@cassiomc1/forgeloop 2.0.0-rc.5 → 2.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CONTRIBUTING.md +3 -1
- package/DOCS_INDEX.md +2 -0
- package/ENG/accessibility-eng.md +6 -6
- package/ENG/clean-code-eng.md +2 -2
- package/ENG/design-code-eng.md +13 -13
- package/ENG/documentation-quality-eng.md +10 -2
- package/ENG/flutter-development-eng.md +38 -59
- package/ENG/games-code-design-web-eng.md +2 -2
- package/ENG/perf-code-eng.md +3 -3
- package/ENG/php-development-eng.md +2 -2
- package/ENG/premium-sites-studio-eng.md +9 -2
- package/ENG/python-development-eng.md +7 -1
- package/ENG/rust-development-eng.md +22 -32
- package/ENG/sec-code-eng.md +19 -3
- package/ENG/taste-frontend-eng.md +108 -1
- package/ENG/test-code-eng.md +2 -2
- package/GUIDE_ROUTER.md +18 -4
- package/README.md +15 -13
- package/THIRD_PARTY_NOTICES.md +59 -6
- package/docs/AGENT_PROTOCOL_SUMMARY.md +1 -1
- package/docs/AGENT_SKILL.md +16 -0
- package/docs/DOCUMENTATION_GUIDE.md +6 -0
- package/docs/GUIDE_MAINTENANCE.md +106 -0
- package/docs/PACKAGE_CONTENTS.md +18 -0
- package/docs/RELEASE_CHECKLIST.md +41 -29
- package/docs/REVENUE_CENTRIC_DESIGN.md +69 -0
- package/docs/SECURITY_AUDIT_SKILL.md +131 -0
- package/docs/SECURITY_REVIEW.md +6 -0
- package/docs/STABLE_2_ACCEPTANCE.md +80 -0
- package/docs/TROUBLESHOOTING.md +12 -0
- package/docs/documentation-manifest.json +244 -0
- package/package.json +12 -3
- package/scripts/generate-forgeloop-skill.mjs +8 -0
- package/scripts/verify-revenue-design-skill.mjs +37 -0
- package/scripts/verify-security-audit-skill.mjs +68 -0
- package/skills/forgeloop/SKILL.md +8 -0
- package/skills/forgeloop/references/revenue-centric-design/LICENSE +30 -0
- package/skills/forgeloop/references/revenue-centric-design/PIN.json +14 -0
- package/skills/forgeloop/references/revenue-centric-design/SKILL.md +64 -0
- package/skills/forgeloop/references/revenue-centric-design/references/playbook.md +36 -0
- package/skills/security-audit/AI-AND-LLM.md +83 -0
- package/skills/security-audit/ATTACK-CLASSES.md +130 -0
- package/skills/security-audit/CLIENT-SIDE.md +83 -0
- package/skills/security-audit/CLOUD-AND-DEPLOYMENT.md +86 -0
- package/skills/security-audit/DATA-ISOLATION-AND-LIFECYCLE.md +84 -0
- package/skills/security-audit/DESKTOP-MOBILE-AND-LOCAL-IPC.md +89 -0
- package/skills/security-audit/HUNTING.md +251 -0
- package/skills/security-audit/LICENSE +21 -0
- package/skills/security-audit/MEMORY-SAFETY-AND-BINARY.md +101 -0
- package/skills/security-audit/PIN.json +30 -0
- package/skills/security-audit/PROTOCOLS-RPC-AND-MESSAGING.md +81 -0
- package/skills/security-audit/RECONNAISSANCE.md +156 -0
- package/skills/security-audit/RESOURCE-EXHAUSTION-AND-AVAILABILITY.md +78 -0
- package/skills/security-audit/SKILL.md +192 -0
- package/skills/security-audit/SUPPLY-CHAIN-AND-RELEASE.md +73 -0
- package/skills/security-audit/VALIDATION-AND-REPORTING.md +186 -0
- package/skills/security-audit/WEB-PROTOCOL-AND-AUTH.md +105 -0
- package/skills/security-audit/report-schema.json +461 -0
- package/skills/security-audit/validate-coverage-ledger.cjs +872 -0
- package/skills/security-audit/validate-coverage-ledger.test.cjs +740 -0
- package/skills/security-audit/validate-findings.cjs +773 -0
- package/skills/security-audit/validate-findings.test.cjs +652 -0
- package/src/core/completion-artifacts.js +4 -7
- package/src/core/diagnosis.js +3 -5
- package/src/core/diagnostic-record.js +4 -4
- package/src/core/next-action-recovery-phases.js +3 -0
- package/src/core/next-action-review-correction.js +26 -0
- package/src/core/next-action-review-phase.js +11 -10
- package/src/core/reconcile-closure.js +5 -0
- package/src/core/review-correction.js +51 -0
- package/src/storage/capabilities.js +1 -1
package/src/core/diagnosis.js
CHANGED
|
@@ -1,6 +1,7 @@
|
|
|
1
1
|
import { appendProtocolEvent, validateEventLedger } from "./events.js";
|
|
2
2
|
import { readWorkState, mutateWorkState } from "./work-state.js";
|
|
3
3
|
import { getTaskTransaction, withTaskTransaction } from "./transaction.js";
|
|
4
|
+
import { assertDiagnosisPhase, assertReviewChronology } from "./review-correction.js";
|
|
4
5
|
import {
|
|
5
6
|
DIAGNOSIS_INFORMATION_GAIN,
|
|
6
7
|
assertDiagnosisDetails,
|
|
@@ -49,11 +50,7 @@ async function recordDiagnosisInTransaction({
|
|
|
49
50
|
error.code = "E_STATE_MISSING";
|
|
50
51
|
throw error;
|
|
51
52
|
}
|
|
52
|
-
|
|
53
|
-
const error = new Error(`Recording a diagnosis requires phase DIAGNOSING, currently ${state.phase}`);
|
|
54
|
-
error.code = "E_PHASE_PREREQUISITE_MISSING";
|
|
55
|
-
throw error;
|
|
56
|
-
}
|
|
53
|
+
assertDiagnosisPhase(state);
|
|
57
54
|
if (typeof state.verificationCycle !== "number" || state.verificationCycle < 1) {
|
|
58
55
|
const error = new Error("Active verification cycle must be an integer >= 1");
|
|
59
56
|
error.code = "E_DIAGNOSIS_INVALID";
|
|
@@ -67,6 +64,7 @@ async function recordDiagnosisInTransaction({
|
|
|
67
64
|
error.code = first.code;
|
|
68
65
|
throw error;
|
|
69
66
|
}
|
|
67
|
+
assertReviewChronology(state, ledger.events);
|
|
70
68
|
|
|
71
69
|
const verificationStarted = ledger.events.some(
|
|
72
70
|
(e) => e.taskId === state.taskId && e.event === "VERIFICATION_STARTED",
|
|
@@ -11,6 +11,7 @@ import {
|
|
|
11
11
|
interventionSemanticFingerprint,
|
|
12
12
|
} from "./diagnostic-model.js";
|
|
13
13
|
import { projectHypothesisStates, getHypothesisState } from "./hypothesis-projection.js";
|
|
14
|
+
import { assertDiagnosisPhase, assertReviewChronology, requiresFailureBinding } from "./review-correction.js";
|
|
14
15
|
|
|
15
16
|
const TERMINAL_STATUSES = Object.freeze(["FALSIFIED", "SUPERSEDED", "UNRESOLVED"]);
|
|
16
17
|
|
|
@@ -112,10 +113,9 @@ async function recordDiagnosticCase({
|
|
|
112
113
|
}
|
|
113
114
|
|
|
114
115
|
const state = await requireActiveState(target, { packageRoot, taskId });
|
|
115
|
-
|
|
116
|
-
throw stateError("E_PHASE_PREREQUISITE_MISSING", `Recording a structured diagnostic case requires phase DIAGNOSING, currently ${state.phase}`);
|
|
117
|
-
}
|
|
116
|
+
assertDiagnosisPhase(state);
|
|
118
117
|
const ledger = await requireValidLedger(target, packageRoot, taskId);
|
|
118
|
+
assertReviewChronology(state, ledger.events);
|
|
119
119
|
|
|
120
120
|
if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
|
|
121
121
|
throw stateError("E_DIAGNOSTIC_CASE_INVALID", "diagnostic case must be a JSON object");
|
|
@@ -156,7 +156,7 @@ async function recordDiagnosticCase({
|
|
|
156
156
|
|
|
157
157
|
// A VERIFICATION_FAILURE case must bind to failed/blocked evidence from the
|
|
158
158
|
// active correction cycle so it cannot be formally valid yet semantically empty.
|
|
159
|
-
if (parsed.failureClass
|
|
159
|
+
if (requiresFailureBinding(state, parsed.failureClass)) {
|
|
160
160
|
const bindsToFailure = [
|
|
161
161
|
...parsed.hypotheses.flatMap((hypothesis) => hypothesis.evidenceRefs ?? []),
|
|
162
162
|
...(parsed.observations ?? [])
|
|
@@ -4,6 +4,7 @@ import { artifactError } from "./next-action-artifacts.js";
|
|
|
4
4
|
import { resolveCurrentCycleDiagnostic } from "./diagnostic-projection.js";
|
|
5
5
|
import { buildTaskReflection } from "./reflection.js";
|
|
6
6
|
import { evaluateProgress, PROGRESS_STATUS } from "./progress.js";
|
|
7
|
+
import { reviewCorrectionAction } from "./next-action-review-correction.js";
|
|
7
8
|
|
|
8
9
|
export async function resolveDiagnosingPhase({ target, packageRoot, normalized, state, context, eventsRel, requiredArtifacts, stateRel }) {
|
|
9
10
|
const ledger = await validateEventLedger(target, packageRoot, { taskId: normalized.taskId ?? null });
|
|
@@ -65,6 +66,8 @@ export async function resolveDiagnosingPhase({ target, packageRoot, normalized,
|
|
|
65
66
|
}
|
|
66
67
|
|
|
67
68
|
export async function resolveCorrectingPhase({ target, packageRoot, normalized, state, context, requiredArtifacts }) {
|
|
69
|
+
const correction = await reviewCorrectionAction({ target, packageRoot, taskId: normalized.taskId ?? null, state, context, requiredArtifacts });
|
|
70
|
+
if (correction) return correction;
|
|
68
71
|
const ledgerForCorrection = await validateEventLedger(target, packageRoot, { taskId: normalized.taskId ?? null });
|
|
69
72
|
const correctionCycle = state.verificationCycle ?? 1;
|
|
70
73
|
const hasStructuredCase = ledgerForCorrection.events.some(
|
|
@@ -0,0 +1,26 @@
|
|
|
1
|
+
import { validateEventLedger } from "./events.js";
|
|
2
|
+
import { resolveCurrentCycleDiagnostic } from "./diagnostic-projection.js";
|
|
3
|
+
import { hasCurrentReview, reviewFailures } from "./review-correction.js";
|
|
4
|
+
import { NEXT_ACTIONS, decision, recordCheckCommandSpec, recordDiagnosisCommandSpec, result } from "./next-action-model.js";
|
|
5
|
+
import { artifactError } from "./next-action-artifacts.js";
|
|
6
|
+
|
|
7
|
+
export async function reviewCorrectionAction({ target, packageRoot, taskId, state, context, requiredArtifacts }) {
|
|
8
|
+
const failures = reviewFailures(state);
|
|
9
|
+
if (state.phase === "REVIEWING" && failures.length === 0) return null;
|
|
10
|
+
const ledger = await validateEventLedger(target, packageRoot, { taskId });
|
|
11
|
+
if (!ledger.valid || !hasCurrentReview(state, ledger.events)) return null;
|
|
12
|
+
if (failures.length === 0) {
|
|
13
|
+
return result({ ...context, nextAction: NEXT_ACTIONS.RECORD_VERIFICATION,
|
|
14
|
+
reasons: [artifactError("E_REVIEW_FINDING_REQUIRED", "Record an observed failed or blocked review finding before diagnosis or retry")],
|
|
15
|
+
commandSpecs: [recordCheckCommandSpec("<reviewed requirement>")], requiredArtifacts });
|
|
16
|
+
}
|
|
17
|
+
const diagnosis = resolveCurrentCycleDiagnostic(ledger.events, state.taskId, state.verificationCycle);
|
|
18
|
+
if (!diagnosis) {
|
|
19
|
+
return result({ ...context, nextAction: NEXT_ACTIONS.RECORD_DIAGNOSIS,
|
|
20
|
+
reasons: [artifactError("E_DIAGNOSIS_REQUIRED", "Diagnose the failed review finding using evidence from the current verification cycle")],
|
|
21
|
+
commandSpecs: [recordDiagnosisCommandSpec()], requiredArtifacts });
|
|
22
|
+
}
|
|
23
|
+
return state.phase === "REVIEWING"
|
|
24
|
+
? decision(context, NEXT_ACTIONS.CORRECT, artifactError("PHASE_REVIEWING", "The diagnosed review finding requires correction"))
|
|
25
|
+
: null;
|
|
26
|
+
}
|
|
@@ -6,17 +6,18 @@ import { evaluateRequiredEvidence, classifyRequirement, terminalRequirementsForC
|
|
|
6
6
|
import { validateEventLedger, validateCompletionRecoveryAuthorization } from "./events.js";
|
|
7
7
|
import { NEXT_ACTIONS, commandFor, decision, recordTerminalResultCommandSpec, result } from "./next-action-model.js";
|
|
8
8
|
import { artifactError, checkListReasons, loadArtifact, requirementsAndCoverage } from "./next-action-artifacts.js";
|
|
9
|
+
import { reviewCorrectionAction } from "./next-action-review-correction.js";
|
|
9
10
|
|
|
10
|
-
export async function resolveReviewingPhase(
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
11
|
+
export async function resolveReviewingPhase(options) {
|
|
12
|
+
const { target, packageRoot, explicitTaskId, state, context, requiredArtifacts } = options;
|
|
13
|
+
const invalidChecks = checkListReasons(state);
|
|
14
|
+
if (invalidChecks.length > 0) return result({ ...context, nextAction: NEXT_ACTIONS.RESOLVE_BLOCKER, reasons: invalidChecks, requiredArtifacts });
|
|
15
|
+
const correction = await reviewCorrectionAction({ target, packageRoot, taskId: explicitTaskId, state, context, requiredArtifacts });
|
|
16
|
+
if (correction) return correction;
|
|
17
|
+
return resolveReviewingEvidence(options);
|
|
18
|
+
}
|
|
19
|
+
|
|
20
|
+
async function resolveReviewingEvidence({ state, context, requiredArtifacts, target, packageRoot, contract, route, preflight, authorityContext, runtimeContext, explicitTaskId, eventsRel, receiptRel, stateRel, policyRecoveryAction }) {
|
|
20
21
|
const evidence = await requirementsAndCoverage({
|
|
21
22
|
target,
|
|
22
23
|
packageRoot,
|
|
@@ -13,6 +13,7 @@ import { classifyLoadedWorkState, readWorkState, mutateWorkState } from "./work-
|
|
|
13
13
|
import { classifyRequirement } from "./evidence-readiness.js";
|
|
14
14
|
import { assertDiagnosingToCorrectingTransition } from "./phase.js";
|
|
15
15
|
import { resolveCurrentCycleDiagnostic } from "./diagnostic-projection.js";
|
|
16
|
+
import { hasCurrentReview } from "./review-correction.js";
|
|
16
17
|
|
|
17
18
|
export const RECONCILE_EVENT = "CHECKPOINT_RECONCILED";
|
|
18
19
|
|
|
@@ -214,6 +215,10 @@ async function rebindReconciliationState(target, {
|
|
|
214
215
|
// reconcile itself records the cycle diagnosis below (provenance bound to
|
|
215
216
|
// the passed evidence execution).
|
|
216
217
|
const cycleDiagnosis = resolveCurrentCycleDiagnostic(ledger.events, state.taskId, state.verificationCycle ?? 1);
|
|
218
|
+
// Refresh only the repository binding for a task that entered correction
|
|
219
|
+
// from review before recording its new finding. No diagnosis is invented;
|
|
220
|
+
// advance to VERIFYING still requires one from this cycle.
|
|
221
|
+
if (state.phase === "CORRECTING" && !cycleDiagnosis && hasCurrentReview(state, ledger.events)) return state;
|
|
217
222
|
if (state.phase === "DIAGNOSING" && !cycleDiagnosis) {
|
|
218
223
|
return { ...state, undiagnosedDiagnosingRebind: true };
|
|
219
224
|
}
|
|
@@ -0,0 +1,51 @@
|
|
|
1
|
+
export function isReviewCorrection(state) {
|
|
2
|
+
return state.phase === "REVIEWING"
|
|
3
|
+
|| (state.phase === "CORRECTING" && state.previousPhase === "REVIEWING");
|
|
4
|
+
}
|
|
5
|
+
|
|
6
|
+
export function hasCurrentReview(state, events) {
|
|
7
|
+
return isReviewCorrection(state) && events.some((event) => event.taskId === state.taskId
|
|
8
|
+
&& event.event === "REVIEW_STARTED"
|
|
9
|
+
&& event.details?.verificationCycle === state.verificationCycle);
|
|
10
|
+
}
|
|
11
|
+
|
|
12
|
+
export function reviewFailures(state) {
|
|
13
|
+
return (state.checks ?? []).filter((check) => check.details?.verificationCycle === state.verificationCycle
|
|
14
|
+
&& ((check.status === "failed" && check.evidenceKind === "OBSERVED")
|
|
15
|
+
|| (check.status === "blocked" && check.evidenceKind === "BLOCKED")));
|
|
16
|
+
}
|
|
17
|
+
|
|
18
|
+
function prerequisite(code, message, artifacts = []) {
|
|
19
|
+
return Object.assign(new Error(message), { code, artifacts });
|
|
20
|
+
}
|
|
21
|
+
|
|
22
|
+
export function assertCheckPhase(state, status, evidenceKind, stateRel) {
|
|
23
|
+
const reviewFinding = isReviewCorrection(state) && ((status === "failed" && evidenceKind === "OBSERVED")
|
|
24
|
+
|| (status === "blocked" && evidenceKind === "BLOCKED"));
|
|
25
|
+
if (state.phase !== "VERIFYING" && !reviewFinding) {
|
|
26
|
+
throw prerequisite("E_PHASE_PREREQUISITE_MISSING", `record-check requires VERIFYING or a negative review finding; found ${state.phase}`, [stateRel]);
|
|
27
|
+
}
|
|
28
|
+
return reviewFinding;
|
|
29
|
+
}
|
|
30
|
+
|
|
31
|
+
export function assertDiagnosisPhase(state) {
|
|
32
|
+
if (state.phase !== "DIAGNOSING" && !isReviewCorrection(state)) {
|
|
33
|
+
throw prerequisite("E_PHASE_PREREQUISITE_MISSING", `Recording a diagnosis requires DIAGNOSING or a review finding, currently ${state.phase}`);
|
|
34
|
+
}
|
|
35
|
+
}
|
|
36
|
+
|
|
37
|
+
export function assertReviewChronology(state, events, artifacts = []) {
|
|
38
|
+
if (isReviewCorrection(state) && !hasCurrentReview(state, events)) {
|
|
39
|
+
throw prerequisite("E_PHASE_CHRONOLOGY_INVALID", "Review findings require REVIEW_STARTED in the current verification cycle", artifacts);
|
|
40
|
+
}
|
|
41
|
+
}
|
|
42
|
+
|
|
43
|
+
export function requiresFailureBinding(state, failureClass) {
|
|
44
|
+
return failureClass === "VERIFICATION_FAILURE" || isReviewCorrection(state);
|
|
45
|
+
}
|
|
46
|
+
|
|
47
|
+
export function assertReviewRequirement(state, requirement, canonicalRequirement) {
|
|
48
|
+
if (isReviewCorrection(state) && !canonicalRequirement) {
|
|
49
|
+
throw prerequisite("E_CHECK_INVALID", `Review finding must reference a required contract or guide check: ${requirement}`);
|
|
50
|
+
}
|
|
51
|
+
}
|