tribunal-kit 6.0.1 → 7.0.0

package/.agent/workflows/migrate.md

@@ -22,6 +22,7 @@ $ARGUMENTS
 ## Mandatory Pre-Flight Context Inspection
 
 Before running framework upgrades, major dependency bumps, or database migrations, you MUST inspect:
+
 1. Dependency Compatibility Matrix (`dependency_analyzer.js`) → Verify target version peer dependencies and breaking changes
 2. Database Expand-and-Contract Plan (`schema_validator.js`) → Ensure database column changes add new fields before dropping old ones
 3. Rollback Protocol Verification → Test local rollback procedure (e.g. SQLite backup or DB transaction revert) before applying migration

package/.agent/workflows/minimal.md

@@ -20,6 +20,7 @@ $ARGUMENTS
 ## Mandatory Pre-Flight Context Inspection
 
 Before proposing any code change, you MUST evaluate the **10 Core Governance Questions**:
+
 1. Does anything need to change? (`NO_CHANGE`)
 2. Does the repository already solve this? (`REUSE`)
 3. Does an existing function, component, utility, service, or abstraction solve it? (`REUSE`)
@@ -35,19 +36,20 @@ Before proposing any code change, you MUST evaluate the **10 Core Governance Que
 
 ## Sub-Commands
 
-| Command | Description |
-| :--- | :--- |
-| `/minimal` | Analyze requested implementation and determine smallest viable change footprint |
-| `/minimal-review` | Review proposed change diff for unnecessary complexity and file proliferation |
-| `/change-budget` | Display estimated Change Budget (files added/modified, lines, deps, abstractions) |
-| `/complexity-audit` | Audit proposal for 14 standardized complexity flags and overengineering patterns |
-| `/reuse-check` | Search repository for existing functions, symbols, and utilities before creating code |
+| Command             | Description                                                                           |
+| :------------------ | :------------------------------------------------------------------------------------ |
+| `/minimal`          | Analyze requested implementation and determine smallest viable change footprint       |
+| `/minimal-review`   | Review proposed change diff for unnecessary complexity and file proliferation         |
+| `/change-budget`    | Display estimated Change Budget (files added/modified, lines, deps, abstractions)     |
+| `/complexity-audit` | Audit proposal for 14 standardized complexity flags and overengineering patterns      |
+| `/reuse-check`      | Search repository for existing functions, symbols, and utilities before creating code |
 
 ---
 
 ## Decision Order Hierarchy
 
 Evaluate solutions strictly in this order:
+
 ```
 NO_CHANGE ➔ REUSE ➔ CONFIGURE ➔ DELETE ➔ MODIFY ➔ EXTEND ➔ CREATE
 ```

package/.agent/workflows/orchestrate.md

@@ -21,6 +21,7 @@ $ARGUMENTS
 ## Mandatory Pre-Flight Context Inspection
 
 Before dispatching multi-agent orchestrations or parallel sub-task workers, you MUST inspect:
+
 1. Orchestrator Payload Validator (`swarm_dispatcher.js`) → Validate subagent payload contracts and JSON schema before fan-out
 2. Context Window Budget Allocation → Provide scoped `context_summary` per worker; ban dumping full conversation history to workers
 3. Fan-In Synthesis & Human Gate → Collect all worker outputs via `Promise.allSettled()` pattern and present unified synthesis before writing disk changes

package/.agent/workflows/performance-benchmarker.md

@@ -21,6 +21,7 @@ $ARGUMENTS
 ## Mandatory Pre-Flight Context Inspection
 
 Before running performance benchmarks or capturing latency metrics, you MUST inspect:
+
 1. Target App Environment & Build Command (`package.json`) → Confirm production build output and dev/preview server URL
 2. Benchmark Scripts Availability (`.agent/scripts/bundle_analyzer.js`) → Verify automated bundle and latency measurement tooling
 3. Before/After Metric Recording Constraint → Require side-by-side metric tables (LCP, CLS, INP, TTFB, Bundle Size) for every benchmark pass

package/.agent/workflows/pipeline.md

@@ -22,18 +22,19 @@ $ARGUMENTS
 ## Mandatory Pre-Flight Context Inspection
 
 Before running 3-pass pipeline generation, you MUST inspect:
+
 1. Pipeline Engine Script (`.agent/scripts/pipeline_engine.js`) → Verify availability and options (`--task`, `--file`, `--phase`)
 2. Context Token Allocation -> Keep Pass 2 builder prompt under 2,500 tokens (loading max 3 essential skill key-rules)
 3. Zero-LLM Pass 3 Validator → Run deterministic security, lint, and type checks on generated code prior to Human Gate submission
 
 ## When to Use /pipeline
 
-| Use `/pipeline` when...                         | Use something else when...                     |
-| :---------------------------------------------- | :--------------------------------------------- |
-| Code generation quality is the top priority     | Quick single-line fix → direct edit            |
-| Context window saturation is causing weak output | Need full tribunal review → `/generate`        |
-| Building UI components, APIs, or complex logic  | Exploring options → `/brainstorm`              |
-| You want maximum LLM attention on code synthesis | Planning architecture → `/plan`                |
+| Use `/pipeline` when...                          | Use something else when...              |
+| :----------------------------------------------- | :-------------------------------------- |
+| Code generation quality is the top priority      | Quick single-line fix → direct edit     |
+| Context window saturation is causing weak output | Need full tribunal review → `/generate` |
+| Building UI components, APIs, or complex logic   | Exploring options → `/brainstorm`       |
+| You want maximum LLM attention on code synthesis | Planning architecture → `/plan`         |
 
 ---
 
@@ -65,6 +66,7 @@ Output: Structured spec JSON with task_type, stack, essential_skills, and constr
 ## Phase 2 — Build (Focused Generation)
 
 Assembles a minimal prompt containing ONLY:
+
 - The spec from Phase 1
 - 2-3 essential skill key-rules (condensed)
 - Target file content (if modifying existing code)
@@ -74,6 +76,7 @@ node .agent/scripts/pipeline_engine.js --task "$TASK" --file "$FILE" --phase bui
 ```
 
 **What is NOT in the prompt (saving ~10,000 tokens):**
+
 - ❌ Full GEMINI.md master rules
 - ❌ Agent persona definitions
 - ❌ Tribunal gate rules
@@ -94,6 +97,7 @@ node .agent/scripts/pipeline_engine.js --phase validate --code ./output.tsx
 ```
 
 Checks:
+
 - ✅ OWASP security patterns (eval, innerHTML, hardcoded secrets, SQL injection)
 - ✅ TypeScript `any` usage
 - ✅ Empty catch blocks
@@ -111,6 +115,7 @@ node .agent/scripts/pipeline_engine.js --task "$TASK" --file "$FILE" --output re
 ```
 
 Or in dry-run mode:
+
 ```bash
 node .agent/scripts/pipeline_engine.js --task "$TASK" --file "$FILE" --dry-run
 ```
@@ -131,25 +136,25 @@ node .agent/scripts/pipeline_engine.js --task "$TASK" --file "$FILE" --dry-run
 
 ## Comparison: /generate vs /pipeline
 
-| Dimension                     | `/generate` (current) | `/pipeline` (new)       |
-| :---------------------------- | :-------------------- | :---------------------- |
-| System prompt tokens          | ~12,000–18,000        | ~2,500 (Pass 2)         |
-| % context for actual task     | ~11%                  | ~75%                    |
-| Governance overhead           | ~89%                  | ~25%                    |
-| Post-gen validation           | LLM-based (expensive) | Deterministic (free)    |
-| Skills loaded per generation  | 6–10                  | 2–3                     |
-| Self-healing retry            | Full re-generation    | Targeted feedback loop  |
-| Backward compatibility        | N/A                   | 100% (additive)         |
+| Dimension                    | `/generate` (current) | `/pipeline` (new)      |
+| :--------------------------- | :-------------------- | :--------------------- |
+| System prompt tokens         | ~12,000–18,000        | ~2,500 (Pass 2)        |
+| % context for actual task    | ~11%                  | ~75%                   |
+| Governance overhead          | ~89%                  | ~25%                   |
+| Post-gen validation          | LLM-based (expensive) | Deterministic (free)   |
+| Skills loaded per generation | 6–10                  | 2–3                    |
+| Self-healing retry           | Full re-generation    | Targeted feedback loop |
+| Backward compatibility       | N/A                   | 100% (additive)        |
 
 ---
 
 ## After /pipeline — Next Steps
 
-| Outcome                       | Next Command                        |
-| :---------------------------- | :---------------------------------- |
-| Code generated, needs review  | → `/review` for human audit         |
-| Code has issues after retry   | → `/generate` with full tribunal    |
-| Code passed, ready to test    | → `/test` for test generation       |
-| Code passed, ready to deploy  | → `/deploy` with pre-flight checks  |
+| Outcome                      | Next Command                       |
+| :--------------------------- | :--------------------------------- |
+| Code generated, needs review | → `/review` for human audit        |
+| Code has issues after retry  | → `/generate` with full tribunal   |
+| Code passed, ready to test   | → `/test` for test generation      |
+| Code passed, ready to deploy | → `/deploy` with pre-flight checks |
 
 ---

package/.agent/workflows/plan.md

@@ -20,6 +20,7 @@ $ARGUMENTS
 ## Mandatory Pre-Flight Context Inspection
 
 Before drafting implementation plans or technical blueprints, you MUST inspect:
+
 1. Workspace Context & Dependencies (`package.json`, `tsconfig.json`) → Confirm current stack capabilities and path mappings
 2. Existing Architecture & Directory Layout → Review current module boundaries to prevent redundant architectural patterns
 3. Zero Code Modification Rule → Restrict outputs in `/plan` mode to research, architectural design, and plan artifact generation; ban code generation before Plan approval

package/.agent/workflows/preview.md

@@ -20,6 +20,7 @@ $ARGUMENTS
 ## Mandatory Pre-Flight Context Inspection
 
 Before managing dev server lifecycle or starting preview servers, you MUST inspect:
+
 1. Workspace Dev Script Configuration (`package.json`) → Verify `npm run dev` or equivalent start script and framework server port
 2. Environment Configuration (`.env`) → Check port bindings and dev server host configs
 3. Dev Server Lifecycle Script (`.agent/scripts/auto_preview.js`) → Use automated script for process management, port collision detection, and health checks

package/.agent/workflows/refactor.md

@@ -22,6 +22,7 @@ $ARGUMENTS
 ## Mandatory Pre-Flight Context Inspection
 
 Before executing structural refactoring or extracting interfaces, you MUST inspect:
+
 1. Complete Dependent Map (Grep Importers) → Identify every file importing the target module before touching a single line
 2. Baseline Test Suite Verification (`test_runner.js`) → Ensure all unit and integration tests pass BEFORE initiating refactor steps
 3. Observable Behavior Preservation → Enforce zero change in public function behavior or API contracts; verify tests pass cleanly after every step
@@ -137,14 +138,14 @@ Rolling forward with broken tests is not refactoring — it's breaking code.
 
 ```typescript
 // Before: inline logic in handler
-app.post("/orders", async (req, res) => {
+app.post('/orders', async (req, res) => {
   const discount = amount > 100 ? amount * 0.9 : amount; // inline
   // ...
 });
 
 // After: extracted pure function with tests
 const applyDiscount = (amount: number): number => (amount > 100 ? amount * 0.9 : amount);
-app.post("/orders", async (req, res) => {
+app.post('/orders', async (req, res) => {
   const discount = applyDiscount(amount); // single responsibility
   // ...
 });

package/.agent/workflows/review-ai.md

@@ -21,6 +21,7 @@ $ARGUMENTS
 ## Mandatory Pre-Flight Context Inspection
 
 Before auditing LLM integrations, prompt templates, or AI API calls, you MUST inspect:
+
 1. Target AI Code & SDK Manifests (`package.json`) → Verify official AI SDK versions (Vercel AI SDK `ai`, `@langchain/core`, `openai`, `@google/genai`)
 2. Prompt Injection Boundary Check → Confirm user inputs are strictly passed via message roles or delimited blocks; ban string concatenation into system prompts
 3. 3-Reviewer AI Integration Gate → Run ai-code-reviewer, logic-reviewer, and security-auditor before approving AI code diffs
@@ -94,12 +95,12 @@ All model names should be in environment variables, not hardcoded.
 
 ```typescript
 // ❌ CRITICAL: User input in system prompt
-messages: [{ role: "system", content: `Help with: ${userQuery}` }];
+messages: [{ role: 'system', content: `Help with: ${userQuery}` }];
 
 // ✅ SAFE: Strict role separation
 messages: [
-  { role: "system", content: "You are a helpful product assistant." },
-  { role: "user", content: userQuery },
+  { role: 'system', content: 'You are a helpful product assistant.' },
+  { role: 'user', content: userQuery },
 ];
 
 // ✅ SAFE: When injection context unavoidable — explicit delimiter

package/.agent/workflows/review.md

@@ -21,6 +21,7 @@ $ARGUMENTS
 ## Mandatory Pre-Flight Context Inspection
 
 Before auditing code for hallucinations or structural flaws, you MUST inspect:
+
 1. Target Source Code & Dependent Modules → Read target files and their import declarations
 2. Package Manifest (`package.json`) → Cross-reference imported packages against installed dependencies
 3. Pure Read-Only Constraint → Prohibit any file mutations or generation; output findings in structured audit tables strictly

package/.agent/workflows/session.md

@@ -20,6 +20,7 @@ $ARGUMENTS
 ## Mandatory Pre-Flight Context Inspection
 
 Before saving, restoring, or clearing session state snapshots, you MUST inspect:
+
 1. Session Manager Executable (`.agent/scripts/session_manager.js`) → Confirm script availability and snapshot parameters
 2. Active Session History -> Read latest snapshot metadata (`session_id`, active task, modified files, open decisions)
 3. Zero Context Loss Rule → Verify state snapshot contains explicit next steps and task status prior to terminating conversation

package/.agent/workflows/status.md

@@ -19,6 +19,7 @@ $ARGUMENTS
 ## Mandatory Pre-Flight Context Inspection
 
 Before rendering project status dashboards, you MUST inspect:
+
 1. Active Execution Ledger (`task.md`) → Read current wave progress, finished tasks, and active in-progress item
 2. Workspace Git Status (`git status`, `git diff --stat`) → List uncommitted edits and modified files
 3. Read-Only Constraint → Ban any file mutations or state updates during status reporting; report status strictly

package/.agent/workflows/strengthen-skills.md

@@ -21,6 +21,7 @@ $ARGUMENTS
 ## Mandatory Pre-Flight Context Inspection
 
 Before auditing or hardening skill definitions, you MUST inspect:
+
 1. Target Skill Directory Inventory (`.agent/skills/`) → List all skill folders and inspect `SKILL.md` frontmatter
 2. Guardrail Idempotency Check → Check if target `SKILL.md` already carries `## Mandatory Pre-Flight Context Inspection` or `## 🏛️ Tribunal Integration`; skip if present
 3. Skill Integrator Script (`.agent/scripts/skill_integrator.js`) → Run skill integrator script to update executable script bindings

package/.agent/workflows/super-prompt.md

@@ -19,6 +19,7 @@ $ARGUMENTS
 ## Mandatory Pre-Flight Context Inspection
 
 Before compiling prompts or running prompt compression, you MUST inspect:
+
 1. Target Input Request Text → Read target user request to strip conversational fillers
 2. Prompt Compiler Script (`.agent/scripts/prompt_compiler.js`) → Verify availability of local prompt compiler script
 3. Zero Token Overhead Principle → Ensure compilation executes locally without invoking LLM API calls

package/.agent/workflows/swarm.md

@@ -21,6 +21,7 @@ $ARGUMENTS
 ## Mandatory Pre-Flight Context Inspection
 
 Before decomposing goals into worker sub-tasks or triggering swarm execution, you MUST inspect:
+
 1. Swarm Dispatcher Validator (`.agent/scripts/swarm_dispatcher.js`) → Run payload validation script to ensure valid worker JSON payloads
 2. Non-Overlapping File Boundary Rule → Verify worker tasks target disjoint file sets to prevent git write conflicts during parallel execution
 3. `Promise.allSettled()` Fan-In Protocol → Collect all worker status reports and synthesize final deliverable before Human Gate confirmation
@@ -58,10 +59,21 @@ Every worker receives a structured JSON contract (not natural language):
   "task_id": "audit-auth-routes",
   "worker_type": "backend-specialist",
   "scope": "Audit all files in src/app/api/auth/ for security and type safety",
-  "files_to_read": ["src/app/api/auth/login/route.ts", "src/app/api/auth/register/route.ts", "src/middleware.ts"],
+  "files_to_read": [
+    "src/app/api/auth/login/route.ts",
+    "src/app/api/auth/register/route.ts",
+    "src/middleware.ts"
+  ],
   "files_to_write": [],
-  "context_summary": ["Next.js 15 App Router project", "Auth uses next-auth v5 (auth.ts pattern)", "Database: Prisma 6 on PostgreSQL"],
-  "constraints": ["Report findings only — do not modify files", "Report BLOCKED if you cannot determine auth pattern from provided files"],
+  "context_summary": [
+    "Next.js 15 App Router project",
+    "Auth uses next-auth v5 (auth.ts pattern)",
+    "Database: Prisma 6 on PostgreSQL"
+  ],
+  "constraints": [
+    "Report findings only — do not modify files",
+    "Report BLOCKED if you cannot determine auth pattern from provided files"
+  ],
   "output_format": {
     "status": "COMPLETE | BLOCKED | ERROR",
     "findings": ["list of specific issues found with file+line references"],

package/.agent/workflows/test.md

@@ -21,6 +21,7 @@ $ARGUMENTS
 ## Mandatory Pre-Flight Context Inspection
 
 Before generating test suites or executing test runners, you MUST inspect:
+
 1. Workspace Test Runner Configuration (`package.json`, `jest.config.js`, `vitest.config.ts`, `pytest.ini`) → Verify installed runner & test environment
 2. Target Module Code & Contracts → Inspect function signatures, parameters, exceptions, and return types
 3. 3-Case Coverage Requirement → Ensure test cases explicitly cover Happy Path, Error Handling Path, and Boundary Conditions before approving test files
@@ -111,16 +112,16 @@ The Tribunal rejects any test submission that does not cover ALL of:
 ### Unit Test (Vitest)
 
 ```typescript
-describe("[functionName]()", () => {
-  it("[happy path description]", () => {
+describe('[functionName]()', () => {
+  it('[happy path description]', () => {
     expect(fn(validInput)).toBe(expectedResult);
   });
 
-  it("returns [expected] when input is [edge case]", () => {
+  it('returns [expected] when input is [edge case]', () => {
     expect(fn(boundaryInput)).toBe(expectedBoundaryResult);
   });
 
-  it("throws [ErrorType] when [invalid condition]", () => {
+  it('throws [ErrorType] when [invalid condition]', () => {
     expect(() => fn(invalidInput)).toThrow(ExpectedError);
   });
 });
@@ -142,12 +143,12 @@ test('[user observable behavior]', async () => {
 ### E2E Test (Playwright)
 
 ```typescript
-test("[critical user path]", async ({ page }) => {
+test('[critical user path]', async ({ page }) => {
   // GIVEN: pre-authenticated (stored session — not login from UI every test)
   // WHEN: navigate and act
-  await page.goto("/checkout");
+  await page.goto('/checkout');
   // THEN: verify final state
-  await expect(page.getByText("Order confirmed")).toBeVisible();
+  await expect(page.getByText('Order confirmed')).toBeVisible();
 });
 ```
 

package/.agent/workflows/tribunal-backend.md

@@ -22,6 +22,7 @@ $ARGUMENTS
 ## Mandatory Pre-Flight Context Inspection
 
 Before auditing backend routes or server logic, you MUST inspect:
+
 1. Target Backend Source & Contracts → Read target route handlers, Server Actions, or controller methods
 2. Dependencies & Environment (`package.json`, `.env.example`) → Check backend framework versions, secret key placeholders, and ORM schemas
 3. 6-Reviewer Parallel Gate → Execute logic-reviewer, security-auditor, dependency-analyzer, type-safety, resilience-reviewer, and schema-reviewer before approving diffs
@@ -108,10 +109,10 @@ router.middleware(() => {}); // not a method — use app.use()
 router.beforeAll(() => {}); // not a method — use router.use()
 
 // ❌ Hono methods that don't exist
-app.middleware("/path", handler); // not valid — use app.use('/path', handler)
+app.middleware('/path', handler); // not valid — use app.use('/path', handler)
 
 // ❌ next-auth v4 patterns in v5 projects
-import { getServerSession } from "next-auth"; // v4 — use auth() from './auth' in v5
+import { getServerSession } from 'next-auth'; // v4 — use auth() from './auth' in v5
 
 // ❌ jwt.verify async form (it's synchronous)
 const payload = await jwt.verify(token, secret); // jwt.verify is NOT async

package/.agent/workflows/tribunal-cicd.md

@@ -0,0 +1,104 @@
+---
+description: CI/CD Pipeline & Workflow Tribunal. Runs Pipeline + Security + Dependency + Resilience reviewers. Use for GitHub Actions (.github/workflows/), GitLab CI (.gitlab-ci.yml), Dockerfiles, and deployment configs.
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 3.0.0
+last-updated: 2026-08-14
+required-skills:
+  - cicd-pro
+  - devops-engineer
+  - containerization-pro
+scripts-binding:
+  - .agent/scripts/cicd_validator.js
+  - .agent/scripts/security_scan.js
+  - .agent/scripts/dependency_analyzer.js
+---
+
+# /tribunal-cicd — Pipeline & Workflow Audit
+
+$ARGUMENTS
+
+---
+
+## Mandatory Pre-Flight Context Inspection
+
+Before auditing CI/CD configurations, you MUST inspect:
+
+1. Target Workflow Files (`.github/workflows/*.yml`, `.gitlab-ci.yml`, `Dockerfile`)
+2. Repository Secrets & OIDC Configuration (`id-token: write`, environment promotion rules)
+3. 5-Reviewer Parallel Gate: Execute `pipeline-reviewer`, `security-auditor`, `dependency-reviewer`, `resilience-reviewer`, and `precedence-reviewer`.
+
+---
+
+## When to Use /tribunal-cicd
+
+| Use `/tribunal-cicd` when...                  | Use something else when...                      |
+| :-------------------------------------------- | :---------------------------------------------- |
+| Writing or modifying GitHub Actions workflows | Application API endpoints → `/tribunal-backend` |
+| Authoring Dockerfiles or multi-stage builds   | Frontend React code → `/tribunal-frontend`      |
+| Setting up automated release pipelines        | Database schemas → `/tribunal-database`         |
+| Auditing CI pipeline security & secrets       | Maximum system-wide coverage → `/tribunal-full` |
+| Fixing broken CI builds or test matrices      | Diagnosing live runner failure logs → `/fix-ci` |
+
+---
+
+## Active Reviewers (Run in Parallel)
+
+### precedence-reviewer
+
+- Checks local repo Case Law for previously rejected pipeline patterns.
+
+### pipeline-reviewer
+
+- Deprecated action tags (`actions/checkout@v2`/`@v3` → `@v4`).
+- Missing concurrency mutex (`concurrency:` with `cancel-in-progress`).
+- Insecure triggers (`pull_request_target` with PR checkout).
+- Deterministic builds (`npm ci` vs `npm install`).
+- Step and runner timeout settings.
+
+### security-auditor
+
+- Script injection via unescaped context strings in inline bash.
+- Hardcoded credentials, plain text tokens, or missing secret references.
+- Excessive workflow-level permissions (e.g. `write-all`).
+- Insecure artifact uploads/downloads.
+
+### dependency-reviewer
+
+- Unpinned third-party community actions (missing SHA hash pinning).
+- Supply chain security vulnerabilities in container base images.
+
+### resilience-reviewer
+
+- Missing `if: failure()` alerting on deploy steps.
+- Missing rollback triggers on health check failures.
+- Unhandled matrix combinations or missing fallback retry logic.
+
+---
+
+## Verdict System
+
+```
+If ANY reviewer → ❌ REJECTED: code must be fixed before Human Gate
+If any reviewer → ⚠️ WARNING:  proceed with flagged items noted
+If all reviewers → ✅ APPROVED: present to Human Gate
+```
+
+---
+
+## Usage Examples
+
+```
+/tribunal-cicd .github/workflows/ci.yml
+/tribunal-cicd .github/workflows/deploy.yml
+/tribunal-cicd Dockerfile and deployment manifest
+```
+
+---
+
+## After /tribunal-cicd — Next Steps
+
+| Outcome                         | Next Command                                   |
+| :------------------------------ | :--------------------------------------------- |
+| All checks pass                 | → `/deploy` or commit and push                 |
+| Reviewers reject with fixes     | → Apply fixes, then run `/tribunal-cicd` again |
+| Live pipeline failure in GitHub | → `/fix-ci` with the failing runner logs       |

package/.agent/workflows/tribunal-database.md

@@ -21,6 +21,7 @@ $ARGUMENTS
 ## Mandatory Pre-Flight Context Inspection
 
 Before auditing database queries, migrations, or ORM transactions, you MUST inspect:
+
 1. ORM Schema Source of Truth (`prisma/schema.prisma` or SQL schema) → Verify active table schemas, indexes, and relations
 2. SQL Parameterization Inspection → Flag all raw SQL queries attempting string interpolation; enforce parameterized queries
 3. 3-Reviewer Database Gate → Execute logic-reviewer, security-auditor, and sql-pro before approving database modifications

package/.agent/workflows/tribunal-frontend.md

@@ -24,6 +24,7 @@ $ARGUMENTS
 ## Mandatory Pre-Flight Context Inspection
 
 Before auditing React components or frontend UI logic, you MUST inspect:
+
 1. Design Tokens & Styling Context (`globals.css`, `tailwind.config`) → Verify OKLCH color palettes, typography scale, and dark mode classes
 2. Active UI Skill Pack (`.agent/skills/ui-skill-packs/SKILL.md`) → Load mandatory UI skill pack (Pack 1: Foundations, Pack 2: Motion, Pack 3: Systems)
 3. 7-Reviewer Frontend Gate → Run logic, security, frontend-reviewer, type-safety, ui-ux-auditor, motion-reviewer, and visual-auditor before approving UI diffs
@@ -111,12 +112,12 @@ If all reviewers → ✅ APPROVED: Human Gate
 
 ```typescript
 // ❌ React 19: useFormState renamed to useActionState
-import { useFormState } from 'react';      // useFormState no longer exists in React 19
-import { useActionState } from 'react';    // Correct React 19 name
+import { useFormState } from 'react'; // useFormState no longer exists in React 19
+import { useActionState } from 'react'; // Correct React 19 name
 
 // ❌ Next.js 15: params and searchParams must be awaited
-const { id } = params;                    // WRONG — params is a Promise in Next.js 15
-const { id } = await params;             // CORRECT
+const { id } = params; // WRONG — params is a Promise in Next.js 15
+const { id } = await params; // CORRECT
 
 // ❌ Hook not valid in Server Component
 export default async function Page() {
@@ -124,8 +125,9 @@ export default async function Page() {
 }
 
 // ❌ Server Action missing 'use server'
-async function saveData(formData: FormData) {  // Without 'use server' — not a Server Action
-  'use server';                                // Must be FIRST line
+async function saveData(formData: FormData) {
+  // Without 'use server' — not a Server Action
+  'use server'; // Must be FIRST line
 }
 ```
 

package/.agent/workflows/tribunal-full.md

@@ -29,6 +29,7 @@ $ARGUMENTS
 ## Mandatory Pre-Flight Context Inspection
 
 Before launching the full 21-reviewer audit, you MUST inspect:
+
 1. Pending Code Modifications (`git diff` / modified files) → Inspect diffs across all domains (frontend, backend, database, mobile)
 2. Workspace Configuration Context (`package.json`, `tsconfig.json`, `tailwind.config`) → Verify project build contracts
 3. 21-Reviewer Synthesis Gate → Execute all 21 specialized reviewers in parallel; halt on any security violation or critical bug before Human Gate approval
@@ -93,7 +94,7 @@ Not all 21 reviewers produce meaningful findings on all code types. Active revie
 | AI LLM integration  | logic, security, ai-code, dependency                              |
 | Test file           | test-coverage, logic                                              |
 | React Native / Expo | mobile, logic, security, performance, ui-ux                       |
-| Next.js page        | logic, frontend, performance, accessibility, ui-ux                       |
+| Next.js page        | logic, frontend, performance, accessibility, ui-ux                |
 | Auth/JWT code       | security, logic, type-safety                                      |
 
 ---

package/.agent/workflows/tribunal-mobile.md

@@ -21,6 +21,7 @@ $ARGUMENTS
 ## Mandatory Pre-Flight Context Inspection
 
 Before auditing React Native, Expo, or native mobile code, you MUST inspect:
+
 1. Native Configuration Manifests (`app.json`, `app.config.js`, `package.json`) → Verify Expo SDK version, Reanimated dependencies, and permissions
 2. Gesture & 60fps Motion Rules → Enforce `react-native-reanimated` worklets on UI thread; ban JavaScript bridge layout thrashing
 3. 3-Reviewer Mobile Gate → Run logic-reviewer, security-auditor, and mobile-reviewer before approving mobile component diffs
@@ -93,19 +94,19 @@ If all reviewers → ✅ APPROVED: Human Gate
 const clamp = (val: number, min: number, max: number) => Math.min(Math.max(val, min), max);
 // ✅ Must have worklet directive
 const clamp = (val: number, min: number, max: number): number => {
-  "worklet";
+  'worklet';
   return Math.min(Math.max(val, min), max);
 };
 
 // ❌ Expo Router: navigate() was refactored in v4 — old API
-import { navigate } from "expo-router"; // Named export doesn't exist
+import { navigate } from 'expo-router'; // Named export doesn't exist
 // ✅ Current Expo Router v4
-import { router } from "expo-router";
-router.push("/products/123");
+import { router } from 'expo-router';
+router.push('/products/123');
 
 // ❌ React Native: StyleSheet.create doesn't eval functions
 const styles = StyleSheet.create({
-  box: { paddingTop: Platform.OS === "ios" ? 20 : 0 }, // Doesn't work in all contexts
+  box: { paddingTop: Platform.OS === 'ios' ? 20 : 0 }, // Doesn't work in all contexts
 });
 // ✅ Use Platform.select or dynamic style object
 const boxStyle = Platform.select({ ios: { paddingTop: 20 }, android: { paddingTop: 0 } });

package/.agent/workflows/tribunal-performance.md

@@ -21,6 +21,7 @@ $ARGUMENTS
 ## Mandatory Pre-Flight Context Inspection
 
 Before optimizing code or running performance reviews, you MUST inspect:
+
 1. Target Source & Heavy Import Inspection (`package.json`, `next.config.js`) → Identify heavy library imports (`moment`, full `lodash`) for tree-shaking
 2. Measured Baseline Metrics → Run `bundle_analyzer.js` or latency measurements; ban claiming performance improvements without measured proof
 3. 2-Reviewer Performance Gate → Run logic-reviewer and performance-optimizer before approving optimization diffs

package/.agent/workflows/tribunal-speed.md

@@ -21,6 +21,7 @@ $ARGUMENTS
 ## Mandatory Pre-Flight Context Inspection
 
 Before running a full-stack performance audit, you MUST inspect:
+
 1. Target Full-Stack File Map → Determine frontend components, Node.js server routes, and database models
 2. Max 5 AI Call Ceiling → Cap swarm executions to 3 parallel specialists + 1 synthesis step to prevent token explosion
 3. Ranked Impact Synthesis → Output findings strictly in a single unified table prioritized by user-facing latency impact