@atlashub/smartstack-cli 3.39.0 → 3.40.0

package/templates/skills/apex/steps/step-05-deep-review.md

@@ -1,129 +1,129 @@
----
-name: step-05-deep-review
-description: Adversarial code review of changes — find issues before they reach production
-model: opus
-prev_step: steps/step-04-examine.md
-next_step: steps/step-06-resolve.md
----
-
-# Step 5: Deep Review (if -x)
-
-**Goal:** Review the code as an adversarial external reviewer. Find bugs, security issues, and convention violations that the automated eXamine checks (step-04) missed.
-
----
-
-## 1. Gather Changed Files
-
-```bash
-git diff --name-only HEAD~{commit_count}
-```
-
-List all files modified during this APEX session.
-
----
-
-## 2. MCP Code Review
-
-```
-Call: mcp__smartstack__review_code
-  scope: "changed"      # Only review files changed in this session
-
-Call: mcp__smartstack__analyze_code_quality
-  scope: "changed"
-```
-
----
-
-## 3. Manual Adversarial Review
-
-For each changed file, check:
-
-**Security (OWASP):**
-- [ ] `[RequirePermission]` on every endpoint (not `[Authorize]`)
-- [ ] No SQL injection (parameterized queries, EF Core only)
-- [ ] No XSS (React auto-escapes, but check dangerouslySetInnerHTML)
-- [ ] Multi-tenant isolation (IHasData filter applied)
-- [ ] No secrets in code
-
-**Architecture:**
-- [ ] Entities in correct Domain folder
-- [ ] Configs in correct Infrastructure folder
-- [ ] Services follow CQRS pattern
-- [ ] DTOs separate from domain entities
-- [ ] Controllers return DTOs, not entities
-- [ ] Frontend in correct hierarchy (App/Module)
-
-**SmartStack conventions:**
-- [ ] Deterministic GUIDs in seed data (not Guid.NewGuid())
-- [ ] 4 languages in translations
-- [ ] CSS variables (not hardcoded colors)
-- [ ] SmartTable/SmartForm (not raw HTML tables/forms)
-- [ ] Correct Layout wrapper per application
-
-**FK Fields & Forms:**
-- [ ] FK Guid fields use `EntityLookup` component (NEVER `<input>`, NEVER `<select>`)
-- [ ] No `<select>` with `<option>` elements for FK fields (even API-loaded options)
-- [ ] No placeholder text asking user to "Enter ID", "Enter GUID", or "Select {Entity}..."
-- [ ] No inline forms in drawers/slide-overs — Create/Edit forms are full pages with own routes (ZERO modals/dialogs/drawers)
-- [ ] Backend GetAll endpoints support `?search=` param for EntityLookup
-- [ ] Each EntityLookup has `apiEndpoint`, `mapOption`, `label` props
-
----
-
-## 4. Produce Findings
-
-For each issue found, classify:
-
-```
-[BLOCKING] — Must fix before completion
-[SUGGESTION] — Should fix, quality improvement
-[NIT] — Minor style/preference issue
-```
-
-**Findings format:**
-
-```markdown
-### Finding F01 [BLOCKING]
-**File:** {path}:{line}
-**Issue:** {description}
-**Fix:** {recommended fix}
-
-### Finding F02 [SUGGESTION]
-**File:** {path}:{line}
-**Issue:** {description}
-**Fix:** {recommended fix}
-```
-
----
-
-## 5. Summary
-
-```
-**APEX SmartStack - Deep Review Complete**
-
-**Files reviewed:** {count}
-**Findings:** {blocking} BLOCKING, {suggestions} SUGGESTION, {nits} NIT
-
-{findings table}
-```
-
----
-
-## 6. Save Output (if save_mode)
-
-Write to `{output_dir}/05-deep-review.md` with all findings.
-
----
-
-## 7. Route to Next Step
-
-```
-IF BLOCKING findings exist:
-  → Load steps/step-06-resolve.md (fix BLOCKING findings first)
-  → Then step-07-tests.md (tests are MANDATORY)
-
-ELSE:
-  → Load steps/step-07-tests.md — IMMEDIATELY
-```
-
-> **REMINDER:** Tests are MANDATORY. Do NOT stop after Deep Review — proceed to step-07.
+---
+name: step-05-deep-review
+description: Adversarial code review of changes — find issues before they reach production
+model: opus
+prev_step: steps/step-04-examine.md
+next_step: steps/step-06-resolve.md
+---
+
+# Step 5: Deep Review (if -x)
+
+**Goal:** Review the code as an adversarial external reviewer. Find bugs, security issues, and convention violations that the automated eXamine checks (step-04) missed.
+
+---
+
+## 1. Gather Changed Files
+
+```bash
+git diff --name-only HEAD~{commit_count}
+```
+
+List all files modified during this APEX session.
+
+---
+
+## 2. MCP Code Review
+
+```
+Call: mcp__smartstack__review_code
+  scope: "changed"      # Only review files changed in this session
+
+Call: mcp__smartstack__analyze_code_quality
+  scope: "changed"
+```
+
+---
+
+## 3. Manual Adversarial Review
+
+For each changed file, check:
+
+**Security (OWASP):**
+- [ ] `[RequirePermission]` on every endpoint (not `[Authorize]`)
+- [ ] No SQL injection (parameterized queries, EF Core only)
+- [ ] No XSS (React auto-escapes, but check dangerouslySetInnerHTML)
+- [ ] Multi-tenant isolation (IHasData filter applied)
+- [ ] No secrets in code
+
+**Architecture:**
+- [ ] Entities in correct Domain folder
+- [ ] Configs in correct Infrastructure folder
+- [ ] Services follow CQRS pattern
+- [ ] DTOs separate from domain entities
+- [ ] Controllers return DTOs, not entities
+- [ ] Frontend in correct hierarchy (App/Module)
+
+**SmartStack conventions:**
+- [ ] Deterministic GUIDs in seed data (not Guid.NewGuid())
+- [ ] 4 languages in translations
+- [ ] CSS variables (not hardcoded colors)
+- [ ] SmartTable/SmartForm (not raw HTML tables/forms)
+- [ ] Correct Layout wrapper per application
+
+**FK Fields & Forms:**
+- [ ] FK Guid fields use `EntityLookup` component (NEVER `<input>`, NEVER `<select>`)
+- [ ] No `<select>` with `<option>` elements for FK fields (even API-loaded options)
+- [ ] No placeholder text asking user to "Enter ID", "Enter GUID", or "Select {Entity}..."
+- [ ] No inline forms in drawers/slide-overs — Create/Edit forms are full pages with own routes (ZERO modals/dialogs/drawers)
+- [ ] Backend GetAll endpoints support `?search=` param for EntityLookup
+- [ ] Each EntityLookup has `apiEndpoint`, `mapOption`, `label` props
+
+---
+
+## 4. Produce Findings
+
+For each issue found, classify:
+
+```
+[BLOCKING] — Must fix before completion
+[SUGGESTION] — Should fix, quality improvement
+[NIT] — Minor style/preference issue
+```
+
+**Findings format:**
+
+```markdown
+### Finding F01 [BLOCKING]
+**File:** {path}:{line}
+**Issue:** {description}
+**Fix:** {recommended fix}
+
+### Finding F02 [SUGGESTION]
+**File:** {path}:{line}
+**Issue:** {description}
+**Fix:** {recommended fix}
+```
+
+---
+
+## 5. Summary
+
+```
+**APEX SmartStack - Deep Review Complete**
+
+**Files reviewed:** {count}
+**Findings:** {blocking} BLOCKING, {suggestions} SUGGESTION, {nits} NIT
+
+{findings table}
+```
+
+---
+
+## 6. Save Output (if save_mode)
+
+Write to `{output_dir}/05-deep-review.md` with all findings.
+
+---
+
+## 7. Route to Next Step
+
+```
+IF BLOCKING findings exist:
+  → Load steps/step-06-resolve.md (fix BLOCKING findings first)
+  → Then step-07-tests.md (tests are MANDATORY)
+
+ELSE:
+  → Load steps/step-07-tests.md — IMMEDIATELY
+```
+
+> **REMINDER:** Tests are MANDATORY. Do NOT stop after Deep Review — proceed to step-07.

package/templates/skills/apex/steps/step-06-resolve.md

@@ -1,101 +1,101 @@
----
-name: step-06-resolve
-description: Fix BLOCKING findings from adversarial review
-model: opus
-prev_step: steps/step-05-deep-review.md
-next_step: steps/step-07-tests.md
----
-
-# Step 6: Resolve (if BLOCKING findings)
-
-**Goal:** Fix all BLOCKING findings from Deep Review (step-05). Re-validate after fixes.
-
----
-
-## 1. Process BLOCKING Findings
-
-For each BLOCKING finding from step-05:
-
-```
-Finding: {F01, F02, ...}
-File: {path}
-Issue: {description}
-Fix approach: {use appropriate skill/MCP tool}
-```
-
-**Fixing rules:**
-- Use the SAME skill/MCP that created the original code
-- If the finding is in a controller → use /controller or MCP scaffold_extension
-- If the finding is in seed data → use MCP generate_permissions
-- If the finding is in frontend → use /ui-components or MCP scaffold_routes
-- NEVER fix by writing raw SmartStack code
-
----
-
-## 2. Apply Fixes
-
-For each finding:
-
-```
-1. Read the file to understand current state
-2. Apply fix via appropriate skill/MCP
-3. Verify fix addresses the finding
-4. Mark finding as RESOLVED
-```
-
----
-
-## 3. Re-Validate
-
-After all BLOCKING findings are fixed:
-
-```
-1. MCP validate_conventions → 0 errors
-2. dotnet build --no-restore → PASS
-3. npm run typecheck → PASS (if frontend)
-```
-
----
-
-## 4. Commit Fixes
-
-```
-fix({module}): resolve review findings {F01, F02, ...}
-```
-
----
-
-## 5. Resolution Summary
-
-```
-**APEX SmartStack - Resolve Complete**
-
-**BLOCKING findings:** {count}
-**Resolved:** {count}
-**Remaining:** {count} (should be 0)
-
-| Finding | Status | Fix Applied |
-|---------|--------|-------------|
-| F01 | RESOLVED | {description} |
-| F02 | RESOLVED | {description} |
-```
-
----
-
-## 6. Save Output (if save_mode)
-
-Write to `{output_dir}/06-resolve.md` with resolution log.
-
----
-
-## 7. Route to Next Step
-
-```
-IF remaining BLOCKING > 0:
-  → Loop: fix remaining, re-validate (max 3 iterations)
-  → If stuck, ask user before continuing
-
-→ Load steps/step-07-tests.md — MANDATORY, do NOT skip
-```
-
-> **REMINDER:** Tests are MANDATORY. After resolving all findings, proceed to step-07 immediately.
+---
+name: step-06-resolve
+description: Fix BLOCKING findings from adversarial review
+model: opus
+prev_step: steps/step-05-deep-review.md
+next_step: steps/step-07-tests.md
+---
+
+# Step 6: Resolve (if BLOCKING findings)
+
+**Goal:** Fix all BLOCKING findings from Deep Review (step-05). Re-validate after fixes.
+
+---
+
+## 1. Process BLOCKING Findings
+
+For each BLOCKING finding from step-05:
+
+```
+Finding: {F01, F02, ...}
+File: {path}
+Issue: {description}
+Fix approach: {use appropriate skill/MCP tool}
+```
+
+**Fixing rules:**
+- Use the SAME skill/MCP that created the original code
+- If the finding is in a controller → use /controller or MCP scaffold_extension
+- If the finding is in seed data → use MCP generate_permissions
+- If the finding is in frontend → use /ui-components or MCP scaffold_routes
+- NEVER fix by writing raw SmartStack code
+
+---
+
+## 2. Apply Fixes
+
+For each finding:
+
+```
+1. Read the file to understand current state
+2. Apply fix via appropriate skill/MCP
+3. Verify fix addresses the finding
+4. Mark finding as RESOLVED
+```
+
+---
+
+## 3. Re-Validate
+
+After all BLOCKING findings are fixed:
+
+```
+1. MCP validate_conventions → 0 errors
+2. dotnet build --no-restore → PASS
+3. npm run typecheck → PASS (if frontend)
+```
+
+---
+
+## 4. Commit Fixes
+
+```
+fix({module}): resolve review findings {F01, F02, ...}
+```
+
+---
+
+## 5. Resolution Summary
+
+```
+**APEX SmartStack - Resolve Complete**
+
+**BLOCKING findings:** {count}
+**Resolved:** {count}
+**Remaining:** {count} (should be 0)
+
+| Finding | Status | Fix Applied |
+|---------|--------|-------------|
+| F01 | RESOLVED | {description} |
+| F02 | RESOLVED | {description} |
+```
+
+---
+
+## 6. Save Output (if save_mode)
+
+Write to `{output_dir}/06-resolve.md` with resolution log.
+
+---
+
+## 7. Route to Next Step
+
+```
+IF remaining BLOCKING > 0:
+  → Loop: fix remaining, re-validate (max 3 iterations)
+  → If stuck, ask user before continuing
+
+→ Load steps/step-07-tests.md — MANDATORY, do NOT skip
+```
+
+> **REMINDER:** Tests are MANDATORY. After resolving all findings, proceed to step-07 immediately.