feat: add receipt-gated React planning suite

.claude/agents/js-critic-router.md

@@ -14,15 +14,9 @@ Your only job is to read the submitted artifact and emit a routing decision. Do
 
 ## Routing Decision Matrix
 
-Read the artifact — code, file paths, config files, imports, PR description, or plan document — and apply the following rules in order. Use the FIRST match.
+Read the artifact — code, file paths, config files, imports, PR description, or plan document. Detect framework signals before deciding whether the artifact is a plan. A plan for Next.js is reviewed by `next-critic`; a plan for React Native is reviewed by `react-native-critic`. Generic proposal review is only for plans with no framework-specific signal.
 
-### 1. proposal-critic
-Route here when the artifact is:
-- A pre-implementation document: RFC, ADR, architecture decision record, technical proposal, migration plan, refactor brief, feature spec, or design doc.
-- Signal phrases: "Proposal", "RFC", "ADR", "we propose", "migration plan", "architecture decision", "this document describes", "alternatives considered", "rollback strategy", "out of scope".
-- No code, or only illustrative pseudocode snippets.
-
-### 2. react-native-critic
+### 1. react-native-critic
 Route here when ANY of the following are present:
 - `react-native` in package.json dependencies or imports.
 - `expo` in package.json or imports from `expo`, `expo-*`, or `@expo/*`.
@@ -31,7 +25,7 @@ Route here when ANY of the following are present:
 - RN-specific components: `View`, `Text`, `FlatList`, `ScrollView`, `TouchableOpacity`, `Pressable` without a browser/web context.
 - Config: `react-native.config.js`, `metro.config.js`.
 
-### 3. next-critic
+### 2. next-critic
 Route here when ANY of the following are present and react-native signals are absent:
 - `next` in package.json dependencies.
 - File paths matching App Router conventions: `app/**/page.tsx`, `app/**/layout.tsx`, `app/**/route.ts`, `app/**/loading.tsx`, `app/**/error.tsx`, `app/**/not-found.tsx`.
@@ -41,12 +35,15 @@ Route here when ANY of the following are present and react-native signals are ab
 - Config: `next.config.*`, `next.config.js`, `next.config.ts`.
 - `generateStaticParams`, `generateMetadata`, `revalidatePath`, `revalidateTag`.
 
-### 4. react-critic (default for React)
+### 3. react-critic (default for React)
 Route here when:
 - React is present (`react` in imports or package.json) and neither Next.js nor React Native signals above are triggered.
 - JSX/TSX files with React hooks (`useState`, `useEffect`, `useContext`, `useCallback`, `useMemo`, `useRef`, `useReducer`, `useSuspenseQuery`, etc.).
 - React component patterns without a framework wrapper.
 
+### 4. proposal-critic
+Route here only when the artifact is a pre-implementation RFC, ADR, migration plan, refactor brief, feature spec, or design document and no React, Next.js, or React Native framework signal is present.
+
 ### 5. Ambiguous / multi-framework
 If signals for multiple critics are present (e.g., a monorepo PR touching both Next.js and React Native code):
 - List each detected framework and the signal that triggered it.
@@ -63,6 +60,7 @@ Emit ONLY:
 ROUTE: [react-critic | next-critic | react-native-critic | proposal-critic | MULTI]
 REASON: One sentence describing the primary signal.
 SIGNALS: Comma-separated list of detected signals (file paths, imports, keywords, or config files).
+MODE: [PLAN | IMPLEMENTATION]
 ```
 
 If MULTI:
@@ -71,6 +69,7 @@ ROUTE: MULTI
 REASON: One sentence.
 SIGNALS: signal1, signal2
 RECOMMENDED_ORDER: critic-a first (reason), critic-b second (reason)
+MODE: [PLAN | IMPLEMENTATION]
 ```
 
 Do not add any other text. Do not start a review.

.claude/agents/react-executor.md

@@ -0,0 +1,8 @@
+---
+name: react-executor
+description: "Use to implement a fingerprinted React, Next.js, or React Native plan after the correct framework critic has accepted it."
+---
+
+<Agent_Prompt>
+You are the React Executor. Follow the react-executor skill exactly. Fail closed when the plan, scope, saved framework-critic output, or receipt does not validate. Preserve unrelated work, implement only the authorized paths, run proportional tests, and bind the final framework-critic output to a matching post-implementation receipt. Do not commit, push, open or update a PR, deploy, or publish unless the user explicitly authorizes that action.
+</Agent_Prompt>

.claude/agents/react-planner.md

@@ -0,0 +1,9 @@
+---
+name: react-planner
+description: "Use for substantive React, Next.js, or React Native planning that must be bound to a framework-critic receipt before implementation."
+disallowedTools: Write, Edit
+---
+
+<Agent_Prompt>
+You are the React Planner. Follow the react-planner skill exactly. Inspect before planning, select the framework critic from repository evidence, emit the Plan Contract v1 JSON, and bind it to the current authorized scope. You do not implement, commit, push, or deploy. A generic proposal critic does not replace the framework critic.
+</Agent_Prompt>

.claude/skills/next-critic/SKILL.md

@@ -26,13 +26,15 @@ The router (`js-critic-router`) dispatches here when it detects: `next` in packa
 ## External Skill References (No Copy Policy)
 Use external skills as references only.
 
-- Canonical reference file: [external-skills-manifest.yaml](references/external-skills-manifest.yaml)
+- Canonical routing manifest: [external-skills-manifest.json](references/external-skills-manifest.json)
+- Central integrity lock: [../shared-js-core/references/external-skills-lock.json](../shared-js-core/references/external-skills-lock.json)
 - Routing policy: [skill-routing-map.md](references/skill-routing-map.md)
 
 Rules:
 - Do not copy external skill body content into this repository.
-- Use manifest IDs/URLs and pinned commit metadata for traceability.
-- If a referenced skill is unavailable in runtime, continue with local rubric fallback and state the limitation.
+- Load a selected reference only with `python3 ../shared-js-core/scripts/resolve_external_skill.py load --consumer next-critic --id ID` from the skills directory. Never infer a raw-content URL.
+- The resolver verifies the explicit source path, pinned commit, file size/hash, bundle digest, consumer enablement, and prompt-injection scan before returning content.
+- If resolution fails, do not use unverified external text. Continue with the local rubric and report the resolver error code as a limitation.
 
 ## References
 - Shared rubric: [../shared-js-core/references/js-review-rubric.md](../shared-js-core/references/js-review-rubric.md)

.claude/skills/next-critic/references/external-skills-manifest.json

@@ -0,0 +1,169 @@
+{
+  "version": 2,
+  "consumer": "next-critic",
+  "generated_at": "2026-09-19T17:46:26Z",
+  "skills": [
+    {
+      "id": "wshobson/agents/nextjs-app-router-patterns",
+      "categories": [
+        "next",
+        "app-router"
+      ],
+      "audiences_supported": [
+        "new-hire",
+        "ops"
+      ],
+      "priority": 88,
+      "jtbd": "Load when reviewing App Router architecture \u2014 layout nesting, parallel routes, route groups, and advanced patterns.",
+      "enabled": true
+    },
+    {
+      "id": "wsimmonds/claude-nextjs-skills/nextjs-app-router-fundamentals",
+      "categories": [
+        "next",
+        "app-router"
+      ],
+      "audiences_supported": [
+        "new-hire"
+      ],
+      "priority": 82,
+      "jtbd": "Load when reviewing App Router fundamentals \u2014 server/client component split, basic routing, and data flow patterns.",
+      "enabled": true
+    },
+    {
+      "id": "clerk/skills/clerk-nextjs-patterns",
+      "categories": [
+        "next",
+        "auth"
+      ],
+      "audiences_supported": [
+        "security"
+      ],
+      "priority": 78,
+      "jtbd": "Load when code uses Clerk for authentication \u2014 middleware setup, protected routes, and session management patterns.",
+      "enabled": true
+    },
+    {
+      "id": "auth0/agent-skills/auth0",
+      "categories": [
+        "next",
+        "auth"
+      ],
+      "audiences_supported": [
+        "security"
+      ],
+      "priority": 78,
+      "jtbd": "Load when code uses Auth0 for authentication \u2014 SDK integration, callback handling, and session patterns for Next.js.",
+      "enabled": true
+    },
+    {
+      "id": "mindrally/skills/nextauth-authentication",
+      "categories": [
+        "next",
+        "auth"
+      ],
+      "audiences_supported": [
+        "security"
+      ],
+      "priority": 76,
+      "jtbd": "Load when code uses NextAuth.js / Auth.js \u2014 provider configuration, session strategy, and callback patterns.",
+      "enabled": true
+    },
+    {
+      "id": "wshobson/agents/javascript-testing-patterns",
+      "categories": [
+        "shared",
+        "testing"
+      ],
+      "audiences_supported": [
+        "ops"
+      ],
+      "priority": 86,
+      "jtbd": "Load when reviewing test strategy, async test patterns, or coverage gaps in JavaScript/TypeScript projects.",
+      "enabled": true
+    },
+    {
+      "id": "wshobson/agents/modern-javascript-patterns",
+      "categories": [
+        "shared",
+        "javascript"
+      ],
+      "audiences_supported": [
+        "new-hire"
+      ],
+      "priority": 76,
+      "jtbd": "Load when reviewing modern JS idioms \u2014 ESM usage, async patterns, and contemporary language features.",
+      "enabled": true
+    },
+    {
+      "id": "sickn33/antigravity-awesome-skills/api-security-best-practices",
+      "categories": [
+        "shared",
+        "security"
+      ],
+      "audiences_supported": [
+        "security"
+      ],
+      "priority": 72,
+      "jtbd": "Load when code handles API boundaries, auth tokens, user input, or sensitive data \u2014 trust boundary and input validation patterns.",
+      "enabled": true
+    },
+    {
+      "id": "vercel-labs/agent-skills/react-best-practices",
+      "categories": [
+        "core-review",
+        "next",
+        "performance"
+      ],
+      "audiences_supported": [
+        "new-hire",
+        "ops"
+      ],
+      "priority": 100,
+      "jtbd": "Core React and Next.js performance guidance after retirement of next-skills.",
+      "enabled": true
+    },
+    {
+      "id": "vercel-labs/agent-skills/composition-patterns",
+      "categories": [
+        "next",
+        "architecture"
+      ],
+      "audiences_supported": [
+        "new-hire",
+        "ops"
+      ],
+      "priority": 94,
+      "jtbd": "Load for component API and server/client composition decisions.",
+      "enabled": true
+    },
+    {
+      "id": "vercel/next.js/next-dev-loop",
+      "categories": [
+        "next",
+        "runtime-verification"
+      ],
+      "audiences_supported": [
+        "new-hire",
+        "ops"
+      ],
+      "priority": 92,
+      "jtbd": "Executor-only: Next 16.3+, Turbopack, running next dev, and agent-browser >=0.31.1.",
+      "enabled": true
+    },
+    {
+      "id": "vercel/next.js/next-cache-components-optimizer",
+      "categories": [
+        "next",
+        "cache-components"
+      ],
+      "audiences_supported": [
+        "new-hire",
+        "ops"
+      ],
+      "priority": 90,
+      "jtbd": "Executor-only: Next 16.3+ Cache Components instant-navigation work.",
+      "enabled": true
+    }
+  ]
+}

.claude/skills/next-critic/references/skill-routing-map.md

@@ -1,17 +1,20 @@
 # Next Critic Skill Routing Map
 
 Core (always loaded):
-- vercel-labs/next-skills/next-best-practices — core Next.js App Router patterns and data fetching from Vercel
+- vercel-labs/agent-skills/react-best-practices — core React and Next.js performance guidance
+- vercel-labs/agent-skills/composition-patterns — load when component APIs or server/client composition are central
 
 Specialists (load one based on context):
-- vercel-labs/next-skills/next-cache-components — when reviewing caching, ISR, or revalidation behavior
-- vercel-labs/next-skills/next-upgrade — when reviewing Next.js version upgrades or migrations
 - wshobson/agents/nextjs-app-router-patterns — when reviewing advanced App Router architecture patterns
 - wsimmonds/claude-nextjs-skills/nextjs-app-router-fundamentals — when reviewing basic App Router component structure
 
+Executor-only upstream tools (never load from version keywords alone):
+- vercel/next.js/next-dev-loop — only with Next.js 16.3+, Turbopack, a running `next dev`, `/_next/mcp`, and `agent-browser >=0.31.1`
+- vercel/next.js/next-cache-components-optimizer — only with Next.js 16.3+, `cacheComponents` enabled, a production-like verification rig, and an explicit instant-navigation objective
+
 Auth conditional (load when auth imports detected):
 - clerk/skills/clerk-nextjs-patterns — when Clerk imports are present
-- auth0/agent-skills/auth0-nextjs — when Auth0 imports are present
+- auth0/agent-skills/auth0 — when Auth0 imports are present; select the Next.js section after verified loading
 - mindrally/skills/nextauth-authentication — when NextAuth.js / Auth.js imports are present
 
 Shared support (load one):

.claude/skills/proposal-critic/SKILL.md

@@ -27,13 +27,15 @@ Uses **executor/stakeholder/skeptic** perspectives instead of the standard secur
 ## External Skill References (No Copy Policy)
 Use external skills as references only.
 
-- Canonical reference file: [external-skills-manifest.yaml](references/external-skills-manifest.yaml)
+- Canonical routing manifest: [external-skills-manifest.json](references/external-skills-manifest.json)
+- Central integrity lock: [../shared-js-core/references/external-skills-lock.json](../shared-js-core/references/external-skills-lock.json)
 - Routing policy: [skill-routing-map.md](references/skill-routing-map.md)
 
 Rules:
 - Do not copy external skill body content into this repository.
-- Use manifest IDs/URLs and pinned commit metadata for traceability.
-- If a referenced skill is unavailable in runtime, continue with local rubric fallback and state the limitation.
+- Load a selected reference only with `python3 ../shared-js-core/scripts/resolve_external_skill.py load --consumer proposal-critic --id ID` from the skills directory. Never infer a raw-content URL.
+- The resolver verifies the explicit source path, pinned commit, file size/hash, bundle digest, consumer enablement, and prompt-injection scan before returning content.
+- If resolution fails, do not use unverified external text. Continue with the local rubric and report the resolver error code as a limitation.
 
 ## References
 - Shared rubric: [../shared-js-core/references/js-review-rubric.md](../shared-js-core/references/js-review-rubric.md)

.claude/skills/proposal-critic/references/external-skills-manifest.json

@@ -0,0 +1,78 @@
+{
+  "version": 2,
+  "consumer": "proposal-critic",
+  "generated_at": "2026-09-19T17:46:26Z",
+  "skills": [
+    {
+      "id": "dotneet/claude-code-marketplace/typescript-react-reviewer",
+      "categories": [
+        "proposal",
+        "typescript",
+        "api-design"
+      ],
+      "audiences_supported": [
+        "executor",
+        "dx-maintainer"
+      ],
+      "priority": 78,
+      "jtbd": "Load when evaluating TypeScript API design proposals \u2014 type safety patterns and interface design review.",
+      "enabled": true
+    },
+    {
+      "id": "wshobson/agents/modern-javascript-patterns",
+      "categories": [
+        "shared",
+        "javascript"
+      ],
+      "audiences_supported": [
+        "executor",
+        "skeptic"
+      ],
+      "priority": 76,
+      "jtbd": "Load when evaluating JS/TS pattern choices in proposals \u2014 modern idioms and contemporary language feature assessment.",
+      "enabled": true
+    },
+    {
+      "id": "sickn33/antigravity-awesome-skills/api-security-best-practices",
+      "categories": [
+        "shared",
+        "security"
+      ],
+      "audiences_supported": [
+        "security-engineer"
+      ],
+      "priority": 72,
+      "jtbd": "Load when proposals involve API design, auth flows, or data handling \u2014 security architecture and trust boundary review.",
+      "enabled": true
+    },
+    {
+      "id": "wshobson/agents/javascript-testing-patterns",
+      "categories": [
+        "shared",
+        "testing"
+      ],
+      "audiences_supported": [
+        "executor"
+      ],
+      "priority": 70,
+      "jtbd": "Load when evaluating test strategy feasibility in proposals \u2014 coverage planning and test architecture assessment.",
+      "enabled": true
+    },
+    {
+      "id": "vercel-labs/agent-skills/composition-patterns",
+      "categories": [
+        "core-review",
+        "proposal",
+        "architecture"
+      ],
+      "audiences_supported": [
+        "executor",
+        "stakeholder",
+        "skeptic"
+      ],
+      "priority": 96,
+      "jtbd": "Core React and Next.js component architecture planning reference.",
+      "enabled": true
+    }
+  ]
+}

.claude/skills/proposal-critic/references/skill-routing-map.md

@@ -1,7 +1,7 @@
 # Proposal Critic Skill Routing Map
 
 Core (always loaded):
-- wshobson/agents/react-native-architecture — cross-framework architectural patterns for proposal evaluation
+- vercel-labs/agent-skills/composition-patterns — React and Next.js component API and state-boundary architecture
 
 Specialists (load one based on proposal focus):
 - dotneet/claude-code-marketplace/typescript-react-reviewer — when proposal involves TypeScript API design or type system decisions