vibecoding-devtools 1.0.1

package/installer/third-party.mjs

@@ -0,0 +1,204 @@
+// Third-party planning performs no commands or writes; only fetchEcc downloads the repository.
+import fs from "node:fs";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+
+export const thirdParty = JSON.parse(fs.readFileSync(new URL("./third-party.json", import.meta.url), "utf8"));
+const CLIS = ["claude", "codex", "agy"];
+const providers = { claude: "claude", codex: "codex", agy: "antigravity" };
+const versionOf = (value) => typeof value === "string" ? value.match(/\d+\.\d+\.\d+(?:-[\w.-]+)?/)?.[0] ?? null : null;
+
+// Read install-state only; return ECC records and warnings.
+export function detectThirdParty(home, project = null) {
+  if (!home) throw new Error("detectThirdParty requires home");
+  const result = { ecc: [], warnings: [] };
+  const locations = [["claude", "global", path.join(home, ".claude", "ecc", "install-state.json")]];
+  if (project) locations.push(
+    ["claude", "project", path.join(project, ".claude", "ecc", "install-state.json")],
+  );
+  for (const [cli, scope, file] of locations) {
+    let text;
+    try { text = fs.readFileSync(file, "utf8"); }
+    catch (error) {
+      if (["ENOENT", "ENOTDIR"].includes(error.code)) continue;
+      throw error;
+    }
+    const item = { cli, scope, method: "npx", file, version: null };
+    try {
+      const state = JSON.parse(text.replace(/^\uFEFF/, ""));
+      if (!state || typeof state !== "object" || Array.isArray(state)) throw new Error("object expected");
+      // Numeric schemaVersion or version describes the format rather than the ECC release.
+      item.version = versionOf(state.eccVersion) ?? versionOf(state.packageVersion)
+        ?? versionOf(state.source?.version) ?? versionOf(state.version);
+    } catch (error) {
+      item.error = `Invalid install-state: ${file}: ${error.message}`;
+      result.warnings.push(item.error);
+    }
+    result.ecc.push(item);
+  }
+  return result;
+}
+
+function findPlugin(detection, cli, owner, scope) {
+  const uniqueList = detection.installed?.plugins?.[cli] ?? detection.plugins?.[cli];
+  const items = Array.isArray(uniqueList) ? uniqueList
+    : uniqueList?.state === "known" && Array.isArray(uniqueList.items) ? uniqueList.items : null;
+  if (!items || items.some((item) => typeof item?.installed !== "boolean")) return { known: false };
+  const plugin = items.find((item) => {
+    // User/global plugins are also loaded in projects. Claude calls global scope "user".
+    const pluginScope = item.scope === "user" ? "global" : item.scope;
+    if (!item.installed || (pluginScope && pluginScope !== scope && pluginScope !== "global")) return false;
+    const name = item.id ?? item.name ?? "";
+    return owner === "ecc" ? /\b(?:ecc|everything-claude-code)\b/i.test(name) : /\bimpeccable\b/i.test(name);
+  });
+  return { known: true, plugin };
+}
+
+function hasImpeccableSkill(cli, root, local) {
+  const directories = cli === "claude" ? [".claude"] : cli === "codex" ? [".agents"]
+    : local ? [".agents", ".agent"] : [path.join(".gemini", "config")];
+  return directories.some((directory) => {
+    try { return fs.statSync(path.join(root, directory, "skills", "impeccable", "SKILL.md")).isFile(); }
+    catch (error) {
+      if (["ENOENT", "ENOTDIR"].includes(error.code)) return false;
+      throw error;
+    }
+  });
+}
+
+// Return commands with warnings attached to the list for callers to display.
+// Accept detection.thirdParty or detection.installed.thirdParty.
+// Use previously queried detection.installed.plugins lists without invoking CLIs.
+export function thirdPartyActions(choices, detection = {}, paths = {}) {
+  const { home, project } = paths;
+  if (!home) throw new Error("paths.home is required");
+  if (!["global", "project"].includes(choices.scope)) throw new Error("Invalid scope");
+  const local = choices.scope === "project";
+  if (local && !project) throw new Error("Project scope requires paths.project");
+  const select = (owner) => {
+    const items = [...new Set(choices[owner]?.clis ?? [])];
+    if (items.some((cli) => !CLIS.includes(cli))) throw new Error("Invalid CLI");
+    return CLIS.filter((cli) => items.includes(cli));
+  };
+  const eccClis = select("ecc"), impeccableClis = select("impeccable");
+  if (eccClis.includes("agy")) throw new Error("ECC is not supported on Antigravity");
+  const installed = detection.thirdParty ?? detection.installed?.thirdParty ?? detectThirdParty(home, project);
+  const actions = [];
+  actions.warnings = [...(installed.warnings ?? [])];
+  const npx = (detection.platform ?? process.platform) === "win32" ? "npx.cmd" : "npx";
+  const cwd = project ?? home;
+  const codexHome = path.join(home, ".codex");
+  const preservePlugin = (owner, cli) => {
+    const { plugin } = findPlugin(detection, cli, owner, choices.scope);
+    if (!plugin) return false;
+    const version = versionOf(plugin.version);
+    const pinned = thirdParty[owner].version;
+    const outdated = version && version.localeCompare(pinned, undefined, { numeric: true }) < 0;
+    const description = `${owner} in ${cli} already installed as a plugin (${version ?? "version unknown"}); active method preserved.`;
+    actions.push({ type: "summary", owner, cli, scope: choices.scope, situation: "same",
+      version, method: "plugin", description });
+    actions.warnings.push(description);
+    if (outdated) actions.warnings.push(`${owner} in ${cli} is outdated: installed plugin ${version}, kit pins ${pinned}. Update through the plugin channel; no alternate installation scheduled.`);
+    return true;
+  };
+  const situation = (owner, cli, method) => {
+    const { known, plugin } = findPlugin(detection, cli, owner, choices.scope);
+    if (!known) {
+      const name = owner === "ecc" ? "ECC" : "Impeccable";
+      actions.warnings.push(`Could not confirm whether ${name} is already installed as a plugin in ${cli}; installation blocked.`);
+      return "conflict";
+    }
+    if (plugin) {
+      if (method !== "plugin") {
+        actions.warnings.push(`${owner} in ${cli} already installed as a plugin; active method preserved.`);
+        return "same";
+      }
+      const version = versionOf(typeof plugin === "string" ? plugin : plugin.version);
+      return !version || version === thirdParty[owner].version ? "same" : "update";
+    }
+    const previous = (installed[owner] ?? []).find((i) => i.cli === cli && i.scope === choices.scope);
+    if (!previous) return "new";
+    if (previous.error) return "conflict";
+    if (previous.method && previous.method !== method) {
+      actions.warnings.push(`${owner} in ${cli} already installed through ${previous.method}; active method preserved.`);
+      return "same";
+    }
+    if (!previous.version) actions.warnings.push(`${owner} in ${cli} already installed without a version; installation preserved.`);
+    return !previous.version || previous.version === thirdParty[owner].version ? "same" : "update";
+  };
+  const add = (owner, cli, cmd, args, state, extra = {}) => {
+    actions.push({ type: "command", owner, cli, cmd, args, cwd, env: {}, scope: choices.scope,
+      version: thirdParty[owner].version, situation: state, description: `${owner} in ${cli}`, ...extra });
+  };
+  for (const cli of eccClis) {
+    if (preservePlugin("ecc", cli)) continue;
+    if (cli === "codex" && !fs.existsSync(codexHome)) {
+      actions.warnings.push("Open Codex once and run the installer again to install ECC on Codex.");
+      continue;
+    }
+    const state = situation("ecc", cli, cli === "codex" ? "plugin" : "npx");
+    if (cli === "codex") {
+      const cmd = detection.clis?.find((c) => c.id === cli)?.filePath ?? "codex";
+      const env = { CODEX_HOME: codexHome };
+      add("ecc", cli, cmd, ["plugin", "marketplace", "add", thirdParty.ecc.marketplace], state, { env });
+      add("ecc", cli, cmd, ["plugin", "add", thirdParty.ecc.plugin], state,
+        { env, uninstall: { cmd, args: ["plugin", "remove", thirdParty.ecc.plugin], cwd, env } });
+      if (choices.ecc?.hooks) actions.warnings.push("ECC hooks on Codex require approval in /hooks.");
+      continue;
+    }
+    const hooks = cli === "claude" && choices.ecc?.hooks === true;
+    const modules = [...thirdParty.ecc.modules, ...(hooks ? [thirdParty.ecc.hooksModule] : [])];
+    const target = local ? "claude-project" : "claude";
+    const packageName = `${thirdParty.ecc.packageName}@${thirdParty.ecc.version}`;
+    add("ecc", cli, npx, ["-y", packageName, "install", "--target", target,
+      "--modules", modules.join(","), hooks ? "--enable-hooks" : "--no-hooks"], state,
+    { uninstall: { cmd: npx, args: ["-y", packageName, "uninstall", "--target", target], cwd } });
+  }
+  if (impeccableClis.length) {
+    const packageName = `${thirdParty.impeccable.packageName}@${thirdParty.impeccable.version}`;
+    const manualClis = impeccableClis.filter((cli) => !preservePlugin("impeccable", cli));
+    const missingItems = manualClis.filter((cli) => !hasImpeccableSkill(cli, local ? project : home, local));
+    // Group only CLIs with matching situations to avoid reinstalling an existing provider.
+    const groups = new Map();
+    for (const cli of missingItems.length ? missingItems : manualClis) {
+      const state = missingItems.length ? situation("impeccable", cli, "npx") : "same";
+      if (!groups.has(state)) groups.set(state, []);
+      groups.get(state).push(cli);
+    }
+    if (!groups.size) return actions;
+    const warning = "Impeccable 4.8.0 does not support uninstalling; manually check created files before removing them.";
+    actions.warnings.push(warning);
+    const extra = { cwd: local ? project : home, env: { DO_NOT_TRACK: "1" }, warning };
+    const telemetryState = [...groups.keys()].every((state) => state === "same") ? "same" : "new";
+    add("impeccable", manualClis[0], npx, ["-y", packageName, "telemetry", "off"], telemetryState, extra);
+    for (const [state, clis] of groups) add("impeccable", clis[0], npx,
+      ["-y", packageName, "install", `--providers=${clis.map((cli) => providers[cli]).join(",")}`,
+        local ? "--project" : "--global", "-y",
+        ...(choices.impeccable?.hooks === true ? [] : ["--no-hooks"])], state, { ...extra, clis });
+  }
+  return actions;
+}
+
+// Explicit fetching is separate from planning; cacheDir is the installer cache directory.
+// Return paths.ecc; injected execution keeps tests offline.
+export function fetchEcc(cacheDir, { execute = spawnSync } = {}) {
+  if (!cacheDir) throw new Error("fetchEcc requires cacheDir");
+  const cache = path.resolve(cacheDir);
+  const destination = path.join(cache, `ecc-${thirdParty.ecc.version}`);
+  const run = (args, cwd) => {
+    const r = execute("git", args, { cwd, encoding: "utf8", shell: false, windowsHide: true });
+    if (r.error) throw r.error;
+    if (r.status !== 0) throw new Error(`Failed to fetch ECC: ${r.stderr ?? r.status}`);
+    return String(r.stdout ?? "").trim();
+  };
+  if (fs.existsSync(destination)) {
+    const tag = run(["describe", "--tags", "--exact-match", "HEAD"], destination);
+    if (tag !== thirdParty.ecc.tag || !fs.existsSync(path.join(destination, "rules"))) {
+      throw new Error(`Invalid ECC cache: ${destination}; expected ${thirdParty.ecc.tag} with rules`);
+    }
+    return destination;
+  }
+  fs.mkdirSync(cache, { recursive: true });
+  run(["clone", "--depth", "1", "--branch", thirdParty.ecc.tag, thirdParty.ecc.repository, destination], cache);
+  return destination;
+}

package/npm-shrinkwrap.json

@@ -0,0 +1,80 @@
+{
+  "name": "vibecoding-devtools",
+  "version": "1.0.1",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "vibecoding-devtools",
+      "version": "1.0.1",
+      "license": "MIT",
+      "dependencies": {
+        "@clack/prompts": "1.8.1"
+      },
+      "bin": {
+        "vibecoding-devtools": "installer/cli.mjs"
+      },
+      "engines": {
+        "node": ">=22"
+      }
+    },
+    "node_modules/@clack/core": {
+      "version": "1.5.1",
+      "resolved": "https://registry.npmjs.org/@clack/core/-/core-1.5.1.tgz",
+      "integrity": "sha512-iHTrHA8MtVuLl2TfZySmcKv1qO2PoyC9Z7pfSDozEuV5vtY3/wcOPKJXlqJ5Oq2Cx5DDGQGAMVx6HZfRRoVEbQ==",
+      "license": "MIT",
+      "dependencies": {
+        "fast-wrap-ansi": "^0.2.0",
+        "sisteransi": "^1.0.5"
+      },
+      "engines": {
+        "node": ">= 20.12.0"
+      }
+    },
+    "node_modules/@clack/prompts": {
+      "version": "1.8.1",
+      "resolved": "https://registry.npmjs.org/@clack/prompts/-/prompts-1.8.1.tgz",
+      "integrity": "sha512-dlT1m5e/0yUL0kRNcQn7yGLVThkgbB0Ga/1AmfDDC/8ik6AIiSf2QLQO2zPYvefsHP0aFgxO93cVLCCfDp7kzQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@clack/core": "1.5.1",
+        "fast-string-width": "^3.0.2",
+        "fast-wrap-ansi": "^0.2.0",
+        "sisteransi": "^1.0.5"
+      },
+      "engines": {
+        "node": ">= 20.12.0"
+      }
+    },
+    "node_modules/fast-string-truncated-width": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/fast-string-truncated-width/-/fast-string-truncated-width-3.0.3.tgz",
+      "integrity": "sha512-0jjjIEL6+0jag3l2XWWizO64/aZVtpiGE3t0Zgqxv0DPuxiMjvB3M24fCyhZUO4KomJQPj3LTSUnDP3GpdwC0g==",
+      "license": "MIT"
+    },
+    "node_modules/fast-string-width": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/fast-string-width/-/fast-string-width-3.0.2.tgz",
+      "integrity": "sha512-gX8LrtNEI5hq8DVUfRQMbr5lpaS4nMIWV+7XEbXk2b8kiQIizgnlr12B4dA3ZEx3308ze0O4Q1R+cHts8kyUJg==",
+      "license": "MIT",
+      "dependencies": {
+        "fast-string-truncated-width": "^3.0.2"
+      }
+    },
+    "node_modules/fast-wrap-ansi": {
+      "version": "0.2.2",
+      "resolved": "https://registry.npmjs.org/fast-wrap-ansi/-/fast-wrap-ansi-0.2.2.tgz",
+      "integrity": "sha512-7F2Fl+TjRSenLqlU3UjSH0iyqopqoZIu7eZVpEirP2g1GtWa2G/ecEmBdgz31+Mxr+ELclgg6sokpSFIQiZ02Q==",
+      "license": "MIT",
+      "dependencies": {
+        "fast-string-width": "^3.0.2"
+      }
+    },
+    "node_modules/sisteransi": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/sisteransi/-/sisteransi-1.0.5.tgz",
+      "integrity": "sha512-bLGGlR1QxBcynn2d5YmDX4MGjlZvy2MRBDRNHLJ8VI6l6+9FUiyTFNJ0IveOSP0bcXgVDPRcfGqA0pjaqUpfVg==",
+      "license": "MIT"
+    }
+  }
+}

package/package.json

@@ -0,0 +1,43 @@
+{
+  "name": "vibecoding-devtools",
+  "version": "1.0.1",
+  "description": "Rules, skills, hooks and templates for AI development with Claude Code, Codex and Antigravity.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Or4cu1o/vibecoding-devtools"
+  },
+  "homepage": "https://github.com/Or4cu1o/vibecoding-devtools#readme",
+  "bugs": {
+    "url": "https://github.com/Or4cu1o/vibecoding-devtools/issues"
+  },
+  "type": "module",
+  "files": [
+    "installer/*.mjs",
+    "!installer/*.test.mjs",
+    "installer/third-party.json",
+    "hooks/*.mjs",
+    "!hooks/*.test.mjs",
+    "!hooks/README.md",
+    "hooks/lib/*.mjs",
+    "!hooks/lib/*.test.mjs",
+    "rules/",
+    "skills/",
+    "templates/",
+    "README.md",
+    "LICENSE",
+    "npm-shrinkwrap.json"
+  ],
+  "bin": {
+    "vibecoding-devtools": "installer/cli.mjs"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "scripts": {
+    "test": "node --test \"installer/**/*.test.mjs\" \"hooks/**/*.test.mjs\""
+  },
+  "dependencies": {
+    "@clack/prompts": "1.8.1"
+  }
+}

package/rules/base.md

@@ -0,0 +1,25 @@
+# Base
+
+Apply to every project and risk level. These take precedence over process rules in a conflict.
+
+- **Secrets:** never write, print or commit secrets, tokens or `.env`; use `.env.example`. Before every commit, scan
+  what will be included: `gitleaks git --pre-commit --staged --redact` (without git: `gitleaks dir <files>`).
+- **Changing platforms:** consult official documentation (cloned or referenced in the project) before assuming
+  behavior from memory.
+- **Git:** branch `type/short-name` from main, Conventional Commits, merge commit. Never push directly to main,
+  force-push or rewrite shared history. Push, PR and merge require the owner's OK.
+- **Destructive or external actions** (delete data or repositories, deploy, publish packages, release tags, change
+  CI secrets or GitHub settings): require the owner's explicit OK. Once approved, whoever has the role executes;
+  do not hand the command back to the owner to run.
+- **Dependencies:** use the repository lockfile's package manager (pnpm by default; Python via uv, never global pip).
+  Check license and maintenance before adding a package.
+- **Interface design:** visual decisions belong to impeccable; web engineering rules handle quality, not visual
+  direction.
+- **Verify before claiming:** run lint, typecheck and tests for what you changed, and report failures honestly. Never
+  claim a check you have not observed.
+- **Delegation:** do quick work yourself, as well as work the owner assigned to you. Delegate independent work that
+  benefits from parallel execution, with a short request stating the risk level.
+- **Stop and flag:** if a task seems to require violating an architecture, economy, security or app boundary rule,
+  stop and tell the owner before working around it.
+- **Commits:** one commit per complete unit of work or when switching tasks, not after every edit.
+- **App README:** if an app's structure, role or flow changes, update that app's `README.md` in the same commit.

package/rules/context-on-demand.md

@@ -0,0 +1,25 @@
+---
+paths:
+  - "**/AGENTS.md"
+  - "**/CLAUDE.md"
+  - "**/GEMINI.md"
+  - "**/SKILL.md"
+  - ".claude/rules/**"
+  - ".agents/rules/**"
+---
+
+# Context on demand
+
+- The project's `CLAUDE.md` and `AGENTS.md` are a **routing table**: "if the task involves X, read file Y".
+  Short, always applicable rules stay there; large rules live in their own files and are read only when the task
+  touches their topic.
+- Automatically path-loaded rules (`paths:` in frontmatter) are only for narrow patterns. A pattern like `**/*.py`
+  loads the rule for almost every task; prefer the table or a skill in that case.
+- Long checklists used only at High risk become a **skill**: only the description stays in context, and the body loads
+  when used.
+- **One source** for Claude Code and other agents (Antigravity, Codex). Two manual copies (`.claude/rules` and
+  `.agents/rules`) drift over time; generate one from the other.
+- Official documentation for changing platforms (Discord, payment providers) is cloned or referenced in the
+  repository, with a table row saying when to consult it.
+- The project's risk map belongs in the same table: which folders are High risk (money, accounts, data, secrets,
+  deploy).

package/rules/maestri-messaging.md

@@ -0,0 +1,10 @@
+# Maestri messaging
+
+Applies only when exchanging messages with another agent through Maestri: `maestri ask` (with or without `--batch`) or
+an incoming message starting with `~` followed by a space. Does not apply to `maestri ask --raw`, which sends keys,
+not messages.
+
+- Before sending or replying, load the `maestri-protocol` skill and follow it. If unavailable, tell the user instead
+  of proceeding without it.
+- Every reply to an agent starts with `~ <Your name> | <STATUS> | <ref> | <one-line summary>`. Your name is what appears
+  under `You:` in `maestri list`.

package/rules/maestri-usage.md

@@ -0,0 +1,12 @@
+# Maestri usage
+
+Applies only when you are the Maestro in Maestri coordinating other agents. Details are in the `maestri-budget` skill.
+
+- At recruitment, follow the autonomous launch and limited-agent guidance in the `maestri-agent-cli` skill.
+- Read agent quotas and context only at checkpoints (session start, start or end of a large task, limit warning),
+  loading the `maestri-budget` skill. Otherwise, decide from your `ledger.md`.
+- Results from agents on lightweight models (such as Gemini Flash) are verified before being accepted or reported.
+- Change an agent's model, effort and configuration only at the user's request or for an Antigravity agent marked as
+  managed, and only between tasks.
+- Before an unrelated task, clear the agent's context (command in its CLI reference). Never compact or clear an agent
+  in the middle of a task.

package/rules/model-tiers.md

@@ -0,0 +1,17 @@
+# Models by role and risk
+
+Model names change; this rule uses tiers. The concrete map (which model fills each tier today) belongs in the project
+or the orchestrator configuration.
+
+| Tier | Purpose | Examples |
+|---|---|---|
+| **Fast** | mechanical, high-volume work, Low risk | docs, CHANGELOG, formatting, renames, quick triage before choosing who executes (only keeps or raises risk) |
+| **Standard** | everyday implementation and review, Medium risk | backend, frontend, bug fixes, code and security review |
+| **Deep** | planning and decisions costly to get wrong, High risk | architecture, cross-app contracts, money data schemas, diagnosis of persistent failures |
+
+- **Money, authentication and security never use the fast tier**, including reviews.
+- **Escalation:** when the same task fails twice with the same approach, move up a tier to replan instead of persisting.
+- **Second opinion** (another provider or cheaper model): treat it as a suggestion. If used for High-risk work,
+  validation comes from a deep-tier model.
+- **Frontend requiring visual judgment:** the model the project has validated for design; until validated, standard
+  tier.

package/rules/risk-process.md

@@ -0,0 +1,69 @@
+# Risk-based process
+
+Effort, time and token cost follow the risk of the change. Replacing an image takes minutes; a payment system receives
+full review.
+
+## How to classify
+
+- Whoever requests the work (the orchestrator, or the agent itself when working alone) states the level at the start.
+- The riskiest file in the change determines the level of the whole change.
+- Whoever finds greater risk along the way reports it, and the level rises. It does not fall mid-task without agreement.
+- Triage by a lightweight model only keeps or raises the level, never lowers it.
+- Each project may have its own risk map in `AGENTS.md` (what is High there). The project map overrides this rule.
+
+## Levels
+
+### Low
+
+Images and assets, text, emojis, styling, documentation, versions, log text, dead code removal outside High-risk
+surfaces, and configuration values unrelated to authentication, permissions, CORS, limits, secrets or money.
+
+- No contract, no new tests (unless repository testing rules require them) and no reviewers.
+- Done = green CI + no blocking findings (see **Findings**) + clean secrets scan.
+
+### Medium
+
+Bug fixes and changes to existing behavior that do not touch a High-risk surface.
+
+- The request is the contract: goal, files and completion criteria, in a few lines.
+- Tests follow the `testing` rule.
+- One review: the orchestrator reads the diff. Architecture only if the change crosses modules; security only if it
+  touches a High-risk surface.
+- Done = Low + this review.
+
+### High
+
+Money and value (payments, balances, sales, financial integrations); personal or sensitive data; authentication,
+sessions, permissions and administrative actions; secrets and tokens; external input the system executes or publishes
+for others (injection, mass mentions, malicious links); data migration or deletion; deploy, CI and supply chain.
+
+- Contract of at most one page: behavior, interfaces, owner decisions and a test plan focused on risk.
+- Threat model limited to the sensitive surface, before coding.
+- Tests on risk paths.
+- Architecture, testing and security each review once, in parallel, on the final commit.
+- Money, personal data or authentication: e2e for every touched flow and coverage ≥ 80% on changed code. Such a flow
+  built from scratch: also the full baseline (OWASP ASVS 5.0 L2).
+
+## At every level
+
+- **Parallel by area:** when an item involves independent areas (front, back, infra), each goes to its builder at the
+  same time, with one owner per file. They agree on the shared interface directly, and the orchestrator checks once
+  that the parts fit together. Small changes stay with one builder.
+- **One pass per review**, on the final commit. Review again only if production code in that reviewer's area changed;
+  test-only or docs-only commits do not call anyone back.
+- **Automated review** (CodeRabbit, GitGuardian and similar): wait for completion and fix everything in one submission.
+- **No CI, automated review or reviewers:** run the equivalent locally (lint, typecheck, tests for changed code,
+  secrets scan), perform reviews sequentially and state in the report what could not be verified.
+- **Findings:** every review (human, agent or automated) classifies each finding as **Critical**, **Major**, **Minor**
+  or **Suggestion** (automated review nitpick). Low, Medium and High are task risk levels only, never finding
+  severities. This is the single source of blocking rules; skills and other rules refer here.
+  - **Exposed secret:** always blocks, even if predating the PR. Rotate the secret before proceeding.
+  - **Critical** and **Major** introduced by the PR: always block.
+  - **Minor:** blocks High-risk tasks. At other levels, fix if trivial; otherwise, explain why and send to the backlog.
+  - **Suggestion:** fix if trivial; otherwise, backlog.
+  - **Predating the PR:** Minor and Suggestion go to the backlog without a new cycle. Critical and Major block until
+    the owner decides to fix in the PR or accept the risk, recorded in a private channel, never a public issue.
+- **Loop:** the same fix failing twice returns to the orchestrator, without a third attempt.
+- **Communication:** message only those who need to act; short reports with evidence. To the owner, only decisions,
+  merges, releases and blockers.
+- **CHANGELOG:** the builder writes the entry in their own PR.

package/rules/testing.md

@@ -0,0 +1,53 @@
+# Testing
+
+Tests protect behavior, not freeze structure. This rule replaces generic coverage targets and mandatory TDD
+(for example, ECC's 80% and TDD). Repository testing rules override this one.
+
+## What deserves tests
+
+- Security: authentication, sessions, permissions, secrets and all user input.
+- Money and personal data.
+- Data persistence and migration.
+- Configuration loading (precedence and types).
+- Contracts with external services (APIs, gateways, queues).
+- Pure rules: functions without side effects that make a decision.
+- Real bug regressions: one test per bug.
+
+## Prohibited
+
+- Mass characterization (tests capturing all current behavior).
+- Structural snapshots or golden tests.
+- Tests reading the text of docs, compose, Dockerfiles or workflows.
+- Tests depending on the real clock or `sleep`.
+- Tautological tests that only restate a constant or mock.
+- Multiple tests for the same path changing only the value: use lean parametrization.
+- Mutation testing outside High risk.
+
+## TDD
+
+RED first only for bug fixes and pure rules. Otherwise, test afterward, and only if the item falls under
+"What deserves tests".
+
+## Coverage
+
+- Global repository floor that never drops.
+- Higher floor (for example, 90%) only in the project's listed critical areas (money, authentication, data, pure rules),
+  enforced by a CI step: a PR that reduces coverage in those areas fails.
+- High risk involving money, personal data or authentication: coverage follows the `risk-process` rule.
+- No global target just to raise the number.
+
+## Markers
+
+`smoke` (system starts), `critical` (critical areas) and `regression` (one per real bug). CI runs `smoke` and `critical`
+first and fails early.
+
+## Where to run
+
+- CI runs lint, typecheck and the full suite. Locally, run only tests for what you changed.
+- Multiple agents do not run the same suite on the same commit: CI is the source of truth.
+- Done follows the `risk-process` rule: green CI or, without CI, equivalent local verification.
+
+## Warning sign
+
+On a Low- or Medium-risk item, test lines several times greater than production lines indicate excess. Stop and
+reassess what actually needs testing.