tribunal-kit 9.2.4 → 9.2.6

package/.agent/skills/domain-modeling/SKILL.md

@@ -1,8 +1,8 @@
 ---
 name: domain-modeling
-description: "Use when Builds and sharpens project domain models, ubiquitous language, entity relationships, and bounded contexts before writing code."
-version: 5.0.0
-last-updated: 2026-09-13
+description: "Use when designing schemas, querying, indexing, optimizing, and securing domain modeling databases and data models."
+version: 6.0.0
+last-updated: 2026-09-29
 skills:
   - architecture
   - codebase-design
@@ -15,47 +15,117 @@ scripts-binding:
 
 # Domain Modeling — Ubiquitous Language & Bounded Contexts
 
----
+## Mandatory Pre-Flight Context Inspection
+Before reading, generating, or refactoring code in the `domain-modeling` domain, inspect these 5 critical parameters:
+1. **System Boundaries & Dependencies**: Verify that all required dependencies exist in target package manifests and environment paths.
+2. **Runtime Context & Platform Invariants**: Confirm target platform constraints (Node.js, Browser, Mobile OS, Edge runtime) before applying APIs.
+3. **Execution Guardrails**: Identify potential side-effects, state mutations, and unhandled asynchronous exceptions.
+4. **Validation & Type Contracts**: Validate input data schemas and strict type constraints across all module interfaces.
+5. **Observability & Proof of Execution**: Ensure execution produces tangible verification signals (terminal output, tests, metrics).
 
-## 🛠️ Technical Architecture & Reference Recipes
 
----
+## Activation Boundaries
+- **Activate when:** Use when designing schemas, querying, indexing, optimizing, and securing domain modeling databases and data models.
+- **DO NOT activate when:** The task falls outside the `domain-modeling` domain or is managed by a different dedicated specialist agent.
 
----
 
-## 4 Domain Modeling Rules
+## 🔁 Multi-Pass Execution Protocol
 
-### 1. Establish Ubiquitous Language
+| Pass | Phase | Core Action | Adaptive Depth |
+|:---|:---|:---|:---|
+| **Pass 1** | **Understand** | Deconstruct the user's explicit objective, implicit requirements, and platform constraints. | Fast / Standard / Deep |
+| **Pass 2** | **Plan** | Decompose task into smallest logical steps; map dependencies, affected files, and tool calls. | Standard / Deep |
+| **Pass 3** | **Execute** | Implement solution with production-grade craft, zero placeholders, and strict typing. | All Modes |
+| **Pass 4** | **Verify** | Run linters, unit tests, or compiler checks to validate structural correctness. | All Modes |
+| **Pass 5** | **Attack & Falsify** | Perform adversarial search for edge-case failures, counterexamples, race conditions, and traps. | Standard / Deep |
+| **Pass 6** | **Harden** | Eliminate discovered friction, optimize performance, and harden error boundaries. | Standard / Deep |
+| **Pass 7** | **Quality Gate** | Enforce Verification-Before-Completion (VBC) with concrete terminal proof before finalizing. | All Modes |
 
-- Agree on strict, unambiguous terms used identically across domain experts, code variable names, database tables, and UI copy.
-  - ❌ _User_, _Account_, _Member_, _Client_ used interchangeably for the same concept.
-  - ✅ Define 1 clear term: **Customer** (for billing context) vs **User** (for authentication context).
 
-### 2. Define Bounded Contexts
+---
+
+## 🛠️ Technical Architecture & Reference Recipes
 
-- Separate large systems into distinct bounded contexts. An entity named `Product` in the _Inventory Context_ (stock level, warehouse bin) has different attributes than `Product` in the _Catalog Context_ (hero image, pricing).
+---
+
+## 4 Domain Modeling Rules
+
+### 1. Establish Ubiquitous Language
+
+- Agree on strict, unambiguous terms used identically across domain experts, code variable names, database tables, and UI copy.
+  - ❌ _User_, _Account_, _Member_, _Client_ used interchangeably for the same concept.
+  - ✅ Define 1 clear term: **Customer** (for billing context) vs **User** (for authentication context).
+
+### 2. Define Bounded Contexts
+
+- Separate large systems into distinct bounded contexts. An entity named `Product` in the _Inventory Context_ (stock level, warehouse bin) has different attributes than `Product` in the _Catalog Context_ (hero image, pricing).
+
+### 3. Aggregates & Invariants
+
+- An **Aggregate Root** (e.g. `Order`) enforces internal business invariants across child entities (`OrderItem`).
+- Never mutate a child entity (`OrderItem`) directly without passing through the aggregate root method (`order.addItem(product, qty)`).
+
+### 4. Value Objects Over Primitives
+
+- Wrap primitives into type-safe Value Objects to enforce validation logic:
+
+```typescript
+// Value Object enforcing domain rule
+export class EmailAddress {
+  private readonly value: string;
+
+  constructor(email: string) {
+    if (!email.includes('@')) throw new Error('Invalid email domain');
+    this.value = email.toLowerCase().trim();
+  }
+
+  public toString(): string {
+    return this.value;
+  }
+}
+```
 
-### 3. Aggregates & Invariants
+## 🚨 Edge-Case & Failure Mode Matrix
 
-- An **Aggregate Root** (e.g. `Order`) enforces internal business invariants across child entities (`OrderItem`).
-- Never mutate a child entity (`OrderItem`) directly without passing through the aggregate root method (`order.addItem(product, qty)`).
+| Scenario | Risk | Production Mitigation |
+|:---|:---|:---|
+| **Empty or Null Inputs** | Unhandled exception or unexpected rendering collapse | Enforce fallback guards, optional chaining, and explicit empty state handlers |
+| **Network Timeout / Latency** | Hanging operations or duplicate side-effects | Implement bounded abort controllers, exponential backoff, and idempotency keys |
+| **Concurrency / Race Conditions** | Stale state overwrite or inconsistent data mutations | Use atomic transactions, mutex locking, or cancel-on-resubmit controls |
+| **Invalid Schema / Malformed Payload** | Downstream runtime errors or security injection | Validate boundary payloads with Zod/Pydantic schemas prior to execution |
+| **Resource / Memory Saturation** | OOM errors, frame drops, or memory leaks | Clean up listeners, cancel active timers, and enforce pagination/virtualization |
 
-### 4. Value Objects Over Primitives
 
-- Wrap primitives into type-safe Value Objects to enforce validation logic:
+## 🤖 LLM-Specific Traps Table
 
-```typescript
-// Value Object enforcing domain rule
-export class EmailAddress {
-  private readonly value: string;
+| Anti-Pattern | What AI Commonly Does Wrong | What Is Actually Correct |
+|:---|:---|:---|
+| **Full Table Scan Blindspot** | Querying high-cardinality tables without index coverage | Verify query plans with EXPLAIN ANALYZE and add composite B-Tree indexes |
+| **Non-Atomic Batch Mutation** | Executing multiple related DB writes sequentially without transaction wrapper | Wrap multi-table updates in an atomic transaction with automatic rollback |
+| **Destructive Schema Migration** | Dropping or renaming columns in production without multi-phase migration | Use expand-and-contract: add new column, sync data, migrate callers, drop old |
 
-  constructor(email: string) {
-    if (!email.includes('@')) throw new Error('Invalid email domain');
-    this.value = email.toLowerCase().trim();
-  }
 
-  public toString(): string {
-    return this.value;
-  }
-}
+## 🏛️ Tribunal Verification & Guardrails
+
+**Active Reviewers:** `database-architect` · `sql-pro` · `security-auditor` · `schema-validator`
+**Slash Command:** `/review` or `/tribunal-full`
+
+### 🔬 Evidence Standard (Tri-State Verification)
+Every finding, audit statement, or completion claim must classify its factual certainty:
+- **`[OBSERVED]`**: Directly confirmed in the codebase or verified via executed terminal command.
+- **`[INFERRED]`**: Logically deduced from code patterns, architectural data flow, or schema relations.
+- **`[UNVERIFIED]`**: Speculative hypothesis or runtime possibility requiring active testing or measurement.
+
+### ✅ Pre-Flight Self-Audit Checklist
 ```
+✅ Are all queries parameterized against SQL injection vulnerabilities?
+✅ Are composite indexes ordered by Equality, Sort, then Range (ESR)?
+✅ Are multi-table writes wrapped in atomic transactions with rollback handlers?
+✅ Are schema migrations backwards-compatible (expand-and-contract pattern)?
+✅ Did I verify table and column names against active schema definitions?
+```
+
+### 🛑 Verification-Before-Completion (VBC) Protocol
+**CRITICAL:** You must follow a strict "evidence-based closeout" state machine.
+- ❌ **Forbidden:** Declaring a task complete because the output "looks correct."
+- ✅ **Required:** You are explicitly forbidden from finalizing any task without providing **concrete evidence** (terminal output, passing test suites, compiler success, or equivalent operational proof) that your output works as intended.

package/.agent/skills/duckdb-analytical-sql/SKILL.md

@@ -1,8 +1,8 @@
 ---
 name: duckdb-analytical-sql
-description: "Use when Embedded OLAP analytics, high-speed Parquet/JSON processing, in-memory analytical SQL, and DuckDB integrations in Node.js, Python, and WASM."
-version: 5.0.0
-last-updated: 2026-09-13
+description: "Use when designing schemas, querying, indexing, optimizing, and securing duckdb analytical sql databases and data models."
+version: 6.0.0
+last-updated: 2026-09-29
 skills:
   - sql-pro
   - database-design
@@ -16,36 +16,108 @@ scripts-binding:
 
 # DuckDB Analytical SQL — Embedded Analytics
 
----
+## Mandatory Pre-Flight Context Inspection
+Before reading, generating, or refactoring code in the `duckdb-analytical-sql` domain, inspect these 5 critical parameters:
+1. **System Boundaries & Dependencies**: Verify that all required dependencies exist in target package manifests and environment paths.
+2. **Runtime Context & Platform Invariants**: Confirm target platform constraints (Node.js, Browser, Mobile OS, Edge runtime) before applying APIs.
+3. **Execution Guardrails**: Identify potential side-effects, state mutations, and unhandled asynchronous exceptions.
+4. **Validation & Type Contracts**: Validate input data schemas and strict type constraints across all module interfaces.
+5. **Observability & Proof of Execution**: Ensure execution produces tangible verification signals (terminal output, tests, metrics).
+
+
+## Activation Boundaries
+- **Activate when:** Use when designing schemas, querying, indexing, optimizing, and securing duckdb analytical sql databases and data models.
+- **DO NOT activate when:** The task falls outside the `duckdb-analytical-sql` domain or is managed by a different dedicated specialist agent.
+
+
+## 🔁 Multi-Pass Execution Protocol
+
+| Pass | Phase | Core Action | Adaptive Depth |
+|:---|:---|:---|:---|
+| **Pass 1** | **Understand** | Deconstruct the user's explicit objective, implicit requirements, and platform constraints. | Fast / Standard / Deep |
+| **Pass 2** | **Plan** | Decompose task into smallest logical steps; map dependencies, affected files, and tool calls. | Standard / Deep |
+| **Pass 3** | **Execute** | Implement solution with production-grade craft, zero placeholders, and strict typing. | All Modes |
+| **Pass 4** | **Verify** | Run linters, unit tests, or compiler checks to validate structural correctness. | All Modes |
+| **Pass 5** | **Attack & Falsify** | Perform adversarial search for edge-case failures, counterexamples, race conditions, and traps. | Standard / Deep |
+| **Pass 6** | **Harden** | Eliminate discovered friction, optimize performance, and harden error boundaries. | Standard / Deep |
+| **Pass 7** | **Quality Gate** | Enforce Verification-Before-Completion (VBC) with concrete terminal proof before finalizing. | All Modes |
+
+
+---
+
+## 🛠️ Technical Architecture & Reference Recipes
+
+## Node.js DuckDB Parquet Query Pattern
+
+```typescript
+import { Database } from 'duckdb-async';
+
+export async function runAnalyticalReport(parquetGlobPath: string) {
+  const db = await Database.create(':memory:');
+
+  // Set memory limits for embedded execution
+  await db.exec("SET max_memory = '2GB'; SET threads = 4;");
+
+  const rows = await db.all(
+    `
+    SELECT 
+        date_trunc('day', timestamp) as event_day,
+        event_type,
+        COUNT(*) as total_count,
+        QUANTILE_CONT(duration_ms, 0.95) as p95_latency
+    FROM read_parquet(?)
+    GROUP BY 1, 2
+    ORDER BY 1 DESC
+    LIMIT 100
+  `,
+    [parquetGlobPath],
+  );
+
+  return rows;
+}
+```
+
+## 🚨 Edge-Case & Failure Mode Matrix
+
+| Scenario | Risk | Production Mitigation |
+|:---|:---|:---|
+| **Empty or Null Inputs** | Unhandled exception or unexpected rendering collapse | Enforce fallback guards, optional chaining, and explicit empty state handlers |
+| **Network Timeout / Latency** | Hanging operations or duplicate side-effects | Implement bounded abort controllers, exponential backoff, and idempotency keys |
+| **Concurrency / Race Conditions** | Stale state overwrite or inconsistent data mutations | Use atomic transactions, mutex locking, or cancel-on-resubmit controls |
+| **Invalid Schema / Malformed Payload** | Downstream runtime errors or security injection | Validate boundary payloads with Zod/Pydantic schemas prior to execution |
+| **Resource / Memory Saturation** | OOM errors, frame drops, or memory leaks | Clean up listeners, cancel active timers, and enforce pagination/virtualization |
 
-## 🛠️ Technical Architecture & Reference Recipes
 
-## Node.js DuckDB Parquet Query Pattern
+## 🤖 LLM-Specific Traps Table
 
-```typescript
-import { Database } from 'duckdb-async';
+| Anti-Pattern | What AI Commonly Does Wrong | What Is Actually Correct |
+|:---|:---|:---|
+| **Full Table Scan Blindspot** | Querying high-cardinality tables without index coverage | Verify query plans with EXPLAIN ANALYZE and add composite B-Tree indexes |
+| **Non-Atomic Batch Mutation** | Executing multiple related DB writes sequentially without transaction wrapper | Wrap multi-table updates in an atomic transaction with automatic rollback |
+| **Destructive Schema Migration** | Dropping or renaming columns in production without multi-phase migration | Use expand-and-contract: add new column, sync data, migrate callers, drop old |
 
-export async function runAnalyticalReport(parquetGlobPath: string) {
-  const db = await Database.create(':memory:');
 
-  // Set memory limits for embedded execution
-  await db.exec("SET max_memory = '2GB'; SET threads = 4;");
+## 🏛️ Tribunal Verification & Guardrails
 
-  const rows = await db.all(
-    `
-    SELECT 
-        date_trunc('day', timestamp) as event_day,
-        event_type,
-        COUNT(*) as total_count,
-        QUANTILE_CONT(duration_ms, 0.95) as p95_latency
-    FROM read_parquet(?)
-    GROUP BY 1, 2
-    ORDER BY 1 DESC
-    LIMIT 100
-  `,
-    [parquetGlobPath],
-  );
+**Active Reviewers:** `database-architect` · `sql-pro` · `security-auditor` · `schema-validator`
+**Slash Command:** `/review` or `/tribunal-full`
 
-  return rows;
-}
+### 🔬 Evidence Standard (Tri-State Verification)
+Every finding, audit statement, or completion claim must classify its factual certainty:
+- **`[OBSERVED]`**: Directly confirmed in the codebase or verified via executed terminal command.
+- **`[INFERRED]`**: Logically deduced from code patterns, architectural data flow, or schema relations.
+- **`[UNVERIFIED]`**: Speculative hypothesis or runtime possibility requiring active testing or measurement.
+
+### ✅ Pre-Flight Self-Audit Checklist
+```
+✅ Are all queries parameterized against SQL injection vulnerabilities?
+✅ Are composite indexes ordered by Equality, Sort, then Range (ESR)?
+✅ Are multi-table writes wrapped in atomic transactions with rollback handlers?
+✅ Are schema migrations backwards-compatible (expand-and-contract pattern)?
+✅ Did I verify table and column names against active schema definitions?
 ```
+
+### 🛑 Verification-Before-Completion (VBC) Protocol
+**CRITICAL:** You must follow a strict "evidence-based closeout" state machine.
+- ❌ **Forbidden:** Declaring a task complete because the output "looks correct."
+- ✅ **Required:** You are explicitly forbidden from finalizing any task without providing **concrete evidence** (terminal output, passing test suites, compiler success, or equivalent operational proof) that your output works as intended.

package/.agent/skills/edge-ai-mobile/SKILL.md

@@ -1,8 +1,8 @@
 ---
 name: edge-ai-mobile
-description: "Use when On-device mobile AI, CoreML, Android NNAPI, ONNX Runtime Web/Mobile, local LLM execution (SLMs), and sub-10ms privacy-first edge inference."
-version: 5.0.0
-last-updated: 2026-09-13
+description: "Use when building, optimizing, and securing edge ai mobile mobile interfaces, native bridges, touch gestures, and offline states."
+version: 6.0.0
+last-updated: 2026-09-29
 skills:
   - mobile-developer
   - browser-native-ai
@@ -16,27 +16,99 @@ scripts-binding:
 
 # Edge AI & On-Device Mobile Machine Learning
 
----
+## Mandatory Pre-Flight Context Inspection
+Before reading, generating, or refactoring code in the `edge-ai-mobile` domain, inspect these 5 critical parameters:
+1. **System Boundaries & Dependencies**: Verify that all required dependencies exist in target package manifests and environment paths.
+2. **Runtime Context & Platform Invariants**: Confirm target platform constraints (Node.js, Browser, Mobile OS, Edge runtime) before applying APIs.
+3. **Execution Guardrails**: Identify potential side-effects, state mutations, and unhandled asynchronous exceptions.
+4. **Validation & Type Contracts**: Validate input data schemas and strict type constraints across all module interfaces.
+5. **Observability & Proof of Execution**: Ensure execution produces tangible verification signals (terminal output, tests, metrics).
+
 
-## 🛠️ Technical Architecture & Reference Recipes
+## Activation Boundaries
+- **Activate when:** Use when building, optimizing, and securing edge ai mobile mobile interfaces, native bridges, touch gestures, and offline states.
+- **DO NOT activate when:** The task falls outside the `edge-ai-mobile` domain or is managed by a different dedicated specialist agent.
 
-## Mobile ONNX Edge Inference Pattern
 
-```typescript
-import * as ort from 'onnxruntime-react-native';
+## 🔁 Multi-Pass Execution Protocol
 
-export async function runLocalEmbeddings(textTokens: number[]): Promise<Float32Array> {
-  const session = await ort.InferenceSession.create('model_quantized.onnx', {
-    executionProviders: ['cpu'], // Accelerates via ANE/NNAPI internally
-  });
+| Pass | Phase | Core Action | Adaptive Depth |
+|:---|:---|:---|:---|
+| **Pass 1** | **Understand** | Deconstruct the user's explicit objective, implicit requirements, and platform constraints. | Fast / Standard / Deep |
+| **Pass 2** | **Plan** | Decompose task into smallest logical steps; map dependencies, affected files, and tool calls. | Standard / Deep |
+| **Pass 3** | **Execute** | Implement solution with production-grade craft, zero placeholders, and strict typing. | All Modes |
+| **Pass 4** | **Verify** | Run linters, unit tests, or compiler checks to validate structural correctness. | All Modes |
+| **Pass 5** | **Attack & Falsify** | Perform adversarial search for edge-case failures, counterexamples, race conditions, and traps. | Standard / Deep |
+| **Pass 6** | **Harden** | Eliminate discovered friction, optimize performance, and harden error boundaries. | Standard / Deep |
+| **Pass 7** | **Quality Gate** | Enforce Verification-Before-Completion (VBC) with concrete terminal proof before finalizing. | All Modes |
 
-  const tensor = new ort.Tensor('int64', new BigInt64Array(textTokens.map(BigInt)), [
-    1,
-    textTokens.length,
-  ]);
-  const feeds = { input_ids: tensor };
 
-  const results = await session.run(feeds);
-  return results.embedding.data as Float32Array;
-}
+---
+
+## 🛠️ Technical Architecture & Reference Recipes
+
+## Mobile ONNX Edge Inference Pattern
+
+```typescript
+import * as ort from 'onnxruntime-react-native';
+
+export async function runLocalEmbeddings(textTokens: number[]): Promise<Float32Array> {
+  const session = await ort.InferenceSession.create('model_quantized.onnx', {
+    executionProviders: ['cpu'], // Accelerates via ANE/NNAPI internally
+  });
+
+  const tensor = new ort.Tensor('int64', new BigInt64Array(textTokens.map(BigInt)), [
+    1,
+    textTokens.length,
+  ]);
+  const feeds = { input_ids: tensor };
+
+  const results = await session.run(feeds);
+  return results.embedding.data as Float32Array;
+}
 ```
+
+## 🚨 Edge-Case & Failure Mode Matrix
+
+| Scenario | Risk | Production Mitigation |
+|:---|:---|:---|
+| **Empty or Null Inputs** | Unhandled exception or unexpected rendering collapse | Enforce fallback guards, optional chaining, and explicit empty state handlers |
+| **Network Timeout / Latency** | Hanging operations or duplicate side-effects | Implement bounded abort controllers, exponential backoff, and idempotency keys |
+| **Concurrency / Race Conditions** | Stale state overwrite or inconsistent data mutations | Use atomic transactions, mutex locking, or cancel-on-resubmit controls |
+| **Invalid Schema / Malformed Payload** | Downstream runtime errors or security injection | Validate boundary payloads with Zod/Pydantic schemas prior to execution |
+| **Resource / Memory Saturation** | OOM errors, frame drops, or memory leaks | Clean up listeners, cancel active timers, and enforce pagination/virtualization |
+
+
+## 🤖 LLM-Specific Traps Table
+
+| Anti-Pattern | What AI Commonly Does Wrong | What Is Actually Correct |
+|:---|:---|:---|
+| **JS Thread Animation Lag** | Driving gestures and scrolling physics on the React Native JS thread | Use React Native Reanimated worklets running directly on the UI thread |
+| **Missing Keyboard Offset** | Forms hidden behind native software keyboard on iOS/Android | Wrap form views in KeyboardAvoidingView with platform-calibrated behavior |
+| **Uncached Image Flooding** | Rendering raw image URLs in list items without memory caching | Use FastImage or Expo Image with disk cache policies and thumbnail previews |
+
+
+## 🏛️ Tribunal Verification & Guardrails
+
+**Active Reviewers:** `mobile-reviewer` · `frontend-reviewer` · `type-safety`
+**Slash Command:** `/review` or `/tribunal-full`
+
+### 🔬 Evidence Standard (Tri-State Verification)
+Every finding, audit statement, or completion claim must classify its factual certainty:
+- **`[OBSERVED]`**: Directly confirmed in the codebase or verified via executed terminal command.
+- **`[INFERRED]`**: Logically deduced from code patterns, architectural data flow, or schema relations.
+- **`[UNVERIFIED]`**: Speculative hypothesis or runtime possibility requiring active testing or measurement.
+
+### ✅ Pre-Flight Self-Audit Checklist
+```
+✅ Do touch targets satisfy the 44x44px minimum touch boundary standard?
+✅ Are gesture handlers and native animations offloaded via Reanimated worklets on the UI thread?
+✅ Are keyboard avoiding views, safe areas, and notch offsets handled?
+✅ Is offline storage and state hydration handled with optimistic sync?
+✅ Did I verify compatibility across iOS, Android, and varying screen densities?
+```
+
+### 🛑 Verification-Before-Completion (VBC) Protocol
+**CRITICAL:** You must follow a strict "evidence-based closeout" state machine.
+- ❌ **Forbidden:** Declaring a task complete because the output "looks correct."
+- ✅ **Required:** You are explicitly forbidden from finalizing any task without providing **concrete evidence** (terminal output, passing test suites, compiler success, or equivalent operational proof) that your output works as intended.