tribunal-kit 9.2.5 → 9.2.7

package/.agent/plans/implementation_plan.md

@@ -1,38 +1,44 @@
 # Tribunal Kit Master Implementation Plan (ADR-Lite)
 
 ## 1. Objective Context
+
 Modernize the existing Tribunal Kit framework by integrating Durable Session Logs, a secure Agent Syscall Abstraction (Tribunal OS), Tribunal Instincts (persistent evidence-backed memory), Dynamic Team Mode (DAG-based subagent delegation), and Built-in MCP Integration. The goal is a more reliable, context-efficient, and secure governance harness.
 
 ## 2. Architectural Handoff
+
 - **Stack:** Node.js (CommonJS/ESM hybrid), standard filesystem (`fs`, `path`), Child Processes (`child_process`).
 - **Storage:** Local JSON/JSONL files (no external databases required).
 - **Constraints:** Backwards compatible with existing `.agent` directory structures, skills, and slash commands. Strict security boundary for tool execution (no raw shell executions by agents).
 
 ## 3. Task-Level Interface Contracts
+
 - **`session_logger.js`**:
-  - *Produces*: `logEvent(type, payload)` -> `string` (Event ID). `readEvents()` -> `Array<object>`.
+  - _Produces_: `logEvent(type, payload)` -> `string` (Event ID). `readEvents()` -> `Array<object>`.
 - **`syscall_registry.js`**:
-  - *Produces*: `executeSyscall(toolName, args, context)` -> `Promise<{stdout, stderr, code}>`.
+  - _Produces_: `executeSyscall(toolName, args, context)` -> `Promise<{stdout, stderr, code}>`.
 - **`memory_archivist.js`**:
-  - *Consumes*: `session_logger.readEvents()`.
-  - *Produces*: `instincts.json` schemas.
+  - _Consumes_: `session_logger.readEvents()`.
+  - _Produces_: `instincts.json` schemas.
 - **`swarm_dispatcher.js`**:
-  - *Consumes*: `harness_manager` tool permissions.
-  - *Produces*: DAG execution result (`allSettled` parallel evaluation).
+  - _Consumes_: `harness_manager` tool permissions.
+  - _Produces_: DAG execution result (`allSettled` parallel evaluation).
 - **`mcp_server.js`**:
-  - *Consumes*: `stdio` (JSON-RPC 2.0).
-  - *Produces*: Standard MCP responses routing to `syscall_registry`.
+  - _Consumes_: `stdio` (JSON-RPC 2.0).
+  - _Produces_: Standard MCP responses routing to `syscall_registry`.
 
 ## 4. The Zero-Placeholder Invariant
+
 All implementations will contain concrete Node.js logic with explicit filesystem checks, child process error boundaries, and standard Tribunal Kit `require('./_colors')` integrations. No "TBD" comments are allowed.
 
 ## 5. Dependency Tree Execution Order
+
 1. **Foundation (Wave 1):** Session Logger and Syscall Registry. Cannot execute safe workflows without an event log and isolated execution environment.
 2. **Memory (Wave 2):** Tribunal Instincts. Depends on the Session Logger to extract insights.
 3. **Orchestration (Wave 3):** Team Mode & DAGs. Depends on Syscalls for execution isolation.
 4. **Integration (Wave 4):** MCP Server. Depends on the existing registry and orchestration engine to expose tools externally.
 
 ## 6. File Blueprint
+
 - `[NEW]` `.agent/scripts/session_logger.js`
 - `[NEW]` `.agent/scripts/memory_archivist.js`
 - `[NEW]` `.agent/scripts/syscall_registry.js`
@@ -43,6 +49,7 @@ All implementations will contain concrete Node.js logic with explicit filesystem
 - `[MODIFY]` `test/unit/audit_release.test.js`
 
 ## 7. Verification Protocol
+
 - **Linter & Security:** Code must pass `node .agent/scripts/checklist.js .` with 0 ESLint warnings (`no-unused-vars` strictly handled via `_` prefix) and 0 security scan alerts.
 - **Test Suite:** `npm run test` must exit `0`, proving DAG topological sorts, MCP request handling, and backward compatibility with `pipeline_engine.js`.
 - **Integration:** Booting the `mcp-server.js` manually must respond to `{"jsonrpc":"2.0","method":"resources/list","id":1}`.

package/.agent/plans/task.md

@@ -1,10 +1,12 @@
 # Current Objective: Agent Harness Modernization & Orchestration
 
 ## Pre-Flight
+
 - [x] Dump existing `.agent` directory state
 - [x] Verify current tests pass (Baseline health via `/audit`)
 
 ## Wave 1 (Durable Session Log & Syscall execution)
+
 - [ ] Implement `session_logger.js` (Event-driven persistent JSONL storage)
 - [ ] Implement `syscall_registry.js` (Centralized tool permissions and execution boundaries)
 - [ ] Implement `harness_manager.js` (Syscall integration and process separation)
@@ -12,24 +14,28 @@
 - [ ] Run `npm test` and `/audit`
 
 ## Wave 2 (Tribunal Instincts & Continuous Memory)
+
 - [ ] Implement `memory_archivist.js` (Background extraction of lessons into `instincts.json`)
 - [ ] Define instinct lifecycle and validation logic
 - [ ] Inject instincts into `context_broker.js`
 - [ ] Run `npm test` and `/audit`
 
 ## Wave 3 (Dynamic Team Mode & DAG Orchestration)
+
 - [ ] Refactor `swarm_dispatcher.js` to support topological sorting (`executeDAG`)
 - [ ] Introduce DAG-based workflow parsing (e.g. `kernel-scheduler.md` concepts)
 - [ ] Implement failure recovery and dependency skipping
 - [ ] Run `npm test` and `/audit`
 
 ## Wave 4 (MCP Integration)
+
 - [ ] Implement `mcp_server.js` (JSON-RPC stdio adapter for Tribunal syscalls)
 - [ ] Expose resource listing (`resources/list`) and prompt listing (`prompts/list`)
 - [ ] Add tool execution mapping to `syscall_registry.js`
 - [ ] Run `npm test` and `/audit`
 
 ## Wave 5 (Finalization & Security Audit)
+
 - [ ] Complete final system audit (resolving linting, test counts, unused vars)
 - [ ] Generate final integration tests for MCP and Syscall registries
 - [ ] Produce `final-tribunal-kit-enhancement-audit.md`

package/.agent/routing_index.json

@@ -2,9 +2,9 @@
   "version": "3.0.0",
   "last_updated": "2026-07-30",
   "summary": {
-    "total_agents": 52,
+    "total_agents": 53,
     "total_workflows": 45,
-    "total_skills": 185
+    "total_skills": 186
   },
   "agents": [
     {
@@ -25,6 +25,15 @@
       "description": "OWASP Top 10 security scanner and vulnerability auditor.",
       "trigger_keywords": ["security", "owasp", "injection", "vulnerability", "auth"]
     },
+    {
+      "name": "anti-slop-auditor",
+      "file": "agents/anti-slop-auditor.md",
+      "type": "reviewer",
+      "routing_domain": "frontend",
+      "routing_tier": "specialized",
+      "description": "Anti-slop rules, Purpose-Gates, and Liveliness Dials auditor.",
+      "trigger_keywords": ["anti-slop", "cliche", "generic", "ui audit", "purpose-gate"]
+    },
     {
       "name": "pipeline-reviewer",
       "file": "agents/pipeline-reviewer.md",
@@ -234,8 +243,8 @@
     },
     {
       "name": "agent-organizer",
-      "file": "agents/agent-organizer.md",
-      "type": "specialist",
+      "file": "skills/agent-organizer/SKILL.md",
+      "type": "skill",
       "routing_domain": "orchestration",
       "routing_tier": "expert",
       "description": "Specialist agent ecosystem management and memory distillation.",
@@ -270,8 +279,8 @@
     },
     {
       "name": "react-specialist",
-      "file": "agents/react-specialist.md",
-      "type": "specialist",
+      "file": "skills/react-specialist/SKILL.md",
+      "type": "skill",
       "routing_domain": "frontend",
       "routing_tier": "specialized",
       "description": "React 19, Server Components, Zustand, and TanStack Query.",
@@ -279,8 +288,8 @@
     },
     {
       "name": "nextjs-react-expert",
-      "file": "agents/nextjs-react-expert.md",
-      "type": "specialist",
+      "file": "skills/nextjs-react-expert/SKILL.md",
+      "type": "skill",
       "routing_domain": "frontend",
       "routing_tier": "expert",
       "description": "Next.js 15 App Router, PPR, Server Actions, and Middleware.",
@@ -288,8 +297,8 @@
     },
     {
       "name": "vue-expert",
-      "file": "agents/vue-expert.md",
-      "type": "specialist",
+      "file": "skills/vue-expert/SKILL.md",
+      "type": "skill",
       "routing_domain": "frontend",
       "routing_tier": "specialized",
       "description": "Vue 3.5+, Composition API, Nuxt 4, and Pinia.",
@@ -297,8 +306,8 @@
     },
     {
       "name": "python-pro",
-      "file": "agents/python-pro.md",
-      "type": "specialist",
+      "file": "skills/python-pro/SKILL.md",
+      "type": "skill",
       "routing_domain": "backend",
       "routing_tier": "specialized",
       "description": "Python 3.12+, FastAPI, Pydantic v2, Asyncio, and Pytest.",
@@ -306,8 +315,8 @@
     },
     {
       "name": "rust-pro",
-      "file": "agents/rust-pro.md",
-      "type": "specialist",
+      "file": "skills/rust-pro/SKILL.md",
+      "type": "skill",
       "routing_domain": "backend",
       "routing_tier": "expert",
       "description": "Rust 1.75+, Tokio async, Axum, Serde, and memory safety.",
@@ -315,8 +324,8 @@
     },
     {
       "name": "csharp-developer",
-      "file": "agents/csharp-developer.md",
-      "type": "specialist",
+      "file": "skills/csharp-developer/SKILL.md",
+      "type": "skill",
       "routing_domain": "backend",
       "routing_tier": "specialized",
       "description": "C# 12, .NET 8/9, ASP.NET Core, and Blazor architecture.",
@@ -333,8 +342,8 @@
     },
     {
       "name": "sql-pro",
-      "file": "agents/sql-pro.md",
-      "type": "specialist",
+      "file": "skills/sql-pro/SKILL.md",
+      "type": "skill",
       "routing_domain": "database",
       "routing_tier": "specialized",
       "description": "PostgreSQL, Supabase RLS, and complex analytical SQL.",
@@ -360,8 +369,8 @@
     },
     {
       "name": "platform-engineer",
-      "file": "agents/platform-engineer.md",
-      "type": "specialist",
+      "file": "skills/platform-engineer/SKILL.md",
+      "type": "skill",
       "routing_domain": "devops",
       "routing_tier": "expert",
       "description": "Cloud-native infrastructure, Kubernetes, and Terraform.",
@@ -378,8 +387,8 @@
     },
     {
       "name": "devops-incident-responder",
-      "file": "agents/devops-incident-responder.md",
-      "type": "specialist",
+      "file": "skills/devops-incident-responder/SKILL.md",
+      "type": "skill",
       "routing_domain": "devops",
       "routing_tier": "expert",
       "description": "Production incident root cause investigation and hotfixes.",

package/.agent/rules/GEMINI.md

@@ -221,7 +221,7 @@ The Human Gate is never skipped. No code is written to a file without explicit u
 | Mobile/Cross-platform | logic + security + mobile-reviewer + type-safety + complexity-reviewer                              |
 | CI/CD / DevOps        | pipeline-reviewer + security + dependency + resilience + complexity-reviewer                        |
 | Any domain            | + performance (if optimization)                                                                     |
-| Before merge          | /tribunal-full (all 30 reviewers)                                                                   |
+| Before merge          | /tribunal-full (all 31 reviewers)                                                                   |
 
 ---
 

package/.agent/rules/kernel.md

@@ -46,21 +46,22 @@ Am I importing a package/method that exists?
 
 When you detect code or design requests, apply the specialist agent profile:
 
-| Domain                       | Specialist              |
-| ---------------------------- | ----------------------- |
-| API / server / backend       | `backend-specialist`    |
-| React / Next.js / UI         | `frontend-specialist`   |
-| Database / schema / SQL      | `database-architect`    |
-| Python / FastAPI / Django    | `python-pro`            |
-| Mobile (RN / Flutter)        | `mobile-developer`      |
-| Debugging / errors           | `debugger`              |
-| Security / vulnerabilities   | `security-auditor`      |
-| Performance / optimization   | `performance-optimizer` |
-| DevOps / CI-CD / Docker      | `devops-engineer`       |
-| Test generation              | `test-engineer`         |
-| Architecture / planning      | `project-planner`       |
+| Domain                     | Specialist              |
+| -------------------------- | ----------------------- |
+| API / server / backend     | `backend-specialist`    |
+| React / Next.js / UI       | `frontend-specialist`   |
+| Database / schema / SQL    | `database-architect`    |
+| Python / FastAPI / Django  | `python-pro`            |
+| Mobile (RN / Flutter)      | `mobile-developer`      |
+| Debugging / errors         | `debugger`              |
+| Security / vulnerabilities | `security-auditor`      |
+| Performance / optimization | `performance-optimizer` |
+| DevOps / CI-CD / Docker    | `devops-engineer`       |
+| Test generation            | `test-engineer`         |
+| Architecture / planning    | `project-planner`       |
 
 Always announce the active specialist:
+
 ```
 🤖 Applying knowledge of @[agent-name]...
 ```
@@ -78,9 +79,11 @@ Always announce the active specialist:
 ## 4. Skills & Tool Integration
 
 Tribunal Kit provides 219 deep skill modules located in:
+
 - `./skills/<skill-name>/SKILL.md`
 - `./.agent/skills/<skill-name>/SKILL.md`
 - `./.agents/skills/<skill-name>/SKILL.md`
 
 Full master rules and domain guidelines are available at:
+
 - `./.agent/rules/GEMINI.md`

package/.agent/scripts/_utils.js

@@ -30,6 +30,8 @@ const DEFAULT_SKIP_DIRS = new Set([
   '.svelte-kit',
   '.nuxt',
   '.output',
+  'scratch',
+  'target',
 ]);
 
 // ── Default Source Extensions ───────────────────────────────────────────────
@@ -262,12 +264,15 @@ function normalizeCommand(cmd, platform = process.platform) {
 function runCommand(cmd, args = [], opts = {}) {
   const { spawnSync } = require('child_process');
   const executable = normalizeCommand(cmd);
+  const isCmdShim =
+    process.platform === 'win32' &&
+    (executable.toLowerCase().endsWith('.cmd') || executable.toLowerCase().endsWith('.bat'));
 
   const result = spawnSync(executable, args, {
     encoding: 'utf8',
     timeout: opts.timeout || 120000,
     cwd: opts.cwd || process.cwd(),
-    shell: false,
+    shell: opts.shell !== undefined ? opts.shell : isCmdShim,
     stdio: opts.stdio || 'pipe',
     ...opts,
   });

package/.agent/scripts/ab_json_experiment.js

@@ -0,0 +1,129 @@
+const FIXTURES = [
+  {
+    complexity: 'Low',
+    desc: 'Frontend accessibility issue',
+    reviewer: 'frontend-reviewer',
+    findings: [
+      {
+        severity: 'Minor',
+        loc: 'src/Header.jsx:12',
+        issue: 'Missing alt attribute on img',
+        fix: 'Add descriptive alt text',
+      },
+    ],
+  },
+  {
+    complexity: 'Medium',
+    desc: 'API change missing boundary',
+    reviewer: 'backend-specialist',
+    findings: [
+      {
+        severity: 'Important',
+        loc: 'src/api/users.js:45',
+        issue: 'Pagination logic lacks max boundary check',
+        fix: 'Add Math.min(limit, 100) to prevent denial of service',
+      },
+    ],
+  },
+  {
+    complexity: 'High',
+    desc: 'Authentication bypass risk',
+    reviewer: 'security-auditor',
+    findings: [
+      {
+        severity: 'Critical',
+        loc: 'src/auth.js:23',
+        issue: 'Missing role check before granting admin token',
+        fix: 'Ensure req.user.role === "ADMIN" is validated before signing JWT',
+      },
+      {
+        severity: 'Important',
+        loc: 'src/auth.js:10',
+        issue: 'JWT secret is hardcoded in test environment',
+        fix: 'Use process.env.JWT_SECRET even in tests',
+      },
+    ],
+  },
+];
+
+function generateMarkdown(fixture) {
+  let status = '✅ APPROVED';
+  if (fixture.findings.some(f => f.severity === 'Critical')) status = '❌ REJECTED';
+  else if (fixture.findings.length > 0) status = '⚠️ WARNING';
+
+  let md = `━━━ Verdicts ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n`;
+  md += `${fixture.reviewer}:      ${status}\n\n`;
+
+  if (fixture.findings.length > 0) {
+    md += `━━━ Warnings ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n`;
+    md += `${fixture.reviewer}:\n`;
+    for (const f of fixture.findings) {
+      md += `  ⚠️ ${f.severity} — ${f.loc}: ${f.issue}\n`;
+      md += `  Fix: ${f.fix}\n\n`;
+    }
+  }
+  return md;
+}
+
+function generateJSON(fixture) {
+  let status = 'APPROVED';
+  if (fixture.findings.some(f => f.severity === 'Critical')) status = 'REJECTED';
+  else if (fixture.findings.length > 0) status = 'WARN';
+
+  const obj = {
+    reviewer: fixture.reviewer,
+    status: status,
+    findings: fixture.findings.map(f => ({
+      severity: f.severity,
+      loc: f.loc,
+      issue: f.issue,
+      fix: f.fix,
+    })),
+  };
+  return JSON.stringify([obj], null, 0); // compact JSON array
+}
+
+function estimateTokens(text) {
+  // Rough estimate: ~4 chars per token
+  return Math.ceil(text.length / 4);
+}
+
+function runExperiment() {
+  const results = [];
+
+  for (const fix of FIXTURES) {
+    const md = generateMarkdown(fix);
+    const js = generateJSON(fix);
+
+    const mdTokens = estimateTokens(md);
+    const jsTokens = estimateTokens(js);
+
+    // Simulate parsing latency and reliability
+    const startParse = process.hrtime.bigint();
+    let parsedCount = 0;
+    let parseSuccess = false;
+    try {
+      const parsed = JSON.parse(js);
+      parsedCount = parsed[0].findings.length;
+      parseSuccess = true;
+    } catch (_e) {}
+    const endParse = process.hrtime.bigint();
+    const parseLat = Number(endParse - startParse) / 1e6;
+
+    results.push({
+      desc: fix.desc,
+      md_tokens: mdTokens,
+      js_tokens: jsTokens,
+      tokens_saved: mdTokens - jsTokens,
+      parse_latency_ms: parseLat,
+      findings_preserved_md: fix.findings.length,
+      findings_preserved_js: parsedCount,
+      parse_success: parseSuccess,
+    });
+  }
+
+  console.log('=== A/B EXPERIMENT RESULTS ===');
+  console.table(results);
+}
+
+runExperiment();