tribunal-kit 9.2.1 → 9.2.4

package/.agent/skills/webgpu-performance/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: webgpu-performance
-description: Use when High-performance browser graphics and compute mastery. Transitioning from WebGL to WebGPU API, WGSL compute shaders, explicit GPU memory management, and browser-side tensor calculations.
+description: "Use when High-performance browser graphics and compute mastery. Transitioning from WebGL to WebGPU API, WGSL compute shaders, explicit GPU memory management, and browser-side tensor calculations."
 version: 5.0.0
 last-updated: 2026-09-13
 skills:
@@ -15,35 +15,6 @@ scripts-binding:
 
 # WebGPU Performance Mastery
 
-## Mandatory Pre-Flight Context Inspection
-
-Before generating, refactoring, or reviewing code in the `webgpu-performance` domain, inspect these 5 critical parameters:
-
-1. **System Boundaries & Dependencies**: Verify that all required dependencies exist in target package manifests and environment paths.
-2. **Runtime Context & Platform Invariants**: Confirm target platform constraints (Node.js, Browser, Mobile OS, Edge runtime) before applying APIs.
-3. **Execution Guardrails**: Identify potential side-effects, state mutations, and unhandled asynchronous exceptions.
-4. **Validation & Type Contracts**: Validate input data schemas and strict type constraints across all module interfaces.
-5. **Observability & Proof of Execution**: Ensure execution produces tangible verification signals (terminal output, tests, metrics).
-
-## Activation Boundaries
-
-- **Activate when:** Use when High-performance browser graphics and compute mastery. Transitioning from WebGL to WebGPU API, WGSL compute shaders, explicit GPU memory management, and browser-side tensor calculations.
-- **DO NOT activate when:** The task falls outside the `webgpu-performance` domain or is managed by a different dedicated specialist.
-
-## 🔁 Multi-Pass Execution Protocol
-
-Execute all non-trivial tasks through this 7-pass cognitive loop:
-
-| Pass       | Phase            | Core Action                                                                                  |
-| :--------- | :--------------- | :------------------------------------------------------------------------------------------- |
-| **Pass 1** | **Understand**   | Deconstruct the user's explicit objective, implicit requirements, and platform constraints.  |
-| **Pass 2** | **Plan**         | Decompose the task into smallest logical steps; map dependencies and required tool calls.    |
-| **Pass 3** | **Execute**      | Implement the solution with production-grade craft, zero placeholders, and strict typing.    |
-| **Pass 4** | **Verify**       | Run linters, unit tests, or compiler checks to validate structural correctness.              |
-| **Pass 5** | **Attack**       | Perform an adversarial review searching for edge-case failures, race conditions, and traps.  |
-| **Pass 6** | **Improve**      | Eliminate discovered friction, optimize performance, and harden error boundaries.            |
-| **Pass 7** | **Quality Gate** | Enforce Verification-Before-Completion (VBC) with concrete terminal proof before finalizing. |
-
 ---
 
 ## 🛠️ Technical Architecture & Reference Recipes
@@ -115,49 +86,3 @@ Before submitting code, ensure:
 1. Devices and adapters are properly null-checked.
 2. WGSL workgroup sizes align with the dispatch sizes dynamically.
 3. GPUBuffers used for compute have `GPUBufferUsage.STORAGE` flags.
-
----
-
-## 🚨 Edge-Case & Failure Mode Matrix
-
-| Scenario                               | Risk                                                 | Mitigation Strategy                                                             |
-| :------------------------------------- | :--------------------------------------------------- | :------------------------------------------------------------------------------ |
-| **Empty or Null Inputs**               | Unhandled exception or unexpected rendering collapse | Enforce fallback guards, optional chaining, and explicit empty state handlers   |
-| **Network Timeout / Latency**          | Hanging operations or duplicate side-effects         | Implement bounded abort controllers, exponential backoff, and idempotency keys  |
-| **Concurrency / Race Conditions**      | Stale state overwrite or inconsistent data mutations | Use atomic transactions, mutex locking, or cancel-on-resubmit controls          |
-| **Invalid Schema / Malformed Payload** | Downstream runtime errors or security injection      | Validate boundary payloads with Zod/Pydantic schemas prior to execution         |
-| **Resource / Memory Saturation**       | OOM errors, frame drops, or memory leaks             | Clean up listeners, cancel active timers, and enforce pagination/virtualization |
-
----
-
-## 🤖 LLM-Specific Traps Table
-
-| Anti-Pattern                       | What AI Commonly Does Wrong                                               | What Is Actually Correct                                                 |
-| :--------------------------------- | :------------------------------------------------------------------------ | :----------------------------------------------------------------------- |
-| **Hallucinated Tool Capabilities** | Assuming an external library or CLI command exists without verification   | Run a verification check or verify package.json before referencing tools |
-| **Premature Completion Claim**     | Declaring a task finished because code was generated without verification | Execute tests, linters, or terminal commands to provide concrete proof   |
-| **Context Bloat Dumping**          | Pasting entire multi-thousand-line files into prompt context              | Extract targeted excerpts, symbols, and signatures to preserve tokens    |
-
----
-
-## 🏛️ Tribunal Verification & Guardrails
-
-**Active Reviewers:** `orchestrator` · `agent-organizer` · `logic-reviewer`
-**Slash Command:** `/review` or `/tribunal-full`
-
-### ✅ Pre-Flight Self-Audit Checklist
-
-```
-✅ Did I deconstruct the root objective before proposing architecture?
-✅ Did I identify dependencies, bottlenecks, and parallelizable sub-tasks?
-✅ Did I avoid over-engineering and select the simplest effective pattern?
-✅ Did I verify assumptions with concrete file reads instead of speculation?
-✅ Did I establish measurable verification criteria before completion?
-```
-
-### 🛑 Verification-Before-Completion (VBC) Protocol
-
-**CRITICAL:** You must follow a strict "evidence-based closeout" state machine.
-
-- ❌ **Forbidden:** Declaring a task complete because the output "looks correct."
-- ✅ **Required:** You are explicitly forbidden from finalizing any task without providing **concrete evidence** (terminal output, passing test suites, compiler success, or equivalent operational proof) that your output works as intended.

package/.agent/skills/whimsy-injector/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: whimsy-injector
-description: Use when Micro-delight generator for frontend interfaces. Suggests and implements subtle animations, playful transitions, and interaction polish across any frontend stack.
+description: "Use when Micro-delight generator for frontend interfaces. Suggests and implements subtle animations, playful transitions, and interaction polish across any frontend stack."
 version: 5.0.0
 last-updated: 2026-09-13
 skills:
@@ -16,35 +16,6 @@ scripts-binding:
 
 # Whimsy Injector Skill — Micro-Delight Generator
 
-## Mandatory Pre-Flight Context Inspection
-
-Before generating, refactoring, or reviewing code in the `whimsy-injector` domain, inspect these 5 critical parameters:
-
-1. **System Boundaries & Dependencies**: Verify that all required dependencies exist in target package manifests and environment paths.
-2. **Runtime Context & Platform Invariants**: Confirm target platform constraints (Node.js, Browser, Mobile OS, Edge runtime) before applying APIs.
-3. **Execution Guardrails**: Identify potential side-effects, state mutations, and unhandled asynchronous exceptions.
-4. **Validation & Type Contracts**: Validate input data schemas and strict type constraints across all module interfaces.
-5. **Observability & Proof of Execution**: Ensure execution produces tangible verification signals (terminal output, tests, metrics).
-
-## Activation Boundaries
-
-- **Activate when:** Use when Micro-delight generator for frontend interfaces. Suggests and implements subtle animations, playful transitions, and interaction polish across any frontend stack.
-- **DO NOT activate when:** The task falls outside the `whimsy-injector` domain or is managed by a different dedicated specialist.
-
-## 🔁 Multi-Pass Execution Protocol
-
-Execute all non-trivial tasks through this 7-pass cognitive loop:
-
-| Pass       | Phase            | Core Action                                                                                  |
-| :--------- | :--------------- | :------------------------------------------------------------------------------------------- |
-| **Pass 1** | **Understand**   | Deconstruct the user's explicit objective, implicit requirements, and platform constraints.  |
-| **Pass 2** | **Plan**         | Decompose the task into smallest logical steps; map dependencies and required tool calls.    |
-| **Pass 3** | **Execute**      | Implement the solution with production-grade craft, zero placeholders, and strict typing.    |
-| **Pass 4** | **Verify**       | Run linters, unit tests, or compiler checks to validate structural correctness.              |
-| **Pass 5** | **Attack**       | Perform an adversarial review searching for edge-case failures, race conditions, and traps.  |
-| **Pass 6** | **Improve**      | Eliminate discovered friction, optimize performance, and harden error boundaries.            |
-| **Pass 7** | **Quality Gate** | Enforce Verification-Before-Completion (VBC) with concrete terminal proof before finalizing. |
-
 ---
 
 ## 🛠️ Technical Architecture & Reference Recipes
@@ -332,49 +303,3 @@ Every file with animations MUST include:
 - **Mark experimental APIs** with `// VERIFY: [API] — check browser support for your target`.
 - **Never suggest animations that cause layout shift** — enforce `transform` and `opacity` only.
 - **Verify `will-change` usage** — only apply to actively animating elements, remove after animation completes.
-
----
-
-## 🚨 Edge-Case & Failure Mode Matrix
-
-| Scenario                               | Risk                                                 | Mitigation Strategy                                                             |
-| :------------------------------------- | :--------------------------------------------------- | :------------------------------------------------------------------------------ |
-| **Empty or Null Inputs**               | Unhandled exception or unexpected rendering collapse | Enforce fallback guards, optional chaining, and explicit empty state handlers   |
-| **Network Timeout / Latency**          | Hanging operations or duplicate side-effects         | Implement bounded abort controllers, exponential backoff, and idempotency keys  |
-| **Concurrency / Race Conditions**      | Stale state overwrite or inconsistent data mutations | Use atomic transactions, mutex locking, or cancel-on-resubmit controls          |
-| **Invalid Schema / Malformed Payload** | Downstream runtime errors or security injection      | Validate boundary payloads with Zod/Pydantic schemas prior to execution         |
-| **Resource / Memory Saturation**       | OOM errors, frame drops, or memory leaks             | Clean up listeners, cancel active timers, and enforce pagination/virtualization |
-
----
-
-## 🤖 LLM-Specific Traps Table
-
-| Anti-Pattern                    | What AI Commonly Does Wrong                                        | What Is Actually Correct                                                      |
-| :------------------------------ | :----------------------------------------------------------------- | :---------------------------------------------------------------------------- |
-| **Uncontrolled Re-render Loop** | Mutating state inside render bodies or omitting hook dependencies  | Wrap effects with explicit deps and isolate reactive derivations in useMemo   |
-| **Accessibility Neglect**       | Interactive <div> without role="button", tabIndex, or onKeyDown    | Use semantic <button> or provide ARIA role, keyboard handlers, and focus ring |
-| **Layout Shift Flash**          | Images/dynamic content without aspect-ratio or explicit dimensions | Enforce aspect-ratio or skeleton placeholders to guarantee zero CLS           |
-
----
-
-## 🏛️ Tribunal Verification & Guardrails
-
-**Active Reviewers:** `frontend-reviewer` · `type-safety` · `ui-ux-auditor` · `complexity-reviewer`
-**Slash Command:** `/review` or `/tribunal-full`
-
-### ✅ Pre-Flight Self-Audit Checklist
-
-```
-✅ Are all component props strictly typed with zero implicit "any"?
-✅ Are responsive breakpoints, fluid typography, and optical balance verified?
-✅ Is accessibility (ARIA labels, keyboard focus, contrast) validated?
-✅ Are re-renders minimized and state lifecycles cleanly separated?
-✅ Did I verify all imported UI components and icon sets actually exist?
-```
-
-### 🛑 Verification-Before-Completion (VBC) Protocol
-
-**CRITICAL:** You must follow a strict "evidence-based closeout" state machine.
-
-- ❌ **Forbidden:** Declaring a task complete because the output "looks correct."
-- ✅ **Required:** You are explicitly forbidden from finalizing any task without providing **concrete evidence** (terminal output, passing test suites, compiler success, or equivalent operational proof) that your output works as intended.

package/.agent/skills/workflow-optimizer/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: workflow-optimizer
-description: Use when Analyzes agent tool-calling patterns and task execution efficiency to suggest process improvements.
+description: "Use when Analyzes agent tool-calling patterns and task execution efficiency to suggest process improvements."
 version: 5.0.0
 last-updated: 2026-09-13
 skills:
@@ -16,35 +16,6 @@ scripts-binding:
 
 # Workflow Optimizer Skill
 
-## Mandatory Pre-Flight Context Inspection
-
-Before generating, refactoring, or reviewing code in the `workflow-optimizer` domain, inspect these 5 critical parameters:
-
-1. **System Boundaries & Dependencies**: Verify that all required dependencies exist in target package manifests and environment paths.
-2. **Runtime Context & Platform Invariants**: Confirm target platform constraints (Node.js, Browser, Mobile OS, Edge runtime) before applying APIs.
-3. **Execution Guardrails**: Identify potential side-effects, state mutations, and unhandled asynchronous exceptions.
-4. **Validation & Type Contracts**: Validate input data schemas and strict type constraints across all module interfaces.
-5. **Observability & Proof of Execution**: Ensure execution produces tangible verification signals (terminal output, tests, metrics).
-
-## Activation Boundaries
-
-- **Activate when:** Use when Analyzes agent tool-calling patterns and task execution efficiency to suggest process improvements.
-- **DO NOT activate when:** The task falls outside the `workflow-optimizer` domain or is managed by a different dedicated specialist.
-
-## 🔁 Multi-Pass Execution Protocol
-
-Execute all non-trivial tasks through this 7-pass cognitive loop:
-
-| Pass       | Phase            | Core Action                                                                                  |
-| :--------- | :--------------- | :------------------------------------------------------------------------------------------- |
-| **Pass 1** | **Understand**   | Deconstruct the user's explicit objective, implicit requirements, and platform constraints.  |
-| **Pass 2** | **Plan**         | Decompose the task into smallest logical steps; map dependencies and required tool calls.    |
-| **Pass 3** | **Execute**      | Implement the solution with production-grade craft, zero placeholders, and strict typing.    |
-| **Pass 4** | **Verify**       | Run linters, unit tests, or compiler checks to validate structural correctness.              |
-| **Pass 5** | **Attack**       | Perform an adversarial review searching for edge-case failures, race conditions, and traps.  |
-| **Pass 6** | **Improve**      | Eliminate discovered friction, optimize performance, and harden error boundaries.            |
-| **Pass 7** | **Quality Gate** | Enforce Verification-Before-Completion (VBC) with concrete terminal proof before finalizing. |
-
 ---
 
 ## 🛠️ Technical Architecture & Reference Recipes
@@ -215,49 +186,3 @@ Before analyzing, check for these common quick wins:
 - **Recommendations must reference real tools** — only suggest tools available in the current environment.
 - **Never fabricate efficiency scores** — always calculate from actual vs optimal counts.
 - **Acknowledge uncertainty**: "Cannot determine if calls 3-5 had data dependency — may be correctly sequential."
-
----
-
-## 🚨 Edge-Case & Failure Mode Matrix
-
-| Scenario                               | Risk                                                 | Mitigation Strategy                                                             |
-| :------------------------------------- | :--------------------------------------------------- | :------------------------------------------------------------------------------ |
-| **Empty or Null Inputs**               | Unhandled exception or unexpected rendering collapse | Enforce fallback guards, optional chaining, and explicit empty state handlers   |
-| **Network Timeout / Latency**          | Hanging operations or duplicate side-effects         | Implement bounded abort controllers, exponential backoff, and idempotency keys  |
-| **Concurrency / Race Conditions**      | Stale state overwrite or inconsistent data mutations | Use atomic transactions, mutex locking, or cancel-on-resubmit controls          |
-| **Invalid Schema / Malformed Payload** | Downstream runtime errors or security injection      | Validate boundary payloads with Zod/Pydantic schemas prior to execution         |
-| **Resource / Memory Saturation**       | OOM errors, frame drops, or memory leaks             | Clean up listeners, cancel active timers, and enforce pagination/virtualization |
-
----
-
-## 🤖 LLM-Specific Traps Table
-
-| Anti-Pattern                       | What AI Commonly Does Wrong                                               | What Is Actually Correct                                                 |
-| :--------------------------------- | :------------------------------------------------------------------------ | :----------------------------------------------------------------------- |
-| **Hallucinated Tool Capabilities** | Assuming an external library or CLI command exists without verification   | Run a verification check or verify package.json before referencing tools |
-| **Premature Completion Claim**     | Declaring a task finished because code was generated without verification | Execute tests, linters, or terminal commands to provide concrete proof   |
-| **Context Bloat Dumping**          | Pasting entire multi-thousand-line files into prompt context              | Extract targeted excerpts, symbols, and signatures to preserve tokens    |
-
----
-
-## 🏛️ Tribunal Verification & Guardrails
-
-**Active Reviewers:** `orchestrator` · `agent-organizer` · `logic-reviewer`
-**Slash Command:** `/review` or `/tribunal-full`
-
-### ✅ Pre-Flight Self-Audit Checklist
-
-```
-✅ Did I deconstruct the root objective before proposing architecture?
-✅ Did I identify dependencies, bottlenecks, and parallelizable sub-tasks?
-✅ Did I avoid over-engineering and select the simplest effective pattern?
-✅ Did I verify assumptions with concrete file reads instead of speculation?
-✅ Did I establish measurable verification criteria before completion?
-```
-
-### 🛑 Verification-Before-Completion (VBC) Protocol
-
-**CRITICAL:** You must follow a strict "evidence-based closeout" state machine.
-
-- ❌ **Forbidden:** Declaring a task complete because the output "looks correct."
-- ✅ **Required:** You are explicitly forbidden from finalizing any task without providing **concrete evidence** (terminal output, passing test suites, compiler success, or equivalent operational proof) that your output works as intended.

package/.agent/skills/zero-trust-passkeys/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: zero-trust-passkeys
-description: Use when Modern passwordless authentication using WebAuthn, FIDO2 biometric passkeys, SimpleWebAuthn v13+, Conditional UI (Passkey Autofill), and Zero-Trust security.
+description: "Use when Modern passwordless authentication using WebAuthn, FIDO2 biometric passkeys, SimpleWebAuthn v13+, Conditional UI (Passkey Autofill), and Zero-Trust security."
 version: 5.0.0
 last-updated: 2026-09-13
 skills:
@@ -16,35 +16,6 @@ scripts-binding:
 
 # Zero-Trust Passkeys & WebAuthn (SimpleWebAuthn v13+)
 
-## Mandatory Pre-Flight Context Inspection
-
-Before generating, refactoring, or reviewing code in the `zero-trust-passkeys` domain, inspect these 5 critical parameters:
-
-1. **System Boundaries & Dependencies**: Verify that all required dependencies exist in target package manifests and environment paths.
-2. **Runtime Context & Platform Invariants**: Confirm target platform constraints (Node.js, Browser, Mobile OS, Edge runtime) before applying APIs.
-3. **Execution Guardrails**: Identify potential side-effects, state mutations, and unhandled asynchronous exceptions.
-4. **Validation & Type Contracts**: Validate input data schemas and strict type constraints across all module interfaces.
-5. **Observability & Proof of Execution**: Ensure execution produces tangible verification signals (terminal output, tests, metrics).
-
-## Activation Boundaries
-
-- **Activate when:** Use when Modern passwordless authentication using WebAuthn, FIDO2 biometric passkeys, SimpleWebAuthn v13+, Conditional UI (Passkey Autofill), and Zero-Trust security.
-- **DO NOT activate when:** The task falls outside the `zero-trust-passkeys` domain or is managed by a different dedicated specialist.
-
-## 🔁 Multi-Pass Execution Protocol
-
-Execute all non-trivial tasks through this 7-pass cognitive loop:
-
-| Pass       | Phase            | Core Action                                                                                  |
-| :--------- | :--------------- | :------------------------------------------------------------------------------------------- |
-| **Pass 1** | **Understand**   | Deconstruct the user's explicit objective, implicit requirements, and platform constraints.  |
-| **Pass 2** | **Plan**         | Decompose the task into smallest logical steps; map dependencies and required tool calls.    |
-| **Pass 3** | **Execute**      | Implement the solution with production-grade craft, zero placeholders, and strict typing.    |
-| **Pass 4** | **Verify**       | Run linters, unit tests, or compiler checks to validate structural correctness.              |
-| **Pass 5** | **Attack**       | Perform an adversarial review searching for edge-case failures, race conditions, and traps.  |
-| **Pass 6** | **Improve**      | Eliminate discovered friction, optimize performance, and harden error boundaries.            |
-| **Pass 7** | **Quality Gate** | Enforce Verification-Before-Completion (VBC) with concrete terminal proof before finalizing. |
-
 ---
 
 ## 🛠️ Technical Architecture & Reference Recipes
@@ -109,49 +80,3 @@ export async function verifyPasskeyAuth(
   return verification.verified;
 }
 ```
-
----
-
-## 🚨 Edge-Case & Failure Mode Matrix
-
-| Scenario                               | Risk                                                 | Mitigation Strategy                                                             |
-| :------------------------------------- | :--------------------------------------------------- | :------------------------------------------------------------------------------ |
-| **Empty or Null Inputs**               | Unhandled exception or unexpected rendering collapse | Enforce fallback guards, optional chaining, and explicit empty state handlers   |
-| **Network Timeout / Latency**          | Hanging operations or duplicate side-effects         | Implement bounded abort controllers, exponential backoff, and idempotency keys  |
-| **Concurrency / Race Conditions**      | Stale state overwrite or inconsistent data mutations | Use atomic transactions, mutex locking, or cancel-on-resubmit controls          |
-| **Invalid Schema / Malformed Payload** | Downstream runtime errors or security injection      | Validate boundary payloads with Zod/Pydantic schemas prior to execution         |
-| **Resource / Memory Saturation**       | OOM errors, frame drops, or memory leaks             | Clean up listeners, cancel active timers, and enforce pagination/virtualization |
-
----
-
-## 🤖 LLM-Specific Traps Table
-
-| Anti-Pattern                    | What AI Commonly Does Wrong                                                       | What Is Actually Correct                                                       |
-| :------------------------------ | :-------------------------------------------------------------------------------- | :----------------------------------------------------------------------------- |
-| **Hardcoded Secret Pattern**    | Committing API keys, tokens, or private salts into source code                    | Load credentials strictly via runtime environment variables and secret stores  |
-| **Prompt Injection Surface**    | Directly concatenating untrusted user input into LLM system prompts               | Wrap user content in isolated delimiters and strip injection control sequences |
-| **Missing Authorization Check** | Relying only on authentication token presence without checking tenant/object RBAC | Verify user permissions against the specific target record ID before mutation  |
-
----
-
-## 🏛️ Tribunal Verification & Guardrails
-
-**Active Reviewers:** `security-auditor` · `penetration-tester` · `backend-security-expert`
-**Slash Command:** `/review` or `/tribunal-full`
-
-### ✅ Pre-Flight Self-Audit Checklist
-
-```
-✅ Are user inputs sanitized and treated as untrusted at system boundaries?
-✅ Are secrets loaded strictly via environment variables with zero hardcoding?
-✅ Is least-privilege enforcement active on APIs, tokens, and storage buckets?
-✅ Are prompt-injection delimiters and sanitizers wrapped around LLM inputs?
-✅ Did I verify encryption in transit and at rest for sensitive customer data?
-```
-
-### 🛑 Verification-Before-Completion (VBC) Protocol
-
-**CRITICAL:** You must follow a strict "evidence-based closeout" state machine.
-
-- ❌ **Forbidden:** Declaring a task complete because the output "looks correct."
-- ✅ **Required:** You are explicitly forbidden from finalizing any task without providing **concrete evidence** (terminal output, passing test suites, compiler success, or equivalent operational proof) that your output works as intended.

package/.agent/workflows/assimilate.md

@@ -0,0 +1,21 @@
+---
+name: assimilate
+description: "Trigger the learning pipeline to extract, validate, and store Tribunal Instincts."
+version: 1.0.0
+---
+
+# ASSIMILATE (LEARNING PIPELINE)
+
+## Invocation
+`/assimilate` or `/learn`
+
+## Behavior
+Instead of learning in real-time and bloating the execution path, learning is an offline batch job.
+
+1. **Extraction**: Invokes the `memory_archivist.js` which reads the most recent session logs.
+2. **Analysis**: Searches for repeated errors, test failures, and ultimate successful fixes.
+3. **Validation**: Converts successful fixes into candidate "Tribunal Instincts".
+4. **Storage**: Saves the verified evidence-backed instinct into `instincts.json` where `context_broker.js` can retrieve it for future related tasks.
+
+## Limits
+Do not trigger this workflow automatically after every prompt. Use it specifically after a long debugging session or a complex architectural setup to persist the hard-earned lessons.

package/.agent/workflows/audit.md

@@ -165,3 +165,8 @@ No files are modified without explicit approval.
 | Audit clean                  | → `/deploy` if preparing for release            |
 
 ---
+
+
+## Harness vs Application Auditing
+
+The `/audit` command now explicitly distinguishes between Application Security (OWASP, SQLi) and Harness Security (AgentShield prompt injection, MCP configuration risks).

package/.agent/workflows/generate.md

@@ -140,7 +140,7 @@ complexity-reviewer→ Enforces the Dependency Ladder to prevent over-engineerin
 | `aria`, `wcag`, `a11y`, `accessibility`                     | `accessibility-reviewer` + `ui-ux-auditor`                     |
 | `import`, `package`, `npm`, `require`                       | `dependency-reviewer`                                          |
 
-> For maximum safety on critical code: use `/tribunal-full` for all 21 reviewers simultaneously.
+> For maximum safety on critical code: use `/tribunal-full` for all 28 reviewers simultaneously.
 
 ---
 
@@ -209,3 +209,8 @@ Write to disk?  Y = approve | N = discard | R = revise with feedback
 /generate a GSAP ScrollTrigger timeline with useGSAP React hook
 /generate an OpenAI structured output call with Zod schema validation
 ```
+
+
+## Brain-Hands Separation & Durable Logging
+
+During code generation, the model (Brain) issues tool requests, and the harness (Hands) executes them. Every tool execution is recorded in the durable log. Verification must complete before Human Gate approval.

package/.agent/workflows/htop.md

@@ -0,0 +1,22 @@
+---
+name: htop
+description: "Inspect active agent execution metrics, task telemetry, and syscall status."
+version: 1.0.0
+---
+
+# HTOP (SYSCALL MONITOR)
+
+## Invocation
+`/htop` or `/syscall-monitor`
+
+## Behavior
+Provides a real-time (or checkpointed) readout of the agent harness execution state.
+
+When invoked, the system reads from `session_logger.js` and `harness_manager.js` to report:
+1. **Active Syscalls**: Which commands are currently executing in the background.
+2. **Token Usage**: Aggregate token consumption for the current session.
+3. **Task Status**: Which nodes in the DAG orchestrator are `PENDING`, `RUNNING`, or `DONE`.
+4. **Timeouts**: Any tools approaching their 5-minute kill threshold.
+
+## Usage
+Use this command when a marathon agent appears to be stuck, to inspect whether it is waiting on a slow `npm install` or if it has entered an infinite loop.

package/.agent/workflows/marathon.md

@@ -284,3 +284,8 @@ node .agent/scripts/marathon_harness.js reset
 | Marathon fully completed  | → `/deploy` to ship                   |
 
 ---
+
+
+## Long-Running State & Interruption
+
+Marathon workflows maintain long-running task state via frequent checkpoints. If interrupted, the workflow can be restarted cleanly using `/resume` without losing validated state.

package/.agent/workflows/orchestrate.md

@@ -28,7 +28,7 @@ Before dispatching multi-agent orchestrations or parallel sub-task workers, you
 
 4. Required Skills → Before executing, load and follow procedural rules from:
    - `agent-organizer` (.agent/skills/agent-organizer/SKILL.md): Multi-agent coordination and task decomposition
-   - `parallel-agents` (.agent/skills/parallel-agents/SKILL.md): Parallel agent dispatch patterns and fan-in synthesis
+   - `parallel-agents` (the parallel-agents skill): Parallel agent dispatch patterns and fan-in synthesis
    - `agentic-patterns` (.agent/skills/agentic-patterns/SKILL.md): Agentic design patterns for multi-agent systems
 
 ---

package/.agent/workflows/resume.md

@@ -0,0 +1,20 @@
+---
+name: resume
+description: "Resume a recoverable Tribunal Kit session from the durable event log."
+version: 1.0.0
+---
+
+# RESUME WORKFLOW
+
+## Invocation
+`/resume [session_id]`
+
+## Behavior
+Tribunal Kit now uses a durable JSONL event log via `session_logger.js`. If a process is killed (OOM, timeout, user interrupt), the state is not lost.
+
+1. **Validation**: Locates the session events in `.agent_session.json`.
+2. **Rehydration**: Replays deterministic pure functions to reconstruct the last known valid state.
+3. **Resumption**: Skips over completed tasks and automatically restarts the task that was interrupted, pulling in the precise context needed for that specific wave.
+
+## Safety Boundaries
+The `/resume` workflow will NEVER blindly replay non-idempotent side effects (e.g., executing a POST request or DROP TABLE) without Human Gate confirmation. 

package/.agent/workflows/review-ai.md

@@ -24,7 +24,7 @@ Before auditing LLM integrations, prompt templates, or AI API calls, you MUST in
 
 1. Target AI Code & SDK Manifests (`package.json`) → Verify official AI SDK versions (Vercel AI SDK `ai`, `@langchain/core`, `openai`, `@google/genai`)
 2. Prompt Injection Boundary Check → Confirm user inputs are strictly passed via message roles or delimited blocks; ban string concatenation into system prompts
-3. 3-Reviewer AI Integration Gate → Run ai-code-reviewer, logic-reviewer, and security-auditor before approving AI code diffs
+3. 28-Reviewer AI Integration Gate → Run ai-code-reviewer, logic-reviewer, and security-auditor before approving AI code diffs
 
 4. Required Skills → Before executing, load and follow procedural rules from:
    - `llm-engineering` (.agent/skills/llm-engineering/SKILL.md): LLM integration patterns, prompt engineering, and cost optimization

package/.agent/workflows/skill-enhancement-engine.md

@@ -7,10 +7,6 @@ required-skills:
   - skill-creator
   - llm-engineering
   - clean-code
-scripts-binding:
-  - scripts/skill_enhancement_engine.js
-  - scripts/validate-payload.js
-  - scripts/audit_skill_sdo.js
 ---
 
 # /skill-enhancement-engine — State-of-the-Art Skill Architecture
@@ -55,20 +51,20 @@ Every enhanced skill incorporates the 18-part architectural framework:
 
 ```bash
 # Preview changes across all skills
-node scripts/skill_enhancement_engine.js --all --dry-run
+node runners/skill_enhancement_engine.js --all --dry-run
 
 # Enhance a single skill
-node scripts/skill_enhancement_engine.js --skill <skill-name> --fix
+node runners/skill_enhancement_engine.js --skill <skill-name> --fix
 
 # Enhance all skills within a domain cluster (motion, frontend, backend, security, devops, database, testing, mobile)
-node scripts/skill_enhancement_engine.js --domain motion --fix
+node runners/skill_enhancement_engine.js --domain motion --fix
 
 # Enhance all 185 skills and mirror changes to workspace root
-node scripts/skill_enhancement_engine.js --all --fix --sync-to-root
+node runners/skill_enhancement_engine.js --all --fix --sync-to-root
 
 # Validate payload and SDO triggers
-node scripts/validate-payload.js
-node scripts/audit_skill_sdo.js
+node runners/validate-payload.js
+node runners/audit_skill_sdo.js
 ```
 
 ---

package/.agent/workflows/swarm.md

@@ -27,7 +27,7 @@ Before decomposing goals into worker sub-tasks or triggering swarm execution, yo
 3. `Promise.allSettled()` Fan-In Protocol → Collect all worker status reports and synthesize final deliverable before Human Gate confirmation
 
 4. Required Skills → Before executing, load and follow procedural rules from:
-   - `parallel-agents` (.agent/skills/parallel-agents/SKILL.md): Parallel agent dispatch patterns and fan-in synthesis
+   - `parallel-agents` (the parallel-agents skill): Parallel agent dispatch patterns and fan-in synthesis
    - `agent-organizer` (.agent/skills/agent-organizer/SKILL.md): Multi-agent coordination and task decomposition
    - `agentic-workflows-2026` (.agent/skills/agentic-workflows-2026/SKILL.md): Advanced agent loops, ReAct planning, and structured tool calling
 

package/.agent/workflows/team-mode.md

@@ -0,0 +1,22 @@
+---
+name: team-mode
+description: "Enable dynamic multi-agent task execution, DAG routing, and parallel reviews."
+version: 1.0.0
+---
+
+# TEAM MODE (DAG ORCHESTRATION)
+
+## Invocation
+`/team-mode [task_prompt]`
+
+## Behavior
+Activates the `swarm_dispatcher.js` using the `--mode dag` flag to execute highly complex, multi-domain tasks.
+
+1. **Decomposition**: The Orchestrator agent splits the `task_prompt` into a Topological DAG.
+2. **Delegation**: Specialized agents (e.g., `frontend-specialist`, `database-architect`) are assigned specific nodes in the graph.
+3. **Parallel Execution**: Independent tasks execute simultaneously.
+4. **Handoffs**: Output from a database task is explicitly passed as context to the dependent frontend task.
+5. **Review**: The entire output is passed through `/tribunal-full` before being marked complete.
+
+## Guardrails
+Team Mode cannot bypass the Human Gate. If any subagent proposes a destructive action, the entire DAG is paused, and the Human Gate Negotiator is summoned.

package/.agent/workflows/tribunal-backend.md

@@ -25,7 +25,7 @@ Before auditing backend routes or server logic, you MUST inspect:
 
 1. Target Backend Source & Contracts → Read target route handlers, Server Actions, or controller methods
 2. Dependencies & Environment (`package.json`, `.env.example`) → Check backend framework versions, secret key placeholders, and ORM schemas
-3. 6-Reviewer Parallel Gate → Execute logic-reviewer, security-auditor, dependency-analyzer, type-safety, resilience-reviewer, and schema-reviewer before approving diffs
+3. 28-Reviewer Parallel Gate → Execute logic-reviewer, security-auditor, dependency-analyzer, type-safety, resilience-reviewer, and schema-reviewer before approving diffs
 
 4. Required Skills → Before executing, load and follow procedural rules from:
    - `backend-security-expert` (.agent/skills/backend-security-expert/SKILL.md): Server-side security, auth, JWT, ORM injection, RBAC

package/.agent/workflows/tribunal-cicd.md

@@ -25,7 +25,7 @@ Before auditing CI/CD configurations, you MUST inspect:
 
 1. Target Workflow Files (`.github/workflows/*.yml`, `.gitlab-ci.yml`, `Dockerfile`)
 2. Repository Secrets & OIDC Configuration (`id-token: write`, environment promotion rules)
-3. 5-Reviewer Parallel Gate: Execute `pipeline-reviewer`, `security-auditor`, `dependency-reviewer`, `resilience-reviewer`, and `precedence-reviewer`.
+3. 28-Reviewer Parallel Gate: Execute `pipeline-reviewer`, `security-auditor`, `dependency-reviewer`, `resilience-reviewer`, and `precedence-reviewer`.
 
 4. Required Skills → Before executing, load and follow procedural rules from:
    - `cicd-pro` (.agent/skills/cicd-pro/SKILL.md): CI/CD workflow syntax, matrix builds, and deployment strategies

package/.agent/workflows/tribunal-database.md

@@ -24,7 +24,7 @@ Before auditing database queries, migrations, or ORM transactions, you MUST insp
 
 1. ORM Schema Source of Truth (`prisma/schema.prisma` or SQL schema) → Verify active table schemas, indexes, and relations
 2. SQL Parameterization Inspection → Flag all raw SQL queries attempting string interpolation; enforce parameterized queries
-3. 3-Reviewer Database Gate → Execute logic-reviewer, security-auditor, and sql-pro before approving database modifications
+3. 28-Reviewer Database Gate → Execute logic-reviewer, security-auditor, and sql-pro before approving database modifications
 
 4. Required Skills → Before executing, load and follow procedural rules from:
    - `database-design` (.agent/skills/database-design/SKILL.md): Schema normalization, indexing, migration strategy

package/.agent/workflows/tribunal-frontend.md

@@ -27,7 +27,7 @@ Before auditing React components or frontend UI logic, you MUST inspect:
 
 1. Design Tokens & Styling Context (`globals.css`, `tailwind.config`) → Verify OKLCH color palettes, typography scale, and dark mode classes
 2. Active UI Skill Pack (`.agent/skills/ui-skill-packs/SKILL.md`) → Load mandatory UI skill pack (Pack 1: Foundations, Pack 2: Motion, Pack 3: Systems)
-3. 7-Reviewer Frontend Gate → Run logic, security, frontend-reviewer, type-safety, ui-ux-auditor, motion-reviewer, and visual-auditor before approving UI diffs
+3. 28-Reviewer Frontend Gate → Run logic, security, frontend-reviewer, type-safety, ui-ux-auditor, motion-reviewer, and visual-auditor before approving UI diffs
 
 ---