ultra-builder-pro-cli 0.25.0 → 0.26.0

package/orchestrator/worktree-manager.cjs

@@ -1,282 +0,0 @@
-'use strict';
-
-// Phase 8B.3 — N-concurrent git worktree registry.
-//
-// Wraps session-runner's single-session gitWorktreeAdd/Remove with:
-//   • allocate({repoRoot, sid, baseRef})  — create .ultra/.runtime/worktrees/<sid>
-//   • release({repoRoot, worktree_path})  — remove one
-//   • listActive(repoRoot)                — scan git + filter our domain
-//   • releaseAll(repoRoot)                — batch cleanup (crash recovery)
-//
-// Node single-thread execFileSync naturally serializes git calls, so
-// `.git/config.lock` contention is a non-issue within one process. If the
-// parallel orchestrator (8B.2) ever switches to async git spawning, an
-// async mutex can be layered here without changing the API.
-
-const fs = require('node:fs');
-const path = require('node:path');
-const { execFileSync } = require('node:child_process');
-const Database = require('better-sqlite3');
-
-const runtimePaths = require('../mcp-server/lib/runtime-paths.cjs');
-const gitBootstrap = require('../mcp-server/lib/git-bootstrap.cjs');
-const { SessionRunnerError, _internal } = require('./session-runner.cjs');
-
-const WORKTREE_DOMAIN = path.join(runtimePaths.RUNTIME_RELATIVE_DIR, 'worktrees');
-
-function worktreePath(repoRoot, sid) {
-  _internal.assertSessionId(sid);
-  return _internal.assertManagedWorktreePath(
-    repoRoot,
-    path.join(repoRoot, WORKTREE_DOMAIN, sid),
-    { sid },
-  );
-}
-
-function allocate({ repoRoot, sid, baseRef = 'HEAD' }) {
-  if (!repoRoot) throw new Error('allocate: repoRoot required');
-  if (!sid) throw new Error('allocate: sid required');
-  const authority = runtimePaths.ensureRuntimeState(repoRoot, {
-    admitStorageBoundary: () => gitBootstrap.ensureExistingProjectStorageBoundary(repoRoot),
-  });
-  const wt = worktreePath(repoRoot, sid);
-  _internal.gitWorktreeAdd(repoRoot, wt, baseRef); // throws WORKTREE_FAILED
-  try {
-    _internal.linkAuthorityIntoWorktree(repoRoot, wt, { authority });
-    return { worktree_path: wt, authority_db_path: authority.stateDbPath };
-  } catch (error) {
-    try { fs.rmSync(path.join(wt, '.ultra', '.runtime'), { force: true }); }
-    catch { /* best effort */ }
-    try { _internal.gitWorktreeRemove(repoRoot, wt); }
-    catch { /* original authority error is more actionable */ }
-    throw error;
-  }
-}
-
-function sessionRemovalBlocker(repoRoot, sid, worktreePath) {
-  const dbPath = runtimePaths.pathsFor(repoRoot).stateDbPath;
-  if (!fs.existsSync(dbPath)) return null;
-  const db = new Database(dbPath, { readonly: true, fileMustExist: true });
-  try {
-    const rows = db.prepare(
-      'SELECT sid, status, worktree_path FROM sessions WHERE sid = ?',
-    ).all(sid);
-    for (const row of rows) {
-      let recorded;
-      let requested;
-      try { recorded = fs.realpathSync(row.worktree_path); }
-      catch { recorded = path.resolve(row.worktree_path); }
-      try { requested = fs.realpathSync(worktreePath); }
-      catch { requested = path.resolve(worktreePath); }
-      if (recorded !== requested) {
-        return `session ${sid} is bound to a different worktree`;
-      }
-      if (!['completed', 'crashed'].includes(row.status)) {
-        return `session ${sid} is nonterminal (${row.status})`;
-      }
-    }
-    return null;
-  } finally {
-    db.close();
-  }
-}
-
-function release({ repoRoot, worktree_path, sid = null }) {
-  if (!repoRoot) throw new Error('release: repoRoot required');
-  if (!worktree_path) throw new Error('release: worktree_path required');
-  const expectedSid = sid === null ? path.basename(worktree_path) : sid;
-  _internal.assertSessionId(expectedSid);
-  const managedPath = _internal.assertManagedWorktreePath(
-    repoRoot, worktree_path, { sid: expectedSid },
-  );
-  const sessionBlocker = sessionRemovalBlocker(
-    repoRoot, expectedSid, managedPath,
-  );
-  const integrationBlocker = _internal.worktreeRemovalBlocker(repoRoot, managedPath);
-  const blocker = sessionBlocker || integrationBlocker;
-  if (blocker) {
-    throw new SessionRunnerError(
-      'WORKTREE_NOT_INTEGRATED',
-      `refusing to remove ${managedPath}: ${blocker}`,
-    );
-  }
-  _internal.gitWorktreeRemove(repoRoot, managedPath);
-}
-
-function parsePorcelain(text) {
-  const entries = [];
-  let current = {};
-  for (const raw of text.split('\n')) {
-    const line = raw.trimEnd();
-    if (line.startsWith('worktree ')) {
-      if (current.worktree) entries.push(current);
-      current = { worktree: line.slice('worktree '.length) };
-    } else if (line.startsWith('HEAD ')) {
-      current.head = line.slice('HEAD '.length);
-    } else if (line.startsWith('branch ')) {
-      current.branch = line.slice('branch '.length);
-    } else if (line === 'detached') {
-      current.detached = true;
-    } else if (line === '' && current.worktree) {
-      entries.push(current);
-      current = {};
-    }
-  }
-  if (current.worktree) entries.push(current);
-  return entries;
-}
-
-function gitDiscoveryError(message, cause) {
-  return new SessionRunnerError(
-    'WORKTREE_DISCOVERY_FAILED',
-    `cannot inspect Git worktrees safely: ${message}`,
-    { cause },
-  );
-}
-
-function hasGitMetadata(repoRoot) {
-  let current = path.resolve(repoRoot);
-  while (true) {
-    if (fs.lstatSync(path.join(current, '.git'), { throwIfNoEntry: false })) return true;
-    const parent = path.dirname(current);
-    if (parent === current) return false;
-    current = parent;
-  }
-}
-
-function runGitText(repoRoot, args, execGit) {
-  const value = execGit('git', args, {
-    cwd: repoRoot, stdio: ['ignore', 'pipe', 'pipe'], encoding: 'utf8',
-  });
-  if (typeof value !== 'string' && !Buffer.isBuffer(value)) {
-    throw gitDiscoveryError(`Git returned no output for ${args.join(' ')}`);
-  }
-  return String(value);
-}
-
-function listActive(repoRoot, { execGit = execFileSync } = {}) {
-  const metadataPresent = hasGitMetadata(repoRoot);
-  let inside;
-  try {
-    inside = runGitText(repoRoot, ['rev-parse', '--is-inside-work-tree'], execGit).trim();
-  } catch (error) {
-    const detail = String(error?.stderr || error?.message || error);
-    if (!metadataPresent && /not a git repository/i.test(detail)) return [];
-    if (error instanceof SessionRunnerError) throw error;
-    throw gitDiscoveryError(detail.trim(), error);
-  }
-  if (inside !== 'true') {
-    if (!metadataPresent && inside === 'false') return [];
-    throw gitDiscoveryError(`unexpected repository probe result: ${inside || '(empty)'}`);
-  }
-
-  let out;
-  try {
-    out = runGitText(repoRoot, ['worktree', 'list', '--porcelain'], execGit);
-  } catch (err) {
-    if (err instanceof SessionRunnerError) throw err;
-    throw gitDiscoveryError(String(err?.stderr || err?.message || err).trim(), err);
-  }
-  const rawDomainRoot = _internal.assertManagedWorktreeRoot(repoRoot);
-  // On macOS tmpdir is a symlink (/var → /private/var); git returns realpath.
-  // Canonicalize both sides so prefix matching is robust.
-  const domainRoot = (fs.existsSync(rawDomainRoot)
-    ? fs.realpathSync(rawDomainRoot)
-    : rawDomainRoot) + path.sep;
-  const active = [];
-  for (const entry of parsePorcelain(out)) {
-    if (!entry.worktree) continue;
-    const physical = fs.existsSync(entry.worktree)
-      ? fs.realpathSync(entry.worktree)
-      : path.resolve(entry.worktree);
-    if (!(physical + path.sep).startsWith(domainRoot)) continue;
-    const sid = path.basename(entry.worktree);
-    const canonical = _internal.assertManagedWorktreePath(
-      repoRoot, entry.worktree, { sid },
-    );
-    active.push({
-      sid,
-      worktree_path: canonical,
-      head: entry.head || null,
-      branch: entry.branch || null,
-      detached: !!entry.detached,
-    });
-  }
-  return active;
-}
-
-function releaseAll(repoRoot, options = {}) {
-  const active = listActive(repoRoot, options);
-  const releaseWorktree = options.releaseWorktree || release;
-  let cleaned = 0;
-  const protectedSids = new Set();
-  const preserved = [];
-  const quarantined = [];
-  for (const entry of active) {
-    try {
-      releaseWorktree({
-        repoRoot,
-        worktree_path: entry.worktree_path,
-        sid: entry.sid,
-      });
-      cleaned += 1;
-    } catch (err) {
-      protectedSids.add(entry.sid);
-      preserved.push({
-        sid: entry.sid,
-        worktree_path: entry.worktree_path,
-        reason: err.message,
-      });
-      // Best-effort: one bad worktree shouldn't stop the sweep.
-      process.stderr.write(`worktree-manager: release(${entry.sid}) failed: ${err.message}\n`);
-    }
-  }
-  // Filesystem entries Git no longer owns are recovery evidence, not trash.
-  // Move real managed children atomically into quarantine and report the path.
-  const domainRoot = path.join(repoRoot, WORKTREE_DOMAIN);
-  if (fs.existsSync(domainRoot)) {
-    for (const name of fs.readdirSync(domainRoot)) {
-      const full = path.join(domainRoot, name);
-      try {
-        if (protectedSids.has(name)) continue;
-        _internal.assertSessionId(name);
-        const managedPath = _internal.assertManagedWorktreePath(
-          repoRoot, full, { sid: name },
-        );
-        const recoveryRoot = path.join(
-          runtimePaths.pathsFor(repoRoot).runtimeDir,
-          'recovery',
-          'worktrees',
-        );
-        fs.mkdirSync(recoveryRoot, { recursive: true });
-        const token = new Date().toISOString().replace(/[:.]/g, '-');
-        let recoveryPath = path.join(recoveryRoot, `${token}-${name}`);
-        let attempt = 0;
-        while (fs.lstatSync(recoveryPath, { throwIfNoEntry: false })) {
-          attempt += 1;
-          recoveryPath = path.join(recoveryRoot, `${token}-${name}-${attempt}`);
-        }
-        fs.renameSync(managedPath, recoveryPath);
-        quarantined.push({
-          sid: name,
-          source_path: managedPath,
-          recovery_path: recoveryPath,
-        });
-      }
-      catch (err) {
-        preserved.push({ sid: name, worktree_path: full, reason: err.message });
-        process.stderr.write(`worktree-manager: orphan sweep failed for ${full}: ${err.message}\n`);
-      }
-    }
-  }
-  return { cleaned, preserved, quarantined };
-}
-
-module.exports = {
-  allocate,
-  release,
-  listActive,
-  releaseAll,
-  worktreePath,
-  WORKTREE_DOMAIN,
-};

package/settings.json

@@ -1,7 +0,0 @@
-{
-  "_comment": "Ultra Builder Pro runtime settings. Host hooks and plugin permissions live in each native plugin manifest.",
-  "cleanupPeriodDays": 30,
-  "orchestrator": {
-    "auto_dispatch": false
-  }
-}

package/skills/cc-collab/SKILL.md

@@ -1,42 +0,0 @@
----
-name: cc-collab
-description: Ask Claude Code for an independent read-only analysis of a bounded architecture, diagnosis, or review question. Use only when the user explicitly requests Claude Code or CC collaboration and the current host remains primary.
----
-
-# Consult Claude Code read-only
-
-Treat Claude Code as an untrusted advisor. Keep the current host responsible for
-scope, evidence, decisions, edits, and final verification.
-
-## Preconditions
-
-1. Confirm the `claude` CLI and authentication.
-2. Bound the workspace, files or diff, question, evidence standard, and response shape.
-3. Write the primary host's analysis first when independence matters.
-4. Exclude credentials, unrelated files, and unbounded home-directory access.
-
-## Invocation
-
-Run without mutation or session persistence:
-
-```bash
-claude --safe-mode -p "<bounded prompt>" \
-  --permission-mode plan \
-  --tools "Read,Grep,Glob,Bash" \
-  --output-format text \
-  --no-session-persistence
-```
-
-Store large output under `.ultra/.runtime/collab/<session-id>/claude-output.md`. A missing CLI,
-failed authentication, timeout, or empty response degrades to host-only analysis and
-never blocks the underlying task.
-
-Treat `.ultra/.runtime/collab/` as working scratch, not Ultra authority. Promote only verified
-conclusions into the invoking DB-bound workflow artifact or report.
-
-## Synthesis
-
-Verify consequential claims against the current checkout, runtime, tests, or primary
-documentation. Separate verified agreement, useful dissent, and unsupported claims.
-Explain scope or version differences and return one host-owned conclusion rather than
-a transcript or model vote.

package/skills/code-review-expert/SKILL.md

@@ -1,43 +0,0 @@
----
-name: code-review-expert
-description: Review a bounded diff for consequential correctness, security, integration, and maintainability defects with evidence and precise locations. Use only when assigned to an Ultra review worker or an explicitly requested read-only code review.
----
-
-# Review a bounded code change
-
-Prioritize defects that can change behavior, safety, operability, or delivery. Do not
-fill the report with style preferences or generic best-practice commentary.
-
-## Workflow
-
-1. Establish the exact diff, stated intent, acceptance evidence, current checkout, and
-   relevant repository guidance. If the scope is empty or ambiguous, report that
-   boundary instead of reviewing unrelated history.
-2. Trace changed behavior from a live entry point through state and side effects to a
-   consumer. Read callers, contracts, tests, and error paths needed to prove or refute
-   a finding.
-3. Load focused references only when their scope is present:
-   - `security-rules` for trust or authorization boundaries;
-   - `integration-rules` for cross-component behavior;
-   - `references/correctness-reliability.md` for a concrete behavioral risk;
-   - `references/design-boundaries.md` for a concrete ownership or coupling problem;
-   - `references/removal-plan.md` for code proposed for deletion.
-4. For every candidate finding, state the violated contract, triggering condition,
-   user or system impact, and evidence in the current source. Discard speculative
-   concerns that lack a plausible execution path.
-5. Assign severity from impact and likelihood:
-   - P0: exploitable security issue, data loss, or deterministic critical failure;
-   - P1: material correctness, authorization, reliability, or delivery failure;
-   - P2: bounded maintainability or edge-case defect with concrete future cost;
-   - P3: optional improvement that does not block the accepted outcome.
-6. Deduplicate findings by root cause and order them by severity, path, and line.
-
-## Finding contract
-
-Each finding includes a concise title, severity, tight file and line range,
-trigger, impact, evidence, and smallest complete remediation. Do not request a broad
-rewrite when a local fix satisfies the contract.
-
-If no actionable defect is supported, say so and name the remaining verification or
-coverage gap. Review is read-only unless a separate implementation request explicitly
-authorizes changes.

package/skills/code-review-expert/references/correctness-reliability.md

@@ -1,30 +0,0 @@
-# Correctness and reliability evidence
-
-Read this reference only when the diff changes behavior, state transitions, resource
-use, concurrency, caching, parsing, or failure handling.
-
-## Establish the contract
-
-Identify the input domain, preconditions, observable result, authoritative state, and
-caller-visible failure behavior. Repository code, tests, schemas, runtime configuration,
-and accepted specifications outrank generic conventions.
-
-## Trace material risks
-
-Inspect only risks supported by the changed path:
-
-- boundary values, empty or optional inputs, numeric range, encoding, and ordering;
-- partial writes, lost updates, duplicate execution, retry, idempotency, and rollback;
-- stale caches, key scope, invalidation, and cross-user or cross-tenant isolation;
-- unbounded work, repeated I/O, resource lifetime, timeout, and cancellation;
-- swallowed failures, false success, ambiguous fallback, and missing recovery signals;
-- deployment-time compatibility between readers, writers, clients, and stored data.
-
-A surface pattern is not a finding. Confirm the triggering condition, follow it to an
-observable impact, and check whether a guard or recovery path exists elsewhere.
-
-## Report
-
-State the violated contract, trigger, impact, current source evidence, and smallest
-complete remediation. If scale or concurrency is required to trigger the issue, name
-the evidence-backed operating condition instead of inventing a multiplier.

package/skills/code-review-expert/references/design-boundaries.md

@@ -1,26 +0,0 @@
-# Design boundary evidence
-
-Read this reference only when the diff changes ownership, invariants, public contracts,
-module boundaries, or a recurring variation point.
-
-## Questions grounded in the live path
-
-- Which module owns the invariant and can callers bypass it?
-- Does one authoritative representation exist, or can state diverge across layers?
-- Is the dependency direction compatible with the repository's established boundary?
-- Does a public contract expose implementation details that block a required consumer?
-- Does the change duplicate a domain rule or scatter one accepted change across
-  unrelated owners?
-- Is an abstraction justified by current callers and variants, or only hypothetical
-  future work?
-- Can the behavior be tested and recovered at its public seam?
-
-File size, method length, inheritance, primitive values, data-only types, and branch
-counts are investigation signals. Report them only when they produce a concrete
-correctness, compatibility, testing, recovery, or maintenance cost in this change.
-
-## Remediation
-
-Prefer the smallest boundary correction that restores ownership and the accepted
-contract. Do not prescribe a design pattern, framework, or broad rewrite without
-showing why the existing repository structure cannot satisfy the requirement.

package/skills/code-review-expert/references/removal-plan.md

@@ -1,24 +0,0 @@
-# Removal evidence
-
-Read this reference only when the proposed change deletes or retires code, a contract,
-configuration, data, or a dependency.
-
-## Prove reachability and ownership
-
-Search static references, registrations, dynamic loading, reflection, generated code,
-configuration, feature flags, scripts, documentation, and external interfaces that may
-consume the item. Distinguish no evidence of use from evidence of no use.
-
-## Determine the safe action
-
-Record:
-
-- exact item and owner;
-- current consumers and supporting evidence;
-- compatibility, data, deployment, and operator impact;
-- prerequisites for removal when a consumer or migration remains;
-- focused deletion steps, verification, monitoring, and rollback.
-
-Do not assign urgency from age, naming, or deprecation text alone. Severity follows the
-cost of retaining an actual hazard or deleting a reachable contract. When evidence is
-incomplete, report the missing proof instead of declaring the item safe to remove.

package/skills/codex-collab/SKILL.md

@@ -1,49 +0,0 @@
----
-name: codex-collab
-description: Ask Codex CLI for an independent read-only analysis of a bounded architecture, diagnosis, or review question. Use only when the user explicitly requests Codex collaboration and the current host remains primary.
----
-
-# Consult Codex read-only
-
-Treat Codex as an untrusted advisor. Keep the current host responsible for scope,
-evidence, edits, verification, and the final answer.
-
-## Preconditions
-
-1. Confirm the `codex` CLI and authentication.
-2. Bound the workspace, files or diff, question, evidence standard, and response shape.
-3. Write the primary analysis first when independence matters.
-4. Exclude secrets, unrelated files, and unbounded home-directory access.
-
-## Invocation
-
-Create a session directory under `.ultra/.runtime/collab/`, then run in a read-only sandbox:
-
-```bash
-SESSION_PATH=".ultra/.runtime/collab/$(date +%Y%m%d-%H%M%S)-codex"
-mkdir -p "${SESSION_PATH}"
-codex exec -s read-only \
-  --ephemeral \
-  --ignore-user-config \
-  --ignore-rules \
-  -o "${SESSION_PATH}/codex-output.md" \
-  "<bounded prompt>" \
-  2> "${SESSION_PATH}/codex-error.log"
-```
-
-Do not enable write-capable automation or permission bypass. The isolation flags keep
-the advisory run independent from the user's Codex runtime configuration and rules;
-the normal Codex authentication store remains available.
-
-Treat `.ultra/.runtime/collab/` as working scratch, not Ultra authority. Promote only verified
-conclusions into the invoking DB-bound workflow artifact or report.
-
-## Synthesis
-
-Read output only after the process exits and the file is non-empty. Verify
-consequential claims against the current checkout, runtime, tests, or primary
-documentation. Separate verified agreement, useful dissent, and unsupported claims,
-then return one host-owned conclusion.
-
-If Codex is unavailable, unauthenticated, times out, or returns empty output, report
-the degraded path and continue with primary evidence.

package/skills/codex-collab/evals/evals.json

@@ -1,35 +0,0 @@
-{
-  "skill_name": "codex-collab",
-  "evals": [
-    {
-      "id": "explicit-review",
-      "prompt": "Ask Codex for an independent read-only review of the current diff, then verify its findings yourself.",
-      "should_trigger": true,
-      "assertions": [
-        "Bounds the repository and exact diff before launch",
-        "Runs codex exec with a read-only sandbox and file output",
-        "Treats Codex output as untrusted advisory evidence",
-        "Returns one primary-host conclusion after source verification"
-      ]
-    },
-    {
-      "id": "explicit-decision",
-      "prompt": "Have Codex independently assess whether this service should stay in the monorepo. Do not tell it our current preference.",
-      "should_trigger": true,
-      "assertions": [
-        "Writes the primary analysis first when independence matters",
-        "Does not prime Codex with the primary conclusion",
-        "Explains evidence or assumption differences before synthesis"
-      ]
-    },
-    {
-      "id": "ordinary-review-negative",
-      "prompt": "Review the current diff for correctness and security issues.",
-      "should_trigger": false,
-      "assertions": [
-        "Uses the host's ordinary review workflow",
-        "Does not launch Codex without an explicit user request"
-      ]
-    }
-  ]
-}

package/skills/integration-rules/SKILL.md

@@ -1,32 +0,0 @@
----
-name: integration-rules
-description: Verify that changed components are reachable, contract-compatible, and tested across the boundaries required by the accepted behavior. Use only when an assigned review or implementation slice crosses modules, services, persistence, protocols, or UI seams.
----
-
-# Verify integration and reachability
-
-Prove that new behavior is connected to a real consumer and that data and failures
-cross each boundary according to one contract.
-
-## Procedure
-
-1. Start at the declared public seam or entry point and trace the changed path through
-   domain behavior, state, side effects, and the final consumer.
-2. At each boundary, identify the producer, consumer, data shape, ownership, error
-   semantics, compatibility expectation, and recovery behavior.
-3. Confirm both sides use the same contract or a deliberate adapter. Inspect runtime
-   configuration and registration, not only exported types.
-4. Verify the implementation is reachable in the production path. A module, handler,
-   schema, or component with no caller or registration is incomplete.
-5. Check that tests cross the boundary whose semantics matter and would fail on a
-   producer-consumer mismatch.
-6. For a larger feature, confirm an executable vertical slice exists before broad
-   expansion. The slice may be narrow, but it must use real wiring and observable data.
-7. Inspect partial failure, retry, idempotency, ordering, rollback, and observability
-   when the boundary can leave inconsistent state.
-
-## Finding contract
-
-Report the broken path, mismatched contract, missing consumer, or unverified failure
-mode with exact source evidence and observable impact. Do not flag a horizontal task
-solely by its name when another completed slice already proves the integration.

package/skills/security-rules/SKILL.md

@@ -1,38 +0,0 @@
----
-name: security-rules
-description: Evaluate changed trust boundaries for exploitable input, authorization, secret, data-exposure, and supply-chain failures. Use only when an assigned review scope contains a security-relevant boundary.
----
-
-# Review security-relevant changes
-
-Follow data from an attacker-controlled or less-trusted source to a protected action,
-secret, identity, or output. Report plausible exploit paths, not isolated pattern
-matches.
-
-## Review procedure
-
-1. Identify trust boundaries, protected assets, principals, and state-changing actions
-   in the diff.
-2. Trace input validation, canonicalization, authorization, and output handling through
-   the real call path.
-3. Verify authorization is derived from trusted server state and applies to the
-   requested resource, tenant, or object.
-4. Inspect persistence and command boundaries for injection, unsafe deserialization,
-   path traversal, and unbounded resource use.
-5. Inspect logs, errors, telemetry, and client responses for secret or sensitive-data
-   disclosure.
-6. Inspect changed authentication, cryptography, dependency, file-upload, webhook, and
-   cross-origin behavior when present.
-7. Check the failure path: rate limits, replay or idempotency, partial writes, rollback,
-   and audit evidence where the risk requires them.
-
-## Finding threshold
-
-Report only when the current code supports a triggering input and a meaningful impact.
-Include the source-to-sink path, affected asset, exploit preconditions, and a bounded
-fix. Distinguish a missing defense from a defense implemented elsewhere in the live
-path.
-
-Treat confirmed secret exposure, authorization bypass, injection with material impact,
-and destructive cross-tenant access as blocking. Calibrate other issues from their
-actual reachability and blast radius rather than a fixed pattern-to-severity table.

package/skills/testing-rules/SKILL.md

@@ -1,32 +0,0 @@
----
-name: testing-rules
-description: Review whether changed behavior has meaningful, trustworthy, and proportionate test evidence across its real boundaries. Use only when assigned to a test review or delivery verification scope.
----
-
-# Review test evidence
-
-Evaluate what the tests prove about the accepted behavior. Line coverage and the mere
-presence of a test file are supporting signals, not the contract.
-
-## Procedure
-
-1. Map each changed behavior and acceptance claim to a test or other executable check.
-2. Confirm the test can fail for the intended defect and observes a public or stable
-   contract rather than implementation trivia.
-3. Inspect happy, error, boundary, state-transition, and concurrency cases according to
-   the risk introduced by the diff.
-4. Verify integration seams with the most realistic practical boundary. Prefer real
-   persistence and protocol behavior when their semantics matter.
-5. Accept test doubles at costly, unavailable, or nondeterministic external boundaries
-   when the double preserves the documented contract and the reason is clear.
-6. Flag mocks or fakes only when they bypass the behavior under review, encode a false
-   contract, or make a passing test unrelated to production behavior.
-7. Detect skipped checks, tautological assertions, swallowed failures, non-determinism,
-   weakened expectations, and tests that never reach the changed code.
-
-## Finding contract
-
-Name the unproven behavior, why current evidence is insufficient, the failure that can
-escape, and the smallest test or boundary check that closes the gap. Calibrate severity
-to product risk and reachability; do not impose a universal coverage percentage or a
-single test technology on every repository.