tribunal-kit 9.2.4 → 9.2.6

package/skills/fixing-metadata/SKILL.md

@@ -1,8 +1,8 @@
 ---
 name: fixing-metadata
-description: "Use when Audit and fix page metadata including page titles, meta descriptions, Open Graph, Twitter cards, canonical URLs, and JSON-LD structured data."
-version: 5.0.0
-last-updated: 2026-09-13
+description: "Use when auditing, pen-testing, hardening, and verifying code against fixing metadata vulnerabilities, injection vectors, and auth flaws."
+version: 6.0.0
+last-updated: 2026-09-29
 skills:
   - nextjs-react-expert
   - baseline-ui
@@ -15,69 +15,139 @@ scripts-binding:
 
 # Fixing Metadata — Technical SEO & Open Graph Tags
 
----
+## Mandatory Pre-Flight Context Inspection
+Before reading, generating, or refactoring code in the `fixing-metadata` domain, inspect these 5 critical parameters:
+1. **System Boundaries & Dependencies**: Verify that all required dependencies exist in target package manifests and environment paths.
+2. **Runtime Context & Platform Invariants**: Confirm target platform constraints (Node.js, Browser, Mobile OS, Edge runtime) before applying APIs.
+3. **Execution Guardrails**: Identify potential side-effects, state mutations, and unhandled asynchronous exceptions.
+4. **Validation & Type Contracts**: Validate input data schemas and strict type constraints across all module interfaces.
+5. **Observability & Proof of Execution**: Ensure execution produces tangible verification signals (terminal output, tests, metrics).
 
-## 🛠️ Technical Architecture & Reference Recipes
 
----
+## Activation Boundaries
+- **Activate when:** Use when auditing, pen-testing, hardening, and verifying code against fixing metadata vulnerabilities, injection vectors, and auth flaws.
+- **DO NOT activate when:** The task falls outside the `fixing-metadata` domain or is managed by a different dedicated specialist agent.
 
----
 
-## 4 Metadata Standard Requirements
-
-### 1. Title & Meta Description Length & Formatting
-
-- **Title Tag**: 50–60 characters max (_"Product Title | Brand Name"_).
-- **Meta Description**: 140–155 characters max. Must contain active call to value without truncating on search result cards.
-
-### 2. Open Graph & Twitter Card Matrix
-
-```html
-<!-- Open Graph / Facebook / LinkedIn -->
-<meta property="og:type" content="website" />
-<meta property="og:title" content="UI Skills for Design Engineers" />
-<meta
-  property="og:description"
-  content="A curated collection of design-engineering skills for accessibility, motion, and frontend craft."
-/>
-<meta property="og:image" content="https://example.com/og-image.jpg" />
-<meta property="og:image:width" content="1200" />
-<meta property="og:image:height" content="630" />
-
-<!-- Twitter / X -->
-<meta name="twitter:card" content="summary_large_image" />
-<meta name="twitter:title" content="UI Skills for Design Engineers" />
-<meta
-  name="twitter:description"
-  content="A curated collection of design-engineering skills for accessibility, motion, and frontend craft."
-/>
-<meta name="twitter:image" content="https://example.com/twitter-image.jpg" />
-```
+## 🔁 Multi-Pass Execution Protocol
 
-### 3. Canonical Tag Verification
+| Pass | Phase | Core Action | Adaptive Depth |
+|:---|:---|:---|:---|
+| **Pass 1** | **Understand** | Deconstruct the user's explicit objective, implicit requirements, and platform constraints. | Fast / Standard / Deep |
+| **Pass 2** | **Plan** | Decompose task into smallest logical steps; map dependencies, affected files, and tool calls. | Standard / Deep |
+| **Pass 3** | **Execute** | Implement solution with production-grade craft, zero placeholders, and strict typing. | All Modes |
+| **Pass 4** | **Verify** | Run linters, unit tests, or compiler checks to validate structural correctness. | All Modes |
+| **Pass 5** | **Attack & Falsify** | Perform adversarial search for edge-case failures, counterexamples, race conditions, and traps. | Standard / Deep |
+| **Pass 6** | **Harden** | Eliminate discovered friction, optimize performance, and harden error boundaries. | Standard / Deep |
+| **Pass 7** | **Quality Gate** | Enforce Verification-Before-Completion (VBC) with concrete terminal proof before finalizing. | All Modes |
 
-```html
-<link rel="canonical" href="https://example.com/current-page-path" />
+
+---
+
+## 🛠️ Technical Architecture & Reference Recipes
+
+---
+
+## 4 Metadata Standard Requirements
+
+### 1. Title & Meta Description Length & Formatting
+
+- **Title Tag**: 50–60 characters max (_"Product Title | Brand Name"_).
+- **Meta Description**: 140–155 characters max. Must contain active call to value without truncating on search result cards.
+
+### 2. Open Graph & Twitter Card Matrix
+
+```html
+<!-- Open Graph / Facebook / LinkedIn -->
+<meta property="og:type" content="website" />
+<meta property="og:title" content="UI Skills for Design Engineers" />
+<meta
+  property="og:description"
+  content="A curated collection of design-engineering skills for accessibility, motion, and frontend craft."
+/>
+<meta property="og:image" content="https://example.com/og-image.jpg" />
+<meta property="og:image:width" content="1200" />
+<meta property="og:image:height" content="630" />
+
+<!-- Twitter / X -->
+<meta name="twitter:card" content="summary_large_image" />
+<meta name="twitter:title" content="UI Skills for Design Engineers" />
+<meta
+  name="twitter:description"
+  content="A curated collection of design-engineering skills for accessibility, motion, and frontend craft."
+/>
+<meta name="twitter:image" content="https://example.com/twitter-image.jpg" />
+```
+
+### 3. Canonical Tag Verification
+
+```html
+<link rel="canonical" href="https://example.com/current-page-path" />
+```
+
+### 4. Next.js App Router Metadata Export Example
+
+```typescript
+import type { Metadata } from 'next';
+
+export const metadata: Metadata = {
+  title: 'UI Skills for Design Engineers',
+  description: 'Curated design-engineering skills for accessibility, motion, and frontend craft.',
+  openGraph: {
+    title: 'UI Skills for Design Engineers',
+    description: 'Curated design-engineering skills for accessibility, motion, and frontend craft.',
+    url: 'https://example.com',
+    images: [{ url: 'https://example.com/og.jpg', width: 1200, height: 630 }],
+  },
+  twitter: {
+    card: 'summary_large_image',
+    title: 'UI Skills for Design Engineers',
+    images: ['https://example.com/twitter.jpg'],
+  },
+};
 ```
 
-### 4. Next.js App Router Metadata Export Example
-
-```typescript
-import type { Metadata } from 'next';
-
-export const metadata: Metadata = {
-  title: 'UI Skills for Design Engineers',
-  description: 'Curated design-engineering skills for accessibility, motion, and frontend craft.',
-  openGraph: {
-    title: 'UI Skills for Design Engineers',
-    description: 'Curated design-engineering skills for accessibility, motion, and frontend craft.',
-    url: 'https://example.com',
-    images: [{ url: 'https://example.com/og.jpg', width: 1200, height: 630 }],
-  },
-  twitter: {
-    card: 'summary_large_image',
-    title: 'UI Skills for Design Engineers',
-    images: ['https://example.com/twitter.jpg'],
-  },
-};
+## 🚨 Edge-Case & Failure Mode Matrix
+
+| Scenario | Risk | Production Mitigation |
+|:---|:---|:---|
+| **Empty or Null Inputs** | Unhandled exception or unexpected rendering collapse | Enforce fallback guards, optional chaining, and explicit empty state handlers |
+| **Network Timeout / Latency** | Hanging operations or duplicate side-effects | Implement bounded abort controllers, exponential backoff, and idempotency keys |
+| **Concurrency / Race Conditions** | Stale state overwrite or inconsistent data mutations | Use atomic transactions, mutex locking, or cancel-on-resubmit controls |
+| **Invalid Schema / Malformed Payload** | Downstream runtime errors or security injection | Validate boundary payloads with Zod/Pydantic schemas prior to execution |
+| **Resource / Memory Saturation** | OOM errors, frame drops, or memory leaks | Clean up listeners, cancel active timers, and enforce pagination/virtualization |
+
+
+## 🤖 LLM-Specific Traps Table
+
+| Anti-Pattern | What AI Commonly Does Wrong | What Is Actually Correct |
+|:---|:---|:---|
+| **Hardcoded Secret Pattern** | Committing API keys, tokens, or private salts into source code | Load credentials strictly via runtime environment variables and secret stores |
+| **Prompt Injection Surface** | Directly concatenating untrusted user input into LLM system prompts | Wrap user content in isolated delimiters and strip injection control sequences |
+| **Missing Authorization Check** | Relying only on authentication token presence without checking tenant/object RBAC | Verify user permissions against the specific target record ID before mutation |
+
+
+## 🏛️ Tribunal Verification & Guardrails
+
+**Active Reviewers:** `security-auditor` · `penetration-tester` · `backend-security-expert`
+**Slash Command:** `/review` or `/tribunal-full`
+
+### 🔬 Evidence Standard (Tri-State Verification)
+Every finding, audit statement, or completion claim must classify its factual certainty:
+- **`[OBSERVED]`**: Directly confirmed in the codebase or verified via executed terminal command.
+- **`[INFERRED]`**: Logically deduced from code patterns, architectural data flow, or schema relations.
+- **`[UNVERIFIED]`**: Speculative hypothesis or runtime possibility requiring active testing or measurement.
+
+### ✅ Pre-Flight Self-Audit Checklist
 ```
+✅ Are user inputs sanitized and treated as untrusted data at system boundaries?
+✅ Are secrets loaded strictly via environment variables with zero hardcoding?
+✅ Is least-privilege enforcement active on APIs, tokens, and storage buckets?
+✅ Are prompt-injection delimiters and sanitizers wrapped around LLM inputs?
+✅ Did I verify encryption in transit and at rest for sensitive data?
+```
+
+### 🛑 Verification-Before-Completion (VBC) Protocol
+**CRITICAL:** You must follow a strict "evidence-based closeout" state machine.
+- ❌ **Forbidden:** Declaring a task complete because the output "looks correct."
+- ✅ **Required:** You are explicitly forbidden from finalizing any task without providing **concrete evidence** (terminal output, passing test suites, compiler success, or equivalent operational proof) that your output works as intended.

package/skills/fixing-motion-performance/SKILL.md

@@ -1,8 +1,8 @@
 ---
 name: fixing-motion-performance
-description: "Use when Audit and fix animation performance issues including layout thrashing, compositor properties, scroll-linked motion, and blur effects. Use when animations stutter, transitions jank, or reviewing CSS/JS animation performance."
-version: 5.0.0
-last-updated: 2026-09-13
+description: "Use when implementing, optimizing, and timing 60fps/120fps fixing motion performance animations, transitions, gesture physics, and reduced-motion fallbacks."
+version: 6.0.0
+last-updated: 2026-09-29
 skills:
   - 60fps-animation
   - motion-engineering
@@ -15,64 +15,134 @@ scripts-binding:
 
 # Fixing Motion Performance — 60/120fps Jank-Free Animation
 
----
+## Mandatory Pre-Flight Context Inspection
+Before reading, generating, or refactoring code in the `fixing-motion-performance` domain, inspect these 5 critical parameters:
+1. **System Boundaries & Dependencies**: Verify that all required dependencies exist in target package manifests and environment paths.
+2. **Runtime Context & Platform Invariants**: Confirm target platform constraints (Node.js, Browser, Mobile OS, Edge runtime) before applying APIs.
+3. **Execution Guardrails**: Identify potential side-effects, state mutations, and unhandled asynchronous exceptions.
+4. **Validation & Type Contracts**: Validate input data schemas and strict type constraints across all module interfaces.
+5. **Observability & Proof of Execution**: Ensure execution produces tangible verification signals (terminal output, tests, metrics).
 
-## 🛠️ Technical Architecture & Reference Recipes
 
----
+## Activation Boundaries
+- **Activate when:** Use when implementing, optimizing, and timing 60fps/120fps fixing motion performance animations, transitions, gesture physics, and reduced-motion fallbacks.
+- **DO NOT activate when:** The task falls outside the `fixing-motion-performance` domain or is managed by a different dedicated specialist agent.
 
----
 
-## 1. Browser Rendering Pipeline & Compositor Rules
+## 🔁 Multi-Pass Execution Protocol
 
-Animations trigger one of 3 rendering costs:
+| Pass | Phase | Core Action | Adaptive Depth |
+|:---|:---|:---|:---|
+| **Pass 1** | **Understand** | Deconstruct the user's explicit objective, implicit requirements, and platform constraints. | Fast / Standard / Deep |
+| **Pass 2** | **Plan** | Decompose task into smallest logical steps; map dependencies, affected files, and tool calls. | Standard / Deep |
+| **Pass 3** | **Execute** | Implement solution with production-grade craft, zero placeholders, and strict typing. | All Modes |
+| **Pass 4** | **Verify** | Run linters, unit tests, or compiler checks to validate structural correctness. | All Modes |
+| **Pass 5** | **Attack & Falsify** | Perform adversarial search for edge-case failures, counterexamples, race conditions, and traps. | Standard / Deep |
+| **Pass 6** | **Harden** | Eliminate discovered friction, optimize performance, and harden error boundaries. | Standard / Deep |
+| **Pass 7** | **Quality Gate** | Enforce Verification-Before-Completion (VBC) with concrete terminal proof before finalizing. | All Modes |
 
-1. **Layout (Expensive)**: Animating `width`, `height`, `margin`, `padding`, `top`, `left`, `flex`, `grid`. Forces full geometry recalculation across the page.
-2. **Paint (Moderate)**: Animating `color`, `background-color`, `border-color`, `box-shadow`, `filter`. Forces pixel repaint.
-3. **Composite (GPU Fast)**: Animating **`transform`** (`translate`, `scale`, `rotate`) and **`opacity`**. Offloaded entirely to GPU compositor thread!
 
-$$\text{Rule: } \text{Animate ONLY } \mathbf{transform} \text{ and } \mathbf{opacity}$$
+---
+
+## 🛠️ Technical Architecture & Reference Recipes
 
----
+---
+
+## 1. Browser Rendering Pipeline & Compositor Rules
+
+Animations trigger one of 3 rendering costs:
+
+1. **Layout (Expensive)**: Animating `width`, `height`, `margin`, `padding`, `top`, `left`, `flex`, `grid`. Forces full geometry recalculation across the page.
+2. **Paint (Moderate)**: Animating `color`, `background-color`, `border-color`, `box-shadow`, `filter`. Forces pixel repaint.
+3. **Composite (GPU Fast)**: Animating **`transform`** (`translate`, `scale`, `rotate`) and **`opacity`**. Offloaded entirely to GPU compositor thread!
+
+$$\text{Rule: } \text{Animate ONLY } \mathbf{transform} \text{ and } \mathbf{opacity}$$
+
+---
+
+## 2. Layout Thrashing (Read/Write Interleaving)
+
+NEVER interleave DOM layout measurements (`offsetHeight`, `getBoundingClientRect()`) with DOM mutations (`style.height = ...`) in the same event loop or frame loop!
+
+```javascript
+// ❌ WRONG — Triggers Layout Thrashing (Multiple Recalculations)
+elements.forEach(el => {
+  const h = el.offsetHeight; // READ (Forces Layout Calculation)
+  el.style.height = `${h + 10}px`; // WRITE (Invalidates Layout)
+});
+
+// ✅ CORRECT — Batch Reads First, Then Batch Writes
+const heights = elements.map(el => el.offsetHeight); // BATCH READS
+elements.forEach((el, i) => {
+  el.style.height = `${heights[i] + 10}px`; // BATCH WRITES
+});
+```
+
+---
+
+## 3. GPU Hinting (`will-change`)
+
+- Use `will-change: transform, opacity` ONLY on actively animated elements right before interaction begins.
+- Remove `will-change` when animation ends to free GPU memory. NEVER place `will-change: transform` globally on hundreds of DOM nodes.
+
+```css
+/* Apply hardware acceleration hint to GPU */
+.animated-card {
+  will-change: transform, opacity;
+}
+```
+
+---
+
+## Anti-Slop Table
+
+| Performance Issue                   | Motion Performance Fix                                                       | FPS Gain                                          |
+| ----------------------------------- | ---------------------------------------------------------------------------- | ------------------------------------------------- |
+| Animating `height: 0` to `auto`     | FLIP technique or `scaleY` transform animation                               | 15fps → 60fps                                     |
+| Scroll listener mutating inline CSS | `CSS scroll-timeline` or `IntersectionObserver`                              | Prevents main-thread scroll jank                  |
+| `transition: all 0.3s`              | `transition: transform 200ms cubic-bezier(0.16,1,0.3,1), opacity 200ms ease` | Eliminates accidental layout/color recalculations |
 
-## 2. Layout Thrashing (Read/Write Interleaving)
+## 🚨 Edge-Case & Failure Mode Matrix
 
-NEVER interleave DOM layout measurements (`offsetHeight`, `getBoundingClientRect()`) with DOM mutations (`style.height = ...`) in the same event loop or frame loop!
+| Scenario | Risk | Production Mitigation |
+|:---|:---|:---|
+| **Empty or Null Inputs** | Unhandled exception or unexpected rendering collapse | Enforce fallback guards, optional chaining, and explicit empty state handlers |
+| **Network Timeout / Latency** | Hanging operations or duplicate side-effects | Implement bounded abort controllers, exponential backoff, and idempotency keys |
+| **Concurrency / Race Conditions** | Stale state overwrite or inconsistent data mutations | Use atomic transactions, mutex locking, or cancel-on-resubmit controls |
+| **Invalid Schema / Malformed Payload** | Downstream runtime errors or security injection | Validate boundary payloads with Zod/Pydantic schemas prior to execution |
+| **Resource / Memory Saturation** | OOM errors, frame drops, or memory leaks | Clean up listeners, cancel active timers, and enforce pagination/virtualization |
 
-```javascript
-// ❌ WRONG — Triggers Layout Thrashing (Multiple Recalculations)
-elements.forEach(el => {
-  const h = el.offsetHeight; // READ (Forces Layout Calculation)
-  el.style.height = `${h + 10}px`; // WRITE (Invalidates Layout)
-});
 
-// ✅ CORRECT — Batch Reads First, Then Batch Writes
-const heights = elements.map(el => el.offsetHeight); // BATCH READS
-elements.forEach((el, i) => {
-  el.style.height = `${heights[i] + 10}px`; // BATCH WRITES
-});
-```
+## 🤖 LLM-Specific Traps Table
 
----
+| Anti-Pattern | What AI Commonly Does Wrong | What Is Actually Correct |
+|:---|:---|:---|
+| **The Instant Pop Trap** | Conditionally unmounting elements without animated interpolation | Use AnimatePresence or coordinate morphs with continuous geometry |
+| **Layout Thrashing** | Animating width, height, top, or left inside animation loops | Animate composite-only transform (translate3d, scale) and opacity |
+| **Sluggish Duration** | Setting micro-interaction transitions to 600ms+ causing interface lag | Cap interactive feedback at 160ms–240ms with snappy ease-out curves |
 
-## 3. GPU Hinting (`will-change`)
 
-- Use `will-change: transform, opacity` ONLY on actively animated elements right before interaction begins.
-- Remove `will-change` when animation ends to free GPU memory. NEVER place `will-change: transform` globally on hundreds of DOM nodes.
+## 🏛️ Tribunal Verification & Guardrails
 
-```css
-/* Apply hardware acceleration hint to GPU */
-.animated-card {
-  will-change: transform, opacity;
-}
-```
+**Active Reviewers:** `frontend-reviewer` · `motion-reviewer` · `ui-ux-auditor`
+**Slash Command:** `/review` or `/tribunal-full`
 
----
+### 🔬 Evidence Standard (Tri-State Verification)
+Every finding, audit statement, or completion claim must classify its factual certainty:
+- **`[OBSERVED]`**: Directly confirmed in the codebase or verified via executed terminal command.
+- **`[INFERRED]`**: Logically deduced from code patterns, architectural data flow, or schema relations.
+- **`[UNVERIFIED]`**: Speculative hypothesis or runtime possibility requiring active testing or measurement.
 
-## Anti-Slop Table
+### ✅ Pre-Flight Self-Audit Checklist
+```
+✅ Does animation maintain 60fps/120fps using transform (translate3d, scale) and opacity?
+✅ Is optical mass conserved across state interpolations without volume collapse?
+✅ Is duration capped within micro-interaction budgets (150ms–280ms)?
+✅ Is prefers-reduced-motion respected with graceful instant fallbacks?
+✅ Did I prevent layout thrashing and continuous geometry mutations?
+```
 
-| Performance Issue                   | Motion Performance Fix                                                       | FPS Gain                                          |
-| ----------------------------------- | ---------------------------------------------------------------------------- | ------------------------------------------------- |
-| Animating `height: 0` to `auto`     | FLIP technique or `scaleY` transform animation                               | 15fps → 60fps                                     |
-| Scroll listener mutating inline CSS | `CSS scroll-timeline` or `IntersectionObserver`                              | Prevents main-thread scroll jank                  |
-| `transition: all 0.3s`              | `transition: transform 200ms cubic-bezier(0.16,1,0.3,1), opacity 200ms ease` | Eliminates accidental layout/color recalculations |
+### 🛑 Verification-Before-Completion (VBC) Protocol
+**CRITICAL:** You must follow a strict "evidence-based closeout" state machine.
+- ❌ **Forbidden:** Declaring a task complete because the output "looks correct."
+- ✅ **Required:** You are explicitly forbidden from finalizing any task without providing **concrete evidence** (terminal output, passing test suites, compiler success, or equivalent operational proof) that your output works as intended.