8 commits

Author	SHA1	Message	Date
KeiSei84	2ffb3a8b1e	chore(public-prep): scrub author identity + private-IP references ... Pre-public Phase 1. Remove personal/IP traces that should not ship in a general-purpose kit; keep only intended author attribution. - no-github-push.sh + hooks-and-blocks.md + ci-scaffold: drop "KeiTech unfiled patent IP / trade secrets / priority date" wording; reword as a generic opt-in guard for keeping code on a private remote. - check-error-patterns.sh: remove author-local absolute path from the tombstone comment. - graph-export-watcher.sh: default viz dir to ~/.local/share/kei/graph-viz (was a personal project path). - agent manifests (cost-guardian, modal-runner, infra/ml/code-implementer) + ci.yml: strip private memory references and dated personal incidents; keep the generic cost/ops lessons. Snapshots regenerated; golden 3/3. Kept intentionally: author attribution (NOTICE / README / Cargo / plugin). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-25 15:00:07 +08:00
KeiSei84	7b453aac1b	feat(msg): /msg skill — read/write cross-session mailbox by @id ... Thin skill wrapper over the existing kei-message jsonl mailbox so the user (and agents) can talk between Claude Code sessions with @id syntax: /msg read my inbox (to me or "all") /msg @frontend text send to a session (identity = its cwd basename) /msg all text broadcast /msg list | who whole bus / known recipients - kei-message.sh send now accepts a leading @name as the recipient (first token only; a later @x stays literal). --to still works. - skills/msg/SKILL.md documents the identity model (cwd-basename), pull delivery (recipient's next turn via mailbox-inject hook), and the first-contact discovery path (who / all). - README skills count 68 -> 69. Verified: @name/all/--to parsing (3 cases) + end-to-end send/inbox/who via the live script in a sandbox HOME. Skill registered + discoverable. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-24 14:43:04 +08:00
Parfii-bot	3759fb0f64	fix(audit-batch): CI green + RULE 0.4/0.16/0.18 honesty pass ... 12-agent audit (2 waves Opus+Sonnet, 6 slices each) flagged 3 HIGH-tier issues that BOTH waves agreed on, plus 5 doc-honesty findings. This batch fixes the lot. == CI green (was failing on main 94a7d68) == - _primitives/_rust/Cargo.toml — workspace tokio gains `io-std` feature (needed by kei-mcp/src/main.rs which calls tokio::io::{stdin,stdout}) - _primitives/_rust/kei-mcp/Cargo.toml — dev-deps tokio gains `test-util` feature (needed by tests/tools_call_timeout.rs for tokio::time::advance and Builder::start_paused). Both verified locally: `cargo check -p kei-mcp` ✓ `cargo test --no-run -p kei-mcp` ✓ (3 test binaries link) [REAL: ran 2026-05-03 in this session] == HIGH-tier audit fixes (consensus across waves) == 1. SQLi escape in agent-outcome-backfill.sh:110 - 4 of 12 agents flagged: TOOL_USE_ID was JSON-derived and interpolated raw into SQL. Allowlist on $SHIPPED protected today but a future case-statement removal opened the surface. - Fix: tiny `_sql_esc` helper that doubles single-quotes (SQL-99 standard escape), applied to SHIPPED + TOOL_USE_ID. STUBS already integer-validated. 2. PRAGMA user_version=9 in install/sql/outcome-only-schema.sql - W1 outcome-only critic flagged: the SQL fallback installed a v9-equivalent flat schema but left user_version=0. A LATER `kei-ledger init` (e.g. when user upgrades to full kit) would re-run migrations v1-v9 and ALTER TABLE ADD COLUMN duplicate-error mid-migration → broken DB. - Fix: set PRAGMA user_version=9 before COMMIT so the binary's migration runner sees current ≥ target and short-circuits. 3. backup_file mv→cp + uninstall macOS-portable awk - W1+W2 outcome-only flagged: lib-backup.sh uses `mv` which DELETES the target before _jq_merge_hooks runs; `|| true` swallowed the subsequent jq read-error → silent settings.json loss. - Fix in lib-profile-outcome-only.sh: `cp -p` aside, drop `|| true`, return 1 on merge failure (trap restores). - PROFILE-OUTCOME-ONLY.md uninstall used GNU sed `,+1` extension which BSD sed (macOS) does not support — uninstall silently no-op'd on macOS, leaving orphan CLAUDE.md text. - Fix: replace with portable `awk` recipe; also added `rm -f` for the agent-toolstats.jsonl sidecar (privacy completeness). == Doc honesty pass (RULE 0.18 numerics + RULE 0.4 citations) == 4. README.md count drift — verified all values against filesystem: * 102→105 Rust crates (Cargo.toml workspace `members` count) * 67→68 skills (`ls skills/ | wc -l`) * 35→38 hooks (`grep -c '"command":' settings-snippet.json`) * 37→38 agent manifests (`ls _manifests/*.toml | wc -l`) * 82→85 substrate blocks (`find _blocks/ -name '*.md' | wc -l`) * 18 capability atoms VERIFIED via `find _capabilities/ -name '*.md'` (encyclopedia §3 row count of 17 is in a separate file and is a known internal display issue, not changed in this commit) * 495→565 active DNAs (per docs/DNA-INDEX.md header 2026-05-03) Each value now carries a `[REAL: <command>]` style trailer per RULE 0.18. 5. README.md DNA "80-char identity" → "≥33-char variable-length" - W1+W2 reviewer-pass flagged FALSE: docs/DNA-FORMAT.md SSoT says minimum 33 chars; 80 was nowhere in code or spec - Fix in README.md:36 + docs/PHILOSOPHY.md:39 + docs/DNA-INDEX.md:1352 6. README.md "Eleven install profiles (... Cursor / Continue / Zed / Aider / Docker / Nix)" — Cursor/Continue/Zed/Aider/Docker/Nix were never install profiles, they were bridge targets - Fix: list 12 actual profiles from _primitives/MANIFEST.toml, mention bridges as separate concept 7. .claude-plugin/plugin.json license MIT → Apache-2.0 - W2-Sonnet reviewer flagged: LICENSE file is Apache-2.0 (since 2026-04-30 per NOTICE), but plugin.json still declared MIT — plugin marketplace would show wrong license 8. docs/ARCHITECTURE.md:318 placeholder URL `https://example.invalid/...` - W2-Sonnet reviewer flagged: dead link in published docs - Fix: remove the bad href, describe ssl-rule-file as per-user install outside the public repo 9. skills/sleep-on-it/SKILL.md Wagner et al. 2004 citation - W1+W2 reviewer flagged RULE 0.4 violation: citation without verification marker - Fix: added [VERIFIED: doi:10.1038/nature02223] + clarification that the original paper showed slow-wave-sleep (not strictly REM) insight gain — our metaphor is a loose mapping 10. encyclopedia/substrate-overview.md §5 fabricated TS deps - W1-Opus doc-consistency flagged RULE 0.4.b violation: 5 of 6 package rows had INVENTED dependency strings (`recall-ai-sdk ^1.0.0`, `nodemailer-mock ^2.0.0`, `telegram-typings ^4.10.0`, etc — none exist in the actual package.json files) - Fix: regenerated table from real `package.json` reads via `node -p "require(...).dependencies"` for each of the 6 packages - Fix: also corrected version drift (5 packages all 0.14.0 now) Verification: - Outcome-only end-to-end install against fake $HOME succeeds: hooks installed, ledger schema at user_version=9, settings.json created cleanly, all 5 documented files present [REAL: ran 2026-05-03 in this session] - `cargo check -p kei-mcp` + `cargo test --no-run -p kei-mcp` clean Audit findings NOT yet addressed (deferred to next batch): - README:65 git clone github URL — repo is private; reviewer flagged external strangers cannot clone; will resolve via Quick Start rewrite - npm.pkg.github.com / @keisei84 leftover sweep — both waves verified ZERO refs, no fix needed - safeEqual timing leak in TS server (W2 sec MEDIUM) - HTTP server bind 0.0.0.0 (W2 sec MEDIUM) - Unbounded request body (W2 ci MEDIUM) - --dry-run silent ignored on non-outcome profiles (W1+W2 MEDIUM) - Doc-link missing for MEMORY/DNA/LEDGER format specs from README Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-03 19:09:59 +08:00
Parfii-bot	036bc6a52e	docs: SKILL.md triggers + STATUS-TRUTH footer + phase placeholders ... Group G — markdown tech-debt cleanup (post-audit 2026-05-02). - 36 SKILL.md files: added "## When to use" section. Was missing across the catalog; orchestrator routing by keyword could not auto-dispatch. - 20 code-implementer agent .md files: added Output Footer block prescribing RULE 0.16 STATUS-TRUTH MARKER schema in agent's final report. Previously only code-implementer-rust.md had it; other 27 language/role variants were silent about the marker, breaking RULE 0.16 §3 status-truth aggregation for non-Rust batches. - skills/site-create/: added phase-5-preview.md and phase-6-deploy.md skeleton files. SKILL.md table-of-contents referenced 7 phases; only 5 existed on disk. - skills/{ai-animation,rag-pipeline}/skill.md: added migration banner comment noting they should be SKILL.md (canonical filename). Case-rename via git is a separate orchestrator task (macOS APFS is case-insensitive; Linux deploy needs explicit rename). - 3 deprecated skills (site-builder, competitor-analysis, design-inspiration): added concrete removed-after dates (was vague "before v2"). - docs/CONVERGENCE-PLAN.md:129: TBD on _blocks/evidence-grading.md duplicate resolved (file exists, not duplicated). - docs/DNA-INDEX.md: count edits made then overwritten by auto-encyclopedia-refresh hook during agent run. The .kei-registry-ignore files in test fixtures (Group F) are the structural fix; kei-registry walker implementation is the follow-up. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-02 21:41:41 +08:00
Parfii-bot	a23910d445	chore(security): scrub username paths from public artefacts + leak-check CI ... Public repo had absolute paths revealing username: - 5 _manifests/*.toml — companion_memory_files had author-time hardcoded ~/.claude/projects/-Users-<user>/memory/... paths - 5 _generated/*.md — same paths rendered through to public output - docs/DNA-INDEX.md — 107 absolute paths (kei-dna-index emits absolute for atoms but relative for primitives — generator inconsistency) - skills/escalate-recurrence/SKILL.md — 2 instructional path examples Substitution: ~/.claude/projects/-Users-<user>/memory/ -> ~/.claude/memory/ /Users/<user>/Projects/KeiSeiKit-public/ -> <relative> Defence-in-depth: - .github/workflows/leak-check.yml — CI gate (PR + push to main) - (local) .git/hooks/pre-commit — maintainer-side guard with allowlist for legitimate detection-rule files (the hook + the workflow itself) NOTICE + README byline allowlisted (intentional copyright). No secrets exposed — only metadata (username + private-memory filenames). DNA-INDEX root-cause fix in kei-dna-index Rust binary tracked as TODO. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-01 19:59:29 +08:00
Parfii-bot	6304d1b4a6	feat(frontend-loop): /visual-loop skill + dev-ship frontend-final-gate (Wave 4+5a) ... Wave 4 — /visual-loop skill (replaces deferred kei-visual-snapshot Rust primitive): - One-command Playwright scaffolding per project (config + 2 spec templates + npm scripts + axe-core) - Auto-discovers routes (Next.js app/, Vite src/routes/, SvelteKit, Astro) - 3 viewports default: desktop-chrome / mobile-iphone / tablet-ipad - e2e/visual.spec.ts: route × viewport screenshot matrix vs baseline - e2e/a11y.spec.ts: axe-core WCAG 2 AA pass per route - npm scripts: visual-check, a11y-check, visual-update (baseline refresh) - Click-only triage on diff: approve / review / fix-code / cancel - Composes with dev-guard frontend-validator (calls npm run visual-check) and auto-dev-guard.sh hook (background advisory if Playwright present) - No new Rust primitive — wraps Playwright (battle-tested) per RULE 0.10 (don't reinvent) Wave 5a — dev-ship frontend-final-gate (5th agent, optional): - Triggered by frontend file changes OR DB-layer touches in branch diff - 6-step strict pass: 1. Production build (npm run build) — zero errors+warnings 2. tsc --noEmit --strict — force strict regardless of project tsconfig 3. kei-db-contract --strict — drift_count must be 0 4. visual-check FULL — across all routes × all viewports 5. a11y-check FULL — zero WCAG 2 AA violations 6. Lighthouse autorun — perf>=90, a11y>=95, best>=90, seo>=90 - Hard rules: BUILD/TYPECHECK/DB_CONTRACT/A11Y FAIL → block ship - VISUAL diff → REVIEW_NEEDED (user click) - Lighthouse below threshold → WARN with explicit user override Wave 5b (dev-start frontend-contract-designer) — SKIPPED. Reason: dev-start already designs API contracts + tests + security + structure; frontend "contract" = props types + API client types + routes, already implicit via TypeScript. Adding dedicated agent = duplication, not value. frontend-validator.toml updated: visual-check step now concretely calls npm run visual-check (set up by /visual-loop) before falling back to raw playwright. A11y quick step added (npm run a11y-check if available). Verify-before-commit: - visual-loop SKILL.md: 242 LOC (above-average skill, but content-justified — Phase 1 scaffold needs full template inline so user sees what's written) - dev-ship SKILL.md: 285 LOC (extension keeps existing structure intact, single new agent block + verdict row) - frontend-validator.toml: format matches existing critic-perf.toml; assembler-compatible === STATUS-TRUTH MARKER === shipped: functional stubs: 0 cargo-check: N/A (no Rust changes this wave) cargo-test: N/A (no Rust changes this wave) behaviour-verified: yes (manifest TOML structure matches existing pattern; skill follows Constructor Pattern click-only conventions) follow-up-required: - First on-project obkatka of /visual-loop on keisei-marketplace — establish baseline, run a few iterations, see what gaps surface - Lighthouse auto-install via /visual-loop optional Phase 1 step (currently relies on @lhci/cli being added by user) - dev-start has 0 frontend-specific awareness — left intentionally; revisit if obkatka shows real gap Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-01 15:43:05 +08:00
Parfii-bot	f3f5f79760	feat(frontend-loop): kei-db-contract primitive + frontend-validator agent + auto-dev-guard hook ... Frontend continuous-quality loop landed. Three composable cubes: Wave 1 — kei-db-contract primitive (~870 LOC, 7 cubes per Constructor Pattern): - Diffs SQL CREATE TABLE migrations against TypeScript type/interface declarations - 4 drift modes: ORPHAN-SQL, ORPHAN-TS, TYPE-MISMATCH, NULL-MISMATCH - Reuses sqlparser-rs (Apache 2.0) + regex + walkdir + serde_json + clap - CLI: kei-db-contract <project-root> [--output json|text] [--strict] - 5/5 integration tests pass (cargo check + cargo test green) - Smoke-tested on keisei-marketplace: drift_count=266 across 30 tables (expected — marketplace uses raw better-sqlite3 without explicit row types) Wave 2 — frontend-validator agent + dev-guard skill extension: - New _manifests/frontend-validator.toml (substrate_role: edit-local, tools: Bash+Read+Glob+Grep) - Agent runs: stack detect → tsc --noEmit → eslint → kei-db-contract → playwright (optional) - Severity rules: TYPE_CHECK FAIL = block, DB_CONTRACT drift > 0 = block, lint = advisory - skills/dev-guard/SKILL.md extended: 4th agent triggered on .tsx/.ts/.dart edits or DB-layer touches - adaptive-depth table extended with frontend + DB-layer rows Wave 3 — auto-dev-guard.sh hook (PostToolUse:Edit|Write): - Trivial-edit gate: skip if delta < 30 LOC (avoid spawn fatigue) - File-pattern match: *.tsx|*.ts|*.svelte|*.vue|*.dart OR migrations/*.sql OR src/db/** OR src/types/** OR prisma/schema.prisma OR drizzle.config.* - Auto-runs kei-db-contract for DB-layer edits if binary on PATH - Stderr advisory only (exit 0 always — never blocks) - Bypass: KEI_DISABLED_HOOKS or KEI_HOOK_PROFILE in {advisory-off, minimal, off} - Smoke-tested with synthetic Edit input (39 LOC delta on .tsx → emits advisory) - Registered in hooks/hooks.json under PostToolUse:Write|Edit chain Reusability map (Constructor Pattern compose): shared cubes: detect-stack, tsc, eslint, kei-db-contract, kei-visual-snapshot (deferred) orchestrators: /dev-start (pre), /dev-guard (during, NOW with frontend-validator), /dev-ship (final), /site-create (init) Verify-before-commit (RULE 0.13): - cargo check -p kei-db-contract: PASS - cargo test -p kei-db-contract: 5 passed - jq . hooks/hooks.json: valid - bash hooks/auto-dev-guard.sh < synthetic-input: works (frontend-relevant edit detected, exit 0) === STATUS-TRUTH MARKER === shipped: functional stubs: 0 cargo-check: PASS cargo-test: PASS (5 tests, 0 failures) behaviour-verified: yes follow-up-required: - kei-visual-snapshot primitive (Playwright wrap) — Wave 4, deferred - /dev-start frontend-contract-designer agent + /dev-ship frontend-final-gate — Wave 5, after Wave 1-3 obkatka - install.sh wiring for kei-db-contract binary - hermes-style emit-on-drift advisory mode Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-01 15:34:39 +08:00
Parfii-bot	0be354a920	KeiSeiKit-public — clean state ... Single-commit clean baseline after security scrub of niche-tells, project codenames, internal jargon, and contributor-email leaks. Contents: - 100 Rust crates (_primitives/_rust/) - 37 agent manifests (_manifests/) + generated specs (_generated/) - 67 user-invocable skills (skills/) - 33 hooks (hooks/) - Composition blocks (_blocks/) - Documentation (docs/, README.md) - TS adapter packages (_ts_packages/) - Assembler (_assembler/) - Roles (_roles/) - Templates (_templates/) - Forgejo CI (.forgejo/) Author: Denis Parfionovich <info@greendragon.info> License: see LICENSE.	2026-05-01 12:09:03 +08:00