tribunal-kit 9.2.4 → 9.2.6

package/.agent/skills/agent-organizer/SKILL.md

@@ -1,8 +1,8 @@
 ---
 name: agent-organizer
-description: "Use when Master Agent orchestration framework. Coordination of sub-agents, workflow definitions, delegation patterns, state management across conversations, memory distillation, and execution loops. Use when assembling multi-agent systems or managing complex agent-to-agent architectures."
-version: 5.0.0
-last-updated: 2026-09-13
+description: "Use when executing, coordinating, planning, or reviewing agent organizer agent workflows, cognitive loops, and architecture standards."
+version: 6.0.0
+last-updated: 2026-09-29
 skills:
   - parallel-agents
   - fabel-protocol
@@ -16,102 +16,160 @@ scripts-binding:
 
 # Agent Organizer — Multi-Agent Orchestration Mastery
 
----
+## Mandatory Pre-Flight Context Inspection
+Before reading, generating, or refactoring code in the `agent-organizer` domain, inspect these 5 critical parameters:
+1. **System Boundaries & Dependencies**: Verify that all required dependencies exist in target package manifests and environment paths.
+2. **Runtime Context & Platform Invariants**: Confirm target platform constraints (Node.js, Browser, Mobile OS, Edge runtime) before applying APIs.
+3. **Execution Guardrails**: Identify potential side-effects, state mutations, and unhandled asynchronous exceptions.
+4. **Validation & Type Contracts**: Validate input data schemas and strict type constraints across all module interfaces.
+5. **Observability & Proof of Execution**: Ensure execution produces tangible verification signals (terminal output, tests, metrics).
 
-## 🛠️ Technical Architecture & Reference Recipes
 
----
+## Activation Boundaries
+- **Activate when:** Use when executing, coordinating, planning, or reviewing agent organizer agent workflows, cognitive loops, and architecture standards.
+- **DO NOT activate when:** The task falls outside the `agent-organizer` domain or is managed by a different dedicated specialist agent.
 
-## Hallucination Traps (Read First)
 
-- ❌ Dispatching sub-agents without a context_summary -> ✅ Always send a trimmed context, never the full conversation
-- ❌ Assuming sub-agents share memory -> ✅ Each agent invocation is stateless unless explicitly passed context
-- ❌ Running agents sequentially when they are independent -> ✅ Use fan-out/fan-in for parallelizable work
+## 🔁 Multi-Pass Execution Protocol
 
----
+| Pass | Phase | Core Action | Adaptive Depth |
+|:---|:---|:---|:---|
+| **Pass 1** | **Understand** | Deconstruct the user's explicit objective, implicit requirements, and platform constraints. | Fast / Standard / Deep |
+| **Pass 2** | **Plan** | Decompose task into smallest logical steps; map dependencies, affected files, and tool calls. | Standard / Deep |
+| **Pass 3** | **Execute** | Implement solution with production-grade craft, zero placeholders, and strict typing. | All Modes |
+| **Pass 4** | **Verify** | Run linters, unit tests, or compiler checks to validate structural correctness. | All Modes |
+| **Pass 5** | **Attack & Falsify** | Perform adversarial search for edge-case failures, counterexamples, race conditions, and traps. | Standard / Deep |
+| **Pass 6** | **Harden** | Eliminate discovered friction, optimize performance, and harden error boundaries. | Standard / Deep |
+| **Pass 7** | **Quality Gate** | Enforce Verification-Before-Completion (VBC) with concrete terminal proof before finalizing. | All Modes |
 
----
-
-## 1. The Delegation Sub-Agent Pattern
-
-Agents should defer specific domain problems to specialized sub-agents.
-
-```json
-// Define the payload contract the Worker Agent expects
-{
-  "taskId": "task-auth-migration-01",
-  "workerRole": "api-security-auditor",
-  "isolatedContext": {
-    "filesToScan": ["src/login.ts", "src/middleware.ts"],
-    "objective": "Identify unprotected mass assignments"
-  },
-  "requiredOutputFormat": "json_list"
-}
-```
 
-### Delegation Rules:
-
-1. **Never pass full histories:** Do not pass the entire conversation history to a worker sub-agent. Extract only the exact files and goal context required. (Context Window Budgeting).
-2. **Clear Boundaries:** If the worker is fixing CSS, it must not invent logic for the database.
-3. **Structured Handoff:** The parent agent requests JSON from the worker, parses it, and then acts. Let machines talk to machines through syntax, not prose.
+---
+
+## 🛠️ Technical Architecture & Reference Recipes
 
+## Hallucination Traps (Read First)
+
+- ❌ Dispatching sub-agents without a context_summary -> ✅ Always send a trimmed context, never the full conversation
+- ❌ Assuming sub-agents share memory -> ✅ Each agent invocation is stateless unless explicitly passed context
+- ❌ Running agents sequentially when they are independent -> ✅ Use fan-out/fan-in for parallelizable work
+
 ---
+## 1. The Delegation Sub-Agent Pattern
+
+Agents should defer specific domain problems to specialized sub-agents.
+
+```json
+// Define the payload contract the Worker Agent expects
+{
+  "taskId": "task-auth-migration-01",
+  "workerRole": "api-security-auditor",
+  "isolatedContext": {
+    "filesToScan": ["src/login.ts", "src/middleware.ts"],
+    "objective": "Identify unprotected mass assignments"
+  },
+  "requiredOutputFormat": "json_list"
+}
+```
+
+### Delegation Rules:
+
+1. **Never pass full histories:** Do not pass the entire conversation history to a worker sub-agent. Extract only the exact files and goal context required. (Context Window Budgeting).
+2. **Clear Boundaries:** If the worker is fixing CSS, it must not invent logic for the database.
+3. **Structured Handoff:** The parent agent requests JSON from the worker, parses it, and then acts. Let machines talk to machines through syntax, not prose.
+
+---
+
+## 2. Execution Loops (Supervisor Pattern)
+
+A Supervisor decides _who_ works and _when_, but does not execute the work.
+
+```
+[User Request: "Add OAuth and secure it"]
+       |
+[Supervisor Agent analyzing required skills...]
+       |
+       ├─> [Dispatches: authentication-best-practices]
+       |         (Worker builds OAuth implementation)
+       |
+       ├─> [Dispatches: api-security-auditor]
+       |         (Worker reviews implementation against OWASP)
+       |
+[Supervisor Agent synthesizes findings]
+       |
+[Action Executed / Git Commit]
+```
+
+### Handoff Signals
+
+A worker must return definitive state signals when yielding control:
+
+- `COMPLETE`: Goal achieved. Final diff generated.
+- `BLOCKED`: Missing context (e.g., "I need the `.env` schema").
+- `ERROR`: Script failed, requires manual Supervisor intervention.
+
+---
+
+## 3. Session State Management (Memory)
+
+Agents lose memory across boundaries. The Organizer must explicitly persist context.
+
+1. **Short-Term Context:** Maintained natively in the active LLM context window.
+2. **Task State:** Maintained locally in `task.md`. Workers check-in and check-out checkboxes.
+3. **Long-Term Memory:** "Knowledge Items" (KIs). Distilling massive conversations down into a single `learnings.json` file injected on subsequent startups.
+
+```markdown
+<!-- task.md (The Global Execution State) -->
+
+# Current Objective: Build Chat Feature
+
+- [x] Initialize websocket connection
+- [/] (Worker: frontend-specialist) Build Chat UI component
+- [ ] (Worker: realtime-patterns) Implement presence sync
+```
+
+---
+
+## 4. The Human-in-the-Loop (Socratic Gate)
+
+Automation without oversight is reckless. The Organizer manages when to pause and query the human.
+
+**Mandatory Gates:**
+
+1. **Approval Gate (Before Execution):** "I have drafted the architecture plan. Do you approve execution?"
+2. **Recovery Gate (After 3 Failures):** "The database migration script has failed 3 times. I am halting. How would you like to proceed?"
 
-## 2. Execution Loops (Supervisor Pattern)
-
-A Supervisor decides _who_ works and _when_, but does not execute the work.
-
-```
-[User Request: "Add OAuth and secure it"]
-       |
-[Supervisor Agent analyzing required skills...]
-       |
-       ├─> [Dispatches: authentication-best-practices]
-       |         (Worker builds OAuth implementation)
-       |
-       ├─> [Dispatches: api-security-auditor]
-       |         (Worker reviews implementation against OWASP)
-       |
-[Supervisor Agent synthesizes findings]
-       |
-[Action Executed / Git Commit]
-```
-
-### Handoff Signals
-
-A worker must return definitive state signals when yielding control:
-
-- `COMPLETE`: Goal achieved. Final diff generated.
-- `BLOCKED`: Missing context (e.g., "I need the `.env` schema").
-- `ERROR`: Script failed, requires manual Supervisor intervention.
-
----
+## 🚨 Edge-Case & Failure Mode Matrix
 
-## 3. Session State Management (Memory)
+| Scenario | Risk | Production Mitigation |
+|:---|:---|:---|
+| **Empty or Null Inputs** | Unhandled exception or unexpected rendering collapse | Enforce fallback guards, optional chaining, and explicit empty state handlers |
+| **Network Timeout / Latency** | Hanging operations or duplicate side-effects | Implement bounded abort controllers, exponential backoff, and idempotency keys |
+| **Concurrency / Race Conditions** | Stale state overwrite or inconsistent data mutations | Use atomic transactions, mutex locking, or cancel-on-resubmit controls |
+| **Invalid Schema / Malformed Payload** | Downstream runtime errors or security injection | Validate boundary payloads with Zod/Pydantic schemas prior to execution |
+| **Resource / Memory Saturation** | OOM errors, frame drops, or memory leaks | Clean up listeners, cancel active timers, and enforce pagination/virtualization |
 
-Agents lose memory across boundaries. The Organizer must explicitly persist context.
 
-1. **Short-Term Context:** Maintained natively in the active LLM context window.
-2. **Task State:** Maintained locally in `task.md`. Workers check-in and check-out checkboxes.
-3. **Long-Term Memory:** "Knowledge Items" (KIs). Distilling massive conversations down into a single `learnings.json` file injected on subsequent startups.
+## 🏛️ Tribunal Verification & Guardrails
 
-```markdown
-<!-- task.md (The Global Execution State) -->
+**Active Reviewers:** `orchestrator` · `agent-organizer` · `logic-reviewer`
+**Slash Command:** `/review` or `/tribunal-full`
 
-# Current Objective: Build Chat Feature
+### 🔬 Evidence Standard (Tri-State Verification)
+Every finding, audit statement, or completion claim must classify its factual certainty:
+- **`[OBSERVED]`**: Directly confirmed in the codebase or verified via executed terminal command.
+- **`[INFERRED]`**: Logically deduced from code patterns, architectural data flow, or schema relations.
+- **`[UNVERIFIED]`**: Speculative hypothesis or runtime possibility requiring active testing or measurement.
 
-- [x] Initialize websocket connection
-- [/] (Worker: frontend-specialist) Build Chat UI component
-- [ ] (Worker: realtime-patterns) Implement presence sync
+### ✅ Pre-Flight Self-Audit Checklist
+```
+✅ Did I deconstruct the root objective before proposing architecture?
+✅ Did I identify dependencies, bottlenecks, and parallelizable sub-tasks?
+✅ Did I avoid over-engineering and select the simplest effective pattern?
+✅ Did I verify assumptions with concrete file reads instead of speculation?
+✅ Did I establish measurable verification criteria before completion?
 ```
 
----
-
-## 4. The Human-in-the-Loop (Socratic Gate)
-
-Automation without oversight is reckless. The Organizer manages when to pause and query the human.
-
-**Mandatory Gates:**
-
-1. **Approval Gate (Before Execution):** "I have drafted the architecture plan. Do you approve execution?"
-2. **Recovery Gate (After 3 Failures):** "The database migration script has failed 3 times. I am halting. How would you like to proceed?"
+### 🛑 Verification-Before-Completion (VBC) Protocol
+**CRITICAL:** You must follow a strict "evidence-based closeout" state machine.
+- ❌ **Forbidden:** Declaring a task complete because the output "looks correct."
+- ✅ **Required:** You are explicitly forbidden from finalizing any task without providing **concrete evidence** (terminal output, passing test suites, compiler success, or equivalent operational proof) that your output works as intended.

package/.agent/skills/agent-syscall-guidelines/SKILL.md

@@ -1,25 +1,100 @@
 ---
 name: agent-syscall-guidelines
-description: "Use when defining how agents must interact with the host system via the controlled tool interface (Tribunal OS)."
-version: 1.0.0
-last-updated: 2026-09-25
+description: "Use when defining, invoking, or auditing agent system calls and tool executions in Tribunal OS. Enforces schema validation, argument sandboxing, path normalization, timeout boundaries, and command whitelisting."
+version: 6.0.0
+last-updated: 2026-09-29
 skills:
   - fabel-protocol
+  - agentshield-security
 tools: Read, Grep, Glob, Bash, Edit, Write
 scripts-binding:
   - .agent/scripts/syscall_registry.js
+  - .agent/scripts/verify_all.js
+  - .agent/scripts/lint_runner.js
 ---
 
-# Agent Syscall Guidelines (Tribunal OS)
+# Agent Syscall Guidelines — Tribunal OS Controlled Tool Boundary
 
-## Overview
-Tribunal Kit is migrating from allowing agents raw `bash` access to enforcing a strict, sandboxed **Syscall Boundary**. The model must think of tools not as shell commands, but as managed system calls.
+## Activation Boundaries
+- **Activate when:** Use when defining, invoking, or auditing agent system calls and tool executions in Tribunal OS. Enforces schema validation, argument sandboxing, path normalization, timeout boundaries, and command whitelisting.
+- **DO NOT activate when:** The task falls outside the `agent-syscall-guidelines` domain or is managed by a different dedicated specialist agent.
 
-## Directives
-1. **Harness Invocation**: Tools MUST be invoked via the `syscall_registry.js` or `harness_manager.js`, not via generic `child_process.exec`.
-2. **Schema Validation**: Every syscall requires a strict JSON payload that matches the expected tool schema.
-3. **Timeouts & Resources**: The registry enforces strict timeouts (e.g., 5 minutes for tests). Agents should not attempt to write custom timeout logic in bash strings.
-4. **Runtime Over Prompt**: Prompt constraints ("Don't delete files") are not enough. The `syscall_registry.js` explicitly whitelists commands (like `npm run build`, `node test.js`) and blocks arbitrary `rm` or `wget` commands.
 
-## Implementation Standard
-When designing new tools for agents, always wrap them in a Syscall definition inside the registry, specifying the exact `command`, `args`, and `cwd`. Never pass unsanitized agent strings directly to the shell.
+## 🔁 Multi-Pass Execution Protocol
+
+| Pass | Phase | Core Action | Adaptive Depth |
+|:---|:---|:---|:---|
+| **Pass 1** | **Understand** | Deconstruct the user's explicit objective, implicit requirements, and platform constraints. | Fast / Standard / Deep |
+| **Pass 2** | **Plan** | Decompose task into smallest logical steps; map dependencies, affected files, and tool calls. | Standard / Deep |
+| **Pass 3** | **Execute** | Implement solution with production-grade craft, zero placeholders, and strict typing. | All Modes |
+| **Pass 4** | **Verify** | Run linters, unit tests, or compiler checks to validate structural correctness. | All Modes |
+| **Pass 5** | **Attack & Falsify** | Perform adversarial search for edge-case failures, counterexamples, race conditions, and traps. | Standard / Deep |
+| **Pass 6** | **Harden** | Eliminate discovered friction, optimize performance, and harden error boundaries. | Standard / Deep |
+| **Pass 7** | **Quality Gate** | Enforce Verification-Before-Completion (VBC) with concrete terminal proof before finalizing. | All Modes |
+
+
+## Mandatory Pre-Flight Context Inspection
+1. **Syscall Registration**: Verify the invoked tool exists in `.agent/scripts/syscall_registry.js`.
+2. **Payload Schema**: Validate tool parameters against Zod schema definitions before execution.
+3. **Path Sanitization**: Normalize file paths across Windows backslashes and POSIX slashes; disallow path traversal (`../`).
+4. **Execution Timeout**: Enforce strict execution timeouts on all syscalls (default 30s, max 300s for test suites).
+5. **Output Buffering**: Limit output capture to 64KB to prevent context window saturation and out-of-memory errors.
+
+## 🛠️ Technical Architecture & Reference Recipes
+
+### 1. Controlled Syscall Dispatch Flow
+```
+Agent Request
+     │
+     ▼
+[Syscall Registry] ──(Schema Validation via Zod)──► Invalid ──► Error Return
+     │ (Valid)
+     ▼
+[Security Whitelist Guard] ──(Block dangerous args: rm -rf, curl | bash)
+     │ (Permitted)
+     ▼
+[Sandboxed Runner] ──(Enforce Timeout + Output Cap 64KB)
+     │
+     ▼
+Sanitized Tool Result returned to Agent
+```
+
+### 2. Whitelist Enforcement & Path Normalization
+```javascript
+const path = require('path');
+
+function sanitizeWorkspacePath(targetPath, workspaceRoot) {
+  const resolved = path.resolve(workspaceRoot, targetPath);
+  if (!resolved.startsWith(path.resolve(workspaceRoot))) {
+    throw new Error(`Syscall Security Violation: Access outside workspace forbidden: ${targetPath}`);
+  }
+  return resolved;
+}
+```
+
+## 🚨 Edge-Case & Failure Mode Matrix
+
+| Scenario | Risk | Production Mitigation |
+|:---|:---|:---|
+| **Infinite Subprocess Hang** | Interactive CLI command (e.g. waiting for y/N stdin) hangs process | Enforce strict `timeout` and pass non-interactive flags (`-y`, `--yes`, `CI=true`) |
+| **Output Token Flooding** | Running `git log` or dumping 10MB file blows prompt context limit | Truncate stdout at 64KB with an explicit warning marker `[TRUNCATED]` |
+| **Shell Injection via Args** | Passing unsanitized user strings into `child_process.exec()` | Use `child_process.execFile()` with array-based arguments, never shell interpolation |
+
+## 🏛️ Tribunal Verification & Guardrails
+
+### 🔬 Evidence Standard (Tri-State Verification)
+Every finding, audit statement, or completion claim must classify its factual certainty:
+- **`[OBSERVED]`**: Directly confirmed in the codebase or verified via executed terminal command.
+- **`[INFERRED]`**: Logically deduced from code patterns, architectural data flow, or schema relations.
+- **`[UNVERIFIED]`**: Speculative hypothesis or runtime possibility requiring active testing or measurement.
+
+- **Active Reviewers:** `security-auditor`, `platform-engineer`, `orchestrator`
+- **Evidence Standard:** Differentiate `[OBSERVED]` command payloads from `[INFERRED]` execution outcomes.
+
+## 🤖 LLM-Specific Traps Table
+
+| Anti-Pattern | What AI Commonly Does Wrong | What Is Actually Correct |
+|:---|:---|:---|
+| **Hallucinated Tool Capabilities** | Assuming an external library or CLI command exists without verification | Run a verification check or verify package.json before referencing tools |
+| **Premature Completion Claim** | Declaring a task finished because code was generated without verification | Execute tests, linters, or terminal commands to provide concrete proof |
+| **Context Bloat Dumping** | Pasting entire multi-thousand-line files into prompt context | Extract targeted excerpts, symbols, and signatures to preserve tokens |