[pull] main from affaan-m:main

.claude-plugin/marketplace.json

@@ -11,7 +11,7 @@
     {
       "name": "ecc",
       "source": "./",
-      "description": "Harness-native ECC operator layer - 68 agents, 292 skills, 94 legacy command shims, reusable hooks, rules, selective install profiles, and production-ready workflows for Claude Code, Codex, OpenCode, Cursor, and related agent harnesses",
+      "description": "Harness-native ECC operator layer - 68 agents, 293 skills, 94 legacy command shims, reusable hooks, rules, selective install profiles, and production-ready workflows for Claude Code, Codex, OpenCode, Cursor, and related agent harnesses",
       "version": "2.2.2",
       "author": {
         "name": "Affaan Mustafa",

.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ecc",
   "version": "2.2.2",
-  "description": "Harness-native ECC plugin for engineering teams - 68 agents, 292 skills, 94 legacy command shims, reusable hooks, rules, MCP conventions, and operator workflows for Claude Code plus adjacent agent harnesses",
+  "description": "Harness-native ECC plugin for engineering teams - 68 agents, 293 skills, 94 legacy command shims, reusable hooks, rules, MCP conventions, and operator workflows for Claude Code plus adjacent agent harnesses",
   "author": {
     "name": "Affaan Mustafa",
     "url": "https://x.com/affaanmustafa"

.gemini/GEMINI.md

@@ -4,7 +4,7 @@ This file provides Gemini CLI with the baseline ECC workflow, review standards,
 
 ## Overview
 
-Everything Claude Code (ECC) is a cross-harness coding system with 36 specialized agents, 142 skills, and 68 commands.
+Everything Claude Code (ECC) is a cross-harness coding system with 68 specialized agents, 293 skills, and 94 commands.
 
 Gemini support is currently focused on a strong project-local instruction layer via `.gemini/GEMINI.md`, plus the shared MCP catalog and package-manager setup assets shipped by the installer.
 

.github/workflows/release.yml

@@ -5,13 +5,17 @@ on:
     tags: ['v*']
 
 permissions:
+  actions: read
+  checks: read
   contents: read
 
 jobs:
   verify:
     name: Verify Release
     runs-on: ubuntu-latest
     outputs:
+      release_sha: ${{ steps.release_gate.outputs.release_sha }}
+      tag_object_sha: ${{ steps.release_gate.outputs.tag_object_sha }}
       already_published: ${{ steps.npm_publish_state.outputs.already_published }}
       dist_tag: ${{ steps.npm_publish_state.outputs.dist_tag }}
       publish_tag: ${{ steps.npm_publish_state.outputs.publish_tag }}
@@ -43,6 +47,13 @@ jobs:
           node-version: '20.x'
           registry-url: 'https://registry.npmjs.org'
 
+      - name: Verify signed tag and exact-SHA CI gates
+        id: release_gate
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: RELEASE_SHA="$(git rev-parse HEAD)" node scripts/ci/verify-release-gates.js
+
       - name: Install dependencies
         run: npm ci --ignore-scripts
 
@@ -194,6 +205,31 @@ jobs:
           ECC_RELEASE_SHA256: ${{ needs.verify.outputs.package_sha256 }}
         run: node -e "const crypto = require('crypto'); const fs = require('fs'); const file = process.env.ECC_RELEASE_PACKAGE; const expected = process.env.ECC_RELEASE_SHA256; if (!/^ecc-universal-[0-9A-Za-z.+-]+\.tgz$/.test(file || '')) throw new Error('Unexpected packed filename'); if (!/^[a-f0-9]{64}$/.test(expected || '')) throw new Error('Invalid packed SHA-256'); const archives = fs.readdirSync('.').filter(name => name.endsWith('.tgz')); if (archives.length !== 1 || archives[0] !== file) throw new Error('Expected exactly one downloaded archive'); const actual = crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex'); if (actual !== expected) throw new Error('Downloaded publish artifact SHA-256 mismatch')"
 
+      - name: Bind gate source to triggering commit
+        env:
+          EVENT_SHA: ${{ github.sha }}
+          VERIFIED_RELEASE_SHA: ${{ needs.verify.outputs.release_sha }}
+        run: node -e "const actual = process.env.EVENT_SHA; const expected = process.env.VERIFIED_RELEASE_SHA; if (typeof actual !== 'string' || actual.length !== 40 || !/^[a-f0-9]{40}$/.test(actual) || expected !== actual) throw new Error('Verified release differs from triggering commit')"
+
+      - name: Checkout verified gate source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.sha }}
+          path: release-gate-source
+          persist-credentials: false
+          sparse-checkout: scripts/ci/verify-release-gates.js
+          sparse-checkout-cone-mode: false
+
+      # This read-only API check uses the existing publish job token. It is a
+      # snapshot; preventing subsequent tag movement requires protected tags.
+      - name: Recheck verified tag before publish
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ github.ref_name }}
+          RELEASE_SHA: ${{ needs.verify.outputs.release_sha }}
+          RELEASE_TAG_OBJECT_SHA: ${{ needs.verify.outputs.tag_object_sha }}
+        run: node release-gate-source/scripts/ci/verify-release-gates.js --tag-only
+
       - name: Publish npm package
         if: needs.verify.outputs.already_published != 'true'
         env:

.github/workflows/reusable-release.yml

@@ -18,13 +18,17 @@ on:
         type: string
 
 permissions:
+  actions: read
+  checks: read
   contents: read
 
 jobs:
   verify:
     name: Verify Release
     runs-on: ubuntu-latest
     outputs:
+      release_sha: ${{ steps.release_gate.outputs.release_sha }}
+      tag_object_sha: ${{ steps.release_gate.outputs.tag_object_sha }}
       already_published: ${{ steps.npm_publish_state.outputs.already_published }}
       dist_tag: ${{ steps.npm_publish_state.outputs.dist_tag }}
       publish_tag: ${{ steps.npm_publish_state.outputs.publish_tag }}
@@ -57,6 +61,13 @@ jobs:
           node-version: '20.x'
           registry-url: 'https://registry.npmjs.org'
 
+      - name: Verify signed tag and exact-SHA CI gates
+        id: release_gate
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ inputs.tag }}
+        run: RELEASE_SHA="$(git rev-parse HEAD)" node scripts/ci/verify-release-gates.js
+
       - name: Install dependencies
         run: npm ci --ignore-scripts
 
@@ -208,6 +219,25 @@ jobs:
           ECC_RELEASE_SHA256: ${{ needs.verify.outputs.package_sha256 }}
         run: node -e "const crypto = require('crypto'); const fs = require('fs'); const file = process.env.ECC_RELEASE_PACKAGE; const expected = process.env.ECC_RELEASE_SHA256; if (!/^ecc-universal-[0-9A-Za-z.+-]+\.tgz$/.test(file || '')) throw new Error('Unexpected packed filename'); if (!/^[a-f0-9]{64}$/.test(expected || '')) throw new Error('Invalid packed SHA-256'); const archives = fs.readdirSync('.').filter(name => name.endsWith('.tgz')); if (archives.length !== 1 || archives[0] !== file) throw new Error('Expected exactly one downloaded archive'); const actual = crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex'); if (actual !== expected) throw new Error('Downloaded publish artifact SHA-256 mismatch')"
 
+      - name: Checkout verified gate source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ needs.verify.outputs.release_sha }}
+          path: release-gate-source
+          persist-credentials: false
+          sparse-checkout: scripts/ci/verify-release-gates.js
+          sparse-checkout-cone-mode: false
+
+      # This read-only API check uses the existing publish job token. It is a
+      # snapshot; preventing subsequent tag movement requires protected tags.
+      - name: Recheck verified tag before publish
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ inputs.tag }}
+          RELEASE_SHA: ${{ needs.verify.outputs.release_sha }}
+          RELEASE_TAG_OBJECT_SHA: ${{ needs.verify.outputs.tag_object_sha }}
+        run: node release-gate-source/scripts/ci/verify-release-gates.js --tag-only
+
       - name: Publish npm package
         if: needs.verify.outputs.already_published != 'true'
         env:

.mcp.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "chrome-devtools": {
       "command": "npx",
-      "args": ["-y", "chrome-devtools-mcp@latest"]
+      "args": ["-y", "chrome-devtools-mcp@1.10.1"]
     }
   }
 }

AGENTS.md

@@ -1,6 +1,6 @@
 # Everything Claude Code (ECC) — Agent Instructions
 
-This is a **production-ready AI coding plugin** providing 68 specialized agents, 292 skills, 94 commands, and automated hook workflows for software development.
+This is a **production-ready AI coding plugin** providing 68 specialized agents, 293 skills, 94 commands, and automated hook workflows for software development.
 
 **Version:** 2.2.2
 
@@ -48,6 +48,42 @@ This is a **production-ready AI coding plugin** providing 68 specialized agents,
 | mle-reviewer | Production ML pipeline review | ML pipelines, evals, serving, monitoring, rollback |
 | rag-pipeline-reviewer | RAG pipeline review | Retrieval quality, chunking, reranking, RAGAS evaluation coverage |
 | typescript-reviewer | TypeScript/JavaScript code review | TypeScript/JavaScript projects |
+| react-reviewer | React/JSX code review | React component and hook changes |
+| react-build-resolver | React/Vite/Next.js/webpack build errors | React build failures |
+| vue-reviewer | Vue.js Composition API and reactivity review | Vue component, Pinia, and Nuxt changes |
+| swift-reviewer | Swift/iOS code review | Swift code changes |
+| swift-build-resolver | Swift/Xcode/SPM build errors | Swift build failures |
+| flutter-reviewer | Flutter/Dart widget and state review | Flutter app changes |
+| dart-build-resolver | Dart/Flutter build and pub dependency errors | Flutter compilation failures |
+| csharp-reviewer | C#/.NET async patterns, nullability, security | All C# code changes |
+| fastapi-reviewer | FastAPI async correctness, Pydantic, OpenAPI | FastAPI endpoint and schema changes |
+| php-reviewer | PHP/PSR-12, Eloquent, security review | PHP code changes |
+| harmonyos-app-resolver | HarmonyOS ArkTS/ArkUI code and API review | HarmonyOS/OpenHarmony application changes |
+| healthcare-reviewer | Clinical safety, PHI compliance, CDSS accuracy | Healthcare, EMR/EHR application code |
+| a11y-architect | WCAG 2.2 accessibility architecture | Designing UI components, accessibility audits |
+| code-architect | Feature architecture blueprints from codebase patterns | New features needing implementation design |
+| network-architect | Enterprise multi-site network architecture | Complex network design decisions |
+| homelab-architect | Home/small-lab network design | Home infrastructure planning |
+| network-config-reviewer | Router/switch config security and correctness | Network configuration changes |
+| network-troubleshooter | OSI-layer connectivity and routing diagnosis | Network connectivity and routing issues |
+| performance-optimizer | Bottleneck detection, bundle size, memory leaks | Slow code or high resource usage |
+| silent-failure-hunter | Swallowed errors and missing propagation | Code reliability audits |
+| type-design-analyzer | Type encapsulation and invariant design | Type design and invariant reviews |
+| pr-test-analyzer | PR test coverage quality and completeness | Before merging pull requests |
+| code-explorer | Execution path tracing and architecture mapping | Understanding unfamiliar code paths |
+| code-simplifier | Clarity-focused code refinement without behavior change | Post-implementation cleanup |
+| comment-analyzer | Comment accuracy, freshness, and rot risk | Code comment audits |
+| agent-evaluator | 5-axis quality scoring for agent output | Evaluating task completion quality |
+| chief-of-staff | Multi-channel communication triage and drafting | Managing email/Slack communication workflows |
+| conversation-analyzer | Extract hook behaviors from session transcripts | Creating hooks from observed patterns |
+| marketing-agent | Campaign planning, copy creation, content calendars | Product launches, marketing campaigns |
+| seo-specialist | Technical SEO audit, structured data, Core Web Vitals | Site audits, meta tag and schema issues |
+| opensource-forker | Fork projects and strip secrets for open-sourcing | Starting an open-source release |
+| opensource-sanitizer | Verify sanitized fork is release-ready | Before any public release |
+| opensource-packager | Generate OSS packaging boilerplate (README, LICENSE, etc.) | Finalizing an open-source release |
+| gan-planner | Expand a prompt into a full product specification | Starting a GAN harness session |
+| gan-generator | Implement features per spec, iterate on evaluator feedback | GAN harness implementation phase |
+| gan-evaluator | Test running application via Playwright and score it | GAN harness evaluation phase |
 
 ## Agent Orchestration
 
@@ -61,6 +97,17 @@ Use agents proactively without user prompt:
 - Autonomous loops / loop monitoring → **ecc:loop-operator**
 - Harness config reliability and cost → **ecc:harness-optimizer**
 - RAG/retrieval pipeline changes → **ecc:rag-pipeline-reviewer**
+- Performance bottleneck or slow code → **ecc:performance-optimizer**
+- React/JSX changes → **ecc:react-reviewer**
+- Vue changes → **ecc:vue-reviewer**
+- Swift changes → **ecc:swift-reviewer**
+- C# changes → **ecc:csharp-reviewer**
+- PHP changes → **ecc:php-reviewer**
+- Flutter/Dart changes → **ecc:flutter-reviewer**
+- Healthcare/clinical code → **ecc:healthcare-reviewer**
+- UI component design → **ecc:a11y-architect**
+- Open-source release prep → **ecc:opensource-forker** → **ecc:opensource-sanitizer** → **ecc:opensource-packager**
+- Agent output quality check → **ecc:agent-evaluator**
 
 Use parallel execution for independent operations — launch multiple agents simultaneously.
 
@@ -154,7 +201,7 @@ Troubleshoot failures: check test isolation → verify mocks → fix implementat
 
 ```
 agents/          — 68 specialized subagents
-skills/          — 292 workflow skills and domain knowledge
+skills/          — 293 workflow skills and domain knowledge
 commands/        — 94 slash commands
 hooks/           — Trigger-based automations
 rules/           — Always-follow guidelines (common + per-language)