coding-os 0.3.2__py3-none-any.whl

core/rules/dimension-registry.md

@@ -0,0 +1,155 @@
+# Dimension Registry
+
+Auto-generated from all installed stacks. Use during Classify
+phase to build your Read List.
+
+## angular
+
+- **Angular component** (M) → `docs/playbooks/angular-app.md`, `docs/engineering/angular-rules.md`
+- **Route / page** (M) → `docs/playbooks/angular-app.md`, `docs/engineering/angular-rules.md`
+- **Service / state** (M) → `docs/engineering/angular-rules.md`
+- **Accessibility** (M) → `docs/engineering/angular-rules.md`
+
+## aspnet-core
+
+- **ASP.NET Core endpoint** (M) → `docs/playbooks/aspnet-core-service.md`, `docs/engineering/aspnet-core-rules.md`
+- **Service / business logic** (M) → `docs/engineering/aspnet-core-rules.md`
+- **Middleware / DI wiring** (M) → `docs/engineering/aspnet-core-rules.md`
+- **DTO validation** (M) → `docs/engineering/aspnet-core-rules.md`, `docs/api-contracts/error-format.md`
+- **Auth / authorization** (M) → `docs/engineering/aspnet-core-rules.md`
+
+## astro
+
+- **Component / island** (M) → `docs/playbooks/astro-app.md`, `docs/engineering/astro-rules.md`
+- **Page / route** (M) → `docs/playbooks/astro-app.md`, `docs/engineering/astro-rules.md`
+- **Content / SEO collection** (M) → `docs/playbooks/astro-app.md`, `docs/engineering/astro-rules.md`
+
+## django
+
+- **Django model / schema** (M) → `docs/engineering/backend-rules.md`, `docs/playbooks/backend-api.md`
+- **DRF endpoint** (M) → `docs/playbooks/backend-api.md`, `docs/api-contracts/error-format.md`
+- **Auth / permissions** (M) → `docs/playbooks/security-review.md`
+
+## fastapi
+
+- **API endpoint** (M) → `docs/playbooks/fastapi-service.md`, `docs/engineering/fastapi-rules.md`
+- **Pydantic model** (M) → `docs/engineering/fastapi-rules.md`
+
+## flutter
+
+- **Flutter screen** (M) → `docs/playbooks/flutter-app.md`, `docs/engineering/flutter-rules.md`
+- **Flutter component** (M) → `docs/engineering/flutter-rules.md`
+- **State / provider** (M) → `docs/engineering/flutter-rules.md`, `docs/playbooks/flutter-app.md`
+- **Navigation / route** (M) → `docs/playbooks/flutter-app.md`
+- **Accessibility** (M) → `docs/engineering/flutter-rules.md`
+
+## go
+
+- **HTTP handler** (M) → `docs/playbooks/go-service.md`
+- **Concurrency** (M) → `docs/engineering/go-rules.md`
+
+## go-fiber
+
+- **Fiber handler** (M) → `docs/playbooks/fiber-service.md`, `docs/engineering/fiber-rules.md`
+- **Middleware / auth** (M) → `docs/engineering/fiber-rules.md`
+- **Request validation / DTO** (M) → `docs/engineering/fiber-rules.md`, `docs/api-contracts/error-format.md`
+
+## laravel
+
+- **Laravel controller** (M) → `docs/playbooks/laravel-service.md`, `docs/engineering/laravel-rules.md`
+- **Route / middleware** (M) → `docs/engineering/laravel-rules.md`
+- **Eloquent model** (M) → `docs/engineering/laravel-rules.md`
+- **Form Request / validation** (M) → `docs/engineering/laravel-rules.md`, `docs/api-contracts/error-format.md`
+
+## meta
+
+- **MCP tool authoring (cos_*)** (M) → `docs/playbooks/mcp-tool-authoring.md`, `docs/engineering/mcp-error-envelope.md`, `docs/governance/mcp-tool-inventory.md`
+- **Graph extractor / backend** (M) → `docs/engineering/graph_os-queries.md`, `docs/engineering/graph-hallucination-cures.md`
+- **Hook authoring (src/core/hooks/)** (M) → `docs/playbooks/hook-authoring.md`, `src/core/hooks/registry.yaml`, `docs/engineering/hooks-reference.md`
+- **Adapter authoring (src/adapters/<id>/)** (M) → `docs/playbooks/adapter-authoring.md`, `docs/adapters/claude-sdk.md`, `docs/engineering/adapter-parity.md`
+- **Template / stack authoring (src/templates/<id>/)** (M) → `docs/playbooks/template-authoring.md`, `docs/architecture/meta-project.md`, `src/core/schemas/stack.schema.json`
+- **CLI command authoring (cli/)** (M) → `docs/architecture/meta-project.md`
+- **Hub / web routes (src/core/web/)** (M) → `docs/engineering/hub-architecture.md`
+- **Board / Scrumban (src/core/board_os/)** (M) → `docs/governance/task-lifecycle.md`
+- **Cognition / formula composer** (M) → `docs/adapters/claude-sdk.md`, `docs/governance/critical-rules.md`
+- **Rule SSOT regen** (M) → `docs/architecture/meta-project.md`
+- **Security review (overlay)** (M) → `docs/playbooks/security-review.md`, `src/core/rules/api-contract-discipline.md`
+
+## nestjs
+
+- **NestJS controller** (M) → `docs/playbooks/nestjs-service.md`, `docs/engineering/nestjs-rules.md`
+- **Provider / service** (M) → `docs/engineering/nestjs-rules.md`
+- **Module / DI wiring** (M) → `docs/engineering/nestjs-rules.md`
+- **Pipe / DTO validation** (M) → `docs/engineering/nestjs-rules.md`, `docs/api-contracts/error-format.md`
+- **Guard / auth** (M) → `docs/engineering/nestjs-rules.md`
+
+## nextjs
+
+- **React component** (M) → `docs/engineering/frontend-rules.md`, `docs/playbooks/frontend-ui.md`
+- **Page / route** (M) → `docs/engineering/frontend-rendering-rules.md`, `docs/playbooks/frontend-ui.md`
+- **Content / SEO** (M) → `docs/playbooks/content-seo.md`, `docs/engineering/copywriting-standard.md`
+- **i18n** (M) → `docs/engineering/i18n-policy.md`
+- **Accessibility** (M) → `docs/engineering/accessibility-web.md`
+
+## node-express
+
+- **Express route** (M) → `docs/playbooks/express-service.md`, `docs/engineering/express-rules.md`
+- **Middleware / auth** (M) → `docs/engineering/express-rules.md`
+- **Request validation / DTO** (M) → `docs/engineering/express-rules.md`, `docs/api-contracts/error-format.md`
+
+## python
+
+- **Python module / API** (M) → `docs/playbooks/python-library.md`, `docs/engineering/python-rules.md`
+- **CLI command** (M) → `docs/playbooks/python-library.md`
+
+## rails
+
+- **Rails controller** (M) → `docs/playbooks/rails-service.md`, `docs/engineering/rails-rules.md`
+- **ActiveRecord model** (M) → `docs/engineering/rails-rules.md`
+- **Route / routes.rb** (M) → `docs/engineering/rails-rules.md`
+- **Concern / mixin** (M) → `docs/engineering/rails-rules.md`
+- **Migration / schema** (M) → `docs/engineering/rails-rules.md`, `docs/api-contracts/error-format.md`
+- **Auth / rescue_from** (M) → `docs/engineering/rails-rules.md`
+
+## react-native
+
+- **RN screen** (M) → `docs/playbooks/mobile-app.md`, `docs/engineering/mobile-rules.md`
+- **RN component** (M) → `docs/engineering/mobile-rules.md`
+- **Offline / sync** (M) → `docs/engineering/offline-first.md`, `docs/playbooks/mobile-app.md`
+- **Native bridge** (M) → `docs/playbooks/mobile-app.md`
+- **Accessibility** (M) → `docs/engineering/accessibility-mobile.md`
+
+## rust-axum
+
+- **Axum handler** (M) → `docs/playbooks/rust-axum-service.md`, `docs/engineering/rust-axum-rules.md`
+- **Router / app wiring** (M) → `docs/engineering/rust-axum-rules.md`
+- **Extractor / DTO** (M) → `docs/engineering/rust-axum-rules.md`, `docs/api-contracts/error-format.md`
+- **Tower middleware** (M) → `docs/engineering/rust-axum-rules.md`
+- **AppError / IntoResponse** (M) → `docs/engineering/rust-axum-rules.md`, `docs/api-contracts/error-format.md`
+
+## spring-boot
+
+- **Spring Boot controller** (M) → `docs/playbooks/spring-boot-service.md`, `docs/engineering/spring-boot-rules.md`
+- **Service / business logic** (M) → `docs/engineering/spring-boot-rules.md`
+- **Repository / persistence** (M) → `docs/engineering/spring-boot-rules.md`
+- **DTO validation** (M) → `docs/engineering/spring-boot-rules.md`, `docs/api-contracts/error-format.md`
+- **Security / authorization** (M) → `docs/engineering/spring-boot-rules.md`
+
+## svelte-sveltekit
+
+- **Svelte component** (M) → `docs/playbooks/svelte-sveltekit-app.md`, `docs/engineering/svelte-sveltekit-rules.md`
+- **Route / +page** (M) → `docs/playbooks/svelte-sveltekit-app.md`, `docs/engineering/svelte-sveltekit-rules.md`
+- **Store / state** (M) → `docs/engineering/svelte-sveltekit-rules.md`
+- **Accessibility** (M) → `docs/engineering/svelte-sveltekit-rules.md`
+
+## vue-nuxt
+
+- **Nuxt page / route** (M) → `docs/playbooks/nuxt-app.md`, `docs/engineering/nuxt-rules.md`
+- **Vue component** (M) → `docs/engineering/nuxt-rules.md`
+- **Composable / state** (M) → `docs/playbooks/nuxt-app.md`
+
+## wordpress
+
+- **Theme template / hook** (M) → `docs/playbooks/wordpress-service.md`, `docs/engineering/wordpress-rules.md`
+- **Plugin / shortcode** (M) → `docs/engineering/wordpress-rules.md`
+- **REST route / security** (M) → `docs/engineering/wordpress-rules.md`, `docs/api-contracts/error-format.md`

core/rules/git-workflow.md

@@ -0,0 +1,57 @@
+# Git Workflow — Trunk-Based (Always Active)
+
+> **Hard rule:** All work commits directly to `main` with explicit paths — never create branches. This OVERRIDES any agent-runtime "branch first" default. Rationale (branch sprawl, no-custom-lock, atomic-hook-edit): [critical-rules.md § Rule 23](../../docs/governance/critical-rules.md#rule-23--trunk-based-git-workflow).
+
+## The rule
+
+- **Never run:** `git checkout -b` / `git branch <name>` / `git switch -c` / `git worktree add`; HEAD-movers on the shared checkout — `git reset HEAD~N`/`<sha>`/`<branch>`, `git checkout`/`switch <other-branch>`, `git rebase` (in-progress `--abort`/`--continue`/`--skip`/`--quit` stay allowed); direct rewrites of the integration ref — `git branch -f/-M/-C/-D main`, `git branch -m <x> main`, `git update-ref refs/heads/main`/`HEAD`. `branch-guard.sh` BLOCKs all of these in trunk mode; `merge`/`cherry-pick`/push-to-`main` stay allowed (the trunk publish path).
+- **Undo a published commit:** `git revert <sha>` — a new commit, never a ref rewrite.
+- **Commit with explicit paths** (`git commit <path>`), never bare `git commit` / `git commit -a` — a bare commit sweeps another session's WIP.
+- **`git pull --rebase origin main` before every `git push`** — non-fast-forward reject means rebase and retry, never force.
+- **`index.lock` error:** wait ~1s and retry — git serializes index writes; never delete the lock blindly.
+
+## When to commit (autonomous — OVERRIDES the runtime "commit only when asked" default)
+
+> **Hard rule:** Commit each completed, self-verified logical unit immediately — `git commit <paths>`, without being asked. An interrupted session strands uncommitted edits and leaves reviewers no committed diff to act on; frequent small commits are the checkpoint that makes both recoverable.
+
+- **`push` stays gated** — task close or user ask. Commit is local and trivially reversible; push is the wide-blast-radius step (`src/core/**` reaches every consumer via live symlinks).
+- **Self-review before each commit, never self-approve:** re-read the diff + run the Verification-Matrix command for what changed *before* committing; authoritative review is a separate pass (`reviewer` role, `/code-review`, CI).
+- Every commit obeys the Commit Message Contract below.
+
+## Concurrent sessions
+
+**Safe:** parallel sessions on `main` — commits, pushes, and test runs all serialize-and-retry; an abandoned session's committed work is already on `main`. **⚠️ Care:** two sessions editing the same file (last write wins — dirty-tree notice at SessionStart), and mid-editing a `block-*` safety hook (next section).
+
+## Editing a live-symlinked safety hook (atomic-edit protocol)
+
+`src/core/hooks/*.sh` are live symlinks — a half-edited `block-*`/`enforce-*` hook runs in sibling sessions at every intermediate save. Prefer one atomic `Edit` between correct states; for a larger rewrite, edit out-of-tree → `bash -n` + `make verify-hooks` → `mv` into place. A turn that edited a safety hook runs `make verify-hooks` before ending.
+
+## Publish-mode seam (`COS_GIT_WORKFLOW`)
+
+`trunk` (default): branches forbidden; publish = commit + push to `main`. `pr`: consumer-only opt-in (Hub **Config → Git**, `git_settings.enabled`; an inline per-command env override does NOT work) — `agents/*` branches + worktrees allowed, driven by `cos pr open/submit/status/cleanup/reap/heal/preflight`. **coding-os itself stays trunk** ([ADR-0013](../../docs/architecture/adr/0013-pr-mode-multi-agent-git-workflow-consumer-only.md); spec: [pr-workflow.md](../../docs/playbooks/pr-workflow.md)). A branch in trunk mode ONLY when the user explicitly asks.
+
+## Always-allowed forms (the safe escape hatches — none move HEAD)
+
+- **Unstage:** `git reset` (bare) / `git reset --mixed HEAD` / `git reset -- <path>`.
+- **Restore content:** `git restore <path>` / `git checkout -- <path>` / `git checkout HEAD <path>` / `git checkout HEAD~1 -- <path>` / `git checkout .`.
+- **Branch admin:** `git checkout main` / `git switch main` (idempotent) · `git branch` list / `-d X` / `-m` (rename) — non-protected branches only; the same ops targeting `main`/protected are BLOCKed.
+- **Undo:** `git revert <sha>`; garbage-commit cleanup: `git revert HEAD --no-edit && git push origin main`.
+
+## Commit Message Contract (Always Active)
+
+> **Hard rule:** Conventional-Commit title ≤100 chars · body ≤3 non-empty lines · no agent/AI attribution · no `Co-Authored-By:` trailers · no quoted user prompts. Enforced by `enforce-commit-message.sh` (agent) + the git `commit-msg` hook (human/GUI; install once per repo: `bash src/scripts/install-git-hooks.sh`). Why every line is permanent: [critical-rules.md § Rule 24](../../docs/governance/critical-rules.md#rule-24--commit-message-contract).
+
+### Hard fails (will BLOCK — enforced by `check_commit_message.py`)
+
+- Title not `<type>(scope)?!: subject`, type ∈ feat/fix/docs/perf/refactor/build/ci/test/chore/style/revert (`Merge`/`Revert`/`fixup!`/`squash!` auto-subjects exempt). release-please parses the title — an unparseable type silently drops the change from `CHANGELOG.md` ([release-process.md](../../docs/governance/release-process.md)).
+- Title >100 chars · body >3 non-empty lines · any `Co-Authored-By:` trailer.
+- Lines matching `🤖`, `Generated with [Claude`, `noreply@anthropic.com`, `claude.com/claude-code`, `@anthropic.com` (case-insensitive) · lines beginning `USER`/`User`/`user` · quoted text with >40 Persian/Arabic characters (prompt-leak guards).
+- Tables, file-path lists, and `Verification:`/`Tests:`/`Files:` headers hit the 3-line ceiling — keep them in the work-log / PR body, not `git log`.
+
+### `--no-verify` is blocked for agents (no escape hatch)
+
+`block-secrets.sh` BLOCKs every agent bypass of the git verify hooks: `--no-verify` and `-n`, leading path / `cd …` / `env …` prefixes, and `-c core.hooksPath=` overrides. The git-level hooks still honor `--no-verify` for a **human** in a genuine emergency only. Under heavy concurrent-session load, split into per-directory commits rather than bypassing hooks.
+
+## Anti-patterns (reject on sight)
+
+`git push --force` to `main` · hand-editing `CHANGELOG.md` or manual `git tag` (release-please owns both — [release-process.md](../../docs/governance/release-process.md)) · `reset --hard/--soft HEAD~N` to "redo"/"squash" (use `git revert` or push the small commits) · `git checkout <branch>` to "peek" (use `git log <branch>` / `git show <branch>:<path>`) · deleting `.git/index.lock` to "unstick" a commit.

core/rules/memory.md

@@ -0,0 +1,46 @@
+# Memory Policy
+
+> **Scope — `memory` module.** Active only when the `memory` subsystem is enabled. With it disabled, this policy is inert and the `cos_search` / `cos_observation_record` / `cos_learn_*` tools it references are gated (`module_disabled`); a lean profile unlinks this file entirely (defense-in-depth: the rule stays honest even in the mid-toggle window).
+>
+> Canonical layering SSOT (the *why*): [docs/governance/wrapper-derivation.md](../../docs/governance/wrapper-derivation.md). This rule is the operational policy.
+
+## The Four Layers (mandatory mental model)
+
+Every fact in the project lives in exactly **one** of these four layers. Putting the same fact in two = drift bug waiting to happen.
+
+| Layer | Tool | What lives there | Lifetime |
+|---|---|---|---|
+| **Code** | `Read` / `cos_graph_*` | Implementations, contracts in code | Until refactor |
+| **Docs** | `cos_doc_search` | Specs, playbooks, ADRs, runbooks | Until superseded |
+| **Tasks** | `cos_task_*` | What's in flight / queued / blocked / done | Until archived |
+| **Agent memory** | `cos_search` / `cos_observation_record` / `cos_learn_*` | Cross-session patterns, breakthroughs, decisions, failure modes | Long-lived, decays |
+
+**When unsure which layer:** default to the graph/code layer (`cos_graph_*`) for structural and "how does X work" questions; fall to memory only for cross-session recall. The four-layer table above is ordered by this precedence — code/graph first, memory last.
+
+## When to write to agent memory (and when NOT to)
+
+Record a **reasoned insight** — a **breakthrough** (non-obvious insight that speeds a future session), a **failure mode** (bug → root cause → fix, especially recurring), a **decision** (trade-off + reasoning when the alternative was non-obvious), or **cross-session context** (a project fact not obvious from the code, e.g. "perf budget is set by the SLA, not preference") — with **`cos_learn_narrative`**: it files a searchable insight doc AND mints a belief. There is **no** freeform `record(title, body)` tool. `cos_observation_record` only force-captures a *file edit* (edit-derived, no content you supply) when the automatic PostToolUse hook didn't fire; `cos_learn_extract` is a corpus scan over task outcomes, not a per-insight record.
+
+**Do NOT save** (it pollutes ranking + wastes tokens): anything already in code (`cos_graph_*`/`Read`), docs (`cos_doc_search`), `git log`/`git blame`, current-session task state (`cos_task_*`/`.task-current`), or "I just did X" recaps (that's the work log).
+
+## When to read from agent memory
+
+In the **Orient** phase (after Classify, before Plan): `cos_search(query, min_confidence=0.3, since_days=90)`, `cos_learn_suggest(domain, complexity)` for ranked patterns, `cos_timeline(days=14)` for recent change. 0 hits at those thresholds = no signal → fall through to docs (`cos_doc_search`) or code (`cos_graph_*`).
+
+## Memory hygiene rules
+
+1. **Confidence is system-computed, not hand-set.** Learned-pattern confidence moves by LTP/LTD only when you call `cos_learn_validate` — a second confirming session reinforces it toward Trusted; there is no tool that writes a confidence number. Validate patterns; don't assert scores (inflated confidence pollutes ranking, and by design you can't).
+2. **Decay is automatic** — old low-confidence patterns deprioritize; don't manually delete unless wrong-and-actively-misleading.
+3. **`min_confidence=0.3`** for high-trust patterns only; **`since_days=90`** when the question implies "recent".
+4. **Tag `domain` + `swimlane`** when known — narrows future retrieval.
+
+## Cross-session reasoning, conflicts, audit, privacy
+
+- **Cross-session is the killer feature** — record in session 1, `cos_search` finds it in session 4. If similar problems aren't getting faster, the write step is being skipped (audit: `cos_metric_trend(metric="time_to_solution", window_days=30)`).
+- **Code wins over memory.** Memory is frozen at write time; code evolves. If recall and `Read` disagree, the memory is stale — update or delete it, trust the code. `cos_search` returns each record's timestamp; older than the file's mtime → re-verify.
+- **Git history ≠ operational memory.** Who-did-what-when lives in git (immutable, no decay); `cos_observation_record` is what an agent learned (decay + confidence). A permission *change* → a commit; a *pattern* about reviewing permissions → memory.
+- **Privacy:** never record PII or secrets (memory is long-lived). Sensitive decisions (e.g. incident root cause) → record metadata + link the postmortem doc, don't inline.
+
+## See also
+
+[wrapper-derivation.md](../../docs/governance/wrapper-derivation.md) (four-layer SSOT) · [docs-system.md](../../docs/governance/docs-system.md) (docs layer) · [agent-workflow.md](../../docs/governance/agent-workflow.md) (Core Loop) · [thinking_os SKILL](../skills/thinking_os/SKILL.md) (when to invoke in the Cycle) · [search SKILL](../skills/search/SKILL.md) (`cos_search` vs `cos_doc_search` vs grep).

core/rules/model-routing.md

@@ -0,0 +1,22 @@
+# Model Routing — Auto Mode (settings-gated)
+
+> **Rule:** When `model_routing.enabled` is on in `$COS_STATE_DIR/hub-settings.json`, the agent consults the kernel router before heavy work: call `cos_route_model` with the recorded gate complexity during Classify, and honor the result at every formula dispatch (`cos_dispatch_formula_run` / `cos_dispatch_parallel_run` accept `model` + `complexity`). When the toggle is off, this rule is inert — zero behavioral or token-cost difference.
+
+CLI / VSCode-plugin sessions have no panel UI, so parity with the hub's settings-gated "Auto" model option comes from this rule plus the `nudge-model-routing` UserPromptSubmit hook (a once-per-session directive, only while the toggle is on).
+
+## The contract
+
+1. **Toggle off (default)** — nothing fires; dispatch behaviour is unchanged.
+2. **Toggle on** — at Classify, after `cos_classify_prompt` records the gate, call `cos_route_model(complexity=<gate>, domain=<routed domain>)`. Honor it when history-backed (`data_points > 0`); else prefer the settings' `orchestrator_model`, else the adapter default.
+3. **Dispatch** — pass the chosen model + gate complexity to the run tools; kernel precedence (claude-sdk.md §7.3: explicit > preset hint > role pref > empirical > default) handles the rest.
+4. **Trace** — run tools log `dispatch model resolved … via <source>`; the chat path emits an SSE `routing` event.
+
+## Settings source (SSOT)
+
+`hub-settings.json::model_routing` — written by the hub Settings page (`/api/settings`), read fresh per call (no restart). Models come from `src/adapters/*/adapter.yaml::models` (Rule 11 — no model id literal here).
+
+## See also
+
+- [docs/engineering/hub-architecture.md § Hub settings contract](../../docs/engineering/hub-architecture.md)
+- [docs/adapters/claude-sdk.md §7.3](../../docs/adapters/claude-sdk.md) — dispatch model precedence
+- [src/core/hooks/nudge-model-routing.sh](../hooks/nudge-model-routing.sh) — the per-session directive injector

core/rules/skill-enforcement.md

@@ -0,0 +1,75 @@
+# Skill Enforcement
+
+Auto-generated. Before writing code matching any glob below,
+invoke the matching skill via the `Skill` tool.
+
+| Globs | Primary Skill | Secondary Skills | Stack |
+| --- | --- | --- | --- |
+| `src/frontend/**/*.ts` | `angular` | clean-code, frontend-fundamentals, a11y, state-management, testing-strategy, performance | angular |
+| `src/frontend/**/*.component.ts` | `angular` | clean-code, frontend-fundamentals, a11y | angular |
+| `src/frontend/**/*.service.ts` | `angular` | state-management, clean-code, frontend-fundamentals | angular |
+| `src/backend/**/*.cs` | `aspnet-core` | clean-code, backend-fundamentals, api-design, auth-patterns, security-web, testing-strategy, observability | aspnet-core |
+| `src/backend/**/*Service.cs`, `src/backend/**/Repositories/**/*.cs`, `src/backend/**/Data/**/*.cs` | `aspnet-core` | clean-code, db-design, backend-fundamentals | aspnet-core |
+| `src/backend/**/*Authorization*.cs`, `src/backend/**/Auth*.cs` | `aspnet-core` | auth-patterns, security-web, clean-code | aspnet-core |
+| `src/frontend/**/*.{ts,astro}` | `astro` | clean-code, frontend-design, frontend-fundamentals, a11y, performance, testing-strategy | astro |
+| `src/frontend/**/components/**/*.astro`, `src/frontend/**/pages/**/*.astro` | `astro` | clean-code, frontend-design, frontend-fundamentals, a11y | astro |
+| `src/frontend/**/content/**/*.ts`, `src/frontend/**/pages/api/**/*.ts` | `astro` | clean-code, frontend-fundamentals, api-design | astro |
+| `src/backend/**/*.py` | `python-django` | clean-code, backend-fundamentals, api-design, auth-patterns, security-web, testing-strategy, observability | django |
+| `src/backend/**/models.py`, `src/backend/**/migrations/*.py` | `python-django` | clean-code, db-design, backend-fundamentals | django |
+| `src/backend/**/auth*.py`, `src/backend/**/permissions.py` | `python-django` | auth-patterns, security-web, clean-code | django |
+| `src/backend/**/*.py` | `python-fastapi` | clean-code, api-design, backend-fundamentals, hexagonal-architecture, auth-patterns, security-web, testing-strategy, observability | fastapi |
+| `src/backend/**/models.py`, `src/backend/**/db/**/*.py`, `src/backend/**/migrations/**/*.py` | `python-fastapi` | clean-code, db-design, backend-fundamentals | fastapi |
+| `src/backend/**/auth*.py`, `src/backend/**/security.py` | `python-fastapi` | auth-patterns, security-web, clean-code | fastapi |
+| `src/mobile/**/*.dart` | `flutter` | clean-code, frontend-fundamentals, mobile-fundamentals, a11y | flutter |
+| `src/mobile/**/screens/**/*.dart`, `src/mobile/**/widgets/**/*.dart` | `flutter` | clean-code, state-management, performance | flutter |
+| `src/mobile/**/state/**/*.dart` | `flutter` | state-management, clean-code | flutter |
+| `src/backend/**/*.go` | `go-patterns` | clean-code, backend-fundamentals, api-design, hexagonal-architecture, testing-strategy, observability | go |
+| `src/backend/**/db/**/*.go`, `src/backend/**/repository/**/*.go` | `go-patterns` | clean-code, db-design, backend-fundamentals | go |
+| `src/backend/**/*.go` | `go-fiber` | clean-code, backend-fundamentals, api-design, hexagonal-architecture, auth-patterns, security-web, testing-strategy, observability | go-fiber |
+| `src/backend/**/db/**/*.go`, `src/backend/**/migrations/**/*.go`, `src/backend/**/repository/**/*.go` | `go-fiber` | clean-code, db-design, backend-fundamentals | go-fiber |
+| `src/backend/**/auth*.go`, `src/backend/**/middleware/auth*.go` | `go-fiber` | auth-patterns, security-web, clean-code | go-fiber |
+| `src/backend/**/*.php` | `laravel` | php, clean-code, backend-fundamentals, api-design, security-web, testing-strategy | laravel |
+| `src/backend/**/Models/**/*.php`, `src/backend/**/database/**/*.php` | `laravel` | php, clean-code, db-design | laravel |
+| `src/backend/**/Middleware/**/*.php`, `src/backend/**/auth*.php` | `laravel` | php, security-web, clean-code | laravel |
+| `src/core/thinking_os/**/*.py` | `python-meta-server` | graph-explorer, clean-code, thinking_os, mcp-tool-authoring, llm-patterns, observability, agent-memory | meta |
+| `src/core/thinking_os/tools/memory.py`, `src/core/thinking_os/tools/learning.py`, `src/core/thinking_os/tools/retrieve.py` | `agent-memory` | python-meta-server, mcp-tool-authoring, clean-code | meta |
+| `src/core/thinking_os/tools/*.py`, `src/core/graph_os/tools/*.py`, `src/core/board_os/mcp_tools.py`, `src/core/web/routes/*.py` | `mcp-tool-authoring` | python-meta-server, graph-explorer, clean-code | meta |
+| `src/core/graph_os/**/*.py` | `graph-os-authoring` | python-meta-server, graph-explorer, clean-code | meta |
+| `src/core/board_os/**/*.py` | `python-meta-server` | graph-explorer, clean-code, task-driver | meta |
+| `src/cli/**/*.py` | `python-meta-server` | graph-explorer, clean-code, testing-strategy | meta |
+| `src/core/web/**/*.py` | `python-meta-server` | graph-explorer, clean-code, api-design, observability | meta |
+| `src/core/web/ui/**/*.{ts,tsx}` | `react-vite-hub` | clean-code, frontend-fundamentals, a11y, state-management | meta |
+| `src/adapters/claude/**/*.py` | `claude-sdk-integration` | graph-explorer, clean-code, llm-patterns, observability | meta |
+| `src/adapters/codex/**/*.py` | `graph-explorer` | clean-code, thinking_os | meta |
+| `src/core/hooks/*.sh` | `hook-authoring` | meta-engineering, clean-code, thinking_os | meta |
+| `src/core/hooks/_helpers/*.py` | `hook-authoring` | meta-engineering, clean-code, thinking_os | meta |
+| `src/templates/**/stack.yaml` | `meta-engineering` | thinking_os, clean-code | meta |
+| `src/core/hooks/registry.yaml` | `hook-authoring` | meta-engineering, thinking_os, clean-code | meta |
+| `docs/tasks/TASK-*.md` | `task-driver` | thinking_os | meta |
+| `.github/workflows/*.yml`, `Dockerfile`, `docker-compose*.yml` | `deployment-cicd` | clean-code, observability | meta |
+| `src/backend/**/*.ts` | `nestjs` | clean-code, backend-fundamentals, api-design, auth-patterns, security-web, testing-strategy, observability | nestjs |
+| `src/backend/**/*.service.ts`, `src/backend/**/repositories/**/*.ts`, `src/backend/**/db/**/*.ts` | `nestjs` | clean-code, db-design, backend-fundamentals | nestjs |
+| `src/backend/**/*.guard.ts`, `src/backend/**/auth*.ts` | `nestjs` | auth-patterns, security-web, clean-code | nestjs |
+| `src/frontend/**/*.{ts,tsx}` | `nextjs-react` | clean-code, frontend-design, frontend-fundamentals, a11y, performance, testing-strategy | nextjs |
+| `src/frontend/**/components/**/*.{ts,tsx}`, `src/frontend/**/app/**/page.tsx`, `src/frontend/**/app/**/layout.tsx` | `nextjs-react` | clean-code, frontend-design, frontend-fundamentals, a11y | nextjs |
+| `src/frontend/**/store/**/*.ts`, `src/frontend/**/stores/**/*.ts`, `src/frontend/**/hooks/use*.ts` | `nextjs-react` | state-management, clean-code, frontend-fundamentals | nextjs |
+| `src/backend/**/*.ts` | `node-express` | clean-code, backend-fundamentals, api-design, auth-patterns, security-web, testing-strategy, observability | node-express |
+| `src/backend/**/repositories/**/*.ts`, `src/backend/**/db/**/*.ts` | `node-express` | clean-code, db-design, backend-fundamentals | node-express |
+| `src/backend/**/middleware/auth*.ts`, `src/backend/**/auth*.ts` | `node-express` | auth-patterns, security-web, clean-code | node-express |
+| `src/backend/**/*.rb` | `rails` | clean-code, backend-fundamentals, api-design, auth-patterns, security-web, testing-strategy, observability | rails |
+| `src/backend/**/models/**/*.rb`, `src/backend/**/migrate/**/*.rb` | `rails` | clean-code, db-design, backend-fundamentals | rails |
+| `src/backend/**/controllers/concerns/auth*.rb`, `src/backend/**/models/concerns/auth*.rb` | `rails` | auth-patterns, security-web, clean-code | rails |
+| `src/mobile/**/*.{ts,tsx}` | `react-native-mobile` | clean-code, frontend-fundamentals, mobile-fundamentals, a11y | react-native |
+| `src/mobile/**/components/**/*.{ts,tsx}`, `src/mobile/**/screens/**/*.{ts,tsx}` | `react-native-patterns` | clean-code, react-native-mobile, state-management, performance | react-native |
+| `src/backend/**/*.rs` | `rust` | clean-code, backend-fundamentals, api-design, hexagonal-architecture, testing-strategy, observability | rust-axum |
+| `src/backend/**/routes/**/*.rs`, `src/backend/**/handlers/**/*.rs` | `rust` | clean-code, api-design, backend-fundamentals | rust-axum |
+| `src/backend/**/auth*.rs`, `src/backend/**/middleware/**/*.rs` | `rust` | auth-patterns, security-web, clean-code | rust-axum |
+| `src/backend/**/*.java` | `spring-boot` | clean-code, backend-fundamentals, api-design, auth-patterns, security-web, testing-strategy, observability | spring-boot |
+| `src/backend/**/*Repository.java`, `src/backend/**/repository/**/*.java`, `src/backend/**/*Entity.java` | `spring-boot` | clean-code, db-design, backend-fundamentals | spring-boot |
+| `src/backend/**/*SecurityConfig.java`, `src/backend/**/security/**/*.java`, `src/backend/**/Auth*.java` | `spring-boot` | auth-patterns, security-web, clean-code | spring-boot |
+| `src/frontend/**/*.{svelte,ts}` | `svelte` | clean-code, frontend-fundamentals, frontend-design, a11y, performance, testing-strategy | svelte-sveltekit |
+| `src/frontend/**/lib/stores/**/*.ts`, `src/frontend/**/stores/**/*.ts` | `svelte` | state-management, clean-code, frontend-fundamentals | svelte-sveltekit |
+| `src/frontend/**/*.{vue,ts}` | `vue-nuxt` | clean-code, frontend-fundamentals, frontend-design, a11y, performance, testing-strategy | vue-nuxt |
+| `src/frontend/**/composables/**/*.ts`, `src/frontend/**/stores/**/*.ts` | `vue-nuxt` | state-management, clean-code, frontend-fundamentals | vue-nuxt |
+| `src/backend/**/*.php` | `wordpress` | php, clean-code, security-web | wordpress |
+| `src/backend/plugin/**/*.php` | `wordpress` | php, clean-code, security-web, api-design | wordpress |

core/rules/test-discipline.md

@@ -0,0 +1,38 @@
+# Test Discipline (Always Active)
+
+> **Hard rule:** Run only the Verification-Matrix command for what changed (SSOT: **AGENTS.md § Verification Matrix** — deliberately not duplicated here). Never `pytest tests/` mid-task — the `test-governor` hook BLOCKs it without an audited override. The suite is ~4,850 tests / ~28 min wall-clock; a full sweep melts a laptop running concurrent sessions. Measurements + spec: [test-governance.md](../../docs/engineering/test-governance.md). If one file matches two matrix rows, run both — still cheaper than a sweep.
+
+## Enforcement + the verify ledger
+
+1. **Dedup** — suite passes auto-record to `$COS_STATE_DIR/.last-verify.json` (keyed on git_head + dirty digest); re-running a suite already green on the same tree is BLOCKed — force with `COS_TEST_FORCE=1`. A tree change auto-invalidates.
+2. **Run lock** — one heavy pytest per machine (`$COS_STATE_DIR/.test-run.lock`, TTL + liveness); a concurrent attempt is BLOCKed naming the holder.
+3. **Full-sweep gate** — bare `pytest`, `pytest tests/`, or ≥3 test roots BLOCKed unless `COS_FULL_SWEEP_OK=1 COS_OVERRIDE_REASON='...≥15 chars'` (audited). Prefix heavy runs with `nice -n 19`. Slow-marked tests (314) run pre-merge via `make test-slow`, not mid-task.
+
+## Run the deliverable, not just its proxy (Critical Rule 26)
+
+A green pytest suite proves the *units* import under the harness — **not** that the delivered executable runs: `pytest` puts the package on `sys.path`; `python path/to/script.py` does not, so an import that passes under test still crashes as `ModuleNotFoundError` when run directly (the `nightly.py` incident). Before `cos task-move --to testing` and before handing the user any command or claiming a behaviour:
+
+- **Smoke-run the artifact end-to-end** — `--help`, `--dry-run`, or a real invocation, from the same entry the user/cron uses. Reading the code is not verification; `--slug` vs `--project` is settled by running `--help`, never by reading the parameter name.
+- **A command you paste to the user is a claim** — only paste one you executed this session.
+- **New runnable entrypoint → add a smoke test** to its suite (`--help` or `python -c "import <module>"` via subprocess) so `enforce-verify.sh` covers the executable path, not just the units.
+
+Runtime sibling of [api-contract-discipline.md](api-contract-discipline.md): don't guess a *behaviour* contract — verify by executing.
+
+## Test cadence — the matrix says *which*, this says *when*
+
+1. **During dev → ONE targeted test:** `pytest path/to/test.py::TestClass::test_name -v`; re-run the file only after the named test goes green. Re-running a ledger-green suite "to be sure" is the anti-pattern, not the safe choice.
+2. **At task close → the matrix suite ONCE,** right before `cos task-move --to testing`; the ledger dedups it for the next agent on the same tree.
+3. **Heavy suite (>~60s) → background it** (`run_in_background`) and keep reading/diffing/writing — never idle-wait. Don't start a second pytest until the first exits (run lock names you as the concurrent holder). Batch heavy suites across sibling tasks: park one in `testing`, finish a sibling, run once for the batch.
+4. **docs-lint → once at close** (the ledger excludes `docs/tasks/` churn — per-message lint is pure latency), or when a non-task `.md` actually changes.
+
+## Full sweep is allowed only for
+
+Pre-merge / pre-release final gate · a cross-cutting refactor touching ≥3 matrix rows · explicit user ask ("run all tests"). Say so out loud first ("Running full sweep — expect ~30 min"), then:
+
+```bash
+COS_FULL_SWEEP_OK=1 COS_OVERRIDE_REASON='pre-merge final gate' nice -n 19 uv run pytest tests/ -q
+```
+
+## Before writing any test/script/function/feature
+
+P1 reuse-first: check `cos_graph_context`/`cos_search` (code), `cos_doc_search` (spec), grep (literal) — found it → reuse ([anti-overengineering.md](anti-overengineering.md) § Reuse-First).

core/rules/thinking_os.md

@@ -0,0 +1,48 @@
+# Thinking OS — Kernel (Always Active)
+
+Methodology SSOT (Cognitive Cycle phases, Zoom tools, Four Laws in full): `src/core/skills/thinking_os/SKILL.md`, loaded on demand for COMPLICATED/COMPLEX. Origin spec: `src/core/docs/thinking_os-final-edition.md` (copied to `docs/workflow/thinking_os-final-edition.md` by `cos init`).
+
+> **Golden Rule:** Never start acting before separating problem, behavior, rules, and risk. Light dimensions may skip behavior and risk once the Complexity Gate confirms low complexity.
+
+## Complexity Gate (Before Any Work — Code, Docs, Debug, Planning, Answering)
+
+Run for EVERY non-trivial request, not just coding.
+
+**Q1 — Problem Nature (Cynefin):**
+
+- **CLEAR:** Known solution → just do it, no Zoom. Signal: "standard", "CRUD", "same as before".
+- **COMPLICATED:** Known type, details need analysis → Zoom cycle. Signal: "design", "architect", "integrate".
+- **COMPLEX:** Unknown until tested → Zoom + experiment. Signal: "best way to", "optimize", "strategy".
+- **CHAOTIC:** Broken NOW → act first, Zoom later. Signal: "down", "crash", "emergency".
+- **CONFUSION:** Can't classify → decompose into pieces, classify each.
+
+**Q2 — Dimensions:** 1 → single pass. 2-4 → standard Zoom. 5+ → full Zoom with Dimension Map. 8+ → break into separate problems.
+
+## Cognitive Cycle (5 phases) — full detail in the SKILL
+
+`CLASSIFY (dry) → MAP (dry) → ORIENT (read) → PLAN (think) → EXECUTE (do)`. Key principle: **think before reading, read before coding** — Classify and Map do zero file reads; Orient is the only phase that reads; Plan synthesizes; Execute implements the smallest correct change [P1, P4]. For COMPLICATED/COMPLEX, Zoom In/Out (≤3 cycles, 10 Thinking Tools) runs *within* Plan. Phase-by-phase checklists, the Four Laws (Golden / Sequence / Zoom / Evolution), and Continuous-Monitoring reframe triggers live in the SKILL.
+
+**Progress tracking in EXECUTE — one SSOT, one scratchpad.** The task **Work Log** (`cos_work_log_append`, one bullet per meaningful checkpoint) is the *persistent* record of progress — it survives the session, shows on the board, and is what the next agent inherits; the **Acceptance (G/W/T)** lines are the Definition of Done. A runtime `TodoWrite` (or equivalent) is allowed only as an *ephemeral, in-turn scratchpad* to stay on-track across a long multi-step EXECUTE within a single turn — never a substitute for the Work Log and never a second place a fact lives (P1 SSOT). Do not build a checklist/subtask field inside tasks — Acceptance + Work Log already carry that, and duplicating it is the drift bug Rule 22 forbids.
+
+## Record Gate (Mandatory Before Code Changes)
+
+After the Complexity Gate, record the classification before any Write/Edit on `.py`/`.ts`/`.tsx` — a hook BLOCKs code writes until then. **Prefer `cos_classify_prompt`** (it classifies, records, traces, and returns `recorded` + a fallback command); use the raw form below only when it returns `recorded=false`:
+
+```bash
+bash .claude/hooks/write-state.sh .thinking_os-gate "CLEAR 1"
+```
+
+Replace `CLEAR 1` with the real classification + dimension count (e.g. `COMPLICATED 3`). The gate is per-PANEL and session-scoped (`$COS_PANEL_DIR/.thinking_os-gate`; `write-state.sh` auto-routes the bare basename), expiring after 120 min or on a new session. Skip for non-code work. Per-panel scope: [state-files.md](../../docs/engineering/state-files.md).
+
+## Routing
+
+- **CLEAR** (1 dim) → record gate, proceed directly, no skill needed.
+- **COMPLICATED / COMPLEX** → record gate, invoke `Skill skill: "thinking_os"` for full methodology.
+- **CHAOTIC** → act to stabilize, record gate, then Zoom cycle afterward.
+
+## Deliberation Record (COMPLICATED+ only)
+
+For a **COMPLICATED or COMPLEX** gate, before EXECUTE the Plan phase appends a 1–2 sentence rationale to the task work log via `cos_work_log_append` — *why this approach, and which [constitution](../../docs/governance/constitution.md) value it honors* (e.g. "chose the smallest-correct-change over a generic helper because no third caller exists yet — anti-overengineering"). This makes the *reasoning*, not just the action, a persisted, auditable artifact that also feeds the memory/learning loop — the finding behind *Teaching Claude Why*: deliberation generalizes where a demonstration alone does not.
+
+- **CLEAR / light gates skip this** — casual-work cost discipline is preserved.
+- **Guidance, not a gate** — no hook enforces it and task-close is never blocked on it (avoid rationale-theater). Reuse the existing `cos_work_log_append`; add no new tool, hook, or schema.

core/rules/transparency-banner.md

@@ -0,0 +1,37 @@
+# Transparency Banner (Always Active)
+
+> **Rule:** Every agent reply MUST begin with the `USER_BANNER` line emitted by `session-context.sh` (UserPromptSubmit `additionalContext`) — exactly as emitted, standalone on line 1, then a blank line, then the reply. The pulse block is agent-only (the chat UI hides `<system-reminder>` tags), so the banner is the user's only view of the cognitive signals — task, gate, skill, roles — driving the turn; the user can't redirect what they can't see.
+
+## The contract
+
+Three shapes, driven by `.task-mode` (`classify-task-mode.sh` sets it per prompt):
+
+- **Casual** (`query`/`adhoc`/`chore`): `🔔 ses=<8-char-tail> · mode=<mode>`
+- **Formal** (`formal`/`gov-required`/`propose-formal`/unset): `🔔 ses=<tail> · mode=<mode> · task=<T> · gate=<G> · skill=<S> · roles=<R>` — `roles` shows the active role + chain position (e.g. `reviewer 2/3`) when a chain is composed, else `-`; it advances via `advance-role.sh`, only to a role already in the chain.
+- **Hook-internal** (`system`): banner suppressed entirely.
+
+Appended markers:
+
+- `⚠️ wip=N but task=none — cos task-start <ID>` — act-now: surface and bind the unbound WIP before continuing.
+- `ℹ️ ctx=NNNk>200k — optional /compact; /clear only between unrelated tasks` — **informational cost signal for the user, not a stop directive**: the agent MUST NOT halt, refuse, or defer pulling the next task because of it. Prefer `/compact` mid-run (the working thread survives); persistent memory (Agent Digest, board, work-logs) survives a `/clear`, which is the user's choice between unrelated work. Audit burn with `cos doctor --tokens`.
+- `ℹ️ bypasses=N self-issued CLEAR-1` — count of manual gate bypasses this session (justifications logged to `$COS_PANEL_DIR/.clear1-bypass-log` for retro). Informational — but a rising count means discipline is being routed around, which `/retro` should surface.
+
+## Reply body — lean by default
+
+After banner + blank line: the **minimum that fully answers** (measured median ~36 tokens, p90 ~128). Casual modes → a sentence or two, no preamble or "here's what I did" recap. Formal work → decision first, then the why; verbose tables / file lists / verification logs go to the work-log or PR body. Deliberate reports the user explicitly asked for → as thorough as the request demands. Convention, not a hook.
+
+## When the banner is missing
+
+No `USER_BANNER` in the latest `additionalContext` (SessionStart before any prompt, or hook failure) → skip the banner for that single turn. NEVER fabricate one from memory — stale values mislead worse than no banner.
+
+## SessionStart emission — hidden agent context vs visible operator alerts
+
+Same hidden-vs-visible split as the banner: recovery rules, `[Session State]`, `[MCP Prime]`, `[Agent Digest]` and enrichment blocks go into ONE hidden `additionalContext` envelope (the agent's memory inheritance); `[Uncommitted Work]` + `[Session Start]` active-tasks go to **stderr** — the operator-visible channel. Two invariants: **one envelope per invocation** (under Codex, plain text only — its dispatcher re-wraps the card), and **the digest is suppressed on `compact`** (same-session memory already holds it; only minimal recovery re-emits — the enrichment runs on `startup`/`resume` only). Full contract: [state-files.md §S5](../../docs/engineering/state-files.md).
+
+## Anti-patterns
+
+Skipping the banner because "nothing changed" · translating or reformatting the field names · placing it anywhere but plain-text line 1 · synthesizing one when `USER_BANNER` is absent · bundling it with code blocks, headers, or tool-call commentary.
+
+## Concurrency + per-field accuracy
+
+Each panel writes its own `$COS_PANEL_DIR` and the banner reader is STRICTLY panel-scoped (no `$COS_AGENT_DIR` fallback) — two concurrent tabs never leak task/gate/skill into each other's banner (the `ses=` tail differs per tab). One lag: skills loaded mid-turn show in the NEXT banner. Ownership table + panel-id resolution: [state-files.md](../../docs/engineering/state-files.md). Emitter: [session-context.sh](../hooks/session-context.sh); atomic writer: [write-state.sh](../hooks/write-state.sh).

core/runtime_paths.yaml

@@ -0,0 +1,36 @@
+version: 1
+# State files created at runtime — NEVER tracked by manifest, NEVER scanned by
+# doctor, NEVER captured in golden snapshots.
+#
+# Any component that creates runtime state should register its path here so
+# all loaders (doctor, manifest generator, golden capture) exclude it
+# consistently.
+runtime_files:
+  - .coding-os/coding-os.db
+  - .coding-os/coding-os.db-shm
+  - .coding-os/coding-os.db-wal
+  # Legacy filenames — auto-renamed by core.thinking_os.database on first
+  # init_db() after the 2026-04-30 rename. Kept here so any sidecar a
+  # consumer hasn't yet upgraded still gets ignored by scaffold scans +
+  # manifest generator.
+  - .coding-os/thinking_os.db
+  - .coding-os/thinking_os.db-shm
+  - .coding-os/thinking_os.db-wal
+  - .coding-os/session-id
+  - .coding-os/.thinking_os-gate
+  - .coding-os/.task-current
+  - .coding-os/.zoom-checkpoint
+  - .coding-os/.last-verify
+  # First-edit grace marker written by `cos init` (TASK-372); consumed by
+  # enforce-doc-anchor.sh on the first code edit, so it's pure runtime state.
+  - .coding-os/.fresh-init
+  - .coding-os/.cos.log
+  - .coding-os/.cos.log.jsonl
+
+# Directory prefixes to ignore during scaffold scans — VCS, build output,
+# virtualenvs, node_modules, etc.
+ignored_prefixes:
+  - .git/
+  - node_modules/
+  - .venv/
+  - .build/