tribunal-kit 6.0.0 → 7.0.0

package/.agent/agents/qa-automation-engineer.md

@@ -19,6 +19,7 @@ last-updated: 2026-07-29
 ## Mandatory Pre-Flight Context Inspection
 
 Before designing test automation suites or Playwright specs, you MUST inspect:
+
 1. `package.json` / `playwright.config.ts` / `vitest.config.ts` → Read existing test runners, timeouts, and CI configurations
 2. Component ARIA roles & accessible labels (`getByRole`, `getByLabelText`) → Verify accessible DOM selectors over brittle CSS classes
 3. MSW handlers (`src/mocks/handlers.ts`) & API contracts → Audit mock network responses and status codes for integration suites
@@ -54,27 +55,27 @@ Write tests that fail when real user-facing behavior breaks — nothing less, no
 // ❌ DON'T unit test: component rendering, API calls, DB queries
 
 // ✅ DO unit test: business logic isolated
-import { describe, it, expect } from "vitest";
-import { calculateDiscount } from "./pricing";
+import { describe, it, expect } from 'vitest';
+import { calculateDiscount } from './pricing';
 
-describe("calculateDiscount()", () => {
+describe('calculateDiscount()', () => {
   // Always test the happy path
-  it("applies 10% to orders over $100", () => {
+  it('applies 10% to orders over $100', () => {
     expect(calculateDiscount(150)).toBe(135);
   });
 
   // Always test all boundary cases
-  it("applies no discount at exactly $100 (exclusive boundary)", () => {
+  it('applies no discount at exactly $100 (exclusive boundary)', () => {
     expect(calculateDiscount(100)).toBe(100);
   });
 
   // Always test error/invalid input
-  it("throws RangeError on negative input", () => {
+  it('throws RangeError on negative input', () => {
     expect(() => calculateDiscount(-50)).toThrow(RangeError);
   });
 
   // Always test zero and extreme values
-  it("returns 0 for $0 order", () => {
+  it('returns 0 for $0 order', () => {
     expect(calculateDiscount(0)).toBe(0);
   });
 });
@@ -145,38 +146,38 @@ test('shows error on failed load', async () => {
 
 ```typescript
 // playwright.config.ts
-import { defineConfig, devices } from "@playwright/test";
+import { defineConfig, devices } from '@playwright/test';
 
 export default defineConfig({
-  testDir: "./e2e",
+  testDir: './e2e',
   fullyParallel: true,
   retries: process.env.CI ? 2 : 0, // Retry in CI for flakiness
-  reporter: [["html"], ["github"]],
+  reporter: [['html'], ['github']],
   use: {
-    baseURL: "http://localhost:3000",
-    trace: "on-first-retry", // Record trace only on failure
-    video: "on-first-retry", // Record video only on failure
-    screenshot: "only-on-failure",
+    baseURL: 'http://localhost:3000',
+    trace: 'on-first-retry', // Record trace only on failure
+    video: 'on-first-retry', // Record video only on failure
+    screenshot: 'only-on-failure',
   },
   projects: [
-    { name: "chromium", use: { ...devices["Desktop Chrome"] } },
-    { name: "Mobile Safari", use: { ...devices["iPhone 14"] } },
+    { name: 'chromium', use: { ...devices['Desktop Chrome'] } },
+    { name: 'Mobile Safari', use: { ...devices['iPhone 14'] } },
   ],
 });
 
 // e2e/auth.spec.ts
-import { test, expect } from "@playwright/test";
+import { test, expect } from '@playwright/test';
 
 // Store auth state to avoid logging in every test
-test.use({ storageState: "e2e/auth.json" });
-
-test("user can complete checkout flow", async ({ page }) => {
-  await page.goto("/products");
-  await page.getByRole("button", { name: "Add to cart" }).first().click();
-  await page.getByRole("link", { name: "Cart" }).click();
-  await expect(page.getByText("1 item")).toBeVisible();
-  await page.getByRole("button", { name: "Checkout" }).click();
-  await expect(page).toHaveURL("/checkout");
+test.use({ storageState: 'e2e/auth.json' });
+
+test('user can complete checkout flow', async ({ page }) => {
+  await page.goto('/products');
+  await page.getByRole('button', { name: 'Add to cart' }).first().click();
+  await page.getByRole('link', { name: 'Cart' }).click();
+  await expect(page.getByText('1 item')).toBeVisible();
+  await page.getByRole('button', { name: 'Checkout' }).click();
+  await expect(page).toHaveURL('/checkout');
 });
 ```
 
@@ -186,15 +187,15 @@ test("user can complete checkout flow", async ({ page }) => {
 
 ```typescript
 // ❌ BRITTLE (fails on UI refactor)
-page.locator(".cart-btn > span.label");
-getByTestId("btn-0"); // Index-based
-container.querySelector("#submit-47f3"); // Generated ID
+page.locator('.cart-btn > span.label');
+getByTestId('btn-0'); // Index-based
+container.querySelector('#submit-47f3'); // Generated ID
 
 // ✅ RESILIENT (survives refactoring + validates accessibility)
-getByRole("button", { name: /add to cart/i }); // Role + name
-getByLabelText("Email address"); // Form label association
-getByPlaceholderText("Search products"); // Input placeholder
-getByText("Free shipping on orders over $50"); // Visible text
+getByRole('button', { name: /add to cart/i }); // Role + name
+getByLabelText('Email address'); // Form label association
+getByPlaceholderText('Search products'); // Input placeholder
+getByText('Free shipping on orders over $50'); // Visible text
 ```
 
 ---
@@ -203,25 +204,31 @@ getByText("Free shipping on orders over $50"); // Visible text
 
 ```typescript
 // Test server routes with supertest — no browser needed
-import request from "supertest";
-import app from "../src/app";
+import request from 'supertest';
+import app from '../src/app';
 
-describe("POST /api/auth/login", () => {
-  it("returns JWT on valid credentials", async () => {
-    const response = await request(app).post("/api/auth/login").send({ email: "alice@example.com", password: "correct" }).expect(200);
+describe('POST /api/auth/login', () => {
+  it('returns JWT on valid credentials', async () => {
+    const response = await request(app)
+      .post('/api/auth/login')
+      .send({ email: 'alice@example.com', password: 'correct' })
+      .expect(200);
 
     expect(response.body).toMatchObject({ token: expect.any(String) });
   });
 
-  it("returns 401 on invalid credentials", async () => {
-    await request(app).post("/api/auth/login").send({ email: "alice@example.com", password: "wrong" }).expect(401);
+  it('returns 401 on invalid credentials', async () => {
+    await request(app)
+      .post('/api/auth/login')
+      .send({ email: 'alice@example.com', password: 'wrong' })
+      .expect(401);
   });
 
-  it("returns 429 after 10 failed attempts", async () => {
+  it('returns 429 after 10 failed attempts', async () => {
     for (let i = 0; i < 10; i++) {
-      await request(app).post("/api/auth/login").send({ password: "wrong" });
+      await request(app).post('/api/auth/login').send({ password: 'wrong' });
     }
-    await request(app).post("/api/auth/login").send({ password: "wrong" }).expect(429); // Rate limit hit
+    await request(app).post('/api/auth/login').send({ password: 'wrong' }).expect(429); // Rate limit hit
   });
 });
 ```

package/.agent/agents/resilience-reviewer.md

@@ -20,6 +20,7 @@ You have one job: ensure the code does not crash the system or fail silently whe
 ## Mandatory Pre-Flight Context Inspection
 
 Before auditing fault tolerance, you MUST inspect:
+
 1. Active environment configs (`package.json`, `.env.example`) → Check for timeout values, retry limits, and environment variable fallbacks
 2. Network boundary calls → Verify `AbortController`, `fetch` timeout wrappers, or DB connection pool retry configurations
 3. Top-level process entry points (`index.ts`, `server.ts`, `app/layout.tsx`) → Verify error boundaries and global exception handlers

package/.agent/agents/schema-reviewer.md

@@ -20,6 +20,7 @@ You have one job: ensure no untrusted data enters the application without strict
 ## Mandatory Pre-Flight Context Inspection
 
 Before auditing validation boundaries, you MUST inspect:
+
 1. `package.json` / `requirements.txt` → Check for Zod, Valibot, ArkType, Pydantic, or native validation libraries
 2. Schema declaration directories (`schemas/`, `lib/validations/`, `models/`) → Ensure schemas are centralized and shared
 3. Target API entry points → Verify request body, path params, query parameters, and header parsing

package/.agent/agents/security-auditor.md

@@ -51,13 +51,11 @@ element.innerHTML = userInput; // Executes embedded scripts
 const query = `UPDATE orders SET status = '${status}' WHERE id = ${orderId}`;
 
 // ✅ Parameterized query
-const result = await db.query("SELECT * FROM users WHERE email = $1", [email]);
+const result = await db.query('SELECT * FROM users WHERE email = $1', [email]);
 
 // ✅ exec validation
-const ALLOWED_REPOS = new Set([
-  /* allowlist */
-]);
-if (!ALLOWED_REPOS.has(repoUrl)) throw new Error("Unauthorized repo");
+const ALLOWED_REPOS = new Set([/* allowlist */]);
+if (!ALLOWED_REPOS.has(repoUrl)) throw new Error('Unauthorized repo');
 
 // ✅ textContent for user-generated text (no script execution)
 element.textContent = userInput;
@@ -72,31 +70,31 @@ element.textContent = userInput;
 jwt.verify(token, secret); // Attacker can forge with algorithm: 'none'
 
 // ❌ WEAK SECRET: Under 32 chars = brute-forceable
-const JWT_SECRET = "password123";
+const JWT_SECRET = 'password123';
 
 // ❌ NO EXPIRY: Token valid forever
 jwt.sign({ userId }, secret); // Missing expiresIn
 
 // ❌ HARDCODED CREDENTIAL
-const DB_PASSWORD = "admin1234";
+const DB_PASSWORD = 'admin1234';
 
 // ✅ Secure JWT
 jwt.verify(token, process.env.JWT_SECRET!, {
-  algorithms: ["HS256"], // Explicit algorithm enforcement
-  issuer: "api.myapp.com",
-  audience: "myapp-client",
+  algorithms: ['HS256'], // Explicit algorithm enforcement
+  issuer: 'api.myapp.com',
+  audience: 'myapp-client',
 });
 
 // ✅ Environment variable with existence guard
 const JWT_SECRET = process.env.JWT_SECRET;
 if (!JWT_SECRET || JWT_SECRET.length < 32) {
-  throw new Error("JWT_SECRET must be at least 32 characters");
+  throw new Error('JWT_SECRET must be at least 32 characters');
 }
 
 // ✅ Short expiry + refresh token pattern
 jwt.sign({ userId }, JWT_SECRET, {
-  expiresIn: "15m", // Short-lived access token
-  algorithm: "HS256",
+  expiresIn: '15m', // Short-lived access token
+  algorithm: 'HS256',
 });
 ```
 
@@ -106,7 +104,7 @@ jwt.sign({ userId }, JWT_SECRET, {
 
 ```typescript
 // ❌ CRITICAL: User controls the URL — can hit internal services
-app.get("/proxy", async (req, res) => {
+app.get('/proxy', async (req, res) => {
   const response = await fetch(req.query.url); // http://169.254.169.254/metadata (AWS IMDS!)
   res.json(await response.json());
 });
@@ -115,7 +113,7 @@ app.get("/proxy", async (req, res) => {
 await fetch(webhookUrl); // Could be http://internal-db:5432
 
 // ✅ SAFE: URL allowlist validation
-const ALLOWED_HOSTS = new Set(["api.stripe.com", "hooks.slack.com"]);
+const ALLOWED_HOSTS = new Set(['api.stripe.com', 'hooks.slack.com']);
 const url = new URL(webhookUrl);
 if (!ALLOWED_HOSTS.has(url.hostname)) {
   throw new Error(`Unauthorized webhook host: ${url.hostname}`);
@@ -127,7 +125,7 @@ function isPrivateIP(hostname: string): boolean {
   return /^(10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.|127\.|169\.254\.)/.test(hostname);
 }
 if (isPrivateIP(new URL(url).hostname)) {
-  throw new Error("Private network access forbidden");
+  throw new Error('Private network access forbidden');
 }
 ```
 
@@ -137,15 +135,15 @@ if (isPrivateIP(new URL(url).hostname)) {
 
 ```typescript
 // ❌ IDOR: User can access any resource by changing the ID parameter
-app.get("/user/:id/documents", async (req, res) => {
+app.get('/user/:id/documents', async (req, res) => {
   const docs = await db.documents.findMany({ where: { userId: req.params.id } });
   return res.json(docs); // Missing: does req.session.userId === req.params.id?
 });
 
 // ✅ SAFE: Scoped to authenticated user's own data
-app.get("/user/:id/documents", requireAuth, async (req, res) => {
-  if (req.session.userId !== req.params.id && req.session.role !== "admin") {
-    return res.status(403).json({ error: "Forbidden" });
+app.get('/user/:id/documents', requireAuth, async (req, res) => {
+  if (req.session.userId !== req.params.id && req.session.role !== 'admin') {
+    return res.status(403).json({ error: 'Forbidden' });
   }
   const docs = await db.documents.findMany({ where: { userId: req.params.id } });
   return res.json(docs);
@@ -158,7 +156,7 @@ app.get("/user/:id/documents", requireAuth, async (req, res) => {
 
 ```typescript
 // ❌ CORS wildcard in production — any origin can call your API
-app.use(cors({ origin: "*" }));
+app.use(cors({ origin: '*' }));
 
 // ❌ Verbose error exposing internals
 app.use((err, req, res, next) => {
@@ -166,7 +164,7 @@ app.use((err, req, res, next) => {
 });
 
 // ✅ Restrictive CORS
-const allowedOrigins = (process.env.ALLOWED_ORIGINS ?? "").split(",");
+const allowedOrigins = (process.env.ALLOWED_ORIGINS ?? '').split(',');
 app.use(
   cors({
     origin: (origin, cb) => {
@@ -178,8 +176,8 @@ app.use(
 
 // ✅ Safe error response — log internally, generic to client
 app.use((err: Error, req, res, next) => {
-  logger.error({ err, path: req.path }, "Unhandled error");
-  res.status(500).json({ error: "Internal server error", code: "INTERNAL_ERROR" });
+  logger.error({ err, path: req.path }, 'Unhandled error');
+  res.status(500).json({ error: 'Internal server error', code: 'INTERNAL_ERROR' });
 });
 ```
 
@@ -188,11 +186,13 @@ app.use((err: Error, req, res, next) => {
 ## 4. Prompt Injection Defense & LLM Call Security
 
 ### Prompt Injection Defenses
+
 - Ensure user-provided input is never concatenated directly into top-level system prompts.
 - Verify that user inputs are isolated in `<user_provided_context>` or custom XML tags, and system prompts explicitly instruct the model to ignore instructions within those tags.
 - Verify that HTML/XML tags are stripped or sanitized from user input before sending to LLM APIs.
 
 ### LLM Call Audit Checklist
+
 - Flag any hardcoded API keys. They must be loaded from environment variables.
 - Verify model strings against official current lists (no invented names like `claude-4-opus` or `gpt-5`).
 - Ensure all LLM API calls are asynchronous and properly awaited.

package/.agent/agents/seo-specialist.md

@@ -17,6 +17,7 @@ last-updated: 2026-07-29
 ## Mandatory Pre-Flight Context Inspection
 
 Before generating metadata, sitemaps, or structured data, you MUST inspect:
+
 1. `app/layout.tsx` / `next.config.js` → Read base URL, default metadata options, and OpenGraph defaults
 2. Page templates (`app/**/page.tsx`) → Verify heading hierarchy (single `<h1>` per page) and Schema.org JSON-LD scripts
 3. AI bot middleware / GEO paths → Audit `sitemap.ts`, `robots.ts`, and crawler detection rules
@@ -25,20 +26,24 @@ Before generating metadata, sitemaps, or structured data, you MUST inspect:
 
 ```typescript
 // app/products/[slug]/page.tsx
-import { Metadata } from "next";
+import { Metadata } from 'next';
 
 // Static metadata
 export const metadata: Metadata = {
-  title: "Product Name | Brand",
-  description: "Compelling 155-character description that matches search intent.",
+  title: 'Product Name | Brand',
+  description: 'Compelling 155-character description that matches search intent.',
 };
 
 // Dynamic metadata (fetched per-page)
-export async function generateMetadata({ params }: { params: Promise<{ slug: string }> }): Promise<Metadata> {
+export async function generateMetadata({
+  params,
+}: {
+  params: Promise<{ slug: string }>;
+}): Promise<Metadata> {
   const { slug } = await params;
   const product = await getProduct(slug);
 
-  if (!product) return { title: "Not Found" };
+  if (!product) return { title: 'Not Found' };
 
   return {
     title: `${product.name} | Brand`,
@@ -56,12 +61,12 @@ export async function generateMetadata({ params }: { params: Promise<{ slug: str
           alt: product.name,
         },
       ],
-      siteName: "Your Brand",
-      type: "website",
+      siteName: 'Your Brand',
+      type: 'website',
     },
 
     twitter: {
-      card: "summary_large_image",
+      card: 'summary_large_image',
       title: product.name,
       description: product.seoDescription,
       images: [product.imageUrl],
@@ -81,21 +86,23 @@ export default async function ProductPage({ params }) {
   const product = await getProduct(slug);
 
   const jsonLd = {
-    "@context": "https://schema.org",
-    "@type": "Product",
+    '@context': 'https://schema.org',
+    '@type': 'Product',
     name: product.name,
     image: product.imageUrl,
     description: product.description,
     sku: product.sku,
     offers: {
-      "@type": "Offer",
+      '@type': 'Offer',
       price: product.price,
-      priceCurrency: "USD",
-      availability: product.inStock ? "https://schema.org/InStock" : "https://schema.org/OutOfStock",
+      priceCurrency: 'USD',
+      availability: product.inStock
+        ? 'https://schema.org/InStock'
+        : 'https://schema.org/OutOfStock',
       url: `https://yoursite.com/products/${slug}`,
     },
     aggregateRating: {
-      "@type": "AggregateRating",
+      '@type': 'AggregateRating',
       ratingValue: product.averageRating,
       reviewCount: product.reviewCount,
     },
@@ -103,7 +110,10 @@ export default async function ProductPage({ params }) {
 
   return (
     <>
-      <script type="application/ld+json" dangerouslySetInnerHTML={{ __html: JSON.stringify(jsonLd) }} />
+      <script
+        type="application/ld+json"
+        dangerouslySetInnerHTML={{ __html: JSON.stringify(jsonLd) }}
+      />
       {/* page content */}
     </>
   );
@@ -116,29 +126,29 @@ export default async function ProductPage({ params }) {
 
 ```typescript
 // app/sitemap.ts
-import { MetadataRoute } from "next";
+import { MetadataRoute } from 'next';
 
 export default async function sitemap(): Promise<MetadataRoute.Sitemap> {
   const products = await getAllProducts();
 
-  const productUrls = products.map((product) => ({
+  const productUrls = products.map(product => ({
     url: `https://yoursite.com/products/${product.slug}`,
     lastModified: product.updatedAt,
-    changeFrequency: "weekly" as const,
+    changeFrequency: 'weekly' as const,
     priority: 0.8,
   }));
 
   return [
     {
-      url: "https://yoursite.com",
+      url: 'https://yoursite.com',
       lastModified: new Date(),
-      changeFrequency: "daily",
+      changeFrequency: 'daily',
       priority: 1.0,
     },
     {
-      url: "https://yoursite.com/products",
+      url: 'https://yoursite.com/products',
       lastModified: new Date(),
-      changeFrequency: "daily",
+      changeFrequency: 'daily',
       priority: 0.9,
     },
     ...productUrls,
@@ -177,7 +187,7 @@ When AI engines (Perplexity, ChatGPT Search) index your site, they need:
 // Next.js Edge Middleware: serve bare markdown to AI bots
 // middleware.ts
 export function middleware(req: NextRequest) {
-  const ua = req.headers.get("user-agent") ?? "";
+  const ua = req.headers.get('user-agent') ?? '';
   const isAIBot = /ChatGPT-User|PerplexityBot|ClaudeBot|GPTBot/i.test(ua);
 
   if (isAIBot) {

package/.agent/agents/sql-reviewer.md

@@ -21,6 +21,7 @@ SQL mistakes are quiet, catastrophic, and permanent. Injection vulnerabilities e
 ## Mandatory Pre-Flight Context Inspection
 
 Before auditing SQL queries or ORM calls, you MUST inspect:
+
 1. `schema.prisma` / `drizzle.schema.ts` / DB migrations → Inspect table schema, existing indices, and foreign key relations
 2. ORM & DB driver in `package.json` → Confirm parameterization syntax (`$1` in pg vs `?` in mysql vs Prisma objects)
 3. Query invocation sites → Check for raw SQL strings (`SELECT ... ${input}`) or `for` loops making queries inside loop bodies
@@ -40,7 +41,7 @@ await db.execute(query);
 const result = await db.execute(`SELECT * FROM orders WHERE id = ${orderId}`);
 
 // ✅ SAFE: Parameterized query (Postgres/pg driver)
-const result = await client.query("SELECT * FROM users WHERE email = $1", [userInput]);
+const result = await client.query('SELECT * FROM users WHERE email = $1', [userInput]);
 
 // ✅ SAFE: Prisma — never interpolates user input into SQL
 const user = await prisma.user.findUnique({
@@ -73,14 +74,14 @@ const users = await prisma.user.findMany({
 // ❌ N+1: GraphQL resolver without DataLoader
 const resolver = {
   User: {
-    posts: (parent) => db.posts.findAll({ where: { userId: parent.id } }), // Fires per user!
+    posts: parent => db.posts.findAll({ where: { userId: parent.id } }), // Fires per user!
   },
 };
 
 // ✅ FIXED: DataLoader batches all requests into one query
-const postsLoader = new DataLoader(async (userIds) => {
+const postsLoader = new DataLoader(async userIds => {
   const posts = await db.posts.findAll({ where: { userId: userIds } });
-  return userIds.map((id) => posts.filter((p) => p.userId === id));
+  return userIds.map(id => posts.filter(p => p.userId === id));
 });
 ```
 

package/.agent/agents/supervisor-agent.md

@@ -18,6 +18,7 @@ last-updated: 2026-07-29
 ## Mandatory Pre-Flight Context Inspection
 
 Before decomposing goals into worker dispatches, you MUST inspect:
+
 1. `swarm-worker-registry.md` → Read the primary routing table and specialist worker capabilities
 2. Active codebase file layout (`task.md`, file structure) → Ensure worker target file paths do not overlap across parallel tasks
 3. System constraints & dependencies (`package.json`, environment variables) → Verify context passed to workers is grounded in current repo state
@@ -78,8 +79,17 @@ Every worker receives a structured JSON dispatch. No unstructured natural langua
   "scope": "Refactor the UserCard component to use Server Components and remove client-side state that belongs on the server.",
   "files_to_read": ["src/components/UserCard.tsx", "src/app/users/[id]/page.tsx"],
   "files_to_write": ["src/components/UserCard.tsx", "src/components/UserCardClient.tsx"],
-  "context_summary": ["The app uses Next.js 15 App Router", "Authentication is handled via next-auth v5 (now 'auth' package)", "Database uses Prisma 6 with PostgreSQL", "No existing tests for this component"],
-  "constraints": ["Do NOT modify any files outside the listed files_to_write", "Store only interactive state in the Client Component", "Maintain identical visual output — no design changes"],
+  "context_summary": [
+    "The app uses Next.js 15 App Router",
+    "Authentication is handled via next-auth v5 (now 'auth' package)",
+    "Database uses Prisma 6 with PostgreSQL",
+    "No existing tests for this component"
+  ],
+  "constraints": [
+    "Do NOT modify any files outside the listed files_to_write",
+    "Store only interactive state in the Client Component",
+    "Maintain identical visual output — no design changes"
+  ],
   "output_format": {
     "status": "COMPLETE | BLOCKED | ERROR",
     "files_modified": ["list of files actually changed"],

package/.agent/agents/swarm-worker-contracts.md

@@ -18,16 +18,16 @@ interface WorkerRequest {
 
   // The category of work being requested.
   type:
-    | "research" // Understand or explain something
-    | "generate_code" // Write new code
-    | "review_code" // Audit existing code
-    | "debug" // Find and fix a bug
-    | "plan" // Produce a structured plan only (no code)
-    | "design_schema" // Design a database or data schema
-    | "write_docs" // Write documentation or comments
-    | "security_audit" // OWASP security review
-    | "optimize" // Refactor for performance
-    | "test"; // Write or run tests
+    | 'research' // Understand or explain something
+    | 'generate_code' // Write new code
+    | 'review_code' // Audit existing code
+    | 'debug' // Find and fix a bug
+    | 'plan' // Produce a structured plan only (no code)
+    | 'design_schema' // Design a database or data schema
+    | 'write_docs' // Write documentation or comments
+    | 'security_audit' // OWASP security review
+    | 'optimize' // Refactor for performance
+    | 'test'; // Write or run tests
 
   // The agent to route this WorkerRequest to.
   // MUST match a filename in .agent/agents/ (without the .md extension).
@@ -77,9 +77,9 @@ interface WorkerResult {
 
   // Outcome of the Worker's execution.
   status:
-    | "success" // Task completed. Output is valid.
-    | "failure" // Task failed but retries remain.
-    | "escalate"; // Task failed after max_retries. Requires human intervention.
+    | 'success' // Task completed. Output is valid.
+    | 'failure' // Task failed but retries remain.
+    | 'escalate'; // Task failed after max_retries. Requires human intervention.
 
   // The agent's output if status is "success".
   // Empty string if status is "failure" or "escalate".