tribunal-kit 4.5.0 → 4.6.0

package/.agent/workflows/tribunal-full.md

@@ -1,100 +1,129 @@
----
-description: Run ALL 16 Tribunal reviewer agents simultaneously. Maximum hallucination coverage. Use before merging any AI-generated code, before production deployments, or when maximum confidence is required.
----
-
-# /tribunal-full — Complete 16-Reviewer Audit
-
-$ARGUMENTS
-
----
-
-## When to Use /tribunal-full
-
-|Use `/tribunal-full` when...|Use targeted tribunal when...|
-|:---|:---|
-|Before merging any AI-generated code|Backend only → `/tribunal-backend`|
-|Before production deployment|Frontend only → `/tribunal-frontend`|
-|Security-critical feature review|DB only → `/tribunal-database`|
-|Code affects auth, payments, or PII||
-|Maximum confidence required||
-
----
-
-## 16 Reviewers — All Active Simultaneously
-
-```
-Tier 1: Always active (universal concerns)
-├── precedence-reviewer    → Checks local repo Case Law for past rejections
-├── logic-reviewer         → Hallucinated methods, impossible logic, undefined refs
-├── security-auditor       → OWASP 2025, injection, JWT, SSRF, IDOR
-└── resilience-reviewer    → Swallowed errors, unhandled rejections, missing retries
-
-Tier 2: Code quality
-├── dependency-reviewer    → Fabricated packages, supply chain, version compatibility
-├── type-safety-reviewer   → 'any' epidemic, Zod parse vs cast, unguarded access
-├── schema-reviewer        → Missing input validation, loose schemas, raw req.body
-└── sql-reviewer           → Injection, N+1, missing indexes, unscoped mutations
-
-Tier 3: Domain-specific
-├── frontend-reviewer      → React 19 APIs, RSC violations, hook rules, hydration
-├── performance-reviewer   → 2026 CWV targets, re-render cascades, memory leaks
-├── mobile-reviewer        → Reanimated thread safety, FlashList, safe area insets
-├── ai-code-reviewer       → Model name hallucinations, prompt injection, cost explosion
-├── test-coverage-reviewer → Happy path only, brittle selectors, missing edge cases
-└── accessibility-reviewer → WCAG 2.2 AA, ARIA misuse, focus management, live regions
-
-Tier 4: Performance Swarm (token-scoped specialists)
-├── vitals-reviewer        → Frontend CWV depth: Suspense waterfalls, paint jank, animation leaks
-├── db-latency-auditor     → DB layer: N+1, unbounded queries, unindexed WHERE, pool config
-└── throughput-optimizer   → Server runtime: event-loop blocks, serialized awaits, memory leaks
-```
-
----
-
-## Active Reviewers by Code Type
-
-Not all 11 reviewers produce meaningful findings on all code types. Active reviewers detect their first finding immediately — inactive reviewers auto-pass with "N/A for this code type."
-
-|Code Under Review|Critical Reviewers|
-|:---|:---|
-|REST API route|logic, security, dependency, type-safety, sql, schema, resilience|
-|React component|logic, frontend, accessibility, type-safety, resilience|
-|Database query|logic, security, sql, resilience|
-|AI LLM integration|logic, security, ai-code, dependency|
-|Test file|test-coverage, logic|
-|React Native / Expo|mobile, logic, security, performance|
-|Next.js page|logic, frontend, performance, accessibility|
-|Auth/JWT code|security, logic, type-safety|
-
----
-
-## Verdict Aggregation
-
-```
-All 16 verdicts are collected. Aggregated result:
-
-If ANY reviewer = ❌ REJECTED → Global verdict: ❌ REJECTED (must fix before Human Gate)
-If any reviewer = ⚠️ WARNING  → Global verdict: ⚠️ WARNINGS (proceed with attention)
-If all reviewers = ✅ APPROVED → Global verdict: ✅ APPROVED (proceed to Human Gate)
-```
-
----
-
----
-
-## Retry Protocol
-
-When code is rejected:
-
-```
-Attempt 1: Maker revises with reviewer feedback
-Attempt 2: Maker revises with stricter constraints + full reviewer context
-Attempt 3: Maker revises with maximum constraints + full context dump
-
-After 3 failed attempts:
-  → HALT
-  → Report to human with full failure history
-  → DO NOT retry silently
-```
-
----
+---
+description: Run ALL 16 Tribunal reviewer agents simultaneously. Maximum hallucination coverage. Use before merging any AI-generated code, before production deployments, or when maximum confidence is required.
+required-skills: all domain skills auto-loaded
+---
+
+# /tribunal-full — Complete 16-Reviewer Audit
+
+$ARGUMENTS
+
+---
+
+## $CONTEXT_REQUIRED
+
+```
+Read BEFORE full review:
+□ All modified files          → Use git diff to see pending changes
+□ package.json                → Verify all dependencies
+□ Config files                 → tsconfig, next.config, tailwind.config
+```
+
+---
+
+## When to Use /tribunal-full
+
+| Use `/tribunal-full` when...         | Use targeted tribunal when...        |
+| :----------------------------------- | :----------------------------------- |
+| Before merging any AI-generated code | Backend only → `/tribunal-backend`   |
+| Before production deployment         | Frontend only → `/tribunal-frontend` |
+| Security-critical feature review     | DB only → `/tribunal-database`       |
+| Code affects auth, payments, or PII  |                                      |
+| Maximum confidence required          |                                      |
+
+---
+
+## 16 Reviewers — All Active Simultaneously
+
+```
+Tier 1: Always active (universal concerns)
+├── precedence-reviewer    → Checks local repo Case Law for past rejections
+├── logic-reviewer         → Hallucinated methods, impossible logic, undefined refs
+├── security-auditor       → OWASP 2025, injection, JWT, SSRF, IDOR
+└── resilience-reviewer    → Swallowed errors, unhandled rejections, missing retries
+
+Tier 2: Code quality
+├── dependency-reviewer    → Fabricated packages, supply chain, version compatibility
+├── type-safety-reviewer   → 'any' epidemic, Zod parse vs cast, unguarded access
+├── schema-reviewer        → Missing input validation, loose schemas, raw req.body
+└── sql-reviewer           → Injection, N+1, missing indexes, unscoped mutations
+
+Tier 3: Domain-specific
+├── frontend-reviewer      → React 19 APIs, RSC violations, hook rules, hydration
+├── performance-reviewer   → 2026 CWV targets, re-render cascades, memory leaks
+├── mobile-reviewer        → Reanimated thread safety, FlashList, safe area insets
+├── ai-code-reviewer       → Model name hallucinations, prompt injection, cost explosion
+├── test-coverage-reviewer → Happy path only, brittle selectors, missing edge cases
+└── accessibility-reviewer → WCAG 2.2 AA, ARIA misuse, focus management, live regions
+
+Tier 4: Performance Swarm (token-scoped specialists)
+├── vitals-reviewer        → Frontend CWV depth: Suspense waterfalls, paint jank, animation leaks
+├── db-latency-auditor     → DB layer: N+1, unbounded queries, unindexed WHERE, pool config
+└── throughput-optimizer   → Server runtime: event-loop blocks, serialized awaits, memory leaks
+```
+
+---
+
+## Active Reviewers by Code Type
+
+Not all 11 reviewers produce meaningful findings on all code types. Active reviewers detect their first finding immediately — inactive reviewers auto-pass with "N/A for this code type."
+
+| Code Under Review   | Critical Reviewers                                                |
+| :------------------ | :---------------------------------------------------------------- |
+| REST API route      | logic, security, dependency, type-safety, sql, schema, resilience |
+| React component     | logic, frontend, accessibility, type-safety, resilience           |
+| Database query      | logic, security, sql, resilience                                  |
+| AI LLM integration  | logic, security, ai-code, dependency                              |
+| Test file           | test-coverage, logic                                              |
+| React Native / Expo | mobile, logic, security, performance                              |
+| Next.js page        | logic, frontend, performance, accessibility                       |
+| Auth/JWT code       | security, logic, type-safety                                      |
+
+---
+
+## Verdict Aggregation
+
+```
+All 16 verdicts are collected. Aggregated result:
+
+If ANY reviewer = ❌ REJECTED → Global verdict: ❌ REJECTED (must fix before Human Gate)
+If any reviewer = ⚠️ WARNING  → Global verdict: ⚠️ WARNINGS (proceed with attention)
+If all reviewers = ✅ APPROVED → Global verdict: ✅ APPROVED (proceed to Human Gate)
+```
+
+---
+
+## Retry Protocol
+
+When code is rejected:
+
+```
+Attempt 1: Maker revises with reviewer feedback
+Attempt 2: Maker revises with stricter constraints + full reviewer context
+Attempt 3: Maker revises with maximum constraints + full context dump
+
+After 3 failed attempts:
+  → HALT
+  → Report to human with full failure history
+  → DO NOT retry silently
+```
+
+---
+
+## Usage Examples
+
+```
+/tribunal-full audit all changes since last commit
+```
+
+---
+
+## After /tribunal-full — Next Steps
+
+| Outcome                    | Next Command                                   |
+| :------------------------- | :--------------------------------------------- |
+| All 16 reviewers approve   | → `/deploy` — highest confidence state         |
+| Reject with multiple fixes | → `/fix` for simple issues, `/debug` for logic |
+| Performance rejection      | → `/tribunal-speed` for granular profiling     |
+| Security rejection         | → Immediate `/tribunal-backend` to resolve     |
+
+---

package/.agent/workflows/tribunal-mobile.md

@@ -1,95 +1,122 @@
----
-description: Mobile-specific Tribunal. Runs Logic + Security + Mobile reviewers. Use for React Native, Expo, gesture handlers, animations, navigation, and any iOS/Android-targeted code.
----
-
-# /tribunal-mobile — Mobile Code Audit
-
-$ARGUMENTS
-
----
-
-## When to Use /tribunal-mobile
-
-|Use `/tribunal-mobile` when...|Use something else when...|
-|:---|:---|
-|React Native components|Web-only components → `/tribunal-frontend`|
-|Expo Router navigation|API routes → `/tribunal-backend`|
-|Reanimated animations/gestures|Full audit → `/tribunal-full`|
-|FlashList / FlatList code||
-|Platform-specific (ios/android) code||
-
----
-
-## 3 Active Reviewers (All Run Simultaneously)
-
-### precedence-reviewer    → Checks local repo Case Law for past rejections
-logic-reviewer
-- `runOnJS` called inside `onUpdate` instead of `onEnd` (runs every frame)
-- Missing `'worklet'` directive on functions called inside Reanimated
-- FlatList inside ScrollView (disables virtualization)
-- `useSharedValue` vs `useState` confusion (SharedValue on wrong thread)
-
-### security-auditor
-- AsyncStorage storing sensitive data (tokens, PII) unencrypted
-- API keys in source code (should be in EAS Secrets)
-- cleartext HTTP traffic (should be HTTPS on all platforms)
-- Deep link not validated before processing URL scheme
-
-### mobile-reviewer
-- `setState` inside Reanimated `onUpdate` (JS bridge crossing = jank)
-- Missing `'worklet'` on custom functions used in Reanimated
-- FlatList for large lists (use FlashList with `estimatedItemSize`)
-- Hardcoded pixel insets instead of `useSafeAreaInsets()`
-- `Platform.OS === 'ios'` inside StyleSheet.create (not evaluated correctly)
-- Missing `AppState` subscription cleanup (`subscription.remove()`)
-- `react-native Image` used instead of `expo-image` (poor caching)
-
----
-
-## Verdict System
-
-```
-If ANY reviewer → ❌ REJECTED: fix before Human Gate
-If any reviewer → ⚠️ WARNING:  proceed with flagged items
-If all reviewers → ✅ APPROVED: Human Gate
-```
-
----
-
----
-
-## Mobile-Specific Hallucination Traps (Common LLM Mistakes)
-
-```tsx
-// ❌ Missing 'worklet' — animation function crashes silently
-const clamp = (val: number, min: number, max: number) => Math.min(Math.max(val, min), max);
-// ✅ Must have worklet directive
-const clamp = (val: number, min: number, max: number): number => {
-  'worklet';
-  return Math.min(Math.max(val, min), max);
-};
-
-// ❌ Expo Router: navigate() was refactored in v4 — old API
-import { navigate } from 'expo-router';   // Named export doesn't exist
-// ✅ Current Expo Router v4
-import { router } from 'expo-router';
-router.push('/products/123');
-
-// ❌ React Native: StyleSheet.create doesn't eval functions
-const styles = StyleSheet.create({
-  box: { paddingTop: Platform.OS === 'ios' ? 20 : 0 } // Doesn't work in all contexts
-});
-// ✅ Use Platform.select or dynamic style object
-const boxStyle = Platform.select({ ios: { paddingTop: 20 }, android: { paddingTop: 0 } });
-```
-
----
-
-## Usage Examples
-
-```
-/tribunal-mobile the SwipeToDelete gesture implementation with Reanimated 3
-/tribunal-mobile the ProductList component using FlashList
-/tribunal-mobile the auth token storage and retrieval functions
-/tribunal-mobile the ProfileScreen with safe area insets
-```
+---
+description: Mobile-specific Tribunal. Runs Logic + Security + Mobile reviewers. Use for React Native, Expo, gesture handlers, animations, navigation, and any iOS/Android-targeted code.
+required-skills: building-native-ui, mobile-design
+---
+
+# /tribunal-mobile — Mobile Code Audit
+
+$ARGUMENTS
+
+---
+
+## $CONTEXT_REQUIRED
+
+```
+Read BEFORE mobile review:
+□ Target component files       → The mobile code being audited
+□ package.json                 → Verify versions (expo, react-native-reanimated)
+□ app.json / app.config.js     → Check for correct permissions and plugins
+```
+
+---
+
+## When to Use /tribunal-mobile
+
+| Use `/tribunal-mobile` when...       | Use something else when...                 |
+| :----------------------------------- | :----------------------------------------- |
+| React Native components              | Web-only components → `/tribunal-frontend` |
+| Expo Router navigation               | API routes → `/tribunal-backend`           |
+| Reanimated animations/gestures       | Full audit → `/tribunal-full`              |
+| FlashList / FlatList code            |                                            |
+| Platform-specific (ios/android) code |                                            |
+
+---
+
+## 3 Active Reviewers (All Run Simultaneously)
+
+### precedence-reviewer → Checks local repo Case Law for past rejections
+
+logic-reviewer
+
+- `runOnJS` called inside `onUpdate` instead of `onEnd` (runs every frame)
+- Missing `'worklet'` directive on functions called inside Reanimated
+- FlatList inside ScrollView (disables virtualization)
+- `useSharedValue` vs `useState` confusion (SharedValue on wrong thread)
+
+### security-auditor
+
+- AsyncStorage storing sensitive data (tokens, PII) unencrypted
+- API keys in source code (should be in EAS Secrets)
+- cleartext HTTP traffic (should be HTTPS on all platforms)
+- Deep link not validated before processing URL scheme
+
+### mobile-reviewer
+
+- `setState` inside Reanimated `onUpdate` (JS bridge crossing = jank)
+- Missing `'worklet'` on custom functions used in Reanimated
+- FlatList for large lists (use FlashList with `estimatedItemSize`)
+- Hardcoded pixel insets instead of `useSafeAreaInsets()`
+- `Platform.OS === 'ios'` inside StyleSheet.create (not evaluated correctly)
+- Missing `AppState` subscription cleanup (`subscription.remove()`)
+- `react-native Image` used instead of `expo-image` (poor caching)
+
+---
+
+## Verdict System
+
+```
+If ANY reviewer → ❌ REJECTED: fix before Human Gate
+If any reviewer → ⚠️ WARNING:  proceed with flagged items
+If all reviewers → ✅ APPROVED: Human Gate
+```
+
+---
+
+## Mobile-Specific Hallucination Traps (Common LLM Mistakes)
+
+```tsx
+// ❌ Missing 'worklet' — animation function crashes silently
+const clamp = (val: number, min: number, max: number) => Math.min(Math.max(val, min), max);
+// ✅ Must have worklet directive
+const clamp = (val: number, min: number, max: number): number => {
+  "worklet";
+  return Math.min(Math.max(val, min), max);
+};
+
+// ❌ Expo Router: navigate() was refactored in v4 — old API
+import { navigate } from "expo-router"; // Named export doesn't exist
+// ✅ Current Expo Router v4
+import { router } from "expo-router";
+router.push("/products/123");
+
+// ❌ React Native: StyleSheet.create doesn't eval functions
+const styles = StyleSheet.create({
+  box: { paddingTop: Platform.OS === "ios" ? 20 : 0 }, // Doesn't work in all contexts
+});
+// ✅ Use Platform.select or dynamic style object
+const boxStyle = Platform.select({ ios: { paddingTop: 20 }, android: { paddingTop: 0 } });
+```
+
+---
+
+## Usage Examples
+
+```
+/tribunal-mobile the SwipeToDelete gesture implementation with Reanimated 3
+/tribunal-mobile the ProductList component using FlashList
+/tribunal-mobile the auth token storage and retrieval functions
+/tribunal-mobile the ProfileScreen with safe area insets
+```
+
+---
+
+## After /tribunal-mobile — Next Steps
+
+| Outcome                     | Next Command                                      |
+| :-------------------------- | :------------------------------------------------ |
+| All checks pass             | → Safe to test on simulator / deploy              |
+| Reviewers reject with fixes | → Apply fixes, then run `/tribunal-mobile` again  |
+| Needs advanced mobile UI    | → `/ui-ux-pro-max` for premium app design         |
+| Animation drops frames      | → `/tribunal-performance` for JS thread profiling |
+
+---