@boyingliu01/xp-gate 0.12.13 → 0.13.0

package/hooks/gate-8.sh

@@ -0,0 +1,56 @@
+# ============================================================================
+# GATE 8: Secret Scanning (gitleaks)
+# Detects secrets (API keys, passwords, tokens) in staged files
+# Tool: gitleaks -- https://github.com/gitleaks/gitleaks
+# ============================================================================
+
+ 2>&1 echo ""
+ 2>&1 echo "→ Gate 8: Secret scanning (gitleaks)..."
+GATE_8_START=$(gate_start_ms)
+
+# Gitleaks availability check
+GITLEAKS_CMD=""
+if command -v gitleaks >/dev/null 2>&1; then
+  GITLEAKS_CMD="gitleaks"
+elif [ -f "$HOME/.local/bin/gitleaks" ]; then
+  GIBLEAKS_CMD="$HOME/.local/bin/gitleaks"
+fi
+
+if [ -n "$GITLEAKS_CMD" ]; then
+  GITLEAKS_CONFIG=""
+  if [ -f ".gitleaks.toml" ]; then
+    GITLEAKS_CONFIG="--config=.gitleaks.toml"
+  fi
+
+  # Run gitleaks on staged changes only (pre-commit mode for speed)
+  GITLEAKS_OUTPUT=$($GITLEAKS_CMD git --pre-commit --redact --no-banner $GITLEAKS_CONFIG --report-format=json --report-path=/tmp/gitleaks-report.json 2>&1)
+  GITLEAKS_EXIT=$?
+
+  if [ "$GITLEAKS_EXIT" -eq 0 ]; then
+    echo "     ✅ PASSED - No secrets detected."
+    GATE_8_STATUS="PASS"
+  elif [ "$GITLEAKS_EXIT" -eq 1 ]; then
+    # Secrets found — output details
+    echo "$GITLEAKS_OUTPUT"
+    echo ""
+    echo "❌ BLOCKED - Secrets detected in staged files."
+    echo ""
+    echo "Remediation options:"
+    echo "  1. Remove the secret and use environment variables instead"
+    echo "  2. Add a false positive to .gitleaks.toml allowlist"
+    echo "  3. Use git secret or vault for sensitive data"
+    echo ""
+    echo "See: https://github.com/gitleaks/gitleaks"
+    exit 1
+  else
+    echo "     ⚠️  gitleaks exited with code $GITLEAKS_EXIT - skipping gate"
+    echo "     ✅ Secret Scanning (SKIP, gitleaks error)"
+    GATE_8_STATUS="SKIP"
+  fi
+else
+  echo "     ℹ️  gitleaks not installed — secret scanning unavailable"
+  echo "     Install: brew install gitleaks (macOS) | winget install gitleaks (Windows) | scripts/install-gitleaks.sh (Linux)"
+  echo "     ⏭️  SKIPPED - Secret scanning (gitleaks not installed)"
+  GATE_8_STATUS="SKIP"
+fi
+record_gate_audit "gate-8" "secret-scanning" "$GATE_8_STATUS" "0" "$GATE_8_START"

package/hooks/pre-commit

@@ -1555,6 +1555,11 @@ else
   # Stage 2: UNCONDITIONAL coverage percentage enforcement
   # Always attempt to parse coverage from available sources. If percentage
   # can be determined and is < 80% → BLOCK. If no data found → warn.
+  #
+  # NOTE: When only a subset of test files were run (smart selection, Issue #286),
+  # coverage data reflects only the tested subset. In that case we warn but don't
+  # block, because the full suite coverage may be ≥80% even though the subset
+  # coverage is lower.
   # ============================================================================
   COVERAGE_ENFORCED=false
 
@@ -1571,10 +1576,17 @@ else
         " 2>/dev/null)
         if [ "$COVERAGE_PERCENT" != "parse_error" ] && [ -n "$COVERAGE_PERCENT" ]; then
           if [ "$COVERAGE_PERCENT" -lt 80 ]; then
-            echo "❌ BLOCKED - TypeScript coverage ${COVERAGE_PERCENT}% below 80% threshold"
-            exit 1
+            # If only subset of tests ran, warn instead of block
+            if [ -n "${CHANGED_TEST_FILE_COUNT:-}" ] && [ "${CHANGED_TEST_FILE_COUNT:-0}" -gt 0 ] 2>/dev/null; then
+              echo "⚠️  Partial coverage ${COVERAGE_PERCENT}% (subset test run, not full suite)."
+              echo "    Run 'npx vitest run --coverage' for full coverage check."
+            else
+              echo "❌ BLOCKED - TypeScript coverage ${COVERAGE_PERCENT}% below 80% threshold"
+              exit 1
+            fi
+          else
+            echo "TypeScript coverage: ${COVERAGE_PERCENT}% ✅ (≥ 80%)"
           fi
-          echo "TypeScript coverage: ${COVERAGE_PERCENT}% ✅ (≥ 80%)"
         else
           echo "⚠️  Could not parse TypeScript coverage from coverage/coverage-summary.json"
         fi

package/mock-policy/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MOCK-POLICY KNOWLEDGE BASE
 
-**Generated:** 2026-07-07
-**Commit:** 897f8eb
-**Branch:** main
-**Version:** 0.12.13.0
+**Generated:** 2026-07-08
+**Commit:** 6f868ee
+**Branch:** sprint/2026-07-07-01
+**Version:** 0.13.0.0
 
 ## OVERVIEW
 Mock layering policy enforcement — Gate M3 of pre-push hook. Ensures integration tests use real implementations for internal dependencies, mock external dependencies, and annotate pending mocks with removal plans. Combines project scope scanning, mock decision engine, and per-file validation into a single pipeline.

package/mutation/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MUTATION KNOWLEDGE BASE
 
-**Generated:** 2026-07-07
-**Commit:** 897f8eb
-**Branch:** main
-**Version:** 0.12.13.0
+**Generated:** 2026-07-08
+**Commit:** 6f868ee
+**Branch:** sprint/2026-07-07-01
+**Version:** 0.13.0.0
 
 ## OVERVIEW
 **Gate M** (incremental mutation testing) + **Gate M2** helpers (test-layer detection used by `src/mock-policy/`). Pre-push quality gate. TypeScript-only; uses Stryker.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/xp-gate",
-  "version": "0.12.13",
+  "version": "0.13.0",
   "description": "AI-driven development workflow: 6 quality gates + Delphi review + Sprint Flow",
   "bin": {
     "xp-gate": "./bin/xp-gate.js"

package/plugins/claude-code/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.12.13",
+  "version": "0.13.0",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Claude Code. Includes 10 quality gates (Gate 0-9), Sprint Flow (11 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {

package/plugins/claude-code/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
-**Generated:** 2026-07-07
-**Commit:** 897f8eb
-**Branch:** main
-**Version:** 0.12.13.0
+**Generated:** 2026-07-08
+**Commit:** 6f868ee
+**Branch:** sprint/2026-07-07-01
+**Version:** 0.13.0.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, 3 experts from ≥2 providers, domestic models only). Supports design + code-walkthrough modes.

package/plugins/claude-code/skills/sprint-flow/AGENTS.md

@@ -1,35 +1,32 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
-**Generated:** 2026-07-07
-**Commit:** 897f8eb
-**Branch:** main
-**Version:** 0.12.13.0
+**Generated:** 2026-07-08
+**Commit:** 6f868ee
+**Branch:** sprint/2026-07-07-01
+**Version:** 0.13.0.0
 
 ## OVERVIEW
-**11-phase** development pipeline: ISOLATE → AUTO-ESTIMATE → THINK → PLAN → BUILD → REVIEW → SHIP → LAND → USER ACCEPTANCE → FEEDBACK → CLEANUP. Phase 2 default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE in Phase 1: design must pass Delphi review (≥90% consensus) before any coding.
+**6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.
 
-> **Doc drift**: README/CAPABILITIES still describe a "7-phase" pipeline. The canonical 11-phase model lives in `SKILL.md` and is what actually executes. See root `AGENTS.md` → "Known Drift" #4.
+> **v2.0 Compact Redesign (Issue #290)**: Merged from 11 phases to 6. PREP = old ISOLATE + AUTO-ESTIMATE. DESIGN = old THINK + PLAN. BUILD = old BUILD. VERIFY = old REVIEW + FEEDBACK. SHIP = old SHIP + LAND. CLOSE = old USER ACCEPTANCE + CLEANUP.
 
 ## STRUCTURE
 ```
 skills/sprint-flow/
-├── SKILL.md              # 11-phase pipeline definition (canonical)
+├── SKILL.md              # 6-phase pipeline definition (canonical, v2.0)
 ├── AGENTS.md             # This file (mirrored to 7 other locations — DO NOT edit mirrors)
 ├── evals/                # Evaluation test cases
 ├── evolution-history.json
 ├── evolution-log.md
 ├── references/
-│   ├── phase-minus-0-5-auto-estimate.md  # Phase -0.5: AUTO-ESTIMATE
-│   ├── phase-0-think.md                   # Phase 0: brainstorming → CONTEXT.md + ADR
-│   ├── phase-1-plan.md                    # Phase 1: autoplan + delphi-review (HARD-GATE)
-│   ├── phase-2-build.md                   # Phase 2: ralph-loop default + TDD + test-align
-│   ├── phase-3-review.md                  # Phase 3: code-walkthrough + QA + benchmark
-│   ├── phase-4-uat.md                     # Phase 4: USER ACCEPTANCE
-│   ├── phase-5-feedback.md                # Phase 5: retro + debugging + learn
-│   ├── phase-6-ship.md                    # Phase 6: finishing-dev-branch + PR
-│   ├── phase-7-land.md                    # Phase 7: land + deploy
-│   ├── phase-8-cleanup.md                 # Phase 8: sprint branch cleanup
+│   ├── phase-1-prep.md                    # Phase 1/6: PREP (worktree isolation + sizing)
+│   ├── phase-2-design.md                  # Phase 2/6: DESIGN (brainstorming + delphi-review HARD-GATE)
+│   ├── phase-3-build.md                   # Phase 3/6: BUILD (ralph-loop default + TDD + test-align)
+│   ├── phase-4-verify.md                  # Phase 4/6: VERIFY (code-walkthrough + QA + feedback)
+│   ├── phase-5-ship.md                    # Phase 5/6: SHIP (PR + merge + deploy + canary)
+│   ├── phase-6-close.md                   # Phase 6/6: CLOSE (UAT + cleanup)
 │   ├── force-levels.md                    # Phase forcing rules
+│   ├── orchestration-rules.md             # Agent dispatch, context inheritance, transition rules
 │   └── components/                        # Reusable phase building blocks
 └── templates/
     ├── auto-estimate-output-template.md
@@ -43,73 +40,64 @@ skills/sprint-flow/
 ## WHERE TO LOOK
 | Task | Location | Notes |
 |------|----------|-------|
-| Pipeline definition | SKILL.md | 11 phases with HARD-GATE between Phase 1 and Phase 2 |
-| Auto-estimate phase | references/phase-minus-0-5-auto-estimate.md | Sizing pass before THINK |
-| THINK phase | references/phase-0-think.md | brainstorming → CONTEXT.md + ADR |
-| PLAN phase + HARD-GATE | references/phase-1-plan.md | autoplan → delphi-review → specification.yaml |
-| BUILD phase | references/phase-2-build.md | ralph-loop (default) vs parallel |
+| Pipeline definition | SKILL.md | 6 phases with HARD-GATE between DESIGN (2/6) and BUILD (3/6) |
+| PREP phase | references/phase-1-prep.md | worktree isolation + sizing pass |
+| DESIGN phase + HARD-GATE | references/phase-2-design.md | brainstorming + autoplan + delphi-review → specification.yaml |
+| BUILD phase | references/phase-3-build.md | ralph-loop (default) vs parallel |
+| VERIFY phase | references/phase-4-verify.md | code-walkthrough + QA + retro + learn |
+| SHIP phase | references/phase-5-ship.md | PR + merge + deploy + canary |
+| CLOSE phase | references/phase-6-close.md | UAT + cleanup |
 | Force-level rules | references/force-levels.md | Defines when each phase becomes mandatory |
+| Orchestration rules | references/orchestration-rules.md | Agent dispatch, context inheritance, transition gates |
 | Templates | templates/ | Auto-estimate, sprint progress/summary, pain doc, emergent issues |
 
-## THE 11 PHASES
+## THE 6 PHASES (v2.0)
 
-| Phase | Name | Key Action | Hard Gate |
-|-------|------|-----------|-----------|
-| -1 | ISOLATE | Isolate working tree / worktree creation | — |
-| -0.5 | AUTO-ESTIMATE | Sizing pass; emits estimate template | — |
-| 0 | THINK | brainstorming → CONTEXT.md + ADR | — |
-| 1 | PLAN | autoplan → delphi-review → specification.yaml | **HARD-GATE**: design must reach ≥90% Delphi consensus |
-| 2 | BUILD | ralph-loop (REQ-level, default) + TDD + test-spec-alignment | — |
-| 3 | REVIEW | code-walkthrough + QA + benchmark | — |
-| 4 | SHIP | finishing-a-development-branch → PR | — |
-| 5 | LAND | land + deploy staging + canary | — |
-| 6 | USER ACCEPTANCE | Manual verification on staging | — |
-| 7 | FEEDBACK | retro + debugging + `learn` (Sprint-level) | — |
-| 8 | CLEANUP | Sprint branch cleanup (per `docs/plans/2026-06-06-sprint-branch-cleanup-design.md`) | — |
+| Phase | Name | Maps From (old 11) | Key Action | Hard Gate |
+|-------|------|-------------------|------------|-----------|
+| 1/6 | PREP | ISOLATE + AUTO-ESTIMATE | Worktree isolation + sizing | — |
+| 2/6 | DESIGN | THINK + PLAN | brainstorming → autoplan → Delphi consensus | **HARD-GATE**: design must reach ≥90% Delphi consensus |
+| 3/6 | BUILD | BUILD | ralph-loop (default) + TDD + test-spec-alignment | — |
+| 4/6 | VERIFY | REVIEW + FEEDBACK | code-walkthrough + QA + retro + learn | HARD-GATE: feedback-log.md must exist |
+| 5/6 | SHIP | SHIP + LAND | PR → squash-merge → deploy → canary | — |
+| 6/6 | CLOSE | USER ACCEPT + CLEANUP | Manual UAT → emergent issues → cleanup | HARD-GATE: UAT mandatory manual |
 
 ## CONVENTIONS
-- **ralph-loop is Phase 2 default**. Each REQ runs in a clean context (no linear accumulation), saving 40-67% tokens vs parallel mode.
-- **delphi-review HARD-GATE in Phase 1**: design must reach ≥90% consensus across ≥2 model providers, domestic models only. Unapproved → BLOCK coding.
-- **`learn` is called twice**: once per REQ in Phase 2 (ralph-loop internal, `progress.log` permanent/contextual classification) and once in Phase 5 (Sprint-level retro).
+- **ralph-loop is Phase 3/6 BUILD default**. Each REQ runs in a clean context, saving 40-67% tokens.
+- **delphi-review HARD-GATE in Phase 2/6 DESIGN**: design must reach ≥90% consensus across ≥2 model providers, domestic models only. Unapproved → BLOCK coding.
+- **`learn` is called twice**: once per REQ in Phase 3/6 (ralph-loop internal) and once in Phase 4/6 VERIFY (Sprint-level retro).
 - **Phase isolation**: each phase has explicit entry/exit criteria documented in its `references/phase-*.md` file.
-- **Emergent Requirements** discovered in Phase 6 (USER ACCEPTANCE) are explicitly captured via `templates/emergent-issues-template.md` — never silently merged.
-- **Auto-detection**: Phase 0 uses `src/npm-package/lib/ui-detector.ts` to pick the right tech-stack templates.
+- **Emergent Requirements** discovered in Phase 6/6 CLOSE (USER ACCEPTANCE) are explicitly captured via `templates/emergent-issues-template.md` — never silently merged.
+- **Auto-detection**: Phase 2/6 DESIGN uses `src/npm-package/lib/ui-detector.ts` to pick the right tech-stack templates.
 
 ## ANTI-PATTERNS (THIS PROJECT)
-- Do NOT skip `delphi-review` in Phase 1 — HARD-GATE blocks implementation.
+- Do NOT skip `delphi-review` in Phase 2/6 DESIGN — HARD-GATE blocks implementation.
 - Do NOT use parallel build mode unless explicitly requested. Ralph-loop is the default for a reason.
-- Do NOT enter Phase 1 (PLAN) without completing Phase 0 (THINK).
-- Do NOT implement before design is APPROVED — Phase 1 must reach Delphi consensus first.
-- Do NOT merge an Emergent Requirement into the original Sprint silently — capture it via the template.
+- Do NOT enter Phase 2/6 DESIGN (PLAN) without completing DESIGN (brainstorming).
+- Do NOT implement before design is APPROVED — Phase 2/6 DESIGN must reach Delphi consensus first.
+- Do NOT merge an Emergent Requirement into the original Sprint silently — capture it via the template in Phase 6/6 CLOSE.
 - Do NOT terminate Delphi review before ≥90% consensus or 5 rounds, whichever first.
 
 ## UNIQUE STYLES
-- **11 phases** including negative-numbered pre-phases (-1, -0.5) — intentional, captures the work that happens before "real" coding starts.
-- **HARD-GATE** between PLAN and BUILD is enforced both in the SKILL.md instructions and in the Claude Code plugin's PreToolUse hook (`plugins/claude-code/bin/delphi-review-guard.sh`).
-- **Per-REQ clean context in ralph-loop** = the core efficiency mechanism. Sprint-flow specifically chooses this over parallel mode.
+- **6 phases** (v2.0 Issue #290) — compact design with merged phases (1-6 numbering)
+- **HARD-GATE** between DESIGN and BUILD enforced both in SKILL.md and Claude Code plugin's PreToolUse hook.
+- **Per-REQ clean context in ralph-loop** = the core efficiency mechanism.
 - **Tech-stack auto-detection** via `--type` and `--lang` flags or `ui-detector.ts`.
 
 ## COMMANDS
 ```bash
-/sprint-flow "开发用户登录"                                     # Full 11-phase pipeline
+/sprint-flow "开发用户登录"                                     # Full 6-phase pipeline
 /sprint-flow "开发用户登录" --type web-nextjs --lang typescript # Pin tech stack
-/sprint-flow "开发用户登录" --phase build-only                  # Skip planning (advanced)
+/sprint-flow "开发用户登录" --phase build-only                  # Skip design (advanced)
 /sprint-flow "开发用户登录" --mode parallel                     # Legacy all-at-once (NOT default)
+/sprint-flow "开发用户登录" --stop-at design                    # Stop after DESIGN phase
 /delphi-review "开发用户登录" --type web-nextjs --lang typescript
 ```
 
 ## NOTES
-- Integrates: brainstorming, autoplan, delphi-review, TDD, test-specification-alignment, qa, design-review, benchmark, systematic-debugging, retro, learn, finishing-a-development-branch.
+- Integrates: brainstorming, autoplan, delphi-review, TDD, test-specification-alignment, qa, design-review, benchmark, systematic-debugging, retro, learn, finishing-a-development-branch, land-and-deploy.
 - ralph-loop's internal learnings are persisted via `progress.log` (permanent vs contextual classification).
-- Phase 5 calls `gstack/learn` for Sprint-level retrospective.
-- Phase 8 cleanup behavior is governed by `docs/plans/2026-06-06-sprint-branch-cleanup-design.md`.
-- This `AGENTS.md` is the canonical version. **7 byte-identical mirrors** exist at:
-  - `plugins/claude-code/skills/sprint-flow/AGENTS.md`
-  - `plugins/opencode/skills/sprint-flow/AGENTS.md`
-  - `plugins/qoder/skills/sprint-flow/AGENTS.md`
-  - `src/npm-package/skills/sprint-flow/AGENTS.md`
-  - `src/npm-package/plugins/claude-code/skills/sprint-flow/AGENTS.md`
-  - `src/npm-package/plugins/opencode/skills/sprint-flow/AGENTS.md`
-  - `src/npm-package/plugins/qoder/skills/sprint-flow/AGENTS.md`
+- Phase 4/6 VERIFY calls `gstack/learn` for Sprint-level retrospective.
+- Phase 6/6 CLOSE cleanup behavior is governed by `docs/plans/2026-06-06-sprint-branch-cleanup-design.md`.
+- This `AGENTS.md` is the canonical version. **7 byte-identical mirrors** exist.
   Mirrors are updated by `scripts/copy-skills.sh`. Do NOT edit them by hand.
-