tribunal-kit 9.2.5 → 9.2.6

package/.agents/skills/whimsy-injector/SKILL.md

@@ -1,27 +1,52 @@
----
-name: whimsy-injector
-description: "Use when Micro-delight generator for frontend interfaces. Suggests and implements subtle animations, playful transitions, and interaction polish across any frontend stack."
-version: 5.0.0
-last-updated: 2026-09-13
-skills:
-  - delight
-  - micro-interaction
-  - 60fps-animation
-  - accessible-animation
-tools: Read, Grep, Glob, Bash, Edit, Write
-scripts-binding:
-  - .agent/scripts/lint_runner.js
-  - .agent/scripts/verify_all.js
----
-
-# Whimsy Injector Skill — Micro-Delight Generator
-
----
-
-## 🛠️ Technical Architecture & Reference Recipes
-
+---
+name: whimsy-injector
+description: "Use when building, styling, optimizing, and auditing whimsy injector components, responsive layouts, design systems, and frontend state."
+version: 6.0.0
+last-updated: 2026-09-29
+skills:
+  - delight
+  - micro-interaction
+  - 60fps-animation
+  - accessible-animation
+tools: Read, Grep, Glob, Bash, Edit, Write
+scripts-binding:
+  - .agent/scripts/lint_runner.js
+  - .agent/scripts/verify_all.js
+---
+
+# Whimsy Injector Skill — Micro-Delight Generator
+
+## Mandatory Pre-Flight Context Inspection
+Before reading, generating, or refactoring code in the `whimsy-injector` domain, inspect these 5 critical parameters:
+1. **System Boundaries & Dependencies**: Verify that all required dependencies exist in target package manifests and environment paths.
+2. **Runtime Context & Platform Invariants**: Confirm target platform constraints (Node.js, Browser, Mobile OS, Edge runtime) before applying APIs.
+3. **Execution Guardrails**: Identify potential side-effects, state mutations, and unhandled asynchronous exceptions.
+4. **Validation & Type Contracts**: Validate input data schemas and strict type constraints across all module interfaces.
+5. **Observability & Proof of Execution**: Ensure execution produces tangible verification signals (terminal output, tests, metrics).
+
+
+## Activation Boundaries
+- **Activate when:** Use when building, styling, optimizing, and auditing whimsy injector components, responsive layouts, design systems, and frontend state.
+- **DO NOT activate when:** The task falls outside the `whimsy-injector` domain or is managed by a different dedicated specialist agent.
+
+
+## 🔁 Multi-Pass Execution Protocol
+
+| Pass | Phase | Core Action | Adaptive Depth |
+|:---|:---|:---|:---|
+| **Pass 1** | **Understand** | Deconstruct the user's explicit objective, implicit requirements, and platform constraints. | Fast / Standard / Deep |
+| **Pass 2** | **Plan** | Decompose task into smallest logical steps; map dependencies, affected files, and tool calls. | Standard / Deep |
+| **Pass 3** | **Execute** | Implement solution with production-grade craft, zero placeholders, and strict typing. | All Modes |
+| **Pass 4** | **Verify** | Run linters, unit tests, or compiler checks to validate structural correctness. | All Modes |
+| **Pass 5** | **Attack & Falsify** | Perform adversarial search for edge-case failures, counterexamples, race conditions, and traps. | Standard / Deep |
+| **Pass 6** | **Harden** | Eliminate discovered friction, optimize performance, and harden error boundaries. | Standard / Deep |
+| **Pass 7** | **Quality Gate** | Enforce Verification-Before-Completion (VBC) with concrete terminal proof before finalizing. | All Modes |
+
+
 ---
 
+## 🛠️ Technical Architecture & Reference Recipes
+
 ## When to Activate
 
 - During `/enhance` or `/ui-ux-pro-max` workflows as a polish pass.
@@ -302,4 +327,49 @@ Every file with animations MUST include:
 - **Only use documented CSS properties** — never invent animation APIs.
 - **Mark experimental APIs** with `// VERIFY: [API] — check browser support for your target`.
 - **Never suggest animations that cause layout shift** — enforce `transform` and `opacity` only.
-- **Verify `will-change` usage** — only apply to actively animating elements, remove after animation completes.
+- **Verify `will-change` usage** — only apply to actively animating elements, remove after animation completes.
+
+## 🚨 Edge-Case & Failure Mode Matrix
+
+| Scenario | Risk | Production Mitigation |
+|:---|:---|:---|
+| **Empty or Null Inputs** | Unhandled exception or unexpected rendering collapse | Enforce fallback guards, optional chaining, and explicit empty state handlers |
+| **Network Timeout / Latency** | Hanging operations or duplicate side-effects | Implement bounded abort controllers, exponential backoff, and idempotency keys |
+| **Concurrency / Race Conditions** | Stale state overwrite or inconsistent data mutations | Use atomic transactions, mutex locking, or cancel-on-resubmit controls |
+| **Invalid Schema / Malformed Payload** | Downstream runtime errors or security injection | Validate boundary payloads with Zod/Pydantic schemas prior to execution |
+| **Resource / Memory Saturation** | OOM errors, frame drops, or memory leaks | Clean up listeners, cancel active timers, and enforce pagination/virtualization |
+
+
+## 🤖 LLM-Specific Traps Table
+
+| Anti-Pattern | What AI Commonly Does Wrong | What Is Actually Correct |
+|:---|:---|:---|
+| **Uncontrolled Re-render Loop** | Mutating state inside render bodies or omitting hook dependencies | Wrap effects with explicit deps and isolate reactive derivations in useMemo |
+| **Accessibility Neglect** | Interactive <div> without role="button", tabIndex, or onKeyDown | Use semantic <button> or provide ARIA role, keyboard handlers, and focus ring |
+| **Layout Shift Flash** | Images/dynamic content without aspect-ratio or explicit dimensions | Enforce aspect-ratio or skeleton placeholders to guarantee zero CLS |
+
+
+## 🏛️ Tribunal Verification & Guardrails
+
+**Active Reviewers:** `frontend-reviewer` · `type-safety` · `ui-ux-auditor` · `complexity-reviewer`
+**Slash Command:** `/review` or `/tribunal-full`
+
+### 🔬 Evidence Standard (Tri-State Verification)
+Every finding, audit statement, or completion claim must classify its factual certainty:
+- **`[OBSERVED]`**: Directly confirmed in the codebase or verified via executed terminal command.
+- **`[INFERRED]`**: Logically deduced from code patterns, architectural data flow, or schema relations.
+- **`[UNVERIFIED]`**: Speculative hypothesis or runtime possibility requiring active testing or measurement.
+
+### ✅ Pre-Flight Self-Audit Checklist
+```
+✅ Are all component props strictly typed with zero implicit "any"?
+✅ Are responsive breakpoints, fluid typography, and optical balance verified?
+✅ Is accessibility (ARIA labels, keyboard navigation, contrast ratio >= 4.5:1) validated?
+✅ Are re-renders minimized and state lifecycles cleanly separated?
+✅ Did I verify all imported UI components and icon sets actually exist?
+```
+
+### 🛑 Verification-Before-Completion (VBC) Protocol
+**CRITICAL:** You must follow a strict "evidence-based closeout" state machine.
+- ❌ **Forbidden:** Declaring a task complete because the output "looks correct."
+- ✅ **Required:** You are explicitly forbidden from finalizing any task without providing **concrete evidence** (terminal output, passing test suites, compiler success, or equivalent operational proof) that your output works as intended.

package/.agents/skills/workflow-optimizer/SKILL.md

@@ -1,27 +1,52 @@
----
-name: workflow-optimizer
-description: "Use when Analyzes agent tool-calling patterns and task execution efficiency to suggest process improvements."
-version: 5.0.0
-last-updated: 2026-09-13
-skills:
-  - parallel-agents
-  - plan-writing
-  - fabel-protocol
-tools: Read, Grep, Glob, Bash, Edit, Write
-scripts-binding:
-  - .agent/scripts/verify_all.js
-  - .agent/scripts/checklist.js
-  - .agent/scripts/lint_runner.js
----
-
-# Workflow Optimizer Skill
-
----
-
-## 🛠️ Technical Architecture & Reference Recipes
-
+---
+name: workflow-optimizer
+description: "Use when executing, coordinating, planning, or reviewing workflow optimizer agent workflows, cognitive loops, and architecture standards."
+version: 6.0.0
+last-updated: 2026-09-29
+skills:
+  - parallel-agents
+  - plan-writing
+  - fabel-protocol
+tools: Read, Grep, Glob, Bash, Edit, Write
+scripts-binding:
+  - .agent/scripts/verify_all.js
+  - .agent/scripts/checklist.js
+  - .agent/scripts/lint_runner.js
+---
+
+# Workflow Optimizer Skill
+
+## Mandatory Pre-Flight Context Inspection
+Before reading, generating, or refactoring code in the `workflow-optimizer` domain, inspect these 5 critical parameters:
+1. **System Boundaries & Dependencies**: Verify that all required dependencies exist in target package manifests and environment paths.
+2. **Runtime Context & Platform Invariants**: Confirm target platform constraints (Node.js, Browser, Mobile OS, Edge runtime) before applying APIs.
+3. **Execution Guardrails**: Identify potential side-effects, state mutations, and unhandled asynchronous exceptions.
+4. **Validation & Type Contracts**: Validate input data schemas and strict type constraints across all module interfaces.
+5. **Observability & Proof of Execution**: Ensure execution produces tangible verification signals (terminal output, tests, metrics).
+
+
+## Activation Boundaries
+- **Activate when:** Use when executing, coordinating, planning, or reviewing workflow optimizer agent workflows, cognitive loops, and architecture standards.
+- **DO NOT activate when:** The task falls outside the `workflow-optimizer` domain or is managed by a different dedicated specialist agent.
+
+
+## 🔁 Multi-Pass Execution Protocol
+
+| Pass | Phase | Core Action | Adaptive Depth |
+|:---|:---|:---|:---|
+| **Pass 1** | **Understand** | Deconstruct the user's explicit objective, implicit requirements, and platform constraints. | Fast / Standard / Deep |
+| **Pass 2** | **Plan** | Decompose task into smallest logical steps; map dependencies, affected files, and tool calls. | Standard / Deep |
+| **Pass 3** | **Execute** | Implement solution with production-grade craft, zero placeholders, and strict typing. | All Modes |
+| **Pass 4** | **Verify** | Run linters, unit tests, or compiler checks to validate structural correctness. | All Modes |
+| **Pass 5** | **Attack & Falsify** | Perform adversarial search for edge-case failures, counterexamples, race conditions, and traps. | Standard / Deep |
+| **Pass 6** | **Harden** | Eliminate discovered friction, optimize performance, and harden error boundaries. | Standard / Deep |
+| **Pass 7** | **Quality Gate** | Enforce Verification-Before-Completion (VBC) with concrete terminal proof before finalizing. | All Modes |
+
+
 ---
 
+## 🛠️ Technical Architecture & Reference Recipes
+
 ## When to Activate
 
 - When a task takes significantly more tool calls than expected.
@@ -185,4 +210,49 @@ Before analyzing, check for these common quick wins:
 - **Only analyze actual tool call logs** — never invent or assume tool calls that didn't happen.
 - **Recommendations must reference real tools** — only suggest tools available in the current environment.
 - **Never fabricate efficiency scores** — always calculate from actual vs optimal counts.
-- **Acknowledge uncertainty**: "Cannot determine if calls 3-5 had data dependency — may be correctly sequential."
+- **Acknowledge uncertainty**: "Cannot determine if calls 3-5 had data dependency — may be correctly sequential."
+
+## 🚨 Edge-Case & Failure Mode Matrix
+
+| Scenario | Risk | Production Mitigation |
+|:---|:---|:---|
+| **Empty or Null Inputs** | Unhandled exception or unexpected rendering collapse | Enforce fallback guards, optional chaining, and explicit empty state handlers |
+| **Network Timeout / Latency** | Hanging operations or duplicate side-effects | Implement bounded abort controllers, exponential backoff, and idempotency keys |
+| **Concurrency / Race Conditions** | Stale state overwrite or inconsistent data mutations | Use atomic transactions, mutex locking, or cancel-on-resubmit controls |
+| **Invalid Schema / Malformed Payload** | Downstream runtime errors or security injection | Validate boundary payloads with Zod/Pydantic schemas prior to execution |
+| **Resource / Memory Saturation** | OOM errors, frame drops, or memory leaks | Clean up listeners, cancel active timers, and enforce pagination/virtualization |
+
+
+## 🤖 LLM-Specific Traps Table
+
+| Anti-Pattern | What AI Commonly Does Wrong | What Is Actually Correct |
+|:---|:---|:---|
+| **Hallucinated Tool Capabilities** | Assuming an external library or CLI command exists without verification | Run a verification check or verify package.json before referencing tools |
+| **Premature Completion Claim** | Declaring a task finished because code was generated without verification | Execute tests, linters, or terminal commands to provide concrete proof |
+| **Context Bloat Dumping** | Pasting entire multi-thousand-line files into prompt context | Extract targeted excerpts, symbols, and signatures to preserve tokens |
+
+
+## 🏛️ Tribunal Verification & Guardrails
+
+**Active Reviewers:** `orchestrator` · `agent-organizer` · `logic-reviewer`
+**Slash Command:** `/review` or `/tribunal-full`
+
+### 🔬 Evidence Standard (Tri-State Verification)
+Every finding, audit statement, or completion claim must classify its factual certainty:
+- **`[OBSERVED]`**: Directly confirmed in the codebase or verified via executed terminal command.
+- **`[INFERRED]`**: Logically deduced from code patterns, architectural data flow, or schema relations.
+- **`[UNVERIFIED]`**: Speculative hypothesis or runtime possibility requiring active testing or measurement.
+
+### ✅ Pre-Flight Self-Audit Checklist
+```
+✅ Did I deconstruct the root objective before proposing architecture?
+✅ Did I identify dependencies, bottlenecks, and parallelizable sub-tasks?
+✅ Did I avoid over-engineering and select the simplest effective pattern?
+✅ Did I verify assumptions with concrete file reads instead of speculation?
+✅ Did I establish measurable verification criteria before completion?
+```
+
+### 🛑 Verification-Before-Completion (VBC) Protocol
+**CRITICAL:** You must follow a strict "evidence-based closeout" state machine.
+- ❌ **Forbidden:** Declaring a task complete because the output "looks correct."
+- ✅ **Required:** You are explicitly forbidden from finalizing any task without providing **concrete evidence** (terminal output, passing test suites, compiler success, or equivalent operational proof) that your output works as intended.

package/.agents/skills/zero-trust-passkeys/SKILL.md

@@ -1,21 +1,48 @@
----
-name: zero-trust-passkeys
-description: "Use when Modern passwordless authentication using WebAuthn, FIDO2 biometric passkeys, SimpleWebAuthn v13+, Conditional UI (Passkey Autofill), and Zero-Trust security."
-version: 5.0.0
-last-updated: 2026-09-13
-skills:
-  - authentication-best-practices
-  - backend-security-expert
-  - frontend-security-expert
-tools: Read, Grep, Glob, Bash, Edit, Write
-scripts-binding:
-  - .agent/scripts/security_scan.js
-  - .agent/scripts/lint_runner.js
-  - .agent/scripts/verify_all.js
----
-
-# Zero-Trust Passkeys & WebAuthn (SimpleWebAuthn v13+)
-
+---
+name: zero-trust-passkeys
+description: "Use when auditing, pen-testing, hardening, and verifying code against zero trust passkeys vulnerabilities, injection vectors, and auth flaws."
+version: 6.0.0
+last-updated: 2026-09-29
+skills:
+  - authentication-best-practices
+  - backend-security-expert
+  - frontend-security-expert
+tools: Read, Grep, Glob, Bash, Edit, Write
+scripts-binding:
+  - .agent/scripts/security_scan.js
+  - .agent/scripts/lint_runner.js
+  - .agent/scripts/verify_all.js
+---
+
+# Zero-Trust Passkeys & WebAuthn (SimpleWebAuthn v13+)
+
+## Mandatory Pre-Flight Context Inspection
+Before reading, generating, or refactoring code in the `zero-trust-passkeys` domain, inspect these 5 critical parameters:
+1. **System Boundaries & Dependencies**: Verify that all required dependencies exist in target package manifests and environment paths.
+2. **Runtime Context & Platform Invariants**: Confirm target platform constraints (Node.js, Browser, Mobile OS, Edge runtime) before applying APIs.
+3. **Execution Guardrails**: Identify potential side-effects, state mutations, and unhandled asynchronous exceptions.
+4. **Validation & Type Contracts**: Validate input data schemas and strict type constraints across all module interfaces.
+5. **Observability & Proof of Execution**: Ensure execution produces tangible verification signals (terminal output, tests, metrics).
+
+
+## Activation Boundaries
+- **Activate when:** Use when auditing, pen-testing, hardening, and verifying code against zero trust passkeys vulnerabilities, injection vectors, and auth flaws.
+- **DO NOT activate when:** The task falls outside the `zero-trust-passkeys` domain or is managed by a different dedicated specialist agent.
+
+
+## 🔁 Multi-Pass Execution Protocol
+
+| Pass | Phase | Core Action | Adaptive Depth |
+|:---|:---|:---|:---|
+| **Pass 1** | **Understand** | Deconstruct the user's explicit objective, implicit requirements, and platform constraints. | Fast / Standard / Deep |
+| **Pass 2** | **Plan** | Decompose task into smallest logical steps; map dependencies, affected files, and tool calls. | Standard / Deep |
+| **Pass 3** | **Execute** | Implement solution with production-grade craft, zero placeholders, and strict typing. | All Modes |
+| **Pass 4** | **Verify** | Run linters, unit tests, or compiler checks to validate structural correctness. | All Modes |
+| **Pass 5** | **Attack & Falsify** | Perform adversarial search for edge-case failures, counterexamples, race conditions, and traps. | Standard / Deep |
+| **Pass 6** | **Harden** | Eliminate discovered friction, optimize performance, and harden error boundaries. | Standard / Deep |
+| **Pass 7** | **Quality Gate** | Enforce Verification-Before-Completion (VBC) with concrete terminal proof before finalizing. | All Modes |
+
+
 ---
 
 ## 🛠️ Technical Architecture & Reference Recipes
@@ -79,4 +106,49 @@ export async function verifyPasskeyAuth(
 
   return verification.verified;
 }
-```
+```
+
+## 🚨 Edge-Case & Failure Mode Matrix
+
+| Scenario | Risk | Production Mitigation |
+|:---|:---|:---|
+| **Empty or Null Inputs** | Unhandled exception or unexpected rendering collapse | Enforce fallback guards, optional chaining, and explicit empty state handlers |
+| **Network Timeout / Latency** | Hanging operations or duplicate side-effects | Implement bounded abort controllers, exponential backoff, and idempotency keys |
+| **Concurrency / Race Conditions** | Stale state overwrite or inconsistent data mutations | Use atomic transactions, mutex locking, or cancel-on-resubmit controls |
+| **Invalid Schema / Malformed Payload** | Downstream runtime errors or security injection | Validate boundary payloads with Zod/Pydantic schemas prior to execution |
+| **Resource / Memory Saturation** | OOM errors, frame drops, or memory leaks | Clean up listeners, cancel active timers, and enforce pagination/virtualization |
+
+
+## 🤖 LLM-Specific Traps Table
+
+| Anti-Pattern | What AI Commonly Does Wrong | What Is Actually Correct |
+|:---|:---|:---|
+| **Hardcoded Secret Pattern** | Committing API keys, tokens, or private salts into source code | Load credentials strictly via runtime environment variables and secret stores |
+| **Prompt Injection Surface** | Directly concatenating untrusted user input into LLM system prompts | Wrap user content in isolated delimiters and strip injection control sequences |
+| **Missing Authorization Check** | Relying only on authentication token presence without checking tenant/object RBAC | Verify user permissions against the specific target record ID before mutation |
+
+
+## 🏛️ Tribunal Verification & Guardrails
+
+**Active Reviewers:** `security-auditor` · `penetration-tester` · `backend-security-expert`
+**Slash Command:** `/review` or `/tribunal-full`
+
+### 🔬 Evidence Standard (Tri-State Verification)
+Every finding, audit statement, or completion claim must classify its factual certainty:
+- **`[OBSERVED]`**: Directly confirmed in the codebase or verified via executed terminal command.
+- **`[INFERRED]`**: Logically deduced from code patterns, architectural data flow, or schema relations.
+- **`[UNVERIFIED]`**: Speculative hypothesis or runtime possibility requiring active testing or measurement.
+
+### ✅ Pre-Flight Self-Audit Checklist
+```
+✅ Are user inputs sanitized and treated as untrusted data at system boundaries?
+✅ Are secrets loaded strictly via environment variables with zero hardcoding?
+✅ Is least-privilege enforcement active on APIs, tokens, and storage buckets?
+✅ Are prompt-injection delimiters and sanitizers wrapped around LLM inputs?
+✅ Did I verify encryption in transit and at rest for sensitive data?
+```
+
+### 🛑 Verification-Before-Completion (VBC) Protocol
+**CRITICAL:** You must follow a strict "evidence-based closeout" state machine.
+- ❌ **Forbidden:** Declaring a task complete because the output "looks correct."
+- ✅ **Required:** You are explicitly forbidden from finalizing any task without providing **concrete evidence** (terminal output, passing test suites, compiler success, or equivalent operational proof) that your output works as intended.

package/README.md

@@ -15,7 +15,7 @@
   <!-- BADGES -->
   <div style="margin-bottom: 25px;">
     <a href="https://github.com/Harmitx7/tribunal-kit/releases">
-      <img src="https://img.shields.io/badge/Release-v9.2.5-blue?style=for-the-badge" alt="Release" />
+      <img src="https://img.shields.io/badge/Release-v9.2.6-blue?style=for-the-badge" alt="Release" />
     </a>
     <a href="https://www.npmjs.com/package/tribunal-kit">
       <img src="https://img.shields.io/npm/v/tribunal-kit?style=for-the-badge&logo=npm&logoColor=white&color=ff1637" alt="NPM Version" />
@@ -23,23 +23,23 @@
     <a href="https://github.com/Harmitx7/tribunal-kit/actions/workflows/ci.yml">
       <img src="https://img.shields.io/github/actions/workflow/status/Harmitx7/tribunal-kit/ci.yml?style=for-the-badge&logo=githubactions&logoColor=white&label=CI" alt="CI Status" />
     </a>
-    <a href="LICENSE">
-      <img src="https://img.shields.io/badge/License-MIT-1a1a1f?style=for-the-badge&color=2d2d30" alt="License" />
+    <a href="#">
+      <img src="https://img.shields.io/badge/Skills-235_Modular-teal?style=for-the-badge" alt="Skills Corpus" />
     </a>
-    <a href="package.json">
-      <img src="https://img.shields.io/badge/Dependencies-Minimal-ff3300?style=for-the-badge&color=111111&logoColor=ff3300" alt="Minimal Dependencies" />
+    <a href="#">
+      <img src="https://img.shields.io/badge/Reviewers-28_Parallel-emerald?style=for-the-badge" alt="Reviewers" />
     </a>
     <a href="crates/core">
       <img src="https://img.shields.io/badge/Core-Rust_10ms-DEA584?style=for-the-badge&logo=rust&logoColor=white" alt="Rust Core" />
     </a>
-    <a href="mcp_config.json">
-      <img src="https://img.shields.io/badge/MCP-Ready-00c2ff?style=for-the-badge&logo=openai&logoColor=111" alt="MCP Server" />
+    <a href="LICENSE">
+      <img src="https://img.shields.io/badge/License-MIT-1a1a1f?style=for-the-badge&color=2d2d30" alt="License" />
     </a>
   </div>
 
   <p>
     <strong>Universal Compatibility:</strong>
-    <code>Cursor</code> • <code>Claude Code</code> • <code>Windsurf</code> • <code>VS Code</code> • <code>Aider</code> • <code>Devin</code>
+    <code>Cursor</code> • <code>Claude Code</code> • <code>Windsurf</code> • <code>VS Code</code> • <code>Aider</code> • <code>Devin</code> • <code>Gemini</code>
   </p>
 </div>
 
@@ -47,20 +47,30 @@
 
 ## 🛡️ Value Proposition
 
-AI coding assistants frequently hallucinate dependencies, deprecated framework hooks, and incorrect database columns. Linters and typecheckers catch these errors only *after* the code is written, failing to understand semantic intent during generation.
+AI coding assistants frequently hallucinate dependencies, deprecated framework hooks, and incorrect database columns. Linters and typecheckers catch these errors only _after_ the code is written, failing to understand semantic intent during generation.
 
-Tribunal Kit acts as a **neurosymbolic verification envelope**. It intercepts AI output locally in **&lt; 10ms**, validates it against your live repository AST, and prevents hallucinated code and phantom packages from ever touching your disk. 
+Tribunal Kit acts as a **neurosymbolic verification envelope**. It intercepts AI output locally in **&lt; 10ms**, validates it against your live repository AST, and prevents hallucinated code and phantom packages from ever touching your disk.
+
+---
+
+## ⚡ What's New in v9.2.6
+
+- **Backend Intelligence Trust Boundary:** Strict validation engine output isolation. LLMs can no longer self-authorize findings; evidence requires verifiable provenance hashes and terminal command records.
+- **Universal 18-Section Governance Standard:** All 235 modular skills upgraded to enforce Tri-State Evidence classification (`[OBSERVED]`, `[INFERRED]`, `[UNVERIFIED]`) and non-negotiable **Verification-Before-Completion (VBC)** gates.
+- **Anti-Slop Purpose-Gate:** Added the dedicated `anti-slop-auditor` (Wave 3) and `anti-slop-enforcement` skill to eradicate cliché AI design copy, gratuitous animations, and generic purple gradients.
+- **System-1 Concurrency & Isolation:** Atomic directory-based installation locks, isolated dependency packaging (~150MB overhead eliminated), and SHA-256 model verification for local ONNX inference.
+- **Zero-Trust Architecture Intelligence (`tk arch`):** Deterministic fact extraction (TAFE), blast-radius computation, circular dependency detection, and interactive HTML architecture projections.
 
 ---
 
 ## ⚡ Core Capabilities
 
-- **Parallel Review Pipeline:** 30 domain-specific reviewers analyze generated code simultaneously before the write operation.
+- **Parallel Review Pipeline:** 28 domain-specific reviewers analyze generated code simultaneously across 3 waves (Logic, Security, Domain) before writing to disk.
 - **Compiled Rust Core:** Sub-10ms AST parsing, semantic graph extraction, and file synchronization using SHA-256 diffs.
-- **Phantom Package Guardrails:** Blocks "slopsquatting" and non-existent npm package imports during generation.
-- **Cross-Session Memory:** "Supreme Court Case Law" (`tk case`) records past AI mistakes so they are never repeated across sessions.
+- **Phantom Package Guardrails:** Blocks "slopsquatting" and non-existent npm package imports during code generation.
+- **Cross-Session Memory:** "Supreme Court Case Law" (`tk case`) and key-value memory (`tk memory`) record past AI mistake precedents.
 - **Subagent-Driven Development (SDD):** Orchestrates multi-agent fan-out and synthesis, strictly isolating context windows to prevent token bloat.
-- **Minimal Dependencies:** The Node.js CLI runtime requires almost zero production dependencies, protecting your supply chain.
+- **Minimal Dependencies:** The production CLI runtime requires zero heavy dependencies, protecting your supply chain.
 - **Native MCP Server:** Exposes real-time repository AST and team contract rules to Model Context Protocol compatible clients.
 
 ---
@@ -72,8 +82,8 @@ Tribunal Kit operates as a fast, intercepting middleware layer between the AI ge
 ```mermaid
 graph LR
     A[User Request] --> B[Context Broker]
-    B --> C[Compiled Rust Core<br/>AST / Graph extraction]
-    C --> D[30 Parallel Reviewers]
+    B --> C[Compiled Rust Core<br/>AST / Graph Extraction]
+    C --> D[28 Parallel Reviewers<br/>Waves 1, 2 & 3]
     D -->|Violation| E[Inner-Loop Auto-Correct]
     E -.-> B
     D -->|Passed| F[Human Gate]
@@ -85,9 +95,9 @@ graph LR
 
 ### Data Flow
 
-1. **Input:** An LLM agent generates a code change proposal (or triggers a workflow like `/generate`).
-2. **Processing:** The Rust Core extracts the current AST and validates the semantic bounds. The proposal is dispatched to parallel Reviewers (e.g., `logic-reviewer`, `security-auditor`).
-3. **Output:** If valid, it passes to the Human Gate or writes directly to disk. If invalid, the process is halted, and feedback is fed back into the agent's context loop.
+1. **Input:** An LLM agent generates a code change proposal (or triggers a workflow like `/generate` or `/sdd`).
+2. **Processing:** The Rust Core extracts the current AST and validates semantic bounds. The proposal is dispatched to parallel Reviewers (e.g., `logic-reviewer`, `security-auditor`, `anti-slop-auditor`).
+3. **Output:** If valid, it passes to the Human Gate or writes directly to disk. If invalid, the process is halted, and structured feedback is fed back into the agent's context loop.
 
 ---
 
@@ -108,6 +118,7 @@ npx tribunal-kit status
 
 **Using a CLI Agent?**
 Install the native adapter for Claude Code or Aider:
+
 ```bash
 npx tribunal-kit tk-adapt claude
 # or
@@ -120,18 +131,24 @@ npx tribunal-kit tk-adapt aider
 
 Tribunal Kit CLI operations are routed through the compiled Rust binary when supported, falling back to the JavaScript engine gracefully.
 
-| Command | Arguments | Description |
-| :--- | :--- | :--- |
-| `init` | `[--force]` | Initializes the `.agent/` configuration payload. |
-| `sync` | — | Syncs rules with IDEs (.cursorrules, .windsurfrules). |
-| `status` | — | Evaluates workspace rules and checks for violations. |
-| `guardrail` | `[--file <path>]` | Scans changes for phantom packages and `// VERIFY` tags. |
-| `tk-adapt` | `[claude\|aider\|--global]` | Installs universal CLI agent adapters. |
-| `hook` | — | Installs the automated Git pre-push governance hook. |
-| `memory` | `store \| recall \| gc` | Manages persistent cross-session AI memory. |
-| `case` | `add \| search <q>` | Records or searches for AI mistake precedents. |
-
-*(For workflow execution, Tribunal Kit monitors for slash commands like `/orchestrate`, `/audit`, or `/deploy` inside your AI context).*
+| Command     | Arguments                   | Description                                                      |
+| :---------- | :-------------------------- | :--------------------------------------------------------------- |
+| `init`      | `[--force]`                 | Initializes the `.agent/` configuration payload.                 |
+| `sync`      | —                           | Syncs rules with IDEs (.cursorrules, .windsurfrules).            |
+| `status`    | —                           | Evaluates workspace rules and checks for violations.             |
+| `validate`  | `[--file <path>]`           | Validates `.agent/` payload structure with live reviewer swarm.  |
+| `guardrail` | `[--file <path>]`           | Scans changes for phantom packages and `// VERIFY` tags.         |
+| `arch`      | `map \| verify \| impact \| diff \| audit \| project` | Verifiable Architecture Intelligence & Blast Radius engine. |
+| `system1`   | `enable \| disable \| status` | Manages local ONNX neural tier assessment and model weights.     |
+| `sdd`       | `run \| status`             | Subagent-Driven Development execution with reviewer waves.       |
+| `minimal`   | `[--prompt <text>]`         | Analyzes change requests for minimal viable diffs (Decision 0-7).|
+| `contract`  | `init \| verify \| list`    | AI agent behavioral contract validation and trace replay.        |
+| `memory`    | `store \| recall \| gc`     | Manages persistent cross-session AI memory.                      |
+| `case`      | `add \| search <q>`         | Records or searches for AI mistake precedents.                   |
+| `tk-adapt`  | `[claude\|aider\|--global]` | Installs universal CLI agent adapters.                           |
+| `hook`      | —                           | Installs the automated Git pre-push governance hook.             |
+
+_(For workflow execution, Tribunal Kit monitors for slash commands like `/orchestrate`, `/audit`, `/sdd`, or `/deploy` inside your AI context)._
 
 ---
 
@@ -140,6 +157,7 @@ Tribunal Kit CLI operations are routed through the compiled Rust binary when sup
 Tribunal Kit is largely zero-config, driven by the `.agent/` directory, but exposes settings via `mcp_config.json` and `package.json`.
 
 **Example MCP Configuration (`mcp_config.json`)**
+
 ```json
 {
   "mcpServers": {
@@ -174,14 +192,14 @@ tribunal-kit/
 
 ## 🔗 Integrations
 
-| Environment / Tool | Integration Type | Status |
-| :--- | :--- | :--- |
-| **Cursor IDE** | Plugin & `.cursorrules` bridge | Supported |
+| Environment / Tool        | Integration Type                              | Status    |
+| :------------------------ | :-------------------------------------------- | :-------- |
+| **Cursor IDE**            | Plugin & `.cursorrules` bridge                | Supported |
 | **Anthropic Claude Code** | Native Marketplace Plugin (`.claude-plugin/`) | Supported |
-| **Windsurf** | Native `.windsurfrules` sync | Supported |
-| **Cognition Devin** | Native Plugin (`.devin-plugin/`) | Supported |
-| **Aider CLI** | Conventions Bridge (`tk-adapt`) | Supported |
-| **Google Gemini CLI** | Extension Manifest (`gemini-extension.json`) | Supported |
+| **Windsurf**              | Native `.windsurfrules` sync                  | Supported |
+| **Cognition Devin**       | Native Plugin (`.devin-plugin/`)              | Supported |
+| **Aider CLI**             | Conventions Bridge (`tk-adapt`)               | Supported |
+| **Google Gemini CLI**     | Extension Manifest (`gemini-extension.json`)  | Supported |
 
 ---
 
@@ -198,24 +216,28 @@ tribunal-kit/
 Tribunal Kit employs rigorous continuous integration.
 
 ```bash
-# Run payload validation and the Jest test suite
-npm run test:all
+# Run payload validation and the full test suite
+npm test
+
+# Run the full 7-gate verification suite (Secret scan, Types, Lint, Tests, Build, Audit, Rust)
+node .agent/scripts/verify_all.js
 
 # Run the Rust core test suite
 npm run test:rust
 ```
 
-The validation pipeline enforces `validate-payload.js` checks to ensure every specialist agent, workflow, and skill definition conforms to the strict schema before compilation.
+The validation pipeline enforces `validate-payload.js` and `integrity_manifest.js` checks to ensure every specialist agent, workflow, and skill definition conforms to the strict schema before compilation.
 
 ---
 
 ## ⚡ Performance
 
 By offloading AST evaluation and file hashing to the `tribunal-core` Rust binary, Tribunal Kit achieves:
+
 - **Sub-10ms** execution overhead for the `guardrail` and `sync` commands.
 - Up to **95% faster** context validation compared to standard Node.js implementations traversing large monorepos.
 
-*(Benchmarks available via `npm run benchmark:rust` locally)*.
+_(Benchmarks available via `npm run benchmark:rust` locally)_.
 
 ---
 

package/bin/adapter-install.js

@@ -204,7 +204,7 @@ function main() {
   console.log('');
   console.log('┌─────────────────────────────────────────────┐');
   console.log('│  🔱 Tribunal Kit — Universal Agent Adapter  │');
-  console.log('│  v9.2.5 · 52 specialists · 185 skills       │');
+  console.log('│  v9.2.6 · 52 specialists · 185 skills       │');
   console.log('└─────────────────────────────────────────────┘');
   console.log('');