tribunal-kit 8.0.0 → 9.0.1

package/.agent/skills/animation-systems/SKILL.md

@@ -1,79 +1,273 @@
 ---
 name: animation-systems
-description: Systematize animation tokens (durations, easings, keyframes) across a full codebase for consistent motion design and maintenance.
-version: 3.0.0
-last-updated: 2026-07-30
+description: Use when creating and architecting design-system motion tokens, centralized duration tiers, CSS custom property easings, Tailwind motion configs, and unified cross-platform animation guidelines.
+version: 5.0.0
+last-updated: 2026-09-13
 skills:
   - motion-engineering
   - 60fps-animation
   - baseline-ui
+  - better-ui
 tools: Read, Grep, Glob, Bash, Edit, Write
 scripts-binding:
   - .agent/scripts/lint_runner.js
   - .agent/scripts/verify_all.js
 ---
 
-# Animation Systems — Global Motion Tokens & System Architecture
+# Animation Systems — Global Motion Tokens & Design System Architecture
+
+## Mandatory Pre-Flight Context Inspection
+
+Before generating, refactoring, or reviewing code in the `animation-systems` domain, inspect these 5 critical parameters:
+
+1. **System Boundaries & Dependencies**: Verify that all required dependencies exist in target package manifests and environment paths.
+2. **Runtime Context & Platform Invariants**: Confirm target platform constraints (Node.js, Browser, Mobile OS, Edge runtime) before applying APIs.
+3. **Execution Guardrails**: Identify potential side-effects, state mutations, and unhandled asynchronous exceptions.
+4. **Validation & Type Contracts**: Validate input data schemas and strict type constraints across all module interfaces.
+5. **Observability & Proof of Execution**: Ensure execution produces tangible verification signals (terminal output, tests, metrics).
+
+## Activation Boundaries
+
+- **Activate when:** Use when creating and architecting design-system motion tokens, centralized duration tiers, CSS custom property easings, Tailwind motion configs, and unified cross-platform animation guidelines.
+- **DO NOT activate when:** The task falls outside the `animation-systems` domain or is managed by a different dedicated specialist.
+
+## 🔁 Multi-Pass Execution Protocol
+
+Execute all non-trivial tasks through this 7-pass cognitive loop:
+
+| Pass | Phase | Core Action |
+|:---|:---|:---|
+| **Pass 1** | **Understand** | Deconstruct the user's explicit objective, implicit requirements, and platform constraints. |
+| **Pass 2** | **Plan** | Decompose the task into smallest logical steps; map dependencies and required tool calls. |
+| **Pass 3** | **Execute** | Implement the solution with production-grade craft, zero placeholders, and strict typing. |
+| **Pass 4** | **Verify** | Run linters, unit tests, or compiler checks to validate structural correctness. |
+| **Pass 5** | **Attack** | Perform an adversarial review searching for edge-case failures, race conditions, and traps. |
+| **Pass 6** | **Improve** | Eliminate discovered friction, optimize performance, and harden error boundaries. |
+| **Pass 7** | **Quality Gate** | Enforce Verification-Before-Completion (VBC) with concrete terminal proof before finalizing. |
 
 ---
 
-## Mandatory Pre-Flight Context Inspection
+## 🛠️ Technical Architecture & Reference Recipes
+
+Without a centralized motion system, codebases descend into animation chaos: arbitrary durations (`350ms`, `420ms`, `175ms`), dissonant easing curves, and unmaintainable component overrides. A professional animation system treats motion as a primary design token—equivalent to color palettes, typography scales, and spatial grids. It standardizes duration tiers, codifies physics-grounded easing curves, and exposes single-source-of-truth tokens across CSS custom properties, Tailwind configs, and Framer Motion dictionaries.
+
+---
 
-Before defining animation tokens or styling transitions, you MUST inspect:
 
-1. `index.css` / `DESIGN.md` → Verify presence of centralized `--duration-*` and `--ease-*` CSS custom properties
-2. Centralized Motion Tokens Schema (Section 26) → Enforce standardized duration tiers (80ms instant to 500ms delight)
-3. Anti-Ad-Hoc Easing Rule (Section 48) → Strictly prohibit inline custom cubic-bezier curves; reference motion tokens instead
+---
+
+
+---
 
-Architect a unified, scalable motion system with centralized CSS easing curves, duration tiers, and standardized keyframes.
 
 ---
 
-## Centralized Motion Tokens Schema
+## 🛠️ Technical Architecture & Reference Recipes
 
-Define standardized design tokens for motion in global CSS or Tailwind config:
+### 1. The Global Motion Token Taxonomy
+
+| Token Variable | Value | Intended Interaction Scope |
+|:---|:---|:---|
+| `--duration-instant` | `80ms` | Button active press, micro-clicks, checkbox states |
+| `--duration-fast` | `150ms` | Hover states, tooltips, focus rings, status badges |
+| `--duration-normal` | `220ms` | Dropdowns, menus, tabs, segment switches, popovers |
+| `--duration-deliberate` | `320ms` | Modals, drawers, accordion expansion, card reveals |
+| `--duration-celebrate` | `500ms` | Confetti, completion fireworks, onboarding sweeps |
+| `--ease-snappy` | `cubic-bezier(0.2, 0, 0, 1)` | Direct tactile interaction and press feedback |
+| `--ease-out-ui` | `cubic-bezier(0.16, 1, 0.3, 1)` | Entrance transitions, unfolds, dynamic cards |
+| `--ease-in-ui` | `cubic-bezier(0.7, 0, 0.84, 0)` | Clean exits, dismissals, unmount fades |
+| `--ease-spring` | `cubic-bezier(0.34, 1.56, 0.64, 1)` | Playful toggles and organic badge pop-ins |
+
+---
+
+### 2. Four Production-Grade Implementation Recipes
+
+#### Recipe 1: CSS Centralized Token Definitions (`tokens/motion.css`)
 
 ```css
 :root {
-  /* Duration Scale */
-  --duration-instant: 80ms; /* Micro feedback, toggle switches */
-  --duration-fast: 150ms; /* Tooltips, hover states, press feedback */
-  --duration-normal: 220ms; /* Dropdowns, menus, tab switching */
-  --duration-slow: 320ms; /* Modals, drawers, page reveals */
-  --duration-delight: 500ms; /* Milestone celebrations, toasts */
-
-  /* Standardized Easing Curves */
-  --ease-snappy: cubic-bezier(0.2, 0, 0, 1); /* Quick response for press/active */
-  --ease-out-ui: cubic-bezier(0.16, 1, 0.3, 1); /* Smooth entrance for popovers/modals */
-  --ease-in-ui: cubic-bezier(0.7, 0, 0.84, 0); /* Smooth exit for modals */
-  --ease-spring: cubic-bezier(0.34, 1.56, 0.64, 1); /* Subtle spring overshoot */
-  --ease-in-out: cubic-bezier(0.65, 0, 0.35, 1); /* Morphing layout changes */
+  /* Durations */
+  --duration-instant: 80ms;
+  --duration-fast: 150ms;
+  --duration-normal: 220ms;
+  --duration-deliberate: 320ms;
+  --duration-celebrate: 500ms;
+
+  /* Easing Curves */
+  --ease-snappy: cubic-bezier(0.2, 0, 0, 1);
+  --ease-out-ui: cubic-bezier(0.16, 1, 0.3, 1);
+  --ease-in-ui: cubic-bezier(0.7, 0, 0.84, 0);
+  --ease-spring: cubic-bezier(0.34, 1.56, 0.64, 1);
+  --ease-in-out: cubic-bezier(0.65, 0, 0.35, 1);
+
+  /* Pre-assembled Transitions */
+  --transition-press: transform var(--duration-instant) var(--ease-snappy);
+  --transition-fade: opacity var(--duration-fast) var(--ease-out-ui);
+  --transition-unfold: transform var(--duration-normal) var(--ease-out-ui), opacity var(--duration-normal) var(--ease-out-ui);
+}
+
+/* Systemic Reduced Motion Collapse */
+@media (prefers-reduced-motion: reduce) {
+  :root {
+    --duration-instant: 0.001ms;
+    --duration-fast: 0.001ms;
+    --duration-normal: 100ms;
+    --duration-deliberate: 120ms;
+    --duration-celebrate: 150ms;
+    --ease-snappy: ease-out;
+    --ease-out-ui: ease-out;
+    --ease-spring: ease-out;
+  }
 }
 ```
 
 ---
 
-## 🤖 LLM-Specific Traps
+#### Recipe 2: Tailwind CSS Integration (`tailwind.config.ts`)
 
-1. **Ad-Hoc Easing Curves**: Writing random `cubic-bezier(0.12, 0.45, ...)` inline inside individual components instead of referencing motion tokens.
-2. **Inconsistent Speeds**: Having tooltips take 400ms while modals take 100ms. Follow the duration scale strictly.
+```typescript
+import type { Config } from 'tailwindcss';
+
+export default {
+  theme: {
+    extend: {
+      transitionDuration: {
+        instant: 'var(--duration-instant)',
+        fast: 'var(--duration-fast)',
+        normal: 'var(--duration-normal)',
+        deliberate: 'var(--duration-deliberate)',
+        celebrate: 'var(--duration-celebrate)',
+      },
+      transitionTimingFunction: {
+        snappy: 'var(--ease-snappy)',
+        'out-ui': 'var(--ease-out-ui)',
+        'in-ui': 'var(--ease-in-ui)',
+        spring: 'var(--ease-spring)',
+      },
+      keyframes: {
+        'slide-up': {
+          from: { transform: 'translateY(12px)', opacity: '0' },
+          to: { transform: 'translateY(0)', opacity: '1' },
+        },
+      },
+      animation: {
+        'slide-up': 'slide-up var(--duration-normal) var(--ease-out-ui) forwards',
+      },
+    },
+  },
+} satisfies Config;
+```
 
 ---
 
-## 🏛️ Tribunal Integration (Anti-Hallucination)
+#### Recipe 3: TypeScript & Framer Motion Transitions Dictionary
+
+```typescript
+// tokens/motion.ts
+import { Transition } from 'framer-motion';
+
+export const MotionTokens = {
+  instant: {
+    duration: 0.08,
+    ease: [0.2, 0, 0, 1],
+  } as Transition,
+  fast: {
+    duration: 0.15,
+    ease: [0.16, 1, 0.3, 1],
+  } as Transition,
+  normal: {
+    duration: 0.22,
+    ease: [0.16, 1, 0.3, 1],
+  } as Transition,
+  deliberate: {
+    duration: 0.32,
+    ease: [0.16, 1, 0.3, 1],
+  } as Transition,
+  // Physics-based Spring Presets
+  springSnappy: {
+    type: 'spring',
+    stiffness: 480,
+    damping: 30,
+    mass: 0.8,
+  } as Transition,
+  springBouncy: {
+    type: 'spring',
+    stiffness: 380,
+    damping: 20,
+    mass: 1,
+  } as Transition,
+};
+```
+
+---
 
-**Active reviewers: `motion-reviewer` · `frontend-reviewer`**
+#### Recipe 4: Systemic Component Application
 
-### ✅ Pre-Flight Self-Audit
+```tsx
+import React from 'react';
+import { motion } from 'framer-motion';
+import { MotionTokens } from '@/tokens/motion';
 
+export function SystemModal({ isOpen, children }: { isOpen: boolean; children: React.ReactNode }) {
+  if (!isOpen) return null;
+
+  return (
+    <div className="fixed inset-0 z-50 flex items-center justify-center bg-black/50">
+      <motion.div
+        initial={{ opacity: 0, scale: 0.94, y: 8 }}
+        animate={{ opacity: 1, scale: 1, y: 0 }}
+        exit={{ opacity: 0, scale: 0.96, y: 4 }}
+        transition={MotionTokens.normal}
+        className="w-full max-w-lg p-6 bg-white dark:bg-neutral-900 rounded-2xl shadow-2xl"
+      >
+        {children}
+      </motion.div>
+    </div>
+  );
+}
 ```
-✅ Are all animation durations and easings pulled from centralized CSS motion tokens?
-✅ Do component entrance and exit transitions match the system's duration scale?
+
+---
+
+## 🚨 Edge-Case & Failure Mode Matrix
+
+| Scenario | Risk | Mitigation Strategy |
+|:---|:---|:---|
+| **Empty or Null Inputs** | Unhandled exception or unexpected rendering collapse | Enforce fallback guards, optional chaining, and explicit empty state handlers |
+| **Network Timeout / Latency** | Hanging operations or duplicate side-effects | Implement bounded abort controllers, exponential backoff, and idempotency keys |
+| **Concurrency / Race Conditions** | Stale state overwrite or inconsistent data mutations | Use atomic transactions, mutex locking, or cancel-on-resubmit controls |
+| **Invalid Schema / Malformed Payload** | Downstream runtime errors or security injection | Validate boundary payloads with Zod/Pydantic schemas prior to execution |
+| **Resource / Memory Saturation** | OOM errors, frame drops, or memory leaks | Clean up listeners, cancel active timers, and enforce pagination/virtualization |
+
+---
+
+## 🤖 LLM-Specific Traps Table
+
+| Anti-Pattern | What AI Commonly Does Wrong | What Is Actually Correct |
+|:---|:---|:---|
+| **The Instant Pop Trap** | Conditionally unmounting elements without animated interpolation | Use AnimatePresence or coordinate morphs with continuous geometry |
+| **Layout Thrashing** | Animating width, height, top, or left inside animation loops | Animate composite-only transform (translate3d, scale) and opacity |
+| **Sluggish Duration** | Setting micro-interaction transitions to 600ms+ causing interface lag | Cap interactive feedback at 160ms–240ms with snappy ease-out curves |
+
+---
+
+## 🏛️ Tribunal Verification & Guardrails
+
+**Active Reviewers:** `frontend-reviewer` · `motion-reviewer` · `ui-ux-auditor`
+**Slash Command:** `/review` or `/tribunal-full`
+
+### ✅ Pre-Flight Self-Audit Checklist
+
+```
+✅ Does animation maintain 60fps/120fps using transform and opacity?
+✅ Is optical mass conserved across state interpolations without volume collapse?
+✅ Is duration capped within micro-interaction budgets (160ms–280ms)?
+✅ Is prefers-reduced-motion respected with graceful instant fallbacks?
+✅ Did I prevent layout thrashing and continuous geometry mutations?
 ```
 
 ### 🛑 Verification-Before-Completion (VBC) Protocol
 
 **CRITICAL:** You must follow a strict "evidence-based closeout" state machine.
-
 - ❌ **Forbidden:** Declaring a task complete because the output "looks correct."
-- ✅ **Required:** You are explicitly forbidden from finalizing any task without providing **concrete evidence** (terminal output, passing tests, compile success, or equivalent proof) that your output works as intended.
+- ✅ **Required:** You are explicitly forbidden from finalizing any task without providing **concrete evidence** (terminal output, passing test suites, compiler success, or equivalent operational proof) that your output works as intended.

package/.agent/skills/antfu-conventions/SKILL.md

@@ -1,13 +1,13 @@
 ---
 name: antfu-conventions
-description: Anthony Fu's opinionated tooling and conventions for JavaScript/TypeScript projects: ESM-first, zero-config, type-safe, and clean tooling standards.
-tools: Read, Grep, Glob, Bash, Edit, Write
-version: 3.0.0
-last-updated: 2026-07-30
+description: "Use when Anthony Fu's opinionated tooling and conventions for JavaScript/TypeScript projects: ESM-first, zero-config, type-safe, and clean tooling standards."
+version: 5.0.0
+last-updated: 2026-09-13
 skills:
   - clean-code
   - typescript-advanced
   - monorepo-management
+tools: Read, Grep, Glob, Bash, Edit, Write
 scripts-binding:
   - .agent/scripts/lint_runner.js
   - .agent/scripts/verify_all.js
@@ -15,19 +15,41 @@ scripts-binding:
 
 # Antfu Conventions — ESM-First & Opinionated Modern Tooling
 
----
-
 ## Mandatory Pre-Flight Context Inspection
 
-Before configuring JS/TS tooling or lint rules, you MUST inspect:
+Before generating, refactoring, or reviewing code in the `antfu-conventions` domain, inspect these 5 critical parameters:
 
-1. Pure ESM-First Requirement (Section 24) → Set `"type": "module"` in `package.json`; ban CommonJS `require()` or `module.exports`
-2. ESLint Flat Config (`eslint.config.js`) (Section 28) → Use `@antfu/eslint-config` with flat config format; ban legacy `.eslintrc.json`
-3. Explicit Type Imports (`import type`) (Section 45) → Enforce `import type` for type-only symbols to allow clean tree-shaking compilation
+1. **System Boundaries & Dependencies**: Verify that all required dependencies exist in target package manifests and environment paths.
+2. **Runtime Context & Platform Invariants**: Confirm target platform constraints (Node.js, Browser, Mobile OS, Edge runtime) before applying APIs.
+3. **Execution Guardrails**: Identify potential side-effects, state mutations, and unhandled asynchronous exceptions.
+4. **Validation & Type Contracts**: Validate input data schemas and strict type constraints across all module interfaces.
+5. **Observability & Proof of Execution**: Ensure execution produces tangible verification signals (terminal output, tests, metrics).
 
-# Antfu Conventions — ESM-First & Opinionated Modern Tooling
+## Activation Boundaries
+
+- **Activate when:** Use when Anthony Fu's opinionated tooling and conventions for JavaScript/TypeScript projects: ESM-first, zero-config, type-safe, and clean tooling standards.
+- **DO NOT activate when:** The task falls outside the `antfu-conventions` domain or is managed by a different dedicated specialist.
+
+## 🔁 Multi-Pass Execution Protocol
+
+Execute all non-trivial tasks through this 7-pass cognitive loop:
+
+| Pass | Phase | Core Action |
+|:---|:---|:---|
+| **Pass 1** | **Understand** | Deconstruct the user's explicit objective, implicit requirements, and platform constraints. |
+| **Pass 2** | **Plan** | Decompose the task into smallest logical steps; map dependencies and required tool calls. |
+| **Pass 3** | **Execute** | Implement the solution with production-grade craft, zero placeholders, and strict typing. |
+| **Pass 4** | **Verify** | Run linters, unit tests, or compiler checks to validate structural correctness. |
+| **Pass 5** | **Attack** | Perform an adversarial review searching for edge-case failures, race conditions, and traps. |
+| **Pass 6** | **Improve** | Eliminate discovered friction, optimize performance, and harden error boundaries. |
+| **Pass 7** | **Quality Gate** | Enforce Verification-Before-Completion (VBC) with concrete terminal proof before finalizing. |
+
+---
+
+## 🛠️ Technical Architecture & Reference Recipes
+
+---
 
-Enforce Anthony Fu's modern JavaScript/TypeScript engineering conventions: ESM-first, zero-config, pnpm workspaces, and strict type safety.
 
 ---
 
@@ -63,28 +85,45 @@ export default antfu({
 
 ---
 
-## 🤖 LLM-Specific Traps
+## 🚨 Edge-Case & Failure Mode Matrix
 
-1. **Mixing CommonJS and ESM**: Generating `require()` calls inside `"type": "module"` ESM packages.
-2. **Legacy ESLint `.eslintrc.json`**: Generating deprecated legacy ESLint configs instead of modern Flat Config `eslint.config.js`.
+| Scenario | Risk | Mitigation Strategy |
+|:---|:---|:---|
+| **Empty or Null Inputs** | Unhandled exception or unexpected rendering collapse | Enforce fallback guards, optional chaining, and explicit empty state handlers |
+| **Network Timeout / Latency** | Hanging operations or duplicate side-effects | Implement bounded abort controllers, exponential backoff, and idempotency keys |
+| **Concurrency / Race Conditions** | Stale state overwrite or inconsistent data mutations | Use atomic transactions, mutex locking, or cancel-on-resubmit controls |
+| **Invalid Schema / Malformed Payload** | Downstream runtime errors or security injection | Validate boundary payloads with Zod/Pydantic schemas prior to execution |
+| **Resource / Memory Saturation** | OOM errors, frame drops, or memory leaks | Clean up listeners, cancel active timers, and enforce pagination/virtualization |
 
 ---
 
-## 🏛️ Tribunal Integration (Anti-Hallucination)
+## 🤖 LLM-Specific Traps Table
 
-**Active reviewers: `type-safety` · `dependency-reviewer`**
+| Anti-Pattern | What AI Commonly Does Wrong | What Is Actually Correct |
+|:---|:---|:---|
+| **Hallucinated Tool Capabilities** | Assuming an external library or CLI command exists without verification | Run a verification check or verify package.json before referencing tools |
+| **Premature Completion Claim** | Declaring a task finished because code was generated without verification | Execute tests, linters, or terminal commands to provide concrete proof |
+| **Context Bloat Dumping** | Pasting entire multi-thousand-line files into prompt context | Extract targeted excerpts, symbols, and signatures to preserve tokens |
 
-### ✅ Pre-Flight Self-Audit
+---
+
+## 🏛️ Tribunal Verification & Guardrails
+
+**Active Reviewers:** `orchestrator` · `agent-organizer` · `logic-reviewer`
+**Slash Command:** `/review` or `/tribunal-full`
+
+### ✅ Pre-Flight Self-Audit Checklist
 
 ```
-✅ Is `"type": "module"` active in package.json?
-✅ Are type imports declared explicitly with `import type`?
-✅ Is `eslint.config.js` flat config format used?
+✅ Did I deconstruct the root objective before proposing architecture?
+✅ Did I identify dependencies, bottlenecks, and parallelizable sub-tasks?
+✅ Did I avoid over-engineering and select the simplest effective pattern?
+✅ Did I verify assumptions with concrete file reads instead of speculation?
+✅ Did I establish measurable verification criteria before completion?
 ```
 
 ### 🛑 Verification-Before-Completion (VBC) Protocol
 
 **CRITICAL:** You must follow a strict "evidence-based closeout" state machine.
-
 - ❌ **Forbidden:** Declaring a task complete because the output "looks correct."
-- ✅ **Required:** You are explicitly forbidden from finalizing any task without providing **concrete evidence** (terminal output, passing tests, compile success, or equivalent proof) that your output works as intended.
+- ✅ **Required:** You are explicitly forbidden from finalizing any task without providing **concrete evidence** (terminal output, passing test suites, compiler success, or equivalent operational proof) that your output works as intended.

package/.agent/skills/api-patterns/SKILL.md

@@ -1,13 +1,13 @@
 ---
 name: api-patterns
-description: API design mastery. REST, GraphQL, tRPC, and gRPC selection. Request/response design, pagination (cursor/offset), filtering, versioning, rate limiting, error formats (RFC 9457), authentication (JWT/OAuth2/API keys), idempotency, file uploads, webhooks, and OpenAPI documentation. Use when designing APIs, choosing protocols, or implementing API standards.
-tools: Read, Grep, Glob, Bash, Edit, Write
-version: 3.0.0
-last-updated: 2026-07-30
+description: Use when API design mastery. REST, GraphQL, tRPC, and gRPC selection. Request/response design, pagination (cursor/offset), filtering, versioning, rate limiting, error formats (RFC 9457), authentication (JWT/OAuth2/API keys), idempotency, file uploads, webhooks, and OpenAPI documentation. Use when designing APIs, choosing protocols, or implementing API standards.
+version: 5.0.0
+last-updated: 2026-09-13
 skills:
   - api-security-auditor
   - backend-security-expert
   - schema-reviewer
+tools: Read, Grep, Glob, Bash, Edit, Write
 scripts-binding:
   - .agent/scripts/lint_runner.js
   - .agent/scripts/verify_all.js
@@ -15,17 +15,41 @@ scripts-binding:
 
 # API Patterns — Design & Protocol Mastery
 
----
-
 ## Mandatory Pre-Flight Context Inspection
 
-Before designing or implementing API endpoints, you MUST inspect:
+Before generating, refactoring, or reviewing code in the `api-patterns` domain, inspect these 5 critical parameters:
 
-1. Authorization Header Token Passing (Section 17) → Pass JWTs in `Authorization: Bearer` headers; strictly ban tokens in URL query params
-2. Cursor-Based Pagination (Section 19) → Use cursor pagination for datasets >10K rows to eliminate `OFFSET N` performance degradation
-3. Idempotency Header for Mutations (Section 21) → Require `Idempotency-Key` headers for state-changing `POST` or `PATCH` retry operations
+1. **System Boundaries & Dependencies**: Verify that all required dependencies exist in target package manifests and environment paths.
+2. **Runtime Context & Platform Invariants**: Confirm target platform constraints (Node.js, Browser, Mobile OS, Edge runtime) before applying APIs.
+3. **Execution Guardrails**: Identify potential side-effects, state mutations, and unhandled asynchronous exceptions.
+4. **Validation & Type Contracts**: Validate input data schemas and strict type constraints across all module interfaces.
+5. **Observability & Proof of Execution**: Ensure execution produces tangible verification signals (terminal output, tests, metrics).
+
+## Activation Boundaries
+
+- **Activate when:** Use when API design mastery. REST, GraphQL, tRPC, and gRPC selection. Request/response design, pagination (cursor/offset), filtering, versioning, rate limiting, error formats (RFC 9457), authentication (JWT/OAuth2/API keys), idempotency, file uploads, webhooks, and OpenAPI documentation. Use when designing APIs, choosing protocols, or implementing API standards.
+- **DO NOT activate when:** The task falls outside the `api-patterns` domain or is managed by a different dedicated specialist.
+
+## 🔁 Multi-Pass Execution Protocol
+
+Execute all non-trivial tasks through this 7-pass cognitive loop:
+
+| Pass | Phase | Core Action |
+|:---|:---|:---|
+| **Pass 1** | **Understand** | Deconstruct the user's explicit objective, implicit requirements, and platform constraints. |
+| **Pass 2** | **Plan** | Decompose the task into smallest logical steps; map dependencies and required tool calls. |
+| **Pass 3** | **Execute** | Implement the solution with production-grade craft, zero placeholders, and strict typing. |
+| **Pass 4** | **Verify** | Run linters, unit tests, or compiler checks to validate structural correctness. |
+| **Pass 5** | **Attack** | Perform an adversarial review searching for edge-case failures, race conditions, and traps. |
+| **Pass 6** | **Improve** | Eliminate discovered friction, optimize performance, and harden error boundaries. |
+| **Pass 7** | **Quality Gate** | Enforce Verification-Before-Completion (VBC) with concrete terminal proof before finalizing. |
+
+---
+
+## 🛠️ Technical Architecture & Reference Recipes
+
+---
 
-# API Patterns — Design & Protocol Mastery
 
 ## Hallucination Traps (Read First)
 
@@ -225,89 +249,45 @@ Protect against:
 
 ---
 
-AI coding assistants often fall into specific bad habits when dealing with this domain. These are strictly forbidden:
+## 🚨 Edge-Case & Failure Mode Matrix
 
-1. **Over-engineering:** Proposing complex abstractions or distributed systems when a simpler approach suffices.
-2. **Hallucinated Libraries/Methods:** Using non-existent methods or packages. Always `// VERIFY` or check `package.json` / `requirements.txt`.
-3. **Skipping Edge Cases:** Writing the "happy path" and ignoring error handling, timeouts, or data validation.
-4. **Context Amnesia:** Forgetting the user's constraints and offering generic advice instead of tailored solutions.
-5. **Silent Degradation:** Catching and suppressing errors without logging or re-raising.
+| Scenario | Risk | Mitigation Strategy |
+|:---|:---|:---|
+| **Empty or Null Inputs** | Unhandled exception or unexpected rendering collapse | Enforce fallback guards, optional chaining, and explicit empty state handlers |
+| **Network Timeout / Latency** | Hanging operations or duplicate side-effects | Implement bounded abort controllers, exponential backoff, and idempotency keys |
+| **Concurrency / Race Conditions** | Stale state overwrite or inconsistent data mutations | Use atomic transactions, mutex locking, or cancel-on-resubmit controls |
+| **Invalid Schema / Malformed Payload** | Downstream runtime errors or security injection | Validate boundary payloads with Zod/Pydantic schemas prior to execution |
+| **Resource / Memory Saturation** | OOM errors, frame drops, or memory leaks | Clean up listeners, cancel active timers, and enforce pagination/virtualization |
 
 ---
 
-**Slash command: `/review` or `/tribunal-full`**
-**Active reviewers: `logic-reviewer` · `security-auditor`**
+## 🤖 LLM-Specific Traps Table
 
-### ❌ Forbidden AI Tropes
-
-1. **Blind Assumptions:** Never make an assumption without documenting it clearly with `// VERIFY: [reason]`.
-2. **Silent Degradation:** Catching and suppressing errors without logging or handling.
-3. **Context Amnesia:** Forgetting the user's constraints and offering generic advice instead of tailored solutions.
-
-Review these questions before confirming output:
-
-```
-✅ Did I rely ONLY on real, verified tools and methods?
-✅ Is this solution appropriately scoped to the user's constraints?
-✅ Did I handle potential failure modes and edge cases?
-✅ Have I avoided generic boilerplate that doesn't add value?
-```
-
-### 🛑 Verification-Before-Completion (VBC) Protocol
-
-**CRITICAL:** You must follow a strict "evidence-based closeout" state machine.
-
-- ❌ **Forbidden:** Declaring a task complete because the output "looks correct."
-- ✅ **Required:** You are explicitly forbidden from finalizing any task without providing **concrete evidence** (terminal output, passing tests, compile success, or equivalent proof) that your output works as intended.
-
-## Pre-Flight Checklist
-
-- [ ] Have I reviewed the user's specific constraints and requests?
-- [ ] Have I checked the environment for relevant existing implementations?
-
-## VBC Protocol (Verification-Before-Completion)
-
-You MUST verify existing code signatures and variables before attempting to modify or call them. No hallucination is permitted.
+| Anti-Pattern | What AI Commonly Does Wrong | What Is Actually Correct |
+|:---|:---|:---|
+| **Unchecked Payload Cast** | Casting request bodies to TypeScript types without runtime schema validation | Parse request payloads through Zod/Pydantic schemas before business logic |
+| **Silent Error Swallowing** | Catching errors with empty catch blocks or logging without rethrowing | Propagate structured errors with status codes and contextual stack traces |
+| **Unparameterized Query** | Concatenating user inputs into SQL/Prisma query strings | Always use parameterized bindings or type-safe ORM query builders |
 
 ---
 
-## 🤖 LLM-Specific Traps
+## 🏛️ Tribunal Verification & Guardrails
 
-AI coding assistants often fall into specific bad habits when dealing with this domain. These are strictly forbidden:
+**Active Reviewers:** `logic-reviewer` · `security-auditor` · `api-architect` · `resilience-reviewer`
+**Slash Command:** `/review` or `/tribunal-full`
 
-1. **Over-engineering:** Proposing complex abstractions or distributed systems when a simpler approach suffices.
-2. **Hallucinated Libraries/Methods:** Using non-existent methods or packages. Always `// VERIFY` or check `package.json` / `requirements.txt`.
-3. **Skipping Edge Cases:** Writing the "happy path" and ignoring error handling, timeouts, or data validation.
-4. **Context Amnesia:** Forgetting the user's constraints and offering generic advice instead of tailored solutions.
-5. **Silent Degradation:** Catching and suppressing errors without logging or re-raising.
-
----
-
-## 🏛️ Tribunal Integration (Anti-Hallucination)
-
-**Slash command: `/review` or `/tribunal-full`**
-**Active reviewers: `logic-reviewer` · `security-auditor`**
-
-### ❌ Forbidden AI Tropes
-
-1. **Blind Assumptions:** Never make an assumption without documenting it clearly with `// VERIFY: [reason]`.
-2. **Silent Degradation:** Catching and suppressing errors without logging or handling.
-3. **Context Amnesia:** Forgetting the user's constraints and offering generic advice instead of tailored solutions.
-
-### ✅ Pre-Flight Self-Audit
-
-Review these questions before confirming output:
+### ✅ Pre-Flight Self-Audit Checklist
 
 ```
-✅ Did I rely ONLY on real, verified tools and methods?
-✅ Is this solution appropriately scoped to the user's constraints?
-✅ Did I handle potential failure modes and edge cases?
-✅ Have I avoided generic boilerplate that doesn't add value?
+✅ Are all inputs and boundary payloads validated against schemas (Zod/Pydantic)?
+✅ Are SQL and database queries parameterized with zero string concatenation?
+✅ Are error boundaries and timeout/retry policies explicitly declared?
+✅ Are authentication checks performed before business logic execution?
+✅ Did I verify that imported dependencies exist in package.json/requirements.txt?
 ```
 
 ### 🛑 Verification-Before-Completion (VBC) Protocol
 
 **CRITICAL:** You must follow a strict "evidence-based closeout" state machine.
-
 - ❌ **Forbidden:** Declaring a task complete because the output "looks correct."
-- ✅ **Required:** You are explicitly forbidden from finalizing any task without providing **concrete evidence** (terminal output, passing tests, compile success, or equivalent proof) that your output works as intended.
+- ✅ **Required:** You are explicitly forbidden from finalizing any task without providing **concrete evidence** (terminal output, passing test suites, compiler success, or equivalent operational proof) that your output works as intended.