tribunal-kit 8.0.0 → 9.0.1

package/skills/backend-security-expert/SKILL.md

@@ -0,0 +1,148 @@
+---
+name: backend-security-expert
+description: Use when Backend security auditing for modern server-side architectures. Focuses on Next.js Server Actions, Node.js/Edge APIs, JWT & Session architectures, ORM injection (Prisma/Drizzle), and RBAC implementation.
+version: 5.0.0
+last-updated: 2026-09-13
+skills:
+  - frontend-security-expert
+  - api-security-auditor
+  - vulnerability-scanner
+tools: Read, Grep, Glob, Bash, Edit, Write
+scripts-binding:
+  - .agent/scripts/lint_runner.js
+  - .agent/scripts/verify_all.js
+---
+
+# Backend Security Expert — Modern Server Architectures
+
+## Mandatory Pre-Flight Context Inspection
+
+Before generating, refactoring, or reviewing code in the `backend-security-expert` domain, inspect these 5 critical parameters:
+
+1. **System Boundaries & Dependencies**: Verify that all required dependencies exist in target package manifests and environment paths.
+2. **Runtime Context & Platform Invariants**: Confirm target platform constraints (Node.js, Browser, Mobile OS, Edge runtime) before applying APIs.
+3. **Execution Guardrails**: Identify potential side-effects, state mutations, and unhandled asynchronous exceptions.
+4. **Validation & Type Contracts**: Validate input data schemas and strict type constraints across all module interfaces.
+5. **Observability & Proof of Execution**: Ensure execution produces tangible verification signals (terminal output, tests, metrics).
+
+## Activation Boundaries
+
+- **Activate when:** Use when Backend security auditing for modern server-side architectures. Focuses on Next.js Server Actions, Node.js/Edge APIs, JWT & Session architectures, ORM injection (Prisma/Drizzle), and RBAC implementation.
+- **DO NOT activate when:** The task falls outside the `backend-security-expert` domain or is managed by a different dedicated specialist.
+
+## 🔁 Multi-Pass Execution Protocol
+
+Execute all non-trivial tasks through this 7-pass cognitive loop:
+
+| Pass | Phase | Core Action |
+|:---|:---|:---|
+| **Pass 1** | **Understand** | Deconstruct the user's explicit objective, implicit requirements, and platform constraints. |
+| **Pass 2** | **Plan** | Decompose the task into smallest logical steps; map dependencies and required tool calls. |
+| **Pass 3** | **Execute** | Implement the solution with production-grade craft, zero placeholders, and strict typing. |
+| **Pass 4** | **Verify** | Run linters, unit tests, or compiler checks to validate structural correctness. |
+| **Pass 5** | **Attack** | Perform an adversarial review searching for edge-case failures, race conditions, and traps. |
+| **Pass 6** | **Improve** | Eliminate discovered friction, optimize performance, and harden error boundaries. |
+| **Pass 7** | **Quality Gate** | Enforce Verification-Before-Completion (VBC) with concrete terminal proof before finalizing. |
+
+---
+
+## 🛠️ Technical Architecture & Reference Recipes
+
+---
+
+
+## 2026 Backend Security & Cryptography Invariants
+
+1. **Timing-Safe Equality**:
+   ```ts
+   import { timingSafeEqual } from 'node:crypto';
+   function verifySecret(provided: string, expected: string): boolean {
+     const bufA = Buffer.from(provided);
+     const bufB = Buffer.from(expected);
+     if (bufA.length !== bufB.length) return false;
+     return timingSafeEqual(bufA, bufB);
+   }
+   ```
+2. **SSRF Guardrails on Webhooks**: Never allow user-submitted URLs to hit AWS/GCP metadata services (`169.254.169.254`) or loopback (`localhost`). Validate IP address after DNS resolution before connecting.
+3. **Mass Assignment Prevention**: Never pass `req.body` directly into database inserts. Explicitly pick allowed attributes via Zod schemas (`schema.parse(req.body)`).
+4. **JWT Verification Security**: Always specify `algorithms: ['HS256']` explicitly to prevent the notorious `alg: "none"` vulnerability.
+
+## Hallucination Traps (Read First)
+
+- ❌ Recommending session tokens without algorithm enforcement → ✅ Always verify JWT algorithms (`alg: "HS256"`)
+- ❌ String equality `token === expectedToken` → ✅ Use `crypto.timingSafeEqual` to prevent timing attacks
+- ❌ Treating ORMs as automatically injection-proof → ✅ Prisma and Drizzle are vulnerable if raw SQL is dynamically interpolated
+- ❌ Assuming Next.js Server Actions are private internal functions → ✅ Server Actions are public HTTP endpoints
+- ❌ Fetching user-supplied URLs without private IP filtering → ✅ Block RFC 1918 and link-local ranges to prevent SSRF
+
+---
+
+## 1. Next.js Server Actions & Edge APIs
+
+Server Actions create implicit API endpoints. They must be treated like raw REST routes.
+
+- **Authentication**: Validate the session ID/token at the very top of _every_ Server Action.
+- **Input Validation**: Parse all inputs using Zod. Do not trust TypeScript types, as they do not exist at runtime.
+- **Rate Limiting**: Apply `@upstash/ratelimit` or similar to prevent brute force and abuse on public-facing actions.
+
+## 2. Authentication & Authorization (RBAC)
+
+- **Role-Based Access**: Check if the authenticated user has permission to perform the specific action, not just if they are logged in.
+- **IDOR Prevention**: Always verify that the resource being modified belongs to the user requesting the modification (e.g., `WHERE userId = session.userId`).
+- **Secrets Management**: Never hardcode API keys. Ensure they are loaded from `.env` and fail loudly if missing.
+
+## 3. Database & ORM Security
+
+- **NoSQL/ORM Injection**: Avoid passing raw JSON or objects directly into query constraints (e.g., MongoDB `$where` or Prisma raw queries).
+- **Mass Assignment**: Never destructure user input directly into a database create/update call. Explicitly pick the fields allowed to be updated.
+- **Query Depth**: For GraphQL backends, always implement depth limiting and cost analysis to prevent query-based DDoS.
+
+## 4. Headers & Server Hardening
+
+- **CORS**: Never use wildcard `Access-Control-Allow-Origin: *` for authenticated routes.
+- **Security Headers**: Ensure Helmet (or equivalent Next.js headers config) is active for HSTS, X-Frame-Options, and Content-Type-Options.
+
+---
+
+## 🚨 Edge-Case & Failure Mode Matrix
+
+| Scenario | Risk | Mitigation Strategy |
+|:---|:---|:---|
+| **Empty or Null Inputs** | Unhandled exception or unexpected rendering collapse | Enforce fallback guards, optional chaining, and explicit empty state handlers |
+| **Network Timeout / Latency** | Hanging operations or duplicate side-effects | Implement bounded abort controllers, exponential backoff, and idempotency keys |
+| **Concurrency / Race Conditions** | Stale state overwrite or inconsistent data mutations | Use atomic transactions, mutex locking, or cancel-on-resubmit controls |
+| **Invalid Schema / Malformed Payload** | Downstream runtime errors or security injection | Validate boundary payloads with Zod/Pydantic schemas prior to execution |
+| **Resource / Memory Saturation** | OOM errors, frame drops, or memory leaks | Clean up listeners, cancel active timers, and enforce pagination/virtualization |
+
+---
+
+## 🤖 LLM-Specific Traps Table
+
+| Anti-Pattern | What AI Commonly Does Wrong | What Is Actually Correct |
+|:---|:---|:---|
+| **Unchecked Payload Cast** | Casting request bodies to TypeScript types without runtime schema validation | Parse request payloads through Zod/Pydantic schemas before business logic |
+| **Silent Error Swallowing** | Catching errors with empty catch blocks or logging without rethrowing | Propagate structured errors with status codes and contextual stack traces |
+| **Unparameterized Query** | Concatenating user inputs into SQL/Prisma query strings | Always use parameterized bindings or type-safe ORM query builders |
+
+---
+
+## 🏛️ Tribunal Verification & Guardrails
+
+**Active Reviewers:** `logic-reviewer` · `security-auditor` · `api-architect` · `resilience-reviewer`
+**Slash Command:** `/review` or `/tribunal-full`
+
+### ✅ Pre-Flight Self-Audit Checklist
+
+```
+✅ Are all inputs and boundary payloads validated against schemas (Zod/Pydantic)?
+✅ Are SQL and database queries parameterized with zero string concatenation?
+✅ Are error boundaries and timeout/retry policies explicitly declared?
+✅ Are authentication checks performed before business logic execution?
+✅ Did I verify that imported dependencies exist in package.json/requirements.txt?
+```
+
+### 🛑 Verification-Before-Completion (VBC) Protocol
+
+**CRITICAL:** You must follow a strict "evidence-based closeout" state machine.
+- ❌ **Forbidden:** Declaring a task complete because the output "looks correct."
+- ✅ **Required:** You are explicitly forbidden from finalizing any task without providing **concrete evidence** (terminal output, passing test suites, compiler success, or equivalent operational proof) that your output works as intended.

package/skills/baseline-ui/SKILL.md

@@ -0,0 +1,130 @@
+---
+name: baseline-ui
+description: Use when Quickly deslop UI code by fixing spacing, hierarchy, typography, contrast, and small layout issues. Use when the interface needs a fast cleanup or polish pass.
+version: 5.0.0
+last-updated: 2026-09-13
+skills:
+  - better-ui
+  - frontend-design
+  - better-colors
+tools: Read, Grep, Glob, Bash, Edit, Write
+scripts-binding:
+  - .agent/scripts/lint_runner.js
+  - .agent/scripts/verify_all.js
+---
+
+# Baseline UI — Fast Deslopping & Hierarchy Cleanup
+
+## Mandatory Pre-Flight Context Inspection
+
+Before generating, refactoring, or reviewing code in the `baseline-ui` domain, inspect these 5 critical parameters:
+
+1. **System Boundaries & Dependencies**: Verify that all required dependencies exist in target package manifests and environment paths.
+2. **Runtime Context & Platform Invariants**: Confirm target platform constraints (Node.js, Browser, Mobile OS, Edge runtime) before applying APIs.
+3. **Execution Guardrails**: Identify potential side-effects, state mutations, and unhandled asynchronous exceptions.
+4. **Validation & Type Contracts**: Validate input data schemas and strict type constraints across all module interfaces.
+5. **Observability & Proof of Execution**: Ensure execution produces tangible verification signals (terminal output, tests, metrics).
+
+## Activation Boundaries
+
+- **Activate when:** Use when Quickly deslop UI code by fixing spacing, hierarchy, typography, contrast, and small layout issues. Use when the interface needs a fast cleanup or polish pass.
+- **DO NOT activate when:** The task falls outside the `baseline-ui` domain or is managed by a different dedicated specialist.
+
+## 🔁 Multi-Pass Execution Protocol
+
+Execute all non-trivial tasks through this 7-pass cognitive loop:
+
+| Pass | Phase | Core Action |
+|:---|:---|:---|
+| **Pass 1** | **Understand** | Deconstruct the user's explicit objective, implicit requirements, and platform constraints. |
+| **Pass 2** | **Plan** | Decompose the task into smallest logical steps; map dependencies and required tool calls. |
+| **Pass 3** | **Execute** | Implement the solution with production-grade craft, zero placeholders, and strict typing. |
+| **Pass 4** | **Verify** | Run linters, unit tests, or compiler checks to validate structural correctness. |
+| **Pass 5** | **Attack** | Perform an adversarial review searching for edge-case failures, race conditions, and traps. |
+| **Pass 6** | **Improve** | Eliminate discovered friction, optimize performance, and harden error boundaries. |
+| **Pass 7** | **Quality Gate** | Enforce Verification-Before-Completion (VBC) with concrete terminal proof before finalizing. |
+
+---
+
+## 🛠️ Technical Architecture & Reference Recipes
+
+---
+
+
+---
+
+## 1. Stack & System Constraints
+
+- **Tailwind CSS Defaults**: MUST use Tailwind CSS default utilities unless custom values already exist or are explicitly requested.
+- **Animation Primitives**: MUST use `motion/react` (formerly `framer-motion`) when JavaScript animation is required.
+- **Utility Class Merging**: MUST use `cn` utility (`clsx` + `tailwind-merge`) for dynamic class logic.
+- **Accessible Component Primitives**: MUST use established accessible primitives (`Base UI`, `React Aria`, `Radix`) for anything with keyboard or focus behavior. Prefer `Base UI` for new unstyled primitives.
+- **Destructive Actions**: MUST use an `AlertDialog` for destructive or irreversible actions.
+- **Loading States**: SHOULD use structural skeletons for loading states instead of plain spinners.
+
+---
+
+## 2. The 5-Step UI Deslop Protocol
+
+1. **Fix Spacing Violations**: Replace hardcoded arbitrary margins/paddings (`margin-top: 13px`, `padding: 7px 11px`) with an 8px grid system (`4px`, `8px`, `12px`, `16px`, `24px`, `32px`, `48px`).
+2. **Establish Typographic Hierarchy**: Max 3 font sizes per component context. Headings bold/semibold with tight letter-spacing (`-0.025em`) and `text-wrap: balance`. Body text regular with `1.5` line height.
+3. **Elevate Contrast Ratios**: Eliminate low-contrast gray-on-gray text. Ensure text meets minimum WCAG AA 4.5:1 ratio against background.
+4. **Clean Up Borders & Dividers**: Replace harsh 100% opaque black/white borders with subtle 8%-12% opacity borders (`border-color: rgba(255,255,255,0.08)` or `var(--border)`).
+5. **Enforce Container Alignment & Active Feedback**: Align text left with action buttons, group related controls with flex gaps, and add instant press feedback (`scale(0.97)`) on all interactive targets.
+
+---
+
+## Anti-Slop Table
+
+| Slop Pattern                        | Baseline Fix                                    | Rationale                                   |
+| ----------------------------------- | ----------------------------------------------- | ------------------------------------------- |
+| `color: #888` on dark background    | `color: var(--text-muted)` (min 4.5:1 ratio)    | Improves readability and WCAG compliance    |
+| `padding: 15px 23px`                | `padding: 16px 24px`                            | Aligns to 8px structural grid               |
+| `border: 1px solid black`           | `border: 1px solid rgba(0,0,0,0.1)`             | Removes harsh, distracting lines            |
+| Mixed font sizes (13px, 14px, 15px) | Standardized scale (12px, 14px, 16px)           | Establishes clear visual hierarchy          |
+| Plain text buttons without states   | Rounded button with hover/active press feedback | Indicates clickability and tactile response |
+
+---
+
+## 🚨 Edge-Case & Failure Mode Matrix
+
+| Scenario | Risk | Mitigation Strategy |
+|:---|:---|:---|
+| **Empty or Null Inputs** | Unhandled exception or unexpected rendering collapse | Enforce fallback guards, optional chaining, and explicit empty state handlers |
+| **Network Timeout / Latency** | Hanging operations or duplicate side-effects | Implement bounded abort controllers, exponential backoff, and idempotency keys |
+| **Concurrency / Race Conditions** | Stale state overwrite or inconsistent data mutations | Use atomic transactions, mutex locking, or cancel-on-resubmit controls |
+| **Invalid Schema / Malformed Payload** | Downstream runtime errors or security injection | Validate boundary payloads with Zod/Pydantic schemas prior to execution |
+| **Resource / Memory Saturation** | OOM errors, frame drops, or memory leaks | Clean up listeners, cancel active timers, and enforce pagination/virtualization |
+
+---
+
+## 🤖 LLM-Specific Traps Table
+
+| Anti-Pattern | What AI Commonly Does Wrong | What Is Actually Correct |
+|:---|:---|:---|
+| **Uncontrolled Re-render Loop** | Mutating state inside render bodies or omitting hook dependencies | Wrap effects with explicit deps and isolate reactive derivations in useMemo |
+| **Accessibility Neglect** | Interactive <div> without role="button", tabIndex, or onKeyDown | Use semantic <button> or provide ARIA role, keyboard handlers, and focus ring |
+| **Layout Shift Flash** | Images/dynamic content without aspect-ratio or explicit dimensions | Enforce aspect-ratio or skeleton placeholders to guarantee zero CLS |
+
+---
+
+## 🏛️ Tribunal Verification & Guardrails
+
+**Active Reviewers:** `frontend-reviewer` · `type-safety` · `ui-ux-auditor` · `complexity-reviewer`
+**Slash Command:** `/review` or `/tribunal-full`
+
+### ✅ Pre-Flight Self-Audit Checklist
+
+```
+✅ Are all component props strictly typed with zero implicit "any"?
+✅ Are responsive breakpoints, fluid typography, and optical balance verified?
+✅ Is accessibility (ARIA labels, keyboard focus, contrast) validated?
+✅ Are re-renders minimized and state lifecycles cleanly separated?
+✅ Did I verify all imported UI components and icon sets actually exist?
+```
+
+### 🛑 Verification-Before-Completion (VBC) Protocol
+
+**CRITICAL:** You must follow a strict "evidence-based closeout" state machine.
+- ❌ **Forbidden:** Declaring a task complete because the output "looks correct."
+- ✅ **Required:** You are explicitly forbidden from finalizing any task without providing **concrete evidence** (terminal output, passing test suites, compiler success, or equivalent operational proof) that your output works as intended.

package/skills/bash-linux/SKILL.md

@@ -0,0 +1,214 @@
+---
+name: bash-linux
+description: Use when Bash/Linux terminal mastery. Shell scripting, piping, stream redirection, process substitution, strict mode (set -euo pipefail), AWK, ripgrep parsing, and robust error handling. Use when writing CI scripts, debugging POSIX environments, or manipulating text pipelines.
+version: 5.0.0
+last-updated: 2026-09-13
+skills:
+  - server-management
+  - devops-engineer
+  - cicd-pro
+tools: Read, Grep, Glob, Bash, Edit, Write
+scripts-binding:
+  - .agent/scripts/lint_runner.js
+  - .agent/scripts/verify_all.js
+---
+
+# Bash & Linux — Shell Scripting Mastery
+
+## Mandatory Pre-Flight Context Inspection
+
+Before generating, refactoring, or reviewing code in the `bash-linux` domain, inspect these 5 critical parameters:
+
+1. **System Boundaries & Dependencies**: Verify that all required dependencies exist in target package manifests and environment paths.
+2. **Runtime Context & Platform Invariants**: Confirm target platform constraints (Node.js, Browser, Mobile OS, Edge runtime) before applying APIs.
+3. **Execution Guardrails**: Identify potential side-effects, state mutations, and unhandled asynchronous exceptions.
+4. **Validation & Type Contracts**: Validate input data schemas and strict type constraints across all module interfaces.
+5. **Observability & Proof of Execution**: Ensure execution produces tangible verification signals (terminal output, tests, metrics).
+
+## Activation Boundaries
+
+- **Activate when:** Use when Bash/Linux terminal mastery. Shell scripting, piping, stream redirection, process substitution, strict mode (set -euo pipefail), AWK, ripgrep parsing, and robust error handling. Use when writing CI scripts, debugging POSIX environments, or manipulating text pipelines.
+- **DO NOT activate when:** The task falls outside the `bash-linux` domain or is managed by a different dedicated specialist.
+
+## 🔁 Multi-Pass Execution Protocol
+
+Execute all non-trivial tasks through this 7-pass cognitive loop:
+
+| Pass | Phase | Core Action |
+|:---|:---|:---|
+| **Pass 1** | **Understand** | Deconstruct the user's explicit objective, implicit requirements, and platform constraints. |
+| **Pass 2** | **Plan** | Decompose the task into smallest logical steps; map dependencies and required tool calls. |
+| **Pass 3** | **Execute** | Implement the solution with production-grade craft, zero placeholders, and strict typing. |
+| **Pass 4** | **Verify** | Run linters, unit tests, or compiler checks to validate structural correctness. |
+| **Pass 5** | **Attack** | Perform an adversarial review searching for edge-case failures, race conditions, and traps. |
+| **Pass 6** | **Improve** | Eliminate discovered friction, optimize performance, and harden error boundaries. |
+| **Pass 7** | **Quality Gate** | Enforce Verification-Before-Completion (VBC) with concrete terminal proof before finalizing. |
+
+---
+
+## 🛠️ Technical Architecture & Reference Recipes
+
+---
+
+
+## Hallucination Traps (Read First)
+
+- ❌ Scripts without `set -euo pipefail` -> ✅ Always enable strict mode to catch silent failures
+- ❌ Using `[ ]` instead of `[[ ]]` for conditionals -> ✅ `[[ ]]` handles spaces in variables and supports regex
+- ❌ Parsing `ls` output -> ✅ Use `find` or glob expansion instead; `ls` output is not portable
+- ❌ `cat file | grep` (useless use of cat) -> ✅ `grep pattern file` directly
+
+---
+
+---
+
+## 1. Bash Strict Mode (Mandatory)
+
+Always start every single bash script with strict compilation flags.
+
+```bash
+#!/usr/bin/env bash
+
+# ❌ BAD: Default bash execution
+# - Undefined variables evaluate to empty strings
+# - Failed commands are ignored, execution continues blindly
+# - Piped failures are hidden (only last command exit code matters)
+
+# ✅ GOOD: Strict Mode
+set -euo pipefail
+IFS=$'\n\t'
+
+# -e: Exit immediately if a command exits with a non-zero status.
+# -u: Treat unset variables as an error and exit immediately.
+# -o pipefail: Pipeline returns the status of the rightmost command to exit with a non-zero status.
+# IFS: Only split on newlines and tabs, not spaces (prevents terrifying globbing/array bugs).
+
+# Example: Catching potential disasters
+unset MY_VAR
+rm -rf "/some/path/${MY_VAR}" # With 'set -u', this throws an error instead of running 'rm -rf /some/path/'
+```
+
+---
+
+## 2. Advanced Stream Manipulation
+
+Piping allows passing stdout from one program into stdin of another.
+
+```bash
+# ❌ VULNERABLE: Useless Use of Cat (UUOC)
+cat file.txt | grep "error"
+
+# ✅ EFFICIENT: Direct parsing
+grep "error" file.txt
+# Or modern ripgrep for huge repositories:
+rg "error" file.txt
+
+# Process Substitution: Treating tool outputs as if they were files
+# Compare two remote JSON responses without writing to disk
+diff <(curl -s api.com/v1) <(curl -s api.com/v2)
+
+# Redirection Mastery
+# 1> stdout, 2> stderr
+command > output.txt 2> error.txt   # Split streams
+command > all.txt 2>&1              # Combine streams (POSIX)
+command &> all.txt                  # Combine streams (Bash shortcut)
+command >/dev/null 2>&1             # Subdue all output cleanly
+```
+
+---
+
+## 3. AWK and Stream Formatting
+
+AWK is a complete programming language designed for text processing.
+
+```bash
+# Example: We have a ps aux output and we want the PIDs (column 2) of all Node processes
+ps aux | grep node | awk '{print $2}'
+
+# Example: Summing numbers in column 3 from a CSV
+cat data.csv | awk -F ',' '{sum+=$3} END {print sum}'
+
+# Extracting specific lines (e.g. line 5 to 10)
+sed -n '5,10p' file.txt
+```
+
+---
+
+## 4. Modern CLI Alternatives (The 2026 Stack)
+
+Standard POSIX tools are reliable but slow. Use modern Rust-based alternatives when available in CI/CD.
+
+| Task               | Legacy POSIX          | Modern Alternative | Why?                                                          |
+| :----------------- | :-------------------- | :----------------- | :------------------------------------------------------------ |
+| Find files         | `find . -name "*.ts"` | `fd -e ts`         | Context-aware, respects `.gitignore`, 10x faster.             |
+| Search text        | `grep -r "auth"`      | `rg "auth"`        | Ripgrep uses multi-threading and SIMD instructions.           |
+| Inspect JSON       | `grep / awk`          | `jq '.users[].id'` | `jq` explicitly parses and filters valid JSON arrays/objects. |
+| Process monitoring | `top`                 | `htop` / `btm`     | Interactive metrics.                                          |
+| Check curl         | `curl -i`             | `httpie` / `xh`    | Colorized, structured JSON networking.                        |
+
+---
+
+## 5. File System Traps & Quoting
+
+If a filename contains a space and you didn't quote your variable, your script will crash or delete the wrong files.
+
+```bash
+# Let FILE="my backup.tar"
+
+# ❌ BAD: Evaluates as `rm my` AND `backup.tar` -> Two different files!
+rm $FILE
+
+# ✅ GOOD: Always quote string variables
+rm "$FILE"
+
+# ✅ GOOD: Array iteration (Using quotes specifically formatted with @)
+FILES=("file 1.txt" "file 2.txt")
+for file in "${FILES[@]}"; do
+  echo "Processing: $file"
+done
+```
+
+---
+
+## 🚨 Edge-Case & Failure Mode Matrix
+
+| Scenario | Risk | Mitigation Strategy |
+|:---|:---|:---|
+| **Empty or Null Inputs** | Unhandled exception or unexpected rendering collapse | Enforce fallback guards, optional chaining, and explicit empty state handlers |
+| **Network Timeout / Latency** | Hanging operations or duplicate side-effects | Implement bounded abort controllers, exponential backoff, and idempotency keys |
+| **Concurrency / Race Conditions** | Stale state overwrite or inconsistent data mutations | Use atomic transactions, mutex locking, or cancel-on-resubmit controls |
+| **Invalid Schema / Malformed Payload** | Downstream runtime errors or security injection | Validate boundary payloads with Zod/Pydantic schemas prior to execution |
+| **Resource / Memory Saturation** | OOM errors, frame drops, or memory leaks | Clean up listeners, cancel active timers, and enforce pagination/virtualization |
+
+---
+
+## 🤖 LLM-Specific Traps Table
+
+| Anti-Pattern | What AI Commonly Does Wrong | What Is Actually Correct |
+|:---|:---|:---|
+| **Silent Pipeline Failure** | Executing shell steps without set -euo pipefail, ignoring errors | Always initialize shell scripts with set -euo pipefail and trap handlers |
+| **Unpinned Dependency Shift** | Installing packages with npm install or using :latest docker tags | Lock dependencies with npm ci / lockfiles and use immutable SHA256 image digests |
+| **Leaking Build Secrets** | Passing secrets as Docker build arguments baked into image layers | Use Docker BuildKit secret mounts (--mount=type=secret) or runtime injection |
+
+---
+
+## 🏛️ Tribunal Verification & Guardrails
+
+**Active Reviewers:** `pipeline-reviewer` · `devops-engineer` · `resilience-reviewer`
+**Slash Command:** `/review` or `/tribunal-full`
+
+### ✅ Pre-Flight Self-Audit Checklist
+
+```
+✅ Are strict execution modes (set -euo pipefail) active on all scripts?
+✅ Are container images pinned to digest/immutable tags instead of "latest"?
+✅ Are deployment health checks and rollback baselines configured?
+✅ Are CI secrets masked and unexposed to untrusted pull requests?
+✅ Did I verify environment compatibility across target runtimes?
+```
+
+### 🛑 Verification-Before-Completion (VBC) Protocol
+
+**CRITICAL:** You must follow a strict "evidence-based closeout" state machine.
+- ❌ **Forbidden:** Declaring a task complete because the output "looks correct."
+- ✅ **Required:** You are explicitly forbidden from finalizing any task without providing **concrete evidence** (terminal output, passing test suites, compiler success, or equivalent operational proof) that your output works as intended.