@arimakouyou/spec-workflow-mcp 2.2.7

package/.claude-plugin/rules/project-architecture.md

@@ -0,0 +1,134 @@
+---
+paths:
+  - "**/*.rs"
+  - "**/Cargo.toml"
+---
+
+# Project Architecture (Axum + Diesel + Valkey)
+
+This rule defines the base architecture for a REST API backend configuration.
+When using a Leptos full-stack configuration, the rules in `leptos.md` take precedence.
+
+## Directory Structure
+
+```
+src/
+├── main.rs              # Entry point, server startup
+├── config.rs            # Environment variable and configuration loading
+├── app_state.rs         # AppState definition
+├── error.rs             # AppError definition (IntoResponse implementation)
+├── db/
+│   ├── mod.rs           # DB pool initialization
+│   └── repository/      # Repository layer (abstracts DB access)
+│       ├── mod.rs
+│       └── users.rs
+├── cache/
+│   ├── mod.rs           # Valkey connection initialization
+│   └── keys.rs          # Key generation helpers
+├── models/
+│   ├── mod.rs
+│   └── user.rs          # Diesel models (Queryable, Insertable, etc.)
+├── handlers/
+│   ├── mod.rs
+│   └── users.rs         # Axum handlers
+├── routes/
+│   ├── mod.rs           # Router configuration
+│   └── users.rs
+├── middleware/
+│   ├── mod.rs
+│   └── auth.rs          # Authentication middleware
+├── schema.rs            # Diesel auto-generated
+└── dto/
+    ├── mod.rs
+    └── user.rs           # Request/response types (Serialize, Deserialize)
+migrations/
+    └── ...
+```
+
+## Layer Structure
+
+```
+Handler (Axum) → Repository (Diesel/Valkey) → Database/Cache
+```
+
+- **Handler**: Receives HTTP requests, performs validation, builds responses
+- **Repository**: Data access logic. Encapsulates DB queries and cache operations
+- **Model**: Diesel table mappings
+- **DTO**: API request/response types (kept separate from Model)
+
+## AppState
+
+```rust
+use diesel_async::pooled_connection::deadpool::Pool;
+use diesel_async::AsyncPgConnection;
+use redis::aio::ConnectionManager;
+
+pub type DbPool = Pool<AsyncPgConnection>;
+
+#[derive(Clone)]
+pub struct AppState {
+    pub db_pool: DbPool,
+    pub valkey: ConnectionManager,
+    pub config: Arc<AppConfig>,
+}
+```
+
+## Unified Error Type
+
+```rust
+use axum::http::StatusCode;
+use axum::response::{IntoResponse, Response};
+
+pub enum AppError {
+    NotFound,
+    BadRequest(String),
+    Unauthorized,
+    Conflict(String),
+    Internal(anyhow::Error),
+}
+
+impl From<diesel::result::Error> for AppError { /* ... */ }
+impl From<redis::RedisError> for AppError { /* ... */ }
+impl From<deadpool::managed::PoolError<deadpool_diesel::postgres::Manager>> for AppError { /* ... */ }
+impl IntoResponse for AppError { /* ... */ }
+```
+
+## Dependency Guidelines
+
+```toml
+[dependencies]
+axum = "0.8"
+diesel = { version = "2.2", features = ["postgres"] }
+diesel-async = { version = "0.5", features = ["postgres", "deadpool"] }
+redis = { version = "0.27", features = ["tokio-comp", "connection-manager"] }
+tokio = { version = "1", features = ["full"] }
+tower = "0.5"
+tower-http = { version = "0.6", features = ["trace", "cors", "timeout"] }
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+tracing = "0.1"
+tracing-subscriber = { version = "0.3", features = ["env-filter"] }
+anyhow = "1"
+dotenvy = "0.15"
+```
+
+## Configuration Management
+
+- Load from environment variables (`dotenvy` + `std::env`)
+- Consolidate `DATABASE_URL`, `VALKEY_URL`, `HOST`, `PORT`, etc. into `AppConfig`
+- Do not hardcode secrets (DB passwords, etc.) in code
+- Switch configuration per environment using environment variables
+
+## Logging and Tracing
+
+- Use `tracing` + `tracing-subscriber`
+- Output request logs with `tower_http::trace::TraceLayer`
+- Control the log level with the `RUST_LOG` environment variable
+- Use structured logging (`tracing::info!(user_id = %id, "User created")`)
+
+## Testing Strategy
+
+- Unit tests: Test the repository layer directly (test DB + transaction rollback)
+- Integration tests: Test the full Axum app with `tower::ServiceExt`
+- Provide a helper function to construct `AppState` for tests
+- Use `test_transaction` to roll back the test DB

package/.claude-plugin/rules/quality-checks.md

@@ -0,0 +1,265 @@
+---
+paths:
+  - "**/*.rs"
+  - "**/Cargo.toml"
+  - "**/package.json"
+---
+
+# Quality Check Commands
+
+Unified command specification for quality checks run by parallel-worker, review-worker, and other agents. All agents must use the commands defined in this rule.
+
+## rustfmt
+
+```bash
+cargo fmt --all -- --check
+```
+
+- Targets both `src` and `tests` (do not check only one of them)
+- To auto-fix, run without `--check`: `cargo fmt --all`
+
+## clippy
+
+```bash
+cargo clippy --quiet --all-targets -- -D warnings
+```
+
+- `--all-targets`: Includes test code, benchmarks, and examples in the check
+- `-D warnings`: Treats all warnings as errors
+- `--quiet`: Suppresses progress output
+
+## test
+
+```bash
+cargo test --quiet
+```
+
+- Runs all tests (unit + integration)
+- To run a specific test only: `cargo test --test {test_name} -- --nocapture`
+
+## Leptos Full-Stack (WASM Frontend) Build Verification
+
+When the project uses `cargo-leptos` (detected by `[package.metadata.leptos]` in `Cargo.toml`), the following additional checks are **required** after the standard checks above.
+
+### cargo-leptos build (preferred)
+
+```bash
+cargo leptos build
+```
+
+- Builds both SSR (server) and WASM (client) targets in a single command
+- Catches WASM compilation errors that `cargo build` / `cargo test` alone cannot detect (they only compile for the host target)
+- Must pass before any commit
+
+### WASM-specific clippy (required fallback when cargo-leptos is unavailable)
+
+```bash
+cargo clippy --target wasm32-unknown-unknown --no-default-features --features hydrate --quiet -- -D warnings
+```
+
+- **Required** when `cargo-leptos` is not installed — WASM verification must not be skipped
+- `--features hydrate`: Compiles only the client-side code path
+- Detects WASM-incompatible API usage (e.g., `std::fs`, `std::net`, `tokio::spawn`)
+
+### Detection and availability check for agents
+
+Before running quality checks, agents must check for a Leptos full-stack configuration and tool availability:
+
+```bash
+# Step 1: Detect Leptos project（ブラケット付きヘッダでマッチ）
+grep -q '\[package.metadata.leptos\]' Cargo.toml 2>/dev/null
+
+# Step 2: If Leptos detected, check cargo-leptos availability
+cargo leptos --version 2>/dev/null
+```
+
+| Leptos detected | cargo-leptos available | Action |
+|-----------------|----------------------|--------|
+| No | — | Skip WASM checks |
+| Yes | Yes | Run `cargo leptos build` |
+| Yes | No | Run WASM-specific clippy as required fallback |
+
+The full check order becomes:
+
+1. `cargo fmt --all -- --check`
+2. `cargo clippy --quiet --all-targets -- -D warnings`
+3. `cargo test --quiet`
+4. `cargo leptos build` OR WASM-specific clippy fallback (Leptos projects only)
+
+## Node.js Task-Level Quality Checks
+
+When the project is Node.js-based (detected by `package.json` existence without Rust indicators), use the following task-level quality checks.
+
+### lint
+
+```bash
+npx eslint . --max-warnings=0
+```
+
+- Falls back to `npx tsc --noEmit` if eslint is not configured
+- If neither eslint nor TypeScript is configured, skip this check
+
+### format
+
+```bash
+npx prettier --check .
+```
+
+- Skip if prettier is not configured in the project
+
+### test
+
+```bash
+npm test
+```
+
+- Or `npx vitest run` / `npx jest` depending on the project's test runner
+- To run a specific test: `npm test -- --testPathPattern={test_name}`
+
+The full check order for Node.js projects:
+
+1. `npx eslint . --max-warnings=0` (or `npx tsc --noEmit` fallback)
+2. `npx prettier --check .`
+3. `npm test`
+
+## Integration Verification (Phase Review / Final E2E Gate)
+
+Phase Review (3.5.1.5) および全Phase完了後の Final E2E Gate (セクション9) で実行する統合レベルの検証。
+タスク単位の品質チェック（rustfmt, clippy, cargo test）とは独立したステップとして実行する。
+
+### プロジェクトタイプ検出
+
+以下の順で検出し、最初にマッチしたタイプを採用する:
+
+```bash
+# 1. Leptos フルスタック検出（ブラケット付きヘッダで誤検出を防止）
+if grep -q '\[package.metadata.leptos\]' Cargo.toml 2>/dev/null; then
+  echo "leptos"
+# 2. Rust API 検出（axum, actix-web, rocket 等）
+elif grep -qE '(axum|actix-web|rocket)' Cargo.toml 2>/dev/null; then
+  echo "rust-api"
+# 3. Node.js 検出
+elif test -f package.json; then
+  echo "nodejs"
+# 4. いずれにも該当しない
+else
+  echo "generic"
+fi
+```
+
+### Step B: ビルド検証（全プロジェクト共通・必須）
+
+成果物のビルドが成功することを確認する。ビルド失敗は即座に FAIL とする。
+
+| タイプ | コマンド | 備考 |
+|--------|---------|------|
+| Leptos | `cargo leptos build` | SSR + WASM 両方をビルド |
+| Rust API | `cargo build` | リリースビルドは不要（デバッグビルドで十分） |
+| Node.js | `npm run build` | `build` スクリプトが package.json に存在する場合のみ。存在しない場合は SKIP（FAIL ではない）とし、ログに「build スクリプトなし」と記録 |
+| Generic | `cargo build` or `npm run build` | 検出可能なビルドコマンドを実行。該当コマンドがない場合は SKIP とする |
+
+### Step C: 統合テスト実行（テストが存在する場合のみ）
+
+統合テストファイルが存在する場合にのみ実行する。存在しない場合は SKIP（FAIL ではない）。
+
+```bash
+# Rust: 統合テストの存在確認（tests/ ディレクトリ内の .rs ファイル。e2e/ と unit/ は再帰的に除外）
+# 検出対象: tests/integration*/ 配下の .rs ファイル、または tests/ 直下の .rs ファイル
+find tests -type f -name '*.rs' ! -regex '.*/tests/\(e2e\|unit\)/.*' -print -quit 2>/dev/null
+
+# Node.js: 統合テストスクリプトまたはファイルの存在確認
+grep -q '"test:integration"' package.json 2>/dev/null || \
+  find tests test __tests__ -type f -name 'integration*' -print -quit 2>/dev/null
+```
+
+| タイプ | コマンド |
+|--------|---------|
+| Rust | `cargo test --tests --quiet` |
+| Node.js（スクリプトあり） | `npm run test:integration` |
+| Node.js（ファイルのみ） | `npm test -- --testPathPattern=integration` |
+
+### Step D: スモークテスト（API プロジェクトのみ）
+
+API サーバを一時的に起動し、ヘルスチェックエンドポイントへの疎通を確認する。
+
+**コンテナベース（docker-compose.yml が存在する場合 — 優先）:**
+
+```bash
+# docker-compose でサービスを起動
+docker-compose up -d
+sleep 10
+```
+
+ヘルスチェック実行後:
+```bash
+docker-compose down
+```
+
+**直接起動（docker-compose.yml が存在しない場合 — フォールバック）:**
+
+```bash
+# プロジェクトタイプに応じてサーバ起動コマンドを切り替え
+if [ -f Cargo.toml ]; then
+  START_CMD="cargo run"
+elif [ -f package.json ]; then
+  # package.json に dev スクリプトがあれば優先的に使用し、なければ start スクリプトを確認
+  if command -v node >/dev/null 2>&1 && \
+     node -e "const p=require('./package.json'); process.exit(p.scripts && p.scripts.dev ? 0 : 1)" >/dev/null 2>&1; then
+    START_CMD="npm run dev"
+  elif command -v node >/dev/null 2>&1 && \
+       node -e "const p=require('./package.json'); process.exit(p.scripts && p.scripts.start ? 0 : 1)" >/dev/null 2>&1; then
+    START_CMD="npm start"
+  else
+    echo "Step D: Node.js プロジェクトで start / dev スクリプトが存在しないため、スモークテストをスキップします。" >&2
+    exit 0
+  fi
+else
+  echo "Step D: 対応するプロジェクトタイプ（Rust/Node.js）が見つからないため、スモークテストをスキップします。" >&2
+  exit 0
+fi
+
+# バックグラウンドでサーバ起動（新しいセッションで確実に停止可能にする）
+setsid sh -c "$START_CMD" &
+SERVER_PID=$!
+trap "kill -- -$SERVER_PID 2>/dev/null; wait $SERVER_PID 2>/dev/null" EXIT
+sleep 5
+
+# ヘルスチェック（/health と /api/health を順に試行）
+HEALTH_STATUS="000"
+for ENDPOINT in "/health" "/api/health" "/healthz"; do
+  STATUS=$(curl -s -o /dev/null -w "%{http_code}" "http://localhost:${PORT:-3000}${ENDPOINT}" 2>/dev/null)
+  if [ "$STATUS" = "200" ]; then
+    HEALTH_STATUS="200"
+    break
+  fi
+done
+
+# クリーンアップ
+kill -- -$SERVER_PID 2>/dev/null
+wait $SERVER_PID 2>/dev/null
+
+# PASS/FAIL 判定
+if [ "$HEALTH_STATUS" != "200" ]; then
+  echo "Step D: ヘルスチェック失敗 — いずれのエンドポイントからも 200 が返りませんでした。" >&2
+  exit 1
+fi
+```
+
+**スモークテストの SKIP 条件**（FAIL ではなく SKIP として扱う）:
+- ヘルスチェックエンドポイントが定義されていない（設計書に記載なし）
+- 外部依存（DB、キャッシュ等）が必要でローカル起動できない
+- サーバ起動コマンドが不明（Cargo.toml に `[[bin]]` セクションがない等）
+- Node.js プロジェクトで `start` / `dev` スクリプトが存在しない
+- 対応するプロジェクトタイプ（Rust/Node.js）が検出されない
+
+SKIP 時は必ずログに理由を記録し、Expert Team Review で補完する。
+
+### 統合検証の結果判定
+
+| 結果 | 条件 | アクション |
+|------|------|----------|
+| **PASS** | ビルド成功 + 統合テスト全パス（or SKIP）+ スモーク OK（or SKIP） | 次ステップに進む |
+| **FAIL (ビルド)** | ビルド失敗 | ビルドエラーを分析し、根本原因タスクを特定して差し戻し |
+| **FAIL (統合テスト)** | 統合テスト失敗 | 失敗テストのエラーを分析。Phase内タスク → 差し戻し、前Phase → ユーザーエスカレート |
+| **FAIL (スモーク)** | ヘルスチェック失敗（SKIP条件に該当しない場合） | 起動ログを分析し根本原因を特定して差し戻し |
+| **SKIP** | 環境依存で実行不可 | ログに SKIP 理由を記録し、次ステップに進む。Expert Team Review で補完 |

package/.claude-plugin/rules/rust-style.md

@@ -0,0 +1,242 @@
+---
+paths:
+  - "**/*.rs"
+---
+
+# Rust Coding Style Rules
+
+Follow the official Rust Style Guide (https://doc.rust-lang.org/style-guide/).
+Use `rustfmt` defaults as the baseline and adhere to the rules below.
+
+## Formatting Basics
+
+- Indentation: 4 spaces (no tabs)
+- Max line width: 100 characters
+- Comment lines: 80 characters (excluding indentation) or max width, whichever is smaller
+- Use block indent, not visual indent
+- No trailing whitespace
+- Newline at end of file
+
+## Trailing Commas
+
+Use trailing commas in multi-line comma-separated lists. Omit them on single lines.
+
+```rust
+// Multi-line: trailing comma
+function_call(
+    argument,
+    another_argument,
+);
+
+// Single line: no trailing comma
+function_call(argument, another_argument)
+```
+
+## Naming Conventions
+
+| Item | Style | Example |
+|---|---|---|
+| Types, Traits, Enums | `UpperCamelCase` | `MyStruct`, `MyTrait` |
+| Enum variants | `UpperCamelCase` | `Some`, `None` |
+| Functions, Methods | `snake_case` | `do_something` |
+| Local variables | `snake_case` | `my_var` |
+| Struct fields | `snake_case` | `field_name` |
+| Constants, immutable statics | `SCREAMING_SNAKE_CASE` | `MAX_SIZE` |
+| Macros | `snake_case` | `my_macro!` |
+| Modules | `snake_case` | `my_module` |
+
+When a reserved word is needed as a name, use raw identifiers (`r#type`) or a trailing underscore (`type_`). Avoid misspelling (`typ`).
+
+## Item Order in Files
+
+1. `extern crate` statements
+2. `use` statements (`self`/`super` first, glob imports last)
+3. Module declarations (`mod foo;`)
+4. Other items
+
+## Function Definitions
+
+```rust
+// Fits on one line
+fn foo(arg1: i32, arg2: i32) -> i32 {
+    ...
+}
+
+// Does not fit: each argument on its own line
+fn foo(
+    arg1: i32,
+    arg2: i32,
+) -> i32 {
+    ...
+}
+```
+
+- No comments inside signatures
+- When the argument list is multi-line, place each argument on its own line with a trailing comma
+
+## Structs and Enums
+
+```rust
+struct Foo {
+    a: A,
+    b: B,
+}
+
+enum FooBar {
+    First(u32),
+    Second,
+    Error {
+        err: Box<Error>,
+        line: u32,
+    },
+}
+```
+
+- Prefer unit structs: `struct Foo;` over `struct Foo {}` or `struct Foo()`
+- When a field type is long, break after `:` with block indent
+
+## Traits and Impls
+
+```rust
+trait Foo: Debug + Bar {}
+
+impl Bar for Foo {
+    ...
+}
+```
+
+- When trait bounds are long, break before `+` with block indent
+
+## Where Clauses
+
+```rust
+fn function<T, U>(args)
+where
+    T: Bound,
+    U: AnotherBound,
+{
+    body
+}
+```
+
+- Place `where` right after the closing parenthesis (same line)
+- Each constraint on its own line with block indent
+- Use trailing commas
+
+## Use Statements
+
+```rust
+use std::collections::HashMap;
+use std::io::{self, Read, Write};
+```
+
+- Sort alphabetically (version sort) within groups
+- Place `self` and `super` before other names
+- Normalize unnecessary nesting: `use a::{b};` → `use a::b;`
+
+## Expressions
+
+### Block Expressions
+- Empty blocks: `{}`
+- Single-expression blocks may be one line in expression context: `let foo = { expr };`
+
+### Closures
+- Omit `{}` when possible
+- `|arg1, arg2| expr`
+
+### Method Chains
+- When multi-line, break before `.` with block indent
+
+```rust
+let foo = bar
+    .baz?
+    .qux();
+```
+
+### Match Expressions
+- Do not place `|` at the beginning of patterns
+- Block indent each arm
+- Single-expression arms on the same line; multiple statements use a block
+
+```rust
+match foo {
+    Foo::Bar => value,
+    Foo::Baz(x) => {
+        let y = process(x);
+        y.result()
+    }
+}
+```
+
+### If/Else
+- Prefer expression form when possible
+
+```rust
+// Preferred
+let x = if y { 1 } else { 0 };
+
+// Avoid
+let x;
+if y { x = 1; } else { x = 0; }
+```
+
+## Types
+
+- Break type expressions at the outermost scope
+- Break trait bounds before `+`
+
+```rust
+// Preferred
+Foo<
+    Bar,
+    Baz<Type1, Type2>,
+>
+
+// Avoid
+Foo<Bar, Baz<
+    Type1,
+    Type2,
+>>
+```
+
+## Let Statements
+
+```rust
+let pattern: Type = expr;
+
+// Long expression: break after =
+let pattern: Type =
+    expr;
+
+// Long type too: break after :
+let pattern:
+    Type =
+    expr;
+```
+
+## Comments
+
+- Prefer line comments (`//`) over block comments (`/* */`)
+- Use `///` for doc comments (outer) and `//!` for module/crate-level docs only
+- Single space after `//`
+
+## Attributes
+
+- Place each attribute on its own line
+- Merge multiple `#[derive(...)]` into one
+
+```rust
+#[derive(Debug, Clone, PartialEq)]
+#[repr(C)]
+struct Foo { ... }
+```
+
+## Extern
+
+- Always specify the ABI explicitly: `extern "C" fn` (avoid bare `extern fn`)
+
+## General Advice
+
+- Avoid `#[path]` attribute on modules
+- Leverage expression-oriented programming (return values from `if`, `match`, etc.)
+- Use `rustfmt` and `clippy` actively

package/.claude-plugin/rules/security.md

@@ -0,0 +1,67 @@
+---
+always_apply: true
+---
+
+# Security Coding Standards
+
+Security standards to apply during code reviews and implementation. Based on OWASP Top 10, including authentication and authorization.
+
+## A1: Injection
+
+- SQL: Build queries through an ORM query builder (e.g., Diesel). Do not embed external input into raw SQL via string concatenation
+- Command injection: Do not pass user input directly to `Command::new()` or `exec`-style calls. Pass arguments individually using `.arg()`
+- Path traversal: When including user input in file paths, validate against directory traversal (`../`)
+
+## A2: Broken Authentication
+
+- Apply authentication middleware to endpoints that require authentication (e.g., `route_layer`)
+- Do not store passwords in plain text. Use hash functions such as bcrypt / argon2
+- Generate session tokens / JWT using cryptographically secure random values
+- Set token expiration and reject expired tokens
+
+## A3: Broken Access Control
+
+- Implement owner checks for resource access (users may only view/update their own data)
+- IDOR (Insecure Direct Object Reference): Do not grant access based solely on the ID in path parameters. Validate the association with the authenticated user
+- When role-based authorization is needed, centralize it in middleware or guard functions
+- Verify that admin-only endpoints are inaccessible to regular users
+
+## A4: Sensitive Data Exposure
+
+- Do not include password hashes, internal IDs, stack traces, or DB error details in responses
+- Explicitly define response types using DTOs; do not return Model objects directly
+- Do not output sensitive information (passwords, tokens, personal data) to logs
+- In production, use generic error messages that do not allow clients to infer internal implementation details
+
+## A5: Input Validation
+
+- Validate all input from request bodies, path parameters, and query parameters
+- Set upper limits on string length (to prevent DoS)
+- Return 400 Bad Request for type conversion errors (e.g., string → number)
+- Use dedicated libraries for format validation of email addresses, URLs, dates, etc.
+
+## A6: Security Headers and CORS
+
+- Configure allowed origins explicitly for CORS (`CorsLayer::permissive()` is for development only)
+- Validate Content-Type and reject requests with unexpected formats
+
+## A7: Mass Assignment
+
+- When converting DTO → Model, ensure that fields the client should not be able to update (`id`, `created_at`, `role`, etc.) are not modified
+- When using `AsChangeset`, explicitly specify the fields to be updated
+
+## A8: Rate Limiting
+
+- Design rate limiting for public endpoints (login, registration, password reset)
+- Consider lockout after repeated failures as a brute-force protection measure
+
+## A9: Dependency Vulnerabilities
+
+- Regularly check for known vulnerabilities using `cargo audit`
+- Remove unused dependencies
+
+## A10: Logging and Monitoring
+
+- Log authentication failures, authorization failures, and validation errors
+- Include sufficient context in logs (request ID, user ID)
+- However, mask sensitive information (see A4)