voidmachine 6.0.0 → 7.0.1

package/core-assets/skills/void-autopilot/SKILL.md

@@ -151,7 +151,7 @@ Act on each returned action, then ask again:
 
 | Action | What you do |
 |---|---|
-| `assign` | claim the ticket (In Progress, assigned), run `autopilot fingerprint --before <ticket>`, create or reuse its worktree, spawn its worker |
+| `assign` | claim the ticket (In Progress, assigned), run `autopilot fingerprint --before <ticket>`, create or reuse its worktree, create the controlled mission there with title and full frozen ticket via `void-orchestrate`, hand its ID to the worker |
 | `wait` | nothing; the reason says who is working |
 | `hand-back-to-worker` | give the ticket back to its worker, alive or respawned in the same worktree, with the reason and the pull request; a respawned worker resumes its mission (see Respawning) |
 | `mark-human-wait` | record it in `recent` with its `reason`, which `recent` requires and the recap repeats, put the decision's `humanWaitLabel` on the ticket, comment the reason and detail, free the slot; keep reporting its pull request and footprint, which hold its ground until that pull request merges or closes |
@@ -159,7 +159,7 @@ Act on each returned action, then ask again:
 | `update-branch` | `void-machine autopilot update-branch --pr <n> --head <headSha>`: GitHub merges the base into the branch if its head is still that one; the new head is reviewed before anything merges it |
 | `enable-auto-merge` | `void-machine autopilot arm --ticket <id> --pr <n> --head <headSha>`, on a base with a merge queue: the same guards, then it records the head, arms on exactly that head and reads GitHub back; never `gh pr merge --auto` by hand, never `--admin` |
 | `disable-auto-merge` | `void-machine autopilot disarm --pr <n>`, before the action that follows it for the same ticket; it turns its auto-merge off, then takes it out of the merge queue, and fails while GitHub still shows either; never `gh pr merge --disable-auto` alone, which leaves a queued pull request in the queue |
-| `review` | `void-machine autopilot review --ticket <id> --pr <n> --head <headSha> --round <round> --mission <canonical-id>`; on awaiting-native-review use `void-orchestrate` for the actual reviewer, record canonical receipts, then repeat to collect. The same attempt keeps its 30 minute deadline; failures retain the existing budget |
+| `review` | `void-machine autopilot review --ticket <id> --pr <n> --head <headSha> --round <round> --mission <canonical-id> --worktree <assigned-path>` from the coordinator checkout; on awaiting-native-review use `void-orchestrate` for the actual reviewer, record canonical receipts, then repeat to collect. The same attempt keeps its 30 minute deadline; failures retain the existing budget |
 | `requeue` | the same command, to put an ejected head back in the queue; the kernel bounds how often |
 | `drain` | take nothing new; keep acting on the tickets in flight |
 | `freeze` | stop acting, once the disarms before it succeeded |
@@ -172,8 +172,8 @@ send each back to the agent that produced it.
 **Spawning.** Every worker gets its worktree before it starts, at the durable location the
 doctrine's worktree rule names, reused when its branch already has one. A worker never chooses its
 own checkout and never works in the main one. Compose `void-orchestrate` to choose supported
-native delegation, including the session-host selection policy and the Herdr adapter
-with its central files when applicable. Count writers,
+native delegation and publish its observed worker lifecycle through `agents record`
+under the canonical mission, as `void-orchestrate` defines. Count writers,
 researchers and reviewers against available dispatch capacity; the ticket cap is unchanged.
 An assigned worker executes the unit once, without recursively delegating the complete cycle.
 `liveWorkers` reflects reconciled actual sessions and current evidence, never stale pane hints.
@@ -181,7 +181,8 @@ No permission is widened. Collect results before closure; uncertainty requires r
 
 **Respawning.** A hand-back goes to the same native session that holds the ticket, with the
 reason and pull request as data. Re-read mission, Git and actual session evidence; consult central
-brief/report and fresh Herdr identities only when that adapter is selected. Never a second run
+brief/report and actual native identities. Keep the worker runId until its assignment
+closes, publishing each observed transition through `void-orchestrate`. Never a second run
 beside an existing or uncertain invocation. A missing session is reported; retain its evidence.
 
 A respawned worker resumes; it never starts the ticket again. Its code is in its
@@ -200,13 +201,13 @@ the local config and the files it includes, the stash, tags, notes, remotes, the
 deploy branches, replace refs, `hooks/` and `info/` are one set for every worktree. The upstream
 (`remote`, `merge`) of every branch but the bases and the one that deploys is left out, since units
 in flight set it when they create or push their branch and drop it with a merged one; the bases'
-own settings still count. So start each worktree from
+own settings still count; only regular root `info/refs`, Git’s generated transport cache, is exempt. Start each worktree from
 `origin/<base>` and never move a local base branch while units are in flight. The baseline
 recorded at `assign` is written once: a second `--before` for the same ticket is refused, so a unit
-cannot re-record the state it left as the state it found. It is compared by the coordinator before it
-publishes, with `autopilot fingerprint --after <ticket>`, and again by the kernel before it arms a
-merge. A changed or missing baseline sends the ticket to a human, unpublished; only that person
-deletes the record.
+cannot re-record the state it left as the state it found. `autopilot fingerprint --after <ticket>`
+checks it; the coordinator publishes only through `autopilot publish --ticket <ticket> --head <sha>
+--remote <remote> --branch <branch>`, which couples that guard to the literal SHA push. Never follow
+refusal with direct Git. Human renewal retains evidence; see [publication and recovery](references/publication.md).
 
 **Disarming.** Armed means GitHub merges without anyone acting again: an auto-merge request, or,
 once the checks pass on a base with a merge queue, an entry in that queue and no request at all.
@@ -265,18 +266,19 @@ neither, so a restart loses nothing.
 
 ## Workers
 
-Given: one ticket id, its worktree, its branch, the programme's plan and spec. The worker re-fetches
+Given: one ticket id, its worktree, its branch, its canonical mission ID, the programme's plan and spec. The worker re-fetches
 the complete ticket itself; it never works from a summary.
 
-It runs `void-implement` whole in that worktree, and starts its mission with the ticket id as its
-`--title`, which is how a respawn finds it again. Before any context compaction it writes to the
+It runs `void-implement` whole and `mission dispatch` in that worktree, reusing the mission
+the coordinator created once with `--title <ticket-id> --ticket <full-frozen-ticket>`.
+A respawn retains that identity and its budgets. Before any context compaction it writes to the
 mission what it has done: each specialist result through `mission specialist-event`, each proof
 through `mission verify`, a committed candidate through `mission writer-event`. The journal accepts
 only these typed events, no free note; what is not yet one of them does not survive a respawn, and
 uncommitted edits survive only in the worktree. During development, the coordinator may create or reuse a draft pull request
 for the branch; drafts are permitted for development, never for merge admission. After the worker
-returns its commit and green proofs, the coordinator runs `autopilot fingerprint --after <ticket>`,
-pushes, and must mark the same pull request ready (create one only if absent), then move the ticket
+returns its commit and green proofs, the coordinator runs the guarded `autopilot publish` command
+and must mark the same pull request ready (create one only if absent), then move the ticket
 to In Review. The independent reviewer examines ready pull requests only; an unfinished draft waits.
 Blocking findings come back as a hand-back and are corrected as a batch, per `void-implement`.
 

package/core-assets/skills/void-autopilot/references/publication.md

@@ -0,0 +1,82 @@
+# Guarded publication and human recovery
+
+The coordinator runs from the checkout containing the ticket's original baseline.
+The local candidate branch can belong to another worktree; no checkout movement
+or evidence copy is needed. Workers remain commit-only.
+
+```sh
+void-machine autopilot publish --ticket DEV-42 --head <full-sha> --remote origin --branch fix/dev-42 --json
+```
+
+This checks the explicit local branch against the full SHA and the shared Git
+guard, then pushes that literal SHA to the named remote branch in the same
+command. A base or deploy branch is refused. It does not force push, disable
+hooks, set an upstream, grant review or merge permission, or remove a merge hold.
+Missing, invalid, unreadable and changed fingerprints launch zero pushes. A
+transport error can follow a remote success: inspect the named remote branch
+before a deliberate retry. Never automatically follow a refusal with direct Git.
+
+## Coverage
+
+Policy v4 excludes only a regular file exactly at common-Git-directory `info/refs`.
+Git documents it as generated transport information, rebuilt by
+[`git update-server-info`](https://git-scm.com/docs/git-update-server-info).
+Its creation, update and removal are harmless to this guard. This does not identify
+who created an incident file from its timestamp. `objects/info/packs` is Git's
+other generated output; it is outside the existing fingerprint. `info/packs` is
+not that output and stays guarded. Symlinks, nested `refs`, `info/exclude`,
+`info/attributes`, hooks and their checksums, config/includes, bases, stash, tags,
+notes, remotes and replace refs retain their previous coverage.
+
+Version 3 aggregates the whole info directory, including regular root `info/refs`.
+A retained v3 record is compared against a current reading using that same complete
+v3 policy at both publication checks and in `autopilot next` merge decisions. All nine digests and retained protected branches
+stay authoritative; any drift refuses. No conversion, renewal or baseline write is
+needed for an unchanged v3 state. Versions 1 and 2 remain unsupported.
+
+A v3 aggregate cannot be converted to v4 without historical file contents. Relaxing
+its policy or accepting actual drift still requires the explicit human renewal below.
+`fingerprint --record` reports the current v4 reading for that renewal inspection;
+`fingerprint --after` and publication use the retained policy for comparison.
+
+## Explicit human renewal
+
+Stop publication. Inspect the failure and the actual shared-state changes. A
+person must authorize the exact repair or policy transition and affected candidate;
+the ticket's implementation mandate alone is not that authorization.
+
+```sh
+void-machine autopilot fingerprint --record DEV-42 --json
+```
+
+Retain the output, including `recordDigest`, `currentDigest`, old fingerprint and
+current fingerprint. After the human decision, use those exact digest values:
+
+```sh
+void-machine autopilot fingerprint --renew DEV-42 --head <full-sha> --branch fix/dev-42 \
+  --previous <recordDigest> --expected <currentDigest> \
+  --cause 'Reviewed authorized repair or v3 policy transition' \
+  --decision '<reference to the explicit human decision>' --json
+```
+
+The original `fingerprints/DEV-42.json` remains byte-for-byte intact. The complete
+renewal under `fingerprints/DEV-42.renewals/` retains both fingerprints, predecessor
+digest, branch/SHA, cause and decision. Its atomic creation is the transition;
+there is no separate baseline replacement. Identical replay returns the retained
+record. Conflicting or stale replay and changed observations refuse. Preserve
+all those files: deleting history is not recovery. Renewal changes no review,
+merge hold, merge authorization or deployment permission.
+
+Publication and renewal share `fingerprints/DEV-42.lock`. A competing operation
+refuses immediately. A crashed process may leave that directory: a person must
+establish the owning process ended and inspect retained evidence before removing
+only that abandoned lock. An incomplete canonical record remains blocked and
+must be recovered from retained evidence, never ignored. Unlinked unique temporary
+files are not committed records; retain them for diagnosis after an interrupted write.
+
+The lock coordinates these supported commands in this state directory. It cannot
+serialize direct Git, hooks or other processes, nor prevent malicious edits to
+local evidence. The command rechecks immediately before its side effect and uses
+an immutable commit refspec, but does not claim an atomic snapshot of all Git state
+through network completion. See [Git push](https://git-scm.com/docs/git-push) for
+refspec and hook semantics. Direct Git is outside this guarantee.

package/core-assets/skills/void-code-review/SKILL.md

@@ -147,7 +147,7 @@ and consequence-based findings; it is not proof of correctness by itself.
    verify only the corrections and affected behavior. Reuse unaffected conclusions and proofs;
    never restart the general review. Newly raised blockers must demonstrate a correction
    regression or a concrete defect within the original scope.
-5. Follow `void-implement`'s maximum two correction batches. Incomplete review, resumption and
+5. Follow `void-implement`'s maximum two correction batches. Under `void-autopilot`, its tighter two-total-review-round budget applies (initial plus one corrected head); see `docs/BOUNDED-REVIEWS.md`. Incomplete review, resumption and
    transport repair do not consume or reset that budget. Advisory findings never request a
    correction cycle. At the limit, report unresolved defects with cause and next action.
 Advisory findings never start a correction cycle; stop after acceptance, required proofs and independent review hold.

package/core-assets/skills/void-commit-discipline/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: void-commit-discipline
-description: Conventional Commits + mandatory "why" in body + scope + breaking-change marking. ASCII-only (no em dash, no emoji). Co-author trailer for AI pair. The git log is documentation. Use at every commit.
+description: Conventional Commits + mandatory "why" in body + scope + breaking-change marking. Co-author trailer for AI pair. The git log is documentation. Use at every commit.
 ---
 
 # commit-discipline — voidcorp craftsman edition
@@ -27,7 +27,7 @@ The git log is the project's living narrative. "fix stuff" / "wip" / "asdf" dest
 |---|---|
 | `feat` | New observable behavior (new feature, new endpoint, new component visible to users / consumers) |
 | `fix` | Bug fix. Composes with `void-debug` (the why = the root cause) |
-| `void-refactor` | Structural change without behavior change. Composes with `void-refactor` (named Fowler move) |
+| `refactor` | Structural change without behavior change. Composes with `void-refactor` (named Fowler move) |
 | `test` | Add / modify tests without changing production code. Includes `test: reproduce <bug>` from `void-debug` |
 | `docs` | Documentation only |
 | `chore` | Repo maintenance (config, scripts, tooling) without user-visible effect |
@@ -48,11 +48,11 @@ No invented types (`improve:`, `tweak:`, `cleanup:`). Reach for one of the above
 
 ### Body rules
 
-- Always present for `feat`, `fix`, `void-refactor`, `perf` commits. Optional for trivial `chore` / `style`.
+- Always present for `feat`, `fix`, `refactor`, `perf` commits. Optional for trivial `chore` / `style`.
 - Wrapped at ≤ 72 columns
 - Explains the WHY: rationale, constraint, spec link, root cause
 - Multi-line bullets fine
-- ASCII only — no em dash, no emoji (the harness invariant)
+- Follow the philosophy's prose rule: avoid decorative filler; meaningful punctuation and glyphs are allowed.
 
 ### Footers
 
@@ -145,10 +145,6 @@ The author cannot tell, the reviewer cannot tell, future maintainers cannot tell
 
 The companion hook `tidying-commit-prefix` (already shipped) flags `refactor:` with behavior-change keywords in body.
 
-### Em dash, emoji, non-ASCII
-
-The harness invariant: English ASCII commit messages. Hyphens (`-`) for ranges, hyphens for parenthetical, not em dash. The companion hook `no-emdash-no-emoji-in-commit-msg` blocks.
-
 ### Missing "why" for substantive commits
 
 `feat:` / `fix:` / `refactor:` / `perf:` without a body explaining why = rejected. The commit message is documentation.
@@ -174,7 +170,6 @@ prove that chronology. Retain the actual test commands/results and explain the r
 - `commitlint-precommit` (commit-msg, in `pack-monorepo`) — already in void-starter. Enforces conventional commits.
 - `tidying-commit-prefix` (commit-msg, already shipped in core/hooks) — warns on mixed-intent `refactor:` commits.
 - `refactor-named-grep` (commit-msg, already shipped) — warns on `refactor:` without a Fowler name.
-- `no-emdash-no-emoji-in-commit-msg` (commit-msg, in `pack-monorepo`) — blocks em dash and emoji.
 
 ---
 
@@ -192,7 +187,6 @@ prove that chronology. Retain the actual test commands/results and explain the r
 
 - MUST NOT decide whether the change itself is correct (that is the upstream skills' job).
 - MUST NOT permit vacuous subjects.
-- MUST NOT permit em dash / emoji / non-ASCII.
 - MUST NOT permit `feat:` / `fix:` / `refactor:` without a body why.
 - MUST NOT substitute phase commit messages for observed RED/GREEN evidence.
 - MUST NOT silently allow invented commit types.
@@ -202,7 +196,7 @@ prove that chronology. Retain the actual test commands/results and explain the r
 ## Final rule
 
 ```
-Every commit → conventional format + imperative subject ≤ 72 + body explains WHY + ASCII + AI co-author trailer.
+Every commit → conventional format + imperative subject ≤ 72 + body explains WHY + AI co-author trailer.
 Substantive (feat/fix/refactor/perf) → body mandatory.
 Otherwise → it is not voidcorp commit-discipline.
 ```

package/core-assets/skills/void-frontend-design/SKILL.md

@@ -19,7 +19,7 @@ Every UI is designed mobile-first AND must reach first-class quality on both vie
 
 - **Layout starts at 360–390px** (iPhone 12 mini → 15 Pro range), progressively enhanced wider.
 - **Never the reverse.** No "desktop-first then squeeze for mobile."
-- **Both viewports screenshot-reviewed before merge** — `viewport-screenshot-gate` hook (shared with `void-accessibility`).
+- **Both viewports screenshot-reviewed before merge** — inspect actual captures; the optional `viewport-screenshot-gate` script only checks PR text.
 - **No mobile-only / desktop-only features** without an explicit decision recorded through the `void-decide` skill.
 - **Performance budget enforced for both**: LCP < 2.5s on slow 4G mobile AND on desktop fiber (measure with the project's perf tooling — Lighthouse CI, WebPageTest, bundlesize).
 
@@ -234,7 +234,7 @@ import { Button } from '@repo/ui';
 
 ## Companion hooks
 
-- `viewport-screenshot-gate` (pre-PR on UI changes, shared with `void-accessibility`) — fails PRs lacking both mobile and desktop screenshots.
+- `viewport-screenshot-gate` (pre-PR on UI changes, shared with `void-accessibility`) — optional PR-text heuristic, not a wired native/CI gate or image validation. Review actual captures.
 - `anti-ai-slop-grep` (pre-commit) — warns on banned copy patterns. Initial list of ~10; grows from `void-learn` harness-gap feedback.
 
 See `../../hooks/`.

package/core-assets/skills/void-hexagonal-architecture/SKILL.md

@@ -31,9 +31,9 @@ The domain decides; the world translates. Ports are interfaces the domain owns.
                      infrastructure (Drizzle, fetch, Resend SDK, ...)
 ```
 
-Read it: the domain depends on its own port interfaces. Adapters depend on the port interfaces and on infrastructure. **Infrastructure NEVER depends on the domain.** Reversing this direction is a Red Flag.
+Read it: the domain depends on its own port interfaces. Adapters depend on the port interfaces and on infrastructure. The domain never imports concrete infrastructure. Adapters may depend on domain-owned ports.
 
-The companion hook `boundary-direction-check` enforces this on every commit.
+Review enforces this architectural direction. The `boundary-direction-check` hook checks declared package dependencies; it does not infer domain/adapters layers from paths.
 
 ---
 
@@ -124,7 +124,7 @@ export function createDrizzleOrdersAdapter(db: Database): OrdersPort {
 
 - Business decisions ("if order total > $1000, set priority")
 - Cross-port coordination ("save to DB AND emit event in one method")
-- Validation beyond type translation (Zod for trust-boundary input lives in use-cases or boundary, not in adapters)
+- Business invariants belong in the domain. Validate untrusted external data at adapter ingress (for example with Zod), before passing typed input to a use-case.
 
 ### The "fat port" smell
 
@@ -231,13 +231,13 @@ Replayable event log is an audit / temporal tool, not a default persistence stra
 
 ### Domain → infrastructure imports
 
-The companion hook blocks. There is no legitimate exception.
+Review rejects this dependency direction; a package-manifest check alone cannot prove internal layer isolation.
 
 ---
 
 ## Companion hooks
 
-- **`boundary-direction-check`** (pre-commit) — greps cross-layer imports forbidden by the architecture (domain → infrastructure / adapters). See `../../hooks/`.
+- **`boundary-direction-check`** (PreToolUse) checks scoped package imports against the nearest package manifest. It does not validate internal layer imports. See `void-dependency-direction` for the pack convention.
 
 ---
 

package/core-assets/skills/void-implement/SKILL.md

@@ -28,6 +28,9 @@ executes it: never delegate this complete workflow again. Tiny direct work and
 capability fallbacks follow that policy without skipping triggered quality gates.
 Preserve one `leadWriterId` through corrections; the coordinator retains user intent
 and decisions. Pass any orchestrator-owned panel contract unchanged.
+For the writer and delegated reviewers, compose `void-orchestrate` to publish
+observed worker lifecycle events in the canonical mission. Display metadata never
+replaces the implementation or independent review receipts below.
 
 ## Optional usage linkage
 
@@ -52,8 +55,10 @@ materializes its runtime-neutral specialist envelopes from the current plan.
 
 1. Keep one `leadWriterId` for implementation and every correction. The implementer owns
    the worktree and code; specialists and the independent reviewer never edit.
-2. Start with `mission start --ticket <ticket>` and follow `mission dispatch --id <mission>
-   --json`. The frozen task and controller own routing, state and correction budget. Normal
+2. Reuse the mission ID the coordinator supplied. The coordinator creates it once from the
+   assigned worktree with `mission start --title <unit> --ticket <full-frozen-ticket> --json`.
+   Run `mission dispatch --id <mission> --json` from that worktree. Never start another mission
+   to repair a refusal. The frozen task and controller own routing, state and correction budget. Normal
    dispatch starts the writer without a compulsory preparation panel. The writer still obtains
    the primary domain specialist advice required by pass 5 before production edits.
    For canonical `invoke-specialists` actions, pass each envelope unchanged through
@@ -78,7 +83,7 @@ materializes its runtime-neutral specialist envelopes from the current plan.
    unaffected conclusions and proofs; invalidate only affected evidence. A new targeted blocker
    must demonstrate a regression from the correction or a defect within the original scope.
    Carry unresolved blockers until an explicit, evidenced resolution; silence is not resolution.
-7. Maximum two correction batches after the initial general review. A batch is submitted
+7. Maximum two correction batches after the initial general review. Under `void-autopilot`, its tighter two-total-review-round budget applies (initial plus one corrected head); see `docs/BOUNDED-REVIEWS.md`. A batch is submitted
    corrections awaiting targeted verification. Agent restart, incomplete review, transport repair
    and mission resumption neither consume a batch nor reset the budget. At the limit, stop
    automatic corrective dispatch, retain history and expose a cause, owner and next action.
@@ -92,8 +97,9 @@ materializes its runtime-neutral specialist envelopes from the current plan.
    prior reviews, resolutions, budgets and effects. Existing attestation-only stops need explicit
    validation of the original review's subject, available provenance and result before recovery;
    never promote a degraded historical result automatically or recreate the mission to bypass it.
-9. Collect the final result before closing an orchestrator-owned agent panel. Keep worktrees,
-   branches and useful proofs on their distinct lifecycle. Panel closure never deletes them.
+9. Collect the final result, then publish the worker terminal state and finished event
+   through `void-orchestrate`. Keep worktrees, branches and useful proofs on their distinct
+   lifecycle. External presentation tools own their surfaces; the harness does not close them.
 
 The CLI and existing Mission Engine implement this bounded cycle. A runtime certification is
 not an additional delivery gate. Concrete independence, permission, isolation, evidence and

package/core-assets/skills/void-observability/SKILL.md

@@ -45,7 +45,7 @@ logger.error({ err, orderId }, 'payment_failed');
 | `error` | Operation failed; user impact |
 | `warn` | Unexpected but handled |
 | `info` | Significant business event |
-| `void-debug` | Developer-time signal |
+| `debug` | Developer-time signal |
 | `trace` | Very granular (rarely committed) |
 
 ---
@@ -110,7 +110,7 @@ The adapter (per `void-hexagonal-architecture`) is where the catch lives. The er
 try { await doSomething(); } catch (e) { /* swallow */ }
 ```
 
-Either log it, or rethrow, or both. `catch (e) {}` is rejected.
+Logging alone does not recover a failed operation. Propagate a typed failure or rethrow; explicit recovery must preserve the caller's contract. Log at the boundary that owns the diagnosis, without duplicating the same failure at every layer.
 
 ---
 
@@ -121,7 +121,7 @@ Majors' rule. Log:
 - User ID (anonymized — `userId: hash(realId)` for Sentry; raw in internal logs only if compliance allows)
 - Org / tenant ID
 - Feature flags active
-- Session ID
+- Non-secret correlation ID (generated for tracing, never an authentication credential)
 - Browser / device / region
 - Business-meaningful tags (plan tier, signup source, conversion path)
 
@@ -184,7 +184,7 @@ Defense in depth. The discipline says "don't log it." The config says "even if y
 ## What NOT to log
 
 - Full request bodies (PII / secrets / massive payloads). Log specific fields with explicit allowlist.
-- Passwords, tokens, API keys, session IDs, JWTs (composes with `void-security-guidance`)
+- Passwords, tokens, API keys, authentication session IDs/cookies, JWTs (composes with `void-security-guidance`)
 - Email addresses unredacted in production logs (consider hashing or partial redaction depending on compliance)
 - Full database rows (PII risk)
 - LLM full prompts / responses (PII + cost) — log token counts and structural metadata, not content