@cassiomc1/forgeloop 2.0.0-rc.5 → 2.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (71) hide show
  1. package/CONTRIBUTING.md +3 -1
  2. package/DOCS_INDEX.md +2 -0
  3. package/ENG/accessibility-eng.md +6 -6
  4. package/ENG/clean-code-eng.md +2 -2
  5. package/ENG/design-code-eng.md +13 -13
  6. package/ENG/documentation-quality-eng.md +10 -2
  7. package/ENG/flutter-development-eng.md +38 -59
  8. package/ENG/games-code-design-web-eng.md +2 -2
  9. package/ENG/perf-code-eng.md +3 -3
  10. package/ENG/php-development-eng.md +2 -2
  11. package/ENG/premium-sites-studio-eng.md +9 -2
  12. package/ENG/python-development-eng.md +7 -1
  13. package/ENG/rust-development-eng.md +22 -32
  14. package/ENG/sec-code-eng.md +19 -3
  15. package/ENG/taste-frontend-eng.md +108 -1
  16. package/ENG/test-code-eng.md +2 -2
  17. package/GUIDE_ROUTER.md +18 -4
  18. package/README.md +15 -13
  19. package/THIRD_PARTY_NOTICES.md +59 -6
  20. package/docs/AGENT_PROTOCOL_SUMMARY.md +1 -1
  21. package/docs/AGENT_SKILL.md +16 -0
  22. package/docs/DOCUMENTATION_GUIDE.md +6 -0
  23. package/docs/GUIDE_MAINTENANCE.md +106 -0
  24. package/docs/PACKAGE_CONTENTS.md +18 -0
  25. package/docs/RELEASE_CHECKLIST.md +41 -29
  26. package/docs/REVENUE_CENTRIC_DESIGN.md +69 -0
  27. package/docs/SECURITY_AUDIT_SKILL.md +131 -0
  28. package/docs/SECURITY_REVIEW.md +6 -0
  29. package/docs/STABLE_2_ACCEPTANCE.md +80 -0
  30. package/docs/TROUBLESHOOTING.md +12 -0
  31. package/docs/documentation-manifest.json +244 -0
  32. package/package.json +12 -3
  33. package/scripts/generate-forgeloop-skill.mjs +8 -0
  34. package/scripts/verify-revenue-design-skill.mjs +37 -0
  35. package/scripts/verify-security-audit-skill.mjs +68 -0
  36. package/skills/forgeloop/SKILL.md +8 -0
  37. package/skills/forgeloop/references/revenue-centric-design/LICENSE +30 -0
  38. package/skills/forgeloop/references/revenue-centric-design/PIN.json +14 -0
  39. package/skills/forgeloop/references/revenue-centric-design/SKILL.md +64 -0
  40. package/skills/forgeloop/references/revenue-centric-design/references/playbook.md +36 -0
  41. package/skills/security-audit/AI-AND-LLM.md +83 -0
  42. package/skills/security-audit/ATTACK-CLASSES.md +130 -0
  43. package/skills/security-audit/CLIENT-SIDE.md +83 -0
  44. package/skills/security-audit/CLOUD-AND-DEPLOYMENT.md +86 -0
  45. package/skills/security-audit/DATA-ISOLATION-AND-LIFECYCLE.md +84 -0
  46. package/skills/security-audit/DESKTOP-MOBILE-AND-LOCAL-IPC.md +89 -0
  47. package/skills/security-audit/HUNTING.md +251 -0
  48. package/skills/security-audit/LICENSE +21 -0
  49. package/skills/security-audit/MEMORY-SAFETY-AND-BINARY.md +101 -0
  50. package/skills/security-audit/PIN.json +30 -0
  51. package/skills/security-audit/PROTOCOLS-RPC-AND-MESSAGING.md +81 -0
  52. package/skills/security-audit/RECONNAISSANCE.md +156 -0
  53. package/skills/security-audit/RESOURCE-EXHAUSTION-AND-AVAILABILITY.md +78 -0
  54. package/skills/security-audit/SKILL.md +192 -0
  55. package/skills/security-audit/SUPPLY-CHAIN-AND-RELEASE.md +73 -0
  56. package/skills/security-audit/VALIDATION-AND-REPORTING.md +186 -0
  57. package/skills/security-audit/WEB-PROTOCOL-AND-AUTH.md +105 -0
  58. package/skills/security-audit/report-schema.json +461 -0
  59. package/skills/security-audit/validate-coverage-ledger.cjs +872 -0
  60. package/skills/security-audit/validate-coverage-ledger.test.cjs +740 -0
  61. package/skills/security-audit/validate-findings.cjs +773 -0
  62. package/skills/security-audit/validate-findings.test.cjs +652 -0
  63. package/src/core/completion-artifacts.js +4 -7
  64. package/src/core/diagnosis.js +3 -5
  65. package/src/core/diagnostic-record.js +4 -4
  66. package/src/core/next-action-recovery-phases.js +3 -0
  67. package/src/core/next-action-review-correction.js +26 -0
  68. package/src/core/next-action-review-phase.js +11 -10
  69. package/src/core/reconcile-closure.js +5 -0
  70. package/src/core/review-correction.js +51 -0
  71. package/src/storage/capabilities.js +1 -1
package/skills/security-audit/report-schema.json ADDED
@@ -0,0 +1,461 @@
1
+ {
2
+ "$comment": "Top-level contract for findings.json. validate-findings.cjs interprets and checks this schema directly.",
3
+ "type": "array",
4
+ "items": {
5
+ "oneOf": [
6
+ {
7
+ "type": "object",
8
+ "description": "A source-grounded vulnerability that was independently demonstrated.",
9
+ "properties": {
10
+ "verdict": {
11
+ "type": "string",
12
+ "const": "confirmed"
13
+ },
14
+ "fingerprint": {
15
+ "type": "string",
16
+ "minLength": 1,
17
+ "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+-]*$",
18
+ "description": "A stable source-derived identifier that does not change between validation states."
19
+ },
20
+ "title": {
21
+ "type": "string",
22
+ "minLength": 1,
23
+ "visibleContent": true
24
+ },
25
+ "description": {
26
+ "type": "string",
27
+ "minLength": 1,
28
+ "visibleContent": true
29
+ },
30
+ "root_cause": {
31
+ "type": "string",
32
+ "minLength": 1,
33
+ "visibleContent": true
34
+ },
35
+ "intended_behavior": {
36
+ "type": "string",
37
+ "minLength": 1,
38
+ "visibleContent": true
39
+ },
40
+ "trace": {
41
+ "type": "array",
42
+ "minItems": 1,
43
+ "uniqueItems": true,
44
+ "items": {
45
+ "type": "object",
46
+ "properties": {
47
+ "kind": {
48
+ "type": "string",
49
+ "enum": ["entrypoint", "propagation", "sink"]
50
+ },
51
+ "file": {
52
+ "type": "string",
53
+ "minLength": 1
54
+ },
55
+ "line": {
56
+ "type": "integer",
57
+ "minimum": 1
58
+ },
59
+ "scope": {
60
+ "type": "string",
61
+ "minLength": 1,
62
+ "visibleContent": true
63
+ },
64
+ "description": {
65
+ "type": "string",
66
+ "minLength": 1,
67
+ "visibleContent": true
68
+ }
69
+ },
70
+ "required": ["kind", "file", "line", "scope", "description"],
71
+ "additionalProperties": false
72
+ }
73
+ },
74
+ "evidence": {
75
+ "type": "array",
76
+ "minItems": 1,
77
+ "uniqueItems": true,
78
+ "items": {
79
+ "type": "object",
80
+ "properties": {
81
+ "file": {
82
+ "type": "string",
83
+ "minLength": 1
84
+ },
85
+ "line": {
86
+ "type": "integer",
87
+ "minimum": 1
88
+ },
89
+ "description": {
90
+ "type": "string",
91
+ "minLength": 1,
92
+ "visibleContent": true
93
+ }
94
+ },
95
+ "required": ["file", "line", "description"],
96
+ "additionalProperties": false
97
+ }
98
+ },
99
+ "conditions": {
100
+ "type": "array",
101
+ "uniqueItems": true,
102
+ "items": {
103
+ "type": "object",
104
+ "properties": {
105
+ "kind": {
106
+ "type": "string",
107
+ "enum": ["authentication_level", "authorization_role", "user_interaction", "system_configuration", "network_routing", "environmental_dependency", "data_state", "timing_dependency", "third_party_dependency"]
108
+ },
109
+ "description": {
110
+ "type": "string",
111
+ "minLength": 1,
112
+ "visibleContent": true
113
+ }
114
+ },
115
+ "required": ["kind", "description"],
116
+ "additionalProperties": false
117
+ }
118
+ },
119
+ "execution": {
120
+ "type": "object",
121
+ "description": "Target-neutral reproduction in the target's native interface.",
122
+ "properties": {
123
+ "attacker_perspective": {
124
+ "type": "string",
125
+ "minLength": 1,
126
+ "visibleContent": true
127
+ },
128
+ "payloads": {
129
+ "type": "array",
130
+ "minItems": 1,
131
+ "uniqueItems": true,
132
+ "items": {
133
+ "type": "string"
134
+ }
135
+ },
136
+ "instructions": {
137
+ "type": "array",
138
+ "minItems": 1,
139
+ "items": {
140
+ "type": "string",
141
+ "minLength": 1,
142
+ "visibleContent": true
143
+ }
144
+ },
145
+ "observed_result": {
146
+ "type": "string",
147
+ "minLength": 1,
148
+ "visibleContent": true
149
+ }
150
+ },
151
+ "required": ["attacker_perspective", "payloads", "instructions", "observed_result"],
152
+ "additionalProperties": false
153
+ },
154
+ "remediation": {
155
+ "type": "object",
156
+ "properties": {
157
+ "strategy": {
158
+ "type": "string",
159
+ "minLength": 1,
160
+ "visibleContent": true
161
+ },
162
+ "code_changes": {
163
+ "type": "array",
164
+ "items": {
165
+ "type": "object",
166
+ "properties": {
167
+ "file_name": {
168
+ "type": "string",
169
+ "minLength": 1
170
+ },
171
+ "fixed_code": {
172
+ "type": "string"
173
+ }
174
+ },
175
+ "required": ["file_name", "fixed_code"],
176
+ "additionalProperties": false
177
+ }
178
+ }
179
+ },
180
+ "required": ["strategy"],
181
+ "additionalProperties": false
182
+ },
183
+ "severity": {
184
+ "type": "object",
185
+ "properties": {
186
+ "likelihood": {
187
+ "type": "object",
188
+ "properties": {
189
+ "score": {
190
+ "type": "string",
191
+ "enum": ["informational", "low", "medium", "high", "critical"]
192
+ },
193
+ "reason": {
194
+ "type": "string",
195
+ "minLength": 1,
196
+ "visibleContent": true
197
+ }
198
+ },
199
+ "required": ["score", "reason"],
200
+ "additionalProperties": false
201
+ },
202
+ "impact": {
203
+ "type": "object",
204
+ "properties": {
205
+ "score": {
206
+ "type": "string",
207
+ "enum": ["informational", "low", "medium", "high", "critical"]
208
+ },
209
+ "reason": {
210
+ "type": "string",
211
+ "minLength": 1,
212
+ "visibleContent": true
213
+ }
214
+ },
215
+ "required": ["score", "reason"],
216
+ "additionalProperties": false
217
+ },
218
+ "overall_severity": {
219
+ "type": "string",
220
+ "enum": ["informational", "low", "medium", "high", "critical"]
221
+ }
222
+ },
223
+ "required": ["likelihood", "impact", "overall_severity"],
224
+ "additionalProperties": false
225
+ },
226
+ "confidence": {
227
+ "type": "object",
228
+ "properties": {
229
+ "score": {
230
+ "type": "string",
231
+ "enum": ["low", "medium", "high"]
232
+ },
233
+ "reason": {
234
+ "type": "string",
235
+ "minLength": 1,
236
+ "visibleContent": true
237
+ }
238
+ },
239
+ "required": ["score", "reason"],
240
+ "additionalProperties": false
241
+ }
242
+ },
243
+ "required": ["verdict", "fingerprint", "title", "description", "root_cause", "intended_behavior", "trace", "evidence", "conditions", "execution", "remediation", "severity", "confidence"],
244
+ "additionalProperties": false
245
+ },
246
+ {
247
+ "type": "object",
248
+ "description": "A source-grounded candidate whose decisive validation is blocked.",
249
+ "properties": {
250
+ "verdict": {
251
+ "type": "string",
252
+ "const": "needs_validation"
253
+ },
254
+ "fingerprint": {
255
+ "type": "string",
256
+ "minLength": 1,
257
+ "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+-]*$"
258
+ },
259
+ "title": {
260
+ "type": "string",
261
+ "minLength": 1,
262
+ "visibleContent": true
263
+ },
264
+ "description": {
265
+ "type": "string",
266
+ "minLength": 1,
267
+ "visibleContent": true
268
+ },
269
+ "claimed_root_cause": {
270
+ "type": "string",
271
+ "minLength": 1,
272
+ "visibleContent": true
273
+ },
274
+ "trace": {
275
+ "type": "array",
276
+ "minItems": 1,
277
+ "uniqueItems": true,
278
+ "items": {
279
+ "type": "object",
280
+ "properties": {
281
+ "kind": {
282
+ "type": "string",
283
+ "enum": ["entrypoint", "propagation", "sink"]
284
+ },
285
+ "file": {
286
+ "type": "string",
287
+ "minLength": 1
288
+ },
289
+ "line": {
290
+ "type": "integer",
291
+ "minimum": 1
292
+ },
293
+ "scope": {
294
+ "type": "string",
295
+ "minLength": 1,
296
+ "visibleContent": true
297
+ },
298
+ "description": {
299
+ "type": "string",
300
+ "minLength": 1,
301
+ "visibleContent": true
302
+ }
303
+ },
304
+ "required": ["kind", "file", "line", "scope", "description"],
305
+ "additionalProperties": false
306
+ }
307
+ },
308
+ "evidence": {
309
+ "type": "array",
310
+ "minItems": 1,
311
+ "uniqueItems": true,
312
+ "items": {
313
+ "type": "object",
314
+ "properties": {
315
+ "file": {
316
+ "type": "string",
317
+ "minLength": 1
318
+ },
319
+ "line": {
320
+ "type": "integer",
321
+ "minimum": 1
322
+ },
323
+ "description": {
324
+ "type": "string",
325
+ "minLength": 1,
326
+ "visibleContent": true
327
+ }
328
+ },
329
+ "required": ["file", "line", "description"],
330
+ "additionalProperties": false
331
+ }
332
+ },
333
+ "blockers": {
334
+ "type": "array",
335
+ "minItems": 1,
336
+ "uniqueItems": true,
337
+ "items": {
338
+ "type": "string",
339
+ "minLength": 1,
340
+ "visibleContent": true
341
+ }
342
+ },
343
+ "validation_plan": {
344
+ "type": "object",
345
+ "properties": {
346
+ "local": {
347
+ "type": "string",
348
+ "minLength": 1,
349
+ "visibleContent": true
350
+ },
351
+ "deployment": {
352
+ "type": "string",
353
+ "minLength": 1,
354
+ "visibleContent": true
355
+ }
356
+ },
357
+ "additionalProperties": false
358
+ }
359
+ },
360
+ "required": ["verdict", "fingerprint", "title", "description", "claimed_root_cause", "trace", "evidence", "blockers", "validation_plan"],
361
+ "additionalProperties": false
362
+ },
363
+ {
364
+ "type": "object",
365
+ "description": "A source-grounded candidate refuted during validation.",
366
+ "properties": {
367
+ "verdict": {
368
+ "type": "string",
369
+ "const": "rejected"
370
+ },
371
+ "fingerprint": {
372
+ "type": "string",
373
+ "minLength": 1,
374
+ "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+-]*$"
375
+ },
376
+ "title": {
377
+ "type": "string",
378
+ "minLength": 1,
379
+ "visibleContent": true
380
+ },
381
+ "description": {
382
+ "type": "string",
383
+ "minLength": 1,
384
+ "visibleContent": true
385
+ },
386
+ "claimed_root_cause": {
387
+ "type": "string",
388
+ "minLength": 1,
389
+ "visibleContent": true
390
+ },
391
+ "trace": {
392
+ "type": "array",
393
+ "minItems": 1,
394
+ "uniqueItems": true,
395
+ "items": {
396
+ "type": "object",
397
+ "properties": {
398
+ "kind": {
399
+ "type": "string",
400
+ "enum": ["entrypoint", "propagation", "sink"]
401
+ },
402
+ "file": {
403
+ "type": "string",
404
+ "minLength": 1
405
+ },
406
+ "line": {
407
+ "type": "integer",
408
+ "minimum": 1
409
+ },
410
+ "scope": {
411
+ "type": "string",
412
+ "minLength": 1,
413
+ "visibleContent": true
414
+ },
415
+ "description": {
416
+ "type": "string",
417
+ "minLength": 1,
418
+ "visibleContent": true
419
+ }
420
+ },
421
+ "required": ["kind", "file", "line", "scope", "description"],
422
+ "additionalProperties": false
423
+ }
424
+ },
425
+ "evidence": {
426
+ "type": "array",
427
+ "minItems": 1,
428
+ "uniqueItems": true,
429
+ "items": {
430
+ "type": "object",
431
+ "properties": {
432
+ "file": {
433
+ "type": "string",
434
+ "minLength": 1
435
+ },
436
+ "line": {
437
+ "type": "integer",
438
+ "minimum": 1
439
+ },
440
+ "description": {
441
+ "type": "string",
442
+ "minLength": 1,
443
+ "visibleContent": true
444
+ }
445
+ },
446
+ "required": ["file", "line", "description"],
447
+ "additionalProperties": false
448
+ }
449
+ },
450
+ "reason": {
451
+ "type": "string",
452
+ "minLength": 1,
453
+ "visibleContent": true
454
+ }
455
+ },
456
+ "required": ["verdict", "fingerprint", "title", "description", "claimed_root_cause", "trace", "evidence", "reason"],
457
+ "additionalProperties": false
458
+ }
459
+ ]
460
+ }
461
+ }