tribunal-kit 9.2.4 → 9.2.6

package/.agent/workflows/tribunal-backend.md

@@ -1,149 +1,161 @@
----
-description: Backend-specific Tribunal. Runs Logic + Security + Dependency + Type Safety + Resilience + Schema reviewers. Use for API routes, server logic, auth code, middleware, Server Actions, and any server-side business logic.
-tools: Read, Grep, Glob, Bash, Edit, Write
-version: 3.0.0
-last-updated: 2026-07-30
-required-skills:
-  - backend-security-expert
-  - nodejs-best-practices
-  - api-patterns
-scripts-binding:
-  - .agent/scripts/security_scan.js
-  - .agent/scripts/dependency_analyzer.js
-  - .agent/scripts/schema_validator.js
----
-
-# /tribunal-backend — Backend Code Audit
-
-$ARGUMENTS
-
----
-
-## Mandatory Pre-Flight Context Inspection
-
-Before auditing backend routes or server logic, you MUST inspect:
-
-1. Target Backend Source & Contracts → Read target route handlers, Server Actions, or controller methods
-2. Dependencies & Environment (`package.json`, `.env.example`) → Check backend framework versions, secret key placeholders, and ORM schemas
-3. 28-Reviewer Parallel Gate → Execute logic-reviewer, security-auditor, dependency-analyzer, type-safety, resilience-reviewer, and schema-reviewer before approving diffs
-
-4. Required Skills → Before executing, load and follow procedural rules from:
-   - `backend-security-expert` (.agent/skills/backend-security-expert/SKILL.md): Server-side security, auth, JWT, ORM injection, RBAC
-   - `nodejs-best-practices` (.agent/skills/nodejs-best-practices/SKILL.md): Node.js patterns, async handling, and error management
-   - `api-patterns` (.agent/skills/api-patterns/SKILL.md): REST/GraphQL API design, versioning, and error contracts
-
----
-
-## When to Use /tribunal-backend
-
-| Use `/tribunal-backend` when...    | Use something else when...                   |
-| :--------------------------------- | :------------------------------------------- |
-| Reviewing API routes or middleware | Frontend components → `/tribunal-frontend`   |
-| Auth, JWT, session code            | Database queries only → `/tribunal-database` |
-| Server Actions                     | Mobile code → `/tribunal-mobile`             |
-| Input validation and Zod schemas   | Maximum coverage → `/tribunal-full`          |
-| Third-party API integrations       |                                              |
-
----
-
-## 6 Active Reviewers (All Run Simultaneously)
-
-### precedence-reviewer → Checks local repo Case Law for past rejections
-
-logic-reviewer
-
-- Hallucinated Express/Hono/Fastify methods
-- Missing awaits on async operations
-- Unreachable code after return statements
-- Race conditions in sequential state mutations
-
-### security-auditor
-
-- SQL injection via string interpolation
-- JWT verify missing `{ algorithms: ['HS256'] }` option
-- Auth check after business logic (wrong order)
-- IDOR — resource ownership not verified against session
-- SSRF — user-controlled URLs passed to fetch()
-- Hardcoded secrets / missing env var existence checks
-- CORS wildcard (`*`) in production
-
-### dependency-reviewer
-
-- Packages not in package.json
-- npm package names matching typosquatting patterns
-- Major version incompatibilities
-- Known CVEs in used packages
-
-### type-safety-reviewer
-
-- `any` types in request handlers
-- Missing Zod validation before DB access
-- Unsafe type assertions (`as User` without runtime check)
-- Return type mismatches
-
-### schema-reviewer
-
-- Missing input validation on req.body/req.query
-- Validation applied client-side only
-- Loosely defined Zod/Pydantic schemas
-
-### resilience-reviewer
-
-- Swallowed errors (empty catch blocks)
-- Missing timeouts on network fetches
-- Unhandled Promise rejections
-- Missing retries for temporal network failures
-
----
-
-## Verdict System
-
-```
-If ANY reviewer → ❌ REJECTED: code must be fixed before Human Gate
-If any reviewer → ⚠️ WARNING:  proceed with flagged items noted
-If all reviewers → ✅ APPROVED: present to Human Gate
-```
-
----
-
-## Backend-Specific Hallucination Traps (Common LLM Mistakes)
-
-```typescript
-// ❌ express.Router() methods that don't exist
-router.middleware(() => {}); // not a method — use app.use()
-router.beforeAll(() => {}); // not a method — use router.use()
-
-// ❌ Hono methods that don't exist
-app.middleware('/path', handler); // not valid — use app.use('/path', handler)
-
-// ❌ next-auth v4 patterns in v5 projects
-import { getServerSession } from 'next-auth'; // v4 — use auth() from './auth' in v5
-
-// ❌ jwt.verify async form (it's synchronous)
-const payload = await jwt.verify(token, secret); // jwt.verify is NOT async
-const payload = jwt.verify(token, secret); // Correct
-```
-
----
-
-## Usage Examples
-
-```
-/tribunal-backend the POST /api/auth/login route with JWT issuance
-/tribunal-backend the createOrder Server Action with Stripe integration
-/tribunal-backend the auth middleware that verifies session on protected routes
-/tribunal-backend the webhook handler for Stripe payment events
-```
-
----
-
-## After /tribunal-backend — Next Steps
-
-| Outcome                      | Next Command                                      |
-| :--------------------------- | :------------------------------------------------ |
-| All checks pass              | → `/deploy` or merge code                         |
-| Reviewers reject with fixes  | → Apply fixes, then run `/tribunal-backend` again |
-| Performance concerns raised  | → `/tribunal-performance` for deep profiling      |
-| Need test coverage for logic | → `/test` to generate backend tests               |
-
----
+---
+description: Backend-specific Tribunal. Runs Logic + Security + Dependency + Type Safety + Resilience + Schema reviewers. Use for API routes, server logic, auth code, middleware, Server Actions, and any server-side business logic.
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 3.0.0
+last-updated: 2026-07-30
+required-skills:
+  - backend-security-expert
+  - nodejs-best-practices
+  - api-patterns
+scripts-binding:
+  - .agent/scripts/backend_audit.js
+  - .agent/scripts/security_scan.js
+  - .agent/scripts/dependency_analyzer.js
+  - .agent/scripts/schema_validator.js
+  - .agent/scripts/cross_agent_correlator.js
+  - .agent/scripts/validation_engine.js
+  - .agent/scripts/backend_report_generator.js
+---
+
+# /tribunal-backend — Backend Code Audit
+
+$ARGUMENTS
+
+---
+
+## Mandatory Pre-Flight Context Inspection
+
+Before auditing backend routes or server logic, you MUST inspect:
+
+1. Target Backend Source & Contracts → Read target route handlers, Server Actions, or controller methods
+2. Dependencies & Environment (`package.json`, `.env.example`) → Check backend framework versions, secret key placeholders, and ORM schemas
+3. 28-Reviewer Parallel Gate → Execute logic-reviewer, security-auditor, dependency-analyzer, type-safety, resilience-reviewer, and schema-reviewer before approving diffs
+
+4. Required Skills → Before executing, run \`.agent/scripts/backend_audit.js\` to detect the backend stack (Python, FastAPI, Node.js, databases) and load the specific dynamically recommended skills from the script output.
+   - You MUST load every skill output by \`backend_audit.js\`.
+   - Examples of dynamically loaded skills include \`fastapi-pro\`, \`backend-postgresql\`, \`backend-architecture-auditor\`, etc.
+
+5. Backend Correlation & Validation Pipeline →
+   - Output all your findings across agents into Evidence-First JSON format.
+   - Save to files (e.g., `findings_sec.json`, `findings_db.json`).
+   - Run \`.agent/scripts/cross_agent_correlator.js findings_sec.json findings_db.json --out=correlated.json\`.
+   - Run \`.agent/scripts/validation_engine.js --in=correlated.json --out=validated.json\`.
+   - Run \`.agent/scripts/backend_report_generator.js --in=validated.json --out=backend_report.md\`.
+   - Present \`backend_report.md\` to the user as the final outcome.
+
+---
+
+## When to Use /tribunal-backend
+
+| Use `/tribunal-backend` when...    | Use something else when...                   |
+| :--------------------------------- | :------------------------------------------- |
+| Reviewing API routes or middleware | Frontend components → `/tribunal-frontend`   |
+| Auth, JWT, session code            | Database queries only → `/tribunal-database` |
+| Server Actions                     | Mobile code → `/tribunal-mobile`             |
+| Input validation and Zod schemas   | Maximum coverage → `/tribunal-full`          |
+| Third-party API integrations       |                                              |
+
+---
+
+## 8 Active Reviewers (All Run Simultaneously)
+
+### precedence-reviewer → Checks local repo Case Law for past rejections
+
+### logic-reviewer
+
+- Hallucinated Express/Hono/Fastify/FastAPI methods
+- Missing awaits on async operations
+- Unreachable code after return statements
+- Race conditions in sequential state mutations
+
+### security-auditor
+
+- SQL injection via string interpolation
+- JWT verify missing `{ algorithms: ['HS256'] }` option
+- Auth check after business logic (wrong order)
+- IDOR — resource ownership not verified against session
+- SSRF — user-controlled URLs passed to fetch()
+- Hardcoded secrets / missing env var existence checks
+- CORS wildcard (`*`) in production
+
+### dependency-reviewer
+
+- Packages not in package.json
+- npm package names matching typosquatting patterns
+- Major version incompatibilities
+- Known CVEs in used packages
+
+### type-safety-reviewer
+
+- `any` types in request handlers
+- Missing Zod validation before DB access
+- Unsafe type assertions (`as User` without runtime check)
+- Return type mismatches
+
+### schema-reviewer
+
+- Missing input validation on req.body/req.query
+- Validation applied client-side only
+- Loosely defined Zod/Pydantic schemas
+
+### resilience-reviewer
+
+- Swallowed errors (empty catch blocks)
+- Missing timeouts on network fetches
+- Unhandled Promise rejections
+- Missing retries for temporal network failures
+
+---
+
+## Verdict System
+
+```
+If ANY reviewer → ❌ REJECTED: code must be fixed before Human Gate
+If any reviewer → ⚠️ WARNING:  proceed with flagged items noted
+If all reviewers → ✅ APPROVED: present to Human Gate
+```
+
+---
+
+## Backend-Specific Hallucination Traps (Common LLM Mistakes)
+
+```typescript
+// ❌ express.Router() methods that don't exist
+router.middleware(() => {}); // not a method — use app.use()
+router.beforeAll(() => {}); // not a method — use router.use()
+
+// ❌ Hono methods that don't exist
+app.middleware('/path', handler); // not valid — use app.use('/path', handler)
+
+// ❌ next-auth v4 patterns in v5 projects
+import { getServerSession } from 'next-auth'; // v4 — use auth() from './auth' in v5
+
+// ❌ jwt.verify async form (it's synchronous)
+const payload = await jwt.verify(token, secret); // jwt.verify is NOT async
+const payload = jwt.verify(token, secret); // Correct
+```
+
+---
+
+## Usage Examples
+
+```
+/tribunal-backend the POST /api/auth/login route with JWT issuance
+/tribunal-backend the createOrder Server Action with Stripe integration
+/tribunal-backend the auth middleware that verifies session on protected routes
+/tribunal-backend the webhook handler for Stripe payment events
+```
+
+---
+
+## After /tribunal-backend — Next Steps
+
+| Outcome                      | Next Command                                      |
+| :--------------------------- | :------------------------------------------------ |
+| All checks pass              | → `/deploy` or merge code                         |
+| Reviewers reject with fixes  | → Apply fixes, then run `/tribunal-backend` again |
+| Architecture concerns raised | → `/plan` to propose a structural refactor        |
+| Performance concerns raised  | → `/tribunal-performance` for deep profiling      |
+| Need test coverage for logic | → `/test` to generate backend tests               |
+
+---

package/.agent/workflows/tribunal-cicd.md

@@ -1,109 +1,109 @@
----
-description: CI/CD Pipeline & Workflow Tribunal. Runs Pipeline + Security + Dependency + Resilience reviewers. Use for GitHub Actions (.github/workflows/), GitLab CI (.gitlab-ci.yml), Dockerfiles, and deployment configs.
-tools: Read, Grep, Glob, Bash, Edit, Write
-version: 3.0.0
-last-updated: 2026-08-14
-required-skills:
-  - cicd-pro
-  - devops-engineer
-  - containerization-pro
-scripts-binding:
-  - .agent/scripts/cicd_validator.js
-  - .agent/scripts/security_scan.js
-  - .agent/scripts/dependency_analyzer.js
----
-
-# /tribunal-cicd — Pipeline & Workflow Audit
-
-$ARGUMENTS
-
----
-
-## Mandatory Pre-Flight Context Inspection
-
-Before auditing CI/CD configurations, you MUST inspect:
-
-1. Target Workflow Files (`.github/workflows/*.yml`, `.gitlab-ci.yml`, `Dockerfile`)
-2. Repository Secrets & OIDC Configuration (`id-token: write`, environment promotion rules)
-3. 28-Reviewer Parallel Gate: Execute `pipeline-reviewer`, `security-auditor`, `dependency-reviewer`, `resilience-reviewer`, and `precedence-reviewer`.
-
-4. Required Skills → Before executing, load and follow procedural rules from:
-   - `cicd-pro` (.agent/skills/cicd-pro/SKILL.md): CI/CD workflow syntax, matrix builds, and deployment strategies
-   - `devops-engineer` (.agent/skills/devops-engineer/SKILL.md): CI/CD pipeline management and infrastructure automation
-   - `containerization-pro` (.agent/skills/containerization-pro/SKILL.md): Docker, Kubernetes, and container security best practices
-
----
-
-## When to Use /tribunal-cicd
-
-| Use `/tribunal-cicd` when...                  | Use something else when...                      |
-| :-------------------------------------------- | :---------------------------------------------- |
-| Writing or modifying GitHub Actions workflows | Application API endpoints → `/tribunal-backend` |
-| Authoring Dockerfiles or multi-stage builds   | Frontend React code → `/tribunal-frontend`      |
-| Setting up automated release pipelines        | Database schemas → `/tribunal-database`         |
-| Auditing CI pipeline security & secrets       | Maximum system-wide coverage → `/tribunal-full` |
-| Fixing broken CI builds or test matrices      | Diagnosing live runner failure logs → `/fix-ci` |
-
----
-
-## Active Reviewers (Run in Parallel)
-
-### precedence-reviewer
-
-- Checks local repo Case Law for previously rejected pipeline patterns.
-
-### pipeline-reviewer
-
-- Deprecated action tags (`actions/checkout@v2`/`@v3` → `@v4`).
-- Missing concurrency mutex (`concurrency:` with `cancel-in-progress`).
-- Insecure triggers (`pull_request_target` with PR checkout).
-- Deterministic builds (`npm ci` vs `npm install`).
-- Step and runner timeout settings.
-
-### security-auditor
-
-- Script injection via unescaped context strings in inline bash.
-- Hardcoded credentials, plain text tokens, or missing secret references.
-- Excessive workflow-level permissions (e.g. `write-all`).
-- Insecure artifact uploads/downloads.
-
-### dependency-reviewer
-
-- Unpinned third-party community actions (missing SHA hash pinning).
-- Supply chain security vulnerabilities in container base images.
-
-### resilience-reviewer
-
-- Missing `if: failure()` alerting on deploy steps.
-- Missing rollback triggers on health check failures.
-- Unhandled matrix combinations or missing fallback retry logic.
-
----
-
-## Verdict System
-
-```
-If ANY reviewer → ❌ REJECTED: code must be fixed before Human Gate
-If any reviewer → ⚠️ WARNING:  proceed with flagged items noted
-If all reviewers → ✅ APPROVED: present to Human Gate
-```
-
----
-
-## Usage Examples
-
-```
-/tribunal-cicd .github/workflows/ci.yml
-/tribunal-cicd .github/workflows/deploy.yml
-/tribunal-cicd Dockerfile and deployment manifest
-```
-
----
-
-## After /tribunal-cicd — Next Steps
-
-| Outcome                         | Next Command                                   |
-| :------------------------------ | :--------------------------------------------- |
-| All checks pass                 | → `/deploy` or commit and push                 |
-| Reviewers reject with fixes     | → Apply fixes, then run `/tribunal-cicd` again |
-| Live pipeline failure in GitHub | → `/fix-ci` with the failing runner logs       |
+---
+description: CI/CD Pipeline & Workflow Tribunal. Runs Pipeline + Security + Dependency + Resilience reviewers. Use for GitHub Actions (.github/workflows/), GitLab CI (.gitlab-ci.yml), Dockerfiles, and deployment configs.
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 3.0.0
+last-updated: 2026-08-14
+required-skills:
+  - cicd-pro
+  - devops-engineer
+  - containerization-pro
+scripts-binding:
+  - .agent/scripts/cicd_validator.js
+  - .agent/scripts/security_scan.js
+  - .agent/scripts/dependency_analyzer.js
+---
+
+# /tribunal-cicd — Pipeline & Workflow Audit
+
+$ARGUMENTS
+
+---
+
+## Mandatory Pre-Flight Context Inspection
+
+Before auditing CI/CD configurations, you MUST inspect:
+
+1. Target Workflow Files (`.github/workflows/*.yml`, `.gitlab-ci.yml`, `Dockerfile`)
+2. Repository Secrets & OIDC Configuration (`id-token: write`, environment promotion rules)
+3. 28-Reviewer Parallel Gate: Execute `pipeline-reviewer`, `security-auditor`, `dependency-reviewer`, `resilience-reviewer`, and `precedence-reviewer`.
+
+4. Required Skills → Before executing, load and follow procedural rules from:
+   - `cicd-pro` (.agent/skills/cicd-pro/SKILL.md): CI/CD workflow syntax, matrix builds, and deployment strategies
+   - `devops-engineer` (.agent/skills/devops-engineer/SKILL.md): CI/CD pipeline management and infrastructure automation
+   - `containerization-pro` (.agent/skills/containerization-pro/SKILL.md): Docker, Kubernetes, and container security best practices
+
+---
+
+## When to Use /tribunal-cicd
+
+| Use `/tribunal-cicd` when...                  | Use something else when...                      |
+| :-------------------------------------------- | :---------------------------------------------- |
+| Writing or modifying GitHub Actions workflows | Application API endpoints → `/tribunal-backend` |
+| Authoring Dockerfiles or multi-stage builds   | Frontend React code → `/tribunal-frontend`      |
+| Setting up automated release pipelines        | Database schemas → `/tribunal-database`         |
+| Auditing CI pipeline security & secrets       | Maximum system-wide coverage → `/tribunal-full` |
+| Fixing broken CI builds or test matrices      | Diagnosing live runner failure logs → `/fix-ci` |
+
+---
+
+## Active Reviewers (Run in Parallel)
+
+### precedence-reviewer
+
+- Checks local repo Case Law for previously rejected pipeline patterns.
+
+### pipeline-reviewer
+
+- Deprecated action tags (`actions/checkout@v2`/`@v3` → `@v4`).
+- Missing concurrency mutex (`concurrency:` with `cancel-in-progress`).
+- Insecure triggers (`pull_request_target` with PR checkout).
+- Deterministic builds (`npm ci` vs `npm install`).
+- Step and runner timeout settings.
+
+### security-auditor
+
+- Script injection via unescaped context strings in inline bash.
+- Hardcoded credentials, plain text tokens, or missing secret references.
+- Excessive workflow-level permissions (e.g. `write-all`).
+- Insecure artifact uploads/downloads.
+
+### dependency-reviewer
+
+- Unpinned third-party community actions (missing SHA hash pinning).
+- Supply chain security vulnerabilities in container base images.
+
+### resilience-reviewer
+
+- Missing `if: failure()` alerting on deploy steps.
+- Missing rollback triggers on health check failures.
+- Unhandled matrix combinations or missing fallback retry logic.
+
+---
+
+## Verdict System
+
+```
+If ANY reviewer → ❌ REJECTED: code must be fixed before Human Gate
+If any reviewer → ⚠️ WARNING:  proceed with flagged items noted
+If all reviewers → ✅ APPROVED: present to Human Gate
+```
+
+---
+
+## Usage Examples
+
+```
+/tribunal-cicd .github/workflows/ci.yml
+/tribunal-cicd .github/workflows/deploy.yml
+/tribunal-cicd Dockerfile and deployment manifest
+```
+
+---
+
+## After /tribunal-cicd — Next Steps
+
+| Outcome                         | Next Command                                   |
+| :------------------------------ | :--------------------------------------------- |
+| All checks pass                 | → `/deploy` or commit and push                 |
+| Reviewers reject with fixes     | → Apply fixes, then run `/tribunal-cicd` again |
+| Live pipeline failure in GitHub | → `/fix-ci` with the failing runner logs       |