tribunal-kit 9.2.5 → 9.2.7

package/.agents/skills/subagent-driven-development/SKILL.md

@@ -1,32 +1,92 @@
----
-name: subagent-driven-development
-description: "Use when decomposing tasks, delegating to subagents, executing code in isolation, and reviewing AI-generated output. Integrates tightly with Tribunal OS governance."
-version: 1.0.0
-last-updated: 2026-09-25
-skills:
-  - tdd-workflow
-  - verification-before-completion
-tools: Read, Grep, Glob, Bash, Edit, Write
-scripts-binding:
-  - .agent/scripts/swarm_dispatcher.js
----
-
-# Subagent-Driven Development (SDD)
-
-## Core Philosophy
-Monolithic tasks must be broken down into atomic, testable units, delegated to specialized agents, and executed in bounded isolation. No single agent should both write code and approve it for production.
-
-## The SDD Lifecycle
-1. **Decomposition**: Break the Epic down into sub-tasks (Waves). No sub-task should touch more than 5 files.
-2. **Delegation**: Assign each sub-task to the agent with the most appropriate profile (e.g., `frontend-specialist`, `database-architect`).
-3. **Execution (Hands)**: The subagent implements the required changes in a localized context.
-4. **Verification**: The subagent runs tests. If tests fail, it iterates.
-5. **Review (Tribunal)**: The code changes are subjected to parallel static analysis reviewers (`/tribunal-full`).
-6. **Handoff**: The subagent reports back to the Orchestrator with concrete proof of verification.
-
-## Mandatory Guardrails
-- **Zero-Trust Delegation**: Never assume a subagent succeeded just because it didn't throw an error. Demand terminal output proof.
-- **Context Isolation**: Do NOT pass the entire conversation history to a subagent. Pass only the required `.md` instructions and relevant file paths.
-
-## Failure Handling
-If a subagent fails 3 times, the Orchestrator must abort the wave, clean up any uncommitted side-effects, and flag the issue for the Human Gate.
+---
+name: subagent-driven-development
+description: "Use when decomposing complex epics into atomic subagent tasks, orchestrating parallel worker waves, isolating context, and synthesizing results with Tribunal reviews. Enforces out-of-band context and human gate approvals."
+version: 6.0.0
+last-updated: 2026-09-29
+skills:
+  - agent-organizer
+  - parallel-agents
+  - tdd-workflow
+  - verification-before-completion
+tools: Read, Grep, Glob, Bash, Edit, Write
+scripts-binding:
+  - .agent/scripts/swarm_dispatcher.js
+  - .agent/scripts/verify_all.js
+  - .agent/scripts/lint_runner.js
+---
+
+# Subagent-Driven Development (SDD) — Swarm Orchestration Engine
+
+## Activation Boundaries
+- **Activate when:** Use when decomposing complex epics into atomic subagent tasks, orchestrating parallel worker waves, isolating context, and synthesizing results with Tribunal reviews. Enforces out-of-band context and human gate approvals.
+- **DO NOT activate when:** The task falls outside the `subagent-driven-development` domain or is managed by a different dedicated specialist agent.
+
+
+## 🔁 Multi-Pass Execution Protocol
+
+| Pass | Phase | Core Action | Adaptive Depth |
+|:---|:---|:---|:---|
+| **Pass 1** | **Understand** | Deconstruct the user's explicit objective, implicit requirements, and platform constraints. | Fast / Standard / Deep |
+| **Pass 2** | **Plan** | Decompose task into smallest logical steps; map dependencies, affected files, and tool calls. | Standard / Deep |
+| **Pass 3** | **Execute** | Implement solution with production-grade craft, zero placeholders, and strict typing. | All Modes |
+| **Pass 4** | **Verify** | Run linters, unit tests, or compiler checks to validate structural correctness. | All Modes |
+| **Pass 5** | **Attack & Falsify** | Perform adversarial search for edge-case failures, counterexamples, race conditions, and traps. | Standard / Deep |
+| **Pass 6** | **Harden** | Eliminate discovered friction, optimize performance, and harden error boundaries. | Standard / Deep |
+| **Pass 7** | **Quality Gate** | Enforce Verification-Before-Completion (VBC) with concrete terminal proof before finalizing. | All Modes |
+
+
+## Mandatory Pre-Flight Context Inspection
+1. **Epic Deconstructibility**: Verify the epic can be partitioned into atomic tasks touching disjoint file sets.
+2. **File Ownership Invariant**: Ensure no two concurrent workers in the same wave edit the same target file.
+3. **Context Isolation**: Pass only scoped `task-<N>-brief.md` and file excerpts to subagents; NEVER dump conversation history.
+4. **Verification Criteria**: Every subagent brief must define measurable pass/fail criteria (unit test, compiler check, lint).
+5. **Fan-In Synthesis**: Collect worker outputs via `allSettled`; resolve conflicting findings before writing disk changes.
+
+## 🛠️ Technical Architecture & Reference Recipes
+
+### 1. The 4-Phase SDD Lifecycle
+```
+1. DECOMPOSE: Epic ──► Wave 1 (Independent Workers) ──► Wave 2 (Dependent Workers)
+2. DISPATCH:   Worker A [backend]     Worker B [frontend]     Worker C [database]
+                    │                      │                       │
+3. VERIFY:     Run Tests              Run Tests               Run Tests
+                    │                      │                       │
+4. SYNTHESIZE: Fan-In Aggregation ──► Tribunal Review Wave ──► Human Gate Approval
+```
+
+### 2. Scoped Task Brief Contract (`task-brief.md`)
+```markdown
+# Task Brief: #042 — Auth Middleware Hardening
+- **Assigned Specialist**: `backend-specialist`
+- **Target Files (Exclusive)**: `src/middleware/auth.ts`, `test/middleware/auth.test.ts`
+- **Context Summary**: JWT verification must enforce algorithm whitelist (`HS256`) and check tenant isolation.
+- **Constraints**: Do NOT edit `src/app.ts`. Do NOT install external dependencies without approval.
+- **Required Verification**: `npm test test/middleware/auth.test.ts` must exit 0 with 100% assertions passing.
+```
+
+## 🚨 Edge-Case & Failure Mode Matrix
+
+| Scenario | Risk | Production Mitigation |
+|:---|:---|:---|
+| **Conflicting Edits in Shared Files** | Two subagents edit the same file simultaneously, causing merge conflicts | Strict partitioning: One subagent owns the file; dependent subagents run in subsequent waves |
+| **Worker Failure / Infinite Loop** | A subagent gets stuck repeating the same failing command | Hard limit of 3 retries; if worker fails on attempt 3, mark as BLOCKED and escalate to supervisor |
+| **Context Window Saturation** | Subagents consume millions of tokens by re-reading identical files | Orchestrator distributes pre-computed context excerpts via `context_broker.js` |
+
+## 🏛️ Tribunal Verification & Guardrails
+
+### 🔬 Evidence Standard (Tri-State Verification)
+Every finding, audit statement, or completion claim must classify its factual certainty:
+- **`[OBSERVED]`**: Directly confirmed in the codebase or verified via executed terminal command.
+- **`[INFERRED]`**: Logically deduced from code patterns, architectural data flow, or schema relations.
+- **`[UNVERIFIED]`**: Speculative hypothesis or runtime possibility requiring active testing or measurement.
+
+- **Active Reviewers:** `orchestrator`, `agent-organizer`, `resilience-reviewer`
+- **Evidence Standard:** All subagent completion claims require verified terminal test output.
+
+## 🤖 LLM-Specific Traps Table
+
+| Anti-Pattern | What AI Commonly Does Wrong | What Is Actually Correct |
+|:---|:---|:---|
+| **Hallucinated Tool Capabilities** | Assuming an external library or CLI command exists without verification | Run a verification check or verify package.json before referencing tools |
+| **Premature Completion Claim** | Declaring a task finished because code was generated without verification | Execute tests, linters, or terminal commands to provide concrete proof |
+| **Context Bloat Dumping** | Pasting entire multi-thousand-line files into prompt context | Extract targeted excerpts, symbols, and signatures to preserve tokens |

package/.agents/skills/supabase-postgres-best-practices/SKILL.md

@@ -1,26 +1,51 @@
----
-name: supabase-postgres-best-practices
-description: "Use when Database architect expert in Supabase and PostgreSQL. Focuses on Row Level Security (RLS), edge functions, real-time setups, and performant schema design."
-version: 5.0.0
-last-updated: 2026-09-13
-skills:
-  - database-design
-  - sql-pro
-  - db-latency-auditor
-tools: Read, Grep, Glob, Bash, Edit, Write
-scripts-binding:
-  - .agent/scripts/lint_runner.js
-  - .agent/scripts/verify_all.js
----
-
-# Supabase & Postgres Best Practices
-
----
-
-## 🛠️ Technical Architecture & Reference Recipes
-
+---
+name: supabase-postgres-best-practices
+description: "Use when designing schemas, querying, indexing, optimizing, and securing supabase postgres best practices databases and data models."
+version: 6.0.0
+last-updated: 2026-09-29
+skills:
+  - database-design
+  - sql-pro
+  - db-latency-auditor
+tools: Read, Grep, Glob, Bash, Edit, Write
+scripts-binding:
+  - .agent/scripts/lint_runner.js
+  - .agent/scripts/verify_all.js
+---
+
+# Supabase & Postgres Best Practices
+
+## Mandatory Pre-Flight Context Inspection
+Before reading, generating, or refactoring code in the `supabase-postgres-best-practices` domain, inspect these 5 critical parameters:
+1. **System Boundaries & Dependencies**: Verify that all required dependencies exist in target package manifests and environment paths.
+2. **Runtime Context & Platform Invariants**: Confirm target platform constraints (Node.js, Browser, Mobile OS, Edge runtime) before applying APIs.
+3. **Execution Guardrails**: Identify potential side-effects, state mutations, and unhandled asynchronous exceptions.
+4. **Validation & Type Contracts**: Validate input data schemas and strict type constraints across all module interfaces.
+5. **Observability & Proof of Execution**: Ensure execution produces tangible verification signals (terminal output, tests, metrics).
+
+
+## Activation Boundaries
+- **Activate when:** Use when designing schemas, querying, indexing, optimizing, and securing supabase postgres best practices databases and data models.
+- **DO NOT activate when:** The task falls outside the `supabase-postgres-best-practices` domain or is managed by a different dedicated specialist agent.
+
+
+## 🔁 Multi-Pass Execution Protocol
+
+| Pass | Phase | Core Action | Adaptive Depth |
+|:---|:---|:---|:---|
+| **Pass 1** | **Understand** | Deconstruct the user's explicit objective, implicit requirements, and platform constraints. | Fast / Standard / Deep |
+| **Pass 2** | **Plan** | Decompose task into smallest logical steps; map dependencies, affected files, and tool calls. | Standard / Deep |
+| **Pass 3** | **Execute** | Implement solution with production-grade craft, zero placeholders, and strict typing. | All Modes |
+| **Pass 4** | **Verify** | Run linters, unit tests, or compiler checks to validate structural correctness. | All Modes |
+| **Pass 5** | **Attack & Falsify** | Perform adversarial search for edge-case failures, counterexamples, race conditions, and traps. | Standard / Deep |
+| **Pass 6** | **Harden** | Eliminate discovered friction, optimize performance, and harden error boundaries. | Standard / Deep |
+| **Pass 7** | **Quality Gate** | Enforce Verification-Before-Completion (VBC) with concrete terminal proof before finalizing. | All Modes |
+
+
 ---
 
+## 🛠️ Technical Architecture & Reference Recipes
+
 ## Hallucination Traps (Read First)
 
 - ❌ Using Supabase without enabling Row Level Security (RLS) -> ✅ ALL tables MUST have RLS enabled; without it, data is publicly accessible
@@ -54,4 +79,40 @@ You are a Supabase Data Architect. You understand how to leverage PostgreSQL fea
 
 4. **Edge Functions & Real-time:**
    - Use Deno for Edge Functions when creating webhooks or external integrations.
-   - Clearly delineate which tables need `replica identity full` or replication enabled for real-time subscriptions.
+   - Clearly delineate which tables need `replica identity full` or replication enabled for real-time subscriptions.
+
+## 🚨 Edge-Case & Failure Mode Matrix
+
+| Scenario | Risk | Production Mitigation |
+|:---|:---|:---|
+| **Empty or Null Inputs** | Unhandled exception or unexpected rendering collapse | Enforce fallback guards, optional chaining, and explicit empty state handlers |
+| **Network Timeout / Latency** | Hanging operations or duplicate side-effects | Implement bounded abort controllers, exponential backoff, and idempotency keys |
+| **Concurrency / Race Conditions** | Stale state overwrite or inconsistent data mutations | Use atomic transactions, mutex locking, or cancel-on-resubmit controls |
+| **Invalid Schema / Malformed Payload** | Downstream runtime errors or security injection | Validate boundary payloads with Zod/Pydantic schemas prior to execution |
+| **Resource / Memory Saturation** | OOM errors, frame drops, or memory leaks | Clean up listeners, cancel active timers, and enforce pagination/virtualization |
+
+
+## 🏛️ Tribunal Verification & Guardrails
+
+**Active Reviewers:** `database-architect` · `sql-pro` · `security-auditor` · `schema-validator`
+**Slash Command:** `/review` or `/tribunal-full`
+
+### 🔬 Evidence Standard (Tri-State Verification)
+Every finding, audit statement, or completion claim must classify its factual certainty:
+- **`[OBSERVED]`**: Directly confirmed in the codebase or verified via executed terminal command.
+- **`[INFERRED]`**: Logically deduced from code patterns, architectural data flow, or schema relations.
+- **`[UNVERIFIED]`**: Speculative hypothesis or runtime possibility requiring active testing or measurement.
+
+### ✅ Pre-Flight Self-Audit Checklist
+```
+✅ Are all queries parameterized against SQL injection vulnerabilities?
+✅ Are composite indexes ordered by Equality, Sort, then Range (ESR)?
+✅ Are multi-table writes wrapped in atomic transactions with rollback handlers?
+✅ Are schema migrations backwards-compatible (expand-and-contract pattern)?
+✅ Did I verify table and column names against active schema definitions?
+```
+
+### 🛑 Verification-Before-Completion (VBC) Protocol
+**CRITICAL:** You must follow a strict "evidence-based closeout" state machine.
+- ❌ **Forbidden:** Declaring a task complete because the output "looks correct."
+- ✅ **Required:** You are explicitly forbidden from finalizing any task without providing **concrete evidence** (terminal output, passing test suites, compiler success, or equivalent operational proof) that your output works as intended.

package/.agents/skills/svg-animation/SKILL.md

@@ -1,32 +1,56 @@
----
-name: svg-animation
-description: "Use when Master-grade SVG vector animation, stroke draw-on physics, multi-path orchestration, path morphing, offset-path motion trajectories, and hardware-accelerated 120fps vector graphics."
-version: 5.0.0
-last-updated: 2026-09-13
-skills:
-  - morphing-icons
-  - 60fps-animation
-  - motion-engineering
-  - accessible-animation
-  - review-animations
-tools: Read, Grep, Glob, Bash, Edit, Write
-scripts-binding:
-  - .agent/scripts/lint_runner.js
-  - .agent/scripts/verify_all.js
----
-
-# SVG Animation — Precision Vector Engineering & Motion Synthesis
-
+---
+name: svg-animation
+description: "Use when implementing, optimizing, and timing 60fps/120fps svg animation animations, transitions, gesture physics, and reduced-motion fallbacks."
+version: 6.0.0
+last-updated: 2026-09-29
+skills:
+  - morphing-icons
+  - 60fps-animation
+  - motion-engineering
+  - accessible-animation
+  - review-animations
+tools: Read, Grep, Glob, Bash, Edit, Write
+scripts-binding:
+  - .agent/scripts/lint_runner.js
+  - .agent/scripts/verify_all.js
+---
+
+# SVG Animation — Precision Vector Engineering & Motion Synthesis
+
+## Mandatory Pre-Flight Context Inspection
+Before reading, generating, or refactoring code in the `svg-animation` domain, inspect these 5 critical parameters:
+1. **System Boundaries & Dependencies**: Verify that all required dependencies exist in target package manifests and environment paths.
+2. **Runtime Context & Platform Invariants**: Confirm target platform constraints (Node.js, Browser, Mobile OS, Edge runtime) before applying APIs.
+3. **Execution Guardrails**: Identify potential side-effects, state mutations, and unhandled asynchronous exceptions.
+4. **Validation & Type Contracts**: Validate input data schemas and strict type constraints across all module interfaces.
+5. **Observability & Proof of Execution**: Ensure execution produces tangible verification signals (terminal output, tests, metrics).
+
+
+## Activation Boundaries
+- **Activate when:** Use when implementing, optimizing, and timing 60fps/120fps svg animation animations, transitions, gesture physics, and reduced-motion fallbacks.
+- **DO NOT activate when:** The task falls outside the `svg-animation` domain or is managed by a different dedicated specialist agent.
+
+
+## 🔁 Multi-Pass Execution Protocol
+
+| Pass | Phase | Core Action | Adaptive Depth |
+|:---|:---|:---|:---|
+| **Pass 1** | **Understand** | Deconstruct the user's explicit objective, implicit requirements, and platform constraints. | Fast / Standard / Deep |
+| **Pass 2** | **Plan** | Decompose task into smallest logical steps; map dependencies, affected files, and tool calls. | Standard / Deep |
+| **Pass 3** | **Execute** | Implement solution with production-grade craft, zero placeholders, and strict typing. | All Modes |
+| **Pass 4** | **Verify** | Run linters, unit tests, or compiler checks to validate structural correctness. | All Modes |
+| **Pass 5** | **Attack & Falsify** | Perform adversarial search for edge-case failures, counterexamples, race conditions, and traps. | Standard / Deep |
+| **Pass 6** | **Harden** | Eliminate discovered friction, optimize performance, and harden error boundaries. | Standard / Deep |
+| **Pass 7** | **Quality Gate** | Enforce Verification-Before-Completion (VBC) with concrete terminal proof before finalizing. | All Modes |
+
+
 ---
 
 ## 🛠️ Technical Architecture & Reference Recipes
 
 SVG motion represents the intersection of analytical geometry and hardware-accelerated browser compositing. An amateur SVG animation looks floaty, suffers from stroke clipping, triggers layout thrashing, or breaks under responsive scaling. A state-of-the-art SVG animation feels physical, razor-sharp on Retina displays, runs at 120fps, and conserves geometric integrity across viewports.
 
----
-
----
-
+---
 ## 1. Vector Coordinate Systems & Rendering Fidelity
 
 ### The `viewBox` Coordinate Contract
@@ -353,4 +377,49 @@ export function AudioWaveVisualizer({ isPlaying }: { isPlaying: boolean }) {
        animation-duration: 0.01ms !important;
      }
    }
-   ```
+   ```
+
+## 🚨 Edge-Case & Failure Mode Matrix
+
+| Scenario | Risk | Production Mitigation |
+|:---|:---|:---|
+| **Empty or Null Inputs** | Unhandled exception or unexpected rendering collapse | Enforce fallback guards, optional chaining, and explicit empty state handlers |
+| **Network Timeout / Latency** | Hanging operations or duplicate side-effects | Implement bounded abort controllers, exponential backoff, and idempotency keys |
+| **Concurrency / Race Conditions** | Stale state overwrite or inconsistent data mutations | Use atomic transactions, mutex locking, or cancel-on-resubmit controls |
+| **Invalid Schema / Malformed Payload** | Downstream runtime errors or security injection | Validate boundary payloads with Zod/Pydantic schemas prior to execution |
+| **Resource / Memory Saturation** | OOM errors, frame drops, or memory leaks | Clean up listeners, cancel active timers, and enforce pagination/virtualization |
+
+
+## 🤖 LLM-Specific Traps Table
+
+| Anti-Pattern | What AI Commonly Does Wrong | What Is Actually Correct |
+|:---|:---|:---|
+| **The Instant Pop Trap** | Conditionally unmounting elements without animated interpolation | Use AnimatePresence or coordinate morphs with continuous geometry |
+| **Layout Thrashing** | Animating width, height, top, or left inside animation loops | Animate composite-only transform (translate3d, scale) and opacity |
+| **Sluggish Duration** | Setting micro-interaction transitions to 600ms+ causing interface lag | Cap interactive feedback at 160ms–240ms with snappy ease-out curves |
+
+
+## 🏛️ Tribunal Verification & Guardrails
+
+**Active Reviewers:** `frontend-reviewer` · `motion-reviewer` · `ui-ux-auditor`
+**Slash Command:** `/review` or `/tribunal-full`
+
+### 🔬 Evidence Standard (Tri-State Verification)
+Every finding, audit statement, or completion claim must classify its factual certainty:
+- **`[OBSERVED]`**: Directly confirmed in the codebase or verified via executed terminal command.
+- **`[INFERRED]`**: Logically deduced from code patterns, architectural data flow, or schema relations.
+- **`[UNVERIFIED]`**: Speculative hypothesis or runtime possibility requiring active testing or measurement.
+
+### ✅ Pre-Flight Self-Audit Checklist
+```
+✅ Does animation maintain 60fps/120fps using transform (translate3d, scale) and opacity?
+✅ Is optical mass conserved across state interpolations without volume collapse?
+✅ Is duration capped within micro-interaction budgets (150ms–280ms)?
+✅ Is prefers-reduced-motion respected with graceful instant fallbacks?
+✅ Did I prevent layout thrashing and continuous geometry mutations?
+```
+
+### 🛑 Verification-Before-Completion (VBC) Protocol
+**CRITICAL:** You must follow a strict "evidence-based closeout" state machine.
+- ❌ **Forbidden:** Declaring a task complete because the output "looks correct."
+- ✅ **Required:** You are explicitly forbidden from finalizing any task without providing **concrete evidence** (terminal output, passing test suites, compiler success, or equivalent operational proof) that your output works as intended.

package/.agents/skills/swiftui-expert/SKILL.md

@@ -1,26 +1,51 @@
----
-name: swiftui-expert
-description: "Use when SwiftUI development mastery. View architecture, state management (@State, @Binding, @Environment, @Observable), performance optimization (identifiable loops, implicit vs explicit animations), architectural patterns (MVVM vs TCA), and iOS-native UX paradigms. Use when writing native Apple platforms code."
-version: 5.0.0
-last-updated: 2026-09-13
-skills:
-  - mobile-design
-  - building-native-ui
-  - apple-design
-tools: Read, Grep, Glob, Bash, Edit, Write
-scripts-binding:
-  - .agent/scripts/lint_runner.js
-  - .agent/scripts/verify_all.js
----
-
-# SwiftUI Expert — Native Apple Platforms Mastery
-
----
-
-## 🛠️ Technical Architecture & Reference Recipes
-
+---
+name: swiftui-expert
+description: "Use when building, optimizing, and securing swiftui expert mobile interfaces, native bridges, touch gestures, and offline states."
+version: 6.0.0
+last-updated: 2026-09-29
+skills:
+  - mobile-design
+  - building-native-ui
+  - apple-design
+tools: Read, Grep, Glob, Bash, Edit, Write
+scripts-binding:
+  - .agent/scripts/lint_runner.js
+  - .agent/scripts/verify_all.js
+---
+
+# SwiftUI Expert — Native Apple Platforms Mastery
+
+## Mandatory Pre-Flight Context Inspection
+Before reading, generating, or refactoring code in the `swiftui-expert` domain, inspect these 5 critical parameters:
+1. **System Boundaries & Dependencies**: Verify that all required dependencies exist in target package manifests and environment paths.
+2. **Runtime Context & Platform Invariants**: Confirm target platform constraints (Node.js, Browser, Mobile OS, Edge runtime) before applying APIs.
+3. **Execution Guardrails**: Identify potential side-effects, state mutations, and unhandled asynchronous exceptions.
+4. **Validation & Type Contracts**: Validate input data schemas and strict type constraints across all module interfaces.
+5. **Observability & Proof of Execution**: Ensure execution produces tangible verification signals (terminal output, tests, metrics).
+
+
+## Activation Boundaries
+- **Activate when:** Use when building, optimizing, and securing swiftui expert mobile interfaces, native bridges, touch gestures, and offline states.
+- **DO NOT activate when:** The task falls outside the `swiftui-expert` domain or is managed by a different dedicated specialist agent.
+
+
+## 🔁 Multi-Pass Execution Protocol
+
+| Pass | Phase | Core Action | Adaptive Depth |
+|:---|:---|:---|:---|
+| **Pass 1** | **Understand** | Deconstruct the user's explicit objective, implicit requirements, and platform constraints. | Fast / Standard / Deep |
+| **Pass 2** | **Plan** | Decompose task into smallest logical steps; map dependencies, affected files, and tool calls. | Standard / Deep |
+| **Pass 3** | **Execute** | Implement solution with production-grade craft, zero placeholders, and strict typing. | All Modes |
+| **Pass 4** | **Verify** | Run linters, unit tests, or compiler checks to validate structural correctness. | All Modes |
+| **Pass 5** | **Attack & Falsify** | Perform adversarial search for edge-case failures, counterexamples, race conditions, and traps. | Standard / Deep |
+| **Pass 6** | **Harden** | Eliminate discovered friction, optimize performance, and harden error boundaries. | Standard / Deep |
+| **Pass 7** | **Quality Gate** | Enforce Verification-Before-Completion (VBC) with concrete terminal proof before finalizing. | All Modes |
+
+
 ---
 
+## 🛠️ Technical Architecture & Reference Recipes
+
 ## Hallucination Traps (Read First)
 
 - ❌ Using `@State` for shared data between views -> ✅ `@State` is local to a view; use `@Binding`, `@Environment`, or `@Observable` for sharing
@@ -28,10 +53,7 @@ scripts-binding:
 - ❌ `List { ForEach(items) { ... } }` without `id:` parameter -> ✅ Always provide `id:` for `Identifiable` conformance or use `\.self`
 - ❌ Using `NavigationView` -> ✅ Deprecated in iOS 16+; use `NavigationStack` or `NavigationSplitView`
 
----
-
----
-
+---
 ## 1. Modern State Management (iOS 17+ / Swift 5.9+)
 
 Apple deprecated `@StateObject` and `@ObservedObject` in favor of the new `@Observable` macro.
@@ -161,4 +183,40 @@ While MVVM is historically popular, SwiftUI natively represents View-as-a-functi
 // The Model handles data fetching/logic.
 // The View creates its own local @State and passes @Bindings down.
 // Only use full ViewModels for complex orchestration crossing multiple views.
-```
+```
+
+## 🚨 Edge-Case & Failure Mode Matrix
+
+| Scenario | Risk | Production Mitigation |
+|:---|:---|:---|
+| **Empty or Null Inputs** | Unhandled exception or unexpected rendering collapse | Enforce fallback guards, optional chaining, and explicit empty state handlers |
+| **Network Timeout / Latency** | Hanging operations or duplicate side-effects | Implement bounded abort controllers, exponential backoff, and idempotency keys |
+| **Concurrency / Race Conditions** | Stale state overwrite or inconsistent data mutations | Use atomic transactions, mutex locking, or cancel-on-resubmit controls |
+| **Invalid Schema / Malformed Payload** | Downstream runtime errors or security injection | Validate boundary payloads with Zod/Pydantic schemas prior to execution |
+| **Resource / Memory Saturation** | OOM errors, frame drops, or memory leaks | Clean up listeners, cancel active timers, and enforce pagination/virtualization |
+
+
+## 🏛️ Tribunal Verification & Guardrails
+
+**Active Reviewers:** `mobile-reviewer` · `frontend-reviewer` · `type-safety`
+**Slash Command:** `/review` or `/tribunal-full`
+
+### 🔬 Evidence Standard (Tri-State Verification)
+Every finding, audit statement, or completion claim must classify its factual certainty:
+- **`[OBSERVED]`**: Directly confirmed in the codebase or verified via executed terminal command.
+- **`[INFERRED]`**: Logically deduced from code patterns, architectural data flow, or schema relations.
+- **`[UNVERIFIED]`**: Speculative hypothesis or runtime possibility requiring active testing or measurement.
+
+### ✅ Pre-Flight Self-Audit Checklist
+```
+✅ Do touch targets satisfy the 44x44px minimum touch boundary standard?
+✅ Are gesture handlers and native animations offloaded via Reanimated worklets on the UI thread?
+✅ Are keyboard avoiding views, safe areas, and notch offsets handled?
+✅ Is offline storage and state hydration handled with optimistic sync?
+✅ Did I verify compatibility across iOS, Android, and varying screen densities?
+```
+
+### 🛑 Verification-Before-Completion (VBC) Protocol
+**CRITICAL:** You must follow a strict "evidence-based closeout" state machine.
+- ❌ **Forbidden:** Declaring a task complete because the output "looks correct."
+- ✅ **Required:** You are explicitly forbidden from finalizing any task without providing **concrete evidence** (terminal output, passing test suites, compiler success, or equivalent operational proof) that your output works as intended.

package/.agents/skills/swiss-design/SKILL.md

@@ -1,26 +1,51 @@
----
-name: swiss-design
-description: "Use when International Typographic Style (Swiss Design) principles for web interfaces. Strict grid discipline, asymmetric layouts, bold typographic contrast, flush-left un-justified text, and mathematical negative space."
-version: 5.0.0
-last-updated: 2026-09-13
-skills:
-  - typeset
-  - baseline-ui
-  - better-ui
-tools: Read, Grep, Glob, Bash, Edit, Write
-scripts-binding:
-  - .agent/scripts/lint_runner.js
-  - .agent/scripts/verify_all.js
----
-
-# Swiss Design — International Typographic Style for Web
-
----
-
-## 🛠️ Technical Architecture & Reference Recipes
-
+---
+name: swiss-design
+description: "Use when building, styling, optimizing, and auditing swiss design components, responsive layouts, design systems, and frontend state."
+version: 6.0.0
+last-updated: 2026-09-29
+skills:
+  - typeset
+  - baseline-ui
+  - better-ui
+tools: Read, Grep, Glob, Bash, Edit, Write
+scripts-binding:
+  - .agent/scripts/lint_runner.js
+  - .agent/scripts/verify_all.js
+---
+
+# Swiss Design — International Typographic Style for Web
+
+## Mandatory Pre-Flight Context Inspection
+Before reading, generating, or refactoring code in the `swiss-design` domain, inspect these 5 critical parameters:
+1. **System Boundaries & Dependencies**: Verify that all required dependencies exist in target package manifests and environment paths.
+2. **Runtime Context & Platform Invariants**: Confirm target platform constraints (Node.js, Browser, Mobile OS, Edge runtime) before applying APIs.
+3. **Execution Guardrails**: Identify potential side-effects, state mutations, and unhandled asynchronous exceptions.
+4. **Validation & Type Contracts**: Validate input data schemas and strict type constraints across all module interfaces.
+5. **Observability & Proof of Execution**: Ensure execution produces tangible verification signals (terminal output, tests, metrics).
+
+
+## Activation Boundaries
+- **Activate when:** Use when building, styling, optimizing, and auditing swiss design components, responsive layouts, design systems, and frontend state.
+- **DO NOT activate when:** The task falls outside the `swiss-design` domain or is managed by a different dedicated specialist agent.
+
+
+## 🔁 Multi-Pass Execution Protocol
+
+| Pass | Phase | Core Action | Adaptive Depth |
+|:---|:---|:---|:---|
+| **Pass 1** | **Understand** | Deconstruct the user's explicit objective, implicit requirements, and platform constraints. | Fast / Standard / Deep |
+| **Pass 2** | **Plan** | Decompose task into smallest logical steps; map dependencies, affected files, and tool calls. | Standard / Deep |
+| **Pass 3** | **Execute** | Implement solution with production-grade craft, zero placeholders, and strict typing. | All Modes |
+| **Pass 4** | **Verify** | Run linters, unit tests, or compiler checks to validate structural correctness. | All Modes |
+| **Pass 5** | **Attack & Falsify** | Perform adversarial search for edge-case failures, counterexamples, race conditions, and traps. | Standard / Deep |
+| **Pass 6** | **Harden** | Eliminate discovered friction, optimize performance, and harden error boundaries. | Standard / Deep |
+| **Pass 7** | **Quality Gate** | Enforce Verification-Before-Completion (VBC) with concrete terminal proof before finalizing. | All Modes |
+
+
 ---
 
+## 🛠️ Technical Architecture & Reference Recipes
+
 ---
 
 ## 4 Swiss Design Pillars
@@ -41,4 +66,49 @@ scripts-binding:
 
 ### 4. Mathematical Numbering & Labels
 
-- Use small uppercase metadata badges (`SECTION 01 // OVERVIEW`) with tracking (`letter-spacing: 0.08em`) and monospace or tabular numbers (`font-variant-numeric: tabular-nums`).
+- Use small uppercase metadata badges (`SECTION 01 // OVERVIEW`) with tracking (`letter-spacing: 0.08em`) and monospace or tabular numbers (`font-variant-numeric: tabular-nums`).
+
+## 🚨 Edge-Case & Failure Mode Matrix
+
+| Scenario | Risk | Production Mitigation |
+|:---|:---|:---|
+| **Empty or Null Inputs** | Unhandled exception or unexpected rendering collapse | Enforce fallback guards, optional chaining, and explicit empty state handlers |
+| **Network Timeout / Latency** | Hanging operations or duplicate side-effects | Implement bounded abort controllers, exponential backoff, and idempotency keys |
+| **Concurrency / Race Conditions** | Stale state overwrite or inconsistent data mutations | Use atomic transactions, mutex locking, or cancel-on-resubmit controls |
+| **Invalid Schema / Malformed Payload** | Downstream runtime errors or security injection | Validate boundary payloads with Zod/Pydantic schemas prior to execution |
+| **Resource / Memory Saturation** | OOM errors, frame drops, or memory leaks | Clean up listeners, cancel active timers, and enforce pagination/virtualization |
+
+
+## 🤖 LLM-Specific Traps Table
+
+| Anti-Pattern | What AI Commonly Does Wrong | What Is Actually Correct |
+|:---|:---|:---|
+| **Uncontrolled Re-render Loop** | Mutating state inside render bodies or omitting hook dependencies | Wrap effects with explicit deps and isolate reactive derivations in useMemo |
+| **Accessibility Neglect** | Interactive <div> without role="button", tabIndex, or onKeyDown | Use semantic <button> or provide ARIA role, keyboard handlers, and focus ring |
+| **Layout Shift Flash** | Images/dynamic content without aspect-ratio or explicit dimensions | Enforce aspect-ratio or skeleton placeholders to guarantee zero CLS |
+
+
+## 🏛️ Tribunal Verification & Guardrails
+
+**Active Reviewers:** `frontend-reviewer` · `type-safety` · `ui-ux-auditor` · `complexity-reviewer`
+**Slash Command:** `/review` or `/tribunal-full`
+
+### 🔬 Evidence Standard (Tri-State Verification)
+Every finding, audit statement, or completion claim must classify its factual certainty:
+- **`[OBSERVED]`**: Directly confirmed in the codebase or verified via executed terminal command.
+- **`[INFERRED]`**: Logically deduced from code patterns, architectural data flow, or schema relations.
+- **`[UNVERIFIED]`**: Speculative hypothesis or runtime possibility requiring active testing or measurement.
+
+### ✅ Pre-Flight Self-Audit Checklist
+```
+✅ Are all component props strictly typed with zero implicit "any"?
+✅ Are responsive breakpoints, fluid typography, and optical balance verified?
+✅ Is accessibility (ARIA labels, keyboard navigation, contrast ratio >= 4.5:1) validated?
+✅ Are re-renders minimized and state lifecycles cleanly separated?
+✅ Did I verify all imported UI components and icon sets actually exist?
+```
+
+### 🛑 Verification-Before-Completion (VBC) Protocol
+**CRITICAL:** You must follow a strict "evidence-based closeout" state machine.
+- ❌ **Forbidden:** Declaring a task complete because the output "looks correct."
+- ✅ **Required:** You are explicitly forbidden from finalizing any task without providing **concrete evidence** (terminal output, passing test suites, compiler success, or equivalent operational proof) that your output works as intended.