tribunal-kit 5.8.4 → 6.0.0

package/.agent/skills/agent-organizer/SKILL.md

@@ -1,15 +1,29 @@
 ---
 name: agent-organizer
 description: Master Agent orchestration framework. Coordination of sub-agents, workflow definitions, delegation patterns, state management across conversations, memory distillation, and execution loops. Use when assembling multi-agent systems or managing complex agent-to-agent architectures.
-allowed-tools: Read, Write, Edit, Glob, Grep
-version: 2.0.0
-last-updated: 2026-04-02
-applies-to-model: gemini-2.5-pro, claude-3-7-sonnet
-routing:
-  domain: general
-  tier: basic
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 3.0.0
+last-updated: 2026-07-30
+skills:
+  - parallel-agents
+  - fabel-protocol
+  - agentic-patterns
+scripts-binding:
+  - .agent/scripts/swarm_dispatcher.js
+  - .agent/scripts/verify_all.js
 ---
 
+# Agent Organizer — Multi-Agent Orchestration Mastery
+
+---
+
+## Mandatory Pre-Flight Context Inspection
+
+Before dispatching multi-agent tasks, you MUST inspect:
+1. `swarm-worker-registry.md` / `task.md` → Verify target worker agents and global execution state
+2. Context Window Budget rules (Section 1) → Trim worker payload context to max 3 files per dispatch
+3. Handoff state signals (`COMPLETE`, `BLOCKED`, `ERROR`) → Verify terminal status handling rules
+
 ## Hallucination Traps (Read First)
 
 - ❌ Dispatching sub-agents without a context_summary -> ✅ Always send a trimmed context, never the full conversation

package/.agent/skills/agentic-patterns/SKILL.md

@@ -1,19 +1,31 @@
 ---
 name: agentic-patterns
 description: AI agent design principles. Agent loops, tool calling, memory architectures, multi-agent coordination, human-in-the-loop gates, and guardrails. Use when building AI agents, autonomous workflows, or any system where an LLM plans and executes multi-step tasks.
-allowed-tools: Read, Write, Edit, Glob, Grep
-version: 1.0.0
-last-updated: 2026-03-12
-applies-to-model: gemini-2.5-pro, claude-3-7-sonnet
-routing:
-  domain: general
-  tier: basic
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 3.0.0
+last-updated: 2026-07-30
+skills:
+  - agent-organizer
+  - fabel-protocol
+  - thinking-protocol
+scripts-binding:
+  - .agent/scripts/swarm_dispatcher.js
+  - .agent/scripts/verify_all.js
 ---
 
 # Agentic Patterns
 
 ---
 
+## Mandatory Pre-Flight Context Inspection
+
+Before designing agentic loops, tool schemas, or memory architectures, you MUST inspect:
+1. `package.json` / LLM SDK definitions → Check tool calling syntax (Zod schemas, OpenAI/Anthropic function calling API)
+2. Agent Loop boundaries (Section 1) → Define hard caps on `MAX_STEPS` (default: 10) and explicit termination reasons
+3. Human-in-the-loop gates (Section 5) → Ensure approval gates for destructive, data-deleting, or high-cost API calls
+
+---
+
 ## The Agent Loop
 
 Every AI agent follows this fundamental pattern:

package/.agent/skills/ai-prompt-injection-defense/SKILL.md

@@ -1,15 +1,29 @@
 ---
 name: ai-prompt-injection-defense
 description: Prompt Injection and Jailbreak defense mastery. Mitigation strategies for direct injection, indirect injection via data poisoning, delimiter separation, XML framing, output validation, and LLM circuit breakers. Use when building AI systems that process untrusted user input or fetch external data.
-allowed-tools: Read, Write, Edit, Glob, Grep
-version: 2.0.0
-last-updated: 2026-04-02
-applies-to-model: gemini-2.5-pro, claude-3-7-sonnet
-routing:
-  domain: general
-  tier: basic
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 3.0.0
+last-updated: 2026-07-30
+skills:
+  - backend-security-expert
+  - vulnerability-scanner
+  - llm-engineering
+scripts-binding:
+  - .agent/scripts/lint_runner.js
+  - .agent/scripts/verify_all.js
 ---
 
+# Prompt Injection Defense — AI Security Mastery
+
+---
+
+## Mandatory Pre-Flight Context Inspection
+
+Before engineering LLM prompts or processing untrusted user input, you MUST inspect:
+1. Message Role Isolation (Section 15) → Place user input exclusively in `role: "user"` messages; never concatenate user input into `role: "system"`
+2. Delimiter Sandboxing (Section 49) → Frame untrusted input inside XML tags (`<user_input>`) or randomized nonces (`<data_a8b4f1c9>`)
+3. Human-in-the-Loop Gate (Section 119) → Require explicit human approval before executing state-changing tool operations (`delete_user`, `process_payment`)
+
 ## Hallucination Traps (Read First)
 
 - ❌ Putting user input into role:'system' messages -> ✅ User input MUST go in role:'user' only

package/.agent/skills/animation-on-scroll/SKILL.md

@@ -1,20 +1,29 @@
 ---
 name: animation-on-scroll
 description: Intentional scroll-driven motion using modern CSS scroll-timeline, view-timeline, or GSAP ScrollTrigger without scroll jank or performance degradation.
-version: 1.0.0
-last-updated: 2026-07-22
-applies-to-model: gemini-3-6-flash, claude-3-7-sonnet
-routing:
-  domain: Scroll-Driven Motion & Storytelling
-  tier: pro
-  co-requires: [gsap-scrolltrigger, 60fps-animation]
-  trigger-signals:
-    strong: [animation-on-scroll, scroll-driven motion, CSS scroll-timeline, view-timeline, GSAP ScrollTrigger, scrollytelling]
-    weak: [scroll animation, scroll effect]
+version: 3.0.0
+last-updated: 2026-07-30
+skills:
+  - motion-engineering
+  - 60fps-animation
+  - accessible-animation
+tools: Read, Grep, Glob, Bash, Edit, Write
+scripts-binding:
+  - .agent/scripts/lint_runner.js
+  - .agent/scripts/verify_all.js
 ---
 
 # Animation On Scroll — Intentional Scroll Motion
 
+---
+
+## Mandatory Pre-Flight Context Inspection
+
+Before implementing scroll-driven animations, you MUST inspect:
+1. Target browser support → Prefer pure CSS `animation-timeline: view()` / `scroll()` when possible
+2. Pinning & Scrubbing rules (Section 45) → Use `scrub: 1` in GSAP ScrollTrigger timelines for smooth inertia
+3. Anti-Scrolljacking rule (Section 88) → Never hijack native scroll wheel momentum or override browser scrolling velocity
+
 Architect performant scroll-linked motion and scrollytelling sequences that feel natural, fluid, and non-intrusive.
 
 ---

package/.agent/skills/animation-systems/SKILL.md

@@ -1,20 +1,29 @@
 ---
 name: animation-systems
 description: Systematize animation tokens (durations, easings, keyframes) across a full codebase for consistent motion design and maintenance.
-version: 1.0.0
-last-updated: 2026-07-22
-applies-to-model: gemini-3-6-flash, claude-3-7-sonnet
-routing:
-  domain: Motion Systems & Token Design
-  tier: pro
-  co-requires: [motion-engineering, emil-design-eng, 60fps-animation]
-  trigger-signals:
-    strong: [animation-systems, motion tokens, animation design system, easing tokens, duration scale]
-    weak: [motion tokens, animation variables]
+version: 3.0.0
+last-updated: 2026-07-30
+skills:
+  - motion-engineering
+  - 60fps-animation
+  - baseline-ui
+tools: Read, Grep, Glob, Bash, Edit, Write
+scripts-binding:
+  - .agent/scripts/lint_runner.js
+  - .agent/scripts/verify_all.js
 ---
 
 # Animation Systems — Global Motion Tokens & System Architecture
 
+---
+
+## Mandatory Pre-Flight Context Inspection
+
+Before defining animation tokens or styling transitions, you MUST inspect:
+1. `index.css` / `DESIGN.md` → Verify presence of centralized `--duration-*` and `--ease-*` CSS custom properties
+2. Centralized Motion Tokens Schema (Section 26) → Enforce standardized duration tiers (80ms instant to 500ms delight)
+3. Anti-Ad-Hoc Easing Rule (Section 48) → Strictly prohibit inline custom cubic-bezier curves; reference motion tokens instead
+
 Architect a unified, scalable motion system with centralized CSS easing curves, duration tiers, and standardized keyframes.
 
 ---

package/.agent/skills/antfu-conventions/SKILL.md

@@ -1,20 +1,31 @@
 ---
 name: antfu-conventions
 description: Anthony Fu's opinionated tooling and conventions for JavaScript/TypeScript projects: ESM-first, zero-config, type-safe, and clean tooling standards.
-version: 1.0.0
-last-updated: 2026-07-22
-applies-to-model: gemini-3-6-flash, claude-3-7-sonnet
-routing:
-  domain: Tooling Conventions & ESM Standards
-  tier: pro
-  co-requires: [clean-code, typescript-advanced]
-  trigger-signals:
-    strong: [antfu-conventions, antfu ESLint, ESM first, zero-config tooling, pnpm catalogs, Anthony Fu tooling]
-    weak: [eslint config, pnpm setup]
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 3.0.0
+last-updated: 2026-07-30
+skills:
+  - clean-code
+  - typescript-advanced
+  - monorepo-management
+scripts-binding:
+  - .agent/scripts/lint_runner.js
+  - .agent/scripts/verify_all.js
 ---
 
 # Antfu Conventions — ESM-First & Opinionated Modern Tooling
 
+---
+
+## Mandatory Pre-Flight Context Inspection
+
+Before configuring JS/TS tooling or lint rules, you MUST inspect:
+1. Pure ESM-First Requirement (Section 24) → Set `"type": "module"` in `package.json`; ban CommonJS `require()` or `module.exports`
+2. ESLint Flat Config (`eslint.config.js`) (Section 28) → Use `@antfu/eslint-config` with flat config format; ban legacy `.eslintrc.json`
+3. Explicit Type Imports (`import type`) (Section 45) → Enforce `import type` for type-only symbols to allow clean tree-shaking compilation
+
+# Antfu Conventions — ESM-First & Opinionated Modern Tooling
+
 Enforce Anthony Fu's modern JavaScript/TypeScript engineering conventions: ESM-first, zero-config, pnpm workspaces, and strict type safety.
 
 ---

package/.agent/skills/api-patterns/SKILL.md

@@ -1,17 +1,31 @@
 ---
 name: api-patterns
 description: API design mastery. REST, GraphQL, tRPC, and gRPC selection. Request/response design, pagination (cursor/offset), filtering, versioning, rate limiting, error formats (RFC 9457), authentication (JWT/OAuth2/API keys), idempotency, file uploads, webhooks, and OpenAPI documentation. Use when designing APIs, choosing protocols, or implementing API standards.
-allowed-tools: Read, Write, Edit, Glob, Grep
-version: 3.1.0
-last-updated: 2026-04-07
-applies-to-model: gemini-3-1-pro, claude-3-7-sonnet
-routing:
-  domain: general
-  tier: basic
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 3.0.0
+last-updated: 2026-07-30
+skills:
+  - api-security-auditor
+  - backend-security-expert
+  - schema-reviewer
+scripts-binding:
+  - .agent/scripts/lint_runner.js
+  - .agent/scripts/verify_all.js
 ---
 
 # API Patterns — Design & Protocol Mastery
 
+---
+
+## Mandatory Pre-Flight Context Inspection
+
+Before designing or implementing API endpoints, you MUST inspect:
+1. Authorization Header Token Passing (Section 17) → Pass JWTs in `Authorization: Bearer` headers; strictly ban tokens in URL query params
+2. Cursor-Based Pagination (Section 19) → Use cursor pagination for datasets >10K rows to eliminate `OFFSET N` performance degradation
+3. Idempotency Header for Mutations (Section 21) → Require `Idempotency-Key` headers for state-changing `POST` or `PATCH` retry operations
+
+# API Patterns — Design & Protocol Mastery
+
 ## Hallucination Traps (Read First)
 
 - ❌ JWT in URL query params → ✅ `Authorization: Bearer` header only. Query params get logged in server access logs.

package/.agent/skills/api-security-auditor/SKILL.md

@@ -1,19 +1,33 @@
 ---
 name: api-security-auditor
 description: API Security auditing mastery. Rate limiting architecture, API key management, payload validation, IDOR (Insecure Direct Object Reference) prevention, mass assignment flaws, GraphQL security, and server-side mitigations. Use when building external APIs, B2B services, or reviewing endpoint security.
-allowed-tools: Read, Write, Edit, Glob, Grep
-version: 2.0.0
-last-updated: 2026-04-02
-applies-to-model: gemini-2.5-pro, claude-3-7-sonnet
-routing:
-  domain: general
-  tier: basic
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 3.0.0
+last-updated: 2026-07-30
+skills:
+  - backend-security-expert
+  - vulnerability-scanner
+  - schema-reviewer
+scripts-binding:
+  - .agent/scripts/lint_runner.js
+  - .agent/scripts/verify_all.js
 ---
 
 # API Security Auditor — Endpoint Hardening Mastery
 
 ---
 
+## Mandatory Pre-Flight Context Inspection
+
+Before auditing or hardening API endpoints, you MUST inspect:
+1. IDOR Prevention (Section 17) → Perform explicit tenancy checks (`receipt.userId === req.user.id`) and prefer UUIDv4/CUID over sequential integer IDs
+2. Mass Assignment Mitigations (Section 47) → Enforce strict Zod schemas (`.strict()`) to prevent parameter overposting into DB updates
+3. Distributed Rate Limiting (Section 80) → Store rate limit state in Redis for multi-pod load balanced environments to prevent limit bypasses
+
+# API Security Auditor — Endpoint Hardening Mastery
+
+---
+
 ## Insecure Direct Object Reference (IDOR)
 
 IDOR occurs when an application provides direct access to objects based on user-supplied input without authorization checks.

package/.agent/skills/app-builder/SKILL.md

@@ -1,15 +1,29 @@
 ---
 name: app-builder
 description: Main application building orchestrator. Creates full-stack applications from natural language requests. Determines project type, selects tech stack, coordinates agents.
-allowed-tools: Read, Write, Edit, Glob, Grep
-version: 3.1.0
-last-updated: 2026-04-06
-applies-to-model: gemini-2.5-pro, claude-3-7-sonnet
-routing:
-  domain: general
-  tier: basic
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 3.0.0
+last-updated: 2026-07-30
+skills:
+  - nextjs-react-expert
+  - react-specialist
+  - project-idioms
+scripts-binding:
+  - .agent/scripts/lint_runner.js
+  - .agent/scripts/verify_all.js
 ---
 
+# App Builder — Application Orchestrator
+
+---
+
+## Mandatory Pre-Flight Context Inspection
+
+Before scaffolding or orchestrating application builds, you MUST inspect:
+1. Clarification Gate (Section 48) → Ask 4 core purpose/constraint questions before selecting stack or creating files
+2. Plan Verification (Section 220) → Ensure `{task-slug}.md` is created and verified in project root before invoking specialist agents
+3. Incremental Build Rule (Section 15) → Never generate entire applications in one shot; build and verify module by module
+
 ## Hallucination Traps (Read First)
 
 - ❌ Generating entire applications in one shot -> ✅ Build one module at a time, verify each

package/.agent/skills/apple-design/SKILL.md

@@ -1,20 +1,29 @@
 ---
 name: apple-design
 description: Apple's approach to interface design and fluid, physical motion, translated for the web. Use when building or reviewing gesture-driven UI, spring animations, drag/swipe/sheet interactions, momentum and interruptible transitions, translucent materials and depth, typography (optical sizing, tracking, leading), reduced-motion, or the design foundations behind Apple-style interfaces.
-version: 1.0.0
-last-updated: 2026-07-22
-applies-to-model: gemini-3-6-flash, claude-3-7-sonnet
-routing:
-  domain: UI Craft & Design Engineering
-  tier: master
-  co-requires: [emil-design-eng, soft-skill]
-  trigger-signals:
-    strong: [apple-design, apple ui, fluid motion, spring physics, translucency, backdrop blur, gesture driven, sheet interaction, momentum transition]
-    weak: [ios style, macos ui, glassmorphism]
+version: 3.0.0
+last-updated: 2026-07-30
+skills:
+  - soft-skill
+  - emil-design-eng
+  - 60fps-animation
+tools: Read, Grep, Glob, Bash, Edit, Write
+scripts-binding:
+  - .agent/scripts/lint_runner.js
+  - .agent/scripts/verify_all.js
 ---
 
 # Apple Design — Fluid Motion, Physicality & Translucent Depth
 
+---
+
+## Mandatory Pre-Flight Context Inspection
+
+Before engineering Apple-style UIs or gesture-driven components, you MUST inspect:
+1. Interruptible Physics-Based Springs (Section 22) → Use physics springs (`stiffness: 300, damping: 24, mass: 0.8`) instead of fixed-duration CSS cubic-beziers
+2. Translucent Backdrop Blur (Section 44) → Limit `backdrop-filter: blur(20px) saturate(180%)` strictly to sticky headers or modals to avoid GPU scroll jank
+3. Optical Letter-Spacing (Section 72) → Apply inverse tracking (`-0.025em` for titles, `+0.015em` for small captions) based on SF Pro font scaling
+
 Design engineering guidelines for bringing Apple's fluid, physical interface paradigms to modern web applications.
 
 ---

package/.agent/skills/architecture/SKILL.md

@@ -1,15 +1,29 @@
 ---
 name: architecture
 description: Software architecture mastery. System design patterns, clean architecture, hexagonal/ports-and-adapters, event-driven architecture, microservices vs monolith decision framework, CQRS, domain-driven design, Architecture Decision Records (ADRs), and scalability patterns. Use when making architecture decisions, designing systems, or documenting technical decisions.
-allowed-tools: Read, Write, Edit, Glob, Grep
-version: 3.1.0
-last-updated: 2026-04-07
-applies-to-model: gemini-3-1-pro, claude-3-7-sonnet
-routing:
-  domain: general
-  tier: basic
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 3.0.0
+last-updated: 2026-07-30
+skills:
+  - domain-modeling
+  - codebase-design
+  - clean-code
+scripts-binding:
+  - .agent/scripts/lint_runner.js
+  - .agent/scripts/verify_all.js
 ---
 
+# Architecture — System Design Mastery
+
+---
+
+## Mandatory Pre-Flight Context Inspection
+
+Before selecting architectural patterns or designing systems, you MUST inspect:
+1. Pragmatic Monolith Default (Section 31) → Start with a modular monolith for teams <5 or scale <100K RPM; ban premature microservices
+2. Clean Architecture Dependency Direction (Section 50) → Ensure dependency arrows point strictly inward to Domain; Domain must have zero external infrastructure dependencies
+3. ADR Requirement for Non-Trivial Decisons (Section 135) → Document every major architectural decision with an ADR in `docs/architecture/`
+
 ## Hallucination Traps (Read First)
 
 - ❌ Choosing microservices for a team of 1-3 developers -> ✅ Start monolith, extract services only when team/scale demands it

package/.agent/skills/audit-and-fix/SKILL.md

@@ -1,20 +1,29 @@
 ---
 name: audit-and-fix
 description: Accessibility auditing and remediation workflow combining detection, prioritization, and practical code fixes for WCAG 2.2 AA compliance issues.
-version: 1.0.0
-last-updated: 2026-07-22
-applies-to-model: gemini-3-6-flash, claude-3-7-sonnet
-routing:
-  domain: Accessibility Auditing & Remediation
-  tier: pro
-  co-requires: [web-accessibility-auditor, fixing-accessibility]
-  trigger-signals:
-    strong: [audit-and-fix, accessibility audit, WCAG remediation, fix accessibility, a11y audit, AccessLint]
-    weak: [a11y check, accessibility fix]
+version: 3.0.0
+last-updated: 2026-07-30
+skills:
+  - fixing-accessibility
+  - build-primitive
+  - baseline-ui
+tools: Read, Grep, Glob, Bash, Edit, Write
+scripts-binding:
+  - .agent/scripts/lint_runner.js
+  - .agent/scripts/verify_all.js
 ---
 
 # Audit and Fix — Accessibility Remediation Workflow
 
+---
+
+## Mandatory Pre-Flight Context Inspection
+
+Before performing accessibility audits or fixes, you MUST inspect:
+1. Automated Violation Detection (Section 24) → Audit markup for missing `alt`, un-labeled inputs/buttons, and `onClick` on non-interactive elements
+2. Prioritization Matrix (Section 31) → Fix Level A blockers (forms, focus traps, keyboard access) before addressing contrast or landmark regions
+3. Anti-Redundant ARIA rule (Section 60) → Do NOT add `role="button"` to native `<button>` tags; apply `aria-hidden="true"` to decorative inner SVGs
+
 Systematically audit HTML/JSX markup against WCAG 2.2 AA standards, prioritize accessibility violations, and apply verified code fixes.
 
 ---

package/.agent/skills/authentication-best-practices/SKILL.md

@@ -1,19 +1,33 @@
 ---
 name: authentication-best-practices
 description: Authentication and Authorization mastery. Best practices for OAuth2, OpenID Connect, JWT (JSON Web Tokens), session management, password hashing, MFA (Multi-Factor Authentication), RBAC/ABAC, SSO, and secure credential storage. Use when auditing or implementing login flows, identity systems, or access control.
-allowed-tools: Read, Write, Edit, Glob, Grep
-version: 2.0.0
-last-updated: 2026-04-02
-applies-to-model: gemini-2.5-pro, claude-3-7-sonnet
-routing:
-  domain: general
-  tier: basic
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 3.0.0
+last-updated: 2026-07-30
+skills:
+  - backend-security-expert
+  - api-security-auditor
+  - vulnerability-scanner
+scripts-binding:
+  - .agent/scripts/lint_runner.js
+  - .agent/scripts/verify_all.js
 ---
 
 # Authentication & Authorization — Identity Mastery
 
 ---
 
+## Mandatory Pre-Flight Context Inspection
+
+Before implementing authentication or session flows, you MUST inspect:
+1. Modern Password Hashing (Section 28) → Use Argon2id or bcrypt; ban legacy fast algorithms (`md5`, `sha256`) for credential hashing
+2. Token Storage Separation (Section 83) → Keep short-lived access tokens in JS memory and long-lived refresh tokens in `HttpOnly`, `SameSite=Lax/Strict` cookies
+3. OAuth PKCE Flow Requirement (Section 109) → Enforce Authorization Code Flow with PKCE for all single-page and mobile apps; ban deprecated Implicit Flow
+
+# Authentication & Authorization — Identity Mastery
+
+---
+
 ## Passwords & Hashing
 
 ```typescript

package/.agent/skills/backend-security-expert/SKILL.md

@@ -1,17 +1,31 @@
 ---
 name: backend-security-expert
 description: Backend security auditing for modern server-side architectures. Focuses on Next.js Server Actions, Node.js/Edge APIs, JWT & Session architectures, ORM injection (Prisma/Drizzle), and RBAC implementation.
-allowed-tools: Read, Write, Edit, Glob, Grep
-version: 1.0.0
-last-updated: 2026-05-22
-applies-to-model: gemini-3-1-pro, claude-3-7-sonnet
-routing:
-  domain: general
-  tier: basic
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 3.0.0
+last-updated: 2026-07-30
+skills:
+  - frontend-security-expert
+  - api-security-auditor
+  - vulnerability-scanner
+scripts-binding:
+  - .agent/scripts/lint_runner.js
+  - .agent/scripts/verify_all.js
 ---
 
 # Backend Security Expert — Modern Server Architectures
 
+---
+
+## Mandatory Pre-Flight Context Inspection
+
+Before auditing or writing backend server code, you MUST inspect:
+1. Server Action Endpoints (Section 26) → Treat Next.js Server Actions as public API routes: authenticate session and parse input with Zod at entry
+2. JWT Algorithm Verification (Section 17) → Enforce explicit algorithms (`alg: "HS256"`) when verifying JWT tokens to prevent "None" algorithm exploits
+3. IDOR & RBAC Validation (Section 34) → Verify resource ownership (`WHERE userId = session.userId`) and user roles before executing mutations
+
+# Backend Security Expert — Modern Server Architectures
+
 ## Hallucination Traps (Read First)
 
 - ❌ Recommending session tokens without algorithm enforcement → ✅ Always verify JWT algorithms (`alg: "HS256"`) to prevent "None" attacks.

package/.agent/skills/baseline-ui/SKILL.md

@@ -1,20 +1,29 @@
 ---
 name: baseline-ui
 description: Quickly deslop UI code by fixing spacing, hierarchy, typography, contrast, and small layout issues. Use when the interface needs a fast cleanup or polish pass.
-version: 1.0.0
-last-updated: 2026-07-22
-applies-to-model: gemini-3-6-flash, claude-3-7-sonnet
-routing:
-  domain: UI Cleanup & Refinement
-  tier: basic
-  co-requires: [better-ui, frontend-design]
-  trigger-signals:
-    strong: [baseline-ui, deslop, cleanup ui, fix spacing, visual hierarchy, fix alignment]
-    weak: [tidy up, fix css, layout cleanup]
+version: 3.0.0
+last-updated: 2026-07-30
+skills:
+  - better-ui
+  - frontend-design
+  - better-colors
+tools: Read, Grep, Glob, Bash, Edit, Write
+scripts-binding:
+  - .agent/scripts/lint_runner.js
+  - .agent/scripts/verify_all.js
 ---
 
 # Baseline UI — Fast Deslopping & Hierarchy Cleanup
 
+---
+
+## Mandatory Pre-Flight Context Inspection
+
+Before cleaning up UI styles, you MUST inspect:
+1. `DESIGN.md` / `package.json` → Check Tailwind CSS configuration and accessibility primitives (`Base UI`, `Radix`)
+2. The 5-Step Deslop Protocol (Section 33) → Fix spacing violations, establish 3-tier typographic hierarchy, and eliminate harsh borders
+3. Anti-Slop Table (Section 43) → Replace hardcoded arbitrary paddings and low-contrast text with tokenized CSS variables
+
 Enforces an opinionated UI baseline to clean up sloppy code and prevent AI-generated interface slop without changing product architecture or feature scope.
 
 ---

package/.agent/skills/bash-linux/SKILL.md

@@ -1,15 +1,29 @@
 ---
 name: bash-linux
 description: Bash/Linux terminal mastery. Shell scripting, piping, stream redirection, process substitution, strict mode (set -euo pipefail), AWK, ripgrep parsing, and robust error handling. Use when writing CI scripts, debugging POSIX environments, or manipulating text pipelines.
-allowed-tools: Read, Write, Edit, Glob, Grep
-version: 2.0.0
-last-updated: 2026-04-02
-applies-to-model: gemini-2.5-pro, claude-3-7-sonnet
-routing:
-  domain: general
-  tier: basic
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 3.0.0
+last-updated: 2026-07-30
+skills:
+  - server-management
+  - devops-engineer
+  - cicd-pro
+scripts-binding:
+  - .agent/scripts/lint_runner.js
+  - .agent/scripts/verify_all.js
 ---
 
+# Bash & Linux — Shell Scripting Mastery
+
+---
+
+## Mandatory Pre-Flight Context Inspection
+
+Before writing Bash scripts or terminal automation pipelines, you MUST inspect:
+1. Strict Mode Flags (`set -euo pipefail`) (Section 39) → Always set `set -euo pipefail` and `IFS=$'\n\t'` at top of every script to fail fast on errors or unset vars
+2. Variable Quoting Safeguards (Section 122) → Double-quote all path and string variables (`"$FILE"`, `"${FILES[@]}"`) to prevent whitespace expansion bugs
+3. Modern CLI Efficiency Rules (Section 102) → Prefer `rg` over `grep`, `fd` over `find`, `jq` over regex JSON parsing for performance and safety
+
 ## Hallucination Traps (Read First)
 
 - ❌ Scripts without `set -euo pipefail` -> ✅ Always enable strict mode to catch silent failures