tribunal-kit 9.0.0 → 9.0.1

package/skills/agentic-patterns/SKILL.md

@@ -0,0 +1,356 @@
+---
+name: agentic-patterns
+description: Use when AI agent design principles. Agent loops, tool calling, memory architectures, multi-agent coordination, human-in-the-loop gates, and guardrails. Use when building AI agents, autonomous workflows, or any system where an LLM plans and executes multi-step tasks.
+version: 5.0.0
+last-updated: 2026-09-13
+skills:
+  - agent-organizer
+  - fabel-protocol
+  - thinking-protocol
+tools: Read, Grep, Glob, Bash, Edit, Write
+scripts-binding:
+  - .agent/scripts/swarm_dispatcher.js
+  - .agent/scripts/verify_all.js
+  - .agent/scripts/lint_runner.js
+---
+
+# Agentic Patterns
+
+## Mandatory Pre-Flight Context Inspection
+
+Before generating, refactoring, or reviewing code in the `agentic-patterns` domain, inspect these 5 critical parameters:
+
+1. **System Boundaries & Dependencies**: Verify that all required dependencies exist in target package manifests and environment paths.
+2. **Runtime Context & Platform Invariants**: Confirm target platform constraints (Node.js, Browser, Mobile OS, Edge runtime) before applying APIs.
+3. **Execution Guardrails**: Identify potential side-effects, state mutations, and unhandled asynchronous exceptions.
+4. **Validation & Type Contracts**: Validate input data schemas and strict type constraints across all module interfaces.
+5. **Observability & Proof of Execution**: Ensure execution produces tangible verification signals (terminal output, tests, metrics).
+
+## Activation Boundaries
+
+- **Activate when:** Use when AI agent design principles. Agent loops, tool calling, memory architectures, multi-agent coordination, human-in-the-loop gates, and guardrails. Use when building AI agents, autonomous workflows, or any system where an LLM plans and executes multi-step tasks.
+- **DO NOT activate when:** The task falls outside the `agentic-patterns` domain or is managed by a different dedicated specialist.
+
+## 🔁 Multi-Pass Execution Protocol
+
+Execute all non-trivial tasks through this 7-pass cognitive loop:
+
+| Pass | Phase | Core Action |
+|:---|:---|:---|
+| **Pass 1** | **Understand** | Deconstruct the user's explicit objective, implicit requirements, and platform constraints. |
+| **Pass 2** | **Plan** | Decompose the task into smallest logical steps; map dependencies and required tool calls. |
+| **Pass 3** | **Execute** | Implement the solution with production-grade craft, zero placeholders, and strict typing. |
+| **Pass 4** | **Verify** | Run linters, unit tests, or compiler checks to validate structural correctness. |
+| **Pass 5** | **Attack** | Perform an adversarial review searching for edge-case failures, race conditions, and traps. |
+| **Pass 6** | **Improve** | Eliminate discovered friction, optimize performance, and harden error boundaries. |
+| **Pass 7** | **Quality Gate** | Enforce Verification-Before-Completion (VBC) with concrete terminal proof before finalizing. |
+
+---
+
+## 🛠️ Technical Architecture & Reference Recipes
+
+---
+
+
+---
+
+## The Agent Loop
+
+Every AI agent follows this fundamental pattern:
+
+```
+PERCEIVE → PLAN → ACT → OBSERVE → (repeat or terminate)
+
+1. PERCEIVE   — What is the current state? What does the agent know?
+2. PLAN       — What action will move toward the goal?
+3. ACT        — Execute the tool, call the API, write the file
+4. OBSERVE    — What changed? Did the action succeed?
+5. EVALUATE   — Goal reached? Continue loop or return?
+```
+
+### When to Terminate
+
+```ts
+// The three termination conditions — always define all three
+type AgentResult = {
+  reason: 'goal_reached' | 'max_steps_exceeded' | 'human_escalation';
+  steps: number;
+  result: string;
+};
+
+const MAX_STEPS = 10; // Hard cap — never let agents loop indefinitely
+```
+
+---
+
+## Tool Calling Design
+
+Tools are the agent's interface to the real world. Design them defensively:
+
+```ts
+// Tool definition — what the LLM sees and how to call it
+const tools = [
+  {
+    type: 'function',
+    function: {
+      name: 'search_database',
+      description:
+        'Search the product database. Use this before creating a new record to avoid duplicates.',
+      parameters: {
+        type: 'object',
+        properties: {
+          query: {
+            type: 'string',
+            description: 'Search terms — be specific',
+          },
+          limit: {
+            type: 'number',
+            description: 'Max results to return. Default: 5, max: 20',
+          },
+        },
+        required: ['query'],
+      },
+    },
+  },
+];
+
+// Tool executor — validate before running
+async function executeTool(name: string, args: unknown): Promise<string> {
+  // Validate args before executing — never trust LLM output directly
+  const parsed = ToolArgsSchema.safeParse(args);
+  if (!parsed.success) {
+    return `Error: Invalid arguments — ${parsed.error.message}`;
+  }
+
+  // Scope check — is this tool allowed for this agent's role?
+  if (!agentPermissions.includes(name)) {
+    return `Error: Tool '${name}' is not permitted for this agent`;
+  }
+
+  try {
+    return await tools[name](parsed.data);
+  } catch (err) {
+    return `Error: Tool execution failed — ${(err as Error).message}`;
+  }
+}
+```
+
+---
+
+## Memory Architecture
+
+Agents need different types of memory for different purposes:
+
+```
+IN-CONTEXT MEMORY (cheapest, shortest-lived):
+  → Current conversation + recent tool outputs
+  → Limited by context window (~100k tokens)
+  → Good for: current task context
+
+EXTERNAL SEMANTIC MEMORY (vector search):
+  → Long-term knowledge, past conversations
+  → Unlimited, but retrieval is approximate
+  → Good for: "What did we discuss about this topic before?"
+
+EPISODIC MEMORY (structured log):
+  → Exact record of past actions and outcomes
+  → Good for: learning from past mistakes, auditability
+
+PROCEDURAL MEMORY (system prompt + tools):
+  → How the agent knows to behave and what it can do
+  → Good for: skills, personas, behavior rules
+```
+
+```ts
+// External memory: retrieve relevant past context before each turn
+async function buildContext(userId: string, currentQuery: string) {
+  const queryEmbedding = await embed(currentQuery);
+
+  // Retrieve semantically relevant past interactions
+  const pastMemories = await vectorDB.search({
+    query: queryEmbedding,
+    filter: { userId },
+    limit: 5,
+  });
+
+  return [
+    { role: 'system', content: systemPrompt },
+    // Inject relevant past context — NOT entire history
+    {
+      role: 'system',
+      content: `Relevant past context:\n${pastMemories.map(m => m.content).join('\n')}`,
+    },
+    { role: 'user', content: currentQuery },
+  ];
+}
+```
+
+---
+
+## Multi-Agent Coordination Patterns
+
+When a task requires multiple specialists:
+
+### Supervisor Pattern
+
+```
+Supervisor agent ─→ breaks task into subtasks
+    │
+    ├─→ Research agent   (reads, gathers information)
+    ├─→ Writer agent     (drafts based on research)
+    └─→ Reviewer agent   (critiques the draft)
+         │
+         └─→ Supervisor collects results, makes final decision
+```
+
+### Peer Review Pattern (Anti-Hallucination for Agents)
+
+```ts
+// Two independent agents answer the same question — supervisor resolves disagreement
+const [answerA, answerB] = await Promise.all([
+  agentA.complete(question),
+  agentB.complete(question),
+]);
+
+if (answerA.answer === answerB.answer) {
+  return answerA; // Agreement — high confidence
+}
+
+// Disagreement — escalate to human or third tiebreaker
+return await supervisor.resolve(question, answerA, answerB);
+```
+
+---
+
+## Human-in-the-Loop Gates
+
+The most important agentic pattern. Agents should request human approval before:
+
+- Deleting data
+- Sending external communications (emails, webhooks)
+- Spending real money (API calls with cost, purchases)
+- Making irreversible changes
+- Acting on low-confidence decisions
+
+```ts
+async function agentLoop(task: string) {
+  for (let step = 0; step < MAX_STEPS; step++) {
+    const planned = await llm.plan(task, history);
+
+    // ✅ Human gate before irreversible actions
+    if (planned.action.isIrreversible) {
+      const approved = await requestHumanApproval({
+        action: planned.action,
+        reason: planned.reasoning,
+        confidence: planned.confidence,
+      });
+      if (!approved) return { reason: 'human_rejected', step };
+    }
+
+    // ✅ Confidence gate — don't act when uncertain
+    if (planned.confidence < 0.7) {
+      return {
+        reason: 'human_escalation',
+        message: `Low confidence (${planned.confidence}) on: ${planned.action.description}`,
+      };
+    }
+
+    const result = await executeTool(planned.action.tool, planned.action.args);
+    history.push({ action: planned.action, result });
+
+    if (planned.goalReached) break;
+  }
+}
+```
+
+---
+
+## Guardrails
+
+Every production agent needs:
+
+```ts
+const guardrails = {
+  // Input guardrails — reject bad prompts before they reach the agent
+  input: [
+    { check: 'no_prompt_injection', action: 'reject' },
+    { check: 'within_scope', action: 'reject' }, // Off-topic requests
+    { check: 'pii_detection', action: 'redact' }, // Redact before processing
+  ],
+
+  // Output guardrails — validate before returning
+  output: [
+    { check: 'no_hallucinated_citations', action: 'flag' },
+    { check: 'schema_valid', action: 'retry_once' },
+    { check: 'no_pii_leaked', action: 'reject' },
+  ],
+
+  // Resource guardrails — prevent runaway cost/loops
+  resource: [
+    { check: 'max_tokens_per_session', limit: 100_000 },
+    { check: 'max_tool_calls_per_session', limit: 50 },
+    { check: 'max_cost_per_session_usd', limit: 1.0 },
+  ],
+};
+```
+
+---
+
+## Output Format
+
+When this skill completes a task, structure your output as:
+
+```
+━━━ Agentic Patterns Output ━━━━━━━━━━━━━━━━━━━━━━━━
+Task:        [what was performed]
+Result:      [outcome summary — one line]
+─────────────────────────────────────────────────
+Checks:      ✅ [N passed] · ⚠️  [N warnings] · ❌ [N blocked]
+VBC status:  PENDING → VERIFIED
+Evidence:    [link to terminal output, test result, or file diff]
+```
+
+---
+
+## 🚨 Edge-Case & Failure Mode Matrix
+
+| Scenario | Risk | Mitigation Strategy |
+|:---|:---|:---|
+| **Empty or Null Inputs** | Unhandled exception or unexpected rendering collapse | Enforce fallback guards, optional chaining, and explicit empty state handlers |
+| **Network Timeout / Latency** | Hanging operations or duplicate side-effects | Implement bounded abort controllers, exponential backoff, and idempotency keys |
+| **Concurrency / Race Conditions** | Stale state overwrite or inconsistent data mutations | Use atomic transactions, mutex locking, or cancel-on-resubmit controls |
+| **Invalid Schema / Malformed Payload** | Downstream runtime errors or security injection | Validate boundary payloads with Zod/Pydantic schemas prior to execution |
+| **Resource / Memory Saturation** | OOM errors, frame drops, or memory leaks | Clean up listeners, cancel active timers, and enforce pagination/virtualization |
+
+---
+
+## 🤖 LLM-Specific Traps Table
+
+| Anti-Pattern | What AI Commonly Does Wrong | What Is Actually Correct |
+|:---|:---|:---|
+| **Hallucinated Tool Capabilities** | Assuming an external library or CLI command exists without verification | Run a verification check or verify package.json before referencing tools |
+| **Premature Completion Claim** | Declaring a task finished because code was generated without verification | Execute tests, linters, or terminal commands to provide concrete proof |
+| **Context Bloat Dumping** | Pasting entire multi-thousand-line files into prompt context | Extract targeted excerpts, symbols, and signatures to preserve tokens |
+
+---
+
+## 🏛️ Tribunal Verification & Guardrails
+
+**Active Reviewers:** `orchestrator` · `agent-organizer` · `logic-reviewer`
+**Slash Command:** `/review` or `/tribunal-full`
+
+### ✅ Pre-Flight Self-Audit Checklist
+
+```
+✅ Did I deconstruct the root objective before proposing architecture?
+✅ Did I identify dependencies, bottlenecks, and parallelizable sub-tasks?
+✅ Did I avoid over-engineering and select the simplest effective pattern?
+✅ Did I verify assumptions with concrete file reads instead of speculation?
+✅ Did I establish measurable verification criteria before completion?
+```
+
+### 🛑 Verification-Before-Completion (VBC) Protocol
+
+**CRITICAL:** You must follow a strict "evidence-based closeout" state machine.
+- ❌ **Forbidden:** Declaring a task complete because the output "looks correct."
+- ✅ **Required:** You are explicitly forbidden from finalizing any task without providing **concrete evidence** (terminal output, passing test suites, compiler success, or equivalent operational proof) that your output works as intended.

package/skills/agentic-workflows-2026/SKILL.md

@@ -0,0 +1,157 @@
+---
+name: agentic-workflows-2026
+description: Use when Advanced 2026-2027 AI agent loops, ReAct planning, structured tool calling via Zod/Pydantic, streaming generative UI, and human-in-the-loop gates.
+version: 5.0.0
+last-updated: 2026-09-13
+skills:
+  - agentic-patterns
+  - generative-ui-expert
+  - parallel-agents
+tools: Read, Grep, Glob, Bash, Edit, Write
+scripts-binding:
+  - .agent/scripts/swarm_dispatcher.js
+  - .agent/scripts/context_broker.js
+  - .agent/scripts/lint_runner.js
+  - .agent/scripts/verify_all.js
+---
+
+# Agentic Workflows 2026 — Multi-Agent Architecture
+
+## Mandatory Pre-Flight Context Inspection
+
+Before generating, refactoring, or reviewing code in the `agentic-workflows-2026` domain, inspect these 5 critical parameters:
+
+1. **System Boundaries & Dependencies**: Verify that all required dependencies exist in target package manifests and environment paths.
+2. **Runtime Context & Platform Invariants**: Confirm target platform constraints (Node.js, Browser, Mobile OS, Edge runtime) before applying APIs.
+3. **Execution Guardrails**: Identify potential side-effects, state mutations, and unhandled asynchronous exceptions.
+4. **Validation & Type Contracts**: Validate input data schemas and strict type constraints across all module interfaces.
+5. **Observability & Proof of Execution**: Ensure execution produces tangible verification signals (terminal output, tests, metrics).
+
+## Activation Boundaries
+
+- **Activate when:** Use when Advanced 2026-2027 AI agent loops, ReAct planning, structured tool calling via Zod/Pydantic, streaming generative UI, and human-in-the-loop gates.
+- **DO NOT activate when:** The task falls outside the `agentic-workflows-2026` domain or is managed by a different dedicated specialist.
+
+## 🔁 Multi-Pass Execution Protocol
+
+Execute all non-trivial tasks through this 7-pass cognitive loop:
+
+| Pass | Phase | Core Action |
+|:---|:---|:---|
+| **Pass 1** | **Understand** | Deconstruct the user's explicit objective, implicit requirements, and platform constraints. |
+| **Pass 2** | **Plan** | Decompose the task into smallest logical steps; map dependencies and required tool calls. |
+| **Pass 3** | **Execute** | Implement the solution with production-grade craft, zero placeholders, and strict typing. |
+| **Pass 4** | **Verify** | Run linters, unit tests, or compiler checks to validate structural correctness. |
+| **Pass 5** | **Attack** | Perform an adversarial review searching for edge-case failures, race conditions, and traps. |
+| **Pass 6** | **Improve** | Eliminate discovered friction, optimize performance, and harden error boundaries. |
+| **Pass 7** | **Quality Gate** | Enforce Verification-Before-Completion (VBC) with concrete terminal proof before finalizing. |
+
+---
+
+## 🛠️ Technical Architecture & Reference Recipes
+
+## 2026 Agentic Architecture Invariants
+
+1. **Context Window Token Budget**:
+   Truncate or summarize completed worker waves before fanning into the supervisor agent. Never pass raw multi-megabyte tool outputs across subagents.
+2. **Deterministic Fan-In**:
+   Always aggregate worker results using `Promise.allSettled()` to prevent one failing subagent from crashing the entire swarm orchestration.
+3. **Structured Failure Handoff**:
+   If an agent fails 3 consecutive iterations, halt execution and yield an explicit diagnosis payload to the user rather than spinning in an infinite retry loop.
+
+---
+
+## Core ReAct Loop Pattern (Zod + TypeScript)
+
+```typescript
+import { z } from 'zod';
+
+export const ToolCallSchema = z.object({
+  toolName: z.enum(['read_file', 'write_file', 'run_test']),
+  args: z.record(z.unknown()),
+  reasoning: z.string().min(10),
+});
+
+export type ToolCall = z.infer<typeof ToolCallSchema>;
+
+export async function runAgentLoop(task: string, maxTurns = 10) {
+  let turn = 0;
+  const history: Array<{ role: string; content: string }> = [{ role: 'user', content: task }];
+
+  while (turn < maxTurns) {
+    turn++;
+    const response = await callLLM(history);
+    const parsed = ToolCallSchema.safeParse(response);
+
+    if (!parsed.success) {
+      history.push({
+        role: 'system',
+        content: `Invalid tool call payload: ${parsed.error.message}`,
+      });
+      continue;
+    }
+
+    if (parsed.data.toolName === 'write_file') {
+      const approved = await requestHumanApproval(parsed.data);
+      if (!approved) break;
+    }
+
+    const result = await executeTool(parsed.data);
+    history.push({ role: 'tool', content: JSON.stringify(result) });
+  }
+}
+```
+
+## Parallel Fan-Out / Fan-In Execution Matrix
+
+```
+[Supervisor Agent]
+       ├── Dispatch Worker A (Backend)  ──> WorkerResult A ──┐
+       ├── Dispatch Worker B (Database) ──> WorkerResult B ──┼─> [Promise.allSettled Synthesis]
+       └── Dispatch Worker C (Frontend) ──> WorkerResult C ──┘
+```
+
+---
+
+## 🚨 Edge-Case & Failure Mode Matrix
+
+| Scenario | Risk | Mitigation Strategy |
+|:---|:---|:---|
+| **Empty or Null Inputs** | Unhandled exception or unexpected rendering collapse | Enforce fallback guards, optional chaining, and explicit empty state handlers |
+| **Network Timeout / Latency** | Hanging operations or duplicate side-effects | Implement bounded abort controllers, exponential backoff, and idempotency keys |
+| **Concurrency / Race Conditions** | Stale state overwrite or inconsistent data mutations | Use atomic transactions, mutex locking, or cancel-on-resubmit controls |
+| **Invalid Schema / Malformed Payload** | Downstream runtime errors or security injection | Validate boundary payloads with Zod/Pydantic schemas prior to execution |
+| **Resource / Memory Saturation** | OOM errors, frame drops, or memory leaks | Clean up listeners, cancel active timers, and enforce pagination/virtualization |
+
+---
+
+## 🤖 LLM-Specific Traps Table
+
+| Anti-Pattern | What AI Commonly Does Wrong | What Is Actually Correct |
+|:---|:---|:---|
+| **Unchecked Payload Cast** | Casting request bodies to TypeScript types without runtime schema validation | Parse request payloads through Zod/Pydantic schemas before business logic |
+| **Silent Error Swallowing** | Catching errors with empty catch blocks or logging without rethrowing | Propagate structured errors with status codes and contextual stack traces |
+| **Unparameterized Query** | Concatenating user inputs into SQL/Prisma query strings | Always use parameterized bindings or type-safe ORM query builders |
+
+---
+
+## 🏛️ Tribunal Verification & Guardrails
+
+**Active Reviewers:** `logic-reviewer` · `security-auditor` · `api-architect` · `resilience-reviewer`
+**Slash Command:** `/review` or `/tribunal-full`
+
+### ✅ Pre-Flight Self-Audit Checklist
+
+```
+✅ Are all inputs and boundary payloads validated against schemas (Zod/Pydantic)?
+✅ Are SQL and database queries parameterized with zero string concatenation?
+✅ Are error boundaries and timeout/retry policies explicitly declared?
+✅ Are authentication checks performed before business logic execution?
+✅ Did I verify that imported dependencies exist in package.json/requirements.txt?
+```
+
+### 🛑 Verification-Before-Completion (VBC) Protocol
+
+**CRITICAL:** You must follow a strict "evidence-based closeout" state machine.
+- ❌ **Forbidden:** Declaring a task complete because the output "looks correct."
+- ✅ **Required:** You are explicitly forbidden from finalizing any task without providing **concrete evidence** (terminal output, passing test suites, compiler success, or equivalent operational proof) that your output works as intended.

package/skills/ai-app-hardening/SKILL.md

@@ -0,0 +1,125 @@
+---
+name: ai-app-hardening
+description: Use when OWASP Top 10 for LLMs (2026), prompt injection defense, model output sanitization, indirect injection defense, and automated SBOM dependency security.
+version: 5.0.0
+last-updated: 2026-09-13
+skills:
+  - ai-prompt-injection-defense
+  - vulnerability-scanner
+  - backend-security-expert
+tools: Read, Grep, Glob, Bash, Edit, Write
+scripts-binding:
+  - .agent/scripts/security_scan.js
+  - .agent/scripts/guardrail_engine.js
+  - .agent/scripts/lint_runner.js
+  - .agent/scripts/verify_all.js
+---
+
+# AI Application Hardening & Indirect Prompt Injection Defense
+
+## Mandatory Pre-Flight Context Inspection
+
+Before generating, refactoring, or reviewing code in the `ai-app-hardening` domain, inspect these 5 critical parameters:
+
+1. **System Boundaries & Dependencies**: Verify that all required dependencies exist in target package manifests and environment paths.
+2. **Runtime Context & Platform Invariants**: Confirm target platform constraints (Node.js, Browser, Mobile OS, Edge runtime) before applying APIs.
+3. **Execution Guardrails**: Identify potential side-effects, state mutations, and unhandled asynchronous exceptions.
+4. **Validation & Type Contracts**: Validate input data schemas and strict type constraints across all module interfaces.
+5. **Observability & Proof of Execution**: Ensure execution produces tangible verification signals (terminal output, tests, metrics).
+
+## Activation Boundaries
+
+- **Activate when:** Use when OWASP Top 10 for LLMs (2026), prompt injection defense, model output sanitization, indirect injection defense, and automated SBOM dependency security.
+- **DO NOT activate when:** The task falls outside the `ai-app-hardening` domain or is managed by a different dedicated specialist.
+
+## 🔁 Multi-Pass Execution Protocol
+
+Execute all non-trivial tasks through this 7-pass cognitive loop:
+
+| Pass | Phase | Core Action |
+|:---|:---|:---|
+| **Pass 1** | **Understand** | Deconstruct the user's explicit objective, implicit requirements, and platform constraints. |
+| **Pass 2** | **Plan** | Decompose the task into smallest logical steps; map dependencies and required tool calls. |
+| **Pass 3** | **Execute** | Implement the solution with production-grade craft, zero placeholders, and strict typing. |
+| **Pass 4** | **Verify** | Run linters, unit tests, or compiler checks to validate structural correctness. |
+| **Pass 5** | **Attack** | Perform an adversarial review searching for edge-case failures, race conditions, and traps. |
+| **Pass 6** | **Improve** | Eliminate discovered friction, optimize performance, and harden error boundaries. |
+| **Pass 7** | **Quality Gate** | Enforce Verification-Before-Completion (VBC) with concrete terminal proof before finalizing. |
+
+---
+
+## 🛠️ Technical Architecture & Reference Recipes
+
+## Indirect Prompt Injection Defense Filter
+
+```typescript
+export function sanitizeRAGDocument(rawDocumentContent: string): string {
+  if (!rawDocumentContent || typeof rawDocumentContent !== 'string') return '';
+
+  // 1. Redact indirect prompt injection trigger phrases
+  let cleaned = rawDocumentContent.replace(
+    /(?:system:\s*ignore|override system prompt|you are now in developer mode|print system prompt)/gi,
+    '[REDACTED_INDIRECT_INJECTION]',
+  );
+
+  // 2. Escape structural tag injection attempts
+  cleaned = cleaned.replace(/<\/?(?:system|user_input|external_context)[^>]*>/gi, '');
+
+  // 3. Truncate document snippet length
+  return cleaned.slice(0, 3000).trim();
+}
+```
+
+## OWASP LLM Top 10 (2026 Matrix)
+
+| Risk ID   | Vulnerability                        | Defense Implementation                              |
+| --------- | ------------------------------------ | --------------------------------------------------- |
+| **LLM01** | Prompt Injection (Direct & Indirect) | Delimiter sandboxing + `sanitizeRAGDocument` filter |
+| **LLM02** | Insecure Output Handling             | Strict Zod output parsing + DOMPurify on frontend   |
+| **LLM04** | Model Denial of Service              | Hard `max_tokens` limit + IP bucket rate limiting   |
+| **LLM07** | System Prompt Leakage                | System prompt redaction guards in output stream     |
+
+---
+
+## 🚨 Edge-Case & Failure Mode Matrix
+
+| Scenario | Risk | Mitigation Strategy |
+|:---|:---|:---|
+| **Empty or Null Inputs** | Unhandled exception or unexpected rendering collapse | Enforce fallback guards, optional chaining, and explicit empty state handlers |
+| **Network Timeout / Latency** | Hanging operations or duplicate side-effects | Implement bounded abort controllers, exponential backoff, and idempotency keys |
+| **Concurrency / Race Conditions** | Stale state overwrite or inconsistent data mutations | Use atomic transactions, mutex locking, or cancel-on-resubmit controls |
+| **Invalid Schema / Malformed Payload** | Downstream runtime errors or security injection | Validate boundary payloads with Zod/Pydantic schemas prior to execution |
+| **Resource / Memory Saturation** | OOM errors, frame drops, or memory leaks | Clean up listeners, cancel active timers, and enforce pagination/virtualization |
+
+---
+
+## 🤖 LLM-Specific Traps Table
+
+| Anti-Pattern | What AI Commonly Does Wrong | What Is Actually Correct |
+|:---|:---|:---|
+| **Hardcoded Secret Pattern** | Committing API keys, tokens, or private salts into source code | Load credentials strictly via runtime environment variables and secret stores |
+| **Prompt Injection Surface** | Directly concatenating untrusted user input into LLM system prompts | Wrap user content in isolated delimiters and strip injection control sequences |
+| **Missing Authorization Check** | Relying only on authentication token presence without checking tenant/object RBAC | Verify user permissions against the specific target record ID before mutation |
+
+---
+
+## 🏛️ Tribunal Verification & Guardrails
+
+**Active Reviewers:** `security-auditor` · `penetration-tester` · `backend-security-expert`
+**Slash Command:** `/review` or `/tribunal-full`
+
+### ✅ Pre-Flight Self-Audit Checklist
+
+```
+✅ Are user inputs sanitized and treated as untrusted at system boundaries?
+✅ Are secrets loaded strictly via environment variables with zero hardcoding?
+✅ Is least-privilege enforcement active on APIs, tokens, and storage buckets?
+✅ Are prompt-injection delimiters and sanitizers wrapped around LLM inputs?
+✅ Did I verify encryption in transit and at rest for sensitive customer data?
+```
+
+### 🛑 Verification-Before-Completion (VBC) Protocol
+
+**CRITICAL:** You must follow a strict "evidence-based closeout" state machine.
+- ❌ **Forbidden:** Declaring a task complete because the output "looks correct."
+- ✅ **Required:** You are explicitly forbidden from finalizing any task without providing **concrete evidence** (terminal output, passing test suites, compiler success, or equivalent operational proof) that your output works as intended.