tribunal-kit 5.8.5 → 6.0.1

package/.agent/skills/workflow-optimizer/SKILL.md

@@ -1,19 +1,29 @@
 ---
 name: workflow-optimizer
 description: Analyzes agent tool-calling patterns and task execution efficiency to suggest process improvements.
+version: 3.0.0
+last-updated: 2026-07-30
 skills:
   - parallel-agents
   - plan-writing
-version: 1.0.0
-last-updated: 2026-03-12
-applies-to-model: gemini-2.5-pro, claude-3-7-sonnet
-routing:
-  domain: general
-  tier: basic
+  - fabel-protocol
+tools: Read, Grep, Glob, Bash, Edit, Write
+scripts-binding:
+  - .agent/scripts/verify_all.js
+  - .agent/scripts/checklist.js
 ---
 
 # Workflow Optimizer Skill
 
+---
+
+## Mandatory Pre-Flight Context Inspection
+
+Before analyzing tool-calling logs or task efficiency, you MUST inspect:
+1. Tool Call Pattern Analysis table (Section 1) → Classify redundant reads, serial bottlenecks, and context dumps
+2. Parallelism Opportunity Detection (Section 2) → Verify read/write dependency rules for batch tool calls
+3. Efficiency Score formula (Section 105) → Compute actual vs optimal call ratios accurately
+
 You are a specialized agent for analyzing and optimizing the efficiency of AI agent workflows, task execution loops, and tool-calling patterns. You act as a "meta-debugger" — debugging the _process_, not the _code_.
 
 ## When to Activate

package/.agent/skills/zero-trust-passkeys/SKILL.md

@@ -0,0 +1,85 @@
+---
+name: zero-trust-passkeys
+description: Modern passwordless authentication using WebAuthn, FIDO2 biometric passkeys, SimpleWebAuthn v13+, Conditional UI (Passkey Autofill), and Zero-Trust security.
+tools: Read, Grep, Glob, Edit, Write
+version: 3.0.0
+last-updated: 2026-08-05
+script: .agent/scripts/security_scan.js
+scripts-binding:
+  - .agent/scripts/security_scan.js
+skills:
+  - authentication-best-practices
+  - backend-security-expert
+  - frontend-security-expert
+---
+
+# Zero-Trust Passkeys & WebAuthn (SimpleWebAuthn v13+)
+
+## Mandatory Pre-Flight Context Inspection
+
+Before implementing auth flows:
+1. Conditional UI (Passkey Autofill) → Use `useBrowserAutofill: true` and `autocomplete="username webauthn"` for seamless form autofill
+2. Feature Detection & Abort Signals → Check `isConditionalMediationAvailable()` and manage cancellation via `AbortController`
+3. Discoverable Credentials → Ensure `userVerification` and resident key options are enabled on registration
+
+## Client-Side Passkey Autofill Pattern (SimpleWebAuthn v13 Browser)
+
+```typescript
+import { 
+  startAuthentication, 
+  isConditionalMediationAvailable 
+} from '@simplewebauthn/browser';
+
+export async function initConditionalPasskeyAutofill(abortSignal: AbortSignal) {
+  const isAvailable = await isConditionalMediationAvailable();
+  if (!isAvailable) return;
+
+  try {
+    // 1. Fetch options from server
+    const res = await fetch('/api/auth/generate-authentication-options');
+    const options = await res.json();
+
+    // 2. Trigger browser native autofill dropdown
+    const credential = await startAuthentication({
+      optionsJSON: options,
+      useBrowserAutofill: true,
+    });
+
+    // 3. Send response to server for verification
+    await fetch('/api/auth/verify-authentication', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify(credential),
+    });
+  } catch (err: any) {
+    if (err.name !== 'AbortError') console.error('Passkey autofill error:', err);
+  }
+}
+```
+
+## Server Verification Pattern (SimpleWebAuthn v13 Server)
+
+```typescript
+import { verifyAuthenticationResponse, generateAuthenticationOptions } from '@simplewebauthn/server';
+
+export async function verifyPasskeyAuth(body: any, expectedChallenge: string, userPublicKey: Uint8Array) {
+  const verification = await verifyAuthenticationResponse({
+    response: body,
+    expectedChallenge,
+    expectedOrigin: process.env.APP_ORIGIN!,
+    expectedRPID: process.env.RP_ID!,
+    credential: {
+      id: body.id,
+      publicKey: userPublicKey,
+      counter: body.counter || 0,
+    },
+  });
+
+  return verification.verified;
+}
+```
+
+## 🛑 Verification-Before-Completion (VBC) Protocol
+
+- Verify input tags have `autocomplete="username webauthn"`.
+- Test passkey autofill flow with `AbortController` cancellation.

package/.agent/templates/DESIGN.md

@@ -0,0 +1,292 @@
+# DESIGN.md — Product Design System
+
+> **This file is your AI agent's source of truth for premium visual design.**
+> Generated by `tribunal-kit init`. Choose and customize one Visual Direction for your brand.
+> All coding agents MUST read this file before generating any UI code.
+
+---
+
+## 1. Chosen Visual Direction: [Enter Chosen Direction Here]
+
+Choose **ONE** direction from the list below to define the brand visual system. Do not mix directions:
+
+*   **Swiss Precision:** Clean, grid-locked alignment, sans-serif typography, clinical whitespace, no decoration.
+*   **Brutalist:** Raw, exposed 1px borders, monospace display fonts, high contrast, sharp corners (`radius: 2px`).
+*   **Editorial:** Magazine-inspired layout, large display headings, generous margins, serif headings, single-column reading paths.
+*   **Neo-Glassmorphism:** Tinted overlays, high backdrop blur (`blur(20px)`), luminous hairlines, floating modules.
+*   **Soft Minimal:** Warm tinted grays (`oklch`), rounded shapes (`radius: 12px`), deep shadows, spacious margins.
+*   **Dark Luxury:** Near-black base (`#0A0A0F`), gold/amber accent lines, thin fonts, subtle animations.
+*   **Neon Cyberpunk:** Dark base surfaces, highly saturated vivid accents (neon cyan/green), glow effects, sharp geometry.
+*   **Retro Analog:** Warm grain overlay, rounded typography, muted color palettes, physical paper-like textures.
+
+---
+
+## 2. Visual Identities CSS Tokens Definition
+
+### 1. Swiss Precision
+```css
+:root {
+  --font-display: "General Sans", sans-serif;
+  --font-body: "Satoshi", sans-serif;
+  --font-mono: "JetBrains Mono", monospace;
+
+  /* Surfaces */
+  --bg-base:           oklch(0.98 0.002 240);
+  --bg-surface:        oklch(1.00 0 0);
+  --bg-surface-raised: oklch(0.95 0.003 240);
+
+  /* Accents */
+  --color-primary:     oklch(0.20 0.01 240);      /* Minimal black/slate */
+  --color-primary-hover: oklch(0.40 0.01 240);
+
+  /* Spacing Grid */
+  --space-xs:  4px;
+  --space-sm:  8px;
+  --space-md:  16px;
+  --space-lg:  24px;
+  --space-xl:  32px;
+
+  /* Radii */
+  --radius-sm: 0px;
+  --radius-md: 0px;
+  --radius-lg: 0px;
+
+  /* Elevation */
+  --shadow-sm: none;
+  --shadow-md: none;
+  --border-subtle: oklch(90% 0.002 240);
+}
+```
+
+### 2. Brutalist
+```css
+:root {
+  --font-display: "JetBrains Mono", monospace;
+  --font-body: "General Sans", sans-serif;
+  --font-mono: "JetBrains Mono", monospace;
+
+  --bg-base:           oklch(1.00 0 0);
+  --bg-surface:        oklch(1.00 0 0);
+  --bg-surface-raised: oklch(0.95 0.005 240);
+
+  --color-primary:     oklch(0.60 0.28 140);      /* Acid Green */
+  --color-primary-hover: oklch(0.50 0.28 140);
+
+  --space-xs:  4px;
+  --space-sm:  8px;
+  --space-md:  16px;
+  --space-lg:  24px;
+  --space-xl:  32px;
+
+  --radius-sm: 2px;
+  --radius-md: 2px;
+  --radius-lg: 2px;
+
+  --shadow-sm: 2px 2px 0px oklch(10% 0.01 240);  /* Hard drop shadows */
+  --shadow-md: 4px 4px 0px oklch(10% 0.01 240);
+  --border-subtle: 2px solid oklch(10% 0.01 240);
+}
+```
+
+### 3. Editorial
+```css
+:root {
+  --font-display: "Playfair Display", serif;
+  --font-body: "Source Sans 3", sans-serif;
+  --font-mono: "Courier New", monospace;
+
+  --bg-base:           oklch(0.97 0.005 60);      /* Warm alabaster tint */
+  --bg-surface:        oklch(0.99 0.002 60);
+  --bg-surface-raised: oklch(0.94 0.008 60);
+
+  --color-primary:     oklch(0.35 0.12 25);       /* Deep terracotta red */
+  --color-primary-hover: oklch(0.25 0.12 25);
+
+  --space-xs:  6px;
+  --space-sm:  12px;
+  --space-md:  24px;
+  --space-lg:  36px;
+  --space-xl:  48px;
+
+  --radius-sm: 4px;
+  --radius-md: 8px;
+  --radius-lg: 16px;
+
+  --shadow-sm: 0 2px 8px oklch(20% 0.01 60 / 0.05);
+  --shadow-md: 0 8px 24px oklch(20% 0.01 60 / 0.08);
+  --border-subtle: oklch(88% 0.01 60);
+}
+```
+
+### 4. Neo-Glassmorphism
+```css
+:root {
+  --font-display: "Clash Display", sans-serif;
+  --font-body: "Satoshi", sans-serif;
+  --font-mono: "JetBrains Mono", monospace;
+
+  --bg-base:           oklch(0.12 0.01 220);      /* Deep indigo gradient base */
+  --bg-surface:        oklch(100% 0 0 / 0.15);    /* Translucent glass */
+  --bg-surface-raised: oklch(100% 0 0 / 0.25);
+
+  --color-primary:     oklch(0.70 0.22 200);      /* Electric cyan */
+  --color-primary-hover: oklch(0.60 0.22 200);
+
+  --space-xs:  4px;
+  --space-sm:  8px;
+  --space-md:  16px;
+  --space-lg:  24px;
+  --space-xl:  32px;
+
+  --radius-sm: 4px;
+  --radius-md: 16px;
+  --radius-lg: 28px;
+
+  --shadow-sm: 0 4px 12px oklch(0% 0 0 / 0.15);
+  --shadow-md: 0 12px 32px oklch(0% 0 0 / 0.25);
+  --border-subtle: 1px solid oklch(100% 0 0 / 0.18); /* Glass hairline glow */
+}
+```
+
+### 5. Soft Minimal
+```css
+:root {
+  --font-display: "Geist Sans", sans-serif;
+  --font-body: "Geist Sans", sans-serif;
+  --font-mono: "Geist Mono", monospace;
+
+  --bg-base:           oklch(0.98 0.003 80);      /* Warm off-white */
+  --bg-surface:        oklch(1.00 0 0);
+  --bg-surface-raised: oklch(0.96 0.005 80);
+
+  --color-primary:     oklch(0.40 0.06 200);      /* Muted graphite slate */
+  --color-primary-hover: oklch(0.30 0.06 200);
+
+  --space-xs:  4px;
+  --space-sm:  8px;
+  --space-md:  16px;
+  --space-lg:  24px;
+  --space-xl:  32px;
+
+  --radius-sm: 6px;
+  --radius-md: 12px;
+  --radius-lg: 20px;
+
+  --shadow-sm: 0 2px 4px oklch(0% 0 0 / 0.02);
+  --shadow-md: 0 8px 24px oklch(0% 0 0 / 0.04);
+  --border-subtle: oklch(93% 0.003 80);
+}
+```
+
+### 6. Dark Luxury
+```css
+:root {
+  --font-display: "Cabinet Grotesk", sans-serif;
+  --font-body: "Satoshi", sans-serif;
+  --font-mono: "JetBrains Mono", monospace;
+
+  --bg-base:           oklch(0.08 0.005 250);     /* OLED-friendly black */
+  --bg-surface:        oklch(0.12 0.008 250);
+  --bg-surface-raised: oklch(0.16 0.01 250);
+
+  --color-primary:     oklch(0.78 0.12 85);       /* Gold/Amber */
+  --color-primary-hover: oklch(0.68 0.12 85);
+
+  --space-xs:  4px;
+  --space-sm:  8px;
+  --space-md:  16px;
+  --space-lg:  24px;
+  --space-xl:  32px;
+
+  --radius-sm: 2px;
+  --radius-md: 6px;
+  --radius-lg: 12px;
+
+  --shadow-sm: 0 1px 2px oklch(0% 0 0 / 0.3);
+  --shadow-md: 0 4px 16px oklch(0% 0 0 / 0.5);
+  --border-subtle: oklch(22% 0.01 250 / 0.5);   /* Thin hairline borders */
+}
+```
+
+### 7. Neon Cyberpunk
+```css
+:root {
+  --font-display: "Space Grotesk", sans-serif;
+  --font-body: "General Sans", sans-serif;
+  --font-mono: "JetBrains Mono", monospace;
+
+  --bg-base:           oklch(0.05 0.01 280);      /* Deep space navy */
+  --bg-surface:        oklch(0.08 0.015 280);
+  --bg-surface-raised: oklch(0.12 0.02 280);
+
+  --color-primary:     oklch(0.75 0.28 160);      /* Neon green glow */
+  --color-primary-hover: oklch(0.85 0.28 160);
+
+  --space-xs:  4px;
+  --space-sm:  8px;
+  --space-md:  16px;
+  --space-lg:  24px;
+  --space-xl:  32px;
+
+  --radius-sm: 0px;
+  --radius-md: 4px;
+  --radius-lg: 8px;
+
+  --shadow-sm: 0 0 8px oklch(0.75 0.28 160 / 0.2);
+  --shadow-md: 0 0 16px oklch(0.75 0.28 160 / 0.4);
+  --border-subtle: oklch(20% 0.03 280);
+}
+```
+
+### 8. Retro Analog
+```css
+:root {
+  --font-display: "Clash Display", sans-serif;
+  --font-body: "Switzer", sans-serif;
+  --font-mono: "Courier New", monospace;
+
+  --bg-base:           oklch(0.94 0.015 70);      /* Warm paper beige */
+  --bg-surface:        oklch(0.96 0.015 70);
+  --bg-surface-raised: oklch(0.91 0.02 70);
+
+  --color-primary:     oklch(0.50 0.18 45);       /* Muted rust brown */
+  --color-primary-hover: oklch(0.40 0.18 45);
+
+  --space-xs:  5px;
+  --space-sm:  10px;
+  --space-md:  20px;
+  --space-lg:  30px;
+  --space-xl:  40px;
+
+  --radius-sm: 4px;
+  --radius-md: 8px;
+  --radius-lg: 16px;
+
+  --shadow-sm: 1px 1px 2px oklch(20% 0.02 70 / 0.08);
+  --shadow-md: 3px 3px 6px oklch(20% 0.02 70 / 0.12);
+  --border-subtle: oklch(85% 0.02 70);
+}
+```
+
+---
+
+## 3. Typographical Scaling (Fluid Type)
+
+*   Headings must use `clamp()` to scale fluidly with the screen width.
+*   Always include `text-wrap: balance` to prevent typographical orphans.
+*   Body text line length must be clamped to `65ch` max width.
+
+---
+
+## 4. Spacing Rules & Nested Radii
+
+*   Maintain the 8px grid alignment.
+*   Nested Radius Formula: `outer_radius = inner_radius + padding_inner`.
+
+---
+
+## 5. Interaction States & Transitions
+
+All buttons and active controls must define styled properties for:
+*   `hover`, `focus-visible`, `active`/`pressed`, and `disabled` states.
+*   Use spring easing curves: `cubic-bezier(0.34, 1.56, 0.64, 1)`.

package/.agent/templates/design-tokens.json

@@ -0,0 +1,137 @@
+{
+  "$schema": "https://design-tokens.github.io/community-group/format/",
+  "$description": "Tribunal Kit — Adaptive Design Tokens (W3C Format). Complete 8 Visual Identities with Typography and Elevation.",
+
+  "themes": {
+    "swiss": {
+      "color": {
+        "primary": { "$value": "oklch(0.20 0.01 240)", "$type": "color" },
+        "bg-base": { "$value": "oklch(0.98 0.002 240)", "$type": "color" },
+        "bg-surface": { "$value": "oklch(1.00 0 0)", "$type": "color" }
+      },
+      "radius": {
+        "sm": { "$value": "0px", "$type": "dimension" },
+        "md": { "$value": "0px", "$type": "dimension" }
+      },
+      "typography": {
+        "family-sans": { "$value": "Helvetica Neue, Arial, sans-serif", "$type": "fontFamily" },
+        "family-mono": { "$value": "SFMono-Regular, Consolas, monospace", "$type": "fontFamily" }
+      }
+    },
+    "brutalist": {
+      "color": {
+        "primary": { "$value": "oklch(0.60 0.28 140)", "$type": "color" },
+        "bg-base": { "$value": "oklch(1.00 0 0)", "$type": "color" },
+        "bg-surface": { "$value": "oklch(1.00 0 0)", "$type": "color" }
+      },
+      "radius": {
+        "sm": { "$value": "2px", "$type": "dimension" },
+        "md": { "$value": "2px", "$type": "dimension" }
+      },
+      "typography": {
+        "family-sans": { "$value": "Space Grotesk, Impact, sans-serif", "$type": "fontFamily" },
+        "family-mono": { "$value": "Space Mono, Courier New, monospace", "$type": "fontFamily" }
+      }
+    },
+    "editorial": {
+      "color": {
+        "primary": { "$value": "oklch(0.35 0.12 25)", "$type": "color" },
+        "bg-base": { "$value": "oklch(0.97 0.005 60)", "$type": "color" },
+        "bg-surface": { "$value": "oklch(0.99 0.002 60)", "$type": "color" }
+      },
+      "radius": {
+        "sm": { "$value": "4px", "$type": "dimension" },
+        "md": { "$value": "8px", "$type": "dimension" }
+      },
+      "typography": {
+        "family-serif": { "$value": "Newsreader, Georgia, serif", "$type": "fontFamily" },
+        "family-sans": { "$value": "Inter, system-ui, sans-serif", "$type": "fontFamily" }
+      }
+    },
+    "glassmorphism": {
+      "color": {
+        "primary": { "$value": "oklch(0.70 0.22 200)", "$type": "color" },
+        "bg-base": { "$value": "oklch(0.12 0.01 220)", "$type": "color" },
+        "bg-surface": { "$value": "oklch(100% 0 0 / 0.15)", "$type": "color" }
+      },
+      "radius": {
+        "sm": { "$value": "4px", "$type": "dimension" },
+        "md": { "$value": "16px", "$type": "dimension" }
+      },
+      "typography": {
+        "family-sans": { "$value": "Plus Jakarta Sans, system-ui, sans-serif", "$type": "fontFamily" }
+      }
+    },
+    "soft-minimal": {
+      "color": {
+        "primary": { "$value": "oklch(0.40 0.06 200)", "$type": "color" },
+        "bg-base": { "$value": "oklch(0.98 0.003 80)", "$type": "color" },
+        "bg-surface": { "$value": "oklch(1.00 0 0)", "$type": "color" }
+      },
+      "radius": {
+        "sm": { "$value": "6px", "$type": "dimension" },
+        "md": { "$value": "12px", "$type": "dimension" }
+      },
+      "typography": {
+        "family-sans": { "$value": "Inter, system-ui, sans-serif", "$type": "fontFamily" }
+      }
+    },
+    "dark-luxury": {
+      "color": {
+        "primary": { "$value": "oklch(0.78 0.12 85)", "$type": "color" },
+        "bg-base": { "$value": "oklch(0.08 0.005 250)", "$type": "color" },
+        "bg-surface": { "$value": "oklch(0.12 0.008 250)", "$type": "color" }
+      },
+      "radius": {
+        "sm": { "$value": "2px", "$type": "dimension" },
+        "md": { "$value": "6px", "$type": "dimension" }
+      },
+      "typography": {
+        "family-serif": { "$value": "Cormorant Garamond, serif", "$type": "fontFamily" },
+        "family-sans": { "$value": "Outfit, system-ui, sans-serif", "$type": "fontFamily" }
+      }
+    },
+    "cyberpunk": {
+      "color": {
+        "primary": { "$value": "oklch(0.75 0.28 160)", "$type": "color" },
+        "bg-base": { "$value": "oklch(0.05 0.01 280)", "$type": "color" },
+        "bg-surface": { "$value": "oklch(0.08 0.015 280)", "$type": "color" }
+      },
+      "radius": {
+        "sm": { "$value": "0px", "$type": "dimension" },
+        "md": { "$value": "4px", "$type": "dimension" }
+      },
+      "typography": {
+        "family-mono": { "$value": "JetBrains Mono, Fira Code, monospace", "$type": "fontFamily" }
+      }
+    },
+    "retro-analog": {
+      "color": {
+        "primary": { "$value": "oklch(0.50 0.18 45)", "$type": "color" },
+        "bg-base": { "$value": "oklch(0.94 0.015 70)", "$type": "color" },
+        "bg-surface": { "$value": "oklch(0.96 0.015 70)", "$type": "color" }
+      },
+      "radius": {
+        "sm": { "$value": "4px", "$type": "dimension" },
+        "md": { "$value": "8px", "$type": "dimension" }
+      },
+      "typography": {
+        "family-sans": { "$value": "Courier Prime, Courier, monospace", "$type": "fontFamily" }
+      }
+    }
+  },
+
+  "spacing": {
+    "xs":  { "$value": "4px",  "$type": "dimension" },
+    "sm":  { "$value": "8px",  "$type": "dimension" },
+    "md":  { "$value": "16px", "$type": "dimension" },
+    "lg":  { "$value": "24px", "$type": "dimension" },
+    "xl":  { "$value": "32px", "$type": "dimension" }
+  },
+
+  "shadow": {
+    "sm": { "$value": "0 1px 3px oklch(0 0 0 / 0.08)", "$type": "shadow" },
+    "md": { "$value": "0 4px 12px oklch(0 0 0 / 0.12)", "$type": "shadow" },
+    "lg": { "$value": "0 12px 32px oklch(0 0 0 / 0.20)", "$type": "shadow" }
+  }
+}

package/.agent/workflows/acf.md

@@ -1,5 +1,13 @@
 ---
 description: Distills human-written markdown documents into highly structured Agent Context Format (.acf) YAML files to minimize token usage and hallucination.
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 3.0.0
+last-updated: 2026-07-30
+required-skills:
+  - clean-code
+  - documentation-templates
+scripts-binding:
+  - .agent/scripts/lint_runner.js
 ---
 
 # /acf — Agent Context Format Distiller
@@ -8,13 +16,12 @@ $ARGUMENTS
 
 ---
 
-## $CONTEXT_REQUIRED
+## Mandatory Pre-Flight Context Inspection
 
-```
-Read BEFORE distilling:
-□ Target markdown file        → The document to compress into ACF
-□ context/ directory listing  → Check for existing ACF files to avoid duplicates
-```
+Before distilling markdown specs into `.acf` YAML files, you MUST inspect:
+1. Target Document Source → Read source `.md` specification (PRD, design spec, or architecture doc)
+2. Existing Context Registry (`context/*.acf`) → Check target directory to prevent duplicate context creation
+3. YAML Schema Strictness → Validate output against ACF schema (rules, constraints, tech-stack, boundaries) before writing to disk
 
 ---
 

package/.agent/workflows/api-tester.md

@@ -1,6 +1,15 @@
 ---
 description: Automated multi-stage API endpoint testing. Generates and runs auth-aware request sequences (login → use token → test CRUD → verify errors). Reports response codes, schema mismatches, and unexpected data.
-required-skills: testing-patterns, api-patterns
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 3.0.0
+last-updated: 2026-07-30
+required-skills:
+  - testing-patterns
+  - api-patterns
+  - backend-security-expert
+scripts-binding:
+  - .agent/scripts/test_runner.js
+  - .agent/scripts/security_scan.js
 ---
 
 # /api-tester — Automated API Testing
@@ -9,14 +18,12 @@ $ARGUMENTS
 
 ---
 
-## $CONTEXT_REQUIRED
+## Mandatory Pre-Flight Context Inspection
 
-```
-Read BEFORE testing:
-□ Target endpoint files       → Understand the expected parameters and auth needs
-□ package.json                → Check testing frameworks available
-□ .env.example / .env.test     → Check for test database or mock API URLs
-```
+Before running automated API endpoint tests or auth-aware request sequences, you MUST inspect:
+1. Target Route Definition & Data Schemas → Inspect route parameters, body validation schemas (Zod/Pydantic), and auth middleware
+2. Test Server URL & Credentials (`.env.test`) → Verify base URL and test token environment variables
+3. Multi-Stage Request Sequence → Enforce sequential execution: Auth Login → Token Capture → CRUD Operations → Error Edge Case Verification
 
 ---
 

package/.agent/workflows/audit.md

@@ -1,6 +1,19 @@
 ---
 description: Full project audit combining security scan, lint, schema validation, test coverage, dependency analysis, and bundle analysis. Runs all scripts in priority order. Human review required before applying any fixes.
-required-skills: vulnerability-scanner, clean-code
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 3.0.0
+last-updated: 2026-07-30
+required-skills:
+  - vulnerability-scanner
+  - clean-code
+  - code-review-checklist
+scripts-binding:
+  - .agent/scripts/security_scan.js
+  - .agent/scripts/dependency_analyzer.js
+  - .agent/scripts/lint_runner.js
+  - .agent/scripts/schema_validator.js
+  - .agent/scripts/test_runner.js
+  - .agent/scripts/bundle_analyzer.js
 ---
 
 # /audit — Complete Project Health Assessment
@@ -9,14 +22,12 @@ $ARGUMENTS
 
 ---
 
-## $CONTEXT_REQUIRED
+## Mandatory Pre-Flight Context Inspection
 
-```
-Read BEFORE auditing:
-□ package.json                → Identify all configured scripts and dependencies
-□ Config files                 → tsconfig.json, eslint.config.js, jest.config.js
-□ .agent/scripts/              → Check which audit scripts exist and are executable
-```
+Before triggering a full project audit, you MUST inspect:
+1. Workspace Package Manifest (`package.json`) → Verify installed test frameworks, linters, and dependencies
+2. Executable Scripts Inventory (`.agent/scripts/`) → Verify presence of `security_scan.js`, `lint_runner.js`, and `test_runner.js`
+3. Pipeline Execution Constraints → Confirm fixed execution order (Security → Dependencies → Type Check → Lint → Schema → Tests → Bundle) and HALT rules on critical CVE findings
 
 ---