Visant Killer

Adversarial UI audit. The screen is the defendant, not the client. Two halves that do not replace each other: the gate (deterministic scripts, binary: AI tell, token, voice, chrome noise) and judgment (you, with the skills loaded), because AI slop survives any linter: the problem is decision, not syntax.

Rule zero (from visant-copy): only the fix of a confirmed defect goes into the file. What passes clean stays untouched, even if it sounds flat. Taste improvements go as a proposal table; the user picks line by line.

A green gate is not a seen screen. A frozen AnimatePresence in a lead form passed six gates. So killer-scan refuses "gate open" without the surface table and the record of having opened the screen.

Where each rule came from: references/cases.md.

Hard prohibitions (you break them while writing, not reviewing)

Exceptions exist (route transition, marketing piece, #fff/#000 as a WCAG contrast reference, blur in a Dialog, scrim over a photo). An exception goes with a written reason on the line, in the scanner format (references/gates.md), never with a mute audit-ignore.

Scripts, by full path (used in every step):

K=~/.claude/skills/visant-killer/scripts/killer-scan.mjs
R=~/.claude/skills/visant-refine/scripts/refine-scan.mjs
D=~/.claude/skills/visant-killer/scripts/dist-scan.mjs
C=~/.claude/skills/visant-copy/scripts/copy-lint.mjs
T=~/.claude/skills/visant-killer/scripts/corta-scan.js; E=${T%corta-scan.js}ritmo-scan.js  # IN THE BROWSER (Step 5): clipping; spacing
V=~/.claude/skills/visant-killer/scripts/verify-screens.mjs  # opens the app logged in (Step 5)
# grafo.mjs is a library (import graph for --roots and repeated-door), not a CLI

Step 0: Root first (large target)

A target of dozens of files starts by grouping findings by root: node $K --roots <target> (shared pieces ranked by fan-out × findings, how). One wrong container produces hundreds of leaves with the same symptom, pointing at the wrong file. Primitives and the shell come before any page; only then --all to split the rest by file.

Step 1: Classify the target (never skip)

The tier decides how much interrogation the target deserves; a wrong tier wastes context, or audits what pays the bills too shallowly.

Mixed target: classify by region, not folder (a billing row inside a listing screen is T3 inside a T2).

Complaint only about excess ("too much text", "cluttered", "template look", "tá poluído", "muita label"): go straight to declutter.md, the path that needs nothing of the house (any repo, any language, no linter).

Step 2: Gate (runs before reading the code)

Report first, detector second (an exit code feels like completion, and agents stop there):

node $K --init-report AUDIT.md <target>    # skeleton, one row per route (Shell hint to confirm)
# fill the table BEFORE fixing anything
node $K --report AUDIT.md <target>

Without a complete --report it prints GATE INCOMPLETE and exits 1 (details). Two required columns:

• surface: A acquisition (not yet a customer), B work (uses it every day), C trust (money, permission, destructive action). A instincts on a B screen is the most expensive frontend mistake.
• business variable: what this element moves. Dash, "TBD" or empty is rejected: filling it with nothing is skipping the step.

The ## Screen seen section (exact heading; ## Tela vista also parses) is the other half: one row per screen opened, with route, width, data state and what happened. Read environment.md first: the dev server lies.

killer-scan runs four detectors, prints one scoreboard and ends with a gates: N/4 ran [...] line naming anything skipped: impeccable (AI tells); token (the repo's audit:design-like gate, else a labeled built-in FALLBACK for raw hex/rgb/hsl and palette classes, aware of the repo's token layer); copy (voice, only on strings that reach the eye: JSX text, label, title, placeholder, aria-label, alt); chrome noise (noise-scan: each line defensible, the sum unreadable). Details and the 24 noise rules: gates.md.

Discover the target repo's gates. The four detectors are the floor. Look at package.json scripts named lint/audit/design/token/ui/theme/i18n/ratchet and at scripts/ for unwired scanners; run what exists on the target; record what ran and what was skipped, and why (commands).

Side gates: node $R <target> when there is a chart, gauge or animation; node $D <app-root> on surface A, before polish, because a page that shares without a card or converts without an event is not fixable by tokens and no UI detector lights up (distribution.md).

A failed gate becomes a fix, not a proposal, after confirming each finding at file:line (legacy code is noisy; fixing unread lines writes bugs).

• A confirmed false positive has ONE right fix: repair the rule and lock the case in the fixture, never an audit-ignore in the file (it hides the next one).
• Written exception: EXCEPTION to <scanner>/<rule>: reason (or EXCEÇÃO ao) on the line or up to 8 above; mute allowlists are forbidden (contract).
• CI ratchet: re-record a baseline only when the total dropped, never to absorb a rise, always over the whole app (gates.md).
• Rule before finding: many findings, almost none real, means the defect is in the RULE. Group by folder, read the rule's intent, scope it with a reason written inside the rule, then fix what is left (false-positives.md).

Step 3: Judgment (load by tier, not everything always)

Skill memory is not the skill; load by tier, and report what was not loaded.

Lean T3 (tight context): only each SKILL.md; a reference only for a finding. Order: visant-frontend (the cut test: every element names the business variable it moves, or it goes; the Step 2 surface table is its output), then visant-motion (easing/duration SSoT and feel gotchas), visant-copy (voice; the gate caught syntax), revenue-centric-design (only as Step 4 ammunition).

Read slop-catalog.md before judging (slop that passes every linter: symptom, cause, fix). Several agents at once: exclusive file ownership, i18n by fragment merged once, measure after edits stop (multi-agent.md).

Step 4: Devil's advocate

The goal is the concept change that makes half the pixel work unnecessary. Question bank per tier: devils-advocate.md.

• Pick the tier's questions, no more (extra on T1 is philosophy about a card). The fixed block F1 to F6 runs on every tier: reuse, design-system consistency, measured responsiveness and performance, progressive flow for the ICP, what to hide or iconize, what is missing for Silicon Valley level.
• Answer it yourself first, with file:line. A question handed back with no attempt is laziness dressed as rigor. Only what changes what gets built and the code cannot answer goes to the user, with your recommendation first.
• Name the revenue-centric-design mechanism when there is one (attention hierarchy, Swiss Knife Index, optimal play, default as decision, promise the size of the proof). Naming the lever is the value.
• One question that kills the screen beats twelve token fixes. If the honest answer is "this screen should not exist", write that.

Step 5: Verification (what compiles is not what someone saw)

First, open the screen (it fills ## Screen seen). App behind login: node $V from the target repo (overflow, cut text, raw i18n keys, console, /api 4xx/5xx, empty screen, theme; paid routes locked). Published URL: corta-url.mjs <base> route. By hand: $T/$E in the console. Flags: verification.md. Before measuring, the four signals in environment.md: route warmed up, hydration confirmed by a DOM mark (not readyState), real data including the worst record, node count matching the page opened by hand.

Then, and only then (whatever did not run goes in the report):

Step 6: Report

The same AUDIT.md, now with findings and score first, never just chat text (scorecard.md). A score is not a compliment: 100 on the gate with a T3 and no positioning interrogation is an incomplete audit, and the report says so.

Do not

• Declare a high score without running the script, or a "full pass" with the surface table blank. The score comes from the process, not the vibe.
• Create a new design-system component without explicit permission. Reuse and parametrize; if a piece is missing, look first in the Visant library (ui.visantlabs.com, 150+ audited items; index at /llms.txt, sheet at /r/<name>.md), then the official shadcn primitive. Both install via npx shadcn@latest add @visant/<name> (registry "@visant": "https://ui.visantlabs.com/r/{name}.json" in components.json); say so before.
• Fix leaves before roots (Step 0, --roots).
• Open a route that spends credits on load without the verify-screens lock.
• Refactor on top of a reported defect without confirming it in the code. Diagnosis is file:line, not opinion.
• Declare done without having opened the screen: the line this whole skill exists to defend.
• Apply it to a gambling, casino or betting product. Refuse and explain: it is a reuse condition of revenue-centric-design, not taste.

Credits and lineage

This skill is the door; judgment comes from the house skills it loads: visant-frontend (cut test, surfaces), visant-motion (motion-lint), visant-refine (refine-scan) and visant-copy (copy-lint). From outside:

A new skill this one starts using or distilling enters this table in the same commit.