or declared victory too early|Brainstorming options → `/brainstorm`|
+| Use `/marathon` when...                                            | Use something else when...            |
+| :----------------------------------------------------------------- | :------------------------------------ |
+| A project requires multiple sessions to complete                   | Quick one-shot task → `/generate`     |
+| You need structured progress tracking across context windows       | Single feature addition → `/enhance`  |
+| Building a complex app from a high-level spec                      | Planning without execution → `/plan`  |
+| Previous agent sessions lost context or declared victory too early | Brainstorming options → `/brainstorm` |
 
 ---
 
@@ -66,11 +78,7 @@ Features are stored in `.agent/history/marathon/feature_list.json` as structured
   "id": 1,
   "category": "core",
   "description": "User can open a new chat and see a welcome screen",
-  "steps": [
-    "Navigate to main page",
-    "Click 'New Chat' button",
-    "Verify welcome state renders"
-  ],
+  "steps": ["Navigate to main page", "Click 'New Chat' button", "Verify welcome state renders"],
   "passes": false,
   "sessionCompleted": null
 }
@@ -90,9 +98,11 @@ Every new session starts by orienting the agent. This is the **Coding Agent** pa
 ### Steps
 
 1. **Read marathon state:**
+
    ```bash
    node .agent/scripts/marathon_harness.js session-start
    ```
+
    This automatically:
    - Reads `progress.json` and shows what was done in previous sessions
    - Reads `git log --oneline -20` for recent commits
@@ -100,6 +110,7 @@ Every new session starts by orienting the agent. This is the **Coding Agent** pa
    - Records the session start time
 
 2. **Start the dev environment:**
+
    ```bash
    node .agent/scripts/auto_preview.js start
    ```
@@ -147,6 +158,7 @@ Work on exactly **one feature at a time**. This incremental approach prevents th
 ### If a feature cannot be completed
 
 If a feature is blocked or too complex for the current session:
+
 1. Leave it as `passes: false`
 2. Add a log note explaining why:
    ```bash
@@ -169,11 +181,13 @@ Every session MUST leave the codebase in a clean, merge-ready state.
    - If something is half-done, either complete it or revert it
 
 2. **Record session end:**
+
    ```bash
    node .agent/scripts/marathon_harness.js session-end "Implemented dark mode, user settings page, and notification bell"
    ```
 
 3. **Final git commit:**
+
    ```bash
    git commit -m "marathon: session N complete, 15/47 features passing"
    ```
@@ -245,3 +259,15 @@ node .agent/scripts/marathon_harness.js reset
 /marathon status
 /marathon reset
 ```
+
+---
+
+## After /marathon — Next Steps
+
+| Outcome                   | Next Command                          |
+| :------------------------ | :------------------------------------ |
+| Session completes         | → `/marathon continue` (next session) |
+| Feature done, needs audit | → `/audit` for project health         |
+| Marathon fully completed  | → `/deploy` to ship                   |
+
+---