@boyingliu01/xp-gate 0.14.5 → 0.14.7

package/skills/sprint-flow/SKILL.md

@@ -200,6 +200,9 @@ Every phase MUST output its header as the first line of that phase's output. For
 4. On `/sprint-flow` trigger, first line MUST output: `Sprint Flow: PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE`
 5. Each phase completion MUST write Phase Summary to `.sprint-state/phase-outputs/phase-{N}-summary.md`
 6. Each phase completion MUST update `.sprint-state/sprint-state.json`
+
+### Required Rendering (MANDATORY per phase)
+
 7. Each phase completion MUST render the ASCII progress dashboard using `templates/sprint-progress-template.md` — the orchestrator reads `sprint-state.json` and outputs the dashboard after every phase's status block, so the user always sees current global progress without needing to ask
 
 ### Phase Output Status Schema (MANDATORY per phase)

package/skills/sprint-flow/__tests__/sprint-flow.test.cjs

@@ -29,10 +29,12 @@ function contentIncludes(str) {
   return skillContent.includes(str) || phaseOverviewContent.includes(str);
 }
 function contentSplit(str) {
-  // Return the part after str from whichever file contains it
+  // Return the part after str from whichever file contains it.
+  // Throws descriptive error instead of returning undefined so callers
+  // get a clear assertion message rather than a TypeError crash.
   if (skillContent.includes(str)) return skillContent.split(str)[1];
   if (phaseOverviewContent.includes(str)) return phaseOverviewContent.split(str)[1];
-  return undefined;
+  throw new Error(`Section "${str}" not found in SKILL.md or references/phase-overview.md`);
 }
 
 function parseFrontmatter(content) {

package/skills/sprint-flow/hooks.md

@@ -0,0 +1,18 @@
+# Hooks — Sprint Flow
+
+Sprint Flow integrates with safety and operational hooks to protect the development environment.
+
+## Security Hooks
+
+| Hook | Purpose | Activation |
+|------|---------|------------|
+| `/careful` | Safety guardrails for destructive commands | Activate before any `rm`, `force-push`, or `git reset` |
+| `/freeze` | Restrict edits to sprint worktree directory | Prevent accidental changes outside sprint scope |
+| `/guard` | Full safety mode (careful + freeze) | Maximum protection for high-risk operations |
+
+## Operational Hooks
+
+| Hook | Purpose | Activation |
+|------|---------|------------|
+| `/context-save` | Save sprint context before pause or handoff | Before pausing sprint or switching tasks |
+| `/context-restore` | Restore sprint context on resume | When resuming from pause or handoff |

package/skills/sprint-flow/scripts/verify-sprint-state.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# sprint-flow: Verify sprint state integrity
+# Checks that sprint-state.json is valid JSON and all expected keys exist.
+#
+# Usage: bash verify-sprint-state.sh [sprint-state-dir]
+
+set -euo pipefail
+
+STATE_DIR="${1:-.sprint-state}"
+STATE_FILE="$STATE_DIR/sprint-state.json"
+
+if [ ! -f "$STATE_FILE" ]; then
+    echo "SKIP: No sprint-state.json found at $STATE_FILE"
+    exit 0
+fi
+
+# Validate JSON
+if ! command -v node &>/dev/null; then
+    echo "WARN: node not available, skipping JSON validation"
+    exit 0
+fi
+
+node -e "
+const fs = require('fs');
+try {
+    const data = JSON.parse(fs.readFileSync('$STATE_FILE', 'utf8'));
+    const requiredKeys = ['sprint_id', 'status', 'current_phase', 'phases'];
+    const missing = requiredKeys.filter(k => !(k in data));
+    if (missing.length > 0) {
+        console.error('ERROR: Missing required keys in sprint-state.json:', missing.join(', '));
+        process.exit(1);
+    }
+    console.log('OK: sprint-state.json is valid with all required keys');
+} catch (e) {
+    console.error('ERROR: sprint-state.json is not valid JSON:', e.message);
+    process.exit(1);
+}
+"

package/skills/sprint-flow/tools.md

@@ -0,0 +1,29 @@
+# Tools Whitelist — Sprint Flow
+
+Sprint Flow is an **orchestration skill** that coordinates subagents and system commands.
+It does NOT implement code directly — it delegates implementation to subagents.
+
+## Allowed Tools
+
+| Tool | Usage | Rationale |
+|------|-------|-----------|
+| `Bash(git, gh, npm, node)` | git worktree/branch/commit, gh PR/release, npm/node CLI | Required for sprint infrastructure management |
+| `Read` | Read project files, configs, docs | Required for context gathering |
+| `Write` | Write sprint-state, specification.yaml, phase summaries | Required for sprint state persistence |
+| `Edit` | Edit sprint-state, CHANGELOG, VERSION | Required for version management |
+| `Glob` | Find project files by pattern | Required for project discovery |
+| `Grep` | Search file contents | Required for codebase understanding |
+| `Task` | Delegate to subagents (quick, deep, unspecified-high) | Core orchestration mechanism |
+| `Skill` | Invoke integrated skills (brainstorming, autoplan, delphi-review, etc.) | Required for skill chain execution |
+| `TodoWrite` | Track sprint progress | Required for progress visibility |
+| `Question` | Ask user at decision gates | Required for user decision points |
+
+## Denied Tools
+
+| Tool | Rationale |
+|------|-----------|
+| `rm -rf (any recursive force remove)` | Destructive — sprint flow only cleans up via `git worktree remove` |
+| `git push --force` | Destructive — never force push during sprint |
+| `DROP TABLE or destructive DB operations` | Destructive — sprint flow orchestrates, does not manage databases |
+| `Write(source code)` | Sprint flow NEVER writes implementation code directly — delegates to subagents via `Task` |
+| `Edit(source code)` | Sprint flow NEVER edits implementation code — delegates to subagents via `Task` |

package/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
-**Generated:** 2026-07-09
-**Commit:** b1d2c76
-**Branch:** sprint/2026-07-09-02
-**Version:** 0.14.5.0
+**Generated:** 2026-07-10
+**Commit:** a9276f6
+**Branch:** main
+**Version:** 0.14.6.2
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.