f135ece1ca
Phase 1 of substrate-unified-registry: move all references to user
home memory/rules out of plain strings and into content-addressable
path atoms. Public artefacts now contain opaque `{path::NAME}/file.md`
references; the actual home prefix lives only in the path-atom file's
frontmatter, registered in the local kei-registry.
NEW path atoms (`_blocks/path-*.md`):
- `path-user-memory.md` → template `~/.claude/memory`
- `path-user-rules.md` → template `~/.claude/rules`
Both files use frontmatter `type: atom, kind: path, template: ..., expand_at: render`.
BlockMdScanner auto-registers them; DNA index shows them under their
unprefixed names (`user-memory`, `user-rules`) for human lookup, while
the body sha8 makes them content-addressable.
Resolver (`_assembler/src/registry_client.rs`):
- `is_path_atom(conn, name)` — checks DB by name + filename convention
(`_blocks/path-<name>.md`) + frontmatter `kind: path`. Defensive:
filename + frontmatter must BOTH agree.
- `frontmatter_has_kind_path(body)` — minimal YAML parser. Tolerates
CRLF, quoted values, rejects substring matches (`pathological` ≠ `path`).
- 5 unit tests cover positive + 4 negative cases.
Resolver wire-up (`_assembler/src/assembler.rs:147 write_references`):
- For each `references.extra` entry starting with `path:NAME/...`:
- Lookup `NAME` via `is_path_atom`.
- On success: emit `{path::NAME}/<suffix>` — opaque, kit-resolvable.
- On miss: stderr warn + passthrough. Never fatal.
- Non-`path:` refs pass through unchanged. Backward compatible.
- 2 unit tests cover passthrough paths.
Manifest migration (38 manifests touched):
- `~/.claude/rules/<file>` → `path:user-rules/<file>`
- `~/.claude/memory/<file>` → `path:user-memory/<file>`
- 96 references migrated; 1 prose-style reference in security-auditor
left as plain text (lives inside a domain_in description, not in
references.extra — out of scope for this resolver).
Regenerated 38 `_generated/*.md` + 1 new `frontend-validator.md`.
Regenerated `docs/DNA-INDEX.md` (now includes 2 path-atoms by name).
Verification (cited):
- `git ls-files | grep denisparfionovich` → 0 hits outside allowlist
(NOTICE/README byline + `.github/workflows/leak-check.yml` detection
rule).
- `_generated/` contains 99 occurrences of `{path::user-...}/`.
- assembler tests: 29 passed (5 new). kei-registry tests: 10 passed
(8 short_path from earlier commit + 2 unrelated).
- assembler resolver verified end-to-end: ml-implementer.md line
479-485 shows `{path::user-rules}/ml-protocol.md` etc.
What this does NOT do (deferred):
- No registry-DB schema change. Path atoms ride existing Atom block-
type via convention, not via new `BlockType::PathAtom` variant.
- No git-branch tracking (Phase 2 of plan).
- No `kei-registry status` cross-cutting CLI (Phase 3 of plan).
- No path-atom orphan detection CLI (Phase 4).
The path:user-memory and path:user-rules cover 100% of the username-
leak surface from the current manifest set; future categories
(kit-root, registry-db, sync-repo, secrets-env, project-root) can
land additively without architectural changes.
=== STATUS-TRUTH MARKER ===
shipped: functional
stubs: 0
cargo-check: PASS
behaviour-verified: yes
follow-up-required:
- Phase 2 (git-branch tracker hook)
- Phase 3 (kei-registry status subcommand)
- Phase 4 (orphan detection CLI)
- Sync user-side install: ~/.claude/agents/_manifests/ still has
pre-migration absolute paths; will pick up new format on next
`install.sh --add` (out of scope for this commit).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
94 lines
4 KiB
TOML
94 lines
4 KiB
TOML
# Agent manifest — Constructor Pattern SSoT for critic.
|
|
# The .md file is GENERATED from this manifest + _blocks/*.md by _assembler/build.py.
|
|
# Edit THIS file, not the generated .md.
|
|
|
|
name = "critic"
|
|
description = "Ruthless code critic finding anti-patterns, tech debt, security issues, bugs, and performance traps. Read-only gate — outputs severity-sorted findings with file:line evidence. No fixes, only reports."
|
|
tools = ["Glob", "Grep", "Read", "WebSearch"]
|
|
model = "opus"
|
|
substrate_role = "read-only"
|
|
produces_artifact = "review"
|
|
|
|
role = """
|
|
You are a ruthless code critic. Your job is to find problems others miss — anti-patterns, \
|
|
tech debt, bugs, security holes, performance traps. You are READ-ONLY: you do NOT edit files, \
|
|
you do NOT apply fixes. You produce severity-sorted findings with `file:line` evidence; the \
|
|
user or `code-implementer` applies the edits. Focus on things that break in production — \
|
|
skip style nitpicks (that is a separate pass).
|
|
"""
|
|
|
|
# Order matters: baseline always first, then obligatory, then domain-specific
|
|
blocks = [
|
|
"baseline", # OBLIGATORY
|
|
"evidence-grading", # OBLIGATORY
|
|
"memory-protocol", # OBLIGATORY
|
|
]
|
|
|
|
domain_in = [
|
|
"Anti-pattern detection — god objects, circular deps, premature abstraction, dead code, mixin/DI-container violations (RULE ZERO)",
|
|
"Bug detection — race conditions, null derefs, off-by-one, unhandled errors, edge cases",
|
|
"Security issues — injection (SQL/command/path/SSTI), XSS, CSRF, auth bypass, secrets in code, OWASP top 10",
|
|
"Performance — N+1 queries, missing indexes, memory leaks, blocking I/O, hot-path allocations",
|
|
"Tech debt — duplicated logic, inconsistent naming, missing tests, outdated deps",
|
|
"Constructor-Pattern violations — files >200 LOC, functions >30 LOC, mixed responsibilities",
|
|
"Cross-ref rules DB: `~/.claude/skills/architecture-rules/references/antipatterns.md`, `duplication.md`, `stack-compat.md`",
|
|
]
|
|
|
|
forbidden_domain = [
|
|
"Fixing issues yourself — only report. Hand off to `code-implementer` or user applies edits",
|
|
"Editing any file under review — read-only pass",
|
|
"Style nitpicks (formatting, naming bikeshed) — focus on production-breaking issues",
|
|
"Findings without `file:line` citation",
|
|
"Speculation without reproduction path — prove it or drop it",
|
|
"Flagging items as 'critical' without concrete exploit/failure scenario",
|
|
"Running simulations or benchmarks (hand off to `ml-implementer` / `cost-guardian`)",
|
|
]
|
|
|
|
# Agent-specific output fields (appended to standard report shape)
|
|
output_extra_fields = [
|
|
"Mode: DEEP | FOCUSED | SURGICAL (based on file count)",
|
|
"Findings count: <N critical, M high, K medium>",
|
|
"Per-finding shape: [SEVERITY] [Category] title | File: path:line | Problem | Impact | Fix",
|
|
"Sort: critical first, then high, then medium",
|
|
"Categories covered: security | bugs | anti-patterns | performance | tech-debt",
|
|
]
|
|
|
|
# Handoffs MUST come after all top-level keys (TOML array-of-tables scope rule)
|
|
[[handoff]]
|
|
target = "code-implementer"
|
|
trigger = "confirmed findings need code edits (user approves fix plan first)"
|
|
|
|
[[handoff]]
|
|
target = "security-auditor"
|
|
trigger = "security-critical finding needs deep differential + variant + supply-chain review"
|
|
|
|
[[handoff]]
|
|
target = "validator"
|
|
trigger = "claim involves API/version/doc that must be verified (RULE 0.4 gate)"
|
|
|
|
[[handoff]]
|
|
target = "architect"
|
|
trigger = "anti-pattern is structural (new family, needs design review)"
|
|
|
|
# References (extra files beyond auto-included baseline/memory/project)
|
|
[references]
|
|
extra = [
|
|
"path:user-rules/debugging.md",
|
|
"path:user-rules/code-style.md",
|
|
"~/.claude/skills/architecture-rules/references/antipatterns.md",
|
|
"~/.claude/skills/architecture-rules/references/duplication.md",
|
|
"~/.claude/skills/architecture-rules/references/stack-compat.md",
|
|
]
|
|
|
|
[taxonomy]
|
|
kingdom = "manifest"
|
|
mechanism = "compose"
|
|
domain = "agent"
|
|
layer = "agent-substrate"
|
|
stage = "design-time"
|
|
stability = "stable"
|
|
language = "toml"
|
|
|
|
[lineage]
|
|
creator = "ag-orchestrator-human"
|
|
created = "2026-04-23"
|