tribunal-kit 9.2.4 → 9.2.6

package/.agents/skills/frontend-design/SKILL.md

@@ -1,8 +1,8 @@
 ---
 name: frontend-design
-description: "Use when Design engineering principles for React/Next.js. Relative color syntax (OKLCH), spatial grid math, fluid container queries, and contrast validation."
-version: 5.0.0
-last-updated: 2026-09-13
+description: "Use when building, styling, optimizing, and auditing frontend design components, responsive layouts, design systems, and frontend state."
+version: 6.0.0
+last-updated: 2026-09-29
 skills:
   - baseline-ui
   - better-colors
@@ -15,89 +15,159 @@ scripts-binding:
 
 # Frontend Design — Technical Spacing & Color Science
 
----
-
-## 🛠️ Technical Architecture & Reference Recipes
-
----
+## Mandatory Pre-Flight Context Inspection
+Before reading, generating, or refactoring code in the `frontend-design` domain, inspect these 5 critical parameters:
+1. **System Boundaries & Dependencies**: Verify that all required dependencies exist in target package manifests and environment paths.
+2. **Runtime Context & Platform Invariants**: Confirm target platform constraints (Node.js, Browser, Mobile OS, Edge runtime) before applying APIs.
+3. **Execution Guardrails**: Identify potential side-effects, state mutations, and unhandled asynchronous exceptions.
+4. **Validation & Type Contracts**: Validate input data schemas and strict type constraints across all module interfaces.
+5. **Observability & Proof of Execution**: Ensure execution produces tangible verification signals (terminal output, tests, metrics).
 
----
-
-## 1. Relative Color Syntax & OKLCH Theme Tokens
 
-Perceptually uniform color science ensures stable contrast. Use CSS **Relative Color Syntax** to derive state colors dynamically:
+## Activation Boundaries
+- **Activate when:** Use when building, styling, optimizing, and auditing frontend design components, responsive layouts, design systems, and frontend state.
+- **DO NOT activate when:** The task falls outside the `frontend-design` domain or is managed by a different dedicated specialist agent.
 
-```css
-:root {
-  /* base color values */
-  --color-primary: oklch(62% 0.21 250); /* Brand electric blue */
 
-  /* Deriving hover states dynamically: reduce lightness, preserve chroma and hue */
-  --color-primary-hover: oklch(from var(--color-primary) calc(l - 0.08) c h);
-  --color-primary-active: oklch(from var(--color-primary) calc(l - 0.12) c h);
+## 🔁 Multi-Pass Execution Protocol
 
-  /* Backgrounds */
-  --bg-surface: oklch(100% 0 0);
-  --text-main: oklch(20% 0.02 250);
-}
+| Pass | Phase | Core Action | Adaptive Depth |
+|:---|:---|:---|:---|
+| **Pass 1** | **Understand** | Deconstruct the user's explicit objective, implicit requirements, and platform constraints. | Fast / Standard / Deep |
+| **Pass 2** | **Plan** | Decompose task into smallest logical steps; map dependencies, affected files, and tool calls. | Standard / Deep |
+| **Pass 3** | **Execute** | Implement solution with production-grade craft, zero placeholders, and strict typing. | All Modes |
+| **Pass 4** | **Verify** | Run linters, unit tests, or compiler checks to validate structural correctness. | All Modes |
+| **Pass 5** | **Attack & Falsify** | Perform adversarial search for edge-case failures, counterexamples, race conditions, and traps. | Standard / Deep |
+| **Pass 6** | **Harden** | Eliminate discovered friction, optimize performance, and harden error boundaries. | Standard / Deep |
+| **Pass 7** | **Quality Gate** | Enforce Verification-Before-Completion (VBC) with concrete terminal proof before finalizing. | All Modes |
 
-[data-theme='dark'] {
-  --bg-surface: oklch(14% 0.008 250);
-  --text-main: oklch(93% 0.003 250);
-}
-```
 
----
+---
+
+## 🛠️ Technical Architecture & Reference Recipes
 
-## 2. Spatial Grid Math & Radius Tokens
+---
+
+## 1. Relative Color Syntax & OKLCH Theme Tokens
+
+Perceptually uniform color science ensures stable contrast. Use CSS **Relative Color Syntax** to derive state colors dynamically:
+
+```css
+:root {
+  /* base color values */
+  --color-primary: oklch(62% 0.21 250); /* Brand electric blue */
+
+  /* Deriving hover states dynamically: reduce lightness, preserve chroma and hue */
+  --color-primary-hover: oklch(from var(--color-primary) calc(l - 0.08) c h);
+  --color-primary-active: oklch(from var(--color-primary) calc(l - 0.12) c h);
+
+  /* Backgrounds */
+  --bg-surface: oklch(100% 0 0);
+  --text-main: oklch(20% 0.02 250);
+}
+
+[data-theme='dark'] {
+  --bg-surface: oklch(14% 0.008 250);
+  --text-main: oklch(93% 0.003 250);
+}
+```
+
+---
+
+## 2. Spatial Grid Math & Radius Tokens
+
+Enforce an 8px spatial grid calculated mathematically to ensure alignment precision:
+
+```css
+:root {
+  --base-grid: 8px;
+
+  --space-xs: calc(var(--base-grid) * 0.5); /* 4px  - icon gaps */
+  --space-sm: calc(var(--base-grid) * 1); /* 8px  - tag paddings */
+  --space-md: calc(var(--base-grid) * 2); /* 16px - inputs */
+  --space-lg: calc(var(--base-grid) * 3); /* 24px - card padding */
+  --space-xl: calc(var(--base-grid) * 4); /* 32px - section gaps */
+}
+```
+
+### Nested Radius Formula
+
+Ensure component inner borders track correctly:
+`outer_radius = inner_radius + padding_inner`
+If container padding is `16px` and inner content radius is `8px`, then container outer radius must be exactly `24px` (`8px + 16px`).
+
+---
+
+## 3. Responsive Layouts & Container Queries
+
+Avoid viewport-level media queries for self-contained components. Use container queries to make components portable:
+
+```css
+.component-wrapper {
+  container-type: inline-size;
+  container-name: component;
+}
+
+@container component (min-width: 450px) {
+  .inner-layout {
+    display: grid;
+    grid-template-columns: repeat(2, 1fr);
+    gap: var(--space-md);
+  }
+}
+```
+
+---
+
+## 4. APCA Contrast Guidelines
+
+Ensure that typography meets the APCA Lc guidelines:
+
+- Lc > 75 for body text elements.
+- Lc > 60 for large titles and headings.
+- Lc > 45 for secondary input labels and border guides.
 
-Enforce an 8px spatial grid calculated mathematically to ensure alignment precision:
+## 🚨 Edge-Case & Failure Mode Matrix
 
-```css
-:root {
-  --base-grid: 8px;
+| Scenario | Risk | Production Mitigation |
+|:---|:---|:---|
+| **Empty or Null Inputs** | Unhandled exception or unexpected rendering collapse | Enforce fallback guards, optional chaining, and explicit empty state handlers |
+| **Network Timeout / Latency** | Hanging operations or duplicate side-effects | Implement bounded abort controllers, exponential backoff, and idempotency keys |
+| **Concurrency / Race Conditions** | Stale state overwrite or inconsistent data mutations | Use atomic transactions, mutex locking, or cancel-on-resubmit controls |
+| **Invalid Schema / Malformed Payload** | Downstream runtime errors or security injection | Validate boundary payloads with Zod/Pydantic schemas prior to execution |
+| **Resource / Memory Saturation** | OOM errors, frame drops, or memory leaks | Clean up listeners, cancel active timers, and enforce pagination/virtualization |
 
-  --space-xs: calc(var(--base-grid) * 0.5); /* 4px  - icon gaps */
-  --space-sm: calc(var(--base-grid) * 1); /* 8px  - tag paddings */
-  --space-md: calc(var(--base-grid) * 2); /* 16px - inputs */
-  --space-lg: calc(var(--base-grid) * 3); /* 24px - card padding */
-  --space-xl: calc(var(--base-grid) * 4); /* 32px - section gaps */
-}
-```
 
-### Nested Radius Formula
+## 🤖 LLM-Specific Traps Table
 
-Ensure component inner borders track correctly:
-`outer_radius = inner_radius + padding_inner`
-If container padding is `16px` and inner content radius is `8px`, then container outer radius must be exactly `24px` (`8px + 16px`).
+| Anti-Pattern | What AI Commonly Does Wrong | What Is Actually Correct |
+|:---|:---|:---|
+| **Uncontrolled Re-render Loop** | Mutating state inside render bodies or omitting hook dependencies | Wrap effects with explicit deps and isolate reactive derivations in useMemo |
+| **Accessibility Neglect** | Interactive <div> without role="button", tabIndex, or onKeyDown | Use semantic <button> or provide ARIA role, keyboard handlers, and focus ring |
+| **Layout Shift Flash** | Images/dynamic content without aspect-ratio or explicit dimensions | Enforce aspect-ratio or skeleton placeholders to guarantee zero CLS |
 
----
 
-## 3. Responsive Layouts & Container Queries
+## 🏛️ Tribunal Verification & Guardrails
 
-Avoid viewport-level media queries for self-contained components. Use container queries to make components portable:
+**Active Reviewers:** `frontend-reviewer` · `type-safety` · `ui-ux-auditor` · `complexity-reviewer`
+**Slash Command:** `/review` or `/tribunal-full`
 
-```css
-.component-wrapper {
-  container-type: inline-size;
-  container-name: component;
-}
+### 🔬 Evidence Standard (Tri-State Verification)
+Every finding, audit statement, or completion claim must classify its factual certainty:
+- **`[OBSERVED]`**: Directly confirmed in the codebase or verified via executed terminal command.
+- **`[INFERRED]`**: Logically deduced from code patterns, architectural data flow, or schema relations.
+- **`[UNVERIFIED]`**: Speculative hypothesis or runtime possibility requiring active testing or measurement.
 
-@container component (min-width: 450px) {
-  .inner-layout {
-    display: grid;
-    grid-template-columns: repeat(2, 1fr);
-    gap: var(--space-md);
-  }
-}
+### ✅ Pre-Flight Self-Audit Checklist
+```
+✅ Are all component props strictly typed with zero implicit "any"?
+✅ Are responsive breakpoints, fluid typography, and optical balance verified?
+✅ Is accessibility (ARIA labels, keyboard navigation, contrast ratio >= 4.5:1) validated?
+✅ Are re-renders minimized and state lifecycles cleanly separated?
+✅ Did I verify all imported UI components and icon sets actually exist?
 ```
 
----
-
-## 4. APCA Contrast Guidelines
-
-Ensure that typography meets the APCA Lc guidelines:
-
-- Lc > 75 for body text elements.
-- Lc > 60 for large titles and headings.
-- Lc > 45 for secondary input labels and border guides.
+### 🛑 Verification-Before-Completion (VBC) Protocol
+**CRITICAL:** You must follow a strict "evidence-based closeout" state machine.
+- ❌ **Forbidden:** Declaring a task complete because the output "looks correct."
+- ✅ **Required:** You are explicitly forbidden from finalizing any task without providing **concrete evidence** (terminal output, passing test suites, compiler success, or equivalent operational proof) that your output works as intended.

package/.agents/skills/frontend-security-expert/SKILL.md

@@ -1,8 +1,8 @@
 ---
 name: frontend-security-expert
-description: "Use when Frontend security auditing for modern meta-frameworks. Focuses on React/Next.js UI paradigms, hydration poisoning, third-party script supply chain, local storage security, and XSS prevention in modern environments."
-version: 5.0.0
-last-updated: 2026-09-13
+description: "Use when auditing, pen-testing, hardening, and verifying code against frontend security expert vulnerabilities, injection vectors, and auth flaws."
+version: 6.0.0
+last-updated: 2026-09-29
 skills:
   - backend-security-expert
   - api-security-auditor
@@ -15,42 +15,103 @@ scripts-binding:
 
 # Frontend Security Expert — Modern Meta-Frameworks
 
----
-
-## 🛠️ Technical Architecture & Reference Recipes
-
----
-
-## Hallucination Traps (Read First)
+## Mandatory Pre-Flight Context Inspection
+Before reading, generating, or refactoring code in the `frontend-security-expert` domain, inspect these 5 critical parameters:
+1. **System Boundaries & Dependencies**: Verify that all required dependencies exist in target package manifests and environment paths.
+2. **Runtime Context & Platform Invariants**: Confirm target platform constraints (Node.js, Browser, Mobile OS, Edge runtime) before applying APIs.
+3. **Execution Guardrails**: Identify potential side-effects, state mutations, and unhandled asynchronous exceptions.
+4. **Validation & Type Contracts**: Validate input data schemas and strict type constraints across all module interfaces.
+5. **Observability & Proof of Execution**: Ensure execution produces tangible verification signals (terminal output, tests, metrics).
 
-- ❌ Focusing on generic OWASP top 10 (SQLi, IDOR) → ✅ This is the _frontend_ skill. Focus strictly on client-side boundaries, SSR hydration, and DOM.
-- ❌ Treating React `useEffect` data fetching as secure → ✅ Data fetched client-side can be intercepted or manipulated.
-- ❌ Recommending LocalStorage for JWTs → ✅ JWTs must go in HttpOnly, Secure, SameSite cookies.
-- ❌ Assuming Next.js SSR is immune to XSS → ✅ Hydration mismatch or dangerouslySetInnerHTML can inject payloads.
 
----
-
-## 1. React & Next.js Specific Vulnerabilities
-
-Modern frameworks handle basic XSS by escaping text, but specific APIs bypass this.
+## Activation Boundaries
+- **Activate when:** Use when auditing, pen-testing, hardening, and verifying code against frontend security expert vulnerabilities, injection vectors, and auth flaws.
+- **DO NOT activate when:** The task falls outside the `frontend-security-expert` domain or is managed by a different dedicated specialist agent.
 
-- **`dangerouslySetInnerHTML`**: Never use this with unsanitized user input. If required, mandate the use of DOMPurify.
-- **Hydration Poisoning**: Ensure that data rendered on the server matches the client to prevent malicious hydration states.
-- **`javascript:` URIs**: React does not automatically prevent `javascript:` URIs in `href` tags. Audit all dynamic links.
 
-## 2. Token & State Storage (Web Storage API)
+## 🔁 Multi-Pass Execution Protocol
 
-- **Local/Session Storage**: Do not store sensitive PII, Auth Tokens (JWTs), or API keys here. They are accessible via any XSS attack.
-- **Cookies**: Use `HttpOnly`, `Secure`, and `SameSite=Strict` (or `Lax`) for all authentication cookies.
-- **In-Memory State**: Store temporary sensitive data in React state/Zustand, recognizing it clears on refresh.
+| Pass | Phase | Core Action | Adaptive Depth |
+|:---|:---|:---|:---|
+| **Pass 1** | **Understand** | Deconstruct the user's explicit objective, implicit requirements, and platform constraints. | Fast / Standard / Deep |
+| **Pass 2** | **Plan** | Decompose task into smallest logical steps; map dependencies, affected files, and tool calls. | Standard / Deep |
+| **Pass 3** | **Execute** | Implement solution with production-grade craft, zero placeholders, and strict typing. | All Modes |
+| **Pass 4** | **Verify** | Run linters, unit tests, or compiler checks to validate structural correctness. | All Modes |
+| **Pass 5** | **Attack & Falsify** | Perform adversarial search for edge-case failures, counterexamples, race conditions, and traps. | Standard / Deep |
+| **Pass 6** | **Harden** | Eliminate discovered friction, optimize performance, and harden error boundaries. | Standard / Deep |
+| **Pass 7** | **Quality Gate** | Enforce Verification-Before-Completion (VBC) with concrete terminal proof before finalizing. | All Modes |
 
-## 3. Third-Party Supply Chain
 
-- **External Scripts**: Any `<script src="...">` has full access to the DOM and global window.
-- **Subresource Integrity (SRI)**: Ensure all CDN-loaded scripts use the `integrity` attribute.
-- **Next.js `<Script>` Component**: Use appropriate strategies (`beforeInteractive`, `afterInteractive`) and audit what is loaded.
-
-## 4. Cross-Origin & PostMessage
+---
+
+## 🛠️ Technical Architecture & Reference Recipes
 
-- **`postMessage`**: Never use `targetOrigin: '*'` when sending messages. Always validate `event.origin` when receiving messages.
+## Hallucination Traps (Read First)
+
+- ❌ Focusing on generic OWASP top 10 (SQLi, IDOR) → ✅ This is the _frontend_ skill. Focus strictly on client-side boundaries, SSR hydration, and DOM.
+- ❌ Treating React `useEffect` data fetching as secure → ✅ Data fetched client-side can be intercepted or manipulated.
+- ❌ Recommending LocalStorage for JWTs → ✅ JWTs must go in HttpOnly, Secure, SameSite cookies.
+- ❌ Assuming Next.js SSR is immune to XSS → ✅ Hydration mismatch or dangerouslySetInnerHTML can inject payloads.
+
+---
+
+## 1. React & Next.js Specific Vulnerabilities
+
+Modern frameworks handle basic XSS by escaping text, but specific APIs bypass this.
+
+- **`dangerouslySetInnerHTML`**: Never use this with unsanitized user input. If required, mandate the use of DOMPurify.
+- **Hydration Poisoning**: Ensure that data rendered on the server matches the client to prevent malicious hydration states.
+- **`javascript:` URIs**: React does not automatically prevent `javascript:` URIs in `href` tags. Audit all dynamic links.
+
+## 2. Token & State Storage (Web Storage API)
+
+- **Local/Session Storage**: Do not store sensitive PII, Auth Tokens (JWTs), or API keys here. They are accessible via any XSS attack.
+- **Cookies**: Use `HttpOnly`, `Secure`, and `SameSite=Strict` (or `Lax`) for all authentication cookies.
+- **In-Memory State**: Store temporary sensitive data in React state/Zustand, recognizing it clears on refresh.
+
+## 3. Third-Party Supply Chain
+
+- **External Scripts**: Any `<script src="...">` has full access to the DOM and global window.
+- **Subresource Integrity (SRI)**: Ensure all CDN-loaded scripts use the `integrity` attribute.
+- **Next.js `<Script>` Component**: Use appropriate strategies (`beforeInteractive`, `afterInteractive`) and audit what is loaded.
+
+## 4. Cross-Origin & PostMessage
+
+- **`postMessage`**: Never use `targetOrigin: '*'` when sending messages. Always validate `event.origin` when receiving messages.
 - **Iframes**: Use the `sandbox` attribute for any user-generated iframes to restrict script execution and top-level navigation.
+
+## 🚨 Edge-Case & Failure Mode Matrix
+
+| Scenario | Risk | Production Mitigation |
+|:---|:---|:---|
+| **Empty or Null Inputs** | Unhandled exception or unexpected rendering collapse | Enforce fallback guards, optional chaining, and explicit empty state handlers |
+| **Network Timeout / Latency** | Hanging operations or duplicate side-effects | Implement bounded abort controllers, exponential backoff, and idempotency keys |
+| **Concurrency / Race Conditions** | Stale state overwrite or inconsistent data mutations | Use atomic transactions, mutex locking, or cancel-on-resubmit controls |
+| **Invalid Schema / Malformed Payload** | Downstream runtime errors or security injection | Validate boundary payloads with Zod/Pydantic schemas prior to execution |
+| **Resource / Memory Saturation** | OOM errors, frame drops, or memory leaks | Clean up listeners, cancel active timers, and enforce pagination/virtualization |
+
+
+## 🏛️ Tribunal Verification & Guardrails
+
+**Active Reviewers:** `security-auditor` · `penetration-tester` · `backend-security-expert`
+**Slash Command:** `/review` or `/tribunal-full`
+
+### 🔬 Evidence Standard (Tri-State Verification)
+Every finding, audit statement, or completion claim must classify its factual certainty:
+- **`[OBSERVED]`**: Directly confirmed in the codebase or verified via executed terminal command.
+- **`[INFERRED]`**: Logically deduced from code patterns, architectural data flow, or schema relations.
+- **`[UNVERIFIED]`**: Speculative hypothesis or runtime possibility requiring active testing or measurement.
+
+### ✅ Pre-Flight Self-Audit Checklist
+```
+✅ Are user inputs sanitized and treated as untrusted data at system boundaries?
+✅ Are secrets loaded strictly via environment variables with zero hardcoding?
+✅ Is least-privilege enforcement active on APIs, tokens, and storage buckets?
+✅ Are prompt-injection delimiters and sanitizers wrapped around LLM inputs?
+✅ Did I verify encryption in transit and at rest for sensitive data?
+```
+
+### 🛑 Verification-Before-Completion (VBC) Protocol
+**CRITICAL:** You must follow a strict "evidence-based closeout" state machine.
+- ❌ **Forbidden:** Declaring a task complete because the output "looks correct."
+- ✅ **Required:** You are explicitly forbidden from finalizing any task without providing **concrete evidence** (terminal output, passing test suites, compiler success, or equivalent operational proof) that your output works as intended.

package/.agents/skills/game-design-expert/SKILL.md

@@ -1,8 +1,8 @@
 ---
 name: game-design-expert
-description: "Use when Game Design, UX, and Flow State mastery. Replaces fragmented legacy skills. Core gameplay loop design, 3Cs (Character, Camera, Controls), input buffering, coyote time, juice (game feel), telemetry tracking, narrative alignment, and audio spatialization integration. Use when crafting player experience, progression arcs, or systemic balance."
-version: 5.0.0
-last-updated: 2026-09-13
+description: "Use when executing, coordinating, planning, or reviewing game design expert agent workflows, cognitive loops, and architecture standards."
+version: 6.0.0
+last-updated: 2026-09-29
 skills:
   - game-engineering-expert
   - 12-principles-of-animation
@@ -15,78 +15,136 @@ scripts-binding:
 
 # Game Design Expert — Player Experience & Flow Mastery
 
----
-
-## 🛠️ Technical Architecture & Reference Recipes
-
----
-
-## Hallucination Traps (Read First)
-
-- ❌ Designing reward systems without testing for compulsion loops -> ✅ Playtesting must verify engagement without addiction patterns
-- ❌ Assuming all players have the same skill level -> ✅ Design difficulty curves that adapt or offer accessibility options
-- ❌ Adding mechanics without testing the core loop first -> ✅ Core loop must be fun in isolation before adding complexity
-
----
-
----
-
-## 1. The 3Cs (Character, Camera, Controls)
-
-Before designing enemies, levels, or UI, the foundation of the player's interaction MUST feel flawless. If the player cannot intrinsically trust the controls, the entire system collapses.
-
-### Input Buffering
-
-Humans cannot click buttons flawlessly on the exact required frame.
-If a player presses "Jump" 3 frames _before_ they hit the ground, a naïve engine ignores it. A designed engine _buffers_ the input in memory for 150ms and instantly executes the jump the millisecond the character's feet touch the dirt.
-
-### Coyote Time
+## Mandatory Pre-Flight Context Inspection
+Before reading, generating, or refactoring code in the `game-design-expert` domain, inspect these 5 critical parameters:
+1. **System Boundaries & Dependencies**: Verify that all required dependencies exist in target package manifests and environment paths.
+2. **Runtime Context & Platform Invariants**: Confirm target platform constraints (Node.js, Browser, Mobile OS, Edge runtime) before applying APIs.
+3. **Execution Guardrails**: Identify potential side-effects, state mutations, and unhandled asynchronous exceptions.
+4. **Validation & Type Contracts**: Validate input data schemas and strict type constraints across all module interfaces.
+5. **Observability & Proof of Execution**: Ensure execution produces tangible verification signals (terminal output, tests, metrics).
 
-Named after Wile E. Coyote hovering off a cliff.
-If a player runs off a ledge, a rigid physics engine drops them instantly.
-A forgiving design allows the player to still press 'Jump' for exactly ~100ms _after_ walking off the ledge. It prevents extreme frustration on close platforming jumps.
 
----
-
-## 2. The Core Gameplay Loop
-
-Every action a player takes must feed into a reinforcing psychological loop.
-
-**The Macro Loop (e.g., Destiny, Monster Hunter)**
-
-1. **Action:** Fight complex monsters.
-2. **Reward:** Collect physical parts and resources.
-3. **Pacing:** Return to base.
-4. **Upgrade:** Convert parts into stronger weapons.
-5. **Goal:** Fight stronger, unkillable monsters (Back to Step 1).
-
-_If step 4 (Upgrading) does not heavily alter step 1 (Fights are now faster, visually different, mechanically superior), the loop is broken and players churn._
-
----
+## Activation Boundaries
+- **Activate when:** Use when executing, coordinating, planning, or reviewing game design expert agent workflows, cognitive loops, and architecture standards.
+- **DO NOT activate when:** The task falls outside the `game-design-expert` domain or is managed by a different dedicated specialist agent.
 
-## 3. "Juice" and Game Feel
 
-"Juice" is the non-functional audiovisual feedback that makes an interaction feel heavy and satisfying.
+## 🔁 Multi-Pass Execution Protocol
 
-1. **Screen Shake:** A minor, mathematically decaying camera displacement when heavy impacts occur. (Needs toggles for accessibility).
-2. **Hitstop (Sleep Frames):** When a sword hits an enemy, freeze the entire game engine for exactly 3 frames (50ms). This creates an immense perceptual illusion of resistance and friction.
-3. **Squash and Stretch:** A character jumping should stretch vertically. A character landing should squash horizontally. It breaks rigidity and infuses life.
-4. **Particle Explosions:** Simple box collisions must be masked by explosive localized particle systems (dust kicks, sparks).
+| Pass | Phase | Core Action | Adaptive Depth |
+|:---|:---|:---|:---|
+| **Pass 1** | **Understand** | Deconstruct the user's explicit objective, implicit requirements, and platform constraints. | Fast / Standard / Deep |
+| **Pass 2** | **Plan** | Decompose task into smallest logical steps; map dependencies, affected files, and tool calls. | Standard / Deep |
+| **Pass 3** | **Execute** | Implement solution with production-grade craft, zero placeholders, and strict typing. | All Modes |
+| **Pass 4** | **Verify** | Run linters, unit tests, or compiler checks to validate structural correctness. | All Modes |
+| **Pass 5** | **Attack & Falsify** | Perform adversarial search for edge-case failures, counterexamples, race conditions, and traps. | Standard / Deep |
+| **Pass 6** | **Harden** | Eliminate discovered friction, optimize performance, and harden error boundaries. | Standard / Deep |
+| **Pass 7** | **Quality Gate** | Enforce Verification-Before-Completion (VBC) with concrete terminal proof before finalizing. | All Modes |
 
----
-
-## 4. Narrative & Audio Synergies
 
-Game design is not segregated from Audio. Audio is the primary vector for temporal feedback.
-
-1. **Spatialization (HRTF):** Sound objects emit audio localized strictly to 3D space, heavily attenuated by environmental occlusions (muffled behind walls).
-2. **Telegraphing State:** If an enemy swings a heavy axe, it MUST have a 300ms audio "wind-up" queue. The player relies on audio rhythm far faster than visual recognition to dodge.
-3. **Dynamic Mixing (Ducking):** Essential dialogue or UI pings must automatically compress (lower the volume of) ambient music underneath to prevent cognitive overload.
+---
+
+## 🛠️ Technical Architecture & Reference Recipes
 
+## Hallucination Traps (Read First)
+
+- ❌ Designing reward systems without testing for compulsion loops -> ✅ Playtesting must verify engagement without addiction patterns
+- ❌ Assuming all players have the same skill level -> ✅ Design difficulty curves that adapt or offer accessibility options
+- ❌ Adding mechanics without testing the core loop first -> ✅ Core loop must be fun in isolation before adding complexity
+
 ---
-
-## 5. Telemetry & Analytics Deficiencies
-
-Design is hypotheses. Playtests are the reality.
-
+## 1. The 3Cs (Character, Camera, Controls)
+
+Before designing enemies, levels, or UI, the foundation of the player's interaction MUST feel flawless. If the player cannot intrinsically trust the controls, the entire system collapses.
+
+### Input Buffering
+
+Humans cannot click buttons flawlessly on the exact required frame.
+If a player presses "Jump" 3 frames _before_ they hit the ground, a naïve engine ignores it. A designed engine _buffers_ the input in memory for 150ms and instantly executes the jump the millisecond the character's feet touch the dirt.
+
+### Coyote Time
+
+Named after Wile E. Coyote hovering off a cliff.
+If a player runs off a ledge, a rigid physics engine drops them instantly.
+A forgiving design allows the player to still press 'Jump' for exactly ~100ms _after_ walking off the ledge. It prevents extreme frustration on close platforming jumps.
+
+---
+
+## 2. The Core Gameplay Loop
+
+Every action a player takes must feed into a reinforcing psychological loop.
+
+**The Macro Loop (e.g., Destiny, Monster Hunter)**
+
+1. **Action:** Fight complex monsters.
+2. **Reward:** Collect physical parts and resources.
+3. **Pacing:** Return to base.
+4. **Upgrade:** Convert parts into stronger weapons.
+5. **Goal:** Fight stronger, unkillable monsters (Back to Step 1).
+
+_If step 4 (Upgrading) does not heavily alter step 1 (Fights are now faster, visually different, mechanically superior), the loop is broken and players churn._
+
+---
+
+## 3. "Juice" and Game Feel
+
+"Juice" is the non-functional audiovisual feedback that makes an interaction feel heavy and satisfying.
+
+1. **Screen Shake:** A minor, mathematically decaying camera displacement when heavy impacts occur. (Needs toggles for accessibility).
+2. **Hitstop (Sleep Frames):** When a sword hits an enemy, freeze the entire game engine for exactly 3 frames (50ms). This creates an immense perceptual illusion of resistance and friction.
+3. **Squash and Stretch:** A character jumping should stretch vertically. A character landing should squash horizontally. It breaks rigidity and infuses life.
+4. **Particle Explosions:** Simple box collisions must be masked by explosive localized particle systems (dust kicks, sparks).
+
+---
+
+## 4. Narrative & Audio Synergies
+
+Game design is not segregated from Audio. Audio is the primary vector for temporal feedback.
+
+1. **Spatialization (HRTF):** Sound objects emit audio localized strictly to 3D space, heavily attenuated by environmental occlusions (muffled behind walls).
+2. **Telegraphing State:** If an enemy swings a heavy axe, it MUST have a 300ms audio "wind-up" queue. The player relies on audio rhythm far faster than visual recognition to dodge.
+3. **Dynamic Mixing (Ducking):** Essential dialogue or UI pings must automatically compress (lower the volume of) ambient music underneath to prevent cognitive overload.
+
+---
+
+## 5. Telemetry & Analytics Deficiencies
+
+Design is hypotheses. Playtests are the reality.
+
 Never rely on developers "feeling" the game. You must systematically log death coordinates (heatmaps). If 80% of players die at Level 2 Trap B, your design intent (teaching the mechanic) has failed.
+
+## 🚨 Edge-Case & Failure Mode Matrix
+
+| Scenario | Risk | Production Mitigation |
+|:---|:---|:---|
+| **Empty or Null Inputs** | Unhandled exception or unexpected rendering collapse | Enforce fallback guards, optional chaining, and explicit empty state handlers |
+| **Network Timeout / Latency** | Hanging operations or duplicate side-effects | Implement bounded abort controllers, exponential backoff, and idempotency keys |
+| **Concurrency / Race Conditions** | Stale state overwrite or inconsistent data mutations | Use atomic transactions, mutex locking, or cancel-on-resubmit controls |
+| **Invalid Schema / Malformed Payload** | Downstream runtime errors or security injection | Validate boundary payloads with Zod/Pydantic schemas prior to execution |
+| **Resource / Memory Saturation** | OOM errors, frame drops, or memory leaks | Clean up listeners, cancel active timers, and enforce pagination/virtualization |
+
+
+## 🏛️ Tribunal Verification & Guardrails
+
+**Active Reviewers:** `orchestrator` · `agent-organizer` · `logic-reviewer`
+**Slash Command:** `/review` or `/tribunal-full`
+
+### 🔬 Evidence Standard (Tri-State Verification)
+Every finding, audit statement, or completion claim must classify its factual certainty:
+- **`[OBSERVED]`**: Directly confirmed in the codebase or verified via executed terminal command.
+- **`[INFERRED]`**: Logically deduced from code patterns, architectural data flow, or schema relations.
+- **`[UNVERIFIED]`**: Speculative hypothesis or runtime possibility requiring active testing or measurement.
+
+### ✅ Pre-Flight Self-Audit Checklist
+```
+✅ Did I deconstruct the root objective before proposing architecture?
+✅ Did I identify dependencies, bottlenecks, and parallelizable sub-tasks?
+✅ Did I avoid over-engineering and select the simplest effective pattern?
+✅ Did I verify assumptions with concrete file reads instead of speculation?
+✅ Did I establish measurable verification criteria before completion?
+```
+
+### 🛑 Verification-Before-Completion (VBC) Protocol
+**CRITICAL:** You must follow a strict "evidence-based closeout" state machine.
+- ❌ **Forbidden:** Declaring a task complete because the output "looks correct."
+- ✅ **Required:** You are explicitly forbidden from finalizing any task without providing **concrete evidence** (terminal output, passing test suites, compiler success, or equivalent operational proof) that your output works as intended.