tribunal-kit 9.2.4 → 9.2.6

package/.agent/skills/adapt/SKILL.md

@@ -1,8 +1,8 @@
 ---
 name: adapt
-description: "Use when Adapt designs across breakpoints, devices, platform constraints, touch vs mouse input, and container queries. Use when making a UI responsive or optimizing for mobile/tablet."
-version: 5.0.0
-last-updated: 2026-09-13
+description: "Use when building, styling, optimizing, and auditing adapt components, responsive layouts, design systems, and frontend state."
+version: 6.0.0
+last-updated: 2026-09-29
 skills:
   - mobile-design
   - building-native-ui
@@ -15,42 +15,112 @@ scripts-binding:
 
 # Adapt — Responsive Adaptation & Container Queries
 
----
+## Mandatory Pre-Flight Context Inspection
+Before reading, generating, or refactoring code in the `adapt` domain, inspect these 5 critical parameters:
+1. **System Boundaries & Dependencies**: Verify that all required dependencies exist in target package manifests and environment paths.
+2. **Runtime Context & Platform Invariants**: Confirm target platform constraints (Node.js, Browser, Mobile OS, Edge runtime) before applying APIs.
+3. **Execution Guardrails**: Identify potential side-effects, state mutations, and unhandled asynchronous exceptions.
+4. **Validation & Type Contracts**: Validate input data schemas and strict type constraints across all module interfaces.
+5. **Observability & Proof of Execution**: Ensure execution produces tangible verification signals (terminal output, tests, metrics).
 
-## 🛠️ Technical Architecture & Reference Recipes
 
----
+## Activation Boundaries
+- **Activate when:** Use when building, styling, optimizing, and auditing adapt components, responsive layouts, design systems, and frontend state.
+- **DO NOT activate when:** The task falls outside the `adapt` domain or is managed by a different dedicated specialist agent.
 
----
 
-## 4 Adaptation Mechanics
+## 🔁 Multi-Pass Execution Protocol
 
-### 1. Container Queries (`@container`) over Viewport Media Queries (`@media`)
+| Pass | Phase | Core Action | Adaptive Depth |
+|:---|:---|:---|:---|
+| **Pass 1** | **Understand** | Deconstruct the user's explicit objective, implicit requirements, and platform constraints. | Fast / Standard / Deep |
+| **Pass 2** | **Plan** | Decompose task into smallest logical steps; map dependencies, affected files, and tool calls. | Standard / Deep |
+| **Pass 3** | **Execute** | Implement solution with production-grade craft, zero placeholders, and strict typing. | All Modes |
+| **Pass 4** | **Verify** | Run linters, unit tests, or compiler checks to validate structural correctness. | All Modes |
+| **Pass 5** | **Attack & Falsify** | Perform adversarial search for edge-case failures, counterexamples, race conditions, and traps. | Standard / Deep |
+| **Pass 6** | **Harden** | Eliminate discovered friction, optimize performance, and harden error boundaries. | Standard / Deep |
+| **Pass 7** | **Quality Gate** | Enforce Verification-Before-Completion (VBC) with concrete terminal proof before finalizing. | All Modes |
 
-- Components should adapt based on their parent container's width, NOT the global browser window size:
 
-```css
-.card-container {
-  container-type: inline-size;
-}
+---
+
+## 🛠️ Technical Architecture & Reference Recipes
 
-@container (min-width: 400px) {
-  .card-layout {
-    display: grid;
-    grid-template-columns: 120px 1fr;
-  }
-}
-```
+---
+
+## 4 Adaptation Mechanics
+
+### 1. Container Queries (`@container`) over Viewport Media Queries (`@media`)
+
+- Components should adapt based on their parent container's width, NOT the global browser window size:
+
+```css
+.card-container {
+  container-type: inline-size;
+}
+
+@container (min-width: 400px) {
+  .card-layout {
+    display: grid;
+    grid-template-columns: 120px 1fr;
+  }
+}
+```
+
+### 2. Touch Target Sizing (Min 44x44px)
+
+- Interactive targets on mobile/touch interfaces MUST maintain a minimum tap target size of `44x44px` (or `48x48px` for Android), even if the visual icon is smaller (`16px`).
+
+### 3. Drawer on Mobile -> Modal on Desktop
+
+- Complex popovers or dialogs on mobile screens should render as bottom sheets (drawers) with drag-to-dismiss handles, automatically morphing into centered modals on desktop viewports ($\ge 768\text{px}$).
+
+### 4. Fluid Typography & Spacing
+
+- Use `clamp()` for fluid scaling without abrupt media query jumps:
+  $$\text{FontSize} = \text{clamp}(1\text{rem}, 0.8\text{rem} + 1\text{vw}, 1.75\text{rem})$$
 
-### 2. Touch Target Sizing (Min 44x44px)
+## 🚨 Edge-Case & Failure Mode Matrix
 
-- Interactive targets on mobile/touch interfaces MUST maintain a minimum tap target size of `44x44px` (or `48x48px` for Android), even if the visual icon is smaller (`16px`).
+| Scenario | Risk | Production Mitigation |
+|:---|:---|:---|
+| **Empty or Null Inputs** | Unhandled exception or unexpected rendering collapse | Enforce fallback guards, optional chaining, and explicit empty state handlers |
+| **Network Timeout / Latency** | Hanging operations or duplicate side-effects | Implement bounded abort controllers, exponential backoff, and idempotency keys |
+| **Concurrency / Race Conditions** | Stale state overwrite or inconsistent data mutations | Use atomic transactions, mutex locking, or cancel-on-resubmit controls |
+| **Invalid Schema / Malformed Payload** | Downstream runtime errors or security injection | Validate boundary payloads with Zod/Pydantic schemas prior to execution |
+| **Resource / Memory Saturation** | OOM errors, frame drops, or memory leaks | Clean up listeners, cancel active timers, and enforce pagination/virtualization |
 
-### 3. Drawer on Mobile -> Modal on Desktop
 
-- Complex popovers or dialogs on mobile screens should render as bottom sheets (drawers) with drag-to-dismiss handles, automatically morphing into centered modals on desktop viewports ($\ge 768\text{px}$).
+## 🤖 LLM-Specific Traps Table
 
-### 4. Fluid Typography & Spacing
+| Anti-Pattern | What AI Commonly Does Wrong | What Is Actually Correct |
+|:---|:---|:---|
+| **Uncontrolled Re-render Loop** | Mutating state inside render bodies or omitting hook dependencies | Wrap effects with explicit deps and isolate reactive derivations in useMemo |
+| **Accessibility Neglect** | Interactive <div> without role="button", tabIndex, or onKeyDown | Use semantic <button> or provide ARIA role, keyboard handlers, and focus ring |
+| **Layout Shift Flash** | Images/dynamic content without aspect-ratio or explicit dimensions | Enforce aspect-ratio or skeleton placeholders to guarantee zero CLS |
 
-- Use `clamp()` for fluid scaling without abrupt media query jumps:
-  $$\text{FontSize} = \text{clamp}(1\text{rem}, 0.8\text{rem} + 1\text{vw}, 1.75\text{rem})$$
+
+## 🏛️ Tribunal Verification & Guardrails
+
+**Active Reviewers:** `frontend-reviewer` · `type-safety` · `ui-ux-auditor` · `complexity-reviewer`
+**Slash Command:** `/review` or `/tribunal-full`
+
+### 🔬 Evidence Standard (Tri-State Verification)
+Every finding, audit statement, or completion claim must classify its factual certainty:
+- **`[OBSERVED]`**: Directly confirmed in the codebase or verified via executed terminal command.
+- **`[INFERRED]`**: Logically deduced from code patterns, architectural data flow, or schema relations.
+- **`[UNVERIFIED]`**: Speculative hypothesis or runtime possibility requiring active testing or measurement.
+
+### ✅ Pre-Flight Self-Audit Checklist
+```
+✅ Are all component props strictly typed with zero implicit "any"?
+✅ Are responsive breakpoints, fluid typography, and optical balance verified?
+✅ Is accessibility (ARIA labels, keyboard navigation, contrast ratio >= 4.5:1) validated?
+✅ Are re-renders minimized and state lifecycles cleanly separated?
+✅ Did I verify all imported UI components and icon sets actually exist?
+```
+
+### 🛑 Verification-Before-Completion (VBC) Protocol
+**CRITICAL:** You must follow a strict "evidence-based closeout" state machine.
+- ❌ **Forbidden:** Declaring a task complete because the output "looks correct."
+- ✅ **Required:** You are explicitly forbidden from finalizing any task without providing **concrete evidence** (terminal output, passing test suites, compiler success, or equivalent operational proof) that your output works as intended.

package/.agent/skills/adr-generation/SKILL.md

@@ -0,0 +1,133 @@
+---
+name: adr-generation
+description: "Use when executing, coordinating, planning, or reviewing adr generation agent workflows, cognitive loops, and architecture standards."
+version: 6.0.0
+last-updated: 2026-09-29
+skills:
+  - fabel-protocol
+tools: Read, Grep, Glob, Bash, Edit, Write
+scripts-binding:
+  - .agent/scripts/lint_runner.js
+  - .agent/scripts/verify_all.js
+---
+
+# ADR Generation Skill
+
+## Mandatory Pre-Flight Context Inspection
+Before reading, generating, or refactoring code in the `adr-generation` domain, inspect these 5 critical parameters:
+1. **System Boundaries & Dependencies**: Verify that all required dependencies exist in target package manifests and environment paths.
+2. **Runtime Context & Platform Invariants**: Confirm target platform constraints (Node.js, Browser, Mobile OS, Edge runtime) before applying APIs.
+3. **Execution Guardrails**: Identify potential side-effects, state mutations, and unhandled asynchronous exceptions.
+4. **Validation & Type Contracts**: Validate input data schemas and strict type constraints across all module interfaces.
+5. **Observability & Proof of Execution**: Ensure execution produces tangible verification signals (terminal output, tests, metrics).
+
+
+## Activation Boundaries
+- **Activate when:** Use when executing, coordinating, planning, or reviewing adr generation agent workflows, cognitive loops, and architecture standards.
+- **DO NOT activate when:** The task falls outside the `adr-generation` domain or is managed by a different dedicated specialist agent.
+
+
+## 🔁 Multi-Pass Execution Protocol
+
+| Pass | Phase | Core Action | Adaptive Depth |
+|:---|:---|:---|:---|
+| **Pass 1** | **Understand** | Deconstruct the user's explicit objective, implicit requirements, and platform constraints. | Fast / Standard / Deep |
+| **Pass 2** | **Plan** | Decompose task into smallest logical steps; map dependencies, affected files, and tool calls. | Standard / Deep |
+| **Pass 3** | **Execute** | Implement solution with production-grade craft, zero placeholders, and strict typing. | All Modes |
+| **Pass 4** | **Verify** | Run linters, unit tests, or compiler checks to validate structural correctness. | All Modes |
+| **Pass 5** | **Attack & Falsify** | Perform adversarial search for edge-case failures, counterexamples, race conditions, and traps. | Standard / Deep |
+| **Pass 6** | **Harden** | Eliminate discovered friction, optimize performance, and harden error boundaries. | Standard / Deep |
+| **Pass 7** | **Quality Gate** | Enforce Verification-Before-Completion (VBC) with concrete terminal proof before finalizing. | All Modes |
+
+
+Use this skill to produce formal Architecture Decision Records.
+
+## 🔴 Hallucination Traps
+
+- ❌ **Creating ADRs for trivial things** → ✅ Only generate ADRs for decisions that affect boundaries, dependencies, or scale.
+- ❌ **Presenting one option as an "Alternative"** → ✅ Always research and list at least 2 viable alternatives.
+- ❌ **Inventing Consequences** → ✅ Focus on concrete operational or code-level consequences (e.g., "Requires manual DB migrations").
+
+## 📋 Pre-Flight Checklist
+
+1. Have we identified the core problem?
+2. Are there at least two viable alternatives?
+3. Did we confirm the Minimal-Change Principle?
+
+## 📝 ADR Markdown Template
+
+Use the following strict template when generating an ADR. Save the file in `.agent/architecture/adrs/YYYY-MM-DD-title.md`.
+
+```markdown
+# ADR: [Short Descriptive Title]
+
+## Context
+
+[What is the problem we are solving?]
+
+## Decision
+
+[What is the selected approach?]
+
+## Alternatives Considered
+
+1. **[Option A]**: [Why it was rejected]
+2. **[Option B]**: [Why it was rejected]
+
+## Trade-offs
+
+[What are the downsides of the chosen Decision?]
+
+## Consequences
+
+[What does this decision force us to do later? What are the operational impacts?]
+```
+
+## 🛡️ Verification-Before-Completion (VBC)
+
+Before concluding, verify that the `system-model.yml` has been updated to reflect this ADR.
+
+## 🚨 Edge-Case & Failure Mode Matrix
+
+| Scenario | Risk | Production Mitigation |
+|:---|:---|:---|
+| **Empty or Null Inputs** | Unhandled exception or unexpected rendering collapse | Enforce fallback guards, optional chaining, and explicit empty state handlers |
+| **Network Timeout / Latency** | Hanging operations or duplicate side-effects | Implement bounded abort controllers, exponential backoff, and idempotency keys |
+| **Concurrency / Race Conditions** | Stale state overwrite or inconsistent data mutations | Use atomic transactions, mutex locking, or cancel-on-resubmit controls |
+| **Invalid Schema / Malformed Payload** | Downstream runtime errors or security injection | Validate boundary payloads with Zod/Pydantic schemas prior to execution |
+| **Resource / Memory Saturation** | OOM errors, frame drops, or memory leaks | Clean up listeners, cancel active timers, and enforce pagination/virtualization |
+
+
+## 🤖 LLM-Specific Traps Table
+
+| Anti-Pattern | What AI Commonly Does Wrong | What Is Actually Correct |
+|:---|:---|:---|
+| **Hallucinated Tool Capabilities** | Assuming an external library or CLI command exists without verification | Run a verification check or verify package.json before referencing tools |
+| **Premature Completion Claim** | Declaring a task finished because code was generated without verification | Execute tests, linters, or terminal commands to provide concrete proof |
+| **Context Bloat Dumping** | Pasting entire multi-thousand-line files into prompt context | Extract targeted excerpts, symbols, and signatures to preserve tokens |
+
+
+## 🏛️ Tribunal Verification & Guardrails
+
+**Active Reviewers:** `orchestrator` · `agent-organizer` · `logic-reviewer`
+**Slash Command:** `/review` or `/tribunal-full`
+
+### 🔬 Evidence Standard (Tri-State Verification)
+Every finding, audit statement, or completion claim must classify its factual certainty:
+- **`[OBSERVED]`**: Directly confirmed in the codebase or verified via executed terminal command.
+- **`[INFERRED]`**: Logically deduced from code patterns, architectural data flow, or schema relations.
+- **`[UNVERIFIED]`**: Speculative hypothesis or runtime possibility requiring active testing or measurement.
+
+### ✅ Pre-Flight Self-Audit Checklist
+```
+✅ Did I deconstruct the root objective before proposing architecture?
+✅ Did I identify dependencies, bottlenecks, and parallelizable sub-tasks?
+✅ Did I avoid over-engineering and select the simplest effective pattern?
+✅ Did I verify assumptions with concrete file reads instead of speculation?
+✅ Did I establish measurable verification criteria before completion?
+```
+
+### 🛑 Verification-Before-Completion (VBC) Protocol
+**CRITICAL:** You must follow a strict "evidence-based closeout" state machine.
+- ❌ **Forbidden:** Declaring a task complete because the output "looks correct."
+- ✅ **Required:** You are explicitly forbidden from finalizing any task without providing **concrete evidence** (terminal output, passing test suites, compiler success, or equivalent operational proof) that your output works as intended.

package/.agent/skills/advanced-rag-pipelines/SKILL.md

@@ -1,8 +1,8 @@
 ---
 name: advanced-rag-pipelines
-description: "Use when Production-grade Retrieval-Augmented Generation (RAG) mastery. Semantic chunking, Hybrid Search (Dense + Sparse/BM25), Cross-Encoder Reranking, and architecture-agnostic vector database management."
-version: 5.0.0
-last-updated: 2026-09-13
+description: "Use when designing, implementing, auditing, and hardening advanced rag pipelines server logic, APIs, background jobs, and error boundaries."
+version: 6.0.0
+last-updated: 2026-09-29
 skills:
   - llm-engineering
   - ai-prompt-injection-defense
@@ -15,80 +15,141 @@ scripts-binding:
 
 # Advanced RAG Pipelines (Production AI Data)
 
----
-
-## 🛠️ Technical Architecture & Reference Recipes
+## Mandatory Pre-Flight Context Inspection
+Before reading, generating, or refactoring code in the `advanced-rag-pipelines` domain, inspect these 5 critical parameters:
+1. **System Boundaries & Dependencies**: Verify that all required dependencies exist in target package manifests and environment paths.
+2. **Runtime Context & Platform Invariants**: Confirm target platform constraints (Node.js, Browser, Mobile OS, Edge runtime) before applying APIs.
+3. **Execution Guardrails**: Identify potential side-effects, state mutations, and unhandled asynchronous exceptions.
+4. **Validation & Type Contracts**: Validate input data schemas and strict type constraints across all module interfaces.
+5. **Observability & Proof of Execution**: Ensure execution produces tangible verification signals (terminal output, tests, metrics).
 
----
-
-## 2026 RAG Performance & Vector Invariants
-
-1. **Reciprocal Rank Fusion (RRF)**:
-   ```python
-   # Combine dense + sparse rankings without normalizing disparate score distributions
-   def rrf(dense_ranks: dict[str, int], sparse_ranks: dict[str, int], k: int = 60) -> dict[str, float]:
-       scores = {}
-       for doc_id, rank in dense_ranks.items():
-           scores[doc_id] = scores.get(doc_id, 0) + 1 / (k + rank)
-       for doc_id, rank in sparse_ranks.items():
-           scores[doc_id] = scores.get(doc_id, 0) + 1 / (k + rank)
-       return dict(sorted(scores.items(), key=lambda x: x[1], reverse=True))
-   ```
-2. **HNSW Indexing with Halfvec (pgvector 0.8+)**:
-   ```sql
-   -- Halves memory usage with < 1% recall loss
-   CREATE INDEX idx_docs_embedding ON documents
-   USING hnsw ((embedding::halfvec(1536)) halfvec_cosine_ops);
-   ```
-3. **Aggressive Context Pruning**: Never dump > 5 chunks into the final LLM prompt. Context dilution ("Lost in the Middle") degrades factual recall and spikes latency.
-
-## Hallucination Traps (Read First)
-
-- ❌ Fixed-character chunking (e.g. split every 500 chars) → ✅ AST/Markdown-aware structural chunking
-- ❌ Relying only on cosine similarity on raw queries → ✅ Hybrid search (Dense + BM25) with cross-encoder rerank
-- ❌ Injecting raw text into system prompt → ✅ Enclose in `<retrieved_context>` tags to prevent indirect prompt injection
-- ❌ Full precision FP32 vectors on massive datasets → ✅ Use FP16 (`halfvec`) or scalar quantization
 
----
+## Activation Boundaries
+- **Activate when:** Use when designing, implementing, auditing, and hardening advanced rag pipelines server logic, APIs, background jobs, and error boundaries.
+- **DO NOT activate when:** The task falls outside the `advanced-rag-pipelines` domain or is managed by a different dedicated specialist agent.
 
-## 2. Advanced Architectural Patterns
 
-### A. Semantic Chunking
+## 🔁 Multi-Pass Execution Protocol
 
-Instead of splitting text every 1000 characters, split by structural bounds:
+| Pass | Phase | Core Action | Adaptive Depth |
+|:---|:---|:---|:---|
+| **Pass 1** | **Understand** | Deconstruct the user's explicit objective, implicit requirements, and platform constraints. | Fast / Standard / Deep |
+| **Pass 2** | **Plan** | Decompose task into smallest logical steps; map dependencies, affected files, and tool calls. | Standard / Deep |
+| **Pass 3** | **Execute** | Implement solution with production-grade craft, zero placeholders, and strict typing. | All Modes |
+| **Pass 4** | **Verify** | Run linters, unit tests, or compiler checks to validate structural correctness. | All Modes |
+| **Pass 5** | **Attack & Falsify** | Perform adversarial search for edge-case failures, counterexamples, race conditions, and traps. | Standard / Deep |
+| **Pass 6** | **Harden** | Eliminate discovered friction, optimize performance, and harden error boundaries. | Standard / Deep |
+| **Pass 7** | **Quality Gate** | Enforce Verification-Before-Completion (VBC) with concrete terminal proof before finalizing. | All Modes |
 
-- **Code:** Split by Abstract Syntax Tree (AST) nodes (functions, classes).
-- **Markdown:** Split by Header levels (`##`).
-- **Prose:** Use LLM-assisted proposition extraction (extracting atomic facts from sentences).
 
-### B. Two-Stage Retrieval (Reranking)
+---
+
+## 🛠️ Technical Architecture & Reference Recipes
 
-```text
-1. User Query -> Embed -> Vector DB (Pinecone/Milvus/Pgvector)
-2. Retrieve Top K = 50 (Fast, low precision)
-3. Pass (Query + 50 Chunks) to Cross-Encoder (e.g., Cohere Rerank, BGE-Reranker)
-4. Reranker outputs Top N = 5 (Slow, high precision)
-5. Pass Top 5 to LLM Context
-```
+## 2026 RAG Performance & Vector Invariants
+
+1. **Reciprocal Rank Fusion (RRF)**:
+   ```python
+   # Combine dense + sparse rankings without normalizing disparate score distributions
+   def rrf(dense_ranks: dict[str, int], sparse_ranks: dict[str, int], k: int = 60) -> dict[str, float]:
+       scores = {}
+       for doc_id, rank in dense_ranks.items():
+           scores[doc_id] = scores.get(doc_id, 0) + 1 / (k + rank)
+       for doc_id, rank in sparse_ranks.items():
+           scores[doc_id] = scores.get(doc_id, 0) + 1 / (k + rank)
+       return dict(sorted(scores.items(), key=lambda x: x[1], reverse=True))
+   ```
+2. **HNSW Indexing with Halfvec (pgvector 0.8+)**:
+   ```sql
+   -- Halves memory usage with < 1% recall loss
+   CREATE INDEX idx_docs_embedding ON documents
+   USING hnsw ((embedding::halfvec(1536)) halfvec_cosine_ops);
+   ```
+3. **Aggressive Context Pruning**: Never dump > 5 chunks into the final LLM prompt. Context dilution ("Lost in the Middle") degrades factual recall and spikes latency.
+
+## Hallucination Traps (Read First)
+
+- ❌ Fixed-character chunking (e.g. split every 500 chars) → ✅ AST/Markdown-aware structural chunking
+- ❌ Relying only on cosine similarity on raw queries → ✅ Hybrid search (Dense + BM25) with cross-encoder rerank
+- ❌ Injecting raw text into system prompt → ✅ Enclose in `<retrieved_context>` tags to prevent indirect prompt injection
+- ❌ Full precision FP32 vectors on massive datasets → ✅ Use FP16 (`halfvec`) or scalar quantization
+
+---
+
+## 2. Advanced Architectural Patterns
+
+### A. Semantic Chunking
+
+Instead of splitting text every 1000 characters, split by structural bounds:
+
+- **Code:** Split by Abstract Syntax Tree (AST) nodes (functions, classes).
+- **Markdown:** Split by Header levels (`##`).
+- **Prose:** Use LLM-assisted proposition extraction (extracting atomic facts from sentences).
+
+### B. Two-Stage Retrieval (Reranking)
+
+```text
+1. User Query -> Embed -> Vector DB (Pinecone/Milvus/Pgvector)
+2. Retrieve Top K = 50 (Fast, low precision)
+3. Pass (Query + 50 Chunks) to Cross-Encoder (e.g., Cohere Rerank, BGE-Reranker)
+4. Reranker outputs Top N = 5 (Slow, high precision)
+5. Pass Top 5 to LLM Context
+```
+
+### C. Query Transformation
+
+Never embed the user's raw query directly. Users write poor queries.
+
+- **HyDE (Hypothetical Document Embeddings):** Have the LLM write a fake answer to the query, then embed that fake answer to search the Vector DB.
+- **Query Routing:** Route "summarize" queries to a Graph database, and "how do I" queries to the Vector DB.
+
+## 3. LLM Traps & Pre-Flight Checks
+
+- **TRAP:** Sending 20 chunks to the LLM. This dilutes the context (Lost in the Middle phenomenon) and increases cost.
+- **FIX:** Always rerank and aggressively filter down to 3-5 highly relevant chunks before the generation step.
+- **TRAP:** Not attaching metadata to chunks.
+- **FIX:** Always attach `{ source_file, line_numbers, date, author }` to the vector payload. This allows the Vector DB to pre-filter before calculating cosine similarity.
+
+## Verification Protocol
+
+Before submitting code, ensure:
+
+1. Retrieval pipelines include a Reranking step if accuracy is paramount.
+2. BM25 / Sparse search is considered alongside standard dense embeddings.
+3. Chunks are injected into the final LLM prompt with explicit `<context>` XML boundaries to prevent prompt injection.
 
-### C. Query Transformation
+## 🚨 Edge-Case & Failure Mode Matrix
 
-Never embed the user's raw query directly. Users write poor queries.
+| Scenario | Risk | Production Mitigation |
+|:---|:---|:---|
+| **Empty or Null Inputs** | Unhandled exception or unexpected rendering collapse | Enforce fallback guards, optional chaining, and explicit empty state handlers |
+| **Network Timeout / Latency** | Hanging operations or duplicate side-effects | Implement bounded abort controllers, exponential backoff, and idempotency keys |
+| **Concurrency / Race Conditions** | Stale state overwrite or inconsistent data mutations | Use atomic transactions, mutex locking, or cancel-on-resubmit controls |
+| **Invalid Schema / Malformed Payload** | Downstream runtime errors or security injection | Validate boundary payloads with Zod/Pydantic schemas prior to execution |
+| **Resource / Memory Saturation** | OOM errors, frame drops, or memory leaks | Clean up listeners, cancel active timers, and enforce pagination/virtualization |
 
-- **HyDE (Hypothetical Document Embeddings):** Have the LLM write a fake answer to the query, then embed that fake answer to search the Vector DB.
-- **Query Routing:** Route "summarize" queries to a Graph database, and "how do I" queries to the Vector DB.
 
-## 3. LLM Traps & Pre-Flight Checks
+## 🏛️ Tribunal Verification & Guardrails
 
-- **TRAP:** Sending 20 chunks to the LLM. This dilutes the context (Lost in the Middle phenomenon) and increases cost.
-- **FIX:** Always rerank and aggressively filter down to 3-5 highly relevant chunks before the generation step.
-- **TRAP:** Not attaching metadata to chunks.
-- **FIX:** Always attach `{ source_file, line_numbers, date, author }` to the vector payload. This allows the Vector DB to pre-filter before calculating cosine similarity.
+**Active Reviewers:** `logic-reviewer` · `security-auditor` · `api-architect` · `resilience-reviewer`
+**Slash Command:** `/review` or `/tribunal-full`
 
-## Verification Protocol
+### 🔬 Evidence Standard (Tri-State Verification)
+Every finding, audit statement, or completion claim must classify its factual certainty:
+- **`[OBSERVED]`**: Directly confirmed in the codebase or verified via executed terminal command.
+- **`[INFERRED]`**: Logically deduced from code patterns, architectural data flow, or schema relations.
+- **`[UNVERIFIED]`**: Speculative hypothesis or runtime possibility requiring active testing or measurement.
 
-Before submitting code, ensure:
+### ✅ Pre-Flight Self-Audit Checklist
+```
+✅ Are all inputs and boundary payloads validated against schemas (Zod/Pydantic)?
+✅ Are SQL and database queries parameterized with zero string concatenation?
+✅ Are error boundaries and timeout/retry policies explicitly declared?
+✅ Are authentication and object-level authorization (IDOR/BOLA) checked before business logic?
+✅ Did I verify that imported dependencies exist in package manifests?
+```
 
-1. Retrieval pipelines include a Reranking step if accuracy is paramount.
-2. BM25 / Sparse search is considered alongside standard dense embeddings.
-3. Chunks are injected into the final LLM prompt with explicit `<context>` XML boundaries to prevent prompt injection.
+### 🛑 Verification-Before-Completion (VBC) Protocol
+**CRITICAL:** You must follow a strict "evidence-based closeout" state machine.
+- ❌ **Forbidden:** Declaring a task complete because the output "looks correct."
+- ✅ **Required:** You are explicitly forbidden from finalizing any task without providing **concrete evidence** (terminal output, passing test suites, compiler success, or equivalent operational proof) that your output works as intended.