tribunal-kit 6.0.0 → 7.0.0

package/.agent/skills/vector-search-pgvector/SKILL.md

@@ -0,0 +1,78 @@
+---
+name: vector-search-pgvector
+description: Production vector database search using pgvector 0.8.0+, halfvec, sparsevec, Pinecone, Weaviate, hybrid sparse-dense retrieval, and iterative HNSW scanning.
+tools: Read, Grep, Glob, Edit, Write
+version: 3.0.0
+last-updated: 2026-08-05
+script: .agent/scripts/schema_validator.js
+scripts-binding:
+  - .agent/scripts/schema_validator.js
+skills:
+  - database-architect
+  - sql-pro
+  - advanced-rag-pipelines
+---
+
+# Vector Search & pgvector 0.8.0+ — 2026 Database Standards
+
+## Mandatory Pre-Flight Context Inspection
+
+Before creating vector tables or indexes:
+
+1. Index Type & Precision → Use `halfvec` (half-precision) for 50% RAM savings on HNSW indexes; use `sparsevec` for high-dimensional sparse vectors
+2. Iterative Index Scans (pgvector 0.8.0+) → Enable iterative scanning to prevent HNSW overfiltering when combining `WHERE` clauses with vector similarity
+3. Hybrid Search Strategy → Combine BM25 full-text search with dense vector similarity via Reciprocal Rank Fusion (RRF)
+
+## High-Performance pgvector 0.8.0+ Schema (`halfvec` + HNSW)
+
+```sql
+CREATE EXTENSION IF NOT EXISTS vector;
+
+CREATE TABLE document_chunks (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    document_id UUID NOT NULL,
+    chunk_index INT NOT NULL,
+    content TEXT NOT NULL,
+    fts_vector tsvector GENERATED ALWAYS AS (to_tsvector('english', content)) STORED,
+    embedding halfvec(1536) NOT NULL  -- 50% memory reduction vs float4 vector
+);
+
+-- HNSW index using halfvec with iterative scanning support (pgvector 0.8.0+)
+CREATE INDEX idx_chunks_embedding_hnsw
+ON document_chunks USING hnsw (embedding halfvec_cosine_ops)
+WITH (m = 16, ef_construction = 64);
+
+-- Full text search GIN index
+CREATE INDEX idx_chunks_fts ON document_chunks USING gin (fts_vector);
+```
+
+## Hybrid Search Query (pgvector 0.8.0+ Iterative Scan + RRF)
+
+```sql
+-- pgvector 0.8.0+ automatically performs iterative prober scans when filtering
+WITH vector_search AS (
+    SELECT id, content, ROW_NUMBER() OVER (ORDER BY embedding <=> $1::halfvec) as rank
+    FROM document_chunks
+    WHERE document_id = $3  -- Iterative scan prevents overfiltering
+    LIMIT 20
+),
+fts_search AS (
+    SELECT id, content, ROW_NUMBER() OVER (ORDER BY ts_rank(fts_vector, websearch_to_tsquery($2)) DESC) as rank
+    FROM document_chunks
+    WHERE fts_vector @@ websearch_to_tsquery($2) AND document_id = $3
+    LIMIT 20
+)
+SELECT
+    COALESCE(v.id, f.id) as id,
+    COALESCE(v.content, f.content) as content,
+    COALESCE(1.0 / (60 + v.rank), 0.0) + COALESCE(1.0 / (60 + f.rank), 0.0) as rrf_score
+FROM vector_search v
+FULL OUTER JOIN fts_search f ON v.id = f.id
+ORDER BY rrf_score DESC
+LIMIT 10;
+```
+
+## 🛑 Verification-Before-Completion (VBC) Protocol
+
+- Verify vector index construction queries pass `EXPLAIN ANALYZE` with `halfvec`.
+- Confirm pgvector extension version is >= 0.8.0 for iterative scanning support.

package/.agent/skills/vue-expert/SKILL.md

@@ -20,6 +20,7 @@ scripts-binding:
 ## Mandatory Pre-Flight Context Inspection
 
 Before writing Vue 3.5+ or Nuxt 4 components, you MUST inspect:
+
 1. Script Setup Architecture → Use `<script setup lang="ts">` exclusively; ban legacy Options API
 2. Pinia & Reactivity Rules (Section 133) → Use `storeToRefs(store)` when destructuring Pinia state to preserve reactivity
 3. Model & Watcher Syntax (Section 42) → Use `defineModel<T>()` (Vue 3.4+) and `watch(() => state.prop, ...)` for primitive watchers
@@ -42,19 +43,21 @@ Before writing Vue 3.5+ or Nuxt 4 components, you MUST inspect:
 
 ```vue
 <script setup lang="ts">
-import { ref, computed, watch, onMounted } from "vue";
+import { ref, computed, watch, onMounted } from 'vue';
 
 // Props
 const props = defineProps<{ title: string; count?: number }>();
 // With defaults:
-const props = withDefaults(defineProps<{ variant?: "primary" | "secondary" }>(), { variant: "primary" });
+const props = withDefaults(defineProps<{ variant?: 'primary' | 'secondary' }>(), {
+  variant: 'primary',
+});
 
 // Emits
 const emit = defineEmits<{ update: [value: string]; delete: [id: number] }>();
 
 // v-model (Vue 3.4+)
 const modelValue = defineModel<string>(); // default model
-const count = defineModel<number>("count"); // named model
+const count = defineModel<number>('count'); // named model
 
 // Expose to parent ref
 defineExpose({ reset: () => {}, focus: () => {} });
@@ -71,7 +74,7 @@ const count = ref(0);
 count.value++;
 
 // reactive — for objects (loses reactivity on reassign/destructure)
-const state = reactive({ name: "Alice", age: 25 });
+const state = reactive({ name: 'Alice', age: 25 });
 // ❌ const { name } = state; // loses reactivity
 // ✅ const name = computed(() => state.name);
 
@@ -79,8 +82,8 @@ const state = reactive({ name: "Alice", age: 25 });
 const doubled = computed(() => count.value * 2);
 const fullName = computed({
   get: () => `${first.value} ${last.value}`,
-  set: (v) => {
-    [first.value, last.value] = v.split(" ");
+  set: v => {
+    [first.value, last.value] = v.split(' ');
   },
 });
 
@@ -131,8 +134,8 @@ export function useAsyncData<T>(fn: () => Promise<T>) {
 
 ```ts
 // stores/counter.ts
-import { defineStore } from "pinia";
-export const useCounterStore = defineStore("counter", () => {
+import { defineStore } from 'pinia';
+export const useCounterStore = defineStore('counter', () => {
   const count = ref(0); // Setup Store (preferred)
   const doubled = computed(() => count.value * 2);
   function increment() {
@@ -145,12 +148,12 @@ export const useCounterStore = defineStore("counter", () => {
 const store = useCounterStore();
 // ❌ const { count } = store;        // loses reactivity!
 // ✅ const count = storeToRefs(store).count;
-import { storeToRefs } from "pinia";
+import { storeToRefs } from 'pinia';
 const { count } = storeToRefs(store);
 
 // Persist plugin:
-import { createPinia } from "pinia";
-import piniaPluginPersistedstate from "pinia-plugin-persistedstate";
+import { createPinia } from 'pinia';
+import piniaPluginPersistedstate from 'pinia-plugin-persistedstate';
 const pinia = createPinia().use(piniaPluginPersistedstate);
 ```
 
@@ -160,25 +163,25 @@ const pinia = createPinia().use(piniaPluginPersistedstate);
 
 ```ts
 // router/index.ts
-import { createRouter, createWebHistory } from "vue-router";
+import { createRouter, createWebHistory } from 'vue-router';
 const router = createRouter({
   history: createWebHistory(),
   routes: [
-    { path: "/", component: () => import("./views/Home.vue") }, // lazy-loaded
-    { path: "/user/:id", component: UserView, props: true }, // props:true passes params as props
-    { path: "/:pathMatch(.*)*", component: NotFound }, // 404 catch-all
+    { path: '/', component: () => import('./views/Home.vue') }, // lazy-loaded
+    { path: '/user/:id', component: UserView, props: true }, // props:true passes params as props
+    { path: '/:pathMatch(.*)*', component: NotFound }, // 404 catch-all
   ],
 });
 // Route guards
 router.beforeEach(async (to, from) => {
-  if (to.meta.requiresAuth && !isLoggedIn()) return { name: "Login" };
+  if (to.meta.requiresAuth && !isLoggedIn()) return { name: 'Login' };
 });
 
 // In component:
-import { useRouter, useRoute } from "vue-router";
+import { useRouter, useRoute } from 'vue-router';
 const router = useRouter();
 const route = useRoute();
-router.push({ name: "User", params: { id: 42 } });
+router.push({ name: 'User', params: { id: 42 } });
 const userId = route.params.id as string;
 ```
 
@@ -243,7 +246,7 @@ const { id } = useRoute().params; // auto-imported
 const { data, error, refresh } = await useFetch(`/api/users/${id}`, {
   lazy: false, // SSR: wait for data before rendering
   server: true, // fetch on server (default)
-  transform: (r) => r.user,
+  transform: r => r.user,
 });
 // ❌ TRAP: useFetch in Nuxt ≠ @tanstack/react-query. It's Nuxt-specific.
 // ❌ TRAP: useAsyncData key must be UNIQUE per page/component

package/.agent/skills/vulnerability-scanner/SKILL.md

@@ -20,6 +20,7 @@ scripts-binding:
 ## Mandatory Pre-Flight Context Inspection
 
 Before scanning codebases for security vulnerabilities, you MUST inspect:
+
 1. SQL Injection Vectors (Section 39) → Ban template literal interpolation in SQL queries (`SELECT ... WHERE id = ${id}`); require parameterized queries
 2. Explicit JWT Algorithms (Section 121) → Verify `jwt.verify(token, secret, { algorithms: ["HS256"] })` specifies explicit algorithms to prevent "None" attacks
 3. SSRF Domain Allowlist (Section 87) → Validate external request URLs against a strict domain allowlist and block private IP ranges (169.254.169.254, 127.0.0.1)
@@ -55,7 +56,7 @@ const query = `SELECT * FROM users WHERE email = '${email}'`;
 // Attack: email = "'; DROP TABLE users; --"
 
 // ✅ SAFE: Parameterized queries
-const result = await db.query("SELECT * FROM users WHERE email = $1", [email]);
+const result = await db.query('SELECT * FROM users WHERE email = $1', [email]);
 
 // ✅ SAFE: ORM (Prisma, Drizzle)
 const user = await prisma.user.findUnique({ where: { email } });
@@ -91,27 +92,27 @@ element.textContent = userComment;
 
 ```typescript
 // ❌ VULNERABLE: fetching user-provided URLs
-app.get("/proxy", async (req, res) => {
-  const data = await fetch(req.query.url).then((r) => r.text());
+app.get('/proxy', async (req, res) => {
+  const data = await fetch(req.query.url).then(r => r.text());
   res.send(data);
 });
 // Attack: url = "http://169.254.169.254/latest/meta-data/" (AWS metadata)
 // Attack: url = "http://localhost:6379/" (internal Redis)
 
 // ✅ SAFE: Allowlist of domains
-const ALLOWED_HOSTS = new Set(["api.example.com", "cdn.example.com"]);
+const ALLOWED_HOSTS = new Set(['api.example.com', 'cdn.example.com']);
 
-app.get("/proxy", async (req, res) => {
+app.get('/proxy', async (req, res) => {
   const url = new URL(req.query.url as string);
   if (!ALLOWED_HOSTS.has(url.hostname)) {
-    return res.status(403).json({ error: "Domain not allowed" });
+    return res.status(403).json({ error: 'Domain not allowed' });
   }
   // Additional: block private IP ranges
   const ip = await dns.resolve4(url.hostname);
   if (isPrivateIP(ip[0])) {
-    return res.status(403).json({ error: "Private IP not allowed" });
+    return res.status(403).json({ error: 'Private IP not allowed' });
   }
-  const data = await fetch(url).then((r) => r.text());
+  const data = await fetch(url).then(r => r.text());
   res.send(data);
 });
 ```
@@ -122,19 +123,19 @@ app.get("/proxy", async (req, res) => {
 
 ```typescript
 // JWT Best Practices
-import jwt from "jsonwebtoken";
+import jwt from 'jsonwebtoken';
 
 // ✅ SAFE: Specify algorithm explicitly
 const token = jwt.sign(payload, SECRET, {
-  algorithm: "HS256", // explicit
-  expiresIn: "15m", // short-lived access token
-  issuer: "myapp",
+  algorithm: 'HS256', // explicit
+  expiresIn: '15m', // short-lived access token
+  issuer: 'myapp',
 });
 
 // ✅ SAFE: Verify with explicit algorithms
 const decoded = jwt.verify(token, SECRET, {
-  algorithms: ["HS256"], // MUST specify — prevents algorithm confusion attack
-  issuer: "myapp",
+  algorithms: ['HS256'], // MUST specify — prevents algorithm confusion attack
+  issuer: 'myapp',
 });
 
 // ❌ HALLUCINATION TRAP: jwt.verify() without algorithms option is VULNERABLE
@@ -142,13 +143,13 @@ const decoded = jwt.verify(token, SECRET, {
 // ✅ jwt.verify(token, SECRET, { algorithms: ["HS256"] });
 
 // Authorization: check BEFORE business logic
-app.delete("/api/posts/:id", async (req, res) => {
+app.delete('/api/posts/:id', async (req, res) => {
   const post = await getPost(req.params.id);
-  if (!post) return res.status(404).json({ error: "Not found" });
+  if (!post) return res.status(404).json({ error: 'Not found' });
 
   // ✅ Authorization check BEFORE delete
-  if (post.authorId !== req.user.id && req.user.role !== "admin") {
-    return res.status(403).json({ error: "Forbidden" });
+  if (post.authorId !== req.user.id && req.user.role !== 'admin') {
+    return res.status(403).json({ error: 'Forbidden' });
   }
 
   await deletePost(post.id);
@@ -196,7 +197,7 @@ Defense:
 ## Security Headers
 
 ```typescript
-import helmet from "helmet";
+import helmet from 'helmet';
 
 app.use(helmet()); // Sets secure defaults
 
@@ -211,8 +212,8 @@ app.use(helmet()); // Sets secure defaults
 // CORS — never wildcard in production
 app.use(
   cors({
-    origin: ["https://myapp.com", "https://admin.myapp.com"],
-    methods: ["GET", "POST", "PUT", "DELETE"],
+    origin: ['https://myapp.com', 'https://admin.myapp.com'],
+    methods: ['GET', 'POST', 'PUT', 'DELETE'],
     credentials: true,
   }),
 );

package/.agent/skills/web-accessibility-auditor/SKILL.md

@@ -20,6 +20,7 @@ scripts-binding:
 ## Mandatory Pre-Flight Context Inspection
 
 Before auditing accessibility or building UI components, you MUST inspect:
+
 1. Native Semantic HTML First Rule (Section 28) → Use native `<button>`, `<a>`, `<label>` elements; ban adding `role="button"` to non-interactive `<div>` tags
 2. Keyboard Focus Visibility (Section 61) → Preserve `:focus-visible` outlines; ban global outline removal (`*:focus { outline: none; }`)
 3. Explicit Form Label Linking (Section 129) → Explicitly link inputs to `<label>` via `id`/`for` attributes; ban using `placeholder` as a label replacement
@@ -104,7 +105,7 @@ When a modal opens:
   <button formmethod="dialog">Close</button>
 </dialog>
 <script>
-  document.getElementById("myModal").showModal();
+  document.getElementById('myModal').showModal();
 </script>
 ```
 

package/.agent/skills/web-design-guidelines/SKILL.md

@@ -20,6 +20,7 @@ scripts-binding:
 ## Mandatory Pre-Flight Context Inspection
 
 Before enforcing web design guidelines or reviewing UI code, you MUST inspect:
+
 1. APCA Contrast Thresholds (Section 14) → Require Lc > 75 for body text, Lc > 60 for headings, Lc > 45 for controls/borders
 2. Core Web Vitals Targets (Section 23) → Ensure LCP < 1.5s (fetchpriority="high"), INP < 100ms, and CLS = 0.00 (explicit aspect-ratio)
 3. Compositor-Only Motion (Section 30) → Restrict animations strictly to `transform` and `opacity` to avoid layout reflows
@@ -31,30 +32,35 @@ This skill defines performance, accessibility, and rendering efficiency guidelin
 ## 1. APCA Contrast Guidelines (WCAG 3.0 Base)
 
 APCA calculates lightness contrast mathematically based on font size and background luminance.
-*   **Body Text:** Lc > 75 is required for body text readability.
-*   **Headings:** Lc > 60 is required for headings.
-*   **Controls/Borders:** Lc > 45 is required for visual divider borders and focus rings.
+
+- **Body Text:** Lc > 75 is required for body text readability.
+- **Headings:** Lc > 60 is required for headings.
+- **Controls/Borders:** Lc > 45 is required for visual divider borders and focus rings.
 
 ---
 
 ## 2. Core Web Vitals (CWV)
-*   **Largest Contentful Paint (LCP < 1.5s):** Hero banners and images must use the `fetchpriority="high"` tag. Avoid blocking layout paints with heavy JS scripts.
-*   **Interaction to Next Paint (INP < 100ms):** Enforce main-thread speed. Wrap heavy operations in `startTransition` or React's deferred values.
-*   **Cumulative Layout Shift (CLS = 0.00):** Image nodes must declare explicit width/height dimensions or aspect-ratios. Pre-allocate spaces for dynamic elements.
+
+- **Largest Contentful Paint (LCP < 1.5s):** Hero banners and images must use the `fetchpriority="high"` tag. Avoid blocking layout paints with heavy JS scripts.
+- **Interaction to Next Paint (INP < 100ms):** Enforce main-thread speed. Wrap heavy operations in `startTransition` or React's deferred values.
+- **Cumulative Layout Shift (CLS = 0.00):** Image nodes must declare explicit width/height dimensions or aspect-ratios. Pre-allocate spaces for dynamic elements.
 
 ---
 
 ## 3. Sustainable & Battery-Efficient UI
-*   **Compositor Properties:** Transitions and animations must only animate `transform` and `opacity`. Animating properties like `margin`, `width`, `height`, or `top` triggers layout reflows and wastes CPU cycles.
-*   **OLED Blacks:** For dark luxury themes, base backgrounds must use OLED-friendly blacks (`oklch(0.08 0.005 250)` or `#000000`) to physically turn off pixels on compatible screens.
-*   **Font Subsetting:** Self-host typography files and use variable fonts to minimize network payloads.
-*   **Image Formats:** Serve images exclusively in AVIF or WebP formats.
+
+- **Compositor Properties:** Transitions and animations must only animate `transform` and `opacity`. Animating properties like `margin`, `width`, `height`, or `top` triggers layout reflows and wastes CPU cycles.
+- **OLED Blacks:** For dark luxury themes, base backgrounds must use OLED-friendly blacks (`oklch(0.08 0.005 250)` or `#000000`) to physically turn off pixels on compatible screens.
+- **Font Subsetting:** Self-host typography files and use variable fonts to minimize network payloads.
+- **Image Formats:** Serve images exclusively in AVIF or WebP formats.
 
 ---
 
 ## Pre-Flight Checklist
+
 - [ ] Have I reviewed the user's specific constraints and requests?
 - [ ] Have I checked the environment for relevant existing implementations?
 
 ## VBC Protocol (Verification-Before-Completion)
+
 You MUST verify existing code signatures and variables before attempting to modify or call them. No hallucination is permitted.

package/.agent/skills/web-quality-audit/SKILL.md

@@ -20,6 +20,7 @@ scripts-binding:
 ## Mandatory Pre-Flight Context Inspection
 
 Before executing web quality audits or Lighthouse-style evaluations, you MUST inspect:
+
 1. Core Web Vitals Benchmarks (Section 24) → LCP $\le 2.5\text{s}$, INP $\le 200\text{ms}$, CLS $\le 0.1$
 2. Layout Shift Prevention (Section 27) → Enforce explicit `width`/`height` or aspect-ratio declarations on all media tags
 3. Async Script Loading (Section 46) → Enforce `async` or `defer` attributes on all third-party script tags in `<head>`
@@ -31,19 +32,23 @@ Conduct a comprehensive multi-pillar web quality audit covering Performance, Acc
 ## 4 Quality Pillars
 
 ### 1. Core Web Vitals (Performance)
+
 - **Largest Contentful Paint (LCP)**: Target $\le 2.5\text{s}$. Preload hero images using `<link rel="preload" as="image">` and fetchpriority="high".
 - **Interaction to Next Paint (INP)**: Target $\le 200\text{ms}$. Break long JS tasks into smaller chunks using `setTimeout` or `requestIdleCallback`.
 - **Cumulative Layout Shift (CLS)**: Target $\le 0.1$. Set explicit `width` and `height` attributes on images and videos; reserve space for dynamic ads/banners.
 
 ### 2. Accessibility (a11y)
+
 - Target 100/100 score. Verify all interactive controls have accessible names, proper contrast ($\ge 4.5:1$), and complete keyboard accessibility.
 
 ### 3. Web Best Practices
+
 - Serve images in modern formats (`.webp` or `.avif`).
 - Enforce HTTPS security headers (`Content-Security-Policy`, `X-Frame-Options`, `Strict-Transport-Security`).
 - Eliminate console errors and unhandled promise rejections.
 
 ### 4. Search Engine Optimization (SEO)
+
 - Valid HTML5 document structure (`<!DOCTYPE html>`, `<html>` with `lang`, single `<h1>`).
 - Robots.txt, sitemap.xml, canonical URLs, and structured JSON-LD data.
 

package/.agent/skills/webapp-testing/SKILL.md

@@ -20,6 +20,7 @@ scripts-binding:
 ## Mandatory Pre-Flight Context Inspection
 
 Before building web application test suites or configuring component mocks, you MUST inspect:
+
 1. Testing Trophy Allocation (Section 27) → Prioritize Integration tests (60% RTL + MSW) over pure Unit (20%) or E2E (10%)
 2. MSW Network Interception Rule (Section 40) → Intercept HTTP network calls via MSW (`setupServer`); ban mocking library clients like `axios.get.mockResolvedValue`
 3. Decouple Business Logic from React (Section 99) → Extract complex calculations into pure testable functions outside React components
@@ -55,17 +56,17 @@ To prevent network calls, utilize Mock Service Worker (MSW) which intercepts req
 
 ```typescript
 // ❌ BAD: Mocking implementation details
-jest.mock("axios");
+jest.mock('axios');
 axios.get.mockResolvedValue({ data: { users: [] } });
 
 // ✅ GOOD: MSW (Mock Service Worker) network level interception
 // The component functions EXACTLY as it would in production
-import { http, HttpResponse } from "msw";
-import { setupServer } from "msw/node";
+import { http, HttpResponse } from 'msw';
+import { setupServer } from 'msw/node';
 
 export const handlers = [
-  http.get("/api/users", () => {
-    return HttpResponse.json([{ id: 1, name: "John Appleseed" }]);
+  http.get('/api/users', () => {
+    return HttpResponse.json([{ id: 1, name: 'John Appleseed' }]);
   }),
 ];
 const server = setupServer(...handlers);
@@ -112,21 +113,21 @@ Isolate business logic entirely from React.
 ```typescript
 // ✅ Move complex logic OUT of the React component entirely
 export function calculateTax(subtotal: number, state: string): number {
-  if (subtotal < 0) throw new Error("Subtotal cannot be negative");
-  if (state === "CA") return subtotal * 0.0825;
+  if (subtotal < 0) throw new Error('Subtotal cannot be negative');
+  if (state === 'CA') return subtotal * 0.0825;
   return 0; // Default
 }
 
 // ✅ Test with extreme precision and coverage
-import { describe, it, expect } from "vitest";
+import { describe, it, expect } from 'vitest';
 
-describe("calculateTax()", () => {
-  it("applies CA tax correctly", () => {
-    expect(calculateTax(100, "CA")).toBe(8.25);
+describe('calculateTax()', () => {
+  it('applies CA tax correctly', () => {
+    expect(calculateTax(100, 'CA')).toBe(8.25);
   });
 
-  it("throws on negative input", () => {
-    expect(() => calculateTax(-50, "CA")).toThrowError("negative");
+  it('throws on negative input', () => {
+    expect(() => calculateTax(-50, 'CA')).toThrowError('negative');
   });
 });
 ```

package/.agent/skills/webgpu-performance/SKILL.md

@@ -20,6 +20,7 @@ scripts-binding:
 ## Mandatory Pre-Flight Context Inspection
 
 Before implementing WebGPU shaders or pipelines, you MUST inspect:
+
 1. Feature Detection (Section 64) → Always feature-detect WebGPU with `if (!navigator.gpu)` and provide WebGL fallback
 2. WGSL Buffer Alignment (Section 17) → Pad WGSL structs strictly to 16-byte boundaries (`vec4<f32>`) to prevent memory corruption
 3. Async Buffer Mapping (Section 68) → Use `mapAsync(GPUMapMode.READ)` to read GPU buffers without main-thread blocking

package/.agent/skills/whimsy-injector/SKILL.md

@@ -21,6 +21,7 @@ scripts-binding:
 ## Mandatory Pre-Flight Context Inspection
 
 Before injecting micro-animations or interaction polish, you MUST inspect:
+
 1. `package.json` → Check installed motion dependencies (`framer-motion`, `gsap`, `@vueuse/motion`, CSS-only)
 2. Whimsy Quota Rules (Section 228) → Max 3 distinct animation types per page; keep CLS impact at ZERO
 3. Duration Constraints (Section 238) → Keep hover interactions $\le 150\text{ms}$ and entrance animations $\le 300\text{ms}$
@@ -78,23 +79,26 @@ You are a specialized agent for injecting "micro-delights" into user interfaces
 ```javascript
 // Vanilla JS — IntersectionObserver trigger
 const observer = new IntersectionObserver(
-  (entries) => {
-    entries.forEach((entry) => {
+  entries => {
+    entries.forEach(entry => {
       if (entry.isIntersecting) {
-        entry.target.classList.add("visible");
+        entry.target.classList.add('visible');
       }
     });
   },
   { threshold: 0.1 },
 );
-document.querySelectorAll(".reveal").forEach((el) => observer.observe(el));
+document.querySelectorAll('.reveal').forEach(el => observer.observe(el));
 ```
 
 ```jsx
 // React — Framer Motion stagger (only if framer-motion is in package.json)
 <motion.ul variants={{ show: { transition: { staggerChildren: 0.05 } } }}>
   {items.map((item, i) => (
-    <motion.li key={item.id} variants={{ hidden: { opacity: 0, y: 20 }, show: { opacity: 1, y: 0 } }} />
+    <motion.li
+      key={item.id}
+      variants={{ hidden: { opacity: 0, y: 20 }, show: { opacity: 1, y: 0 } }}
+    />
   ))}
 </motion.ul>
 ```

package/.agent/skills/workflow-optimizer/SKILL.md

@@ -20,6 +20,7 @@ scripts-binding:
 ## Mandatory Pre-Flight Context Inspection
 
 Before analyzing tool-calling logs or task efficiency, you MUST inspect:
+
 1. Tool Call Pattern Analysis table (Section 1) → Classify redundant reads, serial bottlenecks, and context dumps
 2. Parallelism Opportunity Detection (Section 2) → Verify read/write dependency rules for batch tool calls
 3. Efficiency Score formula (Section 105) → Compute actual vs optimal call ratios accurately

package/.agent/skills/zero-trust-passkeys/SKILL.md

@@ -0,0 +1,90 @@
+---
+name: zero-trust-passkeys
+description: Modern passwordless authentication using WebAuthn, FIDO2 biometric passkeys, SimpleWebAuthn v13+, Conditional UI (Passkey Autofill), and Zero-Trust security.
+tools: Read, Grep, Glob, Edit, Write
+version: 3.0.0
+last-updated: 2026-08-05
+script: .agent/scripts/security_scan.js
+scripts-binding:
+  - .agent/scripts/security_scan.js
+skills:
+  - authentication-best-practices
+  - backend-security-expert
+  - frontend-security-expert
+---
+
+# Zero-Trust Passkeys & WebAuthn (SimpleWebAuthn v13+)
+
+## Mandatory Pre-Flight Context Inspection
+
+Before implementing auth flows:
+
+1. Conditional UI (Passkey Autofill) → Use `useBrowserAutofill: true` and `autocomplete="username webauthn"` for seamless form autofill
+2. Feature Detection & Abort Signals → Check `isConditionalMediationAvailable()` and manage cancellation via `AbortController`
+3. Discoverable Credentials → Ensure `userVerification` and resident key options are enabled on registration
+
+## Client-Side Passkey Autofill Pattern (SimpleWebAuthn v13 Browser)
+
+```typescript
+import { startAuthentication, isConditionalMediationAvailable } from '@simplewebauthn/browser';
+
+export async function initConditionalPasskeyAutofill(abortSignal: AbortSignal) {
+  const isAvailable = await isConditionalMediationAvailable();
+  if (!isAvailable) return;
+
+  try {
+    // 1. Fetch options from server
+    const res = await fetch('/api/auth/generate-authentication-options');
+    const options = await res.json();
+
+    // 2. Trigger browser native autofill dropdown
+    const credential = await startAuthentication({
+      optionsJSON: options,
+      useBrowserAutofill: true,
+    });
+
+    // 3. Send response to server for verification
+    await fetch('/api/auth/verify-authentication', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify(credential),
+    });
+  } catch (err: any) {
+    if (err.name !== 'AbortError') console.error('Passkey autofill error:', err);
+  }
+}
+```
+
+## Server Verification Pattern (SimpleWebAuthn v13 Server)
+
+```typescript
+import {
+  verifyAuthenticationResponse,
+  generateAuthenticationOptions,
+} from '@simplewebauthn/server';
+
+export async function verifyPasskeyAuth(
+  body: any,
+  expectedChallenge: string,
+  userPublicKey: Uint8Array,
+) {
+  const verification = await verifyAuthenticationResponse({
+    response: body,
+    expectedChallenge,
+    expectedOrigin: process.env.APP_ORIGIN!,
+    expectedRPID: process.env.RP_ID!,
+    credential: {
+      id: body.id,
+      publicKey: userPublicKey,
+      counter: body.counter || 0,
+    },
+  });
+
+  return verification.verified;
+}
+```
+
+## 🛑 Verification-Before-Completion (VBC) Protocol
+
+- Verify input tags have `autocomplete="username webauthn"`.
+- Test passkey autofill flow with `AbortController` cancellation.