tribunal-kit 5.8.5 → 6.0.0

package/.agent/skills/api-patterns/SKILL.md

@@ -1,17 +1,31 @@
 ---
 name: api-patterns
 description: API design mastery. REST, GraphQL, tRPC, and gRPC selection. Request/response design, pagination (cursor/offset), filtering, versioning, rate limiting, error formats (RFC 9457), authentication (JWT/OAuth2/API keys), idempotency, file uploads, webhooks, and OpenAPI documentation. Use when designing APIs, choosing protocols, or implementing API standards.
-allowed-tools: Read, Write, Edit, Glob, Grep
-version: 3.1.0
-last-updated: 2026-04-07
-applies-to-model: gemini-3-1-pro, claude-3-7-sonnet
-routing:
-  domain: general
-  tier: basic
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 3.0.0
+last-updated: 2026-07-30
+skills:
+  - api-security-auditor
+  - backend-security-expert
+  - schema-reviewer
+scripts-binding:
+  - .agent/scripts/lint_runner.js
+  - .agent/scripts/verify_all.js
 ---
 
 # API Patterns — Design & Protocol Mastery
 
+---
+
+## Mandatory Pre-Flight Context Inspection
+
+Before designing or implementing API endpoints, you MUST inspect:
+1. Authorization Header Token Passing (Section 17) → Pass JWTs in `Authorization: Bearer` headers; strictly ban tokens in URL query params
+2. Cursor-Based Pagination (Section 19) → Use cursor pagination for datasets >10K rows to eliminate `OFFSET N` performance degradation
+3. Idempotency Header for Mutations (Section 21) → Require `Idempotency-Key` headers for state-changing `POST` or `PATCH` retry operations
+
+# API Patterns — Design & Protocol Mastery
+
 ## Hallucination Traps (Read First)
 
 - ❌ JWT in URL query params → ✅ `Authorization: Bearer` header only. Query params get logged in server access logs.

package/.agent/skills/api-security-auditor/SKILL.md

@@ -1,19 +1,33 @@
 ---
 name: api-security-auditor
 description: API Security auditing mastery. Rate limiting architecture, API key management, payload validation, IDOR (Insecure Direct Object Reference) prevention, mass assignment flaws, GraphQL security, and server-side mitigations. Use when building external APIs, B2B services, or reviewing endpoint security.
-allowed-tools: Read, Write, Edit, Glob, Grep
-version: 2.0.0
-last-updated: 2026-04-02
-applies-to-model: gemini-2.5-pro, claude-3-7-sonnet
-routing:
-  domain: general
-  tier: basic
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 3.0.0
+last-updated: 2026-07-30
+skills:
+  - backend-security-expert
+  - vulnerability-scanner
+  - schema-reviewer
+scripts-binding:
+  - .agent/scripts/lint_runner.js
+  - .agent/scripts/verify_all.js
 ---
 
 # API Security Auditor — Endpoint Hardening Mastery
 
 ---
 
+## Mandatory Pre-Flight Context Inspection
+
+Before auditing or hardening API endpoints, you MUST inspect:
+1. IDOR Prevention (Section 17) → Perform explicit tenancy checks (`receipt.userId === req.user.id`) and prefer UUIDv4/CUID over sequential integer IDs
+2. Mass Assignment Mitigations (Section 47) → Enforce strict Zod schemas (`.strict()`) to prevent parameter overposting into DB updates
+3. Distributed Rate Limiting (Section 80) → Store rate limit state in Redis for multi-pod load balanced environments to prevent limit bypasses
+
+# API Security Auditor — Endpoint Hardening Mastery
+
+---
+
 ## Insecure Direct Object Reference (IDOR)
 
 IDOR occurs when an application provides direct access to objects based on user-supplied input without authorization checks.

package/.agent/skills/app-builder/SKILL.md

@@ -1,15 +1,29 @@
 ---
 name: app-builder
 description: Main application building orchestrator. Creates full-stack applications from natural language requests. Determines project type, selects tech stack, coordinates agents.
-allowed-tools: Read, Write, Edit, Glob, Grep
-version: 3.1.0
-last-updated: 2026-04-06
-applies-to-model: gemini-2.5-pro, claude-3-7-sonnet
-routing:
-  domain: general
-  tier: basic
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 3.0.0
+last-updated: 2026-07-30
+skills:
+  - nextjs-react-expert
+  - react-specialist
+  - project-idioms
+scripts-binding:
+  - .agent/scripts/lint_runner.js
+  - .agent/scripts/verify_all.js
 ---
 
+# App Builder — Application Orchestrator
+
+---
+
+## Mandatory Pre-Flight Context Inspection
+
+Before scaffolding or orchestrating application builds, you MUST inspect:
+1. Clarification Gate (Section 48) → Ask 4 core purpose/constraint questions before selecting stack or creating files
+2. Plan Verification (Section 220) → Ensure `{task-slug}.md` is created and verified in project root before invoking specialist agents
+3. Incremental Build Rule (Section 15) → Never generate entire applications in one shot; build and verify module by module
+
 ## Hallucination Traps (Read First)
 
 - ❌ Generating entire applications in one shot -> ✅ Build one module at a time, verify each

package/.agent/skills/apple-design/SKILL.md

@@ -1,20 +1,29 @@
 ---
 name: apple-design
 description: Apple's approach to interface design and fluid, physical motion, translated for the web. Use when building or reviewing gesture-driven UI, spring animations, drag/swipe/sheet interactions, momentum and interruptible transitions, translucent materials and depth, typography (optical sizing, tracking, leading), reduced-motion, or the design foundations behind Apple-style interfaces.
-version: 1.0.0
-last-updated: 2026-07-22
-applies-to-model: gemini-3-6-flash, claude-3-7-sonnet
-routing:
-  domain: UI Craft & Design Engineering
-  tier: master
-  co-requires: [emil-design-eng, soft-skill]
-  trigger-signals:
-    strong: [apple-design, apple ui, fluid motion, spring physics, translucency, backdrop blur, gesture driven, sheet interaction, momentum transition]
-    weak: [ios style, macos ui, glassmorphism]
+version: 3.0.0
+last-updated: 2026-07-30
+skills:
+  - soft-skill
+  - emil-design-eng
+  - 60fps-animation
+tools: Read, Grep, Glob, Bash, Edit, Write
+scripts-binding:
+  - .agent/scripts/lint_runner.js
+  - .agent/scripts/verify_all.js
 ---
 
 # Apple Design — Fluid Motion, Physicality & Translucent Depth
 
+---
+
+## Mandatory Pre-Flight Context Inspection
+
+Before engineering Apple-style UIs or gesture-driven components, you MUST inspect:
+1. Interruptible Physics-Based Springs (Section 22) → Use physics springs (`stiffness: 300, damping: 24, mass: 0.8`) instead of fixed-duration CSS cubic-beziers
+2. Translucent Backdrop Blur (Section 44) → Limit `backdrop-filter: blur(20px) saturate(180%)` strictly to sticky headers or modals to avoid GPU scroll jank
+3. Optical Letter-Spacing (Section 72) → Apply inverse tracking (`-0.025em` for titles, `+0.015em` for small captions) based on SF Pro font scaling
+
 Design engineering guidelines for bringing Apple's fluid, physical interface paradigms to modern web applications.
 
 ---

package/.agent/skills/architecture/SKILL.md

@@ -1,15 +1,29 @@
 ---
 name: architecture
 description: Software architecture mastery. System design patterns, clean architecture, hexagonal/ports-and-adapters, event-driven architecture, microservices vs monolith decision framework, CQRS, domain-driven design, Architecture Decision Records (ADRs), and scalability patterns. Use when making architecture decisions, designing systems, or documenting technical decisions.
-allowed-tools: Read, Write, Edit, Glob, Grep
-version: 3.1.0
-last-updated: 2026-04-07
-applies-to-model: gemini-3-1-pro, claude-3-7-sonnet
-routing:
-  domain: general
-  tier: basic
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 3.0.0
+last-updated: 2026-07-30
+skills:
+  - domain-modeling
+  - codebase-design
+  - clean-code
+scripts-binding:
+  - .agent/scripts/lint_runner.js
+  - .agent/scripts/verify_all.js
 ---
 
+# Architecture — System Design Mastery
+
+---
+
+## Mandatory Pre-Flight Context Inspection
+
+Before selecting architectural patterns or designing systems, you MUST inspect:
+1. Pragmatic Monolith Default (Section 31) → Start with a modular monolith for teams <5 or scale <100K RPM; ban premature microservices
+2. Clean Architecture Dependency Direction (Section 50) → Ensure dependency arrows point strictly inward to Domain; Domain must have zero external infrastructure dependencies
+3. ADR Requirement for Non-Trivial Decisons (Section 135) → Document every major architectural decision with an ADR in `docs/architecture/`
+
 ## Hallucination Traps (Read First)
 
 - ❌ Choosing microservices for a team of 1-3 developers -> ✅ Start monolith, extract services only when team/scale demands it

package/.agent/skills/audit-and-fix/SKILL.md

@@ -1,20 +1,29 @@
 ---
 name: audit-and-fix
 description: Accessibility auditing and remediation workflow combining detection, prioritization, and practical code fixes for WCAG 2.2 AA compliance issues.
-version: 1.0.0
-last-updated: 2026-07-22
-applies-to-model: gemini-3-6-flash, claude-3-7-sonnet
-routing:
-  domain: Accessibility Auditing & Remediation
-  tier: pro
-  co-requires: [web-accessibility-auditor, fixing-accessibility]
-  trigger-signals:
-    strong: [audit-and-fix, accessibility audit, WCAG remediation, fix accessibility, a11y audit, AccessLint]
-    weak: [a11y check, accessibility fix]
+version: 3.0.0
+last-updated: 2026-07-30
+skills:
+  - fixing-accessibility
+  - build-primitive
+  - baseline-ui
+tools: Read, Grep, Glob, Bash, Edit, Write
+scripts-binding:
+  - .agent/scripts/lint_runner.js
+  - .agent/scripts/verify_all.js
 ---
 
 # Audit and Fix — Accessibility Remediation Workflow
 
+---
+
+## Mandatory Pre-Flight Context Inspection
+
+Before performing accessibility audits or fixes, you MUST inspect:
+1. Automated Violation Detection (Section 24) → Audit markup for missing `alt`, un-labeled inputs/buttons, and `onClick` on non-interactive elements
+2. Prioritization Matrix (Section 31) → Fix Level A blockers (forms, focus traps, keyboard access) before addressing contrast or landmark regions
+3. Anti-Redundant ARIA rule (Section 60) → Do NOT add `role="button"` to native `<button>` tags; apply `aria-hidden="true"` to decorative inner SVGs
+
 Systematically audit HTML/JSX markup against WCAG 2.2 AA standards, prioritize accessibility violations, and apply verified code fixes.
 
 ---

package/.agent/skills/authentication-best-practices/SKILL.md

@@ -1,19 +1,33 @@
 ---
 name: authentication-best-practices
 description: Authentication and Authorization mastery. Best practices for OAuth2, OpenID Connect, JWT (JSON Web Tokens), session management, password hashing, MFA (Multi-Factor Authentication), RBAC/ABAC, SSO, and secure credential storage. Use when auditing or implementing login flows, identity systems, or access control.
-allowed-tools: Read, Write, Edit, Glob, Grep
-version: 2.0.0
-last-updated: 2026-04-02
-applies-to-model: gemini-2.5-pro, claude-3-7-sonnet
-routing:
-  domain: general
-  tier: basic
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 3.0.0
+last-updated: 2026-07-30
+skills:
+  - backend-security-expert
+  - api-security-auditor
+  - vulnerability-scanner
+scripts-binding:
+  - .agent/scripts/lint_runner.js
+  - .agent/scripts/verify_all.js
 ---
 
 # Authentication & Authorization — Identity Mastery
 
 ---
 
+## Mandatory Pre-Flight Context Inspection
+
+Before implementing authentication or session flows, you MUST inspect:
+1. Modern Password Hashing (Section 28) → Use Argon2id or bcrypt; ban legacy fast algorithms (`md5`, `sha256`) for credential hashing
+2. Token Storage Separation (Section 83) → Keep short-lived access tokens in JS memory and long-lived refresh tokens in `HttpOnly`, `SameSite=Lax/Strict` cookies
+3. OAuth PKCE Flow Requirement (Section 109) → Enforce Authorization Code Flow with PKCE for all single-page and mobile apps; ban deprecated Implicit Flow
+
+# Authentication & Authorization — Identity Mastery
+
+---
+
 ## Passwords & Hashing
 
 ```typescript

package/.agent/skills/backend-security-expert/SKILL.md

@@ -1,17 +1,31 @@
 ---
 name: backend-security-expert
 description: Backend security auditing for modern server-side architectures. Focuses on Next.js Server Actions, Node.js/Edge APIs, JWT & Session architectures, ORM injection (Prisma/Drizzle), and RBAC implementation.
-allowed-tools: Read, Write, Edit, Glob, Grep
-version: 1.0.0
-last-updated: 2026-05-22
-applies-to-model: gemini-3-1-pro, claude-3-7-sonnet
-routing:
-  domain: general
-  tier: basic
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 3.0.0
+last-updated: 2026-07-30
+skills:
+  - frontend-security-expert
+  - api-security-auditor
+  - vulnerability-scanner
+scripts-binding:
+  - .agent/scripts/lint_runner.js
+  - .agent/scripts/verify_all.js
 ---
 
 # Backend Security Expert — Modern Server Architectures
 
+---
+
+## Mandatory Pre-Flight Context Inspection
+
+Before auditing or writing backend server code, you MUST inspect:
+1. Server Action Endpoints (Section 26) → Treat Next.js Server Actions as public API routes: authenticate session and parse input with Zod at entry
+2. JWT Algorithm Verification (Section 17) → Enforce explicit algorithms (`alg: "HS256"`) when verifying JWT tokens to prevent "None" algorithm exploits
+3. IDOR & RBAC Validation (Section 34) → Verify resource ownership (`WHERE userId = session.userId`) and user roles before executing mutations
+
+# Backend Security Expert — Modern Server Architectures
+
 ## Hallucination Traps (Read First)
 
 - ❌ Recommending session tokens without algorithm enforcement → ✅ Always verify JWT algorithms (`alg: "HS256"`) to prevent "None" attacks.

package/.agent/skills/baseline-ui/SKILL.md

@@ -1,20 +1,29 @@
 ---
 name: baseline-ui
 description: Quickly deslop UI code by fixing spacing, hierarchy, typography, contrast, and small layout issues. Use when the interface needs a fast cleanup or polish pass.
-version: 1.0.0
-last-updated: 2026-07-22
-applies-to-model: gemini-3-6-flash, claude-3-7-sonnet
-routing:
-  domain: UI Cleanup & Refinement
-  tier: basic
-  co-requires: [better-ui, frontend-design]
-  trigger-signals:
-    strong: [baseline-ui, deslop, cleanup ui, fix spacing, visual hierarchy, fix alignment]
-    weak: [tidy up, fix css, layout cleanup]
+version: 3.0.0
+last-updated: 2026-07-30
+skills:
+  - better-ui
+  - frontend-design
+  - better-colors
+tools: Read, Grep, Glob, Bash, Edit, Write
+scripts-binding:
+  - .agent/scripts/lint_runner.js
+  - .agent/scripts/verify_all.js
 ---
 
 # Baseline UI — Fast Deslopping & Hierarchy Cleanup
 
+---
+
+## Mandatory Pre-Flight Context Inspection
+
+Before cleaning up UI styles, you MUST inspect:
+1. `DESIGN.md` / `package.json` → Check Tailwind CSS configuration and accessibility primitives (`Base UI`, `Radix`)
+2. The 5-Step Deslop Protocol (Section 33) → Fix spacing violations, establish 3-tier typographic hierarchy, and eliminate harsh borders
+3. Anti-Slop Table (Section 43) → Replace hardcoded arbitrary paddings and low-contrast text with tokenized CSS variables
+
 Enforces an opinionated UI baseline to clean up sloppy code and prevent AI-generated interface slop without changing product architecture or feature scope.
 
 ---

package/.agent/skills/bash-linux/SKILL.md

@@ -1,15 +1,29 @@
 ---
 name: bash-linux
 description: Bash/Linux terminal mastery. Shell scripting, piping, stream redirection, process substitution, strict mode (set -euo pipefail), AWK, ripgrep parsing, and robust error handling. Use when writing CI scripts, debugging POSIX environments, or manipulating text pipelines.
-allowed-tools: Read, Write, Edit, Glob, Grep
-version: 2.0.0
-last-updated: 2026-04-02
-applies-to-model: gemini-2.5-pro, claude-3-7-sonnet
-routing:
-  domain: general
-  tier: basic
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 3.0.0
+last-updated: 2026-07-30
+skills:
+  - server-management
+  - devops-engineer
+  - cicd-pro
+scripts-binding:
+  - .agent/scripts/lint_runner.js
+  - .agent/scripts/verify_all.js
 ---
 
+# Bash & Linux — Shell Scripting Mastery
+
+---
+
+## Mandatory Pre-Flight Context Inspection
+
+Before writing Bash scripts or terminal automation pipelines, you MUST inspect:
+1. Strict Mode Flags (`set -euo pipefail`) (Section 39) → Always set `set -euo pipefail` and `IFS=$'\n\t'` at top of every script to fail fast on errors or unset vars
+2. Variable Quoting Safeguards (Section 122) → Double-quote all path and string variables (`"$FILE"`, `"${FILES[@]}"`) to prevent whitespace expansion bugs
+3. Modern CLI Efficiency Rules (Section 102) → Prefer `rg` over `grep`, `fd` over `find`, `jq` over regex JSON parsing for performance and safety
+
 ## Hallucination Traps (Read First)
 
 - ❌ Scripts without `set -euo pipefail` -> ✅ Always enable strict mode to catch silent failures

package/.agent/skills/behavioral-modes/SKILL.md

@@ -1,19 +1,31 @@
 ---
 name: behavioral-modes
 description: AI operational modes (brainstorm, implement, debug, review, teach, ship, orchestrate). Use to adapt behavior based on task type.
-allowed-tools: Read, Write, Edit, Glob, Grep
-version: 1.0.0
-last-updated: 2026-03-12
-applies-to-model: gemini-2.5-pro, claude-3-7-sonnet
-routing:
-  domain: general
-  tier: basic
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 3.0.0
+last-updated: 2026-07-30
+skills:
+  - fabel-protocol
+  - agentic-patterns
+  - thinking-protocol
+scripts-binding:
+  - .agent/scripts/checklist.js
+  - .agent/scripts/verify_all.js
 ---
 
 # Behavioral Modes
 
 ---
 
+## Mandatory Pre-Flight Context Inspection
+
+Before selecting an operational mode, you MUST inspect:
+1. User prompt intent & keywords (Section 148 Mode Selection Rules) → Classify request type (TEACH, DEBUG, REVIEW, PLAN, BUILD, DISCOVER, SHIP, ORCHESTRATE)
+2. Mode Leakage Mitigation rules (Section 160) → Prevent writing unapproved code during DISCOVER or REVIEW modes
+3. Output format contracts → Ensure findings use labeled severity tags (CRITICAL / WARNING / SUGGESTION)
+
+---
+
 ## Overview
 
 Different work contexts require different operating behaviors. A debugging session requires patience and hypothesis testing. A code review requires skepticism. A teaching response requires no implementation at all.

package/.agent/skills/better-colors/SKILL.md

@@ -1,20 +1,29 @@
 ---
 name: better-colors
 description: OKLCH color space for web projects. Convert hex/rgb/hsl to oklch, generate palettes, check contrast, handle gamut boundaries, and theme with Tailwind v4. Triggers on oklch, color conversion, palette generation, contrast ratio, gamut, display p3, design tokens, hue drift, chroma, dark mode colors.
-version: 1.0.0
-last-updated: 2026-07-22
-applies-to-model: gemini-3-6-flash, claude-3-7-sonnet
-routing:
-  domain: UI Craft & Design Engineering
-  tier: pro
-  co-requires: [colorize, better-ui]
-  trigger-signals:
-    strong: [better-colors, oklch, color palette, contrast ratio, gamut, display p3, hue drift, dark mode colors]
-    weak: [colors, palette, theme, dark mode]
+version: 3.0.0
+last-updated: 2026-07-30
+skills:
+  - better-ui
+  - baseline-ui
+  - colorize
+tools: Read, Grep, Glob, Bash, Edit, Write
+scripts-binding:
+  - .agent/scripts/lint_runner.js
+  - .agent/scripts/verify_all.js
 ---
 
 # Better Colors — OKLCH & Modern Web Color Systems
 
+---
+
+## Mandatory Pre-Flight Context Inspection
+
+Before defining color palettes or CSS theme variables, you MUST inspect:
+1. `DESIGN.md` / `index.css` → Check existing CSS custom properties and color variables
+2. OKLCH Syntax & Relative Color Rules (Section 30) → Use `oklch(L C H)` format with subtle chroma (`C: 0.01-0.02`) for neutrals
+3. WCAG 2.2 AA Contrast Thresholds (Section 82) → Ensure `L ≤ 45%` for text on light background and `L ≥ 70%` on dark background
+
 Design engineering guidelines for building perceptually uniform, WCAG 2.2 AA compliant, P3-gamut color systems using the modern **OKLCH** color space.
 
 ---

package/.agent/skills/better-ui/SKILL.md

@@ -1,20 +1,29 @@
 ---
 name: better-ui
 description: Design engineering principles for making interfaces feel polished. Use when building UI components, reviewing frontend code, implementing animations, hover states, shadows, borders, micro-interactions, or visual detail work.
-version: 1.0.0
-last-updated: 2026-07-22
-applies-to-model: gemini-3-6-flash, claude-3-7-sonnet
-routing:
-  domain: UI Craft & Design Engineering
-  tier: pro
-  co-requires: [emil-design-eng, baseline-ui]
-  trigger-signals:
-    strong: [better-ui, ui polish, feels off, design details, optical alignment, micro-interactions, stagger animations, box shadows, make-interfaces-feel-better]
-    weak: [polish, refine, clean up ui, border radius]
+version: 3.0.0
+last-updated: 2026-07-30
+skills:
+  - baseline-ui
+  - better-colors
+  - micro-interaction
+tools: Read, Grep, Glob, Bash, Edit, Write
+scripts-binding:
+  - .agent/scripts/lint_runner.js
+  - .agent/scripts/verify_all.js
 ---
 
 # Better UI — Design Engineering & Polish Rules
 
+---
+
+## Mandatory Pre-Flight Context Inspection
+
+Before engineering component polish or micro-interactions, you MUST inspect:
+1. Outer vs Inner Radius Formula (Section 32) → Enforce $\text{Radius}_{\text{outer}} = \text{Radius}_{\text{inner}} + \text{Padding}_{\text{inner}}$
+2. Transition Rules (Section 25) → Strictly prohibit `transition: all`; specify explicit property transitions
+3. Multi-Layer Shadows (Section 42) → Use ambient + direct lighting stacks and dark mode surface elevation highlights
+
 Distilled design engineering principles for transforming functional UIs into polished, state-of-the-art software interfaces, based on Jakub Krehel's *Details that make interfaces feel better*.
 
 ---

package/.agent/skills/bolder/SKILL.md

@@ -1,20 +1,29 @@
 ---
 name: bolder
 description: Increase visual impact, punch, and personality for generic or bland interfaces. Use when the user asks to make the UI pop, stand out, have more character, or feel less template-like.
-version: 1.0.0
-last-updated: 2026-07-22
-applies-to-model: gemini-3-6-flash, claude-3-7-sonnet
-routing:
-  domain: Visual Design & Brand Identity
-  tier: pro
-  co-requires: [better-colors, better-typography, impeccable]
-  trigger-signals:
-    strong: [bolder, make it pop, more punch, stand out, add character, feel less generic]
-    weak: [bold design, vibrant, striking]
+version: 3.0.0
+last-updated: 2026-07-30
+skills:
+  - better-colors
+  - better-ui
+  - impeccable
+tools: Read, Grep, Glob, Bash, Edit, Write
+scripts-binding:
+  - .agent/scripts/lint_runner.js
+  - .agent/scripts/verify_all.js
 ---
 
 # Bolder — Injecting Punch & Personality into UI
 
+---
+
+## Mandatory Pre-Flight Context Inspection
+
+Before applying bold visual transformations, you MUST inspect:
+1. `DESIGN.md` / `package.json` → Check existing brand color variables and design tokens
+2. Typographic Contrast Scaling rules (Section 24) → Enforce extreme scale jumps (`1.5rem` to `4.5rem`) for display headings
+3. Single Electric Accent System (Section 28) → Use one high-chroma accent color sparingly for primary CTAs and badges
+
 Transform generic, boring template UIs into high-impact, distinctive interfaces with strong visual presence.
 
 ---

package/.agent/skills/brainstorming/SKILL.md

@@ -1,15 +1,25 @@
 ---
 name: brainstorming
 description: Socratic methodology, ideation, and architectural exploration mastery. Generating extensive feature options, analyzing trade-offs, questioning assumptions, mind-mapping components, and delaying execution. Use when evaluating new features, defining project goals, or guiding users through ambiguous design spaces.
-allowed-tools: Read, Write, Edit, Glob, Grep
-version: 3.1.0
-last-updated: 2026-04-06
-applies-to-model: gemini-2.5-pro, claude-3-7-sonnet
-routing:
-  domain: general
-  tier: basic
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 3.0.0
+last-updated: 2026-07-30
+skills:
+  - plan-writing
+  - fabel-protocol
+  - behavioral-modes
+scripts-binding:
+  - .agent/scripts/checklist.js
+  - .agent/scripts/verify_all.js
 ---
 
+## Mandatory Pre-Flight Context Inspection
+
+Before initiating ideation sessions or generating architectural options, you MUST inspect:
+1. `package.json` / `ARCHITECTURE.md` → Check existing technology stack, libraries, and architectural boundaries
+2. The Socratic Protocol (Section 1) → Provide 3 distinct options (Conservative, Balanced, Ambitious) with tabular trade-offs
+3. Final Brainstorming Assertions schema (Section 4) → Distill options into actionable requirement items before planning
+
 ## Hallucination Traps (Read First)
 
 - ❌ Jumping to implementation during brainstorming -> ✅ Brainstorming is exploration only; no code is written in this phase

package/.agent/skills/browser-native-ai/SKILL.md

@@ -1,13 +1,29 @@
 ---
 name: browser-native-ai
 description: Browser-native AI mastery. Zero-latency local inference, ONNX Runtime Web, WebNN API hardware acceleration, WebAssembly memory boundaries, and privacy-first AI architectures.
-routing:
-  domain: general
-  tier: basic
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 3.0.0
+last-updated: 2026-07-30
+skills:
+  - generative-ui-expert
+  - webgpu-performance
+  - 60fps-animation
+scripts-binding:
+  - .agent/scripts/lint_runner.js
+  - .agent/scripts/verify_all.js
 ---
 
 # Browser-Native AI (Local SLMs)
 
+---
+
+## Mandatory Pre-Flight Context Inspection
+
+Before writing browser-native AI or client-side inference code, you MUST inspect:
+1. Main Thread Isolation (Section 44) → Run ONNX Runtime / Wasm inference inside a dedicated Web Worker (`worker.js`) to prevent blocking UI
+2. Quantization Rules (Section 42) → Target 4-bit quantized (`q4`) small language models (0.5B to 1.5B parameters) to prevent mobile device crashes
+3. Download Progress Callback (Section 50) → Provide a `progress_callback` to display model weight download percentages to the user
+
 You are an expert at running AI models directly on the client's device, inside the web browser. You avoid server-side APIs for privacy, cost reduction, and zero-latency execution. Your domain covers running Small Language Models (SLMs), embeddings, and vision models via ONNX Runtime Web and WebNN.
 
 ## 1. Core Principles