Yana-AI

Three-phase vulnerability chain analysis — parallel agents find individual weaknesses, then a synthesis step identifies which combinations escalate to critical impact. Inspired by Strix (usestrix/strix) "Graph of Agents" pentesting model.

One brief → platform-native content for TikTok, Xiaohongshu (小红书), X/Twitter thread, LinkedIn — simultaneously. Each platform gets a specialist with native format, tone, and hooks. No generic copy-paste. Inspired by msitarzewski/agency-agents marketing division (MIT).

Paste your trading history (CSV / broker export / list of trades) and AI extracts hidden behavioral biases, implicit rules, and compares your actual behavior vs an ideal shadow strategy. Inspired by HKUDS/Vibe-Trading Shadow Account Analysis (MIT).

4-agent parallel investment research team modeled after legendary investors. business-analyst (Duan Yongping lens), financial-analyst (Buffett lens), industry-researcher (Munger lens), risk-assessor (Li Lu lens). team-lead synthesizes into a single verdict. Inspired by ai-berkshire (MIT).

Buffett 6-gate checklist for any stock or company. Forces a hard pass/fail verdict with moat scoring, management trust rating, and margin of safety. No hedging, no "it depends". Inspired by ai-berkshire (MIT).

Convene 6 intellectual personas across multiple LLM providers for hard decisions. Each persona runs on a different provider for genuinely different reasoning — not costume changes on one model. Inspired by council-of-high-intelligence (CC0).

Query the Yana AI codebase knowledge graph via codebase-memory-mcp. Use instead of grep/glob when exploring call chains, finding callers/callees, understanding architecture, or tracing impact of changes. Triggers on: 'who calls X', 'trace path', 'find callers', 'search graph', 'cbm', 'knowledge graph', 'what calls', 'call chain', 'what uses', 'where is X defined', 'architecture overview', 'impact of changing'.

Template pattern for multi-agent analysis where agents hold opposing mandates. Use when spawning subagents for complex research, code review, architecture decisions, or risk assessment. Triggers on: 'adversarial team', 'devil's advocate analysis', 'multi-perspective review', 'challenge this decision', 'stress test this plan', 'red team this'.

Use when you need to prove test results with a signed receipt from yana-rt evidence run — not just text. Required for all Rust guard/evidence modules in Yana AI, and any claim "tests passed" that must be verifiable. Triggers on: yana-rt evidence run, signed receipt, viết test trước, evidence run, proof of test.

Production-grade agent conversation loop — iteration budget with grace call, stale-stream detection (90s), chunked retry on truncation, continuation prompt, jittered backoff (base 5s/max 120s). Source: NousResearch/hermes-agent (MIT).

Yana AI-native (not hermes-agent-derived — see Provenance correction below) command allowlist + approval-gate pattern for safe tool execution. Block dangerous commands by default, prompt for approval on risky ones, auto-deny in non-interactive subagents. Complements YAMTAM's safe-run.sh at the agent decision level. Distinct from [[hermes-tool-loop-guard]], which detects within-turn tool-call failure loops.

Set up 9Router as a local AI gateway so coding agents never stop when a provider quota runs out — one OpenAI-compatible endpoint (localhost:20128) fanning out to 40+ providers with automatic fallback. Use when asked to 'set up 9router', 'cài 9router', 'hết quota Claude thì làm sao', 'fallback provider tự động', 'never hit rate limits', 'free AI router', or 'nối Claude Code vào nhiều provider'. Do NOT use for: cloud gateway architecture comparisons (LiteLLM/Portkey/Kong) — see ai-gateway-patterns. Do NOT use for: YAMTAM's internal task routing — see yana-router docs.

Agent-to-Agent (A2A) protocol — Google 2025, 150+ org backing. Agent Cards discovery, task lifecycle (submitted→working→completed), artifacts (text/structured/video), opaque task model. MCP vs A2A split. Auth: bearer/mTLS/signed. Sources: rohitg00/ai-engineering-from-scratch (Apache-2.0).

Library of 232 AI agent personalities across 16 business divisions — Engineering, Design, Sales, Marketing, Security, Finance, Game Dev, GIS, Academic and more. Platform-agnostic (Claude Code, Cursor, Copilot, Windsurf, Aider, Gemini CLI). Triggers on: 'agency agents', 'agent library', 'agent personalities', '232 agents', 'agent divisions', 'specialized AI agents', 'frontend developer agent', 'security architect agent', 'paid media agent', 'AI team structure', 'company as agents', 'multi-division agents', 'agent role catalog', 'msitarzewski agency', 'install agent roles', 'agent markdown files', 'cross-platform agent'.

Attack surface mapping for LLM agent systems. Threat model, blast radius calculation, entry points, trust boundaries, lateral movement paths, and MITRE ATLAS techniques for AI agents. Sources: MITRE/ATLAS, OWASP LLM Top 10, microsoft/promptbench, greshake/indirect-prompt-injection, google/sec-gemini-research, anthropic/model-spec.

Agent memory system security — poisoning prevention, L1/L2 integrity, context window attacks, memory exfiltration defense, and session isolation. Sources: anthropic/model-spec (minimal footprint), OWASP LLM01/LLM02, langchain-ai/langchain (memory modules), memgpt/memgpt, microsoft/autogen (agent memory), chromadb/chroma.

Intercept-layer skill for wrapping all agent tool calls through a sanitize-mutate-execute proxy pipeline. Onion middleware composition (koa), request/response interceptors (axios), scope-aware handler chains (express), near-zero-latency proxy routing (caddy), and in-memory pipe streams (piping-server). Implements core/scripts/tool-proxy.sh. Sources: koajs/koa, axios/axios, expressjs/express, caddyserver/caddy, nwtgck/piping-server.

Telemetry and observability patterns for AI agent systems. Structured multi-transport logging, OpenTelemetry traces/spans through action gates, crash diagnostics, ultra-low-overhead logging, and percentile latency metrics. Sources: winstonjs/winston, open-telemetry/opentelemetry-js, nodejs/node-report, pinojs/pino, vladimir-kostyukov/metrics.

Deterministic verification gate for agent task close-out. Reads scope contract, rule report, feedback log, and diff — emits a single verification_report.json verdict. Block-severity failures cannot be overridden by the agent. Sources: rohitg00/ai-engineering-from-scratch (Apache-2.0).

Intelligence on leaked/published system prompts from 30+ AI coding tools — Cursor, Windsurf, Claude Code, GitHub Copilot, Devin, v0, Lovable, Replit, Warp, Perplexity. Use for competitive analysis, prompt engineering research, understanding how other tools instruct their models. Triggers on: 'system prompt of cursor', 'windsurf system prompt', 'claude code prompt', 'copilot system prompt', 'devin prompt', 'AI tool system prompt', 'leaked AI prompts', 'how cursor instructs AI', 'competitive prompt analysis', 'prompt engineering research', 'v0 system prompt', 'replit agent prompt'.

Merkle-tree-backed append-only log for distributed audit trails. Hypercore feed creation, append entries, replicate over network, sparse access, and integration with L0 audit hash-chain. Sources: holepunchto/hypercore.

Streaming ZIP and TAR archive creation for agent release packaging. node-archiver streaming API, append files/directories, compression levels, progress events, and integrity verification. Sources: archiverjs/node-archiver.

Argo CD GitOps reconciliation loop for agent infrastructure. App-of-Apps pattern, sync policies, drift detection, progressive rollouts, and automated self-healing from Git as single source of truth. Sources: argoproj/argo-cd (Apache-2.0).

Async key-value storage with automatic driver selection. localForage API patterns, IndexedDB/WebSQL/localStorage fallback chain, binary data storage, expiry patterns, and offline-first agent state persistence. Sources: localForage/localForage.

Philosophy of Software Design (John Ousterhout) — Full rules — comprehensive mandatory coding standards. Use when asked to apply Philosophy of Software Design principles or review code against Philosophy of Software Design standards.

Philosophy of Software Design (John Ousterhout) — Condensed rules — key principles distilled. Use when asked to apply Philosophy of Software Design principles or review code against Philosophy of Software Design standards.

Philosophy of Software Design (John Ousterhout) — Minimal rules — essential one-liners only. Use when asked to apply Philosophy of Software Design principles or review code against Philosophy of Software Design standards.

Clean Architecture (Robert C. Martin) — Full rules — comprehensive mandatory coding standards. Use when asked to apply Clean Architecture principles or review code against Clean Architecture standards.

Clean Architecture (Robert C. Martin) — Condensed rules — key principles distilled. Use when asked to apply Clean Architecture principles or review code against Clean Architecture standards.

Clean Architecture (Robert C. Martin) — Minimal rules — essential one-liners only. Use when asked to apply Clean Architecture principles or review code against Clean Architecture standards.

Clean Code (Robert C. Martin) — Full rules — comprehensive mandatory coding standards. Use when asked to apply Clean Code principles or review code against Clean Code standards.

Clean Code (Robert C. Martin) — Condensed rules — key principles distilled. Use when asked to apply Clean Code principles or review code against Clean Code standards.

Clean Code (Robert C. Martin) — Minimal rules — essential one-liners only. Use when asked to apply Clean Code principles or review code against Clean Code standards.

Code Complete (Steve McConnell) — Full rules — comprehensive mandatory coding standards. Use when asked to apply Code Complete principles or review code against Code Complete standards.

Code Complete (Steve McConnell) — Condensed rules — key principles distilled. Use when asked to apply Code Complete principles or review code against Code Complete standards.

Code Complete (Steve McConnell) — Minimal rules — essential one-liners only. Use when asked to apply Code Complete principles or review code against Code Complete standards.

DDIA (Martin Kleppmann) — Full rules — comprehensive mandatory coding standards. Use when asked to apply DDIA principles or review code against DDIA standards.

DDIA (Martin Kleppmann) — Condensed rules — key principles distilled. Use when asked to apply DDIA principles or review code against DDIA standards.

DDIA (Martin Kleppmann) — Minimal rules — essential one-liners only. Use when asked to apply DDIA principles or review code against DDIA standards.

DDD Distilled (Vaughn Vernon) — Full rules — comprehensive mandatory coding standards. Use when asked to apply DDD Distilled principles or review code against DDD Distilled standards.