tribunal-kit 5.8.5 → 6.0.0

package/.agent/rules/GEMINI.md

@@ -135,25 +135,23 @@ Did I load the agent's required skills?  → If no: check frontmatter skills: fi
 
 ---
 
-## Step 3 — Socratic Gate (Before Complex Work)
+## Step 3 — Socratic Gate (Adaptive Governance Policy)
 
-For any complex build, new feature, or unclear request — stop and ask before writing code.
+The Socratic Gate is **adaptive** based on the task's **Impact Tier** evaluated by `impact_classifier.js`:
 
-**Required questions by type:**
-
-| Request              | Questions                                                    |
-| -------------------- | ------------------------------------------------------------ |
-| New feature or build | 1-2 targeted questions about the highest-ambiguity decisions |
-| Code edit or bug fix | Confirm understanding of the root cause before fixing        |
-| Vague request        | 1 question about the core goal, then infer the rest          |
-| Full orchestration   | Block all subagents until plan is confirmed                  |
+| Impact Tier | Scope | Socratic Gate Policy |
+| ----------- | ----- | --------------------- |
+| **Tier 0 (Fast-Pass)** | Typo, CSS, markdown, formatting | **BYPASS** — 0 questions, 0 LLM calls |
+| **Tier 1 (Express Pass)** | Single-file component or function logic edit | **BYPASS** — 0 questions, single specialist pass |
+| **Tier 2 (Targeted Audit)** | Multi-file feature edit | **CONDITIONAL** — Ask 1 question ONLY if ambiguity score > 0.5 |
+| **Tier 3 (Full Gauntlet)** | Auth, schema, migration, breaking architectural changes | **REQUIRED** — 1-2 targeted questions before execution (bypassable via `--no-gate` / `--express`) |
 
 **Rules:**
 
 - Ask only what you cannot infer from context. Check the conversation first.
 - Max 2 questions per response. If you need more, prioritize the most blocking one.
 - Never ask what the user already told you. Never ask generic "what stack?" if the repo shows it.
-- Do not write a single line of code until the gate is cleared
+- Bypass gate automatically on Tier 0 and Tier 1 tasks to preserve rapid developer flow.
 
 ---
 
@@ -222,7 +220,7 @@ The Human Gate is never skipped. No code is written to a file without explicit u
 | Database/SQL          | logic + security + sql + schema + complexity-reviewer                                               |
 | Mobile/Cross-platform | logic + security + mobile-reviewer + type-safety + complexity-reviewer                              |
 | Any domain            | + performance (if optimization)                                                                     |
-| Before merge          | /tribunal-full (all 19 reviewers)                                                                   |
+| Before merge          | /tribunal-full (all 27 reviewers)                                                                   |
 
 ---
 

package/.agent/rules/GEMINI_PLANNER.md

@@ -0,0 +1,84 @@
+---
+trigger: pipeline_only
+---
+
+# Tribunal Planner Rules — Condensed
+
+Minimal rules for Pass 1 (Planning) of the Hybrid Pipeline.
+These are the ONLY rules active during the planning phase.
+Full rules (GEMINI.md) are NOT loaded — this saves ~4,800 tokens.
+
+---
+
+## Task Classification
+
+| Type           | Signals                                            | Output              |
+| -------------- | -------------------------------------------------- | ------------------- |
+| Question       | "what is", "how does", "explain"                   | Text only — no code |
+| Simple edit    | "fix", "change", "update" (single file)            | Direct edit         |
+| Complex build  | "build", "create", "implement", "design"           | Structured spec     |
+| Refactor       | "refactor", "clean", "extract", "split"            | Structured spec     |
+| Test           | "test", "spec", "e2e"                              | Test spec           |
+
+---
+
+## Stack Detection
+
+| Keywords                                    | Stack          |
+| ------------------------------------------- | -------------- |
+| react, jsx, tsx, component, hook            | react          |
+| next, nextjs, server component              | nextjs         |
+| vue, nuxt, composition api                  | vue            |
+| typescript, interface, generic              | typescript     |
+| python, fastapi, django, flask              | python         |
+| express, hono, koa, node                    | node           |
+| sql, postgres, prisma, drizzle              | sql            |
+| rust, cargo, tokio, axum                    | rust           |
+| css, tailwind, responsive                   | css            |
+
+---
+
+## Skill Selection Rules
+
+1. Match task keywords against skill descriptions
+2. Match file extensions against stack affinities
+3. Select TOP 3 skills by relevance score
+4. Never load more than 3 skills for a single pass
+
+---
+
+## Output: Structured Spec Schema
+
+The planner MUST output a JSON object matching this schema:
+
+```json
+{
+  "task_type": "frontend_component | api_endpoint | database_query | auth_flow | test_suite | refactor | animation | general",
+  "stack": ["react", "typescript", "css"],
+  "target_file": "path/to/file.tsx",
+  "essential_skills": [
+    { "name": "skill-name", "score": 5.0 }
+  ],
+  "constraints": {
+    "accessibility": true,
+    "responsive": true,
+    "dark_mode": false,
+    "animation": false,
+    "tests_required": false,
+    "type_safe": true
+  },
+  "spec": "Original user task description"
+}
+```
+
+---
+
+## Planner Anti-Patterns
+
+```
+❌ Do not load full GEMINI.md — use this condensed file only
+❌ Do not load agent persona .md files — those are for generation, not planning
+❌ Do not generate code in the planning phase — output spec JSON only
+❌ Do not select more than 3 essential skills
+❌ Do not include tribunal review rules — those run in Pass 3 (validator)
+```

package/.agent/scripts/case_law_manager.js

@@ -58,6 +58,7 @@ const VALID_DOMAINS = new Set([
   "mobile",
   "testing",
   "devops",
+  "minimal_change",
   "general",
 ]);
 const VALID_VERDICTS = new Set([
@@ -65,6 +66,7 @@ const VALID_VERDICTS = new Set([
   "APPROVED_WITH_CONDITIONS",
   "PRECEDENT_SET",
   "OVERRULED",
+  "MINIMALITY_REJECTED",
 ]);
 
 // ── Noise filter ────────────────────────────────────────────────────────────

package/.agent/scripts/context_broker.js

@@ -49,11 +49,43 @@
 
 const fs = require("fs");
 const path = require("path");
+const { execFileSync } = require("child_process");
 
 // ── Colours & Shared Utilities ────────────────────────────────────────────────
 const { GREEN, YELLOW, CYAN, RED, BOLD, DIM, RESET } = require("./_colors");
 const { findAgentDir } = require("./_utils");
 
+/**
+ * Attempt native Rust context resolution for sub-15ms execution
+ */
+function tryNativeContextBroker(repoPath, targetFile) {
+  if (process.env.TK_DISABLE_RUST === "1") return null;
+
+  const candidates = [
+    path.join(__dirname, "../../target/release/tribunal-core.exe"),
+    path.join(__dirname, "../../target/release/tribunal-core"),
+    path.join(__dirname, "../../target/debug/tribunal-core.exe"),
+    path.join(__dirname, "../../target/debug/tribunal-core"),
+    "tribunal-core"
+  ];
+
+  for (const bin of candidates) {
+    try {
+      if (bin.includes(path.sep) && !fs.existsSync(bin)) continue;
+      const args = ["context-broker", "--repo-path", repoPath];
+      if (targetFile) args.push("--target-file", targetFile);
+      const out = execFileSync(bin, args, { encoding: "utf8", timeout: 2000, stdio: ["ignore", "pipe", "ignore"] });
+      if (out && out.trim().startsWith("{")) {
+        return JSON.parse(out);
+      }
+    } catch (_) {
+      // Continue to next candidate or fallback
+    }
+  }
+  return null;
+}
+
+
 
 // ── Domain → Skill affinity map ───────────────────────────────────────────────
 // Keywords in the user's task that strongly indicate specific skills.
@@ -812,13 +844,119 @@ function broker(task, files = [], model = "large", agentDir = null) {
   return { ...selection, promptText };
 }
 
+/**
+ * Pipeline-specific broker for the 3-pass hybrid architecture.
+ * Returns context tailored to each pipeline phase:
+ *   - "plan":     Skill names + descriptions only (for task classification)
+ *   - "build":    Top 2-3 essential skills' keyRules only (for code generation)
+ *   - "validate": Validator configuration (which patterns to check)
+ *
+ * @param {string}   task     - User task description
+ * @param {string[]} files    - Files being touched
+ * @param {string}   phase    - 'plan' | 'build' | 'validate'
+ * @param {string}   agentDir - Path to .agent/ directory
+ * @returns {object} Phase-specific context
+ */
+function brokerForPipeline(task, files = [], phase = "build", agentDir = null) {
+  const resolvedAgentDir = agentDir || findAgentDir();
+  const skills = loadSkills(resolvedAgentDir);
+  // Always use "small" model tier for aggressive pruning in pipeline mode
+  const selection = selectSkills(task, files, "small", skills);
+
+  if (phase === "plan") {
+    // Plan phase: skill names and descriptions only — no content, no keyRules
+    return {
+      phase: "plan",
+      skills: selection.essential.slice(0, 6).map(s => ({
+        name: s.name,
+        description: s.description,
+        score: selection.scores.get(s.name) || 0,
+      })),
+      total_matched: selection.essential.length + selection.available.length,
+    };
+  }
+
+  if (phase === "build") {
+    // Build phase: top 3 essential keyRules — maximum density, minimum tokens
+    return {
+      phase: "build",
+      skills: selection.essential.slice(0, 3).map(s => ({
+        name: s.name,
+        keyRules: s.keyRules || "",
+        score: selection.scores.get(s.name) || 0,
+      })),
+    };
+  }
+
+  if (phase === "validate") {
+    // Validate phase: return detected stack for targeted pattern matching
+    const fileExts = files.map(f => path.extname(f).toLowerCase()).filter(Boolean);
+    return {
+      phase: "validate",
+      detectedExtensions: fileExts,
+      essentialSkillNames: selection.essential.slice(0, 3).map(s => s.name),
+    };
+  }
+
+  // Fallback: return full selection
+  return { phase, ...selection };
+}
+
+/**
+ * Format pipeline-plan output: compact skill list for planner context.
+ * @param {string} task
+ * @param {object} pipelineResult - Output of brokerForPipeline(task, files, "plan")
+ * @returns {string}
+ */
+function formatPipelinePlan(task, pipelineResult) {
+  const lines = [
+    "# Pipeline Planner Context",
+    `# Task: ${task}`,
+    "",
+    "## Matched Skills (by relevance)",
+    "",
+  ];
+  for (const s of pipelineResult.skills) {
+    lines.push(`- **${s.name}** (score: ${s.score.toFixed(1)}): ${(s.description || "").slice(0, 120)}`);
+  }
+  lines.push("");
+  lines.push(`Total matched: ${pipelineResult.total_matched}`);
+  return lines.join("\n");
+}
+
+/**
+ * Format pipeline-build output: condensed keyRules for builder prompt injection.
+ * @param {string} task
+ * @param {object} pipelineResult - Output of brokerForPipeline(task, files, "build")
+ * @returns {string}
+ */
+function formatPipelineBuild(task, pipelineResult) {
+  const lines = [
+    "# Builder Context — Essential Rules Only",
+    `# Task: ${task}`,
+    "",
+  ];
+  for (const s of pipelineResult.skills) {
+    lines.push(`## ${s.name}`);
+    lines.push("");
+    lines.push(s.keyRules || "(no key rules extracted)");
+    lines.push("");
+    lines.push("---");
+    lines.push("");
+  }
+  return lines.join("\n");
+}
+
 module.exports = {
   broker,
+  brokerForPipeline,
   selectSkills,
   loadSkills,
   scoreSkill,
   tokenize,
   findAgentDir,
+  extractKeyRules,
+  tryNativeContextBroker,
 };
 
 // ── CLI Entry ─────────────────────────────────────────────────────────────────
@@ -906,8 +1044,22 @@ ${BOLD}Examples:${RESET}
     case "prompt":
       console.log(formatPrompt(task, effectiveModel, selection));
       break;
+    case "pipeline-plan": {
+      const pipelinePlan = brokerForPipeline(task, files, "plan", agentDir);
+      console.log(formatPipelinePlan(task, pipelinePlan));
+      break;
+    }
+    case "pipeline-build": {
+      const pipelineBuild = brokerForPipeline(task, files, "build", agentDir);
+      console.log(formatPipelineBuild(task, pipelineBuild));
+      break;
+    }
     default: // 'report'
       formatReport(task, effectiveModel, selection, elapsed);
       break;
   }
 }
+
+
+
+

package/.agent/scripts/guardrail_engine.js

@@ -35,6 +35,9 @@ const path = require("path");
  */
 function ruleFileExists(content, manifest, _ctx) {
   const violations = [];
+  if (_ctx && _ctx.filePath && (_ctx.filePath.endsWith(".js") || _ctx.filePath.endsWith(".py") || _ctx.filePath.endsWith(".json"))) {
+    return violations;
+  }
   const refs = manifest.cross_references || [];
 
   const agentDir = path.join(_ctx.projectRoot, ".agent");
@@ -132,6 +135,9 @@ function ruleReviewerCount(content, manifest, _ctx) {
  */
 function ruleSkillExists(content, manifest, _ctx) {
   const violations = [];
+  if (_ctx && _ctx.filePath && (_ctx.filePath.endsWith(".js") || _ctx.filePath.endsWith(".py") || _ctx.filePath.endsWith(".json"))) {
+    return violations;
+  }
   const skillNames = new Set(manifest.skills ? manifest.skills.names : []);
   if (skillNames.size === 0) return violations;
 
@@ -195,6 +201,9 @@ function ruleSkillExists(content, manifest, _ctx) {
  */
 function ruleAgentExists(content, manifest, _ctx) {
   const violations = [];
+  if (_ctx && _ctx.filePath && (_ctx.filePath.endsWith(".js") || _ctx.filePath.endsWith(".py") || _ctx.filePath.endsWith(".json"))) {
+    return violations;
+  }
   const agentNames = new Set(manifest.agents ? manifest.agents.all : []);
   if (agentNames.size === 0) return violations;
 
@@ -225,9 +234,9 @@ function ruleAgentExists(content, manifest, _ctx) {
 function ruleUnresolvedVerify(content, _manifest, ctx) {
   const violations = [];
   
-  // Skip this check for the internal .agent documentation files themselves
-  // because they contain instructions ABOUT the VERIFY tag.
-  if (ctx && ctx.filePath && ctx.filePath.includes(".agent") && ctx.filePath.endsWith(".md")) {
+  // Skip this check for the internal .agent files themselves
+  // because they contain instructions/comments ABOUT the VERIFY tag.
+  if (ctx && ctx.filePath && ctx.filePath.includes(".agent")) {
     return violations;
   }
 
@@ -360,6 +369,51 @@ function ruleImportPhantom(content, _manifest, ctx) {
   return violations;
 }
 
+/**
+ * Rule 9: rust-module-registration
+ * Validates that Rust modules in crates/core/src/commands are declared in mod.rs
+ * and registered in wrapper.js RUST_COMMANDS set.
+ */
+function ruleRustModuleRegistration(content, manifest, _ctx) {
+  const violations = [];
+  const root = _ctx.projectRoot || process.cwd();
+
+  const modRs = path.join(root, "crates", "core", "src", "commands", "mod.rs");
+  if (fs.existsSync(modRs)) {
+    const modContent = fs.readFileSync(modRs, "utf8");
+    const requiredMods = ["context_broker", "dag_scheduler", "context_compress"];
+    for (const m of requiredMods) {
+      if (!modContent.includes(`pub mod ${m};`)) {
+        violations.push({
+          rule: "rust-module-registration",
+          severity: "warning",
+          location: "crates/core/src/commands/mod.rs",
+          message: `Rust command module "${m}" not declared in mod.rs`,
+          suggestion: `Add "pub mod ${m};" to crates/core/src/commands/mod.rs`,
+          autoFixable: false,
+        });
+      }
+    }
+  }
+
+  const wrapperJs = path.join(root, "bin", "wrapper.js");
+  if (fs.existsSync(wrapperJs)) {
+    const wrapperContent = fs.readFileSync(wrapperJs, "utf8");
+    if (!wrapperContent.includes('"context-broker"')) {
+      violations.push({
+        rule: "rust-module-registration",
+        severity: "warning",
+        location: "bin/wrapper.js",
+        message: 'Command "context-broker" not registered in RUST_COMMANDS in bin/wrapper.js',
+        suggestion: 'Add "context-broker" to RUST_COMMANDS set in bin/wrapper.js',
+        autoFixable: false,
+      });
+    }
+  }
+
+  return violations;
+}
+
 // ── Rule Registry ─────────────────────────────────────────────────────────────
 
 const RULES = {
@@ -371,6 +425,7 @@ const RULES = {
   "unresolved-verify": ruleUnresolvedVerify,
   "numeric-consistency": ruleNumericConsistency,
   "import-phantom": ruleImportPhantom,
+  "rust-module-registration": ruleRustModuleRegistration,
 };
 
 // ── Main Validate Function ────────────────────────────────────────────────────
@@ -527,7 +582,7 @@ function main() {
     const content = fs.readFileSync(file, "utf8");
     const result = validate(content, manifest, {
       autoFix: fixMode,
-      context: { projectRoot },
+      context: { projectRoot, filePath: file },
     });
 
     totalViolations += result.violations.length;

package/.agent/scripts/impact_classifier.js

@@ -0,0 +1,167 @@
+#!/usr/bin/env node
+/**
+ * impact_classifier.js — Adaptive Governance Impact Classifier
+ * ===============================================================
+ * Analyzes diffs, file extensions, and structural changes to classify
+ * tasks into Governance Impact Tiers (Tier 0 to Tier 3).
+ *
+ * Impact Tiers:
+ *   Tier 0 (Fast-Pass):      Score < 0.15. Typo, pure CSS, markdown, comments, <10 lines.
+ *                            0 LLM calls, 0 Socratic gate, <10ms execution.
+ *   Tier 1 (Express Pass):   Score 0.15 - 0.35. Single file logic change.
+ *                            1 domain specialist reviewer, 0 Socratic gate.
+ *   Tier 2 (Targeted Audit): Score 0.35 - 0.70. Multi-file edits, non-critical domain logic.
+ *                            2 reviewers, Socratic gate if ambiguity > 0.5.
+ *   Tier 3 (Full Gauntlet):  Score > 0.70 or critical paths (auth, schema, security, payment).
+ *                            Full multi-agent gauntlet + strict Human Gate.
+ *
+ * Usage:
+ *   node .agent/scripts/impact_classifier.js --files "src/app.css" --diff "+color: red;"
+ *   node .agent/scripts/impact_classifier.js --task "Fix typo in comment"
+ */
+
+"use strict";
+
+const path = require("path");
+const { parseArgs } = require("./_utils");
+
+// Critical file patterns that automatically force Tier 3
+const CRITICAL_PATTERNS = [
+  /auth/i,
+  /security/i,
+  /payment/i,
+  /billing/i,
+  /schema/i,
+  /migration/i,
+  /permission/i,
+  /jwt/i,
+  /crypto/i,
+  /secret/i,
+  /eval/i
+];
+
+// Low-impact extensions / patterns for Tier 0
+const FAST_PASS_EXTENSIONS = [".css", ".scss", ".less", ".md", ".txt", ".json", ".svg", ".png", ".jpg"];
+
+/**
+ * Classify impact based on files, diff content, and task description
+ * @param {Object} opts - Options { files, diff, task, lineCount }
+ * @returns {Object} Tier payload { tier, score, reasoning, maxReviewers, requireGate }
+ */
+function classifyImpact(opts = {}) {
+  if (!opts || typeof opts !== "object") opts = {};
+  const rawFiles = opts.files;
+  const files = Array.isArray(rawFiles)
+    ? rawFiles.filter(f => typeof f === "string" && f.length > 0)
+    : (typeof rawFiles === "string" && rawFiles.length > 0 ? [rawFiles] : []);
+  const diff = typeof opts.diff === "string" ? opts.diff : "";
+  const task = typeof opts.task === "string" ? opts.task : "";
+  const lineCount = typeof opts.lineCount === "number" && Number.isFinite(opts.lineCount) && opts.lineCount >= 0
+    ? opts.lineCount
+    : (diff.length > 0 ? diff.split("\n").length : 0);
+
+  let score = 0.2; // Base baseline score
+  const reasoning = [];
+
+  // Check 1: Critical File Patterns
+  const isCriticalFile = files.some(file => CRITICAL_PATTERNS.some(pat => pat.test(file)));
+  const isCriticalTask = CRITICAL_PATTERNS.some(pat => pat.test(task));
+
+  if (isCriticalFile || isCriticalTask) {
+    score += 0.6;
+    reasoning.push("Critical path detected (auth/security/schema/payment)");
+  }
+
+  // Check 2: File Extensions & Types
+  if (files.length > 0) {
+    const allFastPass = files.every(f => FAST_PASS_EXTENSIONS.includes(path.extname(f).toLowerCase()));
+    if (allFastPass) {
+      score -= 0.25;
+      reasoning.push("All modified files are low-risk assets (styles/docs/assets)");
+    }
+  }
+
+  // Check 3: Line Count & Diff Size
+  if (lineCount <= 10) {
+    score -= 0.15;
+    reasoning.push("Small diff size (<= 10 lines)");
+  } else if (lineCount > 100) {
+    score += 0.3;
+    reasoning.push("Large diff size (> 100 lines)");
+  } else if (lineCount > 30) {
+    score += 0.15;
+    reasoning.push("Medium diff size (30-100 lines)");
+  }
+
+  // Check 4: Task Keywords
+  const taskLower = task.toLowerCase();
+  if (/typo|fix comment|format|lint|rename|css|style|docs|readme/i.test(taskLower)) {
+    score -= 0.2;
+    reasoning.push("Task signals simple edit or formatting");
+  }
+  if (/refactor|rewrite|architecture|redesign|migration|overhaul|security/i.test(taskLower)) {
+    score += 0.35;
+    reasoning.push("Task signals structural refactor or security review");
+  }
+
+  // Clamp score between 0.0 and 1.0
+  score = Math.max(0.0, Math.min(1.0, score));
+
+  // Determine Impact Tier
+  let tier = 1;
+  let maxReviewers = 1;
+  let requireGate = false;
+
+  if (score < 0.15 && !isCriticalFile && !isCriticalTask) {
+    tier = 0;
+    maxReviewers = 0;
+    requireGate = false;
+  } else if (score < 0.35 && !isCriticalFile && !isCriticalTask) {
+    tier = 1;
+    maxReviewers = 1;
+    requireGate = false;
+  } else if (score < 0.70 && !isCriticalFile) {
+    tier = 2;
+    maxReviewers = 2;
+    requireGate = true; // Conditional gate
+  } else {
+    tier = 3;
+    maxReviewers = 8;
+    requireGate = true;
+  }
+
+  return {
+    tier,
+    score: parseFloat(score.toFixed(2)),
+    maxReviewers,
+    requireGate,
+    reasoning,
+    fastPass: tier === 0
+  };
+}
+
+// Direct CLI Execution
+if (require.main === module) {
+  const args = parseArgs(process.argv);
+  const files = args.files ? args.files.split(",") : [];
+  const result = classifyImpact({
+    files,
+    diff: args.diff || "",
+    task: args.task || "",
+    lineCount: args.lines ? parseInt(args.lines, 10) : undefined
+  });
+
+  if (args.json) {
+    console.log(JSON.stringify(result, null, 2));
+  } else {
+    console.log(`\n━━━ Adaptive Governance Impact Tier ━━━━━━━━━━━━━`);
+    console.log(`  Tier:         Tier ${result.tier} (${result.fastPass ? "FAST-PASS" : result.tier === 1 ? "EXPRESS" : result.tier === 2 ? "TARGETED" : "GAUNTLET"})`);
+    console.log(`  Score:        ${result.score}`);
+    console.log(`  Max Reviewers:${result.maxReviewers}`);
+    console.log(`  Require Gate: ${result.requireGate}`);
+    console.log(`  Reasoning:    ${result.reasoning.join(" | ") || "Baseline assessment"}`);
+    console.log(`━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n`);
+  }
+}
+
+module.exports = { classifyImpact };