tribunal-kit 6.0.0 → 7.0.0

package/.agent/skills/api-patterns/SKILL.md

@@ -20,6 +20,7 @@ scripts-binding:
 ## Mandatory Pre-Flight Context Inspection
 
 Before designing or implementing API endpoints, you MUST inspect:
+
 1. Authorization Header Token Passing (Section 17) → Pass JWTs in `Authorization: Bearer` headers; strictly ban tokens in URL query params
 2. Cursor-Based Pagination (Section 19) → Use cursor pagination for datasets >10K rows to eliminate `OFFSET N` performance degradation
 3. Idempotency Header for Mutations (Section 21) → Require `Idempotency-Key` headers for state-changing `POST` or `PATCH` retry operations
@@ -108,7 +109,7 @@ interface ApiError {
 // GET /api/v1/posts?cursor=eyJpZCI6MTAwfQ&limit=20
 const posts = await db.post.findMany({
   where: { id: { lt: decodeCursor(req.query.cursor).id } },
-  orderBy: { id: "desc" },
+  orderBy: { id: 'desc' },
   take: limit + 1, // fetch one extra to determine hasMore
 });
 const hasMore = posts.length > limit;
@@ -126,15 +127,15 @@ return { data: posts, meta: { hasMore, nextCursor: encodeCursor(posts.at(-1)) }
 
 ```typescript
 // POST /api/v1/payments with header: Idempotency-Key: <uuid>
-app.post("/api/v1/payments", async (req, res) => {
-  const key = req.headers["idempotency-key"];
-  if (!key) return res.status(400).json({ error: "Missing Idempotency-Key" });
+app.post('/api/v1/payments', async (req, res) => {
+  const key = req.headers['idempotency-key'];
+  if (!key) return res.status(400).json({ error: 'Missing Idempotency-Key' });
 
   const cached = await redis.get(`idempotency:${key}`);
   if (cached) return res.status(200).json(JSON.parse(cached));
 
   const result = await processPayment(req.body);
-  await redis.set(`idempotency:${key}`, JSON.stringify(result), "EX", 86400);
+  await redis.set(`idempotency:${key}`, JSON.stringify(result), 'EX', 86400);
   return res.status(201).json(result);
 });
 // GET, PUT, DELETE → naturally idempotent (safe to retry without a key)
@@ -147,15 +148,18 @@ app.post("/api/v1/payments", async (req, res) => {
 
 ```typescript
 // HMAC signature verification (always verify — never trust unsigned webhooks)
-import { createHmac, timingSafeEqual } from "node:crypto";
+import { createHmac, timingSafeEqual } from 'node:crypto';
 function verify(payload: string, signature: string, secret: string): boolean {
-  const expected = createHmac("sha256", secret).update(payload).digest("hex");
+  const expected = createHmac('sha256', secret).update(payload).digest('hex');
   return timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
 }
 
-app.post("/webhooks", (req, res) => {
-  if (!verify(JSON.stringify(req.body), req.headers["x-webhook-signature"] as string, WEBHOOK_SECRET)) return res.status(401).send("Invalid signature");
-  res.status(200).send("OK"); // respond immediately
+app.post('/webhooks', (req, res) => {
+  if (
+    !verify(JSON.stringify(req.body), req.headers['x-webhook-signature'] as string, WEBHOOK_SECRET)
+  )
+    return res.status(401).send('Invalid signature');
+  res.status(200).send('OK'); // respond immediately
   processWebhookAsync(req.body); // process asynchronously
 });
 // Retry policy: 3 retries with exponential backoff (1s → 10s → 100s)

package/.agent/skills/api-security-auditor/SKILL.md

@@ -20,6 +20,7 @@ scripts-binding:
 ## Mandatory Pre-Flight Context Inspection
 
 Before auditing or hardening API endpoints, you MUST inspect:
+
 1. IDOR Prevention (Section 17) → Perform explicit tenancy checks (`receipt.userId === req.user.id`) and prefer UUIDv4/CUID over sequential integer IDs
 2. Mass Assignment Mitigations (Section 47) → Enforce strict Zod schemas (`.strict()`) to prevent parameter overposting into DB updates
 3. Distributed Rate Limiting (Section 80) → Store rate limit state in Redis for multi-pod load balanced environments to prevent limit bypasses
@@ -34,19 +35,19 @@ IDOR occurs when an application provides direct access to objects based on user-
 
 ```typescript
 // ❌ VULNERABLE: Trusting the requested ID blindly
-app.get("/api/receipts/:id", async (req, res) => {
+app.get('/api/receipts/:id', async (req, res) => {
   const receipt = await db.receipts.findById(req.params.id);
   res.json(receipt); // Attack: Increment ID to view others' receipts
 });
 
 // ✅ SAFE: Verifying ownership
-app.get("/api/receipts/:id", async (req, res) => {
+app.get('/api/receipts/:id', async (req, res) => {
   const receipt = await db.receipts.findById(req.params.id);
   if (!receipt) return res.status(404).send();
 
   // Explicit tenancy check
-  if (receipt.userId !== req.user.id && req.user.role !== "admin") {
-    return res.status(403).json({ error: "Access denied" });
+  if (receipt.userId !== req.user.id && req.user.role !== 'admin') {
+    return res.status(403).json({ error: 'Access denied' });
   }
 
   res.json(receipt);
@@ -64,20 +65,20 @@ Occurs when web frameworks automatically bind HTTP request parameters to applica
 
 ```typescript
 // ❌ VULNERABLE: Direct object binding
-app.put("/api/users/:id", async (req, res) => {
+app.put('/api/users/:id', async (req, res) => {
   // Attack: req.body = { name: "Bob", role: "admin", isPaid: true }
   await db.users.update({ id: req.params.id }, req.body);
-  res.send("Updated");
+  res.send('Updated');
 });
 
 // ✅ SAFE: Explicit property selection (DTOs)
-app.put("/api/users/:id", async (req, res) => {
+app.put('/api/users/:id', async (req, res) => {
   // Only extract explicitly allowed fields
   const { name, email, bio } = req.body;
   const safeData = { name, email, bio };
 
   await db.users.update({ id: req.params.id }, safeData);
-  res.send("Updated");
+  res.send('Updated');
 });
 
 // ✅ BEST: Validation libraries (Zod, Joi) handling stripping
@@ -95,8 +96,8 @@ const UpdateUserSchema = z
 
 ```typescript
 // Basic Rate Limiting (Express)
-import rateLimit from "express-rate-limit";
-import RedisStore from "rate-limit-redis";
+import rateLimit from 'express-rate-limit';
+import RedisStore from 'rate-limit-redis';
 
 // Global baseline limit
 export const globalLimiter = rateLimit({
@@ -111,7 +112,7 @@ export const authLimiter = rateLimit({
   store: new RedisStore({ client: redisClient }),
   windowMs: 60 * 60 * 1000, // 1 Hour
   max: 5, // 5 login attempts per IP per hour
-  message: "Too many login attempts, please try again later",
+  message: 'Too many login attempts, please try again later',
 });
 
 // ❌ HALLUCINATION TRAP: In-memory rate limiting across multiple server pods
@@ -144,8 +145,8 @@ Best Practices for issuance and storage:
 
 // 1. Query Depth Limiting (Prevent nested joins crushing the DB)
 // User -> Posts -> Comments -> Author -> Posts -> Comments...
-import depthLimit from "graphql-depth-limit";
-app.use("/graphql", graphqlHTTP({ validationRules: [depthLimit(5)] }));
+import depthLimit from 'graphql-depth-limit';
+app.use('/graphql', graphqlHTTP({ validationRules: [depthLimit(5)] }));
 
 // 2. Query Cost Analysis
 // Prevent attackers from requesting 100,000 items in a single query
@@ -155,7 +156,7 @@ app.use("/graphql", graphqlHTTP({ validationRules: [depthLimit(5)] }));
 // Introspection allows attackers to download your entire schema.
 const server = new ApolloServer({
   schema,
-  introspection: process.env.NODE_ENV !== "production",
+  introspection: process.env.NODE_ENV !== 'production',
 });
 ```
 

package/.agent/skills/app-builder/SKILL.md

@@ -20,6 +20,7 @@ scripts-binding:
 ## Mandatory Pre-Flight Context Inspection
 
 Before scaffolding or orchestrating application builds, you MUST inspect:
+
 1. Clarification Gate (Section 48) → Ask 4 core purpose/constraint questions before selecting stack or creating files
 2. Plan Verification (Section 220) → Ensure `{task-slug}.md` is created and verified in project root before invoking specialist agents
 3. Incremental Build Rule (Section 15) → Never generate entire applications in one shot; build and verify module by module

package/.agent/skills/app-builder/templates/nextjs-fullstack/TEMPLATE.md

@@ -93,11 +93,11 @@ project-name/
    Ensure `src/app/globals.css` uses the new import syntax instead of a config file:
 
    ```css
-   @import "tailwindcss";
+   @import 'tailwindcss';
 
    @theme {
      --color-primary: oklch(0.5 0.2 240);
-     --font-sans: "Inter", sans-serif;
+     --font-sans: 'Inter', sans-serif;
    }
    ```
 

package/.agent/skills/app-builder/templates/nextjs-saas/TEMPLATE.md

@@ -104,7 +104,7 @@ project-name/
 3. Install Tailwind v4 (Add to globals.css):
 
    ```css
-   @import "tailwindcss";
+   @import 'tailwindcss';
    ```
 
 4. Configure environment (.env.local)

package/.agent/skills/app-builder/templates/nextjs-static/TEMPLATE.md

@@ -52,10 +52,10 @@ Using `next.config.ts` instead of `.js` for better type safety.
 
 ```typescript
 // next.config.ts
-import type { NextConfig } from "next";
+import type { NextConfig } from 'next';
 
 const nextConfig: NextConfig = {
-  output: "export", // Required for Static Hosting (S3, GitHub Pages)
+  output: 'export', // Required for Static Hosting (S3, GitHub Pages)
   images: {
     unoptimized: true, // Required if not using Node.js server image optimization
   },
@@ -74,19 +74,19 @@ Deprecated next-seo. Configure directly in layout.tsx or page.tsx.
 
 ```typescript
 // src/app/layout.tsx
-import type { Metadata } from "next";
+import type { Metadata } from 'next';
 
 export const metadata: Metadata = {
   title: {
-    template: "%s | Product Name",
-    default: "Home - Product Name",
+    template: '%s | Product Name',
+    default: 'Home - Product Name',
   },
-  description: "SEO optimized description for the landing page.",
+  description: 'SEO optimized description for the landing page.',
   openGraph: {
-    type: "website",
-    locale: "en_US",
-    url: "https://mysite.com",
-    siteName: "My Brand",
+    type: 'website',
+    locale: 'en_US',
+    url: 'https://mysite.com',
+    siteName: 'My Brand',
   },
 };
 ```
@@ -138,11 +138,11 @@ export const metadata: Metadata = {
 3. Configure Tailwind v4 (in `src/app/globals.css`):
 
    ```css
-   @import "tailwindcss";
+   @import 'tailwindcss';
 
    @theme {
      --color-primary: #3b82f6;
-     --font-sans: "Inter", sans-serif;
+     --font-sans: 'Inter', sans-serif;
    }
    ```
 

package/.agent/skills/app-builder/templates/nuxt-app/TEMPLATE.md

@@ -99,12 +99,12 @@ project-name/
    Add to `nuxt.config.ts`:
 
    ```ts
-   import tailwindcss from "@tailwindcss/vite";
+   import tailwindcss from '@tailwindcss/vite';
    export default defineNuxtConfig({
      vite: {
        plugins: [tailwindcss()],
      },
-     css: ["~/assets/css/main.css"],
+     css: ['~/assets/css/main.css'],
    });
    ```
 
@@ -112,7 +112,7 @@ project-name/
    In `app/assets/css/main.css`:
 
    ```css
-   @import "tailwindcss";
+   @import 'tailwindcss';
    @theme {
      --color-primary: oklch(0.6 0.15 150);
    }

package/.agent/skills/apple-design/SKILL.md

@@ -20,6 +20,7 @@ scripts-binding:
 ## Mandatory Pre-Flight Context Inspection
 
 Before engineering Apple-style UIs or gesture-driven components, you MUST inspect:
+
 1. Interruptible Physics-Based Springs (Section 22) → Use physics springs (`stiffness: 300, damping: 24, mass: 0.8`) instead of fixed-duration CSS cubic-beziers
 2. Translucent Backdrop Blur (Section 44) → Limit `backdrop-filter: blur(20px) saturate(180%)` strictly to sticky headers or modals to avoid GPU scroll jank
 3. Optical Letter-Spacing (Section 72) → Apply inverse tracking (`-0.025em` for titles, `+0.015em` for small captions) based on SF Pro font scaling
@@ -41,10 +42,10 @@ Apple interfaces do NOT use fixed-duration cubic-beziers for interactive element
 ```javascript
 // Framer Motion / Motion React Spring Config
 const appleSpring = {
-  type: "spring",
+  type: 'spring',
   stiffness: 300,
   damping: 24,
-  mass: 0.8
+  mass: 0.8,
 };
 ```
 
@@ -87,11 +88,11 @@ Apple depth relies on subtle, multi-layered backdrop blur and border highlights:
 
 ## Anti-Slop Table
 
-| Anti-Pattern | Apple Design Solution | Rationale |
-| --- | --- | --- |
-| Rigid linear/ease transitions | Physics-based spring curves (`stiffness: 300, damping: 24`) | Simulates real-world physical momentum |
-| Opaque static dropdowns | Translucent backdrop blur panel (`blur(20px) saturate(180%)`) | Preserves spatial context beneath UI |
-| Sudden state jumps | Interruptible velocity-preserving spring animations | Prevents visual jarring during rapid user input |
+| Anti-Pattern                  | Apple Design Solution                                         | Rationale                                       |
+| ----------------------------- | ------------------------------------------------------------- | ----------------------------------------------- |
+| Rigid linear/ease transitions | Physics-based spring curves (`stiffness: 300, damping: 24`)   | Simulates real-world physical momentum          |
+| Opaque static dropdowns       | Translucent backdrop blur panel (`blur(20px) saturate(180%)`) | Preserves spatial context beneath UI            |
+| Sudden state jumps            | Interruptible velocity-preserving spring animations           | Prevents visual jarring during rapid user input |
 
 ---
 

package/.agent/skills/architecture/SKILL.md

@@ -20,6 +20,7 @@ scripts-binding:
 ## Mandatory Pre-Flight Context Inspection
 
 Before selecting architectural patterns or designing systems, you MUST inspect:
+
 1. Pragmatic Monolith Default (Section 31) → Start with a modular monolith for teams <5 or scale <100K RPM; ban premature microservices
 2. Clean Architecture Dependency Direction (Section 50) → Ensure dependency arrows point strictly inward to Domain; Domain must have zero external infrastructure dependencies
 3. ADR Requirement for Non-Trivial Decisons (Section 135) → Document every major architectural decision with an ADR in `docs/architecture/`
@@ -72,7 +73,7 @@ interface UserRepository {
 }
 class User {
   promote(): void {
-    if (this._role === UserRole.ADMIN) throw new DomainError("Already admin");
+    if (this._role === UserRole.ADMIN) throw new DomainError('Already admin');
     this._role = UserRole.ADMIN;
   }
 }
@@ -81,7 +82,7 @@ class User {
 class PromoteUserUseCase {
   async execute(userId: string): Promise<void> {
     const user = await this.userRepo.findById(userId);
-    if (!user) throw new NotFoundError("User", userId);
+    if (!user) throw new NotFoundError('User', userId);
     user.promote();
     await this.userRepo.save(user);
     await this.eventBus.publish(new UserPromotedEvent(userId));

package/.agent/skills/audit-and-fix/SKILL.md

@@ -20,6 +20,7 @@ scripts-binding:
 ## Mandatory Pre-Flight Context Inspection
 
 Before performing accessibility audits or fixes, you MUST inspect:
+
 1. Automated Violation Detection (Section 24) → Audit markup for missing `alt`, un-labeled inputs/buttons, and `onClick` on non-interactive elements
 2. Prioritization Matrix (Section 31) → Fix Level A blockers (forms, focus traps, keyboard access) before addressing contrast or landmark regions
 3. Anti-Redundant ARIA rule (Section 60) → Do NOT add `role="button"` to native `<button>` tags; apply `aria-hidden="true"` to decorative inner SVGs
@@ -31,7 +32,9 @@ Systematically audit HTML/JSX markup against WCAG 2.2 AA standards, prioritize a
 ## 4-Step Remediation Pipeline
 
 ### 1. Automated Violation Detection
+
 Scan component code for:
+
 - Missing `alt` tags on `<img>` elements.
 - Form controls (`<input>`, `<select>`) missing associated `<label>` or `aria-label`.
 - Buttons with icon-only content missing `aria-label`.
@@ -39,11 +42,11 @@ Scan component code for:
 
 ### 2. Prioritization Matrix
 
-| Severity Level | Violation Type | Remediation Action |
-| --- | --- | --- |
-| 🔴 **Blocker (Level A)** | Inaccessible form inputs, un-trapped focus in modal, zero keyboard access | Add explicit `<label>`, focus trap, and keyboard handlers immediately. |
-| 🟠 **Critical (Level AA)** | Low text contrast ratio ($< 4.5:1$), missing ARIA states on custom dropdowns | Adjust text colors to OKLCH contrast targets; add `aria-expanded`. |
-| 🟡 **Moderate (Level AA)** | Missing landmark regions (`<main>`, `<nav>`, `<header>`), heading hierarchy gaps | Wrap layout blocks in semantic HTML5 tags. |
+| Severity Level             | Violation Type                                                                   | Remediation Action                                                     |
+| -------------------------- | -------------------------------------------------------------------------------- | ---------------------------------------------------------------------- |
+| 🔴 **Blocker (Level A)**   | Inaccessible form inputs, un-trapped focus in modal, zero keyboard access        | Add explicit `<label>`, focus trap, and keyboard handlers immediately. |
+| 🟠 **Critical (Level AA)** | Low text contrast ratio ($< 4.5:1$), missing ARIA states on custom dropdowns     | Adjust text colors to OKLCH contrast targets; add `aria-expanded`.     |
+| 🟡 **Moderate (Level AA)** | Missing landmark regions (`<main>`, `<nav>`, `<header>`), heading hierarchy gaps | Wrap layout blocks in semantic HTML5 tags.                             |
 
 ### 3. Concrete Code Fix Examples
 

package/.agent/skills/authentication-best-practices/SKILL.md

@@ -20,6 +20,7 @@ scripts-binding:
 ## Mandatory Pre-Flight Context Inspection
 
 Before implementing authentication or session flows, you MUST inspect:
+
 1. Modern Password Hashing (Section 28) → Use Argon2id or bcrypt; ban legacy fast algorithms (`md5`, `sha256`) for credential hashing
 2. Token Storage Separation (Section 83) → Keep short-lived access tokens in JS memory and long-lived refresh tokens in `HttpOnly`, `SameSite=Lax/Strict` cookies
 3. OAuth PKCE Flow Requirement (Section 109) → Enforce Authorization Code Flow with PKCE for all single-page and mobile apps; ban deprecated Implicit Flow
@@ -32,10 +33,10 @@ Before implementing authentication or session flows, you MUST inspect:
 
 ```typescript
 // ❌ BAD: md5, sha1, sha256 (too fast, vulnerable to brute force/rainbow tables)
-const hash = crypto.createHash("sha256").update(password).digest("hex");
+const hash = crypto.createHash('sha256').update(password).digest('hex');
 
 // ✅ GOOD: Argon2 (memory-hard, ASIC resistant) or bcrypt
-import * as argon2 from "argon2";
+import * as argon2 from 'argon2';
 
 async function hashPassword(password: string): Promise<string> {
   // Argon2 hashes include the salt inherently in the resulting string
@@ -86,11 +87,11 @@ async function verifyPassword(hash: string, password: string): Promise<boolean>
 // Scenario: API authentication
 // 1. Access Token (Short-lived: 15 mins)
 const accessToken = jwt.sign({ userId: user.id }, JWT_SECRET, {
-  expiresIn: "15m",
-  algorithm: "HS256", // ALWAYS explicitly specify
+  expiresIn: '15m',
+  algorithm: 'HS256', // ALWAYS explicitly specify
 });
 // 2. Refresh Token (Long-lived: 7 days, opaque string in DB)
-const refreshToken = crypto.randomBytes(40).toString("hex");
+const refreshToken = crypto.randomBytes(40).toString('hex');
 await db.refreshTokens.create({ token: refreshToken, userId: user.id, expires: addDays(7) });
 
 // Client flow:
@@ -142,7 +143,7 @@ Flow (Authorization Code + PKCE):
 
 ```typescript
 // ✅ Check permissions, not roles directly (more flexible)
-if (!user.permissions.includes("delete:user")) {
+if (!user.permissions.includes('delete:user')) {
   throw new ForbiddenError();
 }
 ```
@@ -154,9 +155,9 @@ if (!user.permissions.includes("delete:user")) {
 ```typescript
 // Example Policy
 function canEditPost(user: User, post: Post): boolean {
-  if (user.role === "admin") return true;
+  if (user.role === 'admin') return true;
   if (post.authorId === user.id) return true;
-  if (post.status === "draft" && user.department === "content") return true;
+  if (post.status === 'draft' && user.department === 'content') return true;
   return false;
 }
 ```

package/.agent/skills/backend-security-expert/SKILL.md

@@ -20,6 +20,7 @@ scripts-binding:
 ## Mandatory Pre-Flight Context Inspection
 
 Before auditing or writing backend server code, you MUST inspect:
+
 1. Server Action Endpoints (Section 26) → Treat Next.js Server Actions as public API routes: authenticate session and parse input with Zod at entry
 2. JWT Algorithm Verification (Section 17) → Enforce explicit algorithms (`alg: "HS256"`) when verifying JWT tokens to prevent "None" algorithm exploits
 3. IDOR & RBAC Validation (Section 34) → Verify resource ownership (`WHERE userId = session.userId`) and user roles before executing mutations

package/.agent/skills/baseline-ui/SKILL.md

@@ -20,6 +20,7 @@ scripts-binding:
 ## Mandatory Pre-Flight Context Inspection
 
 Before cleaning up UI styles, you MUST inspect:
+
 1. `DESIGN.md` / `package.json` → Check Tailwind CSS configuration and accessibility primitives (`Base UI`, `Radix`)
 2. The 5-Step Deslop Protocol (Section 33) → Fix spacing violations, establish 3-tier typographic hierarchy, and eliminate harsh borders
 3. Anti-Slop Table (Section 43) → Replace hardcoded arbitrary paddings and low-contrast text with tokenized CSS variables
@@ -51,13 +52,13 @@ Enforces an opinionated UI baseline to clean up sloppy code and prevent AI-gener
 
 ## Anti-Slop Table
 
-| Slop Pattern | Baseline Fix | Rationale |
-| --- | --- | --- |
-| `color: #888` on dark background | `color: var(--text-muted)` (min 4.5:1 ratio) | Improves readability and WCAG compliance |
-| `padding: 15px 23px` | `padding: 16px 24px` | Aligns to 8px structural grid |
-| `border: 1px solid black` | `border: 1px solid rgba(0,0,0,0.1)` | Removes harsh, distracting lines |
-| Mixed font sizes (13px, 14px, 15px) | Standardized scale (12px, 14px, 16px) | Establishes clear visual hierarchy |
-| Plain text buttons without states | Rounded button with hover/active press feedback | Indicates clickability and tactile response |
+| Slop Pattern                        | Baseline Fix                                    | Rationale                                   |
+| ----------------------------------- | ----------------------------------------------- | ------------------------------------------- |
+| `color: #888` on dark background    | `color: var(--text-muted)` (min 4.5:1 ratio)    | Improves readability and WCAG compliance    |
+| `padding: 15px 23px`                | `padding: 16px 24px`                            | Aligns to 8px structural grid               |
+| `border: 1px solid black`           | `border: 1px solid rgba(0,0,0,0.1)`             | Removes harsh, distracting lines            |
+| Mixed font sizes (13px, 14px, 15px) | Standardized scale (12px, 14px, 16px)           | Establishes clear visual hierarchy          |
+| Plain text buttons without states   | Rounded button with hover/active press feedback | Indicates clickability and tactile response |
 
 ---
 

package/.agent/skills/bash-linux/SKILL.md

@@ -20,6 +20,7 @@ scripts-binding:
 ## Mandatory Pre-Flight Context Inspection
 
 Before writing Bash scripts or terminal automation pipelines, you MUST inspect:
+
 1. Strict Mode Flags (`set -euo pipefail`) (Section 39) → Always set `set -euo pipefail` and `IFS=$'\n\t'` at top of every script to fail fast on errors or unset vars
 2. Variable Quoting Safeguards (Section 122) → Double-quote all path and string variables (`"$FILE"`, `"${FILES[@]}"`) to prevent whitespace expansion bugs
 3. Modern CLI Efficiency Rules (Section 102) → Prefer `rg` over `grep`, `fd` over `find`, `jq` over regex JSON parsing for performance and safety

package/.agent/skills/behavioral-modes/SKILL.md

@@ -20,6 +20,7 @@ scripts-binding:
 ## Mandatory Pre-Flight Context Inspection
 
 Before selecting an operational mode, you MUST inspect:
+
 1. User prompt intent & keywords (Section 148 Mode Selection Rules) → Classify request type (TEACH, DEBUG, REVIEW, PLAN, BUILD, DISCOVER, SHIP, ORCHESTRATE)
 2. Mode Leakage Mitigation rules (Section 160) → Prevent writing unapproved code during DISCOVER or REVIEW modes
 3. Output format contracts → Ensure findings use labeled severity tags (CRITICAL / WARNING / SUGGESTION)

package/.agent/skills/better-colors/SKILL.md

@@ -20,6 +20,7 @@ scripts-binding:
 ## Mandatory Pre-Flight Context Inspection
 
 Before defining color palettes or CSS theme variables, you MUST inspect:
+
 1. `DESIGN.md` / `index.css` → Check existing CSS custom properties and color variables
 2. OKLCH Syntax & Relative Color Rules (Section 30) → Use `oklch(L C H)` format with subtle chroma (`C: 0.01-0.02`) for neutrals
 3. WCAG 2.2 AA Contrast Thresholds (Section 82) → Ensure `L ≤ 45%` for text on light background and `L ≥ 70%` on dark background
@@ -63,7 +64,7 @@ $$\text{Format: } \text{oklch}(L \quad C \quad H [\quad / \quad A])$$
   /* Neutrals: Subtly Tinted (Chroma ~ 0.015) */
   --bg-surface: oklch(0.99 0.005 260);
   --bg-surface-raised: oklch(0.96 0.01 260);
-  --text-main: oklch(0.20 0.02 260);
+  --text-main: oklch(0.2 0.02 260);
   --text-muted: oklch(0.45 0.02 260);
   --border-subtle: oklch(0.88 0.015 260);
 }
@@ -72,7 +73,7 @@ $$\text{Format: } \text{oklch}(L \quad C \quad H [\quad / \quad A])$$
 :root {
   color-scheme: light dark;
   --surface-adaptive: light-dark(oklch(0.99 0.005 260), oklch(0.14 0.015 260));
-  --text-adaptive: light-dark(oklch(0.20 0.02 260), oklch(0.96 0.01 260));
+  --text-adaptive: light-dark(oklch(0.2 0.02 260), oklch(0.96 0.01 260));
 }
 
 @media (prefers-color-scheme: dark) {
@@ -91,12 +92,15 @@ $$\text{Format: } \text{oklch}(L \quad C \quad H [\quad / \quad A])$$
 ## 3. WCAG 2.2 AA Contrast Standards
 
 Always verify contrast using WCAG AA minimum thresholds:
+
 - **Normal Text (< 18pt / < 24px)**: Minimum **4.5:1** contrast ratio.
 - **Large Text (≥ 18pt / ≥ 24px bold)**: Minimum **3.0:1** contrast ratio.
 - **UI Components & Icons**: Minimum **3.0:1** contrast ratio against adjacent surface.
 
 ### Rule of Thumb in OKLCH:
+
 To achieve 4.5:1 text contrast against a surface:
+
 - Against Light Surface (`L ≈ 98%`): Text lightness `L` MUST be **`≤ 45%`**.
 - Against Dark Surface (`L ≈ 14%`): Text lightness `L` MUST be **`≥ 70%`**.
 
@@ -111,11 +115,11 @@ To achieve 4.5:1 text contrast against a surface:
 
 ## Anti-Slop Table
 
-| Anti-Pattern | OKLCH Solution | Rationale |
-| --- | --- | --- |
-| Single gray for all backgrounds | Neutral tinted with brand hue (`C: 0.01-0.02`) | Creates cohesive, harmonious UI surfaces |
-| Over-saturated dark mode accents | Scale chroma down (`C: 0.22` → `C: 0.15`) in dark mode | Eliminates glowing text vibration & visual strain |
-| Harsh pure black borders (`#000`) | Alpha-tinted borders (`rgba(255,255,255,0.08)`) | Smooths elevation layers |
+| Anti-Pattern                      | OKLCH Solution                                         | Rationale                                         |
+| --------------------------------- | ------------------------------------------------------ | ------------------------------------------------- |
+| Single gray for all backgrounds   | Neutral tinted with brand hue (`C: 0.01-0.02`)         | Creates cohesive, harmonious UI surfaces          |
+| Over-saturated dark mode accents  | Scale chroma down (`C: 0.22` → `C: 0.15`) in dark mode | Eliminates glowing text vibration & visual strain |
+| Harsh pure black borders (`#000`) | Alpha-tinted borders (`rgba(255,255,255,0.08)`)        | Smooths elevation layers                          |
 
 ---
 

package/.agent/skills/better-typography/SKILL.md

@@ -9,7 +9,17 @@ routing:
   tier: pro
   co-requires: [typeset, better-ui]
   trigger-signals:
-    strong: [better-typography, typography, type scale, font pairing, tabular numbers, text-wrap balance, line-length, optical sizing]
+    strong:
+      [
+        better-typography,
+        typography,
+        type scale,
+        font pairing,
+        tabular numbers,
+        text-wrap balance,
+        line-length,
+        optical sizing,
+      ]
     weak: [fonts, text style, line height]
 ---
 
@@ -25,14 +35,14 @@ Scale font sizes using a consistent multiplier ($1.25$ Major Third or $1.20$ Min
 
 ```css
 :root {
-  --font-size-xs: 0.75rem;    /* 12px - Labels, Badges */
-  --font-size-sm: 0.875rem;   /* 14px - Meta, Caption */
-  --font-size-base: 1rem;     /* 16px - Body Text */
-  --font-size-lg: 1.125rem;   /* 18px - Lead Body */
-  --font-size-xl: 1.375rem;   /* 22px - Subheadings */
-  --font-size-2xl: 1.75rem;   /* 28px - H3 */
-  --font-size-3xl: 2.25rem;   /* 36px - H2 */
-  --font-size-4xl: 3rem;      /* 48px - H1 Hero */
+  --font-size-xs: 0.75rem; /* 12px - Labels, Badges */
+  --font-size-sm: 0.875rem; /* 14px - Meta, Caption */
+  --font-size-base: 1rem; /* 16px - Body Text */
+  --font-size-lg: 1.125rem; /* 18px - Lead Body */
+  --font-size-xl: 1.375rem; /* 22px - Subheadings */
+  --font-size-2xl: 1.75rem; /* 28px - H3 */
+  --font-size-3xl: 2.25rem; /* 36px - H2 */
+  --font-size-4xl: 3rem; /* 48px - H1 Hero */
 
   /* Line Heights proportional to font size */
   --line-height-heading: 1.15;
@@ -50,7 +60,10 @@ Scale font sizes using a consistent multiplier ($1.25$ Major Third or $1.20$ Min
 - **Paragraph Wrapping**: Use `text-wrap: pretty` for long body paragraphs to prevent awkward line breaks.
 
 ```css
-h1, h2, h3, h4 {
+h1,
+h2,
+h3,
+h4 {
   text-wrap: balance;
   letter-spacing: -0.025em;
   line-height: var(--line-height-heading);
@@ -69,6 +82,7 @@ p {
 
 - **Tabular Numbers for Data & Timers**: Use `font-variant-numeric: tabular-nums` (or `tnum`) for data tables, counters, prices, and timestamps so numbers align vertically without jumping when values update.
 - **Font Smoothing**: Enable crisp font smoothing on macOS/iOS:
+
 ```css
 body {
   -webkit-font-smoothing: antialiased;
@@ -80,12 +94,12 @@ body {
 
 ## Anti-Slop Table
 
-| Anti-Pattern | Typography Solution | Rationale |
-| --- | --- | --- |
-| Full-width body text (`width: 100%`) | `max-width: 65ch` | Prevents eye fatigue across wide desktop screens |
-| Single-word widows on headings | `text-wrap: balance` | Creates balanced visual hierarchy |
-| Jittering numbers in data tables | `font-variant-numeric: tabular-nums` | Keeps columns strictly aligned |
-| Default browser line-height (`1.2` on body) | `line-height: 1.5` | Improves reading comfort |
+| Anti-Pattern                                | Typography Solution                  | Rationale                                        |
+| ------------------------------------------- | ------------------------------------ | ------------------------------------------------ |
+| Full-width body text (`width: 100%`)        | `max-width: 65ch`                    | Prevents eye fatigue across wide desktop screens |
+| Single-word widows on headings              | `text-wrap: balance`                 | Creates balanced visual hierarchy                |
+| Jittering numbers in data tables            | `font-variant-numeric: tabular-nums` | Keeps columns strictly aligned                   |
+| Default browser line-height (`1.2` on body) | `line-height: 1.5`                   | Improves reading comfort                         |
 
 ---