tribunal-kit 8.0.0 → 9.0.1

package/.agents/skills/zero-trust-passkeys/SKILL.md

@@ -0,0 +1,156 @@
+---
+name: zero-trust-passkeys
+description: Use when Modern passwordless authentication using WebAuthn, FIDO2 biometric passkeys, SimpleWebAuthn v13+, Conditional UI (Passkey Autofill), and Zero-Trust security.
+version: 5.0.0
+last-updated: 2026-09-13
+skills:
+  - authentication-best-practices
+  - backend-security-expert
+  - frontend-security-expert
+tools: Read, Grep, Glob, Bash, Edit, Write
+scripts-binding:
+  - .agent/scripts/security_scan.js
+  - .agent/scripts/lint_runner.js
+  - .agent/scripts/verify_all.js
+---
+
+# Zero-Trust Passkeys & WebAuthn (SimpleWebAuthn v13+)
+
+## Mandatory Pre-Flight Context Inspection
+
+Before generating, refactoring, or reviewing code in the `zero-trust-passkeys` domain, inspect these 5 critical parameters:
+
+1. **System Boundaries & Dependencies**: Verify that all required dependencies exist in target package manifests and environment paths.
+2. **Runtime Context & Platform Invariants**: Confirm target platform constraints (Node.js, Browser, Mobile OS, Edge runtime) before applying APIs.
+3. **Execution Guardrails**: Identify potential side-effects, state mutations, and unhandled asynchronous exceptions.
+4. **Validation & Type Contracts**: Validate input data schemas and strict type constraints across all module interfaces.
+5. **Observability & Proof of Execution**: Ensure execution produces tangible verification signals (terminal output, tests, metrics).
+
+## Activation Boundaries
+
+- **Activate when:** Use when Modern passwordless authentication using WebAuthn, FIDO2 biometric passkeys, SimpleWebAuthn v13+, Conditional UI (Passkey Autofill), and Zero-Trust security.
+- **DO NOT activate when:** The task falls outside the `zero-trust-passkeys` domain or is managed by a different dedicated specialist.
+
+## 🔁 Multi-Pass Execution Protocol
+
+Execute all non-trivial tasks through this 7-pass cognitive loop:
+
+| Pass | Phase | Core Action |
+|:---|:---|:---|
+| **Pass 1** | **Understand** | Deconstruct the user's explicit objective, implicit requirements, and platform constraints. |
+| **Pass 2** | **Plan** | Decompose the task into smallest logical steps; map dependencies and required tool calls. |
+| **Pass 3** | **Execute** | Implement the solution with production-grade craft, zero placeholders, and strict typing. |
+| **Pass 4** | **Verify** | Run linters, unit tests, or compiler checks to validate structural correctness. |
+| **Pass 5** | **Attack** | Perform an adversarial review searching for edge-case failures, race conditions, and traps. |
+| **Pass 6** | **Improve** | Eliminate discovered friction, optimize performance, and harden error boundaries. |
+| **Pass 7** | **Quality Gate** | Enforce Verification-Before-Completion (VBC) with concrete terminal proof before finalizing. |
+
+---
+
+## 🛠️ Technical Architecture & Reference Recipes
+
+## Client-Side Passkey Autofill Pattern (SimpleWebAuthn v13 Browser)
+
+```typescript
+import { startAuthentication, isConditionalMediationAvailable } from '@simplewebauthn/browser';
+
+export async function initConditionalPasskeyAutofill(abortSignal: AbortSignal) {
+  const isAvailable = await isConditionalMediationAvailable();
+  if (!isAvailable) return;
+
+  try {
+    // 1. Fetch options from server
+    const res = await fetch('/api/auth/generate-authentication-options');
+    const options = await res.json();
+
+    // 2. Trigger browser native autofill dropdown
+    const credential = await startAuthentication({
+      optionsJSON: options,
+      useBrowserAutofill: true,
+    });
+
+    // 3. Send response to server for verification
+    await fetch('/api/auth/verify-authentication', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify(credential),
+    });
+  } catch (err: any) {
+    if (err.name !== 'AbortError') console.error('Passkey autofill error:', err);
+  }
+}
+```
+
+## Server Verification Pattern (SimpleWebAuthn v13 Server)
+
+```typescript
+import {
+  verifyAuthenticationResponse,
+  generateAuthenticationOptions,
+} from '@simplewebauthn/server';
+
+export async function verifyPasskeyAuth(
+  body: any,
+  expectedChallenge: string,
+  userPublicKey: Uint8Array,
+) {
+  const verification = await verifyAuthenticationResponse({
+    response: body,
+    expectedChallenge,
+    expectedOrigin: process.env.APP_ORIGIN!,
+    expectedRPID: process.env.RP_ID!,
+    credential: {
+      id: body.id,
+      publicKey: userPublicKey,
+      counter: body.counter || 0,
+    },
+  });
+
+  return verification.verified;
+}
+```
+
+---
+
+## 🚨 Edge-Case & Failure Mode Matrix
+
+| Scenario | Risk | Mitigation Strategy |
+|:---|:---|:---|
+| **Empty or Null Inputs** | Unhandled exception or unexpected rendering collapse | Enforce fallback guards, optional chaining, and explicit empty state handlers |
+| **Network Timeout / Latency** | Hanging operations or duplicate side-effects | Implement bounded abort controllers, exponential backoff, and idempotency keys |
+| **Concurrency / Race Conditions** | Stale state overwrite or inconsistent data mutations | Use atomic transactions, mutex locking, or cancel-on-resubmit controls |
+| **Invalid Schema / Malformed Payload** | Downstream runtime errors or security injection | Validate boundary payloads with Zod/Pydantic schemas prior to execution |
+| **Resource / Memory Saturation** | OOM errors, frame drops, or memory leaks | Clean up listeners, cancel active timers, and enforce pagination/virtualization |
+
+---
+
+## 🤖 LLM-Specific Traps Table
+
+| Anti-Pattern | What AI Commonly Does Wrong | What Is Actually Correct |
+|:---|:---|:---|
+| **Hardcoded Secret Pattern** | Committing API keys, tokens, or private salts into source code | Load credentials strictly via runtime environment variables and secret stores |
+| **Prompt Injection Surface** | Directly concatenating untrusted user input into LLM system prompts | Wrap user content in isolated delimiters and strip injection control sequences |
+| **Missing Authorization Check** | Relying only on authentication token presence without checking tenant/object RBAC | Verify user permissions against the specific target record ID before mutation |
+
+---
+
+## 🏛️ Tribunal Verification & Guardrails
+
+**Active Reviewers:** `security-auditor` · `penetration-tester` · `backend-security-expert`
+**Slash Command:** `/review` or `/tribunal-full`
+
+### ✅ Pre-Flight Self-Audit Checklist
+
+```
+✅ Are user inputs sanitized and treated as untrusted at system boundaries?
+✅ Are secrets loaded strictly via environment variables with zero hardcoding?
+✅ Is least-privilege enforcement active on APIs, tokens, and storage buckets?
+✅ Are prompt-injection delimiters and sanitizers wrapped around LLM inputs?
+✅ Did I verify encryption in transit and at rest for sensitive customer data?
+```
+
+### 🛑 Verification-Before-Completion (VBC) Protocol
+
+**CRITICAL:** You must follow a strict "evidence-based closeout" state machine.
+- ❌ **Forbidden:** Declaring a task complete because the output "looks correct."
+- ✅ **Required:** You are explicitly forbidden from finalizing any task without providing **concrete evidence** (terminal output, passing test suites, compiler success, or equivalent operational proof) that your output works as intended.

package/.claude-plugin/marketplace.json

@@ -0,0 +1,14 @@
+{
+  "name": "tribunal-kit-marketplace",
+  "owner": {
+    "name": "Harmitx7",
+    "email": "harmit@tribunalkit.com"
+  },
+  "plugins": [
+    {
+      "name": "tribunal-kit",
+      "source": "./",
+      "description": "Enterprise-grade governance layer and anti-hallucination engine for AI coding agents: 52 specialists, 28 parallel reviewers, Rust core, Subagent-Driven Development (SDD), and strict TDD workflows."
+    }
+  ]
+}

package/.claude-plugin/plugin.json

@@ -0,0 +1,26 @@
+{
+  "name": "tribunal-kit",
+  "description": "Enterprise-grade governance layer and anti-hallucination engine for AI coding agents: 52 specialists, 28 parallel reviewers, Rust core, Subagent-Driven Development (SDD), and strict TDD workflows.",
+  "version": "9.0.0",
+  "author": {
+    "name": "Harmitx7",
+    "email": "harmit@tribunalkit.com"
+  },
+  "homepage": "https://github.com/Harmitx7/tribunal-kit",
+  "repository": "https://github.com/Harmitx7/tribunal-kit",
+  "license": "MIT",
+  "keywords": [
+    "tribunal",
+    "governance",
+    "anti-hallucination",
+    "subagent-driven-development",
+    "skills",
+    "tdd",
+    "code-review",
+    "agents",
+    "rust-core",
+    "mcp"
+  ],
+  "skills": "./.agent/skills/",
+  "hooks": "./hooks/hooks.json"
+}

package/.codex-plugin/plugin.json

@@ -0,0 +1,45 @@
+{
+  "name": "tribunal-kit",
+  "version": "9.0.0",
+  "description": "Enterprise-grade governance layer and anti-hallucination engine: 52 specialists, 28 parallel reviewers, Rust core, Subagent-Driven Development (SDD), and strict TDD workflows.",
+  "author": {
+    "name": "Harmitx7",
+    "email": "harmit@tribunalkit.com",
+    "url": "https://github.com/Harmitx7/tribunal-kit"
+  },
+  "homepage": "https://github.com/Harmitx7/tribunal-kit",
+  "repository": "https://github.com/Harmitx7/tribunal-kit",
+  "license": "MIT",
+  "keywords": [
+    "tribunal",
+    "governance",
+    "anti-hallucination",
+    "subagent-driven-development",
+    "skills",
+    "planning",
+    "tdd",
+    "debugging",
+    "code-review",
+    "workflow"
+  ],
+  "skills": "./.agent/skills/",
+  "hooks": "./hooks/hooks.json",
+  "interface": {
+    "displayName": "Tribunal Kit",
+    "shortDescription": "Anti-hallucination governance, 28 specialist reviewers, and SDD for coding agents",
+    "longDescription": "Use Tribunal Kit to govern coding agents through Socratic brainstorming, bite-sized implementation planning, strict test-driven development, out-of-band context isolation, 28-specialist review waves, and persistent Case Law memory.",
+    "developerName": "Harmitx7",
+    "category": "Developer Tools",
+    "capabilities": [
+      "Interactive",
+      "Read",
+      "Write"
+    ],
+    "defaultPrompt": [
+      "Let's design and implement a new feature using Tribunal SDD.",
+      "Run a full Tribunal code audit on this repository."
+    ],
+    "websiteURL": "https://github.com/Harmitx7/tribunal-kit",
+    "brandColor": "#3B82F6"
+  }
+}

package/.cursor-plugin/plugin.json

@@ -0,0 +1,26 @@
+{
+  "name": "tribunal-kit",
+  "displayName": "Tribunal Kit",
+  "description": "Enterprise-grade governance layer and anti-hallucination engine: 52 specialists, 28 parallel reviewers, Rust core, Subagent-Driven Development (SDD), and strict TDD workflows.",
+  "version": "9.0.0",
+  "author": {
+    "name": "Harmitx7",
+    "email": "harmit@tribunalkit.com"
+  },
+  "homepage": "https://github.com/Harmitx7/tribunal-kit",
+  "repository": "https://github.com/Harmitx7/tribunal-kit",
+  "license": "MIT",
+  "keywords": [
+    "tribunal",
+    "governance",
+    "anti-hallucination",
+    "subagent-driven-development",
+    "skills",
+    "tdd",
+    "code-review",
+    "rust-core",
+    "cursor-rules"
+  ],
+  "skills": "./.agent/skills/",
+  "hooks": "./hooks/hooks-cursor.json"
+}

package/.devin-plugin/plugin.json

@@ -0,0 +1,14 @@
+{
+  "name": "tribunal-kit",
+  "version": "9.0.0",
+  "description": "Enterprise-grade governance layer and anti-hallucination engine for Devin: 52 specialists, 28 parallel reviewers, Rust core, and SDD workflows.",
+  "author": {
+    "name": "Harmitx7",
+    "email": "harmit@tribunalkit.com"
+  },
+  "homepage": "https://github.com/Harmitx7/tribunal-kit",
+  "repository": "https://github.com/Harmitx7/tribunal-kit",
+  "license": "MIT",
+  "skills": "./.agent/skills/",
+  "hooks": "./hooks/hooks.json"
+}

package/.hermes-plugin/__init__.py

@@ -0,0 +1,102 @@
+import os
+import re
+from pathlib import Path
+
+BOOTSTRAP_MARKER = "tribunal-kit:master-governance bootstrap for hermes"
+
+
+def _skills_dir() -> str:
+    """Locate the .agent/skills tree for either supported install layout."""
+    here = os.path.dirname(os.path.realpath(__file__))
+    candidates = (
+        os.path.realpath(os.path.join(here, "..", ".agent", "skills")),
+        os.path.realpath(os.path.join(here, ".agent", "skills")),
+        os.path.realpath(os.path.join(here, "..", "skills")),
+        os.path.realpath(os.path.join(here, "skills")),
+    )
+    for cand in candidates:
+        if os.path.isdir(cand) and os.path.isfile(os.path.join(cand, "clean-code", "SKILL.md")):
+            return cand
+    raise RuntimeError(
+        "tribunal-kit plugin: cannot find the .agent/skills/ tree "
+        f"(looked at {candidates})."
+    )
+
+
+def _rules_file() -> str:
+    here = os.path.dirname(os.path.realpath(__file__))
+    candidates = (
+        os.path.realpath(os.path.join(here, "..", ".agent", "rules", "GEMINI.md")),
+        os.path.realpath(os.path.join(here, ".agent", "rules", "GEMINI.md")),
+    )
+    for cand in candidates:
+        if os.path.isfile(cand):
+            return cand
+    return ""
+
+
+def _strip_frontmatter(content: str) -> str:
+    match = re.match(r"^---\n[\s\S]*?\n---\n([\s\S]*)$", content)
+    return (match.group(1) if match else content).strip()
+
+
+def _build_bootstrap(skills_dir: str) -> str:
+    rules_file = _rules_file()
+    body = ""
+    if rules_file and os.path.isfile(rules_file):
+        with open(rules_file, encoding="utf-8") as f:
+            body = _strip_frontmatter(f.read())
+    else:
+        body = "# Tribunal Master Governance\nEnforce strict TDD, out-of-band reviews, and 28-specialist waves."
+
+    tool_mapping = """## Hermes Tool Mapping for Tribunal-Kit
+When skills request actions, map them to Hermes tools:
+- Read files: `read_file(path)`
+- Write / edit files: `write_file(path, content)` or `patch_file(path, ...)`
+- Run shell commands: `exec(command)`
+- Invoke a skill: `skill_view("tribunal-kit:skill-name")` or inspect `skill-name/SKILL.md` directly.
+- Subagent / tasks: Use Hermes subagent delegation.
+- Tribunal CLI: `exec("tk sdd brief <plan> <task>")` or `exec("tk sdd diff <plan> <base> <head>")`."""
+
+    return (
+        f"<EXTREMELY_IMPORTANT>\n"
+        f"{BOOTSTRAP_MARKER}\n\n"
+        f"Tribunal Agent Kit Master Governance is active.\n"
+        f"You are governed by the strict rules and verification guardrails below. Follow them now.\n\n"
+        f"{body}\n\n"
+        f"## Loading Skills on Hermes\n\n"
+        f"Tribunal skills are registered with Hermes' native skill loader: "
+        f'invoke one with `skill_view("skill-name")` '
+        f'(for example `skill_view("tdd-workflow")`).\n'
+        f"Skills directory: `{skills_dir}`\n\n"
+        f"{tool_mapping}\n"
+        f"</EXTREMELY_IMPORTANT>"
+    )
+
+
+def register(ctx):
+    skills_dir = _skills_dir()
+    bootstrap = _build_bootstrap(skills_dir)
+
+    for name in sorted(os.listdir(skills_dir)):
+        skill_md = os.path.join(skills_dir, name, "SKILL.md")
+        if os.path.isfile(skill_md):
+            try:
+                ctx.register_skill(name, Path(skill_md))
+            except Exception:
+                pass
+
+    def pre_llm_call(
+        session_id=None,
+        user_message=None,
+        conversation_history=None,
+        is_first_turn=None,
+        model=None,
+        platform=None,
+        **kwargs,
+    ):
+        if is_first_turn:
+            return {"context": bootstrap}
+        return None
+
+    ctx.register_hook("pre_llm_call", pre_llm_call)

package/.hermes-plugin/plugin.yaml

@@ -0,0 +1,6 @@
+name: tribunal-kit
+version: 9.0.0
+description: Tribunal Agent Kit governance, 28-reviewer waves, and Subagent-Driven Development engine for Hermes Agent
+author: Harmitx7
+provides_hooks:
+  - pre_llm_call

package/.kimi-plugin/plugin.json

@@ -0,0 +1,38 @@
+{
+  "name": "tribunal-kit",
+  "version": "9.0.0",
+  "description": "Multi-agent coding governance, 28-specialist review waves, and Subagent-Driven Development (SDD) engine.",
+  "author": {
+    "name": "Harmitx7",
+    "email": "harmit@tribunalkit.com"
+  },
+  "homepage": "https://github.com/Harmitx7/tribunal-kit",
+  "license": "MIT",
+  "keywords": [
+    "tribunal",
+    "subagent-driven-development",
+    "code-review",
+    "skills",
+    "planning",
+    "tdd",
+    "debugging",
+    "governance"
+  ],
+  "skills": "./skills/",
+  "sessionStart": {
+    "skill": "verification-before-completion"
+  },
+  "skillInstructions": "Kimi Code tool mapping for Tribunal-Kit:\n\n- When Tribunal rules or skills require user clarification or Socratic gates, call Kimi Code's `AskUserQuestion` tool with concrete options. Put the recommended option first.\n- When a skill refers to `TodoWrite`, use Kimi Code's `TodoList` tool.\n- When running Subagent-Driven Development (`/sdd`) or reviewing tasks, use Kimi Code's `Agent` tool with `subagent_type: \"coder\"` for implementation and reviewer subagents. Use `subagent_type: \"explore\"` for read-only codebase exploration.\n- Keep implementers isolated: implementers read `.tribunal/sdd/<plan>/task-<N>-brief.md` and write `task-<N>-report.md`, returning <15 lines status.\n- Reviewers inspect `.tribunal/sdd/<plan>/review-<base>..<head>.diff` out-of-band and emit structured verdicts.\n- Enforce the Iron Law of TDD and Verification-Before-Completion on every change.",
+  "interface": {
+    "displayName": "Tribunal Kit",
+    "shortDescription": "28-Specialist Review Waves & Subagent-Driven Development (SDD) Engine",
+    "longDescription": "Tribunal Kit provides institutional-grade code review, anti-hallucination guardrails, Subagent-Driven Development (SDD), and automated testing pipelines for AI coding agents.",
+    "developerName": "Harmitx7",
+    "capabilities": [
+      "Interactive",
+      "Read",
+      "Write"
+    ],
+    "websiteURL": "https://github.com/Harmitx7/tribunal-kit"
+  }
+}

package/.opencode/INSTALL.md

@@ -0,0 +1,41 @@
+# Installing Tribunal Kit for OpenCode
+
+## Prerequisites
+
+- [OpenCode.ai](https://opencode.ai) installed
+
+## Installation
+
+Add Tribunal Kit to the `plugin` array in your `opencode.json` (global or project-level):
+
+```json
+{
+  "plugin": ["tribunal-kit@latest"]
+}
+```
+
+Or install from git:
+
+```json
+{
+  "plugin": ["tribunal-kit@git+https://github.com/Harmitx7/tribunal-kit.git"]
+}
+```
+
+Restart OpenCode. The plugin registers all 185 Tribunal skills and auto-injects Master Governance rules on session start.
+
+## Usage
+
+Use OpenCode's native `skill` tool:
+
+```
+use skill tool to list skills
+use skill tool to load tdd-workflow
+use skill tool to load verification-before-completion
+```
+
+## Subagent-Driven Development (SDD)
+
+OpenCode delegates tasks to subagents via the `task` tool:
+- Implementers execute tasks following `.tribunal/sdd/<plan>/task-<N>-brief.md`.
+- Reviewers evaluate diffs via `tk sdd diff` out-of-band.

package/.opencode/plugins/tribunal.js

@@ -0,0 +1,101 @@
+/**
+ * Tribunal Kit plugin for OpenCode.ai
+ *
+ * Injects Tribunal Master Governance bootstrap context via message transform.
+ * Auto-registers skills directory via config hook (no symlinks needed).
+ */
+
+import path from 'path';
+import fs from 'fs';
+import { fileURLToPath } from 'url';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+
+const extractAndStripFrontmatter = (content) => {
+  const match = content.match(/^---\n([\s\S]*?)\n---\n([\s\S]*)$/);
+  if (!match) return { frontmatter: {}, content };
+
+  const frontmatterStr = match[1];
+  const body = match[2];
+  const frontmatter = {};
+
+  for (const line of frontmatterStr.split('\n')) {
+    const colonIdx = line.indexOf(':');
+    if (colonIdx > 0) {
+      const key = line.slice(0, colonIdx).trim();
+      const value = line.slice(colonIdx + 1).trim().replace(/^["']|["']$/g, '');
+      frontmatter[key] = value;
+    }
+  }
+
+  return { frontmatter, content: body };
+};
+
+let _bootstrapCache = undefined;
+
+export const TribunalPlugin = async ({ client: _client, directory: _directory } = {}) => {
+  const packageRoot = path.resolve(__dirname, '../..');
+  const tribunalSkillsDir = path.join(packageRoot, '.agent', 'skills');
+  const rulesPath = path.join(packageRoot, '.agent', 'rules', 'GEMINI.md');
+
+  const getBootstrapContent = () => {
+    if (_bootstrapCache !== undefined) return _bootstrapCache;
+
+    let rulesContent = '';
+    if (fs.existsSync(rulesPath)) {
+      const raw = fs.readFileSync(rulesPath, 'utf8');
+      const { content } = extractAndStripFrontmatter(raw);
+      rulesContent = content;
+    } else {
+      rulesContent = '# Tribunal Kit Master Governance Active\nEnforce strict TDD, out-of-band reviews, and 28-specialist waves.';
+    }
+
+    const toolMapping = `**Tool Mapping for OpenCode:**
+When skills or tribunal workflows request actions, map them to OpenCode tools:
+- Create or update tasks/todos → \`todowrite\`
+- Subagent dispatches → \`task\` with \`subagent_type: "general"\` (or \`"explore"\` for read-only exploration)
+- Invoke a skill → OpenCode's native \`skill\` tool
+- Read files → \`read\`
+- Create, edit, or delete files → \`apply_patch\`
+- Run shell commands → \`bash\`
+- Search files → \`grep\`, \`glob\`
+- Fetch a URL → \`webfetch\`
+- Tribunal SDD commands → run via \`bash\` (\`tk sdd brief\`, \`tk sdd diff\`)`;
+
+    _bootstrapCache = `<EXTREMELY_IMPORTANT>
+Tribunal Kit Master Governance is active.
+
+**IMPORTANT: The master governance rules and verification protocols are loaded for this session. Follow them strictly.**
+
+${rulesContent}
+
+${toolMapping}
+</EXTREMELY_IMPORTANT>`;
+
+    return _bootstrapCache;
+  };
+
+  return {
+    config: async (config) => {
+      config.skills = config.skills || {};
+      config.skills.paths = config.skills.paths || [];
+      if (!config.skills.paths.includes(tribunalSkillsDir)) {
+        config.skills.paths.push(tribunalSkillsDir);
+      }
+    },
+
+    'experimental.chat.messages.transform': async (_input, output) => {
+      const bootstrap = getBootstrapContent();
+      if (!bootstrap || !output.messages || !output.messages.length) return;
+      const firstUser = output.messages.find(m => m.info && m.info.role === 'user');
+      if (!firstUser || !firstUser.parts || !firstUser.parts.length) return;
+
+      if (firstUser.parts.some(p => p.type === 'text' && p.text && p.text.includes('EXTREMELY_IMPORTANT'))) return;
+
+      const ref = firstUser.parts[0];
+      firstUser.parts.unshift({ ...ref, type: 'text', text: bootstrap });
+    }
+  };
+};
+
+export default TribunalPlugin;