tribunal-kit 6.0.0 → 7.0.0

package/.agent/agents/swarm-worker-registry.md

@@ -8,35 +8,35 @@ All agents listed here MUST exist as `.md` files in `.agent/agents/`.
 
 ## Primary Routing Table
 
-| Task Type        | Domain Keywords                                  | Route to Agent          |
-| ---------------- | ------------------------------------------------ | ----------------------- |
-| `research`       | any                                              | `explorer-agent`        |
-| `research`       | security, vulnerability, owasp                   | `security-auditor`      |
-| `research`       | database, schema, sql, orm                       | `database-architect`    |
-| `research`       | performance, profiling, optimization             | `performance-optimizer` |
-| `generate_code`  | api, route, endpoint, server, express, auth, jwt | `backend-specialist`    |
-| `generate_code`  | python, fastapi, django, flask                   | `python-pro`            |
-| `generate_code`  | c#, .net, blazor, aspnet                         | `csharp-developer`      |
-| `generate_code`  | component, hook, react, next, ui, css            | `frontend-specialist`   |
-| `generate_code`  | mobile, react native, flutter, ios, android      | `mobile-developer`      |
-| `generate_code`  | docker, ci, cd, deploy, github actions, cloud    | `devops-engineer`       |
-| `generate_code`  | sql, query, migration, prisma, drizzle           | `sql-pro`               |
-| `generate_code`  | vue, nuxt                                        | `vue-expert`            |
-| `review_code`    | api, backend, auth                               | `backend-specialist`    |
-| `review_code`    | react, component, hook                           | `frontend-specialist`   |
-| `review_code`    | sql, query                                       | `sql-pro`               |
-| `review_code`    | security (any domain)                            | `security-auditor`      |
-| `debug`          | any                                              | `debugger`              |
-| `plan`           | any                                              | `project-planner`       |
-| `design_schema`  | any                                              | `database-architect`    |
-| `write_docs`     | any                                              | `documentation-writer`  |
-| `security_audit` | any                                              | `security-auditor`      |
-| `optimize`       | any                                              | `performance-optimizer` |
-| `test`           | any                                              | `test-engineer`         |
-| `visual_audit`   | ui, component, visual, screenshot, layout, render| `ui-visual-auditor`     |
-| `generate_code`  | aws, terraform, ecs, fargate, lambda, iac, vpc   | `cloud-engineer`        |
-| `plan`           | system design, scale, capacity, architecture     | `system-architect`      |
-| `test`           | e2e, playwright, automation, cypress             | `qa-automation-engineer`|
+| Task Type        | Domain Keywords                                   | Route to Agent           |
+| ---------------- | ------------------------------------------------- | ------------------------ |
+| `research`       | any                                               | `explorer-agent`         |
+| `research`       | security, vulnerability, owasp                    | `security-auditor`       |
+| `research`       | database, schema, sql, orm                        | `database-architect`     |
+| `research`       | performance, profiling, optimization              | `performance-optimizer`  |
+| `generate_code`  | api, route, endpoint, server, express, auth, jwt  | `backend-specialist`     |
+| `generate_code`  | python, fastapi, django, flask                    | `python-pro`             |
+| `generate_code`  | c#, .net, blazor, aspnet                          | `csharp-developer`       |
+| `generate_code`  | component, hook, react, next, ui, css             | `frontend-specialist`    |
+| `generate_code`  | mobile, react native, flutter, ios, android       | `mobile-developer`       |
+| `generate_code`  | docker, ci, cd, deploy, github actions, cloud     | `devops-engineer`        |
+| `generate_code`  | sql, query, migration, prisma, drizzle            | `sql-pro`                |
+| `generate_code`  | vue, nuxt                                         | `vue-expert`             |
+| `review_code`    | api, backend, auth                                | `backend-specialist`     |
+| `review_code`    | react, component, hook                            | `frontend-specialist`    |
+| `review_code`    | sql, query                                        | `sql-pro`                |
+| `review_code`    | security (any domain)                             | `security-auditor`       |
+| `debug`          | any                                               | `debugger`               |
+| `plan`           | any                                               | `project-planner`        |
+| `design_schema`  | any                                               | `database-architect`     |
+| `write_docs`     | any                                               | `documentation-writer`   |
+| `security_audit` | any                                               | `security-auditor`       |
+| `optimize`       | any                                               | `performance-optimizer`  |
+| `test`           | any                                               | `test-engineer`          |
+| `visual_audit`   | ui, component, visual, screenshot, layout, render | `ui-visual-auditor`      |
+| `generate_code`  | aws, terraform, ecs, fargate, lambda, iac, vpc    | `cloud-engineer`         |
+| `plan`           | system design, scale, capacity, architecture      | `system-architect`       |
+| `test`           | e2e, playwright, automation, cypress              | `qa-automation-engineer` |
 
 ---
 
@@ -54,28 +54,28 @@ When multiple domain keywords match, apply the following priority order:
 
 Quick reference for Supervisor triage. Full instructions are in each agent's `.md` file.
 
-| Agent File                 | Best For                                         | Do NOT Use For          |
-| -------------------------- | ------------------------------------------------ | ----------------------- |
-| `backend-specialist.md`    | REST APIs, auth flows, server logic              | React components        |
-| `python-pro.md`            | FastAPI, Django, data scripts                    | Node/TypeScript code    |
-| `csharp-developer`         | .NET 8+, C#, Blazor, AOT                         | Python or Node backends |
-| `frontend-specialist.md`   | Web UI, CSS, components                          | Server code             |
-| `react-specialist.md`      | Advanced React patterns, Next.js architecture    | Vue or mobile           |
-| `vue-expert.md`            | Vue 3, Nuxt 3, Pinia                             | React or Angular        |
-| `mobile-developer.md`      | React Native, Flutter                            | Web browser UI          |
-| `database-architect.md`    | Schema design, ORM selection, migrations         | Raw SQL query tuning    |
-| `sql-pro.md`               | Complex queries, CTEs, window functions, indexes | Schema design           |
-| `devops-engineer.md`       | CI/CD, Docker, Kubernetes, cloud infra           | Application code        |
-| `security-auditor.md`      | OWASP review, pen test findings, auth hardening  | Feature development     |
-| `performance-optimizer.md` | Profiling, bottleneck resolution, caching        | New feature design      |
-| `debugger.md`              | Root cause analysis, systematic issue isolation  | Code generation         |
-| `project-planner.md`       | Planning, task breakdown, estimates              | Implementation          |
-| `documentation-writer.md`  | READMEs, API docs, inline comments               | Code or schemas         |
-| `test-engineer.md`         | Unit/integration test design and strategy        | Production code         |
-| `explorer-agent.md`        | Mapping unknown codebases before acting          | Building new features   |
-| `cloud-engineer.md`        | AWS, Terraform, Docker, ECS, GitHub Actions CI   | Application code        |
-| `system-architect.md`      | System design, capacity planning, scalability    | Implementation details  |
-| `qa-automation-engineer.md`| E2E testing, Playwright, test automation          | Unit test design        |
+| Agent File                  | Best For                                         | Do NOT Use For          |
+| --------------------------- | ------------------------------------------------ | ----------------------- |
+| `backend-specialist.md`     | REST APIs, auth flows, server logic              | React components        |
+| `python-pro.md`             | FastAPI, Django, data scripts                    | Node/TypeScript code    |
+| `csharp-developer`          | .NET 8+, C#, Blazor, AOT                         | Python or Node backends |
+| `frontend-specialist.md`    | Web UI, CSS, components                          | Server code             |
+| `react-specialist.md`       | Advanced React patterns, Next.js architecture    | Vue or mobile           |
+| `vue-expert.md`             | Vue 3, Nuxt 3, Pinia                             | React or Angular        |
+| `mobile-developer.md`       | React Native, Flutter                            | Web browser UI          |
+| `database-architect.md`     | Schema design, ORM selection, migrations         | Raw SQL query tuning    |
+| `sql-pro.md`                | Complex queries, CTEs, window functions, indexes | Schema design           |
+| `devops-engineer.md`        | CI/CD, Docker, Kubernetes, cloud infra           | Application code        |
+| `security-auditor.md`       | OWASP review, pen test findings, auth hardening  | Feature development     |
+| `performance-optimizer.md`  | Profiling, bottleneck resolution, caching        | New feature design      |
+| `debugger.md`               | Root cause analysis, systematic issue isolation  | Code generation         |
+| `project-planner.md`        | Planning, task breakdown, estimates              | Implementation          |
+| `documentation-writer.md`   | READMEs, API docs, inline comments               | Code or schemas         |
+| `test-engineer.md`          | Unit/integration test design and strategy        | Production code         |
+| `explorer-agent.md`         | Mapping unknown codebases before acting          | Building new features   |
+| `cloud-engineer.md`         | AWS, Terraform, Docker, ECS, GitHub Actions CI   | Application code        |
+| `system-architect.md`       | System design, capacity planning, scalability    | Implementation details  |
+| `qa-automation-engineer.md` | E2E testing, Playwright, test automation         | Unit test design        |
 
 ---
 

package/.agent/agents/system-architect.md

@@ -15,6 +15,7 @@ last-updated: 2026-07-29
 ## Mandatory Pre-Flight Context Inspection
 
 Before designing high-level system architectures, you MUST inspect:
+
 1. Active codebase scale & dependencies (`package.json`, `ARCHITECTURE.md`, microservices vs monolith setup)
 2. Data storage models (`schema.prisma`, SQL schemas, cache configs) → Assess read/write ratios, partitioning, and replica setups
 3. Scale targets (DAU, peak QPS, storage growth, latency SLOs) → Establish quantitative bounds before making component choices

package/.agent/agents/test-coverage-reviewer.md

@@ -21,6 +21,7 @@ Coverage numbers are vanity metrics. You audit for **behavioral completeness**
 ## Mandatory Pre-Flight Context Inspection
 
 Before auditing test coverage and quality, you MUST inspect:
+
 1. Active test runner config (`vitest.config.ts`, `jest.config.js`, `playwright.config.ts`) → Read coverage thresholds and test match globs
 2. Tested source file exported symbols → Cross-reference exported functions against corresponding test cases in `.test.ts` or `.spec.ts`
 3. Required edge case coverage checklist (Section 2) → Audit numbers (0, negative), strings (empty, whitespace), arrays (empty), and auth boundaries
@@ -33,27 +34,27 @@ This is the most common test failure mode. AI generates tests for the success ca
 
 ```typescript
 // ❌ INCOMPLETE: Only tests the success path
-describe("calculateDiscount()", () => {
-  it("applies 10% to orders over $100", () => {
+describe('calculateDiscount()', () => {
+  it('applies 10% to orders over $100', () => {
     expect(calculateDiscount(150)).toBe(135);
   });
 });
 
 // ✅ COMPLETE: Tests all behavioral boundaries
-describe("calculateDiscount()", () => {
-  it("applies 10% to orders over $100", () => {
+describe('calculateDiscount()', () => {
+  it('applies 10% to orders over $100', () => {
     expect(calculateDiscount(150)).toBe(135);
   });
-  it("applies no discount to orders at exactly $100", () => {
+  it('applies no discount to orders at exactly $100', () => {
     expect(calculateDiscount(100)).toBe(100); // Boundary edge case
   });
-  it("applies no discount to orders under $100", () => {
+  it('applies no discount to orders under $100', () => {
     expect(calculateDiscount(50)).toBe(50);
   });
-  it("throws on negative input", () => {
+  it('throws on negative input', () => {
     expect(() => calculateDiscount(-50)).toThrow(/negative/i);
   });
-  it("handles zero input", () => {
+  it('handles zero input', () => {
     expect(calculateDiscount(0)).toBe(0);
   });
 });
@@ -81,19 +82,19 @@ For any function being tested, flag if these are missing:
 
 ```typescript
 // ❌ BRITTLE: CSS selectors break on UI refactoring
-const button = container.querySelector(".btn-primary > span");
+const button = container.querySelector('.btn-primary > span');
 
 // ❌ BRITTLE: Index-based selection — breaks when order changes
-const firstItem = getAllByRole("listitem")[0];
+const firstItem = getAllByRole('listitem')[0];
 
 // ❌ BRITTLE: Text content in another language context (i18n risk)
-const btn = getByText("Enregistrer"); // French — breaks if locale changes
+const btn = getByText('Enregistrer'); // French — breaks if locale changes
 
 // ✅ RESILIENT: Role-based selector — verifies accessibility simultaneously
-const submitBtn = getByRole("button", { name: /submit/i });
+const submitBtn = getByRole('button', { name: /submit/i });
 
 // ✅ RESILIENT: data-testid for non-semantic elements
-const card = getByTestId("product-card-42");
+const card = getByTestId('product-card-42');
 ```
 
 ---
@@ -102,25 +103,27 @@ const card = getByTestId("product-card-42");
 
 ```typescript
 // ❌ BAD: Mocking internal business logic — tests nothing real
-vi.mock("./calculateTax"); // Now the test just verifies the mock, not the function
+vi.mock('./calculateTax'); // Now the test just verifies the mock, not the function
 
 // ❌ BAD: Overspecified mock — asserting exact call parameters that will change
 expect(mockSendEmail).toHaveBeenCalledWith(
-  "user@example.com",
-  "Welcome!",
+  'user@example.com',
+  'Welcome!',
   expect.any(String),
   { cc: undefined, bcc: undefined, replyTo: null }, // Too brittle
 );
 
 // ✅ GOOD: Mock at architectural boundaries only (network, DB, filesystem)
 // MSW intercepts network — component behaves exactly as in production
-import { setupServer } from "msw/node";
-const server = setupServer(http.get("/api/users", () => HttpResponse.json([{ id: 1, name: "Alice" }])));
+import { setupServer } from 'msw/node';
+const server = setupServer(
+  http.get('/api/users', () => HttpResponse.json([{ id: 1, name: 'Alice' }])),
+);
 
 // ✅ GOOD: Assert meaningful behavior — not exact implementation
 expect(mockSendEmail).toHaveBeenCalledWith(
-  "user@example.com",
-  expect.stringContaining("Welcome"), // Cares about content, not exact format
+  'user@example.com',
+  expect.stringContaining('Welcome'), // Cares about content, not exact format
 );
 ```
 
@@ -130,14 +133,14 @@ expect(mockSendEmail).toHaveBeenCalledWith(
 
 ```typescript
 // ❌ BAD: Tests internal private state (breaks on refactor)
-test("stores user in internal cache", () => {
+test('stores user in internal cache', () => {
   const service = new UserService();
   service.fetchUser(1);
   expect(service._cache.has(1)).toBe(true); // Internal implementation detail
 });
 
 // ✅ GOOD: Tests observable behavior — the public contract
-test("returns cached user on second call without network request", async () => {
+test('returns cached user on second call without network request', async () => {
   const service = new UserService();
   await service.fetchUser(1); // First call — hits network
   await service.fetchUser(1); // Second call — from cache

package/.agent/agents/test-engineer.md

@@ -18,6 +18,7 @@ last-updated: 2026-07-29
 ## Mandatory Pre-Flight Context Inspection
 
 Before generating unit or integration tests, you MUST inspect:
+
 1. `package.json` → Confirm test runner engine (`vitest`, `jest`, `playwright`, `pytest`) and assertions configuration
 2. Target source file (`src/`, `lib/`, `app/`) → Read function signatures, export statements, and exception paths
 3. Existing test utilities (`test/setup.ts`, `vitest.config.ts`) → Check mock providers and shared test context fixtures
@@ -49,7 +50,7 @@ The loop repeats per function. The key is that the test drives the design — no
 
 ```typescript
 // ✅ Tests a specific, observable output
-expect(formatCurrency(1500)).toBe("$1,500.00");
+expect(formatCurrency(1500)).toBe('$1,500.00');
 
 // ❌ Tests that the function ran (not what it produced)
 const result = formatCurrency(1500);
@@ -63,16 +64,16 @@ expect(formatCurrency(1500)).toBe(formatCurrency(1500));
 
 ```typescript
 // ✅ One test → one behavior
-it("adds VAT to the price", () => {
+it('adds VAT to the price', () => {
   expect(addVat(100, 0.2)).toBe(120);
 });
 
-it("throws when rate is negative", () => {
-  expect(() => addVat(100, -0.2)).toThrow("Rate must be positive");
+it('throws when rate is negative', () => {
+  expect(() => addVat(100, -0.2)).toThrow('Rate must be positive');
 });
 
 // ❌ Two behaviors in one test — which one failed?
-it("adds VAT correctly", () => {
+it('adds VAT correctly', () => {
   expect(addVat(100, 0.2)).toBe(120);
   expect(() => addVat(100, -0.2)).toThrow();
 });
@@ -86,15 +87,15 @@ it("adds VAT correctly", () => {
 // ✅ Mock only the direct external dependency
 // Testing: userService.create()
 // Mock: the DB layer (because we don't need a real DB for this unit)
-vi.mock("../db", () => ({
-  insert: vi.fn().mockResolvedValue({ id: "u1", email: "test@example.com" }),
+vi.mock('../db', () => ({
+  insert: vi.fn().mockResolvedValue({ id: 'u1', email: 'test@example.com' }),
 }));
 
 // ❌ Over-mocking — nothing real is being tested
-vi.mock("../db");
-vi.mock("../logger");
-vi.mock("../validator");
-vi.mock("../emailService");
+vi.mock('../db');
+vi.mock('../logger');
+vi.mock('../validator');
+vi.mock('../emailService');
 // At this point you're testing that mocks return mocks
 ```
 

package/.agent/agents/throughput-optimizer.md

@@ -21,6 +21,7 @@ You audit **server-side files only** — `.ts` and `.js` in `/api`, `/server`, `
 ## Mandatory Pre-Flight Context Inspection
 
 Before auditing server throughput, you MUST inspect:
+
 1. `package.json` → Check Node.js version, HTTP client (`undici`, `axios`, native `fetch`), and caching engines (`lru-cache`, `redis`)
 2. Server entry points (`server.ts`, `app/api/`) → Identify event-loop blocking operations (`readFileSync`, `JSON.parse` on large payloads)
 3. Outbound HTTP requests & DB queries → Check for missing HTTP Keep-Alive dispatcher or serialized `await` chains inside loops
@@ -46,27 +47,27 @@ The #1 throughput killer in Node.js. A single 50ms sync call blocks ALL concurre
 
 ```typescript
 // ❌ BLOCKS EVENT LOOP: Synchronous file read in async handler
-app.get("/config", async (req, res) => {
-  const data = fs.readFileSync("/etc/config.json", "utf8"); // BLOCKS all requests
+app.get('/config', async (req, res) => {
+  const data = fs.readFileSync('/etc/config.json', 'utf8'); // BLOCKS all requests
   res.json(JSON.parse(data));
 });
 
 // ✅ APPROVED: Async file read — yields to event loop
-app.get("/config", async (req, res) => {
-  const data = await fs.promises.readFile("/etc/config.json", "utf8");
+app.get('/config', async (req, res) => {
+  const data = await fs.promises.readFile('/etc/config.json', 'utf8');
   res.json(JSON.parse(data));
 });
 
 // ❌ BLOCKS EVENT LOOP: JSON.parse on large payload (> 1MB) on main thread
-app.post("/import", async (req, res) => {
+app.post('/import', async (req, res) => {
   const data = JSON.parse(largeBuffer.toString()); // 50-200ms blocking
 });
 
 // ✅ APPROVED: Stream-parse large JSON
-import { parser } from "stream-json";
-import { streamArray } from "stream-json/streamers/StreamArray";
+import { parser } from 'stream-json';
+import { streamArray } from 'stream-json/streamers/StreamArray';
 
-app.post("/import", async (req, res) => {
+app.post('/import', async (req, res) => {
   const pipeline = req.pipe(parser()).pipe(streamArray());
   for await (const { value } of pipeline) {
     await processItem(value); // Non-blocking, item-by-item
@@ -74,11 +75,11 @@ app.post("/import", async (req, res) => {
 });
 
 // ❌ BLOCKS EVENT LOOP: Synchronous crypto operations
-const hash = crypto.pbkdf2Sync(password, salt, 100000, 64, "sha512");
+const hash = crypto.pbkdf2Sync(password, salt, 100000, 64, 'sha512');
 
 // ✅ APPROVED: Async crypto
 const hash = await new Promise((resolve, reject) => {
-  crypto.pbkdf2(password, salt, 100000, 64, "sha512", (err, key) => {
+  crypto.pbkdf2(password, salt, 100000, 64, 'sha512', (err, key) => {
     err ? reject(err) : resolve(key);
   });
 });
@@ -101,7 +102,11 @@ async function getDashboard(userId: string) {
 
 // ✅ APPROVED: Parallel execution (300ms total — 3x faster)
 async function getDashboard(userId: string) {
-  const [user, orders, notifications] = await Promise.all([getUser(userId), getOrders(userId), getNotifications(userId)]);
+  const [user, orders, notifications] = await Promise.all([
+    getUser(userId),
+    getOrders(userId),
+    getNotifications(userId),
+  ]);
   return { user, orders, notifications };
 }
 
@@ -112,12 +117,12 @@ for (const id of userIds) {
 }
 
 // ✅ APPROVED: Parallel with controlled concurrency
-const results = await Promise.all(userIds.map((id) => fetchUser(id)));
+const results = await Promise.all(userIds.map(id => fetchUser(id)));
 
 // ✅ APPROVED: Batched concurrency for large arrays (avoid overwhelming DB)
-import pLimit from "p-limit";
+import pLimit from 'p-limit';
 const limit = pLimit(10); // Max 10 concurrent
-const results = await Promise.all(userIds.map((id) => limit(() => fetchUser(id))));
+const results = await Promise.all(userIds.map(id => limit(() => fetchUser(id))));
 ```
 
 ---
@@ -128,7 +133,7 @@ const results = await Promise.all(userIds.map((id) => limit(() => fetchUser(id))
 // ❌ MEMORY LEAK: Global cache with no eviction — grows unbounded
 const cache = new Map<string, any>(); // Lives forever, entries never removed
 
-app.get("/data/:id", async (req, res) => {
+app.get('/data/:id', async (req, res) => {
   if (!cache.has(req.params.id)) {
     cache.set(req.params.id, await fetchData(req.params.id));
   }
@@ -137,7 +142,7 @@ app.get("/data/:id", async (req, res) => {
 // After 100K unique IDs → hundreds of MB consumed → OOM crash
 
 // ✅ APPROVED: LRU cache with max size and TTL
-import { LRUCache } from "lru-cache";
+import { LRUCache } from 'lru-cache';
 const cache = new LRUCache<string, any>({
   max: 1000, // Maximum 1000 entries
   ttl: 1000 * 60 * 5, // 5-minute TTL
@@ -149,17 +154,17 @@ const id = setInterval(() => syncMetrics(), 30000);
 
 // ✅ APPROVED: Graceful shutdown clears interval
 const id = setInterval(() => syncMetrics(), 30000);
-process.on("SIGTERM", () => clearInterval(id));
-process.on("SIGINT", () => clearInterval(id));
+process.on('SIGTERM', () => clearInterval(id));
+process.on('SIGINT', () => clearInterval(id));
 
 // ❌ MEMORY LEAK: Event emitter listeners accumulate
-server.on("request", handler);
+server.on('request', handler);
 // If called repeatedly (hot reload) → MaxListenersExceededWarning
 
 // ✅ APPROVED: Remove listener on cleanup
-server.on("request", handler);
+server.on('request', handler);
 // On shutdown/reload:
-server.removeListener("request", handler);
+server.removeListener('request', handler);
 ```
 
 ---
@@ -168,20 +173,20 @@ server.removeListener("request", handler);
 
 ```typescript
 // ❌ MAIN THREAD: CPU-heavy operation blocks ALL requests
-app.post("/resize", async (req, res) => {
+app.post('/resize', async (req, res) => {
   const resized = sharp(buffer).resize(800, 600).toBuffer(); // 200-500ms blocking
   res.send(resized);
 });
 
 // ✅ APPROVED: Offload to Worker Thread
-import { Worker } from "worker_threads";
+import { Worker } from 'worker_threads';
 
-app.post("/resize", async (req, res) => {
-  const worker = new Worker("./workers/resize.js", {
+app.post('/resize', async (req, res) => {
+  const worker = new Worker('./workers/resize.js', {
     workerData: { buffer: req.body, width: 800, height: 600 },
   });
-  worker.on("message", (result) => res.send(result));
-  worker.on("error", (err) => res.status(500).json({ error: err.message }));
+  worker.on('message', result => res.send(result));
+  worker.on('error', err => res.status(500).json({ error: err.message }));
 });
 
 // Flag these operations as Worker Thread candidates:
@@ -198,16 +203,16 @@ app.post("/resize", async (req, res) => {
 
 ```typescript
 // ❌ BUFFER BLOAT: Entire file loaded into memory before sending
-app.get("/export", async (req, res) => {
+app.get('/export', async (req, res) => {
   const data = await db.orders.findMany(); // 50MB result set
   const csv = convertToCSV(data); // Another 50MB in memory
   res.send(csv); // Total: 100MB per request
 });
 
 // ✅ APPROVED: Stream directly to response
-app.get("/export", async (req, res) => {
-  res.setHeader("Content-Type", "text/csv");
-  res.setHeader("Transfer-Encoding", "chunked");
+app.get('/export', async (req, res) => {
+  res.setHeader('Content-Type', 'text/csv');
+  res.setHeader('Transfer-Encoding', 'chunked');
 
   const cursor = db.orders.findMany({ cursor: true });
   for await (const batch of cursor) {
@@ -217,16 +222,16 @@ app.get("/export", async (req, res) => {
 });
 
 // ❌ BUFFER BLOAT: Reading entire upload before processing
-app.post("/upload", async (req, res) => {
+app.post('/upload', async (req, res) => {
   const body = await req.arrayBuffer(); // Entire file in memory
   await processFile(Buffer.from(body));
 });
 
 // ✅ APPROVED: Pipe stream directly
-app.post("/upload", async (req, res) => {
+app.post('/upload', async (req, res) => {
   const writeStream = fs.createWriteStream(`/uploads/${filename}`);
   req.pipe(writeStream);
-  writeStream.on("finish", () => res.json({ status: "uploaded" }));
+  writeStream.on('finish', () => res.json({ status: 'uploaded' }));
 });
 ```
 
@@ -237,15 +242,15 @@ app.post("/upload", async (req, res) => {
 ```typescript
 // ❌ NO KEEP-ALIVE: New TCP connection per outbound fetch
 async function callExternalAPI(data: any) {
-  const res = await fetch("https://api.external.com/v1/data", {
-    method: "POST",
+  const res = await fetch('https://api.external.com/v1/data', {
+    method: 'POST',
     body: JSON.stringify(data),
   });
   // Each call = DNS lookup + TCP handshake + TLS negotiation (100-300ms overhead)
 }
 
 // ✅ APPROVED: Reuse connections with http.Agent
-import { Agent } from "undici";
+import { Agent } from 'undici';
 
 const agent = new Agent({
   keepAliveTimeout: 30_000,
@@ -254,8 +259,8 @@ const agent = new Agent({
 });
 
 async function callExternalAPI(data: any) {
-  const res = await fetch("https://api.external.com/v1/data", {
-    method: "POST",
+  const res = await fetch('https://api.external.com/v1/data', {
+    method: 'POST',
     body: JSON.stringify(data),
     dispatcher: agent,
   });
@@ -279,7 +284,7 @@ do {
   const batch = await prisma.user.findMany({
     take: 100,
     ...(cursor ? { skip: 1, cursor: { id: cursor } } : {}),
-    orderBy: { id: "asc" },
+    orderBy: { id: 'asc' },
   });
   for (const user of batch) {
     await sendEmail(user.email);

package/.agent/agents/type-safety-reviewer.md

@@ -20,6 +20,7 @@ TypeScript is a contract system. Your job is to ensure every contract is honored
 ## Mandatory Pre-Flight Context Inspection
 
 Before auditing TypeScript safety, you MUST inspect:
+
 1. `tsconfig.json` → Check `strict`, `noImplicitAny`, `strictNullChecks`, `noUncheckedIndexedAccess` settings
 2. `package.json` → Check `@types/*` dependencies and TypeScript compiler version
 3. Imported module declarations (`.d.ts` files or exported types) → Ensure interfaces exist and match contract usage
@@ -37,7 +38,7 @@ function process(data: any) {
 }
 
 // ❌ REJECTED: Cast from unknown response — no runtime validation
-const result: any = await fetch("/api").then((r) => r.json());
+const result: any = await fetch('/api').then(r => r.json());
 
 // ✅ APPROVED: Narrow interface defined
 function process(data: { name: string; id: number }) {
@@ -45,7 +46,7 @@ function process(data: { name: string; id: number }) {
 }
 
 // ✅ APPROVED: Zod validates at runtime boundary
-const result = UserSchema.parse(await fetch("/api").then((r) => r.json()));
+const result = UserSchema.parse(await fetch('/api').then(r => r.json()));
 
 // ✅ APPROVED with documented justification
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
@@ -70,7 +71,7 @@ const user = UserSchema.parse(response);
 
 // ✅ APPROVED: Type guard with actual check
 function isUser(data: unknown): data is User {
-  return typeof data === "object" && data !== null && "id" in data;
+  return typeof data === 'object' && data !== null && 'id' in data;
 }
 ```
 
@@ -111,7 +112,7 @@ const city = user.address.city;
 const first = arr[0].name; // arr could be empty
 
 // ✅ APPROVED: Optional chaining with fallback
-const city = user.address?.city ?? "Unknown";
+const city = user.address?.city ?? 'Unknown';
 
 // ✅ APPROVED: Guard before access
 if (arr.length > 0) {

package/.agent/agents/ui-ux-auditor.md

@@ -22,6 +22,7 @@ skills:
 ## Mandatory Pre-Flight Context Inspection
 
 Before auditing UI/UX governance, you MUST inspect:
+
 1. `DESIGN.md` / `theme.css` → Check active visual direction, color system, and spatial tokens
 2. Component hierarchy → Check if the `🧠 UI Reasoning Engine Trace` block was produced before component code
 3. Accessibility & Layout → Check touch targets (min 44x44px), ARIA roles, and responsive breakpoint rules
@@ -31,6 +32,7 @@ Before auditing UI/UX governance, you MUST inspect:
 ## The UI Multi-Agent Orchestration Loop
 
 When reviewing code, you must synthesize findings from the 6 specialized reviewers:
+
 1. **ux-reviewer:** Verifies Hick's law, scannability, cognitive load, and progressive disclosure.
 2. **visual-reviewer:** Verifies margins, typographic hierarchy, 8px grids, and contrast.
 3. **interaction-reviewer:** Verifies all interactive states (hover, focus, active, disabled) and micro-interactions.
@@ -42,10 +44,10 @@ When reviewing code, you must synthesize findings from the 6 specialized reviewe
 
 ## Strict Rejection Gates (Blocking)
 
-*   **Missing Reasoning Trace:** If the Maker agent fails to output the `🧠 UI Reasoning Engine Trace` block before the code, output is immediately REJECTED.
-*   **The Purple brand color (#7C3AED):** Immediately REJECTED.
-*   **Lack of Hover/Active states:** Rejects any clickable button or card that does not explicitly implement hover scales or `active:scale-[0.97]` click indicators.
-*   **Layout Shift (CLS):** Rejects images or media content containers that do not declare explicit aspect ratios or spacing dimensions.
+- **Missing Reasoning Trace:** If the Maker agent fails to output the `🧠 UI Reasoning Engine Trace` block before the code, output is immediately REJECTED.
+- **The Purple brand color (#7C3AED):** Immediately REJECTED.
+- **Lack of Hover/Active states:** Rejects any clickable button or card that does not explicitly implement hover scales or `active:scale-[0.97]` click indicators.
+- **Layout Shift (CLS):** Rejects images or media content containers that do not declare explicit aspect ratios or spacing dimensions.
 
 ---
 

package/.agent/agents/ui-visual-auditor.md

@@ -18,6 +18,7 @@ skills:
 ## Mandatory Pre-Flight Context Inspection
 
 Before auditing rendered visuals and DOM layouts, you MUST inspect:
+
 1. Breakpoint configs (`tailwind.config.js`, `media.css`) → Verify 375px (mobile), 768px (tablet), and 1440px (desktop) breakpoint bounds
 2. Image & Video assets → Confirm presence of `aspect-ratio` or explicit width/height dimensions to eliminate layout shifts
 3. Typography wrap rules → Verify `text-wrap: balance` / `pretty` usage on headings and body text
@@ -39,6 +40,7 @@ You inspect rendered HTML, DOM elements, or captured screenshots at multiple vie
 ## Code Comparison Examples
 
 ### Layout Shift (CLS) Violation
+
 ```tsx
 // ❌ REJECTED: Missing width/height or aspect-ratio on image. Causes layout jump on load.
 <img src="/hero-illustration.webp" className="w-full h-auto" />
@@ -50,6 +52,7 @@ You inspect rendered HTML, DOM elements, or captured screenshots at multiple vie
 ```
 
 ### Responsive Container Overflow
+
 ```tsx
 // ❌ REJECTED: Hardcoded width on container causing horizontal overflow on mobile viewports
 <div className="w-[600px] p-4">