ctoc

Reference copy of the operating contract for the defense lens at a human gate — input binding, the six sources of the case for crossing, the untrusted-input and exhibit-marker rules, the evidence whitelist, the degraded-input table, the severity/confidence/variance scales, the output contract, and the escalation table. NOT preloaded into any agent. agents/iron-loop/advocate-critic.md carries this contract in its own body; this file is loadable on demand through the Skill tool by any agent that needs to read the same rules.

Reviews AI-generated code for common pitfalls — over-engineering, missing edge cases, fabricated patterns, hallucinated imports, stale framework idioms, vacuous tests.

Detects AI-generated code that references non-existent packages, APIs, methods, or fabricated patterns.

Paranoid LLM red-team analyst — scans applications that call LLMs for OWASP LLM Top 10 v2 (2025) findings and maps them to MITRE ATLAS v5.4.0 adversary tactics.

Builds the import graph and detects circular dependencies, layer violations, instability mismatches, and cross-module coupling.

Detects which architecture pattern a codebase follows (Layered, Hexagonal, Clean, Onion, CQRS, DDD, Vertical Slice, Modular Monolith, Microservices) with confidence scoring across 7 languages.

AI regulatory governance scanner — classifies AI systems against EU AI Act risk tiers, NIST AI RMF / AI 600-1 functions, and ISO/IEC 42001 controls; flags missing inventory, oversight, documentation, transparency, and conformity-assessment artifacts.

Validates audit logging for compliance, security, and operational visibility.

Validates GDPR/privacy compliance in code, data flows, consent, and right-to-erasure implementation.

Scans dependencies for license compliance, attribution gaps, and copyleft conflicts.

SBOM correctness, signing, retention, and EU Cyber Resilience Act (CRA) vulnerability-reporting readiness — validates SPDX 2.3+/CycloneDX 1.6+ against NTIA minimum elements and ENISA Single Reporting Platform wiring.

Analyzes infrastructure code and cloud usage for cost optimization — right-sizing, reservations, waste elimination, PR-time cost prediction.

Validates data quality across pipelines, schemas, and warehouses using the six data-quality dimensions.

Validates feature store configurations, feature definitions, freshness, lineage, and online/offline consistency.

Validates ML models for performance, fairness, robustness, drift, and deployment readiness.

Detects usage of deprecated APIs, libraries, and language features so teams can plan migrations.

Validates developer onboarding — README, bootstrap, devcontainer, version pinning, contributing docs — to minimize time-to-first-hello-world.

Auto-generates changelogs from commits and PRs — Keep a Changelog 1.1 + Conventional Commits, semver-driven, breaking-change-first, generated-and-curated hybrid.

Updates API docs, README, code comments, and changelog entries.

Analyzes JavaScript bundle size, enforces performance budgets, finds tree-shaking failures, code-split gaps, and budget regressions in CI.

Tests React/Vue/Svelte/Solid/Blazor components in isolation using real-browser test runners, semantic queries, and user-behavior-driven assertions.

Detects unintended visual changes via AI-aware screenshot comparison and perceptual diffing.

Validates CI/CD pipelines for supply chain security and 2026 best practices.

Guides users through GitHub Actions runner selection (hosted vs self-hosted vs hybrid) with informed-decision UX.

Scans Dockerfiles and images for security vulnerabilities and 2026 hardening best practices.

Validates Kubernetes manifests for security, resource hygiene, and 2026 GitOps best practices.

Validates Terraform / OpenTofu IaC for syntax, security, and 2026 best practices (remote state with locking, drift detection, for_each, policy-as-code).

Contract Lifecycle Management (CLM) obligations tracker — extracts payment, service-level agreement, audit, renewal, and termination obligations from generated legal documents and writes them to .ctoc/contracts/obligations.yaml with timer-bearing fields. Points to lawyer-reviewed clause-library templates for limitation of liability, indemnification, sub-processor, and Health Insurance Portability and Accountability Act Business Associate Agreement boilerplate.

Data Subject Access Request (DSAR) handler — identity verification, scope assessment, data discovery, machine-readable export, signed deletion attestation. Tracks GDPR Article 12 (one month / extendable three) and California Consumer Privacy Act / California Privacy Rights Act (45 days / extendable 90) clocks. Writes per-request evidence to .ctoc/dsar/<request-id>.yaml.

Validates Android/Kotlin code quality, runs ktlint+detekt, builds and tests on the emulator, and emits security findings as critical-tier letters via the refinement loop.

Validates iOS/Swift code quality, runs SwiftLint, builds and tests on the simulator, audits privacy manifest, keychain usage, ATT, code signing.

Validates React Native native module compatibility, bridge efficiency, and Turbo Modules migration.

Designs A/B tests from a hypothesis — control vs variant, success metric, minimum sample size, duration, feature-flag config. Outputs a runnable experiment spec with sample-size, SRM check, CUPED, and pre-registered analysis plan.

Weekly product review. Reads KPI data from PostHog/Stripe, compares against targets, identifies funnel drop-offs, surfaces 2-3 hypotheses for improvement.

Detects architectural violations — circular dependencies, layer violations, forbidden imports, blast radius, missing module boundaries — at stage transitions.

Reviews code quality against CTO profile standards — readability, naming, idiomatic style, error handling, and reviewer-judgement patterns automated tools miss.

Detects code smells and anti-patterns that indicate design problems — classic Fowler catalog plus 2026 ML/LLM additions.

Measures cyclomatic, cognitive, NPath, Halstead, and structural complexity; flags refactoring hotspots with refactor-suggested fixes.

Generates concrete refactoring plans for complex code with before/after examples, AST-based codemod recipes, and quantified complexity reduction across 7 languages.

Ensures naming, patterns, and style consistency across the codebase — catches what formatters can't.