tribunal-kit 5.8.5 → 6.0.1

package/.agent/workflows/pipeline.md

@@ -0,0 +1,155 @@
+---
+description: Hybrid 3-Pass Code Generation pipeline. Pass 1 (Planner) → Pass 2 (Builder) → Pass 3 (Zero-LLM Deterministic Validator). Maximizes code generation quality while keeping prompt context hyper-efficient.
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 3.0.0
+last-updated: 2026-07-30
+required-skills:
+  - clean-code
+  - codebase-design
+  - lint-and-validate
+scripts-binding:
+  - .agent/scripts/pipeline_engine.js
+  - .agent/scripts/lint_runner.js
+  - .agent/scripts/security_scan.js
+---
+
+# /pipeline — Hybrid 3-Pass Code Generation
+
+$ARGUMENTS
+
+---
+
+## Mandatory Pre-Flight Context Inspection
+
+Before running 3-pass pipeline generation, you MUST inspect:
+1. Pipeline Engine Script (`.agent/scripts/pipeline_engine.js`) → Verify availability and options (`--task`, `--file`, `--phase`)
+2. Context Token Allocation -> Keep Pass 2 builder prompt under 2,500 tokens (loading max 3 essential skill key-rules)
+3. Zero-LLM Pass 3 Validator → Run deterministic security, lint, and type checks on generated code prior to Human Gate submission
+
+## When to Use /pipeline
+
+| Use `/pipeline` when...                         | Use something else when...                     |
+| :---------------------------------------------- | :--------------------------------------------- |
+| Code generation quality is the top priority     | Quick single-line fix → direct edit            |
+| Context window saturation is causing weak output | Need full tribunal review → `/generate`        |
+| Building UI components, APIs, or complex logic  | Exploring options → `/brainstorm`              |
+| You want maximum LLM attention on code synthesis | Planning architecture → `/plan`                |
+
+---
+
+## Architecture
+
+```
+User Task → Pass 1 (Planner) → Pass 2 (Builder) → Pass 3 (Validator) → Human Gate
+              ~1,500 tokens     ~2,500 tokens       0 tokens (deterministic)
+```
+
+**vs. monolithic /generate: ~12,000–18,000 tokens in a single pass**
+
+---
+
+## Phase 1 — Plan (Automatic)
+
+The pipeline engine classifies the task, detects the stack, and selects 2-3 essential skills.
+
+```bash
+node .agent/scripts/pipeline_engine.js --task "$TASK" --file "$FILE" --phase plan --output json
+```
+
+Output: Structured spec JSON with task_type, stack, essential_skills, and constraints.
+
+**Human Gate**: Review the spec before proceeding to generation.
+
+---
+
+## Phase 2 — Build (Focused Generation)
+
+Assembles a minimal prompt containing ONLY:
+- The spec from Phase 1
+- 2-3 essential skill key-rules (condensed)
+- Target file content (if modifying existing code)
+
+```bash
+node .agent/scripts/pipeline_engine.js --task "$TASK" --file "$FILE" --phase build --output prompt
+```
+
+**What is NOT in the prompt (saving ~10,000 tokens):**
+- ❌ Full GEMINI.md master rules
+- ❌ Agent persona definitions
+- ❌ Tribunal gate rules
+- ❌ Error recovery protocol
+- ❌ Fabel Protocol cognitive loops
+- ❌ Unrelated domain skills
+
+The LLM receives a clean, focused prompt and can dedicate 75%+ of its attention to generating high-quality code.
+
+---
+
+## Phase 3 — Validate (Zero-LLM Deterministic)
+
+After code is generated, run deterministic validation:
+
+```bash
+node .agent/scripts/pipeline_engine.js --phase validate --code ./output.tsx
+```
+
+Checks:
+- ✅ OWASP security patterns (eval, innerHTML, hardcoded secrets, SQL injection)
+- ✅ TypeScript `any` usage
+- ✅ Empty catch blocks
+- ✅ Console.log pollution
+- ✅ Error handling gaps
+
+If validation fails → structured feedback is generated for automated retry (max 3 attempts).
+
+---
+
+## Full Pipeline (All Phases)
+
+```bash
+node .agent/scripts/pipeline_engine.js --task "$TASK" --file "$FILE" --output report
+```
+
+Or in dry-run mode:
+```bash
+node .agent/scripts/pipeline_engine.js --task "$TASK" --file "$FILE" --dry-run
+```
+
+---
+
+## Pipeline Guard
+
+```
+❌ Never load GEMINI.md into Pass 2 — the planner already distilled what's needed
+❌ Never skip Pass 3 validation — it's zero-cost (no LLM calls)
+❌ Never select more than 3 skills for a single generation pass
+❌ Never inject agent persona definitions into the builder prompt
+❌ Never bypass the Human Gate — even in pipeline mode
+```
+
+---
+
+## Comparison: /generate vs /pipeline
+
+| Dimension                     | `/generate` (current) | `/pipeline` (new)       |
+| :---------------------------- | :-------------------- | :---------------------- |
+| System prompt tokens          | ~12,000–18,000        | ~2,500 (Pass 2)         |
+| % context for actual task     | ~11%                  | ~75%                    |
+| Governance overhead           | ~89%                  | ~25%                    |
+| Post-gen validation           | LLM-based (expensive) | Deterministic (free)    |
+| Skills loaded per generation  | 6–10                  | 2–3                     |
+| Self-healing retry            | Full re-generation    | Targeted feedback loop  |
+| Backward compatibility        | N/A                   | 100% (additive)         |
+
+---
+
+## After /pipeline — Next Steps
+
+| Outcome                       | Next Command                        |
+| :---------------------------- | :---------------------------------- |
+| Code generated, needs review  | → `/review` for human audit         |
+| Code has issues after retry   | → `/generate` with full tribunal    |
+| Code passed, ready to test    | → `/test` for test generation       |
+| Code passed, ready to deploy  | → `/deploy` with pre-flight checks  |
+
+---

package/.agent/workflows/plan.md

@@ -1,6 +1,14 @@
 ---
 description: Create project plan using project-planner agent. 4-phase approach: Analyze → Research → Plan Document → Human Gate. NO code writing — only plan file generation. Writing begins only after explicit human approval.
-required-skills: plan-writing, architecture
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 3.0.0
+last-updated: 2026-07-30
+required-skills:
+  - plan-writing
+  - architecture
+  - project-planner
+scripts-binding:
+  - .agent/scripts/verify_all.js
 ---
 
 # /plan — Strategic Implementation Planning
@@ -9,16 +17,12 @@ $ARGUMENTS
 
 ---
 
-## $CONTEXT_REQUIRED
+## Mandatory Pre-Flight Context Inspection
 
-```
-Read BEFORE writing the plan:
-□ package.json             → Actual dependencies and scripts
-□ tsconfig.json            → TypeScript config and path aliases
-□ prisma/schema.prisma     → If DB changes planned (skip if not applicable)
-□ src/ directory listing   → Current project structure
-□ git log --oneline -5     → Recent work context
-```
+Before drafting implementation plans or technical blueprints, you MUST inspect:
+1. Workspace Context & Dependencies (`package.json`, `tsconfig.json`) → Confirm current stack capabilities and path mappings
+2. Existing Architecture & Directory Layout → Review current module boundaries to prevent redundant architectural patterns
+3. Zero Code Modification Rule → Restrict outputs in `/plan` mode to research, architectural design, and plan artifact generation; ban code generation before Plan approval
 
 ---
 

package/.agent/workflows/preview.md

@@ -1,6 +1,14 @@
 ---
 description: Preview server start, stop, and status check. Local development server management. Uses auto_preview.js for automated lifecycle control. Shows current URL and hot-reload status.
-required-skills: bash-linux, frontend-specialist
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 3.0.0
+last-updated: 2026-07-30
+required-skills:
+  - bash-linux
+  - frontend-specialist
+  - devops-engineer
+scripts-binding:
+  - .agent/scripts/auto_preview.js
 ---
 
 # /preview — Local Development Server
@@ -9,13 +17,12 @@ $ARGUMENTS
 
 ---
 
-## $CONTEXT_REQUIRED
+## Mandatory Pre-Flight Context Inspection
 
-```
-Read BEFORE managing preview:
-□ package.json                → Check dev script command and environment
-□ .env                        → Verify preview environment keys
-```
+Before managing dev server lifecycle or starting preview servers, you MUST inspect:
+1. Workspace Dev Script Configuration (`package.json`) → Verify `npm run dev` or equivalent start script and framework server port
+2. Environment Configuration (`.env`) → Check port bindings and dev server host configs
+3. Dev Server Lifecycle Script (`.agent/scripts/auto_preview.js`) → Use automated script for process management, port collision detection, and health checks
 
 ---
 

package/.agent/workflows/refactor.md

@@ -1,6 +1,16 @@
 ---
 description: Structured code refactoring with dependency-safe execution and behavior preservation. Maps all dependents before touching any file. Refactoring changes structure without changing observable behavior. Tests must pass before and after every step.
-required-skills: clean-code, architecture
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 3.0.0
+last-updated: 2026-07-30
+required-skills:
+  - clean-code
+  - architecture
+  - codebase-design
+  - tdd-workflow
+scripts-binding:
+  - .agent/scripts/test_runner.js
+  - .agent/scripts/lint_runner.js
 ---
 
 # /refactor — Dependency-Safe Structural Improvement
@@ -9,14 +19,12 @@ $ARGUMENTS
 
 ---
 
-## $CONTEXT_REQUIRED
+## Mandatory Pre-Flight Context Inspection
 
-```
-Read BEFORE refactoring:
-□ Target module               → Understand the structure to be extracted or renamed
-□ package.json                → Check test scripts to run after refactor
-□ grep search                 → Locate all importers of the target module
-```
+Before executing structural refactoring or extracting interfaces, you MUST inspect:
+1. Complete Dependent Map (Grep Importers) → Identify every file importing the target module before touching a single line
+2. Baseline Test Suite Verification (`test_runner.js`) → Ensure all unit and integration tests pass BEFORE initiating refactor steps
+3. Observable Behavior Preservation → Enforce zero change in public function behavior or API contracts; verify tests pass cleanly after every step
 
 ---
 

package/.agent/workflows/review-ai.md

@@ -1,6 +1,15 @@
 ---
 description: Audit AI/LLM integration code for hallucinated model names, invented API parameters, prompt injection vulnerabilities, missing rate-limit handling, streaming error gaps, and cost explosion patterns. Uses ai-code-reviewer + logic + security.
-required-skills: llm-engineering, ai-prompt-injection-defense
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 3.0.0
+last-updated: 2026-07-30
+required-skills:
+  - llm-engineering
+  - ai-prompt-injection-defense
+  - generative-ui-expert
+scripts-binding:
+  - .agent/scripts/security_scan.js
+  - .agent/scripts/lint_runner.js
 ---
 
 # /review-ai — AI Integration Code Audit
@@ -9,13 +18,12 @@ $ARGUMENTS
 
 ---
 
-## $CONTEXT_REQUIRED
+## Mandatory Pre-Flight Context Inspection
 
-```
-Read BEFORE reviewing:
-□ Target AI files             → The LLM integrations or prompts
-□ package.json                → Which SDKs are used (e.g. ai, openai)
-```
+Before auditing LLM integrations, prompt templates, or AI API calls, you MUST inspect:
+1. Target AI Code & SDK Manifests (`package.json`) → Verify official AI SDK versions (Vercel AI SDK `ai`, `@langchain/core`, `openai`, `@google/genai`)
+2. Prompt Injection Boundary Check → Confirm user inputs are strictly passed via message roles or delimited blocks; ban string concatenation into system prompts
+3. 3-Reviewer AI Integration Gate → Run ai-code-reviewer, logic-reviewer, and security-auditor before approving AI code diffs
 
 ---
 

package/.agent/workflows/review.md

@@ -1,6 +1,15 @@
 ---
 description: Audit existing code for hallucinations. Runs Logic + Security reviewers on any code without generating anything new. The pure review mode — read, analyze, and report only.
-required-skills: code-review-checklist, vulnerability-scanner
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 3.0.0
+last-updated: 2026-07-30
+required-skills:
+  - code-review-checklist
+  - vulnerability-scanner
+  - clean-code
+scripts-binding:
+  - .agent/scripts/security_scan.js
+  - .agent/scripts/lint_runner.js
 ---
 
 # /review — Hallucination Audit (Read-Only)
@@ -9,13 +18,12 @@ $ARGUMENTS
 
 ---
 
-## $CONTEXT_REQUIRED
+## Mandatory Pre-Flight Context Inspection
 
-```
-Read BEFORE reviewing:
-□ Target code files           → The files that need auditing
-□ package.json                → Check dependencies used by target files
-```
+Before auditing code for hallucinations or structural flaws, you MUST inspect:
+1. Target Source Code & Dependent Modules → Read target files and their import declarations
+2. Package Manifest (`package.json`) → Cross-reference imported packages against installed dependencies
+3. Pure Read-Only Constraint → Prohibit any file mutations or generation; output findings in structured audit tables strictly
 
 ---
 

package/.agent/workflows/session.md

@@ -1,6 +1,14 @@
 ---
 description: Interactive session state tracking for multi-conversation context continuity. Saves and restores agent context across separate sessions so work can be resumed without losing progress.
-required-skills: behavioral-modes, agent-organizer
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 3.0.0
+last-updated: 2026-07-30
+required-skills:
+  - behavioral-modes
+  - agent-organizer
+  - harness-protocol
+scripts-binding:
+  - .agent/scripts/session_manager.js
 ---
 
 # /session — Session State Management
@@ -9,13 +17,12 @@ $ARGUMENTS
 
 ---
 
-## $CONTEXT_REQUIRED
+## Mandatory Pre-Flight Context Inspection
 
-```
-Read BEFORE managing session:
-□ .agent/scripts/session_manager.js → Verify script exists and is executable
-□ Existing session files            → Check what previous sessions exist
-```
+Before saving, restoring, or clearing session state snapshots, you MUST inspect:
+1. Session Manager Executable (`.agent/scripts/session_manager.js`) → Confirm script availability and snapshot parameters
+2. Active Session History -> Read latest snapshot metadata (`session_id`, active task, modified files, open decisions)
+3. Zero Context Loss Rule → Verify state snapshot contains explicit next steps and task status prior to terminating conversation
 
 ---
 

package/.agent/workflows/status.md

@@ -1,6 +1,13 @@
 ---
 description: Display agent and project status. Shows task.md progress, last audit results, CI status, and recently modified files. Read-only — no changes made.
-required-skills: bash-linux
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 3.0.0
+last-updated: 2026-07-30
+required-skills:
+  - bash-linux
+  - code-review-checklist
+scripts-binding:
+  - .agent/scripts/verify_all.js
 ---
 
 # /status — Project Health Dashboard
@@ -9,13 +16,12 @@ $ARGUMENTS
 
 ---
 
-## $CONTEXT_REQUIRED
+## Mandatory Pre-Flight Context Inspection
 
-```
-Read BEFORE checking status:
-□ task.md                     → Get the current active task progress
-□ git status                  → Find recently modified files
-```
+Before rendering project status dashboards, you MUST inspect:
+1. Active Execution Ledger (`task.md`) → Read current wave progress, finished tasks, and active in-progress item
+2. Workspace Git Status (`git status`, `git diff --stat`) → List uncommitted edits and modified files
+3. Read-Only Constraint → Ban any file mutations or state updates during status reporting; report status strictly
 
 ---
 

package/.agent/workflows/strengthen-skills.md

@@ -1,6 +1,15 @@
 ---
 description: Strengthen skills by appending Tribunal guardrails (LLM Traps, Pre-Flight checklist, VBC Protocol) to any SKILL.md missing them. Reads each skill, checks for guardrails, appends if missing, skips if present.
-required-skills: skill-creator, llm-engineering
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 3.0.0
+last-updated: 2026-07-30
+required-skills:
+  - skill-creator
+  - llm-engineering
+  - clean-code
+scripts-binding:
+  - .agent/scripts/skill_integrator.js
+  - .agent/scripts/lint_runner.js
 ---
 
 # /strengthen-skills — Skill Hardening Pipeline
@@ -9,12 +18,12 @@ $ARGUMENTS
 
 ---
 
-## $CONTEXT_REQUIRED
+## Mandatory Pre-Flight Context Inspection
 
-```
-Read BEFORE strengthening:
-□ .agent/skills/              → Identify the skills that exist
-```
+Before auditing or hardening skill definitions, you MUST inspect:
+1. Target Skill Directory Inventory (`.agent/skills/`) → List all skill folders and inspect `SKILL.md` frontmatter
+2. Guardrail Idempotency Check → Check if target `SKILL.md` already carries `## Mandatory Pre-Flight Context Inspection` or `## 🏛️ Tribunal Integration`; skip if present
+3. Skill Integrator Script (`.agent/scripts/skill_integrator.js`) → Run skill integrator script to update executable script bindings
 
 ---
 

package/.agent/workflows/super-prompt.md

@@ -1,18 +1,27 @@
-# /super-prompt — Tokenless Prompt Compiler
-
 ---
+description: Tokenless Prompt Compiler. Converts conversational requests into hyper-dense YAML structures that LLMs process perfectly, reducing prompt tokens and improving response accuracy. Zero API tokens used during compilation.
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 3.0.0
+last-updated: 2026-07-30
+required-skills:
+  - llm-engineering
+  - clean-code
+scripts-binding:
+  - .agent/scripts/prompt_compiler.js
+---
+
+# /super-prompt — Tokenless Prompt Compiler
 
-## required-skills: llm-engineering
+$ARGUMENTS
 
-Converts conversational, fluffy requests into hyper-dense YAML structures that LLMs process perfectly, reducing prompt tokens and drastically improving response accuracy. **Zero API tokens are used during compilation.**
+---
 
-## $CONTEXT_REQUIRED
+## Mandatory Pre-Flight Context Inspection
 
-```
-Read BEFORE super-prompting:
-□ Target prompt               → Determine what the user wants to achieve
-□ .agent/scripts/prompt_compiler.js → Verify script exists
-```
+Before compiling prompts or running prompt compression, you MUST inspect:
+1. Target Input Request Text → Read target user request to strip conversational fillers
+2. Prompt Compiler Script (`.agent/scripts/prompt_compiler.js`) → Verify availability of local prompt compiler script
+3. Zero Token Overhead Principle → Ensure compilation executes locally without invoking LLM API calls
 
 ---
 

package/.agent/workflows/swarm.md

@@ -1,6 +1,15 @@
 ---
 description: Multi-Agent Swarm Orchestration. Supervisor decomposes a complex goal into sub-tasks, dispatches to specialist Workers via structured JSON contracts, collects results via allSettled fan-in, and synthesizes a unified deliverable. Validates payloads via swarm_dispatcher.js before dispatch.
-required-skills: parallel-agents, agent-organizer
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 3.0.0
+last-updated: 2026-07-30
+required-skills:
+  - parallel-agents
+  - agent-organizer
+  - swarm-dispatcher
+scripts-binding:
+  - .agent/scripts/swarm_dispatcher.js
+  - .agent/scripts/verify_all.js
 ---
 
 # /swarm — Multi-Agent Swarm Execution
@@ -9,13 +18,12 @@ $ARGUMENTS
 
 ---
 
-## $CONTEXT_REQUIRED
+## Mandatory Pre-Flight Context Inspection
 
-```
-Read BEFORE swarming:
-□ Target scope                → Ensure tasks are non-overlapping
-□ .agent/scripts/swarm_dispatcher.js → Validate the dispatcher is available
-```
+Before decomposing goals into worker sub-tasks or triggering swarm execution, you MUST inspect:
+1. Swarm Dispatcher Validator (`.agent/scripts/swarm_dispatcher.js`) → Run payload validation script to ensure valid worker JSON payloads
+2. Non-Overlapping File Boundary Rule → Verify worker tasks target disjoint file sets to prevent git write conflicts during parallel execution
+3. `Promise.allSettled()` Fan-In Protocol → Collect all worker status reports and synthesize final deliverable before Human Gate confirmation
 
 ---
 

package/.agent/workflows/test.md

@@ -1,6 +1,15 @@
 ---
 description: Test generation and test running command. Creates and executes tests for code using the Testing Trophy strategy (unit → integration → E2E). Tests are behavioral (GIVEN/WHEN/THEN), not structural. Tests cannot be approved without covering happy path, error path, and boundary cases.
-required-skills: testing-patterns, tdd-workflow
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 3.0.0
+last-updated: 2026-07-30
+required-skills:
+  - testing-patterns
+  - tdd-workflow
+  - test-engineer
+scripts-binding:
+  - .agent/scripts/test_runner.js
+  - .agent/scripts/verify_all.js
 ---
 
 # /test — Test Generation & Execution
@@ -9,14 +18,12 @@ $ARGUMENTS
 
 ---
 
-## $CONTEXT_REQUIRED
+## Mandatory Pre-Flight Context Inspection
 
-```
-Read BEFORE testing:
-□ Target files                → Code to be tested
-□ Existing tests              → Understand testing patterns already used
-□ package.json                → Check test frameworks (Jest, Vitest, etc.)
-```
+Before generating test suites or executing test runners, you MUST inspect:
+1. Workspace Test Runner Configuration (`package.json`, `jest.config.js`, `vitest.config.ts`, `pytest.ini`) → Verify installed runner & test environment
+2. Target Module Code & Contracts → Inspect function signatures, parameters, exceptions, and return types
+3. 3-Case Coverage Requirement → Ensure test cases explicitly cover Happy Path, Error Handling Path, and Boundary Conditions before approving test files
 
 ---
 

package/.agent/workflows/tribunal-backend.md

@@ -1,6 +1,16 @@
 ---
 description: Backend-specific Tribunal. Runs Logic + Security + Dependency + Type Safety + Resilience + Schema reviewers. Use for API routes, server logic, auth code, middleware, Server Actions, and any server-side business logic.
-required-skills: backend-security-expert, nodejs-best-practices, api-patterns
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 3.0.0
+last-updated: 2026-07-30
+required-skills:
+  - backend-security-expert
+  - nodejs-best-practices
+  - api-patterns
+scripts-binding:
+  - .agent/scripts/security_scan.js
+  - .agent/scripts/dependency_analyzer.js
+  - .agent/scripts/schema_validator.js
 ---
 
 # /tribunal-backend — Backend Code Audit
@@ -9,15 +19,12 @@ $ARGUMENTS
 
 ---
 
-## $CONTEXT_REQUIRED
+## Mandatory Pre-Flight Context Inspection
 
-```
-Read BEFORE backend review:
-□ Target backend files         → The code being audited
-□ package.json                 → Verify dependency versions (express, next, etc.)
-□ prisma/schema.prisma         → If ORM is used
-□ .env.example                 → Expected environment variables
-```
+Before auditing backend routes or server logic, you MUST inspect:
+1. Target Backend Source & Contracts → Read target route handlers, Server Actions, or controller methods
+2. Dependencies & Environment (`package.json`, `.env.example`) → Check backend framework versions, secret key placeholders, and ORM schemas
+3. 6-Reviewer Parallel Gate → Execute logic-reviewer, security-auditor, dependency-analyzer, type-safety, resilience-reviewer, and schema-reviewer before approving diffs
 
 ---
 

package/.agent/workflows/tribunal-database.md

@@ -1,6 +1,15 @@
 ---
 description: Database-specific Tribunal. Runs Logic + Security + SQL reviewers. Use for Prisma queries, raw SQL, schema migrations, ORM operations, and database transaction code.
-required-skills: database-design
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 3.0.0
+last-updated: 2026-07-30
+required-skills:
+  - database-design
+  - sql-pro
+  - supabase-postgres-best-practices
+scripts-binding:
+  - .agent/scripts/schema_validator.js
+  - .agent/scripts/security_scan.js
 ---
 
 # /tribunal-database — Database Code Audit
@@ -9,14 +18,12 @@ $ARGUMENTS
 
 ---
 
-## $CONTEXT_REQUIRED
+## Mandatory Pre-Flight Context Inspection
 
-```
-Read BEFORE database review:
-□ Target query/schema files    → The code being audited
-□ prisma/schema.prisma         → The single source of truth for schema
-□ Database migration files      → History of schema changes
-```
+Before auditing database queries, migrations, or ORM transactions, you MUST inspect:
+1. ORM Schema Source of Truth (`prisma/schema.prisma` or SQL schema) → Verify active table schemas, indexes, and relations
+2. SQL Parameterization Inspection → Flag all raw SQL queries attempting string interpolation; enforce parameterized queries
+3. 3-Reviewer Database Gate → Execute logic-reviewer, security-auditor, and sql-pro before approving database modifications
 
 ---