tribunal-kit 5.8.4 → 6.0.0

package/.agent/rules/GEMINI.md

@@ -135,25 +135,23 @@ Did I load the agent's required skills?  → If no: check frontmatter skills: fi
 
 ---
 
-## Step 3 — Socratic Gate (Before Complex Work)
+## Step 3 — Socratic Gate (Adaptive Governance Policy)
 
-For any complex build, new feature, or unclear request — stop and ask before writing code.
+The Socratic Gate is **adaptive** based on the task's **Impact Tier** evaluated by `impact_classifier.js`:
 
-**Required questions by type:**
-
-| Request              | Questions                                                    |
-| -------------------- | ------------------------------------------------------------ |
-| New feature or build | 1-2 targeted questions about the highest-ambiguity decisions |
-| Code edit or bug fix | Confirm understanding of the root cause before fixing        |
-| Vague request        | 1 question about the core goal, then infer the rest          |
-| Full orchestration   | Block all subagents until plan is confirmed                  |
+| Impact Tier | Scope | Socratic Gate Policy |
+| ----------- | ----- | --------------------- |
+| **Tier 0 (Fast-Pass)** | Typo, CSS, markdown, formatting | **BYPASS** — 0 questions, 0 LLM calls |
+| **Tier 1 (Express Pass)** | Single-file component or function logic edit | **BYPASS** — 0 questions, single specialist pass |
+| **Tier 2 (Targeted Audit)** | Multi-file feature edit | **CONDITIONAL** — Ask 1 question ONLY if ambiguity score > 0.5 |
+| **Tier 3 (Full Gauntlet)** | Auth, schema, migration, breaking architectural changes | **REQUIRED** — 1-2 targeted questions before execution (bypassable via `--no-gate` / `--express`) |
 
 **Rules:**
 
 - Ask only what you cannot infer from context. Check the conversation first.
 - Max 2 questions per response. If you need more, prioritize the most blocking one.
 - Never ask what the user already told you. Never ask generic "what stack?" if the repo shows it.
-- Do not write a single line of code until the gate is cleared
+- Bypass gate automatically on Tier 0 and Tier 1 tasks to preserve rapid developer flow.
 
 ---
 
@@ -222,7 +220,7 @@ The Human Gate is never skipped. No code is written to a file without explicit u
 | Database/SQL          | logic + security + sql + schema + complexity-reviewer                                               |
 | Mobile/Cross-platform | logic + security + mobile-reviewer + type-safety + complexity-reviewer                              |
 | Any domain            | + performance (if optimization)                                                                     |
-| Before merge          | /tribunal-full (all 20)                                                                             |
+| Before merge          | /tribunal-full (all 27 reviewers)                                                                   |
 
 ---
 

package/.agent/rules/GEMINI_PLANNER.md

@@ -0,0 +1,84 @@
+---
+trigger: pipeline_only
+---
+
+# Tribunal Planner Rules — Condensed
+
+Minimal rules for Pass 1 (Planning) of the Hybrid Pipeline.
+These are the ONLY rules active during the planning phase.
+Full rules (GEMINI.md) are NOT loaded — this saves ~4,800 tokens.
+
+---
+
+## Task Classification
+
+| Type           | Signals                                            | Output              |
+| -------------- | -------------------------------------------------- | ------------------- |
+| Question       | "what is", "how does", "explain"                   | Text only — no code |
+| Simple edit    | "fix", "change", "update" (single file)            | Direct edit         |
+| Complex build  | "build", "create", "implement", "design"           | Structured spec     |
+| Refactor       | "refactor", "clean", "extract", "split"            | Structured spec     |
+| Test           | "test", "spec", "e2e"                              | Test spec           |
+
+---
+
+## Stack Detection
+
+| Keywords                                    | Stack          |
+| ------------------------------------------- | -------------- |
+| react, jsx, tsx, component, hook            | react          |
+| next, nextjs, server component              | nextjs         |
+| vue, nuxt, composition api                  | vue            |
+| typescript, interface, generic              | typescript     |
+| python, fastapi, django, flask              | python         |
+| express, hono, koa, node                    | node           |
+| sql, postgres, prisma, drizzle              | sql            |
+| rust, cargo, tokio, axum                    | rust           |
+| css, tailwind, responsive                   | css            |
+
+---
+
+## Skill Selection Rules
+
+1. Match task keywords against skill descriptions
+2. Match file extensions against stack affinities
+3. Select TOP 3 skills by relevance score
+4. Never load more than 3 skills for a single pass
+
+---
+
+## Output: Structured Spec Schema
+
+The planner MUST output a JSON object matching this schema:
+
+```json
+{
+  "task_type": "frontend_component | api_endpoint | database_query | auth_flow | test_suite | refactor | animation | general",
+  "stack": ["react", "typescript", "css"],
+  "target_file": "path/to/file.tsx",
+  "essential_skills": [
+    { "name": "skill-name", "score": 5.0 }
+  ],
+  "constraints": {
+    "accessibility": true,
+    "responsive": true,
+    "dark_mode": false,
+    "animation": false,
+    "tests_required": false,
+    "type_safe": true
+  },
+  "spec": "Original user task description"
+}
+```
+
+---
+
+## Planner Anti-Patterns
+
+```
+❌ Do not load full GEMINI.md — use this condensed file only
+❌ Do not load agent persona .md files — those are for generation, not planning
+❌ Do not generate code in the planning phase — output spec JSON only
+❌ Do not select more than 3 essential skills
+❌ Do not include tribunal review rules — those run in Pass 3 (validator)
+```

package/.agent/scripts/_utils.js

@@ -226,9 +226,34 @@ function parseArgs(argv, schema = {}) {
 
 // ── Command Runner ──────────────────────────────────────────────────────────
 
+const WINDOWS_CMD_SHIMS = new Set(["npm", "npx", "pnpm", "yarn", "bun", "bunx"]);
+
+/**
+ * Select the executable that should be passed to spawnSync.
+ * Only package-manager shims need a .cmd suffix on Windows; native executables
+ * such as node, cargo, and git must retain their original names.
+ *
+ * @param {string} cmd - Command to run
+ * @param {string} [platform] - Platform override for deterministic testing
+ * @returns {string}
+ */
+function normalizeCommand(cmd, platform = process.platform) {
+  const lowerCaseCommand = cmd.toLowerCase();
+  const hasPath = cmd.includes("/") || cmd.includes("\\\\");
+  if (
+    platform === "win32" &&
+    !hasPath &&
+    !lowerCaseCommand.endsWith(".cmd") &&
+    WINDOWS_CMD_SHIMS.has(lowerCaseCommand)
+  ) {
+    return `${cmd}.cmd`;
+  }
+  return cmd;
+}
+
 /**
  * Run a command synchronously and return a structured result.
- * Handles Windows .cmd shims automatically.
+ * Handles known Windows package-manager shims without rewriting native tools.
  *
  * @param {string} cmd - Command to run
  * @param {string[]} args - Arguments
@@ -237,12 +262,7 @@ function parseArgs(argv, schema = {}) {
  */
 function runCommand(cmd, args = [], opts = {}) {
   const { spawnSync } = require("child_process");
-  const executable =
-    process.platform === "win32" &&
-    !cmd.endsWith(".cmd") &&
-    !cmd.includes(path.sep)
-      ? `${cmd}.cmd`
-      : cmd;
+  const executable = normalizeCommand(cmd);
 
   const result = spawnSync(executable, args, {
     encoding: "utf8",
@@ -275,5 +295,6 @@ module.exports = {
   // CLI
   parseArgs,
   // Commands
+  normalizeCommand,
   runCommand,
 };

package/.agent/scripts/case_law_manager.js

@@ -58,6 +58,7 @@ const VALID_DOMAINS = new Set([
   "mobile",
   "testing",
   "devops",
+  "minimal_change",
   "general",
 ]);
 const VALID_VERDICTS = new Set([
@@ -65,6 +66,7 @@ const VALID_VERDICTS = new Set([
   "APPROVED_WITH_CONDITIONS",
   "PRECEDENT_SET",
   "OVERRULED",
+  "MINIMALITY_REJECTED",
 ]);
 
 // ── Noise filter ────────────────────────────────────────────────────────────

package/.agent/scripts/context_broker.js

@@ -49,11 +49,43 @@
 
 const fs = require("fs");
 const path = require("path");
+const { execFileSync } = require("child_process");
 
 // ── Colours & Shared Utilities ────────────────────────────────────────────────
 const { GREEN, YELLOW, CYAN, RED, BOLD, DIM, RESET } = require("./_colors");
 const { findAgentDir } = require("./_utils");
 
+/**
+ * Attempt native Rust context resolution for sub-15ms execution
+ */
+function tryNativeContextBroker(repoPath, targetFile) {
+  if (process.env.TK_DISABLE_RUST === "1") return null;
+
+  const candidates = [
+    path.join(__dirname, "../../target/release/tribunal-core.exe"),
+    path.join(__dirname, "../../target/release/tribunal-core"),
+    path.join(__dirname, "../../target/debug/tribunal-core.exe"),
+    path.join(__dirname, "../../target/debug/tribunal-core"),
+    "tribunal-core"
+  ];
+
+  for (const bin of candidates) {
+    try {
+      if (bin.includes(path.sep) && !fs.existsSync(bin)) continue;
+      const args = ["context-broker", "--repo-path", repoPath];
+      if (targetFile) args.push("--target-file", targetFile);
+      const out = execFileSync(bin, args, { encoding: "utf8", timeout: 2000, stdio: ["ignore", "pipe", "ignore"] });
+      if (out && out.trim().startsWith("{")) {
+        return JSON.parse(out);
+      }
+    } catch (_) {
+      // Continue to next candidate or fallback
+    }
+  }
+  return null;
+}
+
+
 
 // ── Domain → Skill affinity map ───────────────────────────────────────────────
 // Keywords in the user's task that strongly indicate specific skills.
@@ -355,25 +387,6 @@ const BASELINE_SKILLS = [
 
 // ── Skill catalogue (loaded from disk) ───────────────────────────────────────
 
-/**
- * Find the .agent directory by walking up from cwd.
- * @returns {string} path to .agent/
- */
-function findAgentDir() {
-  let current = path.resolve(process.cwd());
-  const root = path.parse(current).root;
-  while (current !== root) {
-    const candidate = path.join(current, ".agent");
-    if (fs.existsSync(candidate) && fs.statSync(candidate).isDirectory())
-      return candidate;
-    current = path.dirname(current);
-  }
-  console.error(
-    `${RED}✖ .agent/ not found. Run: npx tribunal-kit init${RESET}`,
-  );
-  process.exit(1);
-}
-
 /**
  * Parse the YAML frontmatter from a SKILL.md file.
  * Returns { name, description, ... } or null on parse failure.
@@ -831,13 +844,119 @@ function broker(task, files = [], model = "large", agentDir = null) {
   return { ...selection, promptText };
 }
 
+/**
+ * Pipeline-specific broker for the 3-pass hybrid architecture.
+ * Returns context tailored to each pipeline phase:
+ *   - "plan":     Skill names + descriptions only (for task classification)
+ *   - "build":    Top 2-3 essential skills' keyRules only (for code generation)
+ *   - "validate": Validator configuration (which patterns to check)
+ *
+ * @param {string}   task     - User task description
+ * @param {string[]} files    - Files being touched
+ * @param {string}   phase    - 'plan' | 'build' | 'validate'
+ * @param {string}   agentDir - Path to .agent/ directory
+ * @returns {object} Phase-specific context
+ */
+function brokerForPipeline(task, files = [], phase = "build", agentDir = null) {
+  const resolvedAgentDir = agentDir || findAgentDir();
+  const skills = loadSkills(resolvedAgentDir);
+  // Always use "small" model tier for aggressive pruning in pipeline mode
+  const selection = selectSkills(task, files, "small", skills);
+
+  if (phase === "plan") {
+    // Plan phase: skill names and descriptions only — no content, no keyRules
+    return {
+      phase: "plan",
+      skills: selection.essential.slice(0, 6).map(s => ({
+        name: s.name,
+        description: s.description,
+        score: selection.scores.get(s.name) || 0,
+      })),
+      total_matched: selection.essential.length + selection.available.length,
+    };
+  }
+
+  if (phase === "build") {
+    // Build phase: top 3 essential keyRules — maximum density, minimum tokens
+    return {
+      phase: "build",
+      skills: selection.essential.slice(0, 3).map(s => ({
+        name: s.name,
+        keyRules: s.keyRules || "",
+        score: selection.scores.get(s.name) || 0,
+      })),
+    };
+  }
+
+  if (phase === "validate") {
+    // Validate phase: return detected stack for targeted pattern matching
+    const fileExts = files.map(f => path.extname(f).toLowerCase()).filter(Boolean);
+    return {
+      phase: "validate",
+      detectedExtensions: fileExts,
+      essentialSkillNames: selection.essential.slice(0, 3).map(s => s.name),
+    };
+  }
+
+  // Fallback: return full selection
+  return { phase, ...selection };
+}
+
+/**
+ * Format pipeline-plan output: compact skill list for planner context.
+ * @param {string} task
+ * @param {object} pipelineResult - Output of brokerForPipeline(task, files, "plan")
+ * @returns {string}
+ */
+function formatPipelinePlan(task, pipelineResult) {
+  const lines = [
+    "# Pipeline Planner Context",
+    `# Task: ${task}`,
+    "",
+    "## Matched Skills (by relevance)",
+    "",
+  ];
+  for (const s of pipelineResult.skills) {
+    lines.push(`- **${s.name}** (score: ${s.score.toFixed(1)}): ${(s.description || "").slice(0, 120)}`);
+  }
+  lines.push("");
+  lines.push(`Total matched: ${pipelineResult.total_matched}`);
+  return lines.join("\n");
+}
+
+/**
+ * Format pipeline-build output: condensed keyRules for builder prompt injection.
+ * @param {string} task
+ * @param {object} pipelineResult - Output of brokerForPipeline(task, files, "build")
+ * @returns {string}
+ */
+function formatPipelineBuild(task, pipelineResult) {
+  const lines = [
+    "# Builder Context — Essential Rules Only",
+    `# Task: ${task}`,
+    "",
+  ];
+  for (const s of pipelineResult.skills) {
+    lines.push(`## ${s.name}`);
+    lines.push("");
+    lines.push(s.keyRules || "(no key rules extracted)");
+    lines.push("");
+    lines.push("---");
+    lines.push("");
+  }
+  return lines.join("\n");
+}
+
 module.exports = {
   broker,
+  brokerForPipeline,
   selectSkills,
   loadSkills,
   scoreSkill,
   tokenize,
   findAgentDir,
+  extractKeyRules,
+  tryNativeContextBroker,
 };
 
 // ── CLI Entry ─────────────────────────────────────────────────────────────────
@@ -925,8 +1044,22 @@ ${BOLD}Examples:${RESET}
     case "prompt":
       console.log(formatPrompt(task, effectiveModel, selection));
       break;
+    case "pipeline-plan": {
+      const pipelinePlan = brokerForPipeline(task, files, "plan", agentDir);
+      console.log(formatPipelinePlan(task, pipelinePlan));
+      break;
+    }
+    case "pipeline-build": {
+      const pipelineBuild = brokerForPipeline(task, files, "build", agentDir);
+      console.log(formatPipelineBuild(task, pipelineBuild));
+      break;
+    }
     default: // 'report'
       formatReport(task, effectiveModel, selection, elapsed);
       break;
   }
 }
+
+
+
+

package/.agent/scripts/guardrail_engine.js

@@ -35,6 +35,9 @@ const path = require("path");
  */
 function ruleFileExists(content, manifest, _ctx) {
   const violations = [];
+  if (_ctx && _ctx.filePath && (_ctx.filePath.endsWith(".js") || _ctx.filePath.endsWith(".py") || _ctx.filePath.endsWith(".json"))) {
+    return violations;
+  }
   const refs = manifest.cross_references || [];
 
   const agentDir = path.join(_ctx.projectRoot, ".agent");
@@ -104,7 +107,7 @@ function ruleReviewerCount(content, manifest, _ctx) {
   const actualCount = manifest.agents ? manifest.agents.reviewer_count : null;
   if (actualCount === null) return violations;
 
-  const countRegex = /(\d+)[-\s]+(?:parallel\s+)?(?:reviewers?|agents?)/gi;
+  const countRegex = /(\d+)\s*(?:-\s*)?(?:(?:parallel|domain(?:-specific)?|tribunal|code)\s+)*reviewers?\b/gi;
   let match;
   while ((match = countRegex.exec(content)) !== null) {
     const claimed = parseInt(match[1], 10);
@@ -132,6 +135,9 @@ function ruleReviewerCount(content, manifest, _ctx) {
  */
 function ruleSkillExists(content, manifest, _ctx) {
   const violations = [];
+  if (_ctx && _ctx.filePath && (_ctx.filePath.endsWith(".js") || _ctx.filePath.endsWith(".py") || _ctx.filePath.endsWith(".json"))) {
+    return violations;
+  }
   const skillNames = new Set(manifest.skills ? manifest.skills.names : []);
   if (skillNames.size === 0) return violations;
 
@@ -195,6 +201,9 @@ function ruleSkillExists(content, manifest, _ctx) {
  */
 function ruleAgentExists(content, manifest, _ctx) {
   const violations = [];
+  if (_ctx && _ctx.filePath && (_ctx.filePath.endsWith(".js") || _ctx.filePath.endsWith(".py") || _ctx.filePath.endsWith(".json"))) {
+    return violations;
+  }
   const agentNames = new Set(manifest.agents ? manifest.agents.all : []);
   if (agentNames.size === 0) return violations;
 
@@ -225,9 +234,9 @@ function ruleAgentExists(content, manifest, _ctx) {
 function ruleUnresolvedVerify(content, _manifest, ctx) {
   const violations = [];
   
-  // Skip this check for the internal .agent documentation files themselves
-  // because they contain instructions ABOUT the VERIFY tag.
-  if (ctx && ctx.filePath && ctx.filePath.includes(".agent") && ctx.filePath.endsWith(".md")) {
+  // Skip this check for the internal .agent files themselves
+  // because they contain instructions/comments ABOUT the VERIFY tag.
+  if (ctx && ctx.filePath && ctx.filePath.includes(".agent")) {
     return violations;
   }
 
@@ -360,6 +369,51 @@ function ruleImportPhantom(content, _manifest, ctx) {
   return violations;
 }
 
+/**
+ * Rule 9: rust-module-registration
+ * Validates that Rust modules in crates/core/src/commands are declared in mod.rs
+ * and registered in wrapper.js RUST_COMMANDS set.
+ */
+function ruleRustModuleRegistration(content, manifest, _ctx) {
+  const violations = [];
+  const root = _ctx.projectRoot || process.cwd();
+
+  const modRs = path.join(root, "crates", "core", "src", "commands", "mod.rs");
+  if (fs.existsSync(modRs)) {
+    const modContent = fs.readFileSync(modRs, "utf8");
+    const requiredMods = ["context_broker", "dag_scheduler", "context_compress"];
+    for (const m of requiredMods) {
+      if (!modContent.includes(`pub mod ${m};`)) {
+        violations.push({
+          rule: "rust-module-registration",
+          severity: "warning",
+          location: "crates/core/src/commands/mod.rs",
+          message: `Rust command module "${m}" not declared in mod.rs`,
+          suggestion: `Add "pub mod ${m};" to crates/core/src/commands/mod.rs`,
+          autoFixable: false,
+        });
+      }
+    }
+  }
+
+  const wrapperJs = path.join(root, "bin", "wrapper.js");
+  if (fs.existsSync(wrapperJs)) {
+    const wrapperContent = fs.readFileSync(wrapperJs, "utf8");
+    if (!wrapperContent.includes('"context-broker"')) {
+      violations.push({
+        rule: "rust-module-registration",
+        severity: "warning",
+        location: "bin/wrapper.js",
+        message: 'Command "context-broker" not registered in RUST_COMMANDS in bin/wrapper.js',
+        suggestion: 'Add "context-broker" to RUST_COMMANDS set in bin/wrapper.js',
+        autoFixable: false,
+      });
+    }
+  }
+
+  return violations;
+}
+
 // ── Rule Registry ─────────────────────────────────────────────────────────────
 
 const RULES = {
@@ -371,6 +425,7 @@ const RULES = {
   "unresolved-verify": ruleUnresolvedVerify,
   "numeric-consistency": ruleNumericConsistency,
   "import-phantom": ruleImportPhantom,
+  "rust-module-registration": ruleRustModuleRegistration,
 };
 
 // ── Main Validate Function ────────────────────────────────────────────────────
@@ -527,7 +582,7 @@ function main() {
     const content = fs.readFileSync(file, "utf8");
     const result = validate(content, manifest, {
       autoFix: fixMode,
-      context: { projectRoot },
+      context: { projectRoot, filePath: file },
     });
 
     totalViolations += result.violations.length;