diff --git a/.claude/skills/INDEX.md b/.claude/skills/INDEX.md index c5bda88bd..2b988540f 100644 --- a/.claude/skills/INDEX.md +++ b/.claude/skills/INDEX.md @@ -98,6 +98,7 @@ Run `python3 /scripts/` (`bash` for `.sh`). `name: purpose — argu ### communication-structure - comms_lint.py: score a human-facing draft against its artifact template. — --kind K [--file F] [--source S]… +- reader_check.py: Reader-accuracy check: can a reader answer fixed factual… — --checks evals/reader-checks.json --id… - status_update_lint.py: check a leadership status update against… — --file F - status_vocab_lint.py: flag unverified "live"/"done" claims in a human-facing update. — --file F @@ -123,6 +124,7 @@ Run `python3 /scripts/` (`bash` for `.sh`). `name: purpose — argu - post_review.sh: post review findings to a PR (opt-in). — [--post] - review_checks.sh: run local, read-only analyzers over the files changed since… — [--base REF] [--tests] [--timeout SECS] - score_review.py: Score a review's findings against a ground-truth file: recall… — GROUND_TRUTH.json FINDINGS.json… +- security_verify.py: triage security findings: verify-or-drop plus a tunable… — [findings.json|-] [override-file] - token_differ.py: the tier-1 design<->app design-token VALUE parity gate. — --design --app [--map… - No documented CLI: binaries_gate.py, ci_cost_lint.py, closes_lint.py, reaper_lint.py, review_feedback.py, source_scan_tests.py, validate_status_claims.py diff --git a/.claude/skills/communication-structure/INDEX.md b/.claude/skills/communication-structure/INDEX.md index 39548152e..38301ee19 100644 --- a/.claude/skills/communication-structure/INDEX.md +++ b/.claude/skills/communication-structure/INDEX.md @@ -6,7 +6,7 @@ Generated by `scripts/skill_index.py` (do not hand-edit; rerun it after changing | File | Read this when... | Tok | |---|---|---| -| `references/artifact-templates.md` | you draft a status update, PR body, release note, decision memo or executive summary, incident summ… | 1739 | +| `references/artifact-templates.md` | you draft a status update, PR body, release note, decision memo or executive summary, incident summ… | 1757 | | `references/leadership-status-update.md` | you write any status update a non-technical leader will read: a tracker project update, an issue st… | 500 | ## Scripts @@ -14,5 +14,6 @@ Generated by `scripts/skill_index.py` (do not hand-edit; rerun it after changing | File | Trigger | CLI (— = open the header) | |---|---|---| | `scripts/comms_lint.py` | score a human-facing draft against its artifact template. | comms_lint.py --kind K [--file F] [--source S] [--json] \| --list | +| `scripts/reader_check.py` | Reader-accuracy check: can a reader answer fixed factual questions from a message alone? | reader_check.py --checks evals/reader-checks.json --id held02 --file message.md Prints "/" and each fail… | | `scripts/status_update_lint.py` | check a leadership status update against references/leadership-status-update.md. | status_update_lint.py --file F | | `scripts/status_vocab_lint.py` | flag unverified "live"/"done" claims in a human-facing update. | status_vocab_lint.py --file F | diff --git a/.claude/skills/deep-code-review/INDEX-scripts.md b/.claude/skills/deep-code-review/INDEX-scripts.md index d28826495..3ea64d5b1 100644 --- a/.claude/skills/deep-code-review/INDEX-scripts.md +++ b/.claude/skills/deep-code-review/INDEX-scripts.md @@ -25,6 +25,7 @@ Generated by `scripts/skill_index.py` (do not hand-edit). The script half of `IN | `scripts/review_checks.sh` | run local, read-only analyzers over the files changed since REF (default origin/main, compared as R… | review_checks.sh [--base REF] [--tests] [--timeout SECS] | | `scripts/review_feedback.py` | repo-local accept/dismiss ledger for review findings. | — | | `scripts/score_review.py` | Score a review's findings against a ground-truth file: recall and precision under an FP budget. | score_review.py GROUND_TRUTH.json FINDINGS.json [--max-fp N] | +| `scripts/security_verify.py` | triage security findings: verify-or-drop plus a tunable exclusion list. | security_verify.py [findings.json\|-] [override-file] Input: JSON list of findings on stdin or a file. Each row may carr… | | `scripts/source_scan_tests.py` | flag a "test" that reads UI source as TEXT instead of rendering it, the class of test that cannot o… | — | | `scripts/token_differ.py` | the tier-1 design<->app design-token VALUE parity gate. | token_differ.py --design --app [--map ] [--root-px 16] [--min-pairs N] token_differ.py --selftest | | `scripts/validate_status_claims.py` | Flag a completion status that carries a caveat — "a ✅ that needs an asterisk is a ✗". | — | diff --git a/.claude/skills/deep-code-review/INDEX.md b/.claude/skills/deep-code-review/INDEX.md index 2580b1700..8e4b949d4 100644 --- a/.claude/skills/deep-code-review/INDEX.md +++ b/.claude/skills/deep-code-review/INDEX.md @@ -26,6 +26,7 @@ Generated by `scripts/skill_index.py` (do not hand-edit; rerun it after changing | `references/appsec-ssti.md` | the target or diff compiles a server-side template from anything but a static file: render_template… | 507 | | `references/appsec-supply.md` | the target or diff adds or bumps a dependency, touches a lockfile or an install-time script, edits… | 2623 | | `references/appsec-tokens.md` | the target or diff issues or verifies JWTs, implements OAuth or OIDC, rotates refresh tokens, or mi… | 1749 | +| `references/appsec-verify.md` | you are about to report a security finding, when a project asks to tune which low-signal security c… | 1444 | | `references/billing-correctness.md` | the target meters usage, runs subscriptions, charges cards, handles invoices or tax, or processes r… | 2168 | | `references/branch-and-merge-hygiene.md` | Read this on a FULL / repo-level review of a git repo with more than one branch, or whenever the re… | 7979 | | `references/code-structure.md` | the review judges module boundaries or coupling: a FULL review of a codebase that has grown past on… | 1612 | @@ -75,7 +76,7 @@ Generated by `scripts/skill_index.py` (do not hand-edit; rerun it after changing | `references/full-audit.md` | the scope is FULL (never for DIFF or FILE). | 1646 | | `references/full-map-principles.md` | a finding turns on principle 4-6, 10 or 11 (1-3 and 7-9 stay in full-map.md), or when setting or re… | 765 | | `references/full-map-report.md` | writing the Phase 5 report or closing a review (Definition of done (a)). | 504 | -| `references/full-map.md` | the review is FILE or FULL scope, a DIFF over 300 changed lines or with a blast-radius flag, or any… | 4680 | +| `references/full-map.md` | the review is FILE or FULL scope, a DIFF over 300 changed lines or with a blast-radius flag, or any… | 4685 | | `references/i18n-l10n.md` | the target renders user-facing text in more than one language or locale, accepts user-supplied Unic… | 2540 | | `references/infra-evolution-by-stage.md` | the going-forward roadmap (report-format.md) must advise how a project's infrastructure and archite… | 1971 | | `references/infra-iac-containers.md` | the target ships Dockerfiles, Kubernetes manifests/Helm, Terraform/Pulumi/CloudFormation, CI/CD wor… | 4342 | @@ -119,7 +120,8 @@ Generated by `scripts/skill_index.py` (do not hand-edit; rerun it after changing | `references/security-agent-skills.md` | the target is a skill, installs skills, or loads skill files (SKILL.md, skill.json, manifest.json,… | 1627 | | `references/security-ai-agents.md` | the code calls an LLM, embeds/retrieves (RAG), or runs an agent that plans, calls tools, executes c… | 9786 | | `references/security-api.md` | the target serves its own HTTP, GraphQL, gRPC, or WebSocket API (always for api / service) | 4361 | -| `references/security-appsec.md` | Read when the target exposes any network surface (web app, API, service, CLI touching untrusted inp… | 6989 | +| `references/security-appsec.md` | Read when the target exposes any network surface (web app, API, service, CLI touching untrusted inp… | 7029 | +| `references/security-review-mode.md` | the user asks for a security audit or security review of a whole app (not a diff). | 2697 | | `references/skill-authoring-and-size.md` | the target repository ships or installs agent skills (/SKILL.md, .claude/skills/, .cursor/skills/,… | 991 | | `references/standards-index.md` | citing a standard URL or verification date from an installed copy of the skill. | 117 | | `references/testing-ai-evals.md` | the target calls an LLM, retrieves for generation (RAG), or runs a tool-using agent. | 2564 | @@ -142,4 +144,4 @@ Generated by `scripts/skill_index.py` (do not hand-edit; rerun it after changing ## Scripts -24 scripts. Read `INDEX-scripts.md` when you need a script (a trigger and CLI per script). `../INDEX.md`, `### deep-code-review`, has only each one-line purpose and arguments. +25 scripts. Read `INDEX-scripts.md` when you need a script (a trigger and CLI per script). `../INDEX.md`, `### deep-code-review`, has only each one-line purpose and arguments. diff --git a/.claude/skills/deep-code-review/references/api-contracts-streaming.md b/.claude/skills/deep-code-review/references/api-contracts-streaming.md new file mode 100644 index 000000000..6ef481be5 --- /dev/null +++ b/.claude/skills/deep-code-review/references/api-contracts-streaming.md @@ -0,0 +1,74 @@ +# Streaming transports — contract & reliability + +Read this when the target serves or consumes a WebSocket, SSE or gRPC-streaming endpoint (server, client or SDK wrapper). It fires at FILE or FULL scope on what the repo contains, not only on a diff. Moved verbatim from `api-contracts.md`, where "this file" refers; the auth angle stays in `security-api.md`. + +A live push connection is neither a queue nor an outbound call; its own failure modes need their own +review. (The auth angle — upgrade auth, `Origin`/CSWSH, per-connection limits — is in `security-api.md`, the WebSocket paragraph; not restated here.) The same +failure modes apply to **gRPC streaming** (server-streaming, client-streaming, bidi) — a live push +connection over HTTP/2 instead of a WS/SSE handshake, sharing the reconnect/backpressure/liveness concerns +below; `security-api.md`'s gRPC paragraph owns its authz/TLS half, not restated here either. (The +horizontal-scale angle — an in-process connection/subscription registry that silently stops delivering +once the server is replicated — is `concurrency-shared-state.md`'s shared-mutable-resource-scope bullet; +not restated here.) + +- **Reconnection resumes from the last delivered position — not from scratch, not silently gapped.** A + connection *will* drop (NAT/proxy timeout, deploy, blip). SSE gives a resume primitive: the client + re-sends its last id ("`Set (Last-Event-ID, lastEventIDValue) in request's header list`") and the + server must honor it to replay the gap. WebSocket has **no** built-in resume, so the application must + carry an equivalent cursor/sequence and catch up on reconnect. Give the reconnect a bounded backoff + (SSE's own reconnection time "must initially be an implementation-defined value, probably in the region + of a few seconds," with "an exponential backoff delay" on repeated failure) **plus jitter** — that + backoff schedule assumes only *this* client is failing; it does not survive a **server-side + mass-disconnect** (a deploy, restart, or rolling update drops every open connection at the same + instant), where every client's exponential schedule anchors to the identical drop time and retries **in + lockstep**, re-storming the server the moment it comes back. Randomizing each client's wait inside its + backoff window spreads the reconnects out instead. This is a different correlation source than a single + client's own retry jitter (`reliability-error-handling.md`, which spreads *one* caller's repeated + retries) or a cache-key stampede on expiry (`performance-db-cost.md`, which correlates independent + callers on a shared *key*); here the **server's own restart is the synchronizer**, correlating + otherwise-unrelated clients on a shared *instant*. Worth + naming because the spec doesn't: the WHATWG page this bullet already cites describes the backoff but + stops short of jitter. 🚩 an SSE server that never reads `Last-Event-ID`; a + WS reconnect that just re-subscribes with no catch-up; a reconnect backoff with no jitter (fine for one + client, a synchronized re-storm risk after a fleet-wide drop). +- **Bound a slow consumer — never let one connection grow server memory without limit.** The backpressure + discipline required for queues (`domain-w.md`) applies *per live connection*: a server fanning + out to N clients where one reads slowly must cap that connection's send buffer and pick a policy — + drop-oldest, coalesce, or disconnect — not queue unboundedly. On the browser send side, a + high-frequency `send()` loop must watch `bufferedAmount` ("the number of bytes ... queued using + `send()` but ... not yet ... transmitted") and pace to it, not fire blindly. +- **Check liveness both ways, with a timeout policy — not just "ping is available."** A vanished client + (phone sleep, NAT drop) holds a connection slot and its subscriptions open forever unless you detect + it: send pings on an interval, track outstanding pongs, reclaim on timeout. RFC 6455: a Ping "may serve + either as a keepalive or as a means to verify that the remote endpoint is still responsive," and "Upon receipt of a Ping frame, an endpoint MUST send a Pong frame in response, unless it already received a Close frame" — but the spec is silent on a + *missed* pong, so closing/reclaiming on one is the application's job. 🚩 a server that pings but never + acts on a missing pong. +- **Ordering and dedup are an explicit contract across a reconnect.** The transport delivers messages in order *within* one connection (WebSocket runs over TCP, SSE over one long-lived HTTP response), but that guarantee ends at the connection boundary — a resumed stream can overlap what the client already + processed. Give each message a stable id/sequence and make the consumer idempotent on it: the same + at-least-once + idempotent-consumer rule this file states for queues/webhooks, applied to a resumed + live stream. +- **gRPC's own keepalive can get the *sender* killed, not the peer — match both sides' policy.** A client + sending aggressive HTTP/2 keepalive pings on a sparse, long-lived streaming RPC is not automatically + welcome: gRPC's keepalive guide warns: "If the service does not support keepalive, the first few + keepalive pings will be ignored, and the server will eventually send a `GOAWAY` message with debug data + equal to the ASCII code for `too_many_pings`." The defaults invite exactly this mismatch — the client's + own ping interval (`KEEPALIVE_TIME`) defaults to disabled (`INT_MAX (Disabled)`), while a server's + minimum-allowed gap between pings carrying no data (`PERMIT_KEEPALIVE_TIME`) defaults to `300000 (5 + minutes)` and `PERMIT_KEEPALIVE_WITHOUT_CALLS` defaults to `0 (false)` — so enabling aggressive + client-side keepalive with no matching server-side allowance gets the connection killed by the peer the + ping was meant to keep it alive against. (The keepalive guide states the `GOAWAY` behavior and the + `PERMIT_KEEPALIVE_TIME` default separately; the *connecting* mechanism — a server counts a `ping_strike` + for each ping arriving before `PERMIT_KEEPALIVE_TIME` has elapsed and, once strikes pass + `MAX_PING_STRIKES`, sends `GOAWAY` with `ENHANCE_YOUR_CALM` / `too_many_pings` — is spelled out in gRPC + proposal **A8, client-side keepalive**.) Distinct from the RFC 6455 ping/pong above: that is each side + **detecting the other is gone**, at the WS-frame layer; this is **your own liveness probe getting you + disconnected** by a healthy, default-configured peer, at the HTTP/2 PING-frame layer. 🚩 client + keepalive enabled with no corresponding server `PERMIT_KEEPALIVE_TIME` / `PERMIT_KEEPALIVE_WITHOUT_CALLS` + allowance (or the reverse). +- **A bidi-streaming RPC can deadlock itself under manual flow control.** gRPC's flow-control guide: + "There is the potential for a deadlock if both the client and server are doing synchronous reads or + using manual flow control and both try to do a lot of writing without doing any reads." Flow control + "applies to streaming RPCs and is not relevant for unary RPCs," and gRPC manages it for you by default — + the risk is specifically code that opts into **manual** flow control (or blocking synchronous reads) on + **both** ends of a bidi stream and keeps writing without ever draining its own read side. 🚩 a + bidi-streaming handler, on either end, that writes in a loop with no interleaved read. diff --git a/.claude/skills/deep-code-review/references/api-contracts.md b/.claude/skills/deep-code-review/references/api-contracts.md index 34701c965..6ee252240 100644 --- a/.claude/skills/deep-code-review/references/api-contracts.md +++ b/.claude/skills/deep-code-review/references/api-contracts.md @@ -183,76 +183,7 @@ inbound rules above rely on. ## Streaming transports (WebSocket / SSE) — contract & reliability -A live push connection is neither a queue nor an outbound call; its own failure modes need their own -review. (The auth angle — upgrade auth, `Origin`/CSWSH, per-connection limits — is in `security-api.md`, the WebSocket paragraph; not restated here.) The same -failure modes apply to **gRPC streaming** (server-streaming, client-streaming, bidi) — a live push -connection over HTTP/2 instead of a WS/SSE handshake, sharing the reconnect/backpressure/liveness concerns -below; `security-api.md`'s gRPC paragraph owns its authz/TLS half, not restated here either. (The -horizontal-scale angle — an in-process connection/subscription registry that silently stops delivering -once the server is replicated — is `concurrency-shared-state.md`'s shared-mutable-resource-scope bullet; -not restated here.) - -- **Reconnection resumes from the last delivered position — not from scratch, not silently gapped.** A - connection *will* drop (NAT/proxy timeout, deploy, blip). SSE gives a resume primitive: the client - re-sends its last id ("`Set (Last-Event-ID, lastEventIDValue) in request's header list`") and the - server must honor it to replay the gap. WebSocket has **no** built-in resume, so the application must - carry an equivalent cursor/sequence and catch up on reconnect. Give the reconnect a bounded backoff - (SSE's own reconnection time "must initially be an implementation-defined value, probably in the region - of a few seconds," with "an exponential backoff delay" on repeated failure) **plus jitter** — that - backoff schedule assumes only *this* client is failing; it does not survive a **server-side - mass-disconnect** (a deploy, restart, or rolling update drops every open connection at the same - instant), where every client's exponential schedule anchors to the identical drop time and retries **in - lockstep**, re-storming the server the moment it comes back. Randomizing each client's wait inside its - backoff window spreads the reconnects out instead. This is a different correlation source than a single - client's own retry jitter (`reliability-error-handling.md`, which spreads *one* caller's repeated - retries) or a cache-key stampede on expiry (`performance-db-cost.md`, which correlates independent - callers on a shared *key*); here the **server's own restart is the synchronizer**, correlating - otherwise-unrelated clients on a shared *instant*. Worth - naming because the spec doesn't: the WHATWG page this bullet already cites describes the backoff but - stops short of jitter. 🚩 an SSE server that never reads `Last-Event-ID`; a - WS reconnect that just re-subscribes with no catch-up; a reconnect backoff with no jitter (fine for one - client, a synchronized re-storm risk after a fleet-wide drop). -- **Bound a slow consumer — never let one connection grow server memory without limit.** The backpressure - discipline required for queues (`domain-w.md`) applies *per live connection*: a server fanning - out to N clients where one reads slowly must cap that connection's send buffer and pick a policy — - drop-oldest, coalesce, or disconnect — not queue unboundedly. On the browser send side, a - high-frequency `send()` loop must watch `bufferedAmount` ("the number of bytes ... queued using - `send()` but ... not yet ... transmitted") and pace to it, not fire blindly. -- **Check liveness both ways, with a timeout policy — not just "ping is available."** A vanished client - (phone sleep, NAT drop) holds a connection slot and its subscriptions open forever unless you detect - it: send pings on an interval, track outstanding pongs, reclaim on timeout. RFC 6455: a Ping "may serve - either as a keepalive or as a means to verify that the remote endpoint is still responsive," and "Upon receipt of a Ping frame, an endpoint MUST send a Pong frame in response, unless it already received a Close frame" — but the spec is silent on a - *missed* pong, so closing/reclaiming on one is the application's job. 🚩 a server that pings but never - acts on a missing pong. -- **Ordering and dedup are an explicit contract across a reconnect.** The transport delivers messages in order *within* one connection (WebSocket runs over TCP, SSE over one long-lived HTTP response), but that guarantee ends at the connection boundary — a resumed stream can overlap what the client already - processed. Give each message a stable id/sequence and make the consumer idempotent on it: the same - at-least-once + idempotent-consumer rule this file states for queues/webhooks, applied to a resumed - live stream. -- **gRPC's own keepalive can get the *sender* killed, not the peer — match both sides' policy.** A client - sending aggressive HTTP/2 keepalive pings on a sparse, long-lived streaming RPC is not automatically - welcome: gRPC's keepalive guide warns: "If the service does not support keepalive, the first few - keepalive pings will be ignored, and the server will eventually send a `GOAWAY` message with debug data - equal to the ASCII code for `too_many_pings`." The defaults invite exactly this mismatch — the client's - own ping interval (`KEEPALIVE_TIME`) defaults to disabled (`INT_MAX (Disabled)`), while a server's - minimum-allowed gap between pings carrying no data (`PERMIT_KEEPALIVE_TIME`) defaults to `300000 (5 - minutes)` and `PERMIT_KEEPALIVE_WITHOUT_CALLS` defaults to `0 (false)` — so enabling aggressive - client-side keepalive with no matching server-side allowance gets the connection killed by the peer the - ping was meant to keep it alive against. (The keepalive guide states the `GOAWAY` behavior and the - `PERMIT_KEEPALIVE_TIME` default separately; the *connecting* mechanism — a server counts a `ping_strike` - for each ping arriving before `PERMIT_KEEPALIVE_TIME` has elapsed and, once strikes pass - `MAX_PING_STRIKES`, sends `GOAWAY` with `ENHANCE_YOUR_CALM` / `too_many_pings` — is spelled out in gRPC - proposal **A8, client-side keepalive**.) Distinct from the RFC 6455 ping/pong above: that is each side - **detecting the other is gone**, at the WS-frame layer; this is **your own liveness probe getting you - disconnected** by a healthy, default-configured peer, at the HTTP/2 PING-frame layer. 🚩 client - keepalive enabled with no corresponding server `PERMIT_KEEPALIVE_TIME` / `PERMIT_KEEPALIVE_WITHOUT_CALLS` - allowance (or the reverse). -- **A bidi-streaming RPC can deadlock itself under manual flow control.** gRPC's flow-control guide: - "There is the potential for a deadlock if both the client and server are doing synchronous reads or - using manual flow control and both try to do a lot of writing without doing any reads." Flow control - "applies to streaming RPCs and is not relevant for unary RPCs," and gRPC manages it for you by default — - the risk is specifically code that opts into **manual** flow control (or blocking synchronous reads) on - **both** ends of a bidi stream and keeps writing without ever draining its own read side. 🚩 a - bidi-streaming handler, on either end, that writes in a loop with no interleaved read. +Reconnect-resume, slow-consumer bounds, two-way liveness, ordering/dedup, gRPC keepalive and bidi flow control: `api-contracts-streaming.md` — **read it when** the target serves or consumes a WebSocket, SSE or gRPC-streaming endpoint, at any scope (FILE or FULL, not only a diff). The auth angle (upgrade auth, `Origin`/CSWSH, per-connection limits) stays in `security-api.md`. --- diff --git a/.claude/skills/deep-code-review/references/full-map.md b/.claude/skills/deep-code-review/references/full-map.md index 088ae4034..0728739ce 100644 --- a/.claude/skills/deep-code-review/references/full-map.md +++ b/.claude/skills/deep-code-review/references/full-map.md @@ -168,11 +168,11 @@ applicable domains. Language footguns: | B | AppSec (OWASP Top 10:2025) | `domain-b.md`, `security-appsec.md` → `appsec-edge.md`, `appsec-scan-tests.md`, `appsec-links.md`, `appsec-approvals.md`, `appsec-supply.md`, `appsec-crypto.md`, `appsec-ssti.md`, `appsec-files.md`, `appsec-tokens.md`, `appsec-login.md`, `appsec-design.md`, `appsec-egress.md`, `appsec-flows.md`, `appsec-corroboration.md`, `threat-modeling.md` (new boundary); `security-api.md` (serves its own HTTP/GraphQL/gRPC/WebSocket API, any archetype), `mobile-appsec.md` (ships an iOS/Android/native mobile client; MASVS/MASTG deltas) | | C | AI / LLM / agents | `domain-c.md`, `security-ai-agents.md`, `security-agent-skills.md` | | D | Data integrity | `domain-d.md`, `data-quality.md` → `data-identity.md`, `data-scoring.md`, `data-metrics.md`, `data-freshness.md`, `data-ml.md`, `data-contracts.md`, `data-shapes.md`, `data-graph.md` | -| E | Performance, efficiency & cost | `domain-e.md`, `performance-db-cost.md`, `model-tiering.md`, `billing-correctness.md` (when the target meters, subscribes, or charges), `energy-efficiency.md` (battery, always-on, carbon) | +| E | Performance, efficiency & cost | `domain-e.md`, `performance-db-cost.md`, `performance-latency-depth.md` (caches, async handlers), `model-tiering.md`, `billing-correctness.md` (when the target meters, subscribes, or charges), `energy-efficiency.md` (battery, always-on, carbon) | | F | Reliability & error handling | `domain-f.md`, `reliability-error-handling.md`, `safety-critical.md` (can harm people or property) | | G | Concurrency & shared state | `domain-g.md`, `concurrency-shared-state.md` | | H | Tech debt, dead code, maintainability | `domain-h.md`, `skill-authoring-and-size.md` (when the target ships/installs skills or has `**/SKILL.md`: size ratchet), `code-structure.md` (coupling, cycles) | -| I | API, contracts, integration | `domain-i.md`, `api-contracts.md`, `compatibility-portability.md` (support matrix, installers) | +| I | API, contracts, integration | `domain-i.md`, `api-contracts.md`, `api-contracts-streaming.md` (WS/SSE/gRPC streams), `compatibility-portability.md` (support matrix, installers) | | J | Testing & evaluation | `domain-j.md`, `testing-and-evals.md`; `testing-ui.md` (UI, E2E), `testing-ai-evals.md` (model output), `testing-ml.md` (ML, notebooks), `testing-situational.md` (flaky, fuzz, mutation) | | K | Build, CI, supply chain, release | `domain-k.md`, `dependency-currency-and-upgrades.md` → `dependency-bulk-upgrades.md`, `release-engineering.md`, `delivery-speed.md` (CI/build time, review friction) | | L | Infra / IaC / containers / cloud / serverless | `domain-l.md`, `infra-iac-containers.md` (how-to-secure existing), `infra-evolution-by-stage.md` (when-to-add, by stage) | diff --git a/.claude/skills/deep-code-review/references/performance-db-cost.md b/.claude/skills/deep-code-review/references/performance-db-cost.md index 0de8b19c8..1d9ca3204 100644 --- a/.claude/skills/deep-code-review/references/performance-db-cost.md +++ b/.claude/skills/deep-code-review/references/performance-db-cost.md @@ -320,47 +320,8 @@ Every billable or slow call must map to value delivered. - Correct key (includes every input that changes the result; per-user/tenant where results differ) and correct **invalidation** (a stale-cache bug is worse than no cache). No caching of sensitive/per-user data in a shared cache. -- **Invalidate every *derived* entry, not just the entity's own key.** The correct-key rule - above covers one entry; a write must also invalidate every composite / aggregate / list / - rendered-fragment entry that *embeds* the mutated entity (a user's name cached inside a - rendered comment, a row inside a cached list or count). HTTP caches make the split explicit: - a cache "MUST invalidate the target URI" on an unsafe method but treats related URIs only as - *candidates* for invalidation (RFC 9111 §4.4) — derived-key fan-out is the application's job, - not the protocol's. Tag each entry with a surrogate key per entity it depends on and purge by - tag, or keep an explicit dependency index; a write that clears only `entity:{id}` and leaves - the entries embedding it is a stale-read bug no single-key test catches. +- Cache invalidation of derived entries, key cardinality, expiry stampede and refresh-on-every-read depth: `performance-latency-depth.md` — **read it when** the target has an application-level cache layer (memoize, Redis, CDN) or a 🚩 grep hit below names one of those shapes, at any scope. - Bounded size / TTL / eviction; a cache that only grows is a leak. -- **Bound key *cardinality*, not just total size.** A key built from an unbounded or - high-cardinality input — raw free text, a full query string with volatile params, a - per-request timestamp — makes almost every lookup miss while filling the cache with - single-use entries, so it adds latency and memory pressure for no hit-rate benefit. - Normalize and allow-list the key inputs to the dimensions that actually recur. Distinct from - a *wrong* key (correctness, above) and from unbounded *total size* (the eviction bullet) — - here the key *space* is too large to ever reuse. -- **Stampede / thundering herd on expiry.** A hot key expiring lets N concurrent - misses all hit the origin at once — an outage amplifier on an expensive origin. - Require **single-flight** (coalesce concurrent recomputes behind one lock/lease) - or a **soft-TTL / early-recompute** with jitter; the de-dupe under *External - calls* above is the same mechanism applied at cache-expiry. -- **An unconditional refresh-on-every-read cache is not a stampede risk (no expiry to race), but - paired with a query whose sort the primary key can't serve, the two compound into a full-table - sort on every single request — check both halves, not one.** A synchronous cache getter that - fires a background reload on **every** call — single-flighted so concurrent calls collapse to one - in-flight reload, but with **no TTL or staleness gate** at all — looks like a reasonable "never - more than a request or two stale, never blocks" design in isolation, and often is: the - single-flight guard means it isn't the stampede-on-expiry case above (there is no expiry here to - race — the reload is retriggered by call volume, not by a timer). The compounding risk sits on the - query side: a composite primary key covering the natural identity columns (`(tenant, as_of, - recorded_at)`) reads as "the table is indexed" at a glance, but a hot read ordering by a - **different** leading column (`ORDER BY as_of DESC, recorded_at DESC` — newest-first by date - rather than by the PK's leading id) can't be served by that PK — with no matching index, the - engine scans and sorts the **whole table** on every execution (*Indexes*, above, for the - EXPLAIN-driven detection). Reviewed separately, each half is defensible (a documented, deliberate - cache policy; a table that visibly has a primary key); reviewed together, an unpruned append-only - source table growing in one dimension and read frequency growing in another multiply into a - per-request full-table sort that is invisible while the table is small. **Fix:** add an index - matching the actual `ORDER BY` shape and, independently, consider gating the reload behind a short - TTL so read volume stops multiplying query volume 1:1. - **Cache-aside write race.** Read-miss → load → set can interleave with a concurrent write so the cache ends up holding a value already superseded. Order it **write-store-then-invalidate** (not set-after-write), use versioned keys, or @@ -388,110 +349,7 @@ Every billable or slow call must map to value delivered. - I/O-bound work is async/parallel where safe; CPU-bound work isn't blocking the event loop / request thread. Backpressure and timeouts on every external call. -- **Sequential `await`s with no data dependency are an accidental serialization, not - a design choice.** A request handler / page data loader / GraphQL resolver that - assembles one response from a few independent backend calls (a main entity fetch - plus an unrelated sidebar, count, or config read) is often written in natural - top-to-bottom order, `await`-ing each call before the next line runs. A call that - reads nothing produced by an earlier call has no data reason to wait for it, yet - still runs last — the handler pays the *sum* of every call's latency instead of - the *max*, adding a full extra round-trip to time-to-first-byte on every request. - The code stays correct (right data, right shape), so nothing fails; it surfaces - only as a slow-page field report or a TTFB regression, not a test. Detect by - listing, for each `await` in the function, whether its arguments (or a variable it - closes over) trace back to a *preceding* `await`'s result in that same function — - any call whose inputs don't is a parallelization candidate regardless of what it - does. Fix by starting every mutually-independent call together - (`Promise.all`/`Promise.allSettled`, `asyncio.gather`, an errgroup) and keeping - sequential only the calls that truly consume a prior call's output — a call that - reads `main.ids` after fetching `main` is a genuine dependency and correctly stays - sequential; that shape is not the anti-pattern. Distinct from **N+1** above (a - query *per row* of an existing result — this is a handful of independent - *top-level* calls, present even for a single row/request) and from the - client-side critical-request-chain waterfall in `web-fetch.md`'s Core Web - Vitals section (the browser's dependent-fetch chain hurting LCP/TTI, versus the - server handler's own `await` ordering hurting TTFB here). And distinct from the - terse `async/parallel where safe` line above, which states the principle: this - names the concrete failure shape (sum-vs-max latency), the detection trace (each - `await`'s arguments back to a prior `await`'s result), and the genuine-dependency - carve-out that one-liner leaves implicit. **A *correct* concurrent group already - in the function is not proof the whole function is parallel — run that same trace - on every `await`, including the ones *after* a group.** The recurring shape is a - loader that already starts its first reads together (a `Promise.all`, a - hoisted-promise pair, an `asyncio.gather`) and then, in a later change, tacks a - new independent read on *after* the group as a lone `await`: its author added read - k+1 at its natural point-of-use without reopening the top-of-function group, and - its inputs never trace back to anything the group returns, so it has no data - reason to run last yet still adds its full round-trip to the sum. The group's - presence is the camouflage — a reviewer reads it as "concurrency already handled" - and the change added only one line, with the group it should have joined sitting - unchanged (often outside the diff hunk), so a diff-only pass waves it through. - Tell it apart from a never-parallelized loader by *provenance*: the group and the - trailing read land in different commits (blame / `git log -L` on the function). - Fix by starting the new read *with* the group, not beside it — but preserve its - error handling in the move: a fail-all group (`Promise.all`/`gather`) rejects as a - whole on any member's failure and discards the siblings' results, so a read that - carried its own `.catch`/fallback loses that isolation if it is blindly folded in. - Hoist it to its own promise, keep the `.catch` on it (or use `Promise.allSettled`), - and `await` it at its point of use — keeping the latency win without coupling a - non-critical read's failure to the critical ones. -- **Two projections of one dataset that each re-load the raw source, awaited one after the - other, pay double I/O *and* double latency — the compute-once-derive-many miss inside a - single handler.** A request handler / SSR loader that needs two differently-shaped views - of the *same* data (a summary card and a detail table; a totals rollup and a line-item - list; a chart series and its CSV export) often calls two exported helpers — - `getSummary()` and `getDetails()` — that each *internally* re-run the shared loader - (`loadRawEvents()` then reduce it one way; `loadRawEvents()` again then reduce it the - other) and `await`s them in top-to-bottom order. The shared read runs **twice** (2× DB - query / file read / API call) and the two reads **serialize** though neither consumes the - other's output — 2× the I/O *and* 2× the latency on a critical path (TTFB / SSR). Each - helper is clean in isolation (right data, right shape), so a per-file review approves - both; the waste lives only in the *pair* and shows only as the network tab's two - identical source reads and a load time that is their sum. Rank the fix: **read the source - once and pass the records into both projections** (best — it deletes the second read, and - with one read there is nothing left to parallelize); **`Promise.all` on the two helpers - is only the fallback for when they must stay independent — it overlaps the latency but - still reads the source twice**, a partial fix, not the fix. Detect by listing every - `await` a handler makes into the same data module before it branches, then confirming the - shared loader runs ≤1× per request and any reads left separate run concurrently; - acceptance = one source read per request, both projections' outputs unchanged. Distinct - from **Redundant full-collection scans** (External / API / LLM calls), whose subject is a - collection pulled for an O(1) find/dedupe it never needed — here the full dataset is *legitimately* - required, only read once too often and shaped twice. Distinct from the **Sequential - `await`s** bullet above, whose independent calls read *different* sources so `Promise.all` - is the whole fix — here they read the *same* source, so `Promise.all` leaves the duplicate - read standing. Distinct from the client-side **identity fan-out** hook in - `web-fetch.md` (N mounted consumers each re-fetching one shared singleton, coalesced - behind a Provider/cache): this is two sibling projections inside *one* handler, coalesced - by hoisting the single read and deriving both locally. -- **An expensive `await` placed *above* an early return is paid on every request that takes - the early branch — even when that branch never reads its result.** A handler / loader / - resolver fetches something costly at the top (a DB query, an API/LLM call, a full-collection - read) and only *then* hits a guard that returns early on the common path — a cache hit, a - `304`, an empty/redirect/short-circuit response, a permission or feature-flag bail — where - the returning branch does not consume the fetched value; only the *rarely-taken* rest of the - function does. Because the fetch runs before the guard, **every** request pays for it and the - hot branch discards the result, so the app issues and throws away that query on its most - frequent path. It reads clean line-by-line — the fetch genuinely is needed *somewhere* in the - function — and the waste is purely the **ordering**: the call sits before the branch that - decides it isn't needed. Common shapes: a page loader that reads the full record/list at the - top for an edge-case render but returns a cached or empty response on the common branch - without touching it; a resolver that `await`s an enrichment call before an authorization or - feature-gate early-return. **Fix — relocate the call, don't cache it:** move the `await` - *below* the early return so only the branch that consumes it issues it, or make it lazy (a - thunk / deferred promise the consuming branch awaits) so the hot path never triggers it. - Caching (the *Necessity* bullet's cure above) does **not** fix this — a cached read is still a - needless lookup on a branch that discards its result; the lever is *where the call sits*, not - *how often it recomputes*. Detect: for each `await` in the function, confirm its result is - read on **every** branch that can `return` after it — an `await` whose value is consumed only - *past* an earlier `return` is the finding; acceptance = count the call's invocations on the - early-return path (zero after the fix, one per request before). Distinct from **Sequential - `await`s** and the **twin-projection** bullet above, whose reads are all genuinely *used* (fix - = parallelize, or read once) — here the read is *unused on the branch that always runs*, so - only relocating the call helps; from **over-fetch / whole-collection** above, which trim what a - *used* result contains (here nothing on the hot path uses it); and from dead code in - `domain-h.md` (an unreferenced function nobody calls) — here the call **runs** on - every request and only its *result* is dead on the hot branch. +- Handler `await` ordering (sequential independent awaits, a shared source re-read per projection, an expensive `await` above an early return): `performance-latency-depth.md` — **read it when** a request handler, page loader or resolver assembles a response from several async calls, or a 🚩 grep hit below names one of those shapes, at any scope. - No unbounded growth: ever-growing lists/maps/caches, accumulating `defer`s, unclosed resources. Stream large data instead of buffering it all in memory. - **Every append-only store on disk names a reaper — unbounded growth fills the disk, a diff --git a/.claude/skills/deep-code-review/references/performance-latency-depth.md b/.claude/skills/deep-code-review/references/performance-latency-depth.md new file mode 100644 index 000000000..09ec35c33 --- /dev/null +++ b/.claude/skills/deep-code-review/references/performance-latency-depth.md @@ -0,0 +1,153 @@ +# Performance depth — handler await ordering and cache expiry + +Read this when the target has a server request handler, page loader or resolver that assembles one response from several async calls, or an application-level cache layer (memoization, Redis, CDN). It fires at FILE or FULL scope on what the repo contains, not only on a diff. Moved verbatim from `performance-db-cost.md`; "above" and "below" in these bullets resolve against that file's *Indexes*, *Necessity*, *N+1* and *External / API / LLM calls* bullets, and its 🚩 grep list stays there. + +## Handler await ordering + +- **Sequential `await`s with no data dependency are an accidental serialization, not + a design choice.** A request handler / page data loader / GraphQL resolver that + assembles one response from a few independent backend calls (a main entity fetch + plus an unrelated sidebar, count, or config read) is often written in natural + top-to-bottom order, `await`-ing each call before the next line runs. A call that + reads nothing produced by an earlier call has no data reason to wait for it, yet + still runs last — the handler pays the *sum* of every call's latency instead of + the *max*, adding a full extra round-trip to time-to-first-byte on every request. + The code stays correct (right data, right shape), so nothing fails; it surfaces + only as a slow-page field report or a TTFB regression, not a test. Detect by + listing, for each `await` in the function, whether its arguments (or a variable it + closes over) trace back to a *preceding* `await`'s result in that same function — + any call whose inputs don't is a parallelization candidate regardless of what it + does. Fix by starting every mutually-independent call together + (`Promise.all`/`Promise.allSettled`, `asyncio.gather`, an errgroup) and keeping + sequential only the calls that truly consume a prior call's output — a call that + reads `main.ids` after fetching `main` is a genuine dependency and correctly stays + sequential; that shape is not the anti-pattern. Distinct from **N+1** above (a + query *per row* of an existing result — this is a handful of independent + *top-level* calls, present even for a single row/request) and from the + client-side critical-request-chain waterfall in `web-fetch.md`'s Core Web + Vitals section (the browser's dependent-fetch chain hurting LCP/TTI, versus the + server handler's own `await` ordering hurting TTFB here). And distinct from the + terse `async/parallel where safe` line above, which states the principle: this + names the concrete failure shape (sum-vs-max latency), the detection trace (each + `await`'s arguments back to a prior `await`'s result), and the genuine-dependency + carve-out that one-liner leaves implicit. **A *correct* concurrent group already + in the function is not proof the whole function is parallel — run that same trace + on every `await`, including the ones *after* a group.** The recurring shape is a + loader that already starts its first reads together (a `Promise.all`, a + hoisted-promise pair, an `asyncio.gather`) and then, in a later change, tacks a + new independent read on *after* the group as a lone `await`: its author added read + k+1 at its natural point-of-use without reopening the top-of-function group, and + its inputs never trace back to anything the group returns, so it has no data + reason to run last yet still adds its full round-trip to the sum. The group's + presence is the camouflage — a reviewer reads it as "concurrency already handled" + and the change added only one line, with the group it should have joined sitting + unchanged (often outside the diff hunk), so a diff-only pass waves it through. + Tell it apart from a never-parallelized loader by *provenance*: the group and the + trailing read land in different commits (blame / `git log -L` on the function). + Fix by starting the new read *with* the group, not beside it — but preserve its + error handling in the move: a fail-all group (`Promise.all`/`gather`) rejects as a + whole on any member's failure and discards the siblings' results, so a read that + carried its own `.catch`/fallback loses that isolation if it is blindly folded in. + Hoist it to its own promise, keep the `.catch` on it (or use `Promise.allSettled`), + and `await` it at its point of use — keeping the latency win without coupling a + non-critical read's failure to the critical ones. +- **Two projections of one dataset that each re-load the raw source, awaited one after the + other, pay double I/O *and* double latency — the compute-once-derive-many miss inside a + single handler.** A request handler / SSR loader that needs two differently-shaped views + of the *same* data (a summary card and a detail table; a totals rollup and a line-item + list; a chart series and its CSV export) often calls two exported helpers — + `getSummary()` and `getDetails()` — that each *internally* re-run the shared loader + (`loadRawEvents()` then reduce it one way; `loadRawEvents()` again then reduce it the + other) and `await`s them in top-to-bottom order. The shared read runs **twice** (2× DB + query / file read / API call) and the two reads **serialize** though neither consumes the + other's output — 2× the I/O *and* 2× the latency on a critical path (TTFB / SSR). Each + helper is clean in isolation (right data, right shape), so a per-file review approves + both; the waste lives only in the *pair* and shows only as the network tab's two + identical source reads and a load time that is their sum. Rank the fix: **read the source + once and pass the records into both projections** (best — it deletes the second read, and + with one read there is nothing left to parallelize); **`Promise.all` on the two helpers + is only the fallback for when they must stay independent — it overlaps the latency but + still reads the source twice**, a partial fix, not the fix. Detect by listing every + `await` a handler makes into the same data module before it branches, then confirming the + shared loader runs ≤1× per request and any reads left separate run concurrently; + acceptance = one source read per request, both projections' outputs unchanged. Distinct + from **Redundant full-collection scans** (External / API / LLM calls), whose subject is a + collection pulled for an O(1) find/dedupe it never needed — here the full dataset is *legitimately* + required, only read once too often and shaped twice. Distinct from the **Sequential + `await`s** bullet above, whose independent calls read *different* sources so `Promise.all` + is the whole fix — here they read the *same* source, so `Promise.all` leaves the duplicate + read standing. Distinct from the client-side **identity fan-out** hook in + `web-fetch.md` (N mounted consumers each re-fetching one shared singleton, coalesced + behind a Provider/cache): this is two sibling projections inside *one* handler, coalesced + by hoisting the single read and deriving both locally. +- **An expensive `await` placed *above* an early return is paid on every request that takes + the early branch — even when that branch never reads its result.** A handler / loader / + resolver fetches something costly at the top (a DB query, an API/LLM call, a full-collection + read) and only *then* hits a guard that returns early on the common path — a cache hit, a + `304`, an empty/redirect/short-circuit response, a permission or feature-flag bail — where + the returning branch does not consume the fetched value; only the *rarely-taken* rest of the + function does. Because the fetch runs before the guard, **every** request pays for it and the + hot branch discards the result, so the app issues and throws away that query on its most + frequent path. It reads clean line-by-line — the fetch genuinely is needed *somewhere* in the + function — and the waste is purely the **ordering**: the call sits before the branch that + decides it isn't needed. Common shapes: a page loader that reads the full record/list at the + top for an edge-case render but returns a cached or empty response on the common branch + without touching it; a resolver that `await`s an enrichment call before an authorization or + feature-gate early-return. **Fix — relocate the call, don't cache it:** move the `await` + *below* the early return so only the branch that consumes it issues it, or make it lazy (a + thunk / deferred promise the consuming branch awaits) so the hot path never triggers it. + Caching (the *Necessity* bullet's cure above) does **not** fix this — a cached read is still a + needless lookup on a branch that discards its result; the lever is *where the call sits*, not + *how often it recomputes*. Detect: for each `await` in the function, confirm its result is + read on **every** branch that can `return` after it — an `await` whose value is consumed only + *past* an earlier `return` is the finding; acceptance = count the call's invocations on the + early-return path (zero after the fix, one per request before). Distinct from **Sequential + `await`s** and the **twin-projection** bullet above, whose reads are all genuinely *used* (fix + = parallelize, or read once) — here the read is *unused on the branch that always runs*, so + only relocating the call helps; from **over-fetch / whole-collection** above, which trim what a + *used* result contains (here nothing on the hot path uses it); and from dead code in + `domain-h.md` (an unreferenced function nobody calls) — here the call **runs** on + every request and only its *result* is dead on the hot branch. + +## Cache invalidation, key space and refresh + +- **Invalidate every *derived* entry, not just the entity's own key.** The correct-key rule + above covers one entry; a write must also invalidate every composite / aggregate / list / + rendered-fragment entry that *embeds* the mutated entity (a user's name cached inside a + rendered comment, a row inside a cached list or count). HTTP caches make the split explicit: + a cache "MUST invalidate the target URI" on an unsafe method but treats related URIs only as + *candidates* for invalidation (RFC 9111 §4.4) — derived-key fan-out is the application's job, + not the protocol's. Tag each entry with a surrogate key per entity it depends on and purge by + tag, or keep an explicit dependency index; a write that clears only `entity:{id}` and leaves + the entries embedding it is a stale-read bug no single-key test catches. +- **Bound key *cardinality*, not just total size.** A key built from an unbounded or + high-cardinality input — raw free text, a full query string with volatile params, a + per-request timestamp — makes almost every lookup miss while filling the cache with + single-use entries, so it adds latency and memory pressure for no hit-rate benefit. + Normalize and allow-list the key inputs to the dimensions that actually recur. Distinct from + a *wrong* key (correctness, above) and from unbounded *total size* (the eviction bullet) — + here the key *space* is too large to ever reuse. +- **Stampede / thundering herd on expiry.** A hot key expiring lets N concurrent + misses all hit the origin at once — an outage amplifier on an expensive origin. + Require **single-flight** (coalesce concurrent recomputes behind one lock/lease) + or a **soft-TTL / early-recompute** with jitter; the de-dupe under *External + calls* above is the same mechanism applied at cache-expiry. +- **An unconditional refresh-on-every-read cache is not a stampede risk (no expiry to race), but + paired with a query whose sort the primary key can't serve, the two compound into a full-table + sort on every single request — check both halves, not one.** A synchronous cache getter that + fires a background reload on **every** call — single-flighted so concurrent calls collapse to one + in-flight reload, but with **no TTL or staleness gate** at all — looks like a reasonable "never + more than a request or two stale, never blocks" design in isolation, and often is: the + single-flight guard means it isn't the stampede-on-expiry case above (there is no expiry here to + race — the reload is retriggered by call volume, not by a timer). The compounding risk sits on the + query side: a composite primary key covering the natural identity columns (`(tenant, as_of, + recorded_at)`) reads as "the table is indexed" at a glance, but a hot read ordering by a + **different** leading column (`ORDER BY as_of DESC, recorded_at DESC` — newest-first by date + rather than by the PK's leading id) can't be served by that PK — with no matching index, the + engine scans and sorts the **whole table** on every execution (*Indexes*, above, for the + EXPLAIN-driven detection). Reviewed separately, each half is defensible (a documented, deliberate + cache policy; a table that visibly has a primary key); reviewed together, an unpruned append-only + source table growing in one dimension and read frequency growing in another multiply into a + per-request full-table sort that is invisible while the table is small. **Fix:** add an index + matching the actual `ORDER BY` shape and, independently, consider gating the reload behind a short + TTL so read volume stops multiplying query volume 1:1. diff --git a/SHA256SUMS b/SHA256SUMS index b074783c3..0af5b8437 100644 --- a/SHA256SUMS +++ b/SHA256SUMS @@ -1,9 +1,10 @@ -0c412865411a71a662b92dfcad4303456c5abc4dbccfacc5888162b41c5fef0e .claude/skills/agentic-ceo/INDEX.md -526e7fc7d61aa1ef53522fcab9f48cfd92df1ac65efa7bd184f0a92afefb27a5 .claude/skills/agentic-ceo/SKILL.md +5053762cfd5bc16250d4c49dc2b261195b3b33afb162d65a3bcfa58cc6968e5c .claude/skills/agentic-ceo/INDEX.md +d81b8f6a60711f5ec3204b4a44d51c0b930d620b50dfceddcaa8f1acbc42ec5f .claude/skills/agentic-ceo/SKILL.md 5dae0c0a5ed3cdaa78704e25bb38d72c31018311e933283d06ed4f93360bfc6c .claude/skills/agentic-ceo/VERSION 45823025916e516f6ab4346ec8cb2f2f4e8ce7b176845259901287418609f9c2 .claude/skills/agentic-ceo/evals/evals.json 37c22251bef2f984315ecf5944ef7816a707739033aa26a1eb4c2b1f7e5da26c .claude/skills/agentic-ceo/evals/triggers.json 0388d641e5d9e91b0824c8ea03f276773d003e271885450c9325138b8cf9696e .claude/skills/agentic-ceo/references/chaos-playbook.md +e626cc63c6dd946db7668fd0121499fcbcc93ceef8abfa2904612ebdfbfbe070 .claude/skills/agentic-ceo/references/full-map.md dddc593312ff759af209ac90a2807d7db902832e4fa7e61cc189b0c96b228c5d .claude/skills/agentic-ceo/references/improvement-loop.md aca590a84478a5e72bcd7af9981f28c8817c5c041bf535d37289d2f92aaaf047 .claude/skills/agentic-ceo/scripts/context_audit.py c055291d4401717a50cb0dd296efc03d7270496fb0e769440cff6f0a112a77e9 .claude/skills/agentic-ceo/scripts/fixtures/token/session.jsonl @@ -14,37 +15,40 @@ b1080da06ca20a2807ea7be3a25cb95b94c97a6c2a686401796ffc3adac3ee37 .claude/skills 0e33120bae36e120f9628bf16de27fd563a038a680a28df18ef65ccd511602f0 .claude/skills/agentic-ceo/scripts/stop_reminder.py 2e4bd15720508cd50672fb54804ad510794776d4cb7c21334393546c5a0a483b .claude/skills/agentic-ceo/scripts/task_ledger.py 71def6259e7016301932ac474dd4b7afea29349a8dd0b6284d74b5e9ebd16936 .claude/skills/agentic-ceo/scripts/token_ratchet.py -2089bab92d4c5b81036f54b4f3defdc4b7734bafa99b8ea6bdae1ec338b52e77 .claude/skills/agentic-ceo/scripts/token_report.py +f10e0353283b6488262f5f45b5bc28dfc59463a990b51edc232ba75f35fe35cd .claude/skills/agentic-ceo/scripts/token_report.py 9521b057ff3db92d1e60923ebd88170713914f7e235ceb45717eb39419daf811 .claude/skills/agentic-ceo/scripts/weekly_receipt.py -4457e0b069c7d80f5150310778c5ec5bd4e063ebd94dbdd5a295bafc9b1ae03f .claude/skills/agentic-delivery/INDEX.md -f25cbd014f2fd02f910c20c535d5a776d70d034ca8df7c57456934fcbd6e392a .claude/skills/agentic-delivery/SKILL.md +0cb857e4602443cfc1eabcfb149af1262acd880c88f6dc641b2d3eded76d9aa1 .claude/skills/agentic-delivery/INDEX-scripts.md +e489f22ceac306a561a80a98d42286630e2f06cc81b40db52f7dfabdf5e335b6 .claude/skills/agentic-delivery/INDEX.md +b7d03560b1acdc5c01bed01a8d6afd1656ca845dbfd027c2fb1db3a431799438 .claude/skills/agentic-delivery/SKILL.md 3a7100063ea7874528922e525d36b65ed738826902b54408420eaa5ac17bfa83 .claude/skills/agentic-delivery/VERSION -5ea1bb706239cfe19a99d87eff3f1ab38b54d5d00c6c817d8ec4620326da2bcf .claude/skills/agentic-delivery/evals/evals.json +8fe2ddc6bf99fcfb41893c278a8a8169e1b80a26f41ac14d7e52708104439cb9 .claude/skills/agentic-delivery/evals/evals.json fba7699a2d0836b51b7c838d019b1f0cd20570522a362e8a32b8dacfb911298e .claude/skills/agentic-delivery/evals/triggers.json -84a563b8d7eb91d8453b2f2e706944eeaaa9d4785ef2da48e967b1e7d2016d10 .claude/skills/agentic-delivery/references/cost-quality-guardrails.md -550984090d65a3f1ac189336e4a0ae0907add8eb1900ae479366aa22e34b43c2 .claude/skills/agentic-delivery/references/dev-env-ownership.md -785dd7cfad3e2f0698998bcbbc4697fa51e61b3581522ae400971007fdd7e1b5 .claude/skills/agentic-delivery/references/fanout-host-sizing.md -5fe1022817a24bbee2426d09b41ae7d4facbb9ded419d4a164578cebd5b4a1a5 .claude/skills/agentic-delivery/references/fast-agentic-delivery.md +e5f7fe4e6f97a02ed51c8f29b4de7f6d98eec7b2e4113e32bb6a8dcffb7d9e7c .claude/skills/agentic-delivery/references/cost-quality-guardrails.md +eed07e997b517be02c087b9d0fff769c2098eb9c3ed6528fbee3a538ce3fc250 .claude/skills/agentic-delivery/references/dev-env-ownership.md +5810d8544363b6bd28478841fc0d61ca9eab89a540ddba828d69d237b8145a77 .claude/skills/agentic-delivery/references/fanout-host-sizing.md +3439ace0b3857b1d2ca1bcb0450b20d064f28118fd5b158c18e70c15e2ec8577 .claude/skills/agentic-delivery/references/fast-agentic-delivery.md 191ec77a035ca95f402de0d0694a1f66471c7839a8b0dd040a1226858317d712 .claude/skills/agentic-delivery/references/focus-kit.md -04e7797ce08b65b39876a2d5d11af721d91ae1f07014a8a4077590963bed30a5 .claude/skills/agentic-delivery/references/gate-epistemology.md +681757241bcaa1d66dd4b6c783c667aa7347a4e21f3f4b552f24e7765c315373 .claude/skills/agentic-delivery/references/full-map.md +40a212f98db2ae2dd2919bca47723d4d297e50148fc24a6e927b30ebb0a7af2a .claude/skills/agentic-delivery/references/gate-epistemology.md 82979e693d7e9191d67e0178628803dbffe5317335fe6c2520f2b8372a3096b8 .claude/skills/agentic-delivery/references/host-enforcement.md d4e3888e82ad39dc8c4247ed24c008fe8dce4f13603fbeb664cd60634756b46d .claude/skills/agentic-delivery/references/incident-response.md e19b43f2e66aa762397a09b35fa061d6d7b5a4e6a608a2af7d216478a5804bd4 .claude/skills/agentic-delivery/references/install.md -14f74c4fcdd6eef9ba9049a4b56bb6008fff58a717a405414658271880071c35 .claude/skills/agentic-delivery/references/merge-queue-worktrees.md -969dd96f43969ccd28a5f803f5256f8c9b0fa71ece91e9be0f2468d1f088fe16 .claude/skills/agentic-delivery/references/multi-session-coordination.md +18b5c7f8d5112d09c9ecf5ef19c5578ecdf256b8538f816684a14dba818ac219 .claude/skills/agentic-delivery/references/merge-queue-worktrees.md +b782662302a36324d230bd9f6ac9dae5bd54492f40d77dbf8ca0ba7ba5d807d9 .claude/skills/agentic-delivery/references/multi-session-coordination.md 5c2d094ab6f0ccf9722ab0f81ef7e45408fc45439995daf85350dca65a173fdc .claude/skills/agentic-delivery/references/operating-discipline.md 3735b27478bd14f8521066e40e498fb9f8d2faf69236292bf40c1ba182358973 .claude/skills/agentic-delivery/references/pipeline-optimizer.md 0aeeac05e4eefcc5c372b56fa1fa62d6e588c34d20aa1fb93ebcefef987f9662 .claude/skills/agentic-delivery/references/production-grade-product-playbook.md 4c46afbe5c5ae4d7b544e251a950ab54cc0683e4f655ec9a29dca0693c191361 .claude/skills/agentic-delivery/references/project-state.md -4755894a4ad35e797c3aa5233e3b8c997fa6226ea8b8fa4771b7d5e6b1e8d1b0 .claude/skills/agentic-delivery/references/red-gate-triage.md +495b9ab1441a5bd9624ea910014404b2b1ae11bf65eb62da9c6de84d198b74b7 .claude/skills/agentic-delivery/references/red-gate-triage.md f10024adaf2be3072ed7bc39ec4f7cbd3e487960ad7e05badd0c916cc9689443 .claude/skills/agentic-delivery/references/retrospective.md -e988527739b074499c572ad98bc0ff3ca62ce2e410eaa2cdfa5b8e145b2f6562 .claude/skills/agentic-delivery/references/roles.md +00750ffbd78d3607d42ceae64f1f9e9f2762d018e76ad94652c20439189cc565 .claude/skills/agentic-delivery/references/roles.md 538a658aa8a65b21932795812ddaefa3ed8c15ef5b37703c76d6601a5f192748 .claude/skills/agentic-delivery/references/support-ops.md 3a345cabed38700296cdf88810eda6f716b82efa55e6bf5fd46b3a8d96b51e2d .claude/skills/agentic-delivery/references/template-adr.md +2d576f8376e837f38a137a7bd48c14455d823e85b0d1c0da771af186f6d86950 .claude/skills/agentic-delivery/references/template-onepager.md c20c5d3e60129fe3c920d0ff419cbee566af221a4a02b318a61ba2191b00597a .claude/skills/agentic-delivery/references/template-postmortem.md -0fe4dc155db84f9c6cbeb09f08efaeb868727f53453d0731ed754f4e754418a4 .claude/skills/agentic-delivery/references/unattended-operating-mode.md -0e718be29d3705c0315aab74638d15a7dbbc86fefbfc02475a6bdb7f018f7516 .claude/skills/agentic-delivery/references/unattended-trackers.md -f4bb88d76edf9b9389fe9913660a9b64f8a90ac91d1b84b5f3964b86a9ed0862 .claude/skills/agentic-delivery/references/verification-handback.md +3a001ea14ecd217846988b4c12221680831b3ae7ff973ee5b3ed0a084bf81bb8 .claude/skills/agentic-delivery/references/unattended-operating-mode.md +21ed04bf22ae6781fc45d934b4f3df985b00750d66a0e84f9bb19acbc7ae243e .claude/skills/agentic-delivery/references/unattended-trackers.md +5702d18166bda951117d315576671d0af8f09f0996281e1487fd07b39fc26cce .claude/skills/agentic-delivery/references/verification-handback.md aeebeef026b671acf5a0fae8eca03c87be515249809924850485a87a36bdf103 .claude/skills/agentic-delivery/references/work-tracking.md 796a51981e5a268390c2827173e967e7b7acd2080966cf825b25fb472d8147a5 .claude/skills/agentic-delivery/references/worktree-isolation.md 14c304485a05f9d72ef3f89ecfcd4b7b08d7d063f2ff3f070a715b079992229f .claude/skills/agentic-delivery/scripts/_clean_union.sh @@ -55,13 +59,13 @@ aeebeef026b671acf5a0fae8eca03c87be515249809924850485a87a36bdf103 .claude/skills 126650f2ac2e509147b109ff8d2d1fe847dd61c7659912241d6413f4443f2ad4 .claude/skills/agentic-delivery/scripts/board_state.py a6fc31cf16e20c1b3107b832c1c65b766984199fd64d5cc0937df88951183e69 .claude/skills/agentic-delivery/scripts/board_sync.py bff4184deffa7689059ac8d906d03e2c2ad660699813f8e26d0625edf145106e .claude/skills/agentic-delivery/scripts/bypass_guard.py -4427b832d5509c5abc008da0b55f0ad36c6d7b8b0da76423eb689bbd741b65f6 .claude/skills/agentic-delivery/scripts/ceo_altitude_guard.py +c8511e699360636c29532fc58b2efc69a0c3dd550d5ffaf6ae39066def2f2569 .claude/skills/agentic-delivery/scripts/ceo_altitude_guard.py 0193bc266dd2726b6b370e7d733fe7cdda33ebdf650748d561c9e6f8a311b8e0 .claude/skills/agentic-delivery/scripts/claim_probe.py 03af48a629587a7d5d826a84420373bd3bfce9f96097a1eea09bb3656d2b3359 .claude/skills/agentic-delivery/scripts/clean_finished.sh 8555679c4a06b5ac88cddf33f3be919e3112b322936da4cac8afa13f9d11c493 .claude/skills/agentic-delivery/scripts/clock_lint.py 8c327dcb537cb90e48ccfd07dc8d44494667cbc7ead2fa293e432cbd615cdf02 .claude/skills/agentic-delivery/scripts/comms_guard.py 57cfd9ff186dc4f9cf345e001bc8a0aa7f2b3f09cce85755ee0a9a643f56db26 .claude/skills/agentic-delivery/scripts/context_nudge.py -701ea1faffbfccd9729d19b9a19f250f1e8e54ff5696527f3d9b813192905c7f .claude/skills/agentic-delivery/scripts/cost_statusline.py +f1f0bce9a4b9dcc93a5c07ae44a3e7c9e73641b31024b9968c19d333704aa4f8 .claude/skills/agentic-delivery/scripts/cost_statusline.py 1add34cf7a19825ff8a8590a20ea724ea31e3ad3553f97fc637d7daf83683701 .claude/skills/agentic-delivery/scripts/destructive_guard.py 8de7d96e543075dd4bf50bc42b258f630ee1c84f5c12cce0b279f617aa82a644 .claude/skills/agentic-delivery/scripts/env_lint.py 7b50800cfc26b0a63a7ef5db36b5efa6a06c2e4406a1d1f9c5dcad4de0de24c2 .claude/skills/agentic-delivery/scripts/escaped_defects.py @@ -77,7 +81,7 @@ dfd9263a0745e4887f8f43a90969d1ce2a75b461beda466a8b82e514f3cf0cde .claude/skills 3efe843f2e198ed70d464802afa6c3a2164acafef20fb8a1da394b8e3a1ee2e0 .claude/skills/agentic-delivery/scripts/host_probe.py 58761355b4743532e0aa58f8e03265a3984569186ee81d49187dd7fee6c734a4 .claude/skills/agentic-delivery/scripts/host_safety.py fc3ac416d127664da929822637b9abf8547e8378dd2be25a86ed1d8f2614b21c .claude/skills/agentic-delivery/scripts/job_lease.py -aa27efd2c9969e9e4af91626dee9c5590337881aa4db185c2b1aee7787915cf0 .claude/skills/agentic-delivery/scripts/land_train.sh +cdf8243bbe2710b2df75e13efefc3fdfb6ce600dddadd2ec5399ea85c81c2881 .claude/skills/agentic-delivery/scripts/land_train.sh b0a7eda851079bce5b1f581fc235bf11a69ce5eee7758063b5115be5b7f5aa57 .claude/skills/agentic-delivery/scripts/landing_watchdog.py c2ea8802eafd3432e03f9004046b119e8f4a09716cbbb8b405c57a6774d5c284 .claude/skills/agentic-delivery/scripts/lane_cap.py ac7b83056ece082ad31adfce0cfada6fbc63779c268bacb600cec2edf80bc124 .claude/skills/agentic-delivery/scripts/lane_guard.py @@ -90,7 +94,7 @@ bde40cecab26a415753d25482d5c7a4150c7b9c812d2dd06922ed4e251102d04 .claude/skills 3ef97e904982b589b104dbaa55e6471fe667c291c91984a2c7fd84a59325d585 .claude/skills/agentic-delivery/scripts/outcome_claim_guard.py bd5b655445d1dca330de9023c925adb0fe582f6219e45ecb5ae8eb206eb4ce1c .claude/skills/agentic-delivery/scripts/partial_pass.py 7dffc52b4061921029f2600f95ed7df246a26f612142c92d2972915d4df86907 .claude/skills/agentic-delivery/scripts/perun_auto_update.py -7965304e7ead0af12594443cfaaf0790916dc1db4a26cfc73c70714c03a4612a .claude/skills/agentic-delivery/scripts/perun_policy.py +bb2626777299ce3c196bfdde4b60de163adf3eb14f6f2c425c6ac8737f89ba95 .claude/skills/agentic-delivery/scripts/perun_policy.py 503bf3e5ea16b45868b622e78ca5d5399f653743cb693a7214a60f6450a67132 .claude/skills/agentic-delivery/scripts/pipe_mask_guard.py 4b2b7c5ab7ccc0ea4ac8de57b8ebd7d0c2611129bb62aa943175dfdcbc4de450 .claude/skills/agentic-delivery/scripts/pipeline_profile.py 797d4d0625564b0ccb92512116b619272137f119efae81142eb1a23524854809 .claude/skills/agentic-delivery/scripts/plan_gate.py @@ -103,7 +107,7 @@ df84be6c5c868d26b90c34ba720e87407f63bc259dbabfb30ae41789dfb5da63 .claude/skills a93ac9578390ca3bc5cf670c3c88c20e2e9e298cbe65e754a65f08c256aead76 .claude/skills/agentic-delivery/scripts/refix_gate.py 413c2d01be5a64d85b1d2b6901404c634cba71c59bc55f397b08e88642d010dd .claude/skills/agentic-delivery/scripts/restore_ledger.py 4a6fb3e0620bf882a53698af6fbe0fa7b8c8d2e8bb4d9e457940f8a2980cbf35 .claude/skills/agentic-delivery/scripts/review_digest.py -0dde55a595de0128a9eb43501625b156e33f6ebe569ea7874d717263dbcaad64 .claude/skills/agentic-delivery/scripts/review_gate.py +ef04b97eba27a5928f04691f790d9a52cea706662c3fcd65d008b3c3a515d099 .claude/skills/agentic-delivery/scripts/review_gate.py 1eb03b23282a85e7d97016a80526a76815aa459aeb3ccea6a00208403c0b6a84 .claude/skills/agentic-delivery/scripts/run_ledger.sh 6cb989df6d8571937af9c6ea14253e72c853b703cbfbcdb386785f8dd06b14b4 .claude/skills/agentic-delivery/scripts/sandbox_preflight.py ee703fb1f47b399b6a79212a9dc983b537251f61e6404464f0d664f8ac083211 .claude/skills/agentic-delivery/scripts/sandbox_probe.py @@ -117,53 +121,59 @@ f1a14c32f2d2e60382b0b50c1c056bda410c8e20a9fe60a78e8623d586b2a986 .claude/skills fa414e2f054a825ab1ff9b26147bf80e1d6036fe266a2ac73a4c91bd8b10c2cf .claude/skills/agentic-delivery/scripts/surface_check.py 3df4294acea6ea5e7a730767ae20a5dcc464fb9b4c184175c320dc89156a690a .claude/skills/agentic-delivery/scripts/teardown_lint.py 71eb61df64407560d110765a22585a05b5ebe5e2f17b192d6a2b15111702aa3d .claude/skills/agentic-delivery/scripts/terse_reply_check.py -c6651d126dc7b0473c210c6cb9391c3f11636ddbe34ba0b8d1a4ab0c54df51c1 .claude/skills/agentic-delivery/scripts/tier_gate.py +9ffbed35791ea1d5f80322d63d18716e27066ba35a8a1862218b43d3e28ee70e .claude/skills/agentic-delivery/scripts/tier_gate.py 932767b2bf59d28d44a046412c22bddb10ce9c96d99c17f75e508d1870b2e6be .claude/skills/agentic-delivery/scripts/tracker_check.py 3f736e352c91ff08e557ec79d284a4a44ba7db52cfdd300436ce91fb2801b1d8 .claude/skills/agentic-delivery/scripts/tracker_weekly_update.py 71ed0045a274dbdaba680dfcd150847e551041f133f27ed30615eec0e58a255c .claude/skills/agentic-delivery/scripts/train_flake.sh -5124cd0638b67386f1caa2b60fa6acde33677ded75d252e2ddf07eff05351aaa .claude/skills/agentic-delivery/scripts/train_land.sh +d2fec620b3ab139c2f621725fe28cdca471aed1886cb3f3d7ded26a01e2e585e .claude/skills/agentic-delivery/scripts/train_land.sh df65cae17d231114005ff0c5d99ae461ce50d5290b8c41bb77956f5e8c3cae24 .claude/skills/agentic-delivery/scripts/union_overlap.py 603ae6edea7a4d574f55e4d09da8dea6eb4d6d8800c3ecbdc49b1d5d71bea97a .claude/skills/agentic-delivery/scripts/vacuous_test_gate.py 78171cb3658239473d9929addea8271b1a1ff9eb811f9f618f182e7dd725adf2 .claude/skills/agentic-delivery/scripts/wired_check.py 98ec99b865d0ebf249960be4722e16af57489a1c78af06adc4afcd5a37de9223 .claude/skills/agentic-delivery/templates/handoff.md 46a4e52954370bb53db6ebf78b7365b2c4ef790ea6e2e73f4f4c09c823c8e219 .claude/skills/agentic-delivery/templates/host-safety.tsv -6969d5f7a35d1564eb9d1b0e8e21115204132fd43c9e169013e1381aac9c8907 .claude/skills/agentic-delivery/templates/lane-preamble.md +16f6c7aca422b66a539e60512173305999c4f36aeca5a711d77f163fcfd257fb .claude/skills/agentic-delivery/templates/lane-preamble.md c3ef87aa65dec1f63df5f6b1aadc3a1e5c322ed7288a5dbd3b7617d56c12adbb .claude/skills/agentic-delivery/templates/loops/cleanup.md b956a4767c55179e732c5e34581abfd07b285dd73aa030ad9119005cb8e2d0a2 .claude/skills/agentic-delivery/templates/loops/coordinator.md 7f5e043836dca83534623994d97de0da88caec290e434d0c7a1a52cf2345f05b .claude/skills/agentic-delivery/templates/loops/peer.md f18768edc4d9614e3c0b5401b507ad12e04105c9a67d6cf054513033cba95cd6 .claude/skills/agentic-delivery/templates/operating-layer.settings.json -40057f8eb15e51ffc355b0c217f255addcbda2888db3621ae5092db9983a18af .claude/skills/agentic-delivery/templates/review-tiers.tsv +024c151cdc8b5175a25ebe44cf4cbb86539ae8d9f90e03b7e2ac359481841681 .claude/skills/agentic-delivery/templates/review-tiers.tsv 0a250e0345c762cbcd7ac018c161bc9a11b405fed644c936379fb74881cc5025 .claude/skills/agentic-delivery/templates/terse-replies.settings.json -cba00528c97f7bff9b499018584a599d8fca9684c80d14d7e01c61e695df4519 .claude/skills/business-ops/INDEX.md -39af659d0f34751f187cd40fe5e4ee9f7325d1b314485bbcf1633da87eecf741 .claude/skills/business-ops/SKILL.md +986cd7d948bb0aea7abbaa89931756e68b63f48d6fc0fccb00a8e070e618ec6d .claude/skills/business-ops/INDEX.md +4811c1f56be702eb34b6d0e9deda7720b063386a313b8112a977f696916a428e .claude/skills/business-ops/SKILL.md ded1b601e81d31ca1f65c4f3ccf2ebd7992b6390e37bc2a86f3837282f1e00cf .claude/skills/business-ops/VERSION ac4d2f7a4f99ebc618a06223acc890653256ed36afef9a57d033bc53dddf28eb .claude/skills/business-ops/evals/evals.json b8eaccc017ff43654798f4781f3e6c804ca3306d1365c2ab7870e9e1f855e0ba .claude/skills/business-ops/evals/triggers.json +6967542c52536ecea3dcaf1374a2ea78928e19d3b4595aacb09b025cc46bfe08 .claude/skills/business-ops/references/full-map.md 8be21023d9bc5b2eb1d10bf95c45de8526b212afbd46eb429f9856fc2620a86f .claude/skills/business-ops/references/regulated-domain-triage.md -852f1d5f4482c1d0f26a81c635e0d5e6466aeb61a3e42d6cc8cb1b85410a1b1b .claude/skills/communication-structure/INDEX.md -b85680fb2b0b21ff6a32020e5bbd5fe3b12357b81175918ca75ee7cfdd937e10 .claude/skills/communication-structure/SKILL.md +66b3862368182ef01649d0db8f99913b518bdce78fce4a9282da247d77c7ea3a .claude/skills/business-ops/scripts/bizops_check.py +10c09e52d1182b65afeca3e6f15078c1c921c88df92dbd686310e28d298d40b3 .claude/skills/communication-structure/INDEX.md +0e5afb32996c1f721bbfe709a78a21b6feaa1f347fdb705be1ed6a102b0db719 .claude/skills/communication-structure/SKILL.md 563a0b4eec3c77bbc34ac630d4fa5214f5c6726ae01468404fd704473110084e .claude/skills/communication-structure/VERSION -408f61ed14ec08557b6ca9646731cbdeb615b47a9436127fe78fbe4a760fd8a5 .claude/skills/communication-structure/evals/evals.json +c90009107b343eff57af6565f8a7bec56626688402eb113bc4315760f0fdbdb7 .claude/skills/communication-structure/evals/evals.json +7024c68d4964f2b247f5b9cc05d6827611c362664d055f137cb00a80f5d48e70 .claude/skills/communication-structure/evals/reader-checks.json 29020bf7db659b0e2019587f6857d34794d05dc1f693f909543b20dd7f0873b3 .claude/skills/communication-structure/evals/triggers.json -4e6f6330720c915c4b487fb13e9a92bcd33dcf3c6dcc84cb189958be5b6c633e .claude/skills/communication-structure/references/artifact-templates.md +e901c75eb91c0e5c82e92e9bee67d75523383307bc288fb6d1e4bd62f81241c7 .claude/skills/communication-structure/references/artifact-templates.md b9e8c4a71aa0102503226c0180379bc3bc25f13485ac35232521da88b88fc843 .claude/skills/communication-structure/references/leadership-status-update.md efb09b482741c164e60b34f256f71b471736bffd306f4d12c1c4e8bb854fc8dd .claude/skills/communication-structure/scripts/comms_lint.py +aee1b377e135c8dcdb808cb02b29d7bd8ca9ab3038023ee4afd616f5ffc74d6f .claude/skills/communication-structure/scripts/reader_check.py 4195df9b36e2a1f73fd6ffa397fca22e95e86465064110fdfaea65c19f130d9d .claude/skills/communication-structure/scripts/status_update_lint.py 2524bf62b627d362d888535ec9ef6527642cd7eeccbfd518454ed68f30d21344 .claude/skills/communication-structure/scripts/status_vocab_lint.py -7828b757129b69ac85bbd39b95ead33766876cecef3730ab0e17f6eb808f4d56 .claude/skills/contribution/INDEX.md -7b7b86bc9a1ab9e7a91f879dfca0369d87a935aff1b4253ec2207096d2d383d3 .claude/skills/contribution/SKILL.md +858f638ae643daf6792b56289c49a0441694e1c6688ca67a56877ba2b6deecfa .claude/skills/contribution/INDEX.md +bfd5d950c0639a0eb6efde0898c0b0639375dd6ba9b5cb616206079c3df22cbb .claude/skills/contribution/SKILL.md 6cf4e084b47f33c9b02ef79279d157833868f8f70514169a768be353ee328fea .claude/skills/contribution/VERSION -c404e7e511984fb9a1a8819d8ba62e05b3f61a8953cef5936180203f1bc1d308 .claude/skills/contribution/evals/evals.json +5de3d7fdd92675621e6db7fa5e9b8e86b3c5c4c3821f85465deba9c3230fd987 .claude/skills/contribution/evals/evals.json d98f3e4380da3496061ba63be7beebe75017ab4ee1734eda9a3e798e19007b0e .claude/skills/contribution/evals/triggers.json 3f047b5935d72317605691d0fc4e6357cf6c44d1b91347eb2fc36e75497f7382 .claude/skills/contribution/kernel-paths.txt -8e329e28c1f9e95742f84791db297c8621810da722be930df1d412bc73c57b34 .claude/skills/contribution/references/contribution-procedure.md +611f6d2c12f9f6319758b354894eb46f1aee7b8a7a8132009c0d1cf2d726663d .claude/skills/contribution/references/contribution-procedure.md +107211aee342bcda67e5e0092f84467ca98f836322869a3bffe10e6d0949292e .claude/skills/contribution/references/full-map.md 6108f7f8d13cefb9a23ca3960cc3bc73200f8ef88fe39c9d1a9b49b9ec7222f1 .claude/skills/contribution/scripts/learning_to_pr.py 92d22cc5d0a60ba6bdb1f4a9b597823dec5b8412cec09a5be6cf93b3973f4226 .claude/skills/contribution/scripts/prefile_check.sh 18f20db537ab784460ad33cf218f7a01ac0a172fc38413f14c0e19e1ce6821cc .claude/skills/contribution/scripts/share_learning.py -e84c8b55a83092d5715b799d398dbb64678c98da25dfcfab1a2503d02219fc99 .claude/skills/deep-code-review/INDEX.md -9a1cdd20f0eb868a35473861208c8a721ea10a95c5fc421a6149684bf692f85b .claude/skills/deep-code-review/SKILL.md +9cdfda27f9e19367420d88d7586ce1a34bea5b326c2bbc349ca28eb319573adb .claude/skills/deep-code-review/INDEX-scripts.md +983ce90442804f691a2dc2e9292cad2515b49d8a8db8a0fb504555870fe16175 .claude/skills/deep-code-review/INDEX.md +1a0b850887d1a1325715c12ee8697b78b5634b4c57ffb2c67695327d4f00241e .claude/skills/deep-code-review/SKILL.md 3a7100063ea7874528922e525d36b65ed738826902b54408420eaa5ac17bfa83 .claude/skills/deep-code-review/VERSION -114683c02ff4551238026d1737e2df84fe6de1dd816f58d4a18da748e4a50198 .claude/skills/deep-code-review/evals/evals.json +ec5a10cfb7d374f5117977973c66938988f74f400a6bec3379bc8a15fa248817 .claude/skills/deep-code-review/evals/evals.json 13dbb52e4bf61b1093302e094151def167371d26e7cf67a026f3beeb09d34378 .claude/skills/deep-code-review/evals/triggers.json b84e3a2b88dc189f041784e76b97e68ad879915814e00f4b37cd27513746d6f1 .claude/skills/deep-code-review/references/a11y-aria.md 5a3e66353bcdabb0289ea926c7f192dbad750edca74ef0f0d8c0f6b71bcbf5ef .claude/skills/deep-code-review/references/a11y-color-motion.md @@ -172,21 +182,25 @@ de68ee1296de1b8ad6f855f9582cc2f382aab403c69b34047584e33fbf55c67d .claude/skills bc0c945b60a87d6f0b84caccfda7085b602d7921b803d4662c1d543b1229fc1e .claude/skills/deep-code-review/references/a11y-live.md e3c04dceff4b15c10dc7eeb1122914c94cb66b717a104ad952a0a16f3c71b60f .claude/skills/deep-code-review/references/api-contracts.md 1b0f52a6249e129b4342acb40b3dc58615116ad1151b472293cb9fcf83f10c99 .claude/skills/deep-code-review/references/appsec-approvals.md +d3dcddc61b815a8b50f908c6f9b646bacdd23902d715432185f5d1f1eced2bfc .claude/skills/deep-code-review/references/appsec-corroboration.md db83977c17ed42a158f5bbb2242f6dd91ff40392cdee823de37eec798bc64f89 .claude/skills/deep-code-review/references/appsec-crypto.md 16bad4a5e6cfe86aeb72d2d2e41413de427fb57c903af4a87dedd1f8d63a75b5 .claude/skills/deep-code-review/references/appsec-design.md 4203f039499146034386a95dd819fa266380733dcc6a2aa31e3504b6518aa73b .claude/skills/deep-code-review/references/appsec-edge.md +0dff7f180afadf6ea0a1150b608599bd2502b907c6e7d1cdbc864a665a18db07 .claude/skills/deep-code-review/references/appsec-egress.md 3ee6470081b5c333d3d1ca9e5facce87c3b203da9f7703df5b9ccec7c6e178af .claude/skills/deep-code-review/references/appsec-files.md -6e7abd1c9496ef82a8e9baa228e5dcef1f548512c6ca65d44ec487b817122e61 .claude/skills/deep-code-review/references/appsec-links.md +c23c728984e6e3bf168cf4b9af76b4354ed059b44aca4c2b4652ce3b8aaab868 .claude/skills/deep-code-review/references/appsec-flows.md +6284a4493c8a0939b1751a9f0d04331d1dd7a3ae2bf8b0f1a8cb3e3e4bc6f331 .claude/skills/deep-code-review/references/appsec-links.md 97ac3c74e40fea4fe438e23e7461c54841ada1f6b5b92c82893c710570613492 .claude/skills/deep-code-review/references/appsec-login.md 30f5d21cb3078a13dc658122a963b3ea885de820eb3d37c6bca5705a0279f360 .claude/skills/deep-code-review/references/appsec-scan-tests.md 30cc28f8876ce648de29f95167c227896c2dd0f4d664fc62dccfb9100f90a8de .claude/skills/deep-code-review/references/appsec-ssti.md a8825f0d50c6aab31f77eb209312382e98c741b14ad19c2348c38ae551422048 .claude/skills/deep-code-review/references/appsec-supply.md 6f4c9222628d37993187da36e51ee6a5a5daee74e51f31da9b343742bc82b575 .claude/skills/deep-code-review/references/appsec-tokens.md +84fe6e62d738d03b5400eb5c2dc37d02bc165ab114cf777e9b53ac70923234e3 .claude/skills/deep-code-review/references/appsec-verify.md 0abd4efacaead5559ce491c64ef044182fcf408ba490e5f69cc1fa69df8ab829 .claude/skills/deep-code-review/references/billing-correctness.md -fc3a4c0d35dfb643bd22eb6d45a286fda88174b434b0ad987d1795d804916cb9 .claude/skills/deep-code-review/references/branch-and-merge-hygiene.md -4e33f26f08c9b35c7a4dc705eb5be2cc93115ba6a7629f758bad0f7c27bc7e0d .claude/skills/deep-code-review/references/code-structure.md +379eed07f3ed3fbd36d7a33bf53f2c18e64c111bf6cb746b99606e92dc5451a2 .claude/skills/deep-code-review/references/branch-and-merge-hygiene.md +cf8bc78f7d3fa24c51aef32d60f3bf040420faca25f128e5ba3a9cfff23698f8 .claude/skills/deep-code-review/references/code-structure.md 58f5959fca2a9dd222d68df65c357df84e979a00a5faa4a8d120de8945f93007 .claude/skills/deep-code-review/references/compact-mode.md -01bd09ab325868c347757549cc43a934e548cc09e73047a3b732588e6b05f5a2 .claude/skills/deep-code-review/references/compatibility-portability.md +fe6bf6b2bb354da2d263fac54f0b9f9f882823a3aae3e3e71d732d6b92854b38 .claude/skills/deep-code-review/references/compatibility-portability.md ce2d42bf3ad0d789b25ca0d6845da958f9216d97c84b2c0d0d574f5cd4d96341 .claude/skills/deep-code-review/references/concurrency-shared-state.md 9784d63efd0de74e1362272395e4e6d169a949711441475bbff1fa0879307624 .claude/skills/deep-code-review/references/data-contracts.md 59fd81eb6deb38c3a8d96978a326d034cfbce45a110e0734c3f634927d02c798 .claude/skills/deep-code-review/references/data-freshness.md @@ -197,11 +211,11 @@ e6c78c7d826c292e7e98d8fc56e4bae9b4477e41d2d83c7a2fe86044d9b11957 .claude/skills 1be86ad27bf713afa87394063f6675358080c59a0545bb8a422d99c971be344c .claude/skills/deep-code-review/references/data-quality.md 5ce85f462970c09526ff361f6d7acda3f5e8896e8a971ad0ac1f40cf2667fffc .claude/skills/deep-code-review/references/data-scoring.md 4869f86c4439dfab3f397a759280f77f99c11244b1a633aa13721ac61c2e8655 .claude/skills/deep-code-review/references/data-shapes.md -d04df0ab2c145b5652a8dd1f36062fe4e7b1554dc28e5ee33a7171653801e2e4 .claude/skills/deep-code-review/references/delivery-speed.md +7c294d00229660d6cb1dff1b75264d37622722e090494a50d4edd7a07421ff38 .claude/skills/deep-code-review/references/delivery-speed.md a3584914862966240de982800136d19cd6c70fe4e8853ab43b3629eede33feb2 .claude/skills/deep-code-review/references/dependency-bulk-upgrades.md -fe79a074dd8173300b1bc9fde08428cad511bbaa105b0939aef86ad6324e0d57 .claude/skills/deep-code-review/references/dependency-currency-and-upgrades.md -7a4c15c62f8ece1144bc9ab7bda76a6cc610ee9c5ccbaf6242a9b449a3fbd37f .claude/skills/deep-code-review/references/docs-and-dx.md -b0bbec43934a3da9e666183dc157c97ef7e587670efe26209d12a0e0f7f01900 .claude/skills/deep-code-review/references/docs-evolution-by-stage.md +ba8a14edeec2ebcfc83dd0399da756c730e07a37821d34622199d7e518010558 .claude/skills/deep-code-review/references/dependency-currency-and-upgrades.md +93d1dc05740e30e43c55937aa694ce5c65ab5953f2b2f51b4e1fae984716c7b4 .claude/skills/deep-code-review/references/docs-and-dx.md +863e1604ebfce44db94b2107b740782f0df170d51425b6e46c80fbac0d92c1b7 .claude/skills/deep-code-review/references/docs-evolution-by-stage.md 1ca5eb5e29b534e019b3431126e14c2df4bdc5dea84f1eb79984ade4c31eca92 .claude/skills/deep-code-review/references/domain-a.md 4264f85fa2376bfb5430072c63b88128282508dc78d625cfbedeace4077a7238 .claude/skills/deep-code-review/references/domain-b.md c5f1df9cdbabc7db1be688ab20b9416c154b827eef5e9c3a1d54cdf5f284c6d5 .claude/skills/deep-code-review/references/domain-c.md @@ -224,17 +238,20 @@ f824751693cf80407208ab0fa6bcae26d6f6de3595d312af85af2ed8230e04f2 .claude/skills f4f326a893228576d6508749803bbbe9df57815b8feea9beb28b6ff7c85abef5 .claude/skills/deep-code-review/references/domain-s.md d8e6a48d65a2e722b023fdf91b7aeb2697ffbfddf628bdd6625405e6ba859723 .claude/skills/deep-code-review/references/domain-t.md d82afc43d6ef9aa4ec1ce85fa9cdf2635888eee0a7980cb7473fa4e0b08b8871 .claude/skills/deep-code-review/references/domain-w.md -c0cd696d13048e457984b8ec303efa91ad3101aebe3c2d62daffdb31c26b8fe4 .claude/skills/deep-code-review/references/energy-efficiency.md +1c60334321dc4dcb6b2f7af15a1042070ff6cf7c5964d526407a420ea2f1a988 .claude/skills/deep-code-review/references/energy-efficiency.md ed10ed59f4ec9fcfb337ce474a8971b6a4a17f78bd0980db9a6bed08a308166f .claude/skills/deep-code-review/references/example-review-report.md 3a3779c8a6a1137198e97085c4a1f75f04e83663624e11e3133113ef85d59d3c .claude/skills/deep-code-review/references/frontend-a11y.md b11aeb6dc59a583ca33bb6039464e2c3c3bb7f6c9200a208f68c7c11a2742512 .claude/skills/deep-code-review/references/frontend-security.md 0270104d07e930aaa3e0e0466ddc385edc3f4990346791596b83d7f772ea188e .claude/skills/deep-code-review/references/full-audit.md +9a784db8a900b4c56b3fd8a087df12c421bb69153577769bc73e702e952204de .claude/skills/deep-code-review/references/full-map-principles.md +045e10417a2aeb1b3365e66006346fa408432af1e93e6132c2d1c28c456ad46a .claude/skills/deep-code-review/references/full-map-report.md +5c73ea52389d0deed140731b817de9e99c72a5f8feb22bb2a1472f0f8f54835a .claude/skills/deep-code-review/references/full-map.md f9c9e8626408258f95ff0174456425dfd7cd807c9757bdf12219ac2cbdc84e80 .claude/skills/deep-code-review/references/i18n-l10n.md -0abf5ad619d56d7f991f65a5630e8806a139541f1c84a31d9dabc9eb47f979d9 .claude/skills/deep-code-review/references/infra-evolution-by-stage.md +549a6d6b8707a517e45a83f88d331d7af4a00f5c8515e7f962107b216bf48208 .claude/skills/deep-code-review/references/infra-evolution-by-stage.md 9c2ad65f31c1cad2405b85ea6ee3a0bb7e52dc9a636f5b855187da320c0189b8 .claude/skills/deep-code-review/references/infra-iac-containers.md c27a828dc2ab2403c0ce1442c78c517bea465e4c30824bcec14c421149d37b3f .claude/skills/deep-code-review/references/lang-c-cpp-rust.md c975cb8db3c12febde56a5b348de861703760e871aa4869138bbc0854c4ccc97 .claude/skills/deep-code-review/references/lang-go.md -a993a8146294f3a9ecacb449f5ca4bacc52ea96df89e580aca55a17f52c77efd .claude/skills/deep-code-review/references/lang-js-ts.md +bc07c4366bfd341798ce0256ce9ea84dd61eba904901713933e94137395a852f .claude/skills/deep-code-review/references/lang-js-ts.md 051ed3e65f4af3a020f863b046e80a5663f7a2162ccd050e1c58b1cce080c2b3 .claude/skills/deep-code-review/references/lang-jvm.md ba03d850119e84e0abfd6875ab482b827d47edba1bec2bc0be0eb26806235f4d .claude/skills/deep-code-review/references/lang-python.md 42ebe7339583059eb7a3b1b280be76898e3d1263d100682d5971d4c40a2bdd8b .claude/skills/deep-code-review/references/lang-ruby-php.md @@ -242,51 +259,54 @@ ba03d850119e84e0abfd6875ab482b827d47edba1bec2bc0be0eb26806235f4d .claude/skills f2374ef94de331d8a965a4647c6039bf43dc9b198f697b365825ccc744d30175 .claude/skills/deep-code-review/references/lang-sql.md 58b33121250c278d629ec52699409f51778e55dd4795c7d4887742ddb0f6ad7f .claude/skills/deep-code-review/references/language-stack-redflags.md 4c874f9371336d24448e4e9bbd0d257c15432d52486587f28da1948df172698e .claude/skills/deep-code-review/references/machine-report.md -b74637fb05917dc32a7f71f1605b57ac8bfe2925f24b0185f4f71ae0159f6f7c .claude/skills/deep-code-review/references/merge-operations.md +cfdc3609c63b7669dd0ddcab3546dbae6036e5214668802acfb0cfc9117a8f25 .claude/skills/deep-code-review/references/merge-operations.md +712ff4adad24308045101ee386340a61dd80230ddcbdedc30603d18b412378d3 .claude/skills/deep-code-review/references/method-diff.md +1c428659366bb21fad34ab66f42390410dbf5191d97c07ca40db8b0476081fa2 .claude/skills/deep-code-review/references/method-lenses.md 43ce8532a5f85d5784bcfd1d052ed6d7e832902602d2f7e5e8c4fafebef0b8e2 .claude/skills/deep-code-review/references/method-report.md -81e8647f62d8ef9f75ffc19bc0dff4fb923aacd9f24e7942eed877a99a1b557d .claude/skills/deep-code-review/references/method-situational.md -ab430600975df56edf6c33e8d944e5d1c86de90823949713b147f98480508094 .claude/skills/deep-code-review/references/method.md -5f36ad64a585d3f9f17b1b5ed27fa4b8a7d68ca52cdd8c1e3bc780f6100be7e5 .claude/skills/deep-code-review/references/migration-parity.md -503c7a02eec45805f445e1b0c04b4c754227a6b6f4e3e67df0d5cebc3bfc2271 .claude/skills/deep-code-review/references/mobile-appsec.md +5e15780f3b4a72c712ca2bfdb808d64f0d52a96f868fbd27259fb15f87d160b8 .claude/skills/deep-code-review/references/method-situational.md +fd354313f768db8a13a99e4012379a2c75f804a120c8e2de8556a8cac3981742 .claude/skills/deep-code-review/references/method.md +5fd086a47f860ab2b946d9409d1e1de03b1338cf832d5f1539fb3dfe63d85001 .claude/skills/deep-code-review/references/migration-parity.md +17838a58489145ecb8a466737ae5e12ac37e98260d335d160aff95d3d5354804 .claude/skills/deep-code-review/references/mobile-appsec.md fa28846f30a5bc94147a194832fb1da96832f03818ff74e84708a8d2f8321327 .claude/skills/deep-code-review/references/model-tiering.md 9fb5d5baceb7993e68b46c59efa82b4919bfbfbc70d4cfc510bc416c3c26c358 .claude/skills/deep-code-review/references/nextjs-app-router.md 4fc1cb87bdd0d4d65c18b49f4fb856e316c105661573fd6b8adaf6b4079427df .claude/skills/deep-code-review/references/observability.md d22260c6b6281656663111f6d2673a53fea3327f3396c5e4fd4a419735fc41d1 .claude/skills/deep-code-review/references/overlays.md -b65f416c2cab6a67427a0bbaed4e56b339eeb9856a36ba7cfcf2a7228849b91e .claude/skills/deep-code-review/references/parallel-audit.md +0c278c040a88ec82cdb6572d4a9aee61d033c81229705fb5a3483112c97f0669 .claude/skills/deep-code-review/references/parallel-audit.md 2d00bf4115a8e6d078cbaf30a48fd8db69729a5c1a91b9ea381a3331fb24a56f .claude/skills/deep-code-review/references/performance-db-cost.md 34baa1fa6c265df2849eb2669c190f4b89d835de1287f96945f29520f31db65b .claude/skills/deep-code-review/references/privacy-by-design.md e74062e3cbf00e808d464a0a61560f172ee0724eae839ef14d1786636989be19 .claude/skills/deep-code-review/references/privacy-compliance.md -9fd0e3d993e52aa760405f19069894e06a11cdce712ac61ec00546d0fa54eb86 .claude/skills/deep-code-review/references/product-impact.md -9e6ae8d905f8f7fdbe683849aaf104ac16e1948ddd2ee390915ac36cff8202e6 .claude/skills/deep-code-review/references/product-ux-quality.md +9e5932478f180726180cc001bbd1ba4540234bf1e4b4c001529813d5dc89cb95 .claude/skills/deep-code-review/references/product-impact.md +7d8b4a5335cc3aecebaddb5d368ad4ed1d40bb5347484afe2b01eaf4bd52fedd .claude/skills/deep-code-review/references/product-ux-quality.md 5978e95203bb95f9918241cbc0b8748052d9f427177213f7ef65837a7bc8bc71 .claude/skills/deep-code-review/references/readme-authoring.md 7995d1310242bef10f3c0c9677664c20e1ef5cb22d8855804825e39757903d36 .claude/skills/deep-code-review/references/redflags-situational.md -1b6ca71c3a1e25eaa5c542528edd020dc9437d81fb735f8d29cde17d55c0b79f .claude/skills/deep-code-review/references/release-engineering.md +79ce5942086927d49a0b4082d4f7b81851486fe9d992fc4ee9e63f8bf6417736 .claude/skills/deep-code-review/references/release-engineering.md 9219b1271846574e80597b38069a46ce851d81311300d2bbbead35fedf2fc661 .claude/skills/deep-code-review/references/reliability-error-handling.md 9194a85db5dbdedab574d71b885d663a0de81df20e744b6c454c81c0d77af910 .claude/skills/deep-code-review/references/rendered-parity.md acd2d758c6c6c380ee3bbe1a7703ec39e116403d1b25d310585e7b3d23573874 .claude/skills/deep-code-review/references/report-format.md 251f4126bfb0f0729c96018a60720be59c33aff5ecae35ff49c401ea65b26024 .claude/skills/deep-code-review/references/review-config.md 3d79b2176667193b91f0e1bf9ba73e55e1e628b6936f082ef0a9e5326fe23b41 .claude/skills/deep-code-review/references/role-coverage.md -b0b419380ccb86599b92dac9b11775b2be45deb38fa7f97e530f92dfa40d0f38 .claude/skills/deep-code-review/references/safety-critical.md +d8075eb0c9482e05a96c8ded3f885f98b165a43cf19b52ba461fb90339b00cd7 .claude/skills/deep-code-review/references/safety-critical.md 9aa91ea0e701c629d68345b8d408223c1ab6ab4d486e79302e1b3db8f603be5f .claude/skills/deep-code-review/references/security-agent-skills.md 7b8e6447fd2d804bdeed3b08dcf64be069c14deac6a26836cc8fa88705c272f2 .claude/skills/deep-code-review/references/security-ai-agents.md 28f1d98a261743d86b96700b97ad01160ef64d5ee37a1f16445d811858580fb6 .claude/skills/deep-code-review/references/security-api.md -80b0f6e38fa231ba7cfdf2e6efad652a4d938ff499daeea9b825f75f32fdf0f2 .claude/skills/deep-code-review/references/security-appsec.md +3316198a2b5f8932000a009d449b0910deb309e4f8c47f02bec178d7ac5bc59a .claude/skills/deep-code-review/references/security-appsec.md +9fded29ad50b4aeb0c08f76788319b037ff7adf71f05146f9e19b9babd0a6328 .claude/skills/deep-code-review/references/security-review-mode.md e22c43592533cdeaa5dd6d6967d2a5519124dc2e5401b595caa182e7e0e68fb5 .claude/skills/deep-code-review/references/skill-authoring-and-size.md a0ed7ad061b7e60230601ee9b38a00400841d6ddf3af386edbd4b34a981c9798 .claude/skills/deep-code-review/references/standards-index.md 1d42030a463bd30ec43ed5a57af49551749d29ce3f3f4d0095ee59d3fafecd6f .claude/skills/deep-code-review/references/testing-ai-evals.md 65e11f80668f360d8516f3ddae7ea923df1c46f97edee08401024fb1c80bfd02 .claude/skills/deep-code-review/references/testing-and-evals.md 2463c659a2591017ee207a137da11ed263fee5e9b899c22873039e7c78fc40ce .claude/skills/deep-code-review/references/testing-ml.md -297b0b5ddfe244229c38740ab00ca8b86456d9d6f35bd89af52ccdcbed7145d8 .claude/skills/deep-code-review/references/testing-situational.md +962deafb27840de06b2b11a890c916a7590a84b9a10f5726f545d580d8af2028 .claude/skills/deep-code-review/references/testing-situational.md 8581f0023aedc9e0a4dece61cb2ea876ca9ab57f6acda63ed16c9b54494a1bc8 .claude/skills/deep-code-review/references/testing-ui.md 68df4819a34cbe23756eb19e9b513b9edcd675ad55da7d8c7624d95b124a9744 .claude/skills/deep-code-review/references/threat-modeling.md cf5218579b77d07ca49349165ab6d64c94b0145f61a4438cb09898a414793c68 .claude/skills/deep-code-review/references/time-date-correctness.md bfda9dd8f0d1718725e0fb8c2d6890f4fc2742c9a0d7993112ecf459a3af9f9c .claude/skills/deep-code-review/references/ux-components.md 5e69c5a0c0ab8d94079f2f08e026bc0e700369c76cd7dfeee6e5c7c5c2f020bb .claude/skills/deep-code-review/references/ux-dataviz.md -ee95753de1188cf6dbac71284198733408c1777128e37c73f56cd79f5617b887 .claude/skills/deep-code-review/references/ux-gates.md +68c40fe7134afac5fae125f107726136a911c67c1d4abdf0e4c627aee6751713 .claude/skills/deep-code-review/references/ux-gates.md 4f98d9176a1d1333fabf0a394deeb8d767c73af87f5d3773129e9711a9a9b8e9 .claude/skills/deep-code-review/references/ux-interaction.md b25047d750eaff669560ab3668190c558c4293626fd920b9e76107b3f67dcb17 .claude/skills/deep-code-review/references/ux-lists.md -a0181098567096e8b64ae34eaa0dff620734b1b9e23c70f3d48ac6ca10abb572 .claude/skills/deep-code-review/references/ux-states.md -5471bd39029699d2c39be56a627b33311e1c922eb8b10d03e0ad4c097455fd9a .claude/skills/deep-code-review/references/ux-sweep.md +36661cf454c462744660eda6a6f669255b7d4714e7f0a9007bbd5e68845e0091 .claude/skills/deep-code-review/references/ux-states.md +b7b85757362758f393b6ddaaafed0f8a5e5075c9a74b604d3a80fca0301bdd71 .claude/skills/deep-code-review/references/ux-sweep.md 0de8627b98293ea5f2b2869d6aac8ec6fd2015336dc4c2e17cd3c5b8f251455b .claude/skills/deep-code-review/references/ux-writes.md 034c0fe0b35fc11bc46b4ae8d3651ff80f9ed28d43b8aa3373927ba37ea6b23f .claude/skills/deep-code-review/references/web-fetch.md b05798db39365a53e913dee3910c1193de2560b00ef2ed47c91ec1608ce2a96f .claude/skills/deep-code-review/references/web-render.md @@ -324,9 +344,10 @@ cdacdfba4a9aff3c20344bfc8a4fe84b6ed24e85e9b5feefb2a08058f8858bda .claude/skills 9cf250be85e7c589979ca6a4f2774cf9a692695d94d46f6ded79480dea18fbe5 .claude/skills/deep-code-review/scripts/partition_diff.py 5d6910164ddf6dfd4ed62dfc365a2f615f49dc07878ed3d1f881aa9518e481c2 .claude/skills/deep-code-review/scripts/post_review.sh f1108e2700864195a239744b319b1d04953879589f8a2b83708bc45a080e3d86 .claude/skills/deep-code-review/scripts/reaper_lint.py -bd89f7f44348c13b18df3d7e1dda54524e6d58505ce87e5686e521566bcc17d1 .claude/skills/deep-code-review/scripts/review_checks.sh +b21d4b83f0d1b989aaa683960a7d8f9d2290fc5197a1318ef99b01d591e262b5 .claude/skills/deep-code-review/scripts/review_checks.sh 8c87c02a050a975e453b52ecacbaf01481c7134466a9c67feaf409d22e36d9f7 .claude/skills/deep-code-review/scripts/review_feedback.py 859c67d6a6a781c873f47d5662d403da2321da53e6994ca3d0ccdbf74afd39ac .claude/skills/deep-code-review/scripts/score_review.py +82d59aabe304664751d4ecf0fcd291daaf4a1d06f4a4fabc51d67ea6818716e4 .claude/skills/deep-code-review/scripts/security_verify.py 761ccb5730e297f41d865aeec9babd44b00b5cc029a8d4e7b2cb37b1122222be .claude/skills/deep-code-review/scripts/source_scan_tests.py 01ce284157850e6f9b146023dbcf12a8ed014db578ee5f6f27ddf21a2a3a0b5e .claude/skills/deep-code-review/scripts/token_differ.py 317acae212ed73279df66eb7b419b8426733bb1be05345b0e1c8b2c6790ad8a1 .claude/skills/deep-code-review/scripts/validate_status_claims.py @@ -335,21 +356,24 @@ bd89f7f44348c13b18df3d7e1dda54524e6d58505ce87e5686e521566bcc17d1 .claude/skills f31e66a322ee172e4b9621c3b70717a6e896ee64178f0e8ea77ac2088b6d0cb6 .claude/skills/deep-code-review/templates/integrator-gate.sh 1f2ae6dfa026858aa04bffa55f93d8e53995ea536e3b813dcf28a88fa6f983e2 .claude/skills/deep-code-review/templates/parity-capture.md d84df8bbfb7e87be95446e91151f1badcc85797c07d3cb574be00c66b4f6b7c4 .claude/skills/deep-code-review/templates/perun-review.yml -fa42b299035e2b95e18af0255a676594b6f95d1fd05d4afbb0bf722d9d097d8e .claude/skills/deep-code-review/templates/pre-push-verify.sh -1cca0387516479b66f42f6fe1b73c5981cabe5a7d9298fa82a1a4e92841cad07 .claude/skills/growth-analytics/INDEX.md -f6372ab0fb5c5b405b47b5dca58b6f596aa5d70c4e6e8b63ba0aaeed6df549b3 .claude/skills/growth-analytics/SKILL.md +981b3bdcb130997a5f4d102334ef9352eea1440674b3bb89a838768a7d44acef .claude/skills/deep-code-review/templates/pre-push-verify.sh +29ee3a47eb7973011cdfe1fb4321aac89fc0fe8f98776505df70a6d6a45cbf0f .claude/skills/growth-analytics/INDEX.md +4fe9fb6176818c279ddce11bde1aa97157800190075ba79604c174a5d9a7c59c .claude/skills/growth-analytics/SKILL.md 77123b8e4bdbd54505bf6e8021527ac60281602a06fe307564532c4dba39dbca .claude/skills/growth-analytics/VERSION 60cd5cd0290217b94c6a0a1168b6180ef0991006cce6263af80f21b4abdcad07 .claude/skills/growth-analytics/evals/evals.json e951eaa63fd0d1870701d69c89c29ef4fe74dbad9b680ab6ef0a4e993fb8bc20 .claude/skills/growth-analytics/evals/triggers.json -be7fa2e828bbd1b8beafa9931901fca459576f32be2b152a8836205cb7b514b6 .claude/skills/idea-critic/INDEX.md -098888e75f9fe5dae76863699f4d45b06f36abe60ca92d1e53c6db8609222467 .claude/skills/idea-critic/SKILL.md +fd316c63bbf1cc0ea64322d7d923d66692eaf7b545c056367bfecca35146c862 .claude/skills/growth-analytics/references/full-map.md +2f1d7499e9ed7ae59f550b5c00043e465b2a4e885821ad153438e2e33fcccb45 .claude/skills/growth-analytics/scripts/readout_check.py +0183fe90e2571e76e3067cad83cbb1177bc8eb257956875196c28f4e675cb74c .claude/skills/idea-critic/INDEX.md +ae991a79f2973fcb925f12237dd64af5f669a2bdc39fd776595243bb177ed842 .claude/skills/idea-critic/SKILL.md 3a7100063ea7874528922e525d36b65ed738826902b54408420eaa5ac17bfa83 .claude/skills/idea-critic/VERSION -86a64a093eb5d07dd2cd38789f4a43e65358e3577b7d385c0378155832343657 .claude/skills/idea-critic/evals/evals.json +e68b27f878d68b6b38dcf270da4a993f40a77b78ed50038833f4efed160855ad .claude/skills/idea-critic/evals/evals.json 0e1c0db300661a1ab1a427a7157c75e2ed67130ab24d5c6cb02ec3ff9e793f58 .claude/skills/idea-critic/evals/heldout.json d8098c5ced63e8b8608867dd144091049563a0553cf62d27ce05b9d52ac54266 .claude/skills/idea-critic/evals/triggers.json -cdf41ed9b5334448736c1490f7438a66115581bd191d09ac16e48e73be2d89ee .claude/skills/idea-critic/references/anti-rationalization.md +37d13d879460b9e65f017d62303e30adbf2dcd590ff3a2156ba2b53e931e611d .claude/skills/idea-critic/references/anti-rationalization.md 46d0ad9c3fbd02575586a4a95e71651e97171596ac91873ab2eb7eca3cc6d0fe .claude/skills/idea-critic/references/council.md c5615e5c59bc2e452c2c49619be2ec5e456f3c167e772498316f8b5a45deb2c8 .claude/skills/idea-critic/references/decision-hygiene.md +7ffd569fd3a9aa4b2fc969c8f163b88373929ce77388aeebc8fb5737783754bb .claude/skills/idea-critic/references/full-map.md b9339c3a39f7af13fc3a3103b57d6a203207986b1d9912df50ac94b990a68c9d .claude/skills/idea-critic/scripts/council.py 3dfd631f08755989ae8f3497d4ed5920a39dd4ab058bb9a9f70e2364dfb72399 .claude/skills/idea-critic/scripts/lenses/better-way.txt dfe0fc8220d5eaa56092bbc8638b38136f819dc4a8b333307dfeb1d0ab3e51f4 .claude/skills/idea-critic/scripts/lenses/cfo.txt @@ -360,20 +384,26 @@ ffa9792bd3dc750725d85e32f91a8051d2f21932d035f3f4e47fcccb66186860 .claude/skills 3cd5013dd2a63683f6b0c5ee1b9a0887e9eb893dd6cad8d571939698928fc917 .claude/skills/idea-critic/scripts/lenses/kill-criteria.txt 0b3872c37c94e1db02a094ccdb04a39d1a245b1089f801729c2c1827a154ff6e .claude/skills/idea-critic/scripts/lenses/skeptic.txt e3c08eee63d6da353029bfcc78f0ba7638d75b3acb02fd0af045e3c399a857a6 .claude/skills/idea-critic/scripts/lenses/user-advocate.txt -61738abe40fb35bc9174c24e05fd817516ac4ecaf54345d0b2b7565bafde49bc .claude/skills/idea-critic/scripts/validate_verdict.py +5baa5b2f797a24208cac893de5ba34bda548590c0340ca41826bbcdc60dabf6c .claude/skills/idea-critic/scripts/validate_verdict.py a0402ed9fdd0c41c97d70d8d2c28d642b86b9ad1bc4c943058c30052c7007959 .claude/skills/idea-critic/scripts/veche.py -ecebac5632f36162d73f75ff6fbd443c213b8112c61bda0a6845ddf4a64ee1fb .claude/skills/positioning/INDEX.md -78568f7a101c3f0c6291e2520372d6d90d5c91455cdac41c35fcd297c1a94580 .claude/skills/positioning/SKILL.md +b812c50e074a71f342c5a9cf9d032f31be84768cd231840a0006c26c66536ccf .claude/skills/positioning/INDEX.md +595e209389ef87fded12b1f0b9a7f368449bc622e8b431f74a4f603438ed20b8 .claude/skills/positioning/SKILL.md f5e5c9534532840fcd45bb002e69ed85c61dba2753450e26b448b7df1481e24d .claude/skills/positioning/VERSION 4064784d173b17ebd9dfb78fe379b69a5ccf47b2dc110794ef669f7a0e642d54 .claude/skills/positioning/evals/evals.json dbbce310d05603993a7f389ec2e885789fc9009cec012ee811ac9326d84f4b2e .claude/skills/positioning/evals/triggers.json -c30c8e4476927958f7ec51f42039354ad0d2cb46b5b16a322b0c0d674820949c .claude/skills/product-discovery/INDEX.md -4c863da9337104d7a719fd6d2f33b80811440a308c9fbd17582150f8ae53beba .claude/skills/product-discovery/SKILL.md +01af24622ace8dadedcf25bf623efda1f94e89dbfa6fd2d08a5a023f7f362359 .claude/skills/positioning/references/full-map.md +fe00c3f37ed1a626e4ece40848a1cb325c0a617529a7c6a4c8c56c55aebda169 .claude/skills/positioning/scripts/positioning_check.py +d592e49ae2627c6ca6b60a2dc1dae523d208dac305dddd071e209a059ef57bdf .claude/skills/product-discovery/INDEX.md +fad7f636dcfc71f8155cb6522b97afd18bd2151bd6e271fab4ad44524ae3dd7d .claude/skills/product-discovery/SKILL.md 6cf4e084b47f33c9b02ef79279d157833868f8f70514169a768be353ee328fea .claude/skills/product-discovery/VERSION 8564f32197bfff1aefa29ba417d72255ec13f400bd4bab0f6228f8b1232acaca .claude/skills/product-discovery/evals/evals.json 8f99c3d677312503a820e13b22ab750dc6bbebe3cd66c1d893c1e46af846b641 .claude/skills/product-discovery/evals/triggers.json -db236a4b60e0b5170b2dda95ab8c4aec5d62d90ddcf9d2009ca27c3ac8b7b9bc .claude/skills/product-output-safety/INDEX.md -0f828a844dbe8c4e648a1a89c03bf06480da557f6e39942f78ef9205fd8e03f6 .claude/skills/product-output-safety/SKILL.md +a513b87088061908f7a5fdf74111737d08efb02eeb530ade44e7973973a708a4 .claude/skills/product-discovery/references/full-map.md +a50362602105303daa79536ea22e09f9bf6bf708be3e05afff197c413b74b688 .claude/skills/product-discovery/scripts/discovery_check.py +ce476dcd13175969e8831fe6f818a9d79834310b220366850a6ee1551044b4f2 .claude/skills/product-output-safety/INDEX.md +5bd06f625785fff80d988d56857c27beb5ad25b985e856447c8f2a22a9d7400c .claude/skills/product-output-safety/SKILL.md a74a0cf84ef0b15e01e64746c3465813312b763796f4f6362b092f092dccb8b5 .claude/skills/product-output-safety/VERSION 8f7ad4f569ac8f8a291b3c936e80741e580374d43356450f81bd9df94c91dc32 .claude/skills/product-output-safety/evals/evals.json 6a09082b7f2a08b5b6c06515e39315bfead65b366e5020c9b85052b7c4a5229f .claude/skills/product-output-safety/evals/triggers.json +e38031b9b654f0cea5115435646e9107422b46e5b79efba3ba3851c1dcc5f892 .claude/skills/product-output-safety/references/full-map.md +7342bc2d3ccc93fab578c282a1c2c994d9dc63abf7ef96a5d0fed7ea93a327a3 .claude/skills/product-output-safety/scripts/output_safety_check.py diff --git a/changelog.d/review-latency-split.md b/changelog.d/review-latency-split.md new file mode 100644 index 000000000..5f95ca456 --- /dev/null +++ b/changelog.d/review-latency-split.md @@ -0,0 +1,5 @@ + +### Changed +- Token optimization: the two largest must-load references of the `data / ETL` and `lib / SDK` archetypes each shed verbatim depth into a lazy reference. `performance-db-cost.md` 43051 to 31096 bytes (-27.8%): three handler `await`-ordering bullets (sequential independent awaits, a shared source re-read per projection, an expensive `await` above an early return) and four cache bullets (derived-entry invalidation, key cardinality, expiry stampede, refresh-on-every-read) move to `performance-latency-depth.md` (13236 B). `api-contracts.md` 28126 to 21458 bytes (-23.7%): the WebSocket / SSE / gRPC streaming section moves to `api-contracts-streaming.md` (7409 B). Each lazy file opens with a "Read this when" trigger on what the repo contains (a cache layer or a handler composing async calls; a WebSocket, SSE or gRPC-streaming endpoint), so it fires at FILE or FULL scope, not only on a diff, and is routed from its core file and from the `full-map.md` domain map. No safety check moved: the per-user-data-in-a-shared-cache rule, the shared-cache-key-on-varying-headers rule, cache-as-source-of-truth data loss, the append-only-store reaper, the webhook, queue-evolution and email sections, and the streaming auth pointer to `security-api.md` all stay in the must-load cores. Must-load tokens per archetype, before to after: data / ETL 19991 to 17003 (-14.9%), lib / SDK 11038 to 9368 (-15.1%); api / service also loads `api-contracts.md`, 19589 to 17922 (-8.5%). The Phase 0-2 floors rise 27 tokens each (two short routing cells in `full-map.md`): phase-floor-light 18534 to 18561, phase-floor-full 26513 to 26540. A review that fires a lazy trigger reads the moved text back, so the saving holds only where the trigger stays unfired; no paid bench was run, so recall under the lazy files is unmeasured. New `scripts/test_latency_split.py` pins the line multiset of the four files against the pre-split lines (`scripts/latency-split-lines.txt`) plus an explicit allowlist of the nine added lines, so a dropped, duplicated or edited line fails, plus routing, triggers, the retained safety bullets and a size cap on each core. +- size-budget-raise: .claude/skills/deep-code-review/references/full-map.md 18720→18829 two routing cells naming the lazy streaming and latency-depth references +- size-budget-raise: .claude/skills/deep-code-review/INDEX.md 18650→18963 two generated index rows for the new lazy references (a FULL review reads the index) diff --git a/docs/INDEX.md b/docs/INDEX.md index 37ed43928..46e026e53 100644 --- a/docs/INDEX.md +++ b/docs/INDEX.md @@ -4,7 +4,7 @@ Generated by `python3 .claude/skills/agentic-delivery/scripts/focus_kit.py docs- | File | Read this when... | Tok | |---|---|---| -| `docs/capability-matrix.md` | Perun capability matrix: Of 18 capabilities, 12 ship, 5 are partial and 1 is a gap by design (compressed-prose and minimal-code modes). | 13529 | +| `docs/capability-matrix.md` | Perun capability matrix: Of 18 capabilities, 12 ship, 5 are partial and 1 is a gap by design (compressed-prose and minimal-code modes). | 13804 | | `docs/example-review-report.md` | Example review report (fictional): you want to see what a finished FULL deliverable looks like — confidence markers (CONFIRMED / CORROBORAT… | 1633 | | `docs/for-fleets.md` | Perun for agent fleets: If you run several agents in parallel, install the delivery overlay and wire the gates: ./install.sh --full --with-… | 3572 | | `docs/for-leaders.md` | Perun for leaders: Perun is a free checklist that makes an AI coding assistant review software the same careful way every time. | 3178 | @@ -15,11 +15,12 @@ Generated by `python3 .claude/skills/agentic-delivery/scripts/focus_kit.py docs- | `docs/idea-critic-outcome-1019/README.md` | idea-critic outcome bench (2026-10-19), exploratory (not preregistered): on 36 historically resolved go/no-go decisions, the idea-critic sk… | 2085 | | `docs/peer-survey-2026-10-16.md` | Peer survey and field measurements, 2026-10-16: The roadmap in roadmap.md cites this page as the source for peer-reported pain points. | 335 | | `docs/perun-doctor.md` | Perun doctor and uninstall: Installed scripts and hooks can sit in a repo and never run: an operating layer that needed an extra flag, a st… | 1588 | -| `docs/perun-vs-rivals.md` | Perun vs other skill bundles: 2026-10-17 to 2026-10-19 held-out runs, free PCSS models, judge protocol v2). | 30075 | -| `docs/review-cost-per-recall.md` | Review cost per real bug caught, and false alarms per case: on the one set with per-case data (S1, n=22, patch-only), Perun's real skill ca… | 2805 | -| `docs/roadmap.md` | Roadmap: Two parts. The product roadmap below is what to build or fix next for Perun, produced by the CEO improvement loop: ranked by a pri… | 15493 | +| `docs/perun-vs-rivals.md` | Perun vs other skill bundles: 2026-10-17 to 2026-10-19 held-out runs, free PCSS models, judge protocol v2). | 30463 | +| `docs/review-cost-per-recall.md` | Review cost per real bug caught, and false alarms per case: on the one set with per-case data (S1, n=22, patch-only), Perun's real skill ca… | 2915 | +| `docs/roadmap.md` | Roadmap: Two parts. The product roadmap below is what to build or fix next for Perun, produced by the CEO improvement loop: ranked by a pri… | 15600 | +| `docs/scoreboard.md` | Perun scoreboard: Generated by scripts/scoreboard.py from committed results | 4422 | | `docs/self-improvement.md` | How Perun improves itself: Perun is improved by running Perun on Perun: its own review skill (deep-code-review), idea attack (idea-critic),… | 1268 | -| `docs/standards-index.md` | Standards index: Every standard the skill relies on, split into what was verified by direct fetch for this release and what is referenced b… | 93434 | +| `docs/standards-index.md` | Standards index: Every standard the skill relies on, split into what was verified by direct fetch for this release and what is referenced b… | 94767 | | `docs/team-install.md` | Team-wide install through a Claude Code plugin marketplace: This repository is its own marketplace (.claude-plugin/marketplace.json, name p… | 478 | | `docs/technical-overview.md` | Technical overview: you want the engineering detail that used to sit in the top-level README.md: the mechanisms table, the full "what you g… | 2288 | | `docs/token-cost-tips.md` | Token cost tips for teams: the biggest savings come from sending less context, using the cheapest model tier that clears its own gate, and… | 2127 | diff --git a/scripts/ci-tests.d/review-latency-split.sh b/scripts/ci-tests.d/review-latency-split.sh new file mode 100644 index 000000000..c9713be19 --- /dev/null +++ b/scripts/ci-tests.d/review-latency-split.sh @@ -0,0 +1,2 @@ +# Registers the performance-db-cost.md / api-contracts.md lazy splits: line multiset survives with only allowlisted additions, both lazy files routed, safety bullets stay in the cores. Offline. +python3 scripts/test_latency_split.py diff --git a/scripts/latency-split-lines.txt b/scripts/latency-split-lines.txt new file mode 100644 index 000000000..e0e0ab220 --- /dev/null +++ b/scripts/latency-split-lines.txt @@ -0,0 +1,862 @@ +0080f10b786102f9 +00a3a12d26c208a1 +00b391989e41be1d +00deacafab64607a +00efb3ea2e6dc649 +011d5a7756e3d284 +017434aca34d6db0 +0219bec391c6c2e9 +02516adb95002b7e +0342368da7fe1bf2 +03b3999a8c847548 +03cc6555b09f40bc +047ca517f0bf9e2d +048aeb53cae70a9f +04a339a19b81a50a +04d1459cd98297d9 +04da7bed09834044 +051a3a7d95cc47a3 +052d0ed147328607 +0566959cad7d628a +06751652c6f3f197 +06c0fa5640580aa5 +06dd48f3f955c982 +06e77e3a18b9eca0 +0702e700d753afcd +073f115db17b4394 +07ff9f625a0d91c6 +0859a88887f18ba3 +096251de60c0c4ed +09987c69a35c927b +09d6c9b056a4b632 +09e4c896708aebb6 +0a0697d4e3f69a9b +0a2427f47010d3c5 +0a8a89ec95c95ec2 +0c16f8d5ec1fbab1 +0c39894ba8049b1f +0c4ebb4fd510ef08 +0c9d922d60fc13ae +0ce648bca997a91a +0d00396b510cdbde +0d735f789dafc3d6 +0e26f450d11f5056 +0e32ed527786f419 +0f1a4254f219450f +0fb783c02f20d148 +0fdef396a12c1683 +103c112800dddca7 +104180a1a7d877d8 +109fbc8157952e72 +11237b3e41ddc8d4 +113e4128858c63f8 +11f87cca2776bcd3 +11fd96e7c2edead9 +12877becb9bec302 +12a86a55b8e1efa2 +1391782f1706d13e +13bcea2b64e42b3b +13e68b9a4e087e53 +142a82133ca35c57 +1482e4fc08b8567a +14b4d4af18f9febb +14ecfd2fcae815f7 +151a89b8f244337f +15eb9dbc55a055d0 +164c5cf72bee667a +168099e2a0523e3e +16cfe908ecc09470 +176213b6900b6324 +183097acd3619abd +18f307dabab5cd9a +1945298832257255 +19828c3deb4be08c +198ae437569b5f16 +19b3273f6979ac4c +19ce87a7847be383 +19f22bfe617d075d +19f8d7c6385813d2 +1a9d1417bb55aff6 +1aa8e006a387ec68 +1ae5f3df57da2078 +1baf000d3f78d386 +1bb7e696e451481d +1bc9aae5a3721478 +1c364659c485f0d3 +1c83ac57a438b323 +1c944731f1542fa0 +1cc3dbe19c95bee2 +1d26cee5f03e4ed5 +1daf2ebbccf6188b +1db4684224738dbe +1dbf2a40fbd635d6 +1df32aed1609d36b +1e3bb18ed9a098a3 +1e419803171c0bf4 +1e649a549e5de9a4 +1e6a99c95558f5f0 +1e7dd12bf1418bbf +1efe130a0acbae9e +1f39ef0234a98a6b +1fc462e7875a3d22 +200e2abea0d65f87 +20e6d7c17adac46f +20f95ec149705df5 +21240bda4f649220 +2127dda6478af210 +21fdc5e75300a1a8 +225b1fb4174a306d +2280e5e88fb8c84f +22bc759b45e28751 +22fba4674d1cbd2b +239b1090f3d27fee +23ab93c41b0c5bdc +23b06229988142e7 +2446c19abc0e8bed +246e32fb2e9b8774 +24b04a61e09d6233 +251c34bc150c6c0e +2553af9c73d3de78 +25a4c96807fbb7db +2671dfe4b1cd1c00 +269a77c9f1c5aff7 +26ec1faf11fa2478 +2733051d617a05cf +2734822e9b03332a +2792f6fcf1fc7f0b +27a9998a36b45322 +27b43fc895c6bb28 +2858b73b43525c70 +285ca53045cd8446 +28bad7b8933981a3 +28bb9bf983395f83 +28f28bb8846a206b +2a3a02a308b0914d +2a6c27b9aaf4daeb +2ab5a47c78216c37 +2b0f4bf5248ff722 +2b4b50aae95ac8f9 +2b5f2f8baf2843ce +2b7195ed820eb714 +2b928030a99b1779 +2b97923860f56931 +2bf655c1bef64536 +2c24cb53879839f3 +2d502b5b67200198 +2d52603306c9e948 +2d8c4f7c24332c2d +2d987a1fd715ef41 +2e02ac2954639ebb +2e1d478507aaeca4 +2e4bb412a0e593f4 +2e7eb36bf8be1016 +2e98765854ba756f +2fb2a611e9eefbe9 +2ff77132793158f1 +30118b84b39bf797 +3021941b630ac7f8 +305d575563f6e99b +3083b25efc9343d8 +30866e0595297143 +30af85316ec39759 +30cfbb8d62d53bbd +310152dec3d1b8d9 +310ab402bb4b9f66 +31aeda9a8c553ef0 +32064bab89fb9f7a +321e21250802eb9d +3257908f9f07fc89 +325a10543cc5f8f7 +329c397b8e6dd1fe +32e8b8e38b092d7a +33aac49e64463bc9 +33d65b79caa2f0c7 +344e45f86bd28bc1 +348225f427581dce +350b9217757c1808 +351563e3f095c6fd +35991cbd50bf6b86 +35b9eab48266d928 +35cc04769dbe8444 +35eaf45fe2dc9bec +35f4b84126875dc3 +361f62b4e8cf8d0a +363fcb0a1b7eec38 +3670679105f9697c +3693de956bb10856 +37487f2428e4c906 +3782aa0cd730ba80 +37b32f7420d208e5 +37f109dbfa214c9d +3821353011e35eaf +385eea53f55f0f81 +3893abc865057038 +38c85c87cd10ac84 +38cf2d94bcf39ece +39165c3c30245d54 +399a30d8d9fd6c1e +399df4e9b1a59360 +3a50ad6f1ab3a2fb +3a6bf48596a4edff +3a70e9865e648459 +3aa4908a06c5fd8c +3ad3caff6aef7f85 +3afd323b3baa796f +3b16326e9c376131 +3c2052e7b21a2f8e +3c351125ee2f1dbf +3c9b6cd5dac24a7a +3cd2df72cecadba7 +3d2843f3f21ce222 +3d3e31b4e0ff0711 +3d66c9cec501b84b +3d713cc207b6467d +3dbf503492c667da +3e3e49cb0db2240a +3ecc82db966643d9 +3ee93b8bf9e84b76 +3f00f4781efe1a6a +3f0622cdbd18a403 +3f618913c60714ff +3f98b58f09827f6c +3fd434338bb21fcd +4098aa95eef2d7b4 +40c27e1f2a2a7570 +4128165a4df8873a +41b8466291a6a3a8 +41be82128dbbf5b6 +41fdacde04e9ef11 +4231ece8972c7ad8 +425dac4e10c4c935 +431623374fd47206 +43b2567d93216416 +43c0c34c170e3998 +43d59c525dbcab7e +45c267516c8af169 +45d602e300a730b0 +45f5b8a38333a1fc +4652eff06b462e4a +46898ef04fa2ba1c +472a2b040fb87468 +472afda474c747cf +4773208f1c6084a7 +47bf9312bfbff0e8 +47d26f1cbfb3d429 +492f7876a4abb3d9 +49331b8ce9ce1cc6 +493e3e50a2449198 +498617137f6c3433 +49d8ea439d603b9f +4a7bb88b9a3016a6 +4ac8149197d29629 +4acf82f8b9a5d516 +4af1812ceaace1f0 +4b3fea26f6f00037 +4b4499df8405d4a9 +4b609433fb61fa51 +4ba6ef61b648be05 +4bd06a7cf9e4a406 +4bda500b6313c576 +4c3afb6c9fa6411c +4c8c74733edceca0 +4cc27d0586b65a3c +4d0adf531e3d6517 +4e152b9a4462a694 +4e4a1d779ac82317 +4eb33b9861d2a8a1 +4eb7098d32cda4e7 +4efcc2ce6e4b9c70 +4f40ebc7a3d9dbe7 +4f419a184034f179 +4f9edf38d6fe2d13 +4fe77d3d5d1a4a5c +4fe9d715a558f363 +50681fbdf0ea0a99 +506dd44506836561 +50d427cfe58bd9ae +50f0b795b2002a11 +510fe9624c0f2991 +515ac6ad12707c70 +5189078559101976 +51f6eff5947e978a +52075ddb5a1a2dea +521d2b7f8377860a +5233fb6f9f0f6de0 +527138b1a583d4ac +528795e6e635dbdc +528ba098193f1f34 +5293e2b891c7375e +52daf7b13cbd5cb3 +53ea8b2402949495 +5434ded8f814a025 +54ae704458ba90e0 +5521e2250f2a88bc +554eb4978b90d657 +5588e65f90af45b3 +55b3b6d07cbfa0f5 +55da389b6e55cf57 +56b1b5417a71e786 +572b5c701739ea8b +574bd7648b403cf5 +577992aeaed8a872 +5797926169ee2ffd +57c719d63d2ff023 +58167e1134b5ceff +58acd56e60bde06e +593ad8e843e817ce +595647f707ca6b6b +59b410c7dc6a9ca4 +5a32cb4ed7f1c378 +5a65728afff5af67 +5adb68a2c0af946f +5af1fb9271dc6b14 +5b44cfb6baae0e3e +5babdd9b8f502f7a +5be3d92571c4d44d +5c07f922a333bf18 +5c2e4b7aa5134105 +5d042ebbaf85903e +5d114ab911d83f67 +5d4bcef5f6747a07 +5d76cc777f25b408 +5db6fafd260c304e +5f013f99195e8295 +5f3d92b32e43ef1b +5fc5350f7e80285c +6028e758c023b812 +60aba1b54a004994 +611250ddceb4da58 +612f9a53a5e37488 +6195fa28c50a85bc +61ac3b338cd8b460 +61c4babc6ebfb029 +62814d75edb7dcf8 +6306a0a86a70fe79 +63555c80291e4cef +638e6662a7a6513d +63d7ef907d331dff +644d617ec64396f1 +64b072e57a3587f4 +64c249bd69d9582f +64e2d39553639c9d +650f8cea8e1c4ca0 +6514666ada91499d +6524720ef92fee66 +6582debad108ec5f +6590403bd76a5e25 +65a6c14329dad017 +65bc64c8c5e596c3 +66b21af69a699bc1 +672695f6c89cedce +67479e3ac88f29a0 +67c12f5b1e2be453 +6824bf1e49c32af6 +6843c925cd108862 +68880a3129a4ce16 +68c6a2e5f0ba0845 +68f69c9f21a07a71 +6a1676b1ea5fa84f +6a1a12edcf532b16 +6ac58928c64602c1 +6b3aa86b9b88361c +6b4035cf2d29b047 +6baebba79e224602 +6bb921e1ef18effc +6be4dd3bbea9c3bd +6c4c1c4f389f668b +6c94599d76085007 +6cc3bf6e77e4c0b8 +6d70b5b11085c8a9 +6dd1938cc9ca771d +6ddce0e4a11babef +6e7858d30b32ec17 +6f1a5474b842d7e5 +6f2079038815cd15 +6f8e4ddd7aa9bc32 +6fbd6b854ed5d837 +70190a56b4721957 +70b150ffe36b7340 +714cd233858eb83a +72422db2ac6d5c98 +73250c0227adff62 +733a6b608d237512 +73ed8e33c58b5d9b +73f4afd042154e7c +741f44f423554f3a +743ca2f6b02d93f9 +74e1991b8f6e94a8 +74f97be4117dbd0d +7655aab919c7b3c3 +771d5881a18d54d0 +774671c0d65e6f76 +774856b8eedfbab5 +774a5807ad69c49c +77888414fba363cc +77a1560713961b87 +77a964ecda09e83a +7818b3bbfff3f330 +781d6d692346c1c6 +781e8f3585c2f6f3 +783aa760b89635d8 +786ef244b0b1f707 +791b743456276b83 +799fed41b83d8869 +79c8aca3b5e56288 +79d3821504ca138a +7aa48391d2bed920 +7b3687ca42089ac7 +7b94976f396e396a +7bc249de7eacf1ed +7c0dc6c54c2b3fa5 +7c3d097436d16f54 +7c8025170398a660 +7c8b3bbf1a2469b0 +7c97bb5522fc7582 +7cc84f4374a63915 +7de8d161db9d8e4b +7e7eeeed60e1e2f4 +7ee9b18cea892c8e +7eec7f54948854cd +7f3ac16f15dc0734 +7f5ca7d3fbbef291 +7f638acfed1108ff +7fb790d89fcb4a9e +7fda9de326e65124 +8011d475dfc17182 +801386f66e32ad56 +803054a9e4940b61 +80afae5e97c687d2 +80be37419a8d5f09 +8109ecc4efaa7355 +8127454d28547114 +813c6052eca3dce5 +81e8c6462f5a7925 +820df1d884ca5266 +8259c38d4574ea6d +82a30136643e2b32 +82bf3a3981f312c4 +82e57c702de19825 +8307e678f0f7bc36 +832bafa8bdc7cb67 +833dfcf3acbe5025 +8379b78124f60c81 +850ada5e5321b80f +85284e6e26b1dc0f +852d82c0c07805f4 +855b0c47427cbaf2 +85ff36ffdeb54c44 +8606ae9cdd7948c4 +86f3cd17ab2c4b67 +86f75eb89285e776 +871619c5a2f02ad9 +871a71c039f94fc8 +876623c4717d3388 +87914944a6a590a2 +8830904ba435ffad +8853dc41c7cad01a +886152d60c0e3e42 +8866fcc2459a1443 +8891a26ad42f16ae +88b1a786acae687d +892fd8ce3c21d0fb +8942a6d50104be9e +897acc9fd31601f8 +89d425f23ab05fac +89d7d8d1058f0d51 +8a51d50984e64c5f +8b7f48c18af6c3e5 +8c002f779b619305 +8c2087f008eab858 +8ce6a68b1141678b +8d4706eada293931 +8de3d3347821cdad +8f04892779d52990 +8fc098532ce14829 +8fd44a6c7932210f +904d21b741381116 +90979a0408d68eab +9097b9d475b488cb +90bb9860032667b7 +9114ff340ed5a55f +91453e0c66475371 +91a0ce6fb9be3e6f +91f4c43b88629675 +9234c27f44e1d12e +92bc5858f482f11b +92d9932f75b807a5 +938d5158ac05b3c7 +93d6feb7686abfe8 +940eb1610a2f3290 +9415a2b947f8da91 +941977868a1050d7 +94641e42051bc09f +94b597540a4e3233 +94e18c5ecba5887a +953da1b635383321 +957bb65143a88e62 +95ac8f6751300707 +9605f511b7f3b052 +964cc9f1c9887687 +96bc7ebb44f7d1d9 +96ca4fea46ab6144 +96d351e1edc8a097 +96f67e4e63e38684 +9738ac80a08bd96a +977332b8b17d52ca +979b28d30597fbca +9865f3acd4ce6871 +98665ae04dfeb93e +987cae11447797f0 +98cd2a1a4c002704 +98e568af33a306db +996bf4d83a3f2f62 +99b056ba6b137116 +99c0f5b8f69f82ad +99d1c1e1a48efe72 +9b01d9861dad4a3d +9b2f09e1243b364b +9b61895076edebe8 +9b9946996e295a5f +9bb2889b895ab174 +9c8884583de6a76c +9cd629bfe2b64135 +9ce6d75c56338f15 +9d1c3a141faf72d9 +9d890e9c29e47e87 +9da7e9d014c3feaa +9da8e4c771ffe616 +9e6b176e8619736c +9e6f83098b9a1674 +9ecb9011f5d042ee +9f0c97fff2ac2fe1 +9f548c0afbe4852b +9f55709677744cfd +9f585dcf3a01aec3 +9f5b12a67958d422 +9fd54cfac63a9052 +a06fe44f3347bee8 +a0c2614820e3c53a +a0cc4fc1ba13c9ea +a0e6086bb49af281 +a0e71bec39465d4e +a11b16c73bdde56a +a13fae0e03bf2dbe +a179036e9a43efa3 +a1963efc5c4fb97b +a2056c657fad5e51 +a2108ab1b91fb202 +a23688ec36a37c15 +a2d3a61645abb4ea +a393cf3a94cf9680 +a3b85efed84b8203 +a40b4a97120af1a9 +a43b55aca3689698 +a45680af9332d8fc +a4bb8a66b7bd2a7d +a4c30946860702eb +a4dd5c2103f76fb6 +a6302b5383b1b36f +a63727c12344d03d +a667c18cf5c208a2 +a6795f6f4b8d87dd +a7717c9e1023d486 +a7a14a0c63442343 +a7d4aa206ff4d24d +a7fbf95f1caba1eb +a86ddc28bffea486 +a87295f98d63eabd +a8deeeeb636f04e7 +a8ebce2f2586eddd +ab80eda2b08dbd72 +abe0b714a5bbf6b9 +ac4dcb3832619d46 +aca1165446287bbf +acc86f21d79b06e2 +ad1bf51801ba3660 +ad1cbfa9c4eaabd2 +aeb53f80df9f7919 +aed57001d403cb78 +aeda4d808247fd03 +aef27b180606011c +b01f7ffb61477db5 +b044f2ed743ff965 +b064284c1811c2b1 +b100821e682c171f +b12aff1df0e07328 +b12d0d6400b3e427 +b15602dfc74be009 +b23483d491c4fc37 +b26dd92ec472c5d2 +b2812ff966e0aed4 +b298bea6e57c2975 +b2e75563b94971aa +b2e89a6154d74e64 +b34acaaf97e13c70 +b4df4c30ae648e40 +b54dfadd1fe8175b +b578cb4adaef6c73 +b59653a6a783e3c1 +b6ef81c9376a9df4 +b6f6679ba6ef6576 +b71bf7027bb80b30 +b73af737c78cb294 +b7970cd4be287ae0 +b7d70f70edf061bf +b7de472e3683e509 +b822b0c958e3c808 +b857a8f0b8c7f8d0 +b86027d3a942a5b2 +b89bb67e377d7e8b +b8b8ceaacbfb61cf +b9ec851b0c95b437 +b9f4f5820c9e437c +ba4051d2deac5dd4 +ba5a7ffac92f9a56 +ba679be0bf6d415d +bb83606493dfd114 +bb8fe6aa0f0853be +bbe1aede997a1852 +bbf3c224ec3a7e89 +bc54bc5b00749cc9 +bcc6e0661e13f97f +bd39b376d1666823 +bd7044ebb799d41a +bd975688d9125843 +bda8e2b808fab953 +be1d4e281e96d7f8 +be429928cf3be7a9 +be46051be8b17219 +becf2b6196827e66 +bf3f982563667c22 +c04d8e37b62eaa92 +c04effb5962ed3f9 +c06b46187b41ce39 +c0bc9c3beacfffb8 +c0ede2967958d8f5 +c17fa3946050e530 +c1ec61742a0bf689 +c2e03edf02c088d7 +c2e50921d18a434a +c2e9aab8ed28badb +c436f10fbbffed15 +c4ec79b035593324 +c50546fdc714aeb6 +c52242714c169ab6 +c52ce464c71a350a +c541412ead5b1029 +c624efd60ebc9b1a +c66a50c4e9249d70 +c694b28e0beb3a1e +c6c37e4ed1f25039 +c733e37df3aea643 +c7374f6665225736 +c77de47b9dce3009 +c7c136d6198db9fc +c8347b03e14ae80a +c8699159e0a53ed0 +c883e8108ddc3578 +c89f3f67f5120452 +c8a48f90abd8f015 +c8a6ab759edd1926 +c923a688f0a4cffc +c99dadfaaa12c292 +ca506efeef01d547 +cb2bdcdafefa5ca4 +cb32482ae9fa23c1 +cb3f91d54eee30e5 +cb3f91d54eee30e5 +cb3f91d54eee30e5 +cb3f91d54eee30e5 +cb3f91d54eee30e5 +cb3f91d54eee30e5 +cb3f91d54eee30e5 +cb3f91d54eee30e5 +cb3f91d54eee30e5 +cb3f91d54eee30e5 +cb3f91d54eee30e5 +cb3f91d54eee30e5 +cc558c14b0453c50 +cc9c517c8bbbc337 +ccdab9f37f07ddb3 +cd34da52ff686a64 +cdb998b101a1d57e +ce690392bf9eda67 +ce9446610897d382 +cef80172111563b7 +cf0736aa34359a46 +cf47f46b4cc6b686 +cf55c5a43c8a6a07 +cfe09507bc35149b +d0418ed28a9675db +d059d986c11cda7d +d0d755b9d078aa55 +d1239e69f5a61368 +d13705606730aa63 +d1560b035193e872 +d1a47a38c782f97d +d1d88986469f8eef +d2bb7db4c0a2aecb +d2c7f7fb07a2eecd +d2e27af67b7a0cfe +d2e62de368b282e8 +d313a89dca29e0e0 +d36141a50e1362b5 +d3924985239d3d3d +d3deaae5996e6852 +d60eba39da58daf6 +d65fcf45457708da +d66e6602096b4ce5 +d670fd8799b7f1ef +d6cd313eda779a44 +d76d85e719a50119 +d79c3fc5bfe2c01c +d7a7c4777c468bd2 +d7c469d2924c3c3f +d7d3a6f386451cf1 +d7fb247f86cd3ca9 +d834b0cd9d9fffb3 +d8397822d2dd7834 +d856ff72c7e0601a +d8ab33f1dbf9b499 +d8ba4111a62a4975 +d8d121f7602ba5d1 +d92695bceea2a7e8 +d93944ae0be07dd0 +d94963ca37c57178 +d956fc34d2717a24 +d95fb12ee55b7746 +d9a5d9fe23d1ae0a +d9aaccb7f7d069bd +da296dbd0df68682 +dabd4c5f94a1aaee +dae0ac878dd92d41 +daf2237d42bc74fb +db148d4d1b9ec9a7 +db3522372ddd29e0 +db4697734698b294 +dc6f56f8a250eb19 +dc72e362b147e48a +dcc815a703b61a04 +dce64745cabe2f37 +dcf3da6a567342e2 +dd5a0fcbe4206613 +de9a43c891661c84 +dfef5e8050901998 +e0213b54f4794b32 +e03c8be0ce392ca9 +e060f727cac87c0e +e0dd7525dc5f8223 +e0df95e870f96dd5 +e0fa7353f8fda528 +e1205eb4c32815ea +e16aa293d00f45a9 +e191bcbe62be3eef +e1c9850db4b3401e +e1e2eed271723c3f +e21387f634fc7aa7 +e23c8402baa3f5b2 +e23d23a17d378a85 +e2746580ec5a5827 +e2ad809beaaa2dc5 +e2aeeb300679b8cc +e32da65f1611685a +e3b2291434eaf394 +e3babcc56c3b580a +e422c50567d12925 +e50109d5cc6bbedf +e52d7c31683c8a46 +e66e495a64e7284b +e6ac2f84934b698d +e6b3c1994add71e9 +e6c7fe6fb3d7e672 +e6c87dda3fa248c5 +e6d284ac9a440817 +e6ee4ff028bea5ad +e6ee6ec59fb95bf4 +e721166e13f0697d +e781b3bdfe141919 +e78c1338fda09175 +e7c210b8784b5ae4 +e8909809d4f3e081 +e8b29fe4f0874652 +e8c457cfaadb42c6 +e8fb7fd437a5fc4d +e90c1eea25b53ff4 +e9148bee61194624 +e9bd8829a50e12b3 +e9ed08d427e90d15 +ea243c5fa504a351 +ea3c55e07070d9ad +ea6a20be9154368b +eaa0c773f5984bad +eaa7abc196ada3b3 +eab2eb7426816a3b +eb1c22eef38f762d +eb4bf8919e88daff +ebc5f759cd26aefe +ebcd51392c08be3b +ec03c117b8af522d +ec2ed0cedf9a7f24 +ec3f9f0d7355d5fb +ec7f32b9d4a79524 +ecb377f795d8a039 +ecc0faf7940ac446 +ecd96a7fd21f1229 +ecec2f00809c3a9e +ed7a33e476b9b195 +ed8e55d3d40f0199 +edd44cb4a1d3c324 +edd99defc66f0eda +ede6b7bf9bc7f71c +ede6e1d1045615da +ee14b73fa45d83d4 +ee2f47741360c98b +ee39cd004bd0af96 +ee481f728e3d2e7f +eeb9f4017ab52607 +ef16f65952a6271e +ef4f6fc51eef8a2f +efb695f29e668329 +efc587210d09ff99 +efe8f178437cd2a7 +f0094c42f38497d1 +f00d3a4fb2a53690 +f04d35379aa9cbdc +f0d49f2eb47bd608 +f0e2c604b6d421c1 +f1485f948d795f65 +f14f5fefafefd249 +f212626ffa4f95fa +f2c111e3409bf8f3 +f37978aba4f0800d +f469befa0704a2a9 +f4cf8293b7b8103f +f51e0bc40da91ccb +f5928b6d8c0f160f +f5dc7b0f134b752e +f66b9af9fefe664d +f680a0ede8297905 +f717b26d5a3eeeb8 +f733b6ca9d68d8ed +f78cd98ba16240cb +f7d51e4a1e032c30 +f806247b720de2f4 +f848ca2bcc4943f2 +f85f47209b3e79aa +f87f602611672cbf +f89327badd7b8dfd +f9ca7a61ab1be248 +fa7836b28407fb62 +faf0d430a706c7c8 +fafd2e18ecebf1b2 +fb78fc7267f049d4 +fbcaeb963d43376f +fbd41d430fcb5dbb +fc1eb2fb3bdb6f6a +fc6dc222ad8ff0c6 +fcc04ae6b5450fa8 +fd72ac30b3d14368 +fd7fe2661907fdec +feabad3888ad205b +ffd90d523c22e8f4 +fff6b0db77ddce66 diff --git a/scripts/mustload-budgets.tsv b/scripts/mustload-budgets.tsv index 6ed0ffd19..60520ffe0 100644 --- a/scripts/mustload-budgets.tsv +++ b/scripts/mustload-budgets.tsv @@ -286,13 +286,14 @@ # method.md split (core + method-diff.md + method-lenses.md): the floors hold the core only. method-diff.md is read on a DIFF or FILE scope and method-lenses.md on its trigger; # the gate has no scope-conditional class, so both stay off the floors. A DIFF or FILE review therefore loads phase-floor-light + 1968 tokens (method-diff.md, 7872 B, modelled by scripts/review_load_bytes.py). # Floors re-pinned down: phase-floor-light 21711->18368, phase-floor-full 29692->26349 (method.md 43524->29936 B, full-map.md +216 B for the routing line). No archetype row moves. +# Latency + streaming split: performance-db-cost.md and api-contracts.md shed verbatim depth into performance-latency-depth.md and api-contracts-streaming.md (lazy, off every must-load set). api / service 18381->16714, data / ETL 19991->17003, lib / SDK 11038->9368. Floors phase-floor-light 18551->18578, phase-floor-full 26530->26557 (+27 each, two routing cells in full-map.md). web 18841 mobile 13467 -api / service 18381 -data / ETL 19991 +api / service 16714 +data / ETL 17003 agent / LLM / MCP 18402 IaC / platform 4342 -lib / SDK 11038 +lib / SDK 9368 # 1.539.0: SKILL.md routes references/compact-mode.md for non-Claude models (one line). Floors: phase-floor-light 23257->23274, phase-floor-full 31476->31493 (+17 each); no archetype row changed. # Re-pin (review yellow): phase-floor-light 23274->23272, phase-floor-full 31493->31491 after the SKILL.md agentic-default edit (-6 bytes SKILL.md). # 1.560.0: two route clauses only (method.md situational line: FULL-only composition/effective-config/rule-map checks; testing-and-evals.md conditional-depth line: evidence-gate accept-predicate audit). Depth lives off the floor in method-situational.md and testing-situational.md; the DIFF /review path is unchanged. Floors: phase-floor-light 23272->23329, phase-floor-full 31491->31548 (+36 each); no archetype row changed. @@ -311,8 +312,8 @@ lib / SDK 11038 # Routing dedupe: domain-checklists.md drops its A-W table (SKILL.md Domain map is the home), language-stack-redflags.md trims a pattern list, branch-and-merge-hygiene.md drops Cross-references and the standards-name list (full only). Floors: phase-floor-light 23115->22810 (-305), phase-floor-full 31334->30786 (-548) (net of +51 bytes in SKILL.md: the M and O Domain-map names echo their domain-m.md / domain-o.md triggers for trigger_lint); no archetype row changed. # Slim SKILL.md split: the tables moved verbatim to references/full-map.md, which the gate now counts instead of SKILL.md (SKILL.md is the slim small-DIFF fast path, bounded by routing --max-bytes and scripts/test_slim_skill_fast_path.py). Floors: phase-floor-light 22810->22796, phase-floor-full 30786->30772 (-14 each); no archetype row changed. # full-map.md core split: principles 4-6, 10 and 11 plus the Project stage model moved (principles 7 and 8, the read-only default and fetched-content-is-data guardrails, stay in the core because no finding trigger fires before a write or a fetch) verbatim to references/full-map-principles.md (read only when a finding turns on one of them); the Findings report and Definition of done (a) to references/full-map-report.md (read at Phase 5 / when closing); the Severity rubric stays in the core because every review ranks findings. Honest bytes per review, before->after: 22122 -> 20456 typical (core 18438 + report file 2018, -1666, -7.5%); 18438 core-only (-3684); worst case 23516 when the principles file also loads (+1394). Floors: phase-floor-light 22796->21877, phase-floor-full 30772->29856 (-919 and -916; the core counts, the split files are not Phase 0-2 mandatory loads); no archetype row changed. -phase-floor-light 18551 -phase-floor-full 26530 +phase-floor-light 18578 +phase-floor-full 26557 # Train 2026-10-12: union of merged PRs nets the floors down 1 token each (23359->23358, 31578->31577). phase-conditional method-situational.md phase-conditional redflags-situational.md diff --git a/scripts/size-budgets.tsv b/scripts/size-budgets.tsv index 820e0e5f6..21a56053b 100644 --- a/scripts/size-budgets.tsv +++ b/scripts/size-budgets.tsv @@ -33,22 +33,22 @@ .claude/skills/agentic-ceo/references/full-map.md 15848 .claude/skills/agentic-ceo/references/improvement-loop.md 11646 .claude/skills/agentic-delivery/SKILL.md 7006 -.claude/skills/agentic-delivery/references/cost-quality-guardrails.md 15870 +.claude/skills/agentic-delivery/references/cost-quality-guardrails.md 15839 .claude/skills/agentic-delivery/references/dev-env-ownership.md 33694 .claude/skills/agentic-delivery/references/fanout-host-sizing.md 46161 .claude/skills/agentic-delivery/references/fast-agentic-delivery.md 6404 .claude/skills/agentic-delivery/references/full-map.md 23891 -.claude/skills/agentic-delivery/references/gate-epistemology.md 10708 +.claude/skills/agentic-delivery/references/gate-epistemology.md 10706 .claude/skills/agentic-delivery/references/host-enforcement.md 41319 .claude/skills/agentic-delivery/references/incident-response.md 12693 .claude/skills/agentic-delivery/references/install.md 1180 -.claude/skills/agentic-delivery/references/merge-queue-worktrees.md 37294 -.claude/skills/agentic-delivery/references/multi-session-coordination.md 72388 +.claude/skills/agentic-delivery/references/merge-queue-worktrees.md 37292 +.claude/skills/agentic-delivery/references/multi-session-coordination.md 72256 .claude/skills/agentic-delivery/references/operating-discipline.md 10585 .claude/skills/agentic-delivery/references/production-grade-product-playbook.md 6635 .claude/skills/agentic-delivery/references/project-state.md 7540 .claude/skills/agentic-delivery/references/retrospective.md 4577 -.claude/skills/agentic-delivery/references/roles.md 27323 +.claude/skills/agentic-delivery/references/roles.md 27320 .claude/skills/agentic-delivery/references/support-ops.md 4455 .claude/skills/agentic-delivery/references/template-adr.md 2641 .claude/skills/agentic-delivery/references/template-postmortem.md 3387 @@ -58,13 +58,13 @@ .claude/skills/business-ops/SKILL.md 6454 .claude/skills/business-ops/references/regulated-domain-triage.md 8031 .claude/skills/business-ops/references/full-map.md 11211 -.claude/skills/communication-structure/SKILL.md 7052 +.claude/skills/communication-structure/SKILL.md 7540 .claude/skills/contribution/SKILL.md 5356 .claude/skills/contribution/references/contribution-procedure.md 5678 .claude/skills/contribution/references/full-map.md 7453 # Re-pin (review yellow): deep-code-review/SKILL.md 23541->23535 after the agentic-default edit. # 1.564.0 re-pin: DIFF quick-path concrete (SKILL.md +118), guard-severity (report-format +210), in-use lens (concurrency +339) bytes. -.claude/skills/deep-code-review/SKILL.md 2785 +.claude/skills/deep-code-review/SKILL.md 2884 .claude/skills/deep-code-review/references/a11y-aria.md 26605 .claude/skills/deep-code-review/references/a11y-color-motion.md 8435 .claude/skills/deep-code-review/references/a11y-focus.md 22485 @@ -161,7 +161,7 @@ .claude/skills/deep-code-review/references/security-agent-skills.md 6509 .claude/skills/deep-code-review/references/security-ai-agents.md 39145 .claude/skills/deep-code-review/references/security-api.md 17447 -.claude/skills/deep-code-review/references/security-appsec.md 27956 +.claude/skills/deep-code-review/references/security-appsec.md 28118 .claude/skills/deep-code-review/references/skill-authoring-and-size.md 3966 .claude/skills/deep-code-review/references/standards-index.md 470 .claude/skills/deep-code-review/references/testing-ai-evals.md 10259 @@ -208,14 +208,14 @@ README.md 16118 .claude/skills/product-discovery/references/full-map.md 12384 .claude/skills/growth-analytics/references/full-map.md 10661 .claude/skills/positioning/references/full-map.md 9520 -.claude/skills/INDEX.md 13037 +.claude/skills/INDEX.md 13281 .claude/skills/agentic-delivery/INDEX.md 4533 .claude/skills/agentic-delivery/INDEX-scripts.md 12834 -.claude/skills/deep-code-review/INDEX.md 19091 -.claude/skills/deep-code-review/INDEX-scripts.md 4415 +.claude/skills/deep-code-review/INDEX.md 19370 +.claude/skills/deep-code-review/INDEX-scripts.md 4648 .claude/skills/agentic-delivery/references/pipeline-optimizer.md 17583 .claude/skills/agentic-delivery/references/focus-kit.md 5235 -.claude/skills/communication-structure/references/artifact-templates.md 6958 +.claude/skills/communication-structure/references/artifact-templates.md 7029 .claude/skills/deep-code-review/references/code-structure.md 6449 .claude/skills/deep-code-review/references/compatibility-portability.md 5771 .claude/skills/deep-code-review/references/delivery-speed.md 7666 @@ -224,6 +224,8 @@ README.md 16118 .claude/skills/deep-code-review/references/safety-critical.md 7453 .claude/skills/deep-code-review/references/overlays.md 1437 .claude/skills/agentic-delivery/references/template-onepager.md 1667 -.claude/skills/deep-code-review/references/full-map.md 18720 +.claude/skills/deep-code-review/references/full-map.md 18740 .claude/skills/deep-code-review/references/full-map-principles.md 3060 .claude/skills/deep-code-review/references/full-map-report.md 2018 +.claude/skills/deep-code-review/references/appsec-verify.md 5779 +.claude/skills/deep-code-review/references/security-review-mode.md 10789 diff --git a/scripts/test_fullmap_core_split.py b/scripts/test_fullmap_core_split.py index 09bcc6e1f..593767874 100644 --- a/scripts/test_fullmap_core_split.py +++ b/scripts/test_fullmap_core_split.py @@ -20,6 +20,8 @@ "Read this when the review is FILE or FULL scope, a DIFF over 300 changed lines or with a blast-radius flag, or anything the SKILL.md fast path does not cover. It is the full map: scope modes, principles, gates, routing, report template. References that cite `SKILL.md` principles, Project stage, Severity rubric or Definition of done mean the sections of this file.": ('full-map.md', 'Read this when the review is FILE or FULL scope, a DIFF over 300 changed lines or with a blast-radius flag, or anything the SKILL.md fast path does not cover. It is the core of the full map: scope modes, the first-response block, hard rules, the phase and domain routing. Principles 4-6, 10, 11 and the Project stage model are in `full-map-principles.md`; the Findings report and Definition of done (a) are in `full-map-report.md`. References that cite `SKILL.md` principles, Project stage, Severity rubric or Definition of done mean those sections, wherever they now live.'), "This file is the map: scope, principles, gates, routing. Depth lives in": ('full-map.md', 'This file is the map: scope, hard rules, gates, routing. Depth lives in'), "| B | AppSec (OWASP Top 10:2025) | `domain-b.md`, `security-appsec.md` → `appsec-edge.md`, `appsec-scan-tests.md`, `appsec-links.md`, `appsec-approvals.md`, `appsec-supply.md`, `appsec-crypto.md`, `appsec-ssti.md`, `appsec-files.md`, `appsec-tokens.md`, `appsec-login.md`, `appsec-design.md`, `threat-modeling.md` (new boundary); `security-api.md` (serves its own HTTP/GraphQL/gRPC/WebSocket API, any archetype), `mobile-appsec.md` (ships an iOS/Android/native mobile client; MASVS/MASTG deltas) |": ('full-map.md', "| B | AppSec (OWASP Top 10:2025) | `domain-b.md`, `security-appsec.md` → `appsec-edge.md`, `appsec-scan-tests.md`, `appsec-links.md`, `appsec-approvals.md`, `appsec-supply.md`, `appsec-crypto.md`, `appsec-ssti.md`, `appsec-files.md`, `appsec-tokens.md`, `appsec-login.md`, `appsec-design.md`, `appsec-egress.md`, `appsec-flows.md`, `appsec-corroboration.md`, `threat-modeling.md` (new boundary); `security-api.md` (serves its own HTTP/GraphQL/gRPC/WebSocket API, any archetype), `mobile-appsec.md` (ships an iOS/Android/native mobile client; MASVS/MASTG deltas) |"), + '| E | Performance, efficiency & cost | `domain-e.md`, `performance-db-cost.md`, `model-tiering.md`, `billing-correctness.md` (when the target meters, subscribes, or charges), `energy-efficiency.md` (battery, always-on, carbon) |': ('full-map.md', '| E | Performance, efficiency & cost | `domain-e.md`, `performance-db-cost.md`, `performance-latency-depth.md` (caches, async handlers), `model-tiering.md`, `billing-correctness.md` (when the target meters, subscribes, or charges), `energy-efficiency.md` (battery, always-on, carbon) |'), + '| I | API, contracts, integration | `domain-i.md`, `api-contracts.md`, `compatibility-portability.md` (support matrix, installers) |': ('full-map.md', '| I | API, contracts, integration | `domain-i.md`, `api-contracts.md`, `api-contracts-streaming.md` (WS/SSE/gRPC streams), `compatibility-portability.md` (support matrix, installers) |'), "6. **Rank ruthlessly.** Severity rubric below. Never bury a Critical under Nits.":('full-map-principles.md', '6. **Rank ruthlessly.** Severity rubric in `full-map.md`. Never bury a Critical under Nits.'), } # Narrowed lazy-load triggers: the broad "before any write, fix or fan-out" trigger must not return. diff --git a/scripts/test_latency_split.py b/scripts/test_latency_split.py new file mode 100644 index 000000000..42802a77d --- /dev/null +++ b/scripts/test_latency_split.py @@ -0,0 +1,95 @@ +"""performance-db-cost.md and api-contracts.md each shed verbatim depth into a lazy reference. + +Pins, as a multiset (collections.Counter) of non-blank lines hashed with sha256[:16]: the combined line multiset of the four files +equals the pre-split multiset of the two old files (hashes in scripts/latency-split-lines.txt, one per line, duplicates kept) plus +exactly the ADDED allowlist below, and nothing else. A dropped line, a duplicated line or an edited line therefore all fail; every +edit to a moved line must be added to ADDED (and its old hash is then reported as lost). Also pins routing, the "Read this when" +headers, that the safety bullets stayed in the must-load cores (shared-cache keying, per-user data in a shared cache, cache as +source of truth = data loss, streaming auth pointer), and a size cap on each core. +""" +import hashlib +import pathlib +import unittest +from collections import Counter + +ROOT = pathlib.Path(__file__).resolve().parent.parent +R = ROOT / ".claude/skills/deep-code-review/references" +FILES = ("performance-db-cost.md", "performance-latency-depth.md", "api-contracts.md", "api-contracts-streaming.md") +h = lambda s: hashlib.sha256(s.strip().encode()).hexdigest()[:16] # noqa: E731 +text = lambda n: (R / n).read_text(encoding="utf-8") # noqa: E731 +OLD = Counter((ROOT / "scripts/latency-split-lines.txt").read_text().split()) +ADDED = [ + '# Performance depth — handler await ordering and cache expiry', + 'Read this when the target has a server request handler, page loader or resolver that assembles one response from several async calls, or an application-level cache layer (memoization, Redis, CDN). It fires at FILE or FULL scope on what the repo contains, not only on a diff. Moved verbatim from `performance-db-cost.md`; "above" and "below" in these bullets resolve against that file\'s *Indexes*, *Necessity*, *N+1* and *External / API / LLM calls* bullets, and its 🚩 grep list stays there.', + '## Handler await ordering', + '## Cache invalidation, key space and refresh', + '- Cache invalidation of derived entries, key cardinality, expiry stampede and refresh-on-every-read depth: `performance-latency-depth.md` — **read it when** the target has an application-level cache layer (memoize, Redis, CDN) or a 🚩 grep hit below names one of those shapes, at any scope.', + '- Handler `await` ordering (sequential independent awaits, a shared source re-read per projection, an expensive `await` above an early return): `performance-latency-depth.md` — **read it when** a request handler, page loader or resolver assembles a response from several async calls, or a 🚩 grep hit below names one of those shapes, at any scope.', + '# Streaming transports — contract & reliability', + 'Read this when the target serves or consumes a WebSocket, SSE or gRPC-streaming endpoint (server, client or SDK wrapper). It fires at FILE or FULL scope on what the repo contains, not only on a diff. Moved verbatim from `api-contracts.md`, where "this file" refers; the auth angle stays in `security-api.md`.', + 'Reconnect-resume, slow-consumer bounds, two-way liveness, ordering/dedup, gRPC keepalive and bidi flow control: `api-contracts-streaming.md` — **read it when** the target serves or consumes a WebSocket, SSE or gRPC-streaming endpoint, at any scope (FILE or FULL, not only a diff). The auth angle (upgrade auth, `Origin`/CSWSH, per-connection limits) stays in `security-api.md`.', +] + + + +def lines(texts): + return Counter(h(x) for t in texts.values() for x in t.split("\n") if x.strip()) + + +def diff(texts): + """(lost, extra) multiset differences against OLD + ADDED.""" + want, have = OLD + Counter(h(a) for a in ADDED), lines(texts) + return want - have, have - want + + +class LatencySplit(unittest.TestCase): + def texts(self): + return {n: text(n) for n in FILES} + + def test_line_multiset_survives_with_only_the_allowlisted_additions(self): + self.assertEqual(diff(self.texts()), (Counter(), Counter())) + + def test_mutations_fail(self): + t = self.texts() + for n, pick in (("performance-latency-depth.md", "- **Stampede"), ("performance-latency-depth.md", "- **Sequential"), + ("performance-db-cost.md", "- **Cache-aside write race"), ("api-contracts-streaming.md", "- **Bound a slow"), + ("api-contracts.md", "- **Adding a required field")): + line = next(x for x in t[n].split("\n") if x.startswith(pick)) + for bad in (t[n].replace(line, ""), t[n].replace(line, line + "\n" + line), t[n].replace(line, line + " x")): + self.assertNotEqual(diff({**t, n: bad}), (Counter(), Counter()), (n, pick)) + # a line duplicated across files (moved text left behind in the core too) fails + dup = next(x for x in t["performance-latency-depth.md"].split("\n") if x.startswith("- **Stampede")) + self.assertTrue(diff({**t, "performance-db-cost.md": t["performance-db-cost.md"] + dup + "\n"})[1]) + + def test_lazy_files_open_with_read_this_when_and_are_routed(self): + fm = text("full-map.md") + for lazy, core in (("performance-latency-depth.md", "performance-db-cost.md"), ("api-contracts-streaming.md", "api-contracts.md")): + self.assertIn("Read this when", "\n".join(text(lazy).split("\n")[:4]), lazy) + self.assertIn(f"`{lazy}`", text(core), lazy) + self.assertIn(f"`{lazy}`", fm, lazy) + + def test_triggers_fire_on_repo_content_not_only_a_diff(self): + for n in ("performance-latency-depth.md", "api-contracts-streaming.md"): + self.assertIn("not only on a diff", text(n), n) + self.assertIn("at any scope", text("performance-db-cost.md")) + self.assertIn("not only a diff", text("api-contracts.md")) + + def test_safety_bullets_stay_in_the_must_load_cores(self): + core = text("performance-db-cost.md") + for k in ("No caching of sensitive/per-user data in a shared cache", "**A shared cache must key on whatever varies the representation.**", + "**Authoritative vs advisory — state which.**", "turns an eviction into\n **data loss**", + "**Every append-only store on disk names a reaper"): + self.assertIn(k, core) + api = text("api-contracts.md") + self.assertIn("`security-api.md`", api.split("## Streaming transports")[1].split("\n---")[0]) + for k in ("## Webhooks — consuming (inbound)", "## Webhooks — providing (outbound)", "## Message / queue / serialized-state evolution", + "## Transactional / bulk email"): + self.assertIn(k, api) + + def test_cores_stay_cut(self): + self.assertLessEqual(len(text("performance-db-cost.md").encode()), 31100) # old 43051 + self.assertLessEqual(len(text("api-contracts.md").encode()), 21500) # old 28126 + + +if __name__ == "__main__": + unittest.main()