ultra-builder-pro-cli 0.10.0 → 0.11.0

package/skills/ultra-think/SKILL.md

@@ -1,110 +1,51 @@
 ---
 name: ultra-think
-description: "Deep analysis with adversarial reasoning — Evidence-First + Multi-Perspective + Steel-Man + Pre-Mortem + Sensitivity. Produces a recommendation with confidence bounds."
-user-invocable: true
-runtime: all
-cli_fallback: "direct user interaction"
+description: Produce an evidence-bounded recommendation or diagnosis for a consequential technical or product question. Use when the decision has material tradeoffs, uncertainty, or failure risk that benefits from explicit stress testing.
 ---
 
-# ultra-think — Phase 3.6
+# Analyze a consequential question
 
-Reasoning harness for complex decisions / diagnostics / architecture calls.
-Enforces Evidence-First labelling and adversarial stress-tests before issuing
-a recommendation with explicit confidence.
+Use the smallest reasoning structure that resolves the user's actual decision. Answer
+simple questions directly; do not turn every request into a framework exercise.
 
 ## Workflow
 
-### Step 1 — Scope Check
-
-If the problem is ambiguous / underspecified, ask up to **3** clarifying
-questions through the current Host's native user-interaction surface.
-If the problem is simple, **skip the framework**, answer concisely, and mark
-downstream steps `completed` with note `"skipped: simple answer path"`.
-
-### Step 2 — Evidence Gathering
-
-Every factual claim about tech/API/best-practices must be verified via:
-- Repo source (Read/Grep)
-- Official docs (Context7 MCP: `mcp__context7__query-docs`)
-- Community (Exa MCP: `mcp__exa__web_search_exa`)
-- Web search (fallback)
-
-Label each assertion:
-- **Fact** — verified, cite source (URL / file path)
-- **Inference** — deduced from facts (show the derivation chain)
-- **Speculation** — unverified; list verification steps the user can run
-
-**Iron law**: never trade accuracy for speed. Wrong-with-confidence > "I don't know + here's how to check".
-
-### Step 3 — Multi-Perspective Analysis
-
-Generate **≥3 distinct approaches**. For each, apply whichever lenses are relevant:
-- **Technical** — feasibility, scalability, security, maintainability
-- **Business** — value, cost, time-to-market, competitive advantage
-- **User** — needs, experience, edge cases, accessibility
-- **System** — integration, dependencies, emergent behaviors
-
-### Step 4 — Adversarial Stress-Testing
-
-Apply all four techniques:
-
-| Technique | Question |
-|-----------|----------|
-| **Steel Man** | For the option you're inclined to REJECT, build its strongest possible case. What do you discover? |
-| **Pre-Mortem** | Assume the recommended option has failed in 6 months. List the 3 most likely causes. |
-| **Sensitivity** | Which single assumption, if wrong, would reverse your recommendation? |
-| **Second-Order** | What new problems does the recommendation create 6-12 months out? |
-
-### Step 5 — Synthesis
-
-Recommendation with quantified confidence (0-100%) and explicit uncertainty bounds.
-
-## Output Structure (adapt to problem type)
-
-### Problem Statement
-1-2 sentences: core decision + key constraints.
-
-### Analysis
-Deep analysis using relevant lenses from Step 3.
-
-### Options Comparison (skip for diagnostic/investigative problems)
-| Criterion | Weight | Option A | Option B | Option C |
-|-----------|-------:|----------|----------|----------|
-Quantified where possible.
-
-### Adversarial Findings
-- **Strongest counter-argument** (steel man for rejected option)
-- **Pre-mortem top risk** (most likely failure + mitigation)
-- **Assumption sensitivity** (load-bearing assumption)
-
-### Recommendation
-- **Choice**: <option>
-- **Confidence**: <X>% because <rationale>
-- **Key Assumptions**: what must be true
-- **What would change my mind**: specific evidence / outcome
-
-### Verification Plan
-Concrete steps to validate the decision — metrics, tests, time-boxed experiments.
-
-### Next Steps
-Ordered, actionable items.
-
-## MCP → CLI fallback matrix
-
-| Purpose | MCP tool | CLI fallback |
-|---------|----------|--------------|
-| Clarifying questions | none | current Host's native user-interaction surface |
-
-## What this skill DOES NOT do
-
-- Does NOT modify state.db or project files
-- Does NOT implement the recommendation (that's `/ultra-dev` after `/ultra-plan`)
-- Does NOT replace independent review — output is one model's analysis
-
-## Integration
-
-| | |
-|---|---|
-| **Input** | the problem statement in `$ARGUMENTS`, optional repo context via Read/Grep, docs via Context7/Exa |
-| **Output** | structured Markdown report (Chinese per project rule) |
-| **Feeds** | decisions captured in `.ultra/specs/architecture.md` via Dual-Write Mode of `/ultra-dev` |
+1. State the decision, observed symptom, or disputed claim and the constraints that
+   could change the answer. Ask only for missing information that materially affects
+   the result.
+2. Gather evidence from the most authoritative available source:
+   - current checkout and runtime for repository claims;
+   - official primary documentation for product or API behavior;
+   - current web sources for unstable external facts.
+3. Separate verified facts, evidence-backed inferences, and unresolved assumptions.
+   Cite the supporting file, command, runtime result, or source near each consequential
+   claim.
+4. For a decision, compare only credible alternatives. Do not invent a fixed number of
+   options or assign arbitrary numeric scores. Name the criteria that actually drive
+   the choice and explain the tradeoffs.
+5. For a diagnosis, form falsifiable hypotheses and identify the smallest observation
+   that distinguishes them. Do not recommend implementation before the earliest
+   incorrect state is supported by evidence.
+6. Stress-test the leading conclusion with the techniques that fit the problem:
+   - strongest counterargument;
+   - likely failure scenario and recovery;
+   - load-bearing assumption;
+   - meaningful second-order effect.
+7. Return the recommendation or diagnosis, evidence, uncertainty, what would change
+   the conclusion, and the smallest verification step.
+
+## Output
+
+Adapt the response to the question. Include:
+
+- the conclusion first;
+- the decisive evidence and tradeoffs;
+- unresolved uncertainty without false precision;
+- one concrete verification or follow-up action.
+
+Use a comparison table only when several alternatives share the same decision
+criteria. Comparisons are an analysis tool, not a required output section.
+
+This skill is read-only unless the user separately authorizes writing an analysis
+artifact. It does not update Ultra state, implement the recommendation, or replace an
+independent review.

package/skills/ultra-verify/SKILL.md

@@ -1,92 +1,52 @@
 ---
 name: ultra-verify
-description: Run independent two-model verification with the current host as primary and a read-only Codex advisor, then verify and synthesize the evidence.
+description: Run independent two-model verification with the current host as primary and a read-only external advisor, then verify and synthesize both evidence sets. Use only when the user explicitly requests cross-model verification.
 ---
 
-# Ultra Verify — Independent Two-Model Verification
+# Run independent cross-model verification
 
-Claude Code remains primary. It writes the first independent analysis, verifies consequential
-claims, and owns the final answer. Codex is an untrusted read-only advisor. Use this workflow only
-when the user explicitly asks for cross-model verification.
+Claude Code writes the first analysis, verifies consequential claims, and owns the
+final answer. Codex is an untrusted read-only advisor.
 
 ## Modes
 
-- `decision <question>`: architecture or product decision.
-- `diagnose <symptoms>`: independent root-cause hypotheses.
-- `audit <scope>`: evidence-backed findings.
-- `estimate <task>`: estimates with explicit assumptions.
-
-## Preconditions
-
-1. Confirm `codex --version` plus authentication.
-2. Define the exact workspace, question, evidence standard, and response shape.
-3. Do not send secrets, unrelated files, or an unbounded home directory.
-4. Track four steps in the current host plan: primary analysis, advisor launch, completion wait,
-   and verified synthesis.
-
-## 1. Create the session and write the primary view
-
-```bash
-SESSION_ID="$(date +%Y%m%d-%H%M%S)-verify-<mode>"
-SESSION_PATH=".ultra/collab/${SESSION_ID}"
-mkdir -p "${SESSION_PATH}"
-```
-
-Write Claude Code's evidence-backed analysis to `${SESSION_PATH}/claude-analysis.md` before
-reading the advisor output. Record the mode, checkout, scope, and evidence boundary.
-
-## 2. Launch the advisor read-only
-
-Give the advisor the bounded raw question and evidence without the primary conclusion.
-
-```bash
-codex exec -s read-only \
-  -o "${SESSION_PATH}/codex-output.md" \
-  "<bounded prompt>" \
-  2> "${SESSION_PATH}/codex-error.log"
-```
-
-Never enable write-capable automation, danger-full-access, or permission bypass for the advisor.
-
-## 3. Wait for completed output
-
-Run the bundled waiter in an asynchronous or yielded shell session and poll it at bounded
-intervals; never hold one blocking tool call longer than 60 seconds.
-
-```bash
-python3 "$CLAUDE_PLUGIN_ROOT/skills/ultra-verify/scripts/verify_wait.py" \
-  "${SESSION_PATH}" --timeout 1200
-```
-
-The waiter reports the advisor as `complete`, `failed`, `empty`, or `pending`. Read the output only
-after its status is `complete` and the file is non-empty. Preserve the error log when it fails.
-
-## 4. Verify and synthesize
-
-Compare `claude-analysis.md` with `codex-output.md`:
-
-1. Verify claims against the current checkout, tests, runtime, or primary documentation.
-2. Separate verified agreement, useful dissent, and unsupported assertions.
-3. Explain scope, version, and assumption differences before judging the result.
-4. Write `synthesis.md` and `metadata.json`, then return one Claude Code-owned conclusion.
-
-Use `references/confidence-system.md` for evidence-based confidence and
-`references/cross-verify-modes.md` for mode-specific expectations. Model agreement never overrides
-failing tests or authoritative runtime evidence.
-
-## Degraded operation
-
-- Advisor failure: return the primary analysis with an explicit single-source warning.
-- Never block the underlying user task solely because the advisor is absent, unauthenticated, or
-  slow.
-
-## Session files
-
-```text
-.ultra/collab/<SESSION_ID>/
-  claude-analysis.md
-  codex-output.md
-  codex-error.log
-  metadata.json
-  synthesis.md
-```
+- `decision`: one consequential architecture or product choice;
+- `diagnose`: independent root-cause hypotheses;
+- `audit`: evidence-backed findings over a bounded scope;
+- `estimate`: an estimate with explicit assumptions and uncertainty.
+
+## Workflow
+
+1. Confirm the advisor CLI and authentication. Define the exact workspace, question,
+   evidence standard, and response shape. Exclude secrets and unrelated files.
+2. Create `.ultra/collab/<session-id>/` and write the primary host's evidence-backed
+   analysis to `claude-analysis.md` before reading advisor output.
+3. Launch Codex with the raw bounded question and evidence in a read-only sandbox. Do
+   not include the primary conclusion when independence matters:
+
+   ```bash
+   codex exec -s read-only \
+     -a never \
+     --ephemeral \
+     --ignore-user-config \
+     --ignore-rules \
+     -o "${SESSION_PATH}/codex-output.md" \
+     "<bounded prompt>" \
+     2> "${SESSION_PATH}/codex-error.log"
+   ```
+4. Run `scripts/verify_wait.py` resolved relative to this skill directory. Use a
+   yielded or asynchronous shell session and poll at bounded intervals; do not hold a
+   blocking tool call longer than one minute.
+5. Read advisor output only after the waiter reports a complete, non-empty file.
+6. Verify both analyses against the current checkout, tests, runtime, or primary
+   documentation. Explain scope, version, evidence, and assumption differences before
+   judging disagreement.
+7. Write session metadata and a synthesis artifact, then return one host-owned
+   conclusion.
+
+Read `references/cross-verify-modes.md` for mode-specific evidence and
+`references/confidence-system.md` when confidence language is useful. Model agreement
+never overrides failing tests or authoritative runtime evidence.
+
+Advisor failure degrades to the primary analysis with a single-source warning. It does
+not block the user's underlying task.

package/skills/ultra-verify/evals/evals.json

@@ -2,47 +2,44 @@
   "skill_name": "ultra-verify",
   "evals": [
     {
-      "id": 1,
-      "prompt": "/ultra-verify decision 'Should we use PostgreSQL or MongoDB for our new microservice?'",
-      "expected_output": "Claude writes its analysis first, launches Codex read-only, verifies both analyses, and returns one evidence-backed synthesis",
+      "id": "explicit-decision",
+      "prompt": "Run independent cross-model verification on the database choice, with the current host writing its view before the advisor.",
+      "should_trigger": true,
       "assertions": [
-        "Claude writes its own analysis before reading advisor output",
-        "Launches Codex with a read-only sandbox",
-        "Creates a session directory under .ultra/collab/",
+        "Writes the primary analysis before reading advisor output",
+        "Launches the advisor in a read-only sandbox",
+        "Uses a bounded session directory and completion waiter",
         "Verifies consequential claims against authoritative evidence",
-        "Separates verified agreement, useful dissent, and unsupported assertions"
+        "Returns one host-owned synthesis"
       ]
     },
     {
-      "id": 2,
-      "prompt": "/ultra-verify diagnose 'API returns 500 intermittently under load'",
-      "expected_output": "Independent hypotheses are reconciled through discriminating checks and evidence strength",
+      "id": "explicit-diagnosis",
+      "prompt": "Use two independent models to diagnose the intermittent 500 response and reconcile their hypotheses with discriminating checks.",
+      "should_trigger": true,
       "assertions": [
-        "Both analyses provide ranked hypotheses",
-        "Duplicate hypotheses are merged by root cause",
-        "Each retained hypothesis includes a verification step",
-        "Investigation order follows evidence strength and verification cost"
+        "Keeps both initial hypotheses independent",
+        "Deduplicates by root cause after both outputs complete",
+        "Orders verification by evidence and diagnostic value",
+        "Does not decide by model vote"
       ]
     },
     {
-      "id": 3,
-      "prompt": "/ultra-verify audit",
-      "expected_output": "Findings are deduplicated and verified against the current checkout without vote-based severity",
+      "id": "ordinary-analysis-negative",
+      "prompt": "Should this service use PostgreSQL or MongoDB?",
+      "should_trigger": false,
       "assertions": [
-        "Uses the same scope and severity model for both analyses",
-        "Verifies every reported location",
-        "Retains uniquely reported findings when source evidence confirms them",
-        "Severity does not depend on model agreement"
+        "Answers with the ordinary analysis workflow",
+        "Does not launch an external advisor without explicit cross-model intent"
       ]
     },
     {
-      "id": 4,
-      "prompt": "/ultra-verify estimate 'Implement OAuth2 login with two providers'",
-      "expected_output": "Two estimates are reconciled by scope, assumptions, dependencies, and risk",
+      "id": "ordinary-review-negative",
+      "prompt": "Review these changes before I commit.",
+      "should_trigger": false,
       "assertions": [
-        "Both analyses include work breakdowns and assumptions",
-        "Large differences are explained rather than averaged mechanically",
-        "Final range is supported by the reconciled work breakdown"
+        "Uses the standard review workflow",
+        "Does not substitute cross-model verification for native review"
       ]
     }
   ]

package/spec/schemas/command-manifest.schema.json

@@ -1,47 +1,29 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://ultra-builder-pro.dev/spec/command-manifest.schema.json",
-  "title": "Command manifest (frontmatter)",
-  "description": "YAML frontmatter contract for commands/ultra-*.md thin-shell files. Phase 3 薄壳化: 命令文件 ≤ 80 行正文，真实 workflow 放 skills/<name>/SKILL.md。additionalProperties=false (PLAN R19).",
+  "title": "Ultra command launcher frontmatter",
+  "description": "Portable source contract for a thin command launcher. Runtime metadata and workflow procedure belong outside the command file.",
   "type": "object",
-  "required": ["description"],
+  "required": ["description", "workflow-ref"],
   "additionalProperties": false,
   "properties": {
     "description": {
       "type": "string",
       "minLength": 10,
-      "description": "一句话触发描述; 给 runtime 的 skill router / 用户命令列表使用"
+      "maxLength": 240,
+      "description": "Concise user-visible action description."
     },
     "argument-hint": {
       "oneOf": [
         { "type": "string" },
         { "type": "array", "items": { "type": "string" }, "minItems": 1 }
       ],
-      "description": "Claude Code convention: hint shown after slash-command name. Both `argument-hint: [foo]` (YAML array form) and `argument-hint: \"[foo]\"` (string form) are accepted."
-    },
-    "allowed-tools": {
-      "type": "string",
-      "description": "Claude Code convention: comma-separated tool allowlist"
-    },
-    "model": {
-      "type": "string",
-      "enum": ["haiku", "sonnet", "opus"],
-      "description": "Claude Code convention: model routing hint"
+      "description": "Optional host launcher hint; it does not define argument semantics."
     },
     "workflow-ref": {
       "type": "string",
       "pattern": "^@skills/[a-z][a-z0-9\\-]*/SKILL\\.md$",
-      "description": "Phase 3 薄壳关键字段: 指向 skills/<name>/SKILL.md; 存在即表示该命令已迁为薄壳"
-    },
-    "mcp_tools_required": {
-      "type": "array",
-      "items": { "type": "string", "pattern": "^[a-z]+\\.[a-z_]+$" },
-      "uniqueItems": true,
-      "description": "Phase 3+: 命令运行时会调用的 MCP tool 名单; 无 MCP 时走 cli_fallback"
-    },
-    "cli_fallback": {
-      "type": "string",
-      "description": "Phase 3+: MCP 不可达时回退的 ultra-tools 子命令 (e.g. 'init' -> 'ultra-tools init')"
+      "description": "The single Skill that owns this workflow."
     }
   }
 }

package/spec/schemas/skill-manifest.schema.json

@@ -1,94 +1,24 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://ultra-builder-pro.dev/spec/skill-manifest.schema.json",
-  "title": "Skill manifest (frontmatter)",
-  "description": "YAML frontmatter contract for skills/*/SKILL.md. Strict additionalProperties=false: any new field must be added here AND propagated through validate-skills.cjs (PLAN R19 single-source rule).",
+  "title": "Portable Agent Skill frontmatter",
+  "description": "Canonical source contract for skills/*/SKILL.md. Host invocation policy, UI metadata, runtime dependencies, and command hints belong in adapters or host-native metadata, not model instructions.",
   "type": "object",
   "required": ["name", "description"],
   "additionalProperties": false,
   "properties": {
     "name": {
       "type": "string",
-      "pattern": "^[a-z][a-z0-9\\-]*$",
-      "description": "kebab-case slug; matches the directory name"
+      "minLength": 1,
+      "maxLength": 64,
+      "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$",
+      "description": "Portable Agent Skills name; must match the parent directory."
     },
     "description": {
       "type": "string",
       "minLength": 10,
-      "description": "human-readable trigger sentence consumed by the runtime's skill router"
-    },
-    "runtime": {
-      "oneOf": [
-        { "type": "string", "enum": ["claude", "opencode", "codex", "kimi", "all"] },
-        {
-          "type": "array",
-          "items": { "type": "string", "enum": ["claude", "opencode", "codex", "kimi"] },
-          "minItems": 1,
-          "uniqueItems": true
-        }
-      ],
-      "description": "v4.5 — which runtime(s) this skill targets. Defaults to 'all' when absent (Phase 4 adapter installs everywhere)."
-    },
-    "mcp_tools_required": {
-      "type": "array",
-      "items": { "type": "string", "pattern": "^[a-z]+\\.[a-z_]+$" },
-      "uniqueItems": true,
-      "description": "v4.5 — MCP tool names this skill calls; Phase 3+ generators verify availability"
-    },
-    "cli_fallback": {
-      "type": "string",
-      "description": "v4.5 — ultra-tools subcommand to fall back to when MCP unreachable"
-    },
-    "complexity_hint": {
-      "type": "string",
-      "enum": ["haiku", "sonnet", "opus"],
-      "description": "v4.5 — model routing hint (Phase 7+)"
-    },
-    "argument-hint": {
-      "type": "string",
-      "description": "Claude Code convention: hint shown after slash-command name"
-    },
-    "allowed-tools": {
-      "type": "string",
-      "description": "Claude Code convention: comma-separated tool allowlist"
-    },
-    "user-invocable": {
-      "type": "boolean",
-      "description": "Claude Code convention: can the user call this via slash command"
-    },
-    "disable-model-invocation": {
-      "type": "boolean",
-      "description": "Claude Code convention: skill is not auto-invoked by the model"
-    },
-    "context": {
-      "type": "string",
-      "enum": ["fork", "main"],
-      "description": "Claude Code convention: 'fork' isolates skill output from main conversation"
-    },
-    "license": {
-      "type": "string",
-      "description": "third-party skill license (e.g. MIT)"
-    },
-    "metadata": {
-      "type": "object",
-      "additionalProperties": true,
-      "properties": {
-        "author":  { "type": "string" },
-        "version": { "type": "string" }
-      },
-      "description": "third-party metadata block (vercel skills, etc.)"
-    }
-  },
-  "allOf": [
-    {
-      "if": { "required": ["user-invocable"], "properties": { "user-invocable": { "const": true } } },
-      "then": {
-        "not": {
-          "required": ["disable-model-invocation"],
-          "properties": { "disable-model-invocation": { "const": true } }
-        },
-        "errorMessage": "user-invocable=true cannot coexist with disable-model-invocation=true"
-      }
+      "maxLength": 1024,
+      "description": "Concise discovery metadata that states both what the skill does and when to use it."
     }
-  ]
+  }
 }

package/skills/code-review-expert/references/code-quality-checklist.md

@@ -1,112 +0,0 @@
-# Code Quality Checklist
-
-## Error Handling
-
-### Anti-patterns to Flag
-
-- **Swallowed exceptions**: Empty catch blocks or catch with only logging
-  ```javascript
-  try { ... } catch (e) { }  // Silent failure
-  try { ... } catch (e) { console.log(e) }  // Log and forget
-  ```
-- **Overly broad catch**: Catching `Exception`/`Error` base class instead of specific types
-- **Error information leakage**: Stack traces or internal details exposed to users
-- **Missing error handling**: No try-catch around fallible operations (I/O, network, parsing)
-- **Async error handling**: Unhandled promise rejections, missing `.catch()`, no error boundary
-
-### Questions to Ask
-- "What happens when this operation fails?"
-- "Will the caller know something went wrong?"
-- "Is there enough context to debug this error?"
-
----
-
-## Performance & Caching
-
-### CPU-Intensive Operations
-- Expensive operations in hot paths: Regex compilation, JSON parsing, crypto in loops
-- Blocking main thread: Sync I/O, heavy computation without worker/async
-- Unnecessary recomputation: Same calculation done multiple times
-- Missing memoization: Pure functions called repeatedly with same inputs
-
-### Database & I/O
-- **N+1 queries**: Loop that makes a query per item instead of batch
-  ```javascript
-  // Bad: N+1
-  for (const id of ids) {
-    const user = await db.query('SELECT * FROM users WHERE id = ?', id)
-  }
-  // Good: Batch
-  const users = await db.query('SELECT * FROM users WHERE id IN (?)', ids)
-  ```
-- Missing indexes: Queries on unindexed columns
-- Over-fetching: SELECT * when only few columns needed
-- No pagination: Loading entire dataset into memory
-
-### Caching Issues
-- Missing cache for expensive operations: Repeated API calls, DB queries, computations
-- Cache without TTL: Stale data served indefinitely
-- Cache without invalidation strategy: Data updated but cache not cleared
-- Cache key collisions: Insufficient key uniqueness
-- Caching user-specific data globally: Security/privacy issue
-
-### Memory
-- Unbounded collections: Arrays/maps that grow without limit
-- Large object retention: Holding references preventing GC
-- String concatenation in loops: Use StringBuilder/join instead
-- Loading large files entirely: Use streaming instead
-
-### Questions to Ask
-- "What's the time complexity of this operation?"
-- "How does this behave with 10x/100x data?"
-- "Is this result cacheable? Should it be?"
-- "Can this be batched instead of one-by-one?"
-
----
-
-## Boundary Conditions
-
-### Null/Undefined Handling
-- Missing null checks: Accessing properties on potentially null objects
-- Truthy/falsy confusion: `if (value)` when `0` or `""` are valid
-- Optional chaining overuse: `a?.b?.c?.d` hiding structural issues
-- Null vs undefined inconsistency: Mixed usage without clear convention
-
-### Empty Collections
-- Empty array not handled: Code assumes array has items
-- Empty object edge case: `for...in` or `Object.keys` on empty object
-- First/last element access: `arr[0]` or `arr[arr.length-1]` without length check
-
-### Numeric Boundaries
-- Division by zero: Missing check before division
-- Integer overflow: Large numbers exceeding safe integer range
-- Floating point comparison: Using `===` instead of epsilon comparison
-- Negative values: Index or count that shouldn't be negative
-- Off-by-one errors: Loop bounds, array slicing, pagination
-
-### String Boundaries
-- Empty string: Not handled as edge case
-- Whitespace-only string: Passes truthy check but is effectively empty
-- Very long strings: No length limits causing memory/display issues
-- Unicode edge cases: Emoji, RTL text, combining characters
-
-### Common Dangerous Patterns
-```javascript
-// No null check
-const name = user.profile.name
-
-// Array access without check
-const first = items[0]
-
-// Division without check
-const avg = total / count
-
-// Truthy check excludes valid values
-if (value) { ... }  // fails for 0, "", false
-```
-
-### Questions to Ask
-- "What if this is null/undefined?"
-- "What if this collection is empty?"
-- "What's the valid range for this number?"
-- "What happens at the boundaries (0, -1, MAX_INT)?"