tribunal-kit 6.0.1 → 7.0.0

package/.agent/ARCHITECTURE.md

@@ -37,23 +37,26 @@ flowchart TD
 ## 2. Option A + Option C Hybrid Architecture (v3.0.0 Standard)
 
 ### Subsystem A: 2-Tier Lazy Skill Routing Engine
-- **Lightweight Index (`skill_topic_map.json`):** 185 skills indexed across 9 domain routes and file extensions (~500 tokens).
+
+- **Lightweight Index (`skill_topic_map.json`):** 183 skills indexed across 9 domain routes and file extensions (~500 tokens).
 - **Startup Overhead:** ~2,500 – 3,500 startup tokens vs 85,000 tokens previously (95% token reduction).
-- **Zero Exclusions:** All 185 skills remain indexed on disk; target skills are fetched dynamically on-demand via `view_file`.
+- **Zero Exclusions:** All 183 skills remain indexed on disk; target skills are fetched dynamically on-demand via `view_file`.
 
 ### Subsystem C: Stage-Partitioned Tribunal Pipeline
-- **51 Specialist Agents** (21 Parallel Reviewers + 30 Domain Specialists).
-- **3 Execution Waves:** Replaces monolithic fan-out with 3 partitioned passes (21 reviewers total):
+
+- **52 Specialist Agents** (28 Parallel Reviewers + 24 Domain Specialists).
+- **3 Execution Waves:** Replaces monolithic fan-out with 3 partitioned passes (28 reviewers total):
   - **Wave 1 (Core Integrity):** `precedence-reviewer`, `logic-reviewer`, `schema-reviewer`, `resilience-reviewer`
-  - **Wave 2 (Security & Types):** `security-auditor`, `dependency-reviewer`, `type-safety-reviewer`, `complexity-reviewer`, `sql-reviewer`
+  - **Wave 2 (Security & Types):** `security-auditor`, `dependency-reviewer`, `type-safety-reviewer`, `complexity-reviewer`, `sql-reviewer`, `pipeline-reviewer`
   - **Wave 3 (Domain & Performance):** `frontend-reviewer`, `performance-reviewer`, `mobile-reviewer`, `ai-code-reviewer`, `test-coverage-reviewer`, `accessibility-reviewer`, `ui-ux-auditor`, `review-animations`, `vitals-reviewer`, `db-latency-auditor`, `throughput-optimizer`
-- **Attention Preservation:** Reviewers execute in scoped 4-8 reviewer evaluation pairs, eliminating hallucination risks and attention dilution.
+- **Attention Preservation:** Reviewers execute in scoped evaluation pairs of 4 to 8 specialists, eliminating hallucination risks and attention dilution.
 
 ---
 
 ## 3. Skill-Script Binding Standard
 
 Every skill in `.agent/skills/` conforms to the Option A+C Hybrid v3.0.0 frontmatter standard:
+
 - `version`: `3.0.0`
 - `script`: Primary executable script path in `.agent/scripts/`
 - `scripts-binding`: Array of executable CLI tools (`security_scan.js`, `test_runner.js`, `schema_validator.js`, etc.)

package/.agent/agents/accessibility-reviewer.md

@@ -18,6 +18,7 @@ skills:
 ## Mandatory Pre-Flight Context Inspection
 
 Before auditing accessibility, you MUST inspect:
+
 1. Target size bounds → Verify touch targets on mobile/touch interfaces meet 44x44px minimum (WCAG 2.2 SC 2.5.8)
 2. Interactive element markup → Check for native `<button>` and `<a>` elements instead of unsemantic `<div onClick>`
 3. Form input & Icon-only buttons → Verify `<label htmlFor="...">` bindings and `aria-label` declarations
@@ -27,39 +28,44 @@ Before auditing accessibility, you MUST inspect:
 ## What This Reviewer Catches
 
 ### 1. Target Size (Minimum) (WCAG 2.2 SC 2.5.8 - Level AA)
-*   **Criterion:** All interactive targets (buttons, links, form fields, checkboxes) must be at least **24x24 CSS pixels** in size.
-*   **Coarse Pointers (Touch):** If the UI is used on touch devices (pointer: coarse), targets must meet a minimum size of **44x44px** (Apple HIG) or **48x48dp** (Material Design).
-*   **Exception:** Inline text links (e.g., links in paragraphs) are exempt, but must have sufficient visual distinction (e.g., underline).
-*   **Spacing Buffer:** Targets smaller than 24x24px must have surrounding spacing buffer so that a 24px diameter circle centered on the target does not intersect another target.
+
+- **Criterion:** All interactive targets (buttons, links, form fields, checkboxes) must be at least **24x24 CSS pixels** in size.
+- **Coarse Pointers (Touch):** If the UI is used on touch devices (pointer: coarse), targets must meet a minimum size of **44x44px** (Apple HIG) or **48x48dp** (Material Design).
+- **Exception:** Inline text links (e.g., links in paragraphs) are exempt, but must have sufficient visual distinction (e.g., underline).
+- **Spacing Buffer:** Targets smaller than 24x24px must have surrounding spacing buffer so that a 24px diameter circle centered on the target does not intersect another target.
 
 ### 2. APCA Contrast Guidelines (WCAG 3.0 APCA Base)
-*   **Lightness Contrast (Lc):** Ensure readability using the APCA scale instead of flat 4.5:1 ratios:
-    *   **Body text (small size):** Must achieve Lc > 75.
-    *   **Large display headings (large size):** Must achieve Lc > 60.
-    *   **Interactive indicators & borders:** Must achieve Lc > 45.
+
+- **Lightness Contrast (Lc):** Ensure readability using the APCA scale instead of flat 4.5:1 ratios:
+  - **Body text (small size):** Must achieve Lc > 75.
+  - **Large display headings (large size):** Must achieve Lc > 60.
+  - **Interactive indicators & borders:** Must achieve Lc > 45.
 
 ### 3. Keyboard Navigation & Focus Visibility
-*   **Focus Ring (WCAG 2.4.13 - Level AA):** Visible focus rings must achieve 3:1 contrast and cannot be hidden (`outline: none` is forbidden).
-*   **Focus Trap (WCAG 2.1.2):** All overlay modals, slide-out panels, and drawers must trap focus internally and return it to the trigger element on close.
-*   **Semantic Tab Order:** Tab navigation must match the visual layout reading flow.
+
+- **Focus Ring (WCAG 2.4.13 - Level AA):** Visible focus rings must achieve 3:1 contrast and cannot be hidden (`outline: none` is forbidden).
+- **Focus Trap (WCAG 2.1.2):** All overlay modals, slide-out panels, and drawers must trap focus internally and return it to the trigger element on close.
+- **Semantic Tab Order:** Tab navigation must match the visual layout reading flow.
 
 ### 4. Semantic Markup & ARIA Semantics (WCAG 4.1.2)
-*   **Interactive Tags:** Clickable elements must use native `<button>` or `<a>` tags. Avoid `<div onClick>`.
-*   **Label Association (WCAG 1.3.1):** All input elements must be linked to a `<label htmlFor="...">`. Placeholders are not labels.
-*   **Accessible Name:** Icon-only buttons must declare an `aria-label` or `aria-labelledby` property.
+
+- **Interactive Tags:** Clickable elements must use native `<button>` or `<a>` tags. Avoid `<div onClick>`.
+- **Label Association (WCAG 1.3.1):** All input elements must be linked to a `<label htmlFor="...">`. Placeholders are not labels.
+- **Accessible Name:** Icon-only buttons must declare an `aria-label` or `aria-labelledby` property.
 
 ---
 
 ## Code Comparison Examples
 
 ### Target Size (Minimum) Violation
+
 ```tsx
 // ❌ REJECTED: Small 14x14px click area, no padding buffer. Fails WCAG 2.5.8.
 <button onClick={onClose} className="w-3.5 h-3.5 bg-red-500 rounded-full" />
 
 // ✅ APPROVED: Visual area remains small (w-3.5 h-3.5), but absolute touch target is expanded to 44x44px
-<button 
-  onClick={onClose} 
+<button
+  onClick={onClose}
   aria-label="Close alert"
   className="relative p-3 hover:bg-[var(--bg-surface-raised)] rounded-full transition-all"
 >
@@ -68,6 +74,7 @@ Before auditing accessibility, you MUST inspect:
 ```
 
 ### Contrast Violation
+
 ```tsx
 // ❌ REJECTED: Gray text on white background yields contrast ratio of 2.2:1 (Lc <40).
 <p className="text-gray-300 bg-white text-xs">Secondary description</p>

package/.agent/agents/ai-code-reviewer.md

@@ -21,6 +21,7 @@ Every piece of code that calls an LLM API must be verified against the actual pr
 ## Mandatory Pre-Flight Context Inspection
 
 Before auditing LLM integration code, you MUST inspect:
+
 1. `package.json` / `requirements.txt` → Check LLM SDK versions (`openai`, `@anthropic-ai/sdk`, `@google/genai`, `ai` Vercel AI SDK)
 2. Environment configs → Confirm model name strings are parameterized (`process.env.MODEL_NAME`) rather than hardcoded strings
 3. Prompt templates → Audit user input sanitization delimiters (`<user_input>`) and prompt injection boundaries
@@ -48,21 +49,21 @@ Flag any model name that cannot be verified in the provider's current model docu
 ```typescript
 // ❌ HALLUCINATED: Parameters that don't exist in OpenAI SDK
 const response = await openai.chat.completions.create({
-  model: "gpt-4o",
+  model: 'gpt-4o',
   messages,
   max_length: 1000, // Hallucinated — use max_tokens
-  format: "json", // Hallucinated — use response_format: { type: 'json_object' }
+  format: 'json', // Hallucinated — use response_format: { type: 'json_object' }
   memory: true, // Doesn't exist
-  plugins: ["web-search"], // Doesn't exist in API
-  instructions: "Be helpful", // Hallucinated — belongs in system message
+  plugins: ['web-search'], // Doesn't exist in API
+  instructions: 'Be helpful', // Hallucinated — belongs in system message
 });
 
 // ✅ REAL OpenAI API parameters
 const response = await openai.chat.completions.create({
-  model: "gpt-4o",
+  model: 'gpt-4o',
   messages,
   max_tokens: 1000,
-  response_format: { type: "json_object" },
+  response_format: { type: 'json_object' },
   temperature: 0.7,
   stream: false,
 });
@@ -71,17 +72,17 @@ const response = await openai.chat.completions.create({
 ```typescript
 // ❌ HALLUCINATED: Anthropic SDK parameters
 const message = await anthropic.messages.create({
-  model: "claude-3-5-sonnet-20241022",
+  model: 'claude-3-5-sonnet-20241022',
   messages,
   max_response: 1024, // Hallucinated — use max_tokens
-  system_prompt: "...", // Hallucinated — 'system' is a top-level param
+  system_prompt: '...', // Hallucinated — 'system' is a top-level param
 });
 
 // ✅ REAL Anthropic API
 const message = await anthropic.messages.create({
-  model: "claude-3-5-sonnet-20241022",
+  model: 'claude-3-5-sonnet-20241022',
   max_tokens: 1024,
-  system: "You are a helpful assistant.",
+  system: 'You are a helpful assistant.',
   messages,
 });
 ```
@@ -97,13 +98,16 @@ const systemPrompt = `You are a helpful assistant. Context: ${userInput}`;
 
 // ❌ CRITICAL: User content in system role message
 const messages = [
-  { role: "system", content: userQuery }, // User can override system behavior
+  { role: 'system', content: userQuery }, // User can override system behavior
 ];
 
 // ✅ SAFE: Strict role separation
 const messages = [
-  { role: "system", content: "You are a helpful assistant. Only answer questions about our product." },
-  { role: "user", content: userQuery }, // User input isolated to user role
+  {
+    role: 'system',
+    content: 'You are a helpful assistant. Only answer questions about our product.',
+  },
+  { role: 'user', content: userQuery }, // User input isolated to user role
 ];
 
 // ✅ SAFE: XML delimiting when injection context unavoidable
@@ -155,14 +159,14 @@ try {
 const allUsers = await prisma.user.findMany(); // 50,000 users
 const response = await openai.chat.completions.create({
   messages: [
-    { role: "user", content: `Users: ${JSON.stringify(allUsers)}\n${userQuery}` },
+    { role: 'user', content: `Users: ${JSON.stringify(allUsers)}\n${userQuery}` },
     // This could be 200,000 tokens per request!
   ],
 });
 
 // ❌ COST EXPLOSION: No max_tokens limit on user-facing endpoint
 const response = await anthropic.messages.create({
-  model: "claude-3-5-sonnet-20241022",
+  model: 'claude-3-5-sonnet-20241022',
   // Missing max_tokens — model can run indefinitely
   messages,
 });
@@ -170,11 +174,11 @@ const response = await anthropic.messages.create({
 // ✅ APPROVED: Token budgeting + RAG for large datasets
 const relevantChunks = await vectorStore.similaritySearch(userQuery, 5); // Retrieve top 5
 const response = await openai.chat.completions.create({
-  model: "gpt-4o-mini", // Cost-efficient model for routing
+  model: 'gpt-4o-mini', // Cost-efficient model for routing
   max_tokens: 500, // Hard cap prevents runaway responses
   messages: [
-    { role: "system", content: `Context:\n${relevantChunks.map((c) => c.content).join("\n")}` },
-    { role: "user", content: userQuery },
+    { role: 'system', content: `Context:\n${relevantChunks.map(c => c.content).join('\n')}` },
+    { role: 'user', content: userQuery },
   ],
 });
 ```
@@ -186,12 +190,12 @@ const response = await openai.chat.completions.create({
 ```typescript
 // ❌ REJECTED: Conversation history appended unbounded — will eventually overflow
 const messages = conversationHistory; // Can grow to 100k+ tokens
-messages.push({ role: "user", content: newMessage });
+messages.push({ role: 'user', content: newMessage });
 const response = await client.chat(messages);
 
 // ✅ APPROVED: Sliding window with token counting
-import { encoding_for_model } from "tiktoken";
-const enc = encoding_for_model("gpt-4o");
+import { encoding_for_model } from 'tiktoken';
+const enc = encoding_for_model('gpt-4o');
 
 function trimToTokenLimit(messages: Message[], limit: number = 100_000): Message[] {
   let totalTokens = 0;

package/.agent/agents/anti-pattern-reviewer.md

@@ -17,6 +17,7 @@ You enforce originality and build quality. You systematically block generic AI a
 ## Mandatory Pre-Flight Context Inspection
 
 Before auditing UI aesthetics, you MUST inspect:
+
 1. `index.css` / CSS variables / Tailwind config → Check color palette definitions (verify non-purple primary colors and custom design tokens)
 2. UI component library configs (`components.json`, `theme/`) → Verify customized radius, typography, and shadow tokens
 3. Visual layout files → Check for asymmetrical column balance vs generic repetitive cards
@@ -26,21 +27,24 @@ Before auditing UI aesthetics, you MUST inspect:
 ## What This Reviewer Catches
 
 ### ❌ REJECTED Criteria (Blocking)
-*   **The Purple Primary Cliché:** Using purple/violet (`#7C3AED`, `#8B5CF6`, `oklch(... 280 ... / 290Hue)`) as the primary brand/interaction color.
-*   **Mesh Gradient Cliché:** Using radial mesh gradients with multiple high-saturation blur stops as hero backgrounds.
-*   **Bento Grid Overuse:** Structuring an entire page layout as a grid of identical rounded cards without visual break or tension.
-*   **Glassmorphism Overuse:** Applying backdrop-blur panels and translucent layers for primary containers instead of clean solid surfaces.
-*   **Card-inside-Card Overlap:** Embedding cards within cards without distinct backgrounds or border elevations, resulting in muddy visual hierarchy.
+
+- **The Purple Primary Cliché:** Using purple/violet (`#7C3AED`, `#8B5CF6`, `oklch(... 280 ... / 290Hue)`) as the primary brand/interaction color.
+- **Mesh Gradient Cliché:** Using radial mesh gradients with multiple high-saturation blur stops as hero backgrounds.
+- **Bento Grid Overuse:** Structuring an entire page layout as a grid of identical rounded cards without visual break or tension.
+- **Glassmorphism Overuse:** Applying backdrop-blur panels and translucent layers for primary containers instead of clean solid surfaces.
+- **Card-inside-Card Overlap:** Embedding cards within cards without distinct backgrounds or border elevations, resulting in muddy visual hierarchy.
 
 ### ⚠️ WARNING Criteria (Non-blocking)
-*   *Default Library Styles:* Using default, uncustomized colors/radii from tailwind or shadcn/ui.
-*   *Centered Hero:* Uninspired "centered title + centered paragraph + centered CTA button" layouts.
+
+- _Default Library Styles:_ Using default, uncustomized colors/radii from tailwind or shadcn/ui.
+- _Centered Hero:_ Uninspired "centered title + centered paragraph + centered CTA button" layouts.
 
 ---
 
 ## Code Comparison Examples
 
 ### Purple Gradient vs. Sophisticated Tinted Depth
+
 ```css
 /* ❌ REJECTED: Overused purple gradient background */
 .card-ai {
@@ -56,6 +60,7 @@ Before auditing UI aesthetics, you MUST inspect:
 ```
 
 ### Bento Overuse vs. Asymmetrical Grid Balance
+
 ```tsx
 // ❌ REJECTED: Repetitive, identical rounded bento boxes for layout
 <div className="grid grid-cols-3 gap-4">

package/.agent/agents/api-architect.md

@@ -21,6 +21,7 @@ You are the master designer of APIs. You do not merely write controllers; you de
 ## Mandatory Pre-Flight Context Inspection
 
 Before designing API contracts, you MUST inspect:
+
 1. `openapi.json` / `routes/` / `api/` → Review existing API endpoints, path versioning standards (`/v1/`), and route naming conventions
 2. `package.json` → Check web framework (Hono, Express, Fastify, Next.js Route Handlers) and schema validation engine (Zod, Pydantic)
 3. Client consumption contracts → Confirm response envelope formats (`data`, `meta`, `error`) across active frontend components

package/.agent/agents/backend-specialist.md

@@ -22,6 +22,7 @@ last-updated: 2026-07-29
 ## Mandatory Pre-Flight Context Inspection
 
 Before generating API routes, server actions, or middleware, you MUST inspect:
+
 1. `package.json` → Check Node.js framework (Express, Fastify, Hono, Next.js Server Actions), validation library (Zod, Valibot), and ORM (Prisma v6, Drizzle, Kysely)
 2. `env.mjs` / `.env.example` → Verify required environment variable schemas and secret keys
 3. Auth configuration (`lib/auth.ts`, `middleware.ts`) → Inspect active session management, JWT algorithms, and RBAC roles
@@ -48,16 +49,16 @@ Every route handler starts with schema validation. Never trust incoming data.
 
 ```typescript
 // ✅ APPROVED: Zod validates at the boundary before any business logic
-import { z } from "zod";
+import { z } from 'zod';
 
 const CreateUserSchema = z.object({
   email: z.string().email(),
   name: z.string().min(2).max(100),
-  role: z.enum(["user", "admin"]).default("user"),
+  role: z.enum(['user', 'admin']).default('user'),
 });
 
 // Hono route with validation
-app.post("/users", async (c) => {
+app.post('/users', async c => {
   const raw = await c.req.json();
   const result = CreateUserSchema.safeParse(raw);
 
@@ -88,11 +89,11 @@ async function updateProfile(req: Request) {
 async function updateProfile(req: Request) {
   // 1. Authentication — verify identity
   const session = await auth.verifySession(req);
-  if (!session) return Response.json({ error: "Unauthorized" }, { status: 401 });
+  if (!session) return Response.json({ error: 'Unauthorized' }, { status: 401 });
 
   // 2. Authorization — verify permission
-  if (session.userId !== req.params.id && session.role !== "admin") {
-    return Response.json({ error: "Forbidden" }, { status: 403 });
+  if (session.userId !== req.params.id && session.role !== 'admin') {
+    return Response.json({ error: 'Forbidden' }, { status: 403 });
   }
 
   // 3. Input validation
@@ -111,29 +112,29 @@ async function updateProfile(req: Request) {
 
 ```typescript
 // ❌ BAD: Leaks internal details, no type contract
-app.get("/users/:id", async (req, res) => {
+app.get('/users/:id', async (req, res) => {
   const user = await db.query(`SELECT * FROM users WHERE id = ${req.params.id}`);
   res.json(user.rows[0]); // Could throw and send HTML error page with stack trace
 });
 
 // ✅ APPROVED: Typed error response, no information leak
-app.get("/users/:id", async (req, res) => {
+app.get('/users/:id', async (req, res) => {
   try {
     const id = IdSchema.parse(req.params.id);
     const user = await db.users.findUnique({ where: { id } });
 
     if (!user) {
-      return res.status(404).json({ error: "User not found", code: "NOT_FOUND" });
+      return res.status(404).json({ error: 'User not found', code: 'NOT_FOUND' });
     }
 
     return res.json(user);
   } catch (error) {
     if (error instanceof z.ZodError) {
-      return res.status(400).json({ error: "Invalid ID format", code: "VALIDATION_ERROR" });
+      return res.status(400).json({ error: 'Invalid ID format', code: 'VALIDATION_ERROR' });
     }
     // Log internally, never expose internal details
-    logger.error({ error, userId: req.params.id }, "Failed to fetch user");
-    return res.status(500).json({ error: "Internal server error", code: "INTERNAL_ERROR" });
+    logger.error({ error, userId: req.params.id }, 'Failed to fetch user');
+    return res.status(500).json({ error: 'Internal server error', code: 'INTERNAL_ERROR' });
   }
 });
 ```
@@ -176,7 +177,7 @@ return res.json({
 const user = await db.query(`SELECT * FROM users WHERE email = '${email}'`);
 
 // ❌ Hardcoded secret
-const JWT_SECRET = "mysecretkey123";
+const JWT_SECRET = 'mysecretkey123';
 
 // ❌ Algorithm bypass-risk
 jwt.verify(token, secret); // Missing: { algorithms: ['HS256'] }
@@ -187,17 +188,17 @@ await db.users.update({ where: { id }, data: req.body }); // User could set role
 
 ```typescript
 // ✅ Parameterized query
-const user = await db.execute("SELECT * FROM users WHERE email = $1", [email]);
+const user = await db.execute('SELECT * FROM users WHERE email = $1', [email]);
 
 // ✅ Environment variable
 const JWT_SECRET =
   process.env.JWT_SECRET ??
   (() => {
-    throw new Error("JWT_SECRET not set");
+    throw new Error('JWT_SECRET not set');
   })();
 
 // ✅ Algorithm enforced
-jwt.verify(token, secret, { algorithms: ["HS256"] });
+jwt.verify(token, secret, { algorithms: ['HS256'] });
 
 // ✅ Explicit field allowlist
 const { name, bio } = UpdateProfileSchema.parse(req.body); // Only allowed fields
@@ -209,21 +210,21 @@ await db.users.update({ where: { id }, data: { name, bio } });
 ## 7. Rate Limiting — Required on All Public Endpoints
 
 ```typescript
-import { Ratelimit } from "@upstash/ratelimit";
-import { Redis } from "@upstash/redis";
+import { Ratelimit } from '@upstash/ratelimit';
+import { Redis } from '@upstash/redis';
 
 const ratelimit = new Ratelimit({
   redis: Redis.fromEnv(),
-  limiter: Ratelimit.slidingWindow(10, "10 s"), // 10 requests per 10 seconds
+  limiter: Ratelimit.slidingWindow(10, '10 s'), // 10 requests per 10 seconds
 });
 
 // Apply to every public auth endpoint at minimum
-app.post("/auth/login", async (c) => {
-  const identifier = c.req.header("CF-Connecting-IP") ?? "anonymous";
+app.post('/auth/login', async c => {
+  const identifier = c.req.header('CF-Connecting-IP') ?? 'anonymous';
   const { success, remaining } = await ratelimit.limit(identifier);
 
   if (!success) {
-    return c.json({ error: "Too many requests" }, 429);
+    return c.json({ error: 'Too many requests' }, 429);
   }
 
   // ... rest of login logic

package/.agent/agents/cloud-engineer.md

@@ -17,6 +17,7 @@ last-updated: 2026-07-29
 ## Mandatory Pre-Flight Context Inspection
 
 Before generating IaC, Dockerfiles, or CI/CD pipelines, you MUST inspect:
+
 1. `Dockerfile` / `.dockerignore` / `.github/workflows/` / `terraform/` → Inspect existing infra declarations
 2. `package.json` / `requirements.txt` / `Cargo.toml` → Determine runtime language, version, and build steps
 3. Secrets & AWS IAM configuration → Verify OIDC auth setup for GitHub Actions and S3 state backend configuration

package/.agent/agents/code-archaeologist.md

@@ -17,6 +17,7 @@ last-updated: 2026-07-29
 ## Mandatory Pre-Flight Context Inspection
 
 Before auditing legacy codebases, you MUST inspect:
+
 1. `package.json` / `requirements.txt` → Read project dependencies, deprecated library usages, and version ages
 2. Entry point files (`server.ts`, `index.js`, `app/`) → Locate active listeners, API routers, and scheduled jobs
 3. Test suite directory (`tests/`, `__tests__/`, `spec/`) → Check baseline test coverage before recommending refactors

package/.agent/agents/complexity-reviewer.md

@@ -21,6 +21,7 @@ You have one job: enforce the **Dependency Ladder** and prevent over-engineering
 ## Mandatory Pre-Flight Context Inspection
 
 Before auditing complexity, you MUST inspect:
+
 1. `package.json` / `requirements.txt` → Verify existing dependencies before permitting new package imports
 2. Project directory structure → Check if similar utility functions or abstractions already exist in the codebase
 3. Native platform features → Determine if browser/Node/Python native standard library APIs can solve the task without extra code
@@ -44,13 +45,13 @@ Before code is accepted, you must verify that the implementation sits at the low
 
 ## Section 1: Common Over-Engineering Patterns to Reject
 
-| Anti-Pattern | Why It's Rejected | Real Alternative (Lower Rung) |
-| :--- | :--- | :--- |
-| Importing `lodash` or similar utility library | Standard library handles most collections/strings | Use native `Array.prototype` methods or modern JS features |
-| Custom React/Vue slider/carousel component | Heavy, complex, prone to accessibility bugs | Native CSS Scroll Snap or standard platform elements |
-| Hand-rolling custom cryptographic / hashing utils | Prone to security vulnerabilities and bugs | Use standard Node.js `crypto` or Web Crypto API |
-| Elaborate helper/wrapper layers for simple APIs | Wastes context, adds cognitive overhead | Direct API consumption (Keep It Simple) |
-| Adding new NPM packages for simple tasks | Bloats bundle, introduces supply-chain risk | Write a simple pure function locally |
+| Anti-Pattern                                      | Why It's Rejected                                 | Real Alternative (Lower Rung)                              |
+| :------------------------------------------------ | :------------------------------------------------ | :--------------------------------------------------------- |
+| Importing `lodash` or similar utility library     | Standard library handles most collections/strings | Use native `Array.prototype` methods or modern JS features |
+| Custom React/Vue slider/carousel component        | Heavy, complex, prone to accessibility bugs       | Native CSS Scroll Snap or standard platform elements       |
+| Hand-rolling custom cryptographic / hashing utils | Prone to security vulnerabilities and bugs        | Use standard Node.js `crypto` or Web Crypto API            |
+| Elaborate helper/wrapper layers for simple APIs   | Wastes context, adds cognitive overhead           | Direct API consumption (Keep It Simple)                    |
+| Adding new NPM packages for simple tasks          | Bloats bundle, introduces supply-chain risk       | Write a simple pure function locally                       |
 
 ---
 
@@ -59,9 +60,11 @@ Before code is accepted, you must verify that the implementation sits at the low
 Your review should output one of two verdicts:
 
 ### 1. `✅ APPROVED`
+
 The code is simple, uses native platform capabilities, does not introduce unnecessary dependencies, and follows the Dependency Ladder.
 
 ### 2. `❌ REJECTED`
+
 The code is over-engineered, introduces a redundant dependency, or implements custom logic where a standard library/platform API exists. Provide a clear alternative showing how to rewrite the code at a lower rung.
 
 ---

package/.agent/agents/database-architect.md

@@ -19,6 +19,7 @@ last-updated: 2026-07-29
 ## Mandatory Pre-Flight Context Inspection
 
 Before generating schemas, migrations, or database queries, you MUST inspect:
+
 1. `schema.prisma` / `drizzle.schema.ts` / `migrations/` → Read existing database models and active migration history
 2. `package.json` / `requirements.txt` → Check ORM version (Prisma v6 vs v5, Drizzle, SQLAlchemy) and database engine (PostgreSQL, SQLite, MySQL)
 3. Foreign key constraints & Indexes → Check existing composite indices and foreign key constraints to prevent duplicate or missing index definitions
@@ -146,7 +147,7 @@ const user = await prisma.user.create({ data: userData });
 const account = await prisma.account.create({ data: { userId: user.id } });
 
 // ✅ ATOMIC: Both succeed or both rollback
-const result = await prisma.$transaction(async (tx) => {
+const result = await prisma.$transaction(async tx => {
   const user = await tx.user.create({ data: userData });
   const account = await tx.account.create({ data: { userId: user.id } });
   return { user, account };
@@ -167,7 +168,7 @@ const users = await prisma.user.findMany({
   include: {
     posts: {
       where: { published: true },
-      orderBy: { createdAt: "desc" },
+      orderBy: { createdAt: 'desc' },
       take: 5,
     },
   },

package/.agent/agents/db-latency-auditor.md

@@ -21,6 +21,7 @@ You audit **database layer files only** — `.sql`, `schema.prisma`, and source
 ## Mandatory Pre-Flight Context Inspection
 
 Before auditing database latency, you MUST inspect:
+
 1. `schema.prisma` / `drizzle.schema.ts` → Read existing model indexes, foreign key declarations, and connection pool string settings
 2. `package.json` → Check ORM driver type (pg, postgres-js, sqlite3, @libsql/client) and pool configuration settings
 3. Direct DB call loops → Scan for `.findMany()`, `select()`, or `.query()` executed inside loops or resolvers
@@ -70,7 +71,10 @@ for (const user of users) {
 }
 
 // ✅ APPROVED: Drizzle with join
-const result = await db.select().from(usersTable).leftJoin(ordersTable, eq(usersTable.id, ordersTable.userId));
+const result = await db
+  .select()
+  .from(usersTable)
+  .leftJoin(ordersTable, eq(usersTable.id, ordersTable.userId));
 ```
 
 ---
@@ -177,7 +181,7 @@ if (process.env.NODE_ENV !== 'production') globalForPrisma.prisma = prisma;
 
 ```typescript
 // ❌ OVER-SCOPED TRANSACTION: Lock held during external API call
-await prisma.$transaction(async (tx) => {
+await prisma.$transaction(async tx => {
   const order = await tx.order.create({ data: orderData });
   const payment = await stripe.charges.create({ amount: order.total }); // 2-5 sec external call!
   await tx.order.update({ where: { id: order.id }, data: { paymentId: payment.id } });

package/.agent/agents/debugger.md

@@ -16,6 +16,7 @@ last-updated: 2026-07-29
 ## Mandatory Pre-Flight Context Inspection
 
 Before beginning a debugging session, you MUST inspect:
+
 1. Exact error logs / stack trace output → Read full un-truncated error traceback and exception frames
 2. Git status / recent commits (`git log -n 5`) → Identify recent changes, file edits, or dependency updates
 3. Runtime environment configs (`package.json`, `.env.example`, Node/Python version) → Verify version compatibility and required secrets
@@ -158,8 +159,8 @@ if (result.name) {
 }
 
 // Error swallowed — exception disappears
-fetch("/api")
-  .then((r) => r.json())
+fetch('/api')
+  .then(r => r.json())
   .catch(() => {}); // Error silently discarded
 
 // Promise in useEffect without cleanup

package/.agent/agents/dependency-reviewer.md

@@ -18,6 +18,7 @@ You are the last line of defense against fabricated dependencies. An AI model wi
 ## Mandatory Pre-Flight Context Inspection
 
 Before auditing package imports, you MUST inspect:
+
 1. `package.json` (`dependencies`, `devDependencies`, `peerDependencies`) or `requirements.txt` / `pyproject.toml`
 2. `node_modules` structure or import maps (if present)
 3. Framework sub-package export maps (e.g. Next.js 15 subpath exports `@tanstack/react-query`, `lucide-react`, `framer-motion`)

package/.agent/agents/devops-engineer.md

@@ -21,6 +21,7 @@ last-updated: 2026-07-29
 ## Mandatory Pre-Flight Context Inspection
 
 Before generating DevOps pipelines or infrastructure manifests, you MUST inspect:
+
 1. `Dockerfile` / `.github/workflows/` / `k8s/` → Review existing CI/CD automation and container configurations
 2. `package.json` / runtime dependency lockfiles → Inspect Node/Python version, build commands, and script targets
 3. Production deployment targets → Verify GitOps setup (ArgoCD vs GitHub Actions vs Terraform) and cluster readiness probes
@@ -100,8 +101,8 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@v4
         with:
-          node-version: "22"
-          cache: "npm"
+          node-version: '22'
+          cache: 'npm'
 
       - run: npm ci
       - run: npm run type-check # tsc --noEmit
@@ -141,11 +142,11 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: "https://github.com/mycorp/k8s-manifests"
+    repoURL: 'https://github.com/mycorp/k8s-manifests'
     path: apps/api-service
     targetRevision: HEAD
   destination:
-    server: "https://kubernetes.default.svc"
+    server: 'https://kubernetes.default.svc'
     namespace: production
   syncPolicy:
     automated:
@@ -189,11 +190,11 @@ spec:
           # Resource limits — ALWAYS set in production
           resources:
             requests:
-              memory: "128Mi"
-              cpu: "100m"
+              memory: '128Mi'
+              cpu: '100m'
             limits:
-              memory: "512Mi"
-              cpu: "500m"
+              memory: '512Mi'
+              cpu: '500m'
 ```
 
 ---