@curdx/flow 1.1.11 → 2.0.0-beta.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (66) hide show
  1. package/.claude-plugin/marketplace.json +3 -3
  2. package/.claude-plugin/plugin.json +2 -2
  3. package/CHANGELOG.md +79 -0
  4. package/README.md +74 -102
  5. package/agents/flow-adversary.md +1 -1
  6. package/agents/flow-architect.md +1 -1
  7. package/agents/flow-product-designer.md +1 -1
  8. package/agents/flow-qa-engineer.md +3 -3
  9. package/agents/flow-researcher.md +1 -1
  10. package/agents/flow-security-auditor.md +1 -1
  11. package/agents/flow-triage-analyst.md +3 -3
  12. package/agents/flow-ui-researcher.md +5 -5
  13. package/agents/flow-ux-designer.md +2 -2
  14. package/cli/install.js +16 -5
  15. package/commands/debug.md +10 -10
  16. package/commands/help.md +109 -87
  17. package/commands/implement.md +4 -4
  18. package/commands/init.md +5 -5
  19. package/commands/review.md +114 -130
  20. package/commands/spec.md +131 -89
  21. package/commands/start.md +100 -153
  22. package/commands/verify.md +110 -92
  23. package/gates/adversarial-review-gate.md +1 -1
  24. package/gates/coverage-audit-gate.md +1 -1
  25. package/gates/devex-gate.md +1 -1
  26. package/gates/edge-case-gate.md +1 -1
  27. package/gates/security-gate.md +3 -3
  28. package/hooks/scripts/session-start.sh +1 -1
  29. package/knowledge/epic-decomposition.md +2 -2
  30. package/knowledge/execution-strategies.md +4 -4
  31. package/knowledge/planning-reviews.md +6 -6
  32. package/knowledge/spec-driven-development.md +3 -3
  33. package/knowledge/two-stage-review.md +2 -2
  34. package/knowledge/wave-execution.md +5 -5
  35. package/package.json +1 -1
  36. package/agents/persona-amelia.md +0 -128
  37. package/agents/persona-david.md +0 -141
  38. package/agents/persona-emma.md +0 -179
  39. package/agents/persona-john.md +0 -105
  40. package/agents/persona-mary.md +0 -95
  41. package/agents/persona-oliver.md +0 -136
  42. package/agents/persona-rachel.md +0 -126
  43. package/agents/persona-serena.md +0 -175
  44. package/agents/persona-winston.md +0 -117
  45. package/commands/audit.md +0 -170
  46. package/commands/autoplan.md +0 -184
  47. package/commands/design.md +0 -155
  48. package/commands/discuss.md +0 -162
  49. package/commands/doctor.md +0 -124
  50. package/commands/index.md +0 -261
  51. package/commands/install-deps.md +0 -128
  52. package/commands/party.md +0 -241
  53. package/commands/plan-ceo.md +0 -117
  54. package/commands/plan-design.md +0 -107
  55. package/commands/plan-dx.md +0 -104
  56. package/commands/plan-eng.md +0 -108
  57. package/commands/qa.md +0 -118
  58. package/commands/requirements.md +0 -146
  59. package/commands/research.md +0 -141
  60. package/commands/security.md +0 -109
  61. package/commands/sketch.md +0 -118
  62. package/commands/spike.md +0 -181
  63. package/commands/status.md +0 -139
  64. package/commands/switch.md +0 -95
  65. package/commands/tasks.md +0 -189
  66. package/commands/triage.md +0 -160
package/commands/help.md CHANGED
@@ -1,119 +1,141 @@
1
1
  ---
2
2
  name: help
3
- description: CurDX-Flow help (command list, workflow overview, troubleshooting)
3
+ description: Show CurDX-Flow command list, workflow overview, or troubleshooting guide. With a command name, show that command's detail.
4
4
  argument-hint: "[<command-name> | workflow | troubleshoot]"
5
- allowed-tools: [Read]
5
+ allowed-tools: [Read, Bash]
6
6
  ---
7
7
 
8
8
  # CurDX-Flow Help
9
9
 
10
- ## No ArgumentsQuick Overview
10
+ ## No argumentquick overview
11
+
12
+ Show the 9 core slash commands + 5 auto-invoked skills. Keep the table compact, use tabs for alignment.
11
13
 
12
14
  ```
13
- 🚀 CurDX-Flow — AI Engineering Workflow Meta-Framework
14
-
15
- Current version: 0.1.0 (Phase 0 — Foundation)
16
-
17
- ╔══════════════════════════════════════════════════════════════╗
18
- Command overview (Phase 0 implemented) ║
19
- ╠══════════════════════════════════════════════════════════════╣
20
- /curdx-flow:init Initialize .flow/ project structure ║
21
- /curdx-flow:install-deps One-shot install of recommended plugins ║
22
- /curdx-flow:doctor Health check (deps + project config)
23
- /curdx-flow:status View spec and phase status ║
24
- /curdx-flow:help This help ║
25
- ╚══════════════════════════════════════════════════════════════╝
26
-
27
- Coming soon (Phase 1+):
28
- /curdx-flow:start / /curdx-flow:research / /curdx-flow:requirements / /curdx-flow:design
29
- /curdx-flow:tasks / /curdx-flow:implement / /curdx-flow:verify / /curdx-flow:review
30
- /curdx-flow:triage / /curdx-flow:party / /curdx-flow:debug / /curdx-flow:qa / /curdx-flow:sketch
31
- /curdx-flow:ship / /curdx-flow:land / /curdx-flow:canary / /curdx-flow:retro ...
32
-
33
- Usage:
34
- /curdx-flow:help <command> View detailed usage for a command
35
- /curdx-flow:help workflow Introduce the full workflow
36
- /curdx-flow:help troubleshoot Common troubleshooting
15
+ 🚀 CurDX-Flow v2 Claude Code Discipline Layer
16
+
17
+ 9 slash commands (explicit control)
18
+ ────────────────────────────────────
19
+ /curdx-flow:init Initialize .flow/ in the current project
20
+ /curdx-flow:start Create / resume / switch a feature spec
21
+ /curdx-flow:spec Write or refresh the spec (--phase, --review, --regenerate)
22
+ /curdx-flow:implement Execute the tasks (auto-routed strategy)
23
+ /curdx-flow:verify Goal-backward verification the differentiator
24
+ /curdx-flow:review Two-stage code review (+ --adversarial, --edge-case)
25
+ /curdx-flow:fast Skip the spec one-shot small task
26
+ /curdx-flow:debug Systematic 4-stage debugging
27
+ /curdx-flow:help This help
28
+
29
+ 5 skills (auto-invoked by Claude based on context)
30
+ ────────────────────────────────────
31
+ epic Decompose a large feature into vertical-slice sub-specs
32
+ browser-qa Real-browser test via chrome-devtools MCP
33
+ ui-sketch Generate UI design variants (via frontend-design skill)
34
+ security-audit OWASP + STRIDE + CVE scan
35
+ brownfield-index Map an unfamiliar / legacy codebase
36
+
37
+ 3 MCP servers auto-installed
38
+ ────────────────────────────────────
39
+ context7 Latest library docs
40
+ sequential-thinking Structured reasoning
41
+ chrome-devtools Browser automation
42
+
43
+ Usage:
44
+ /curdx-flow:help <command> Detail for one command
45
+ /curdx-flow:help workflow Standard workflow walkthrough
46
+ /curdx-flow:help troubleshoot Common problems
37
47
  ```
38
48
 
39
- ## `<command-name>` — Command Details
49
+ ## `<command-name>` — command detail
40
50
 
41
- Based on the argument, read and display the corresponding command file (in a user-friendly format):
51
+ When the argument matches one of the 9 commands, read the corresponding `commands/<name>.md` from the plugin cache and present it cleanly:
42
52
 
43
53
  ```bash
44
- cat "${CLAUDE_PLUGIN_ROOT}/commands/${COMMAND}.md"
54
+ PLUGIN=$(ls -dt "$HOME/.claude/plugins/cache/curdx-flow-marketplace/curdx-flow/"*/ 2>/dev/null | head -1)
55
+ CMD="$1"
56
+ cat "$PLUGIN/commands/$CMD.md"
45
57
  ```
46
58
 
47
- ## `workflow` Workflow Overview
59
+ If the argument isn't a known command, list the 9 candidates and the 5 skill names.
60
+
61
+ ## `workflow` — standard workflow
48
62
 
49
63
  ```
50
- 📐 CurDX-Flow Standard Workflow
51
-
52
- 1. Foundation (one-time)
53
- └─ /curdx-flow:install-deps → /curdx-flow:init /curdx-flow:doctor
54
-
55
- 2. Per feature (Feature Workflow)
56
- ├─ Research /curdx-flow:research (optional)
57
- ├─ Requirements /curdx-flow:requirements (required)
58
- ├─ Design /curdx-flow:design (required)
59
- ├─ Tasks /curdx-flow:tasks (required)
60
- ├─ Execute /curdx-flow:implement (required)
61
- ├─ Verify /curdx-flow:verify (required)
62
- ├─ Review /curdx-flow:review (recommended)
63
- └─ Ship /curdx-flow:ship (recommended)
64
-
65
- 3. Large feature (Epic Workflow)
66
- └─ /curdx-flow:triage split into multiple specs advanced in parallel
67
-
68
- 4. Ultra-fast path (Fast Path)
69
- └─ /curdx-flow:fast "description" — skip specs and execute directly
70
-
71
- 5. Prototype exploration (Sketch Path)
72
- └─ /curdx-flow:sketch "description" UI design drafts
73
-
74
- Five modes (configured via .flow/config.json):
75
- sketch — Rapid prototyping
76
- fast One-shot tasks
77
- standard — Regular features (default)
78
- enterprise Full SDLC + multi-agent collaboration
79
- autonomous — Overnight automation
64
+ 📐 CurDX-Flow v2 Standard Workflow
65
+
66
+ 1. One-time setup (outside Claude Code)
67
+ └─ npx @curdx/flow install --all
68
+
69
+ 2. Per project (in Claude Code)
70
+ └─ /curdx-flow:init
71
+
72
+ 3. Per feature — the main loop
73
+ ├─ /curdx-flow:start my-feature "one-line goal"
74
+ ├─ /curdx-flow:spec ← research → requirements → design → tasks
75
+ ├─ (optional) /curdx-flow:spec --review ← add multi-dim planning review
76
+ ├─ /curdx-flow:implement ← execute tasks
77
+ ├─ /curdx-flow:verify ← goal-backward check
78
+ └─ /curdx-flow:review ← code review
79
+
80
+ 4. Big feature (breaks into multiple specs)
81
+ └─ Say "this feature is too big, break it down" → epic skill auto-invokes
82
+
83
+ 5. One-off task (skip the spec)
84
+ └─ /curdx-flow:fast "rename foo to bar in src/"
85
+
86
+ 6. Stuck on a bug
87
+ └─ /curdx-flow:debug "tests fail intermittently after 3rd run"
88
+
89
+ Modes (set via /curdx-flow:start --mode=...)
90
+ fast One-off task paths
91
+ standard Default spec + gates + review
92
+ enterprise Standard + adversarial + edge-case + security-audit
80
93
  ```
81
94
 
82
- ## `troubleshoot` — Common Issues
95
+ ## `troubleshoot` — common issues
83
96
 
84
97
  ```
85
- 🛠️ Common Troubleshooting
98
+ 🛠️ Common issues
99
+
100
+ Q: After install, /curdx-flow:* commands are not found.
101
+ A: Restart Claude Code. The plugin needs a fresh session to register.
102
+
103
+ Q: MCP servers not starting?
104
+ A: Check Node >= 18: node --version
105
+ Check MCPs: claude mcp list
106
+ Health overall: npx @curdx/flow doctor
107
+
108
+ Q: GitHub slow / blocked during install?
109
+ A: v1.1.5+ defaults to offline install (bundled plugin body).
110
+ Force-offline: npx @curdx/flow install --no-deps
111
+ Force-online: npx @curdx/flow install --online
86
112
 
87
- Q: 3 MCPs did not start?
88
- A: Check Node.js >= 18: `node --version`
89
- View MCP status: `claude mcp list`
90
- Restart Claude Code
113
+ Q: claude-mem MCP keeps failing?
114
+ A: It needs bun. Run: npx @curdx/flow doctor — it auto-symlinks bun if installed.
91
115
 
92
- Q: Recommended-plugins prompt keeps appearing?
93
- A: Run /curdx-flow:install-deps to install, or create the marker file manually:
94
- touch "${CLAUDE_PLUGIN_DATA}/.deps-checked"
116
+ Q: /curdx-flow:init says .flow/ already exists?
117
+ A: Use --force, or run /curdx-flow:start directly to begin a new spec in the existing .flow/.
95
118
 
96
- Q: /curdx-flow:init reports "directory already exists"?
97
- A: An existing .flow/ is already initialized. Run /curdx-flow:status to view, or use --force to overwrite.
119
+ Q: Skills don't auto-invoke reliably?
120
+ A: Invoke explicitly every skill also has a /skill-name slash. E.g., /curdx-flow:security-audit.
98
121
 
99
- Q: Agents do not call context7 / sequential-thinking?
100
- A: Make sure preamble.md is loaded (InstructionsLoaded hook).
101
- Run /curdx-flow:doctor to check MCP status.
122
+ Q: I want the old v1 commands (research, plan-ceo, party…).
123
+ A: They're removed in v2. See MIGRATION.md for mappings, or stay on 1.x:
124
+ npm i -g @curdx/flow@^1.1
102
125
 
103
- Q: Do claude-mem and .flow/STATE.md conflict?
104
- A: No. claude-mem lives at ~/.claude-mem/ (SQLite), curdx-flow lives at .flow/ (JSON+MD).
105
- Division of duties: claude-mem for automatic implicit memory, STATE.md for explicit decisions.
126
+ Q: Too many gates blocking progress?
127
+ A: Your spec mode decides gate strictness. Lower via:
128
+ /curdx-flow:start <name> "<goal>" --mode=fast
106
129
 
107
- Q: pua is too aggressive, can it be turned off?
108
- A: pua is an independent plugin, you can /plugin disable pua.
109
- Enabling pua does not affect curdx-flow's core features (the three red lines are built into preamble).
130
+ Q: Where are decisions logged?
131
+ A: .flow/STATE.md (D-NN entries). Edit directly no slash command needed.
110
132
 
111
- Q: Want to contribute / report a bug?
112
- A: https://github.com/wdx/curdx-flow/issues
133
+ Q: File a bug / request feature
134
+ A: https://github.com/curdx/curdx-flow/issues
113
135
  ```
114
136
 
115
- ## Output Principles
137
+ ## Output principles
116
138
 
117
- - Stay concise; use tables and lists instead of long prose
118
- - Every answer points to a specific command; avoid filler like "please consult the docs"
119
- - Prioritize showing the user's next actionable step
139
+ - Keep it compact. Use tables and lists, not prose.
140
+ - Always point at a concrete next action, not "see the docs".
141
+ - Version number should come from `cli/utils.js` dynamic read, not hard-coded.
@@ -38,7 +38,7 @@ done
38
38
  [ -z "$SPEC_NAME" ] && { echo "❌ No active spec. Run /curdx-flow:start first"; exit 1; }
39
39
 
40
40
  DIR=".flow/specs/$SPEC_NAME"
41
- [ ! -f "$DIR/tasks.md" ] && { echo "❌ Missing tasks.md. Run /curdx-flow:tasks first"; exit 1; }
41
+ [ ! -f "$DIR/tasks.md" ] && { echo "❌ Missing tasks.md. Run /curdx-flow:spec first (or /curdx-flow:spec --phase=tasks to rebuild just the tasks phase)"; exit 1; }
42
42
  ```
43
43
 
44
44
  ## Step 2: Parse Task Characteristics from tasks.md
@@ -275,7 +275,7 @@ len(failed) == 1:
275
275
 
276
276
  len(failed) >= 2:
277
277
  → likely environment issue (missing deps/tsc error/permissions)
278
- → stop immediately, suggest /curdx-flow:doctor
278
+ → stop immediately, suggest npx @curdx/flow doctor
279
279
 
280
280
  failed_attempts >= 3 (cumulative):
281
281
  → stop, user intervention required
@@ -357,10 +357,10 @@ if all tasks done:
357
357
 
358
358
  ## Error Recovery
359
359
 
360
- - Verify field in tasks.md is "manual" → stop, suggest re-running /curdx-flow:tasks to fix
360
+ - Verify field in tasks.md is "manual" → stop, suggest re-running `/curdx-flow:spec --phase=tasks --regenerate` to fix
361
361
  - 3 consecutive TASK_FAILED → stop, prompt for user intervention
362
362
  - git operation failure → stop immediately, do not continue (avoid state corruption)
363
- - Test framework not found (npm test not found) → stop, suggest running /curdx-flow:doctor
363
+ - Test framework not found (npm test not found) → stop, suggest running npx @curdx/flow doctor
364
364
 
365
365
  ## Output to User
366
366
 
package/commands/init.md CHANGED
@@ -22,7 +22,7 @@ ls -la
22
22
  - If the current directory is a dangerous location such as the home directory or a system directory, stop and ask the user to switch
23
23
  - If `.flow/` already exists:
24
24
  - With `--force` → continue but warn about overwriting
25
- - Without `--force` → stop and prompt the user to run `/curdx-flow:status` to inspect the existing state
25
+ - Without `--force` → stop and prompt the user to inspect `.flow/` directly, or run `/curdx-flow:start --list` to see existing specs
26
26
 
27
27
  ### Step 2: Create Directory Skeleton
28
28
 
@@ -71,7 +71,7 @@ Append (if not already present):
71
71
 
72
72
  ### Step 5: Health Check
73
73
 
74
- Run `/curdx-flow:doctor` (or inline its checks) to verify:
74
+ Run `npx @curdx/flow doctor` (or inline its checks) to verify:
75
75
  - 3 MCPs started (context7 / sequential-thinking / chrome-devtools)
76
76
  - Recommended plugins status (pua / claude-mem / frontend-design)
77
77
 
@@ -90,9 +90,9 @@ Output:
90
90
 
91
91
  Next steps (in order):
92
92
  1. Edit .flow/PROJECT.md to add the project goal
93
- 2. /curdx-flow:install-deps install recommended plugins (if not installed)
94
- 3. /curdx-flow:doctor — verify health
95
- 4. /curdx-flow:status view project status
93
+ 2. (already handled) — recommended plugins installed via `npx @curdx/flow install --all`
94
+ 3. npx @curdx/flow doctor — verify health
95
+ 4. /curdx-flow:start <name> "<goal>" begin your first feature spec
96
96
 
97
97
  Start development (after Phase 1 ships):
98
98
  5. /curdx-flow:start <name> "<goal>" — kick off the first spec
@@ -1,168 +1,152 @@
1
1
  ---
2
2
  name: review
3
- description: Two-Stage Review — Stage 1 spec compliance + Stage 2 code quality. Applies enabled Gates. Dispatches flow-reviewer.
4
- argument-hint: "[spec-name] [--adversarial | --edge-case | --both]"
3
+ description: Two-stage code review — Stage 1 spec compliance, Stage 2 code quality. Optional flags add adversarial review or edge-case hunting.
4
+ argument-hint: "[--stage=<1|2|both>] [--adversarial] [--edge-case]"
5
5
  allowed-tools: [Read, Bash, Task, Grep, Glob]
6
6
  ---
7
7
 
8
- # Flow Review — Two-Stage Code Review
8
+ # Two-Stage Code Review
9
9
 
10
- @${CLAUDE_PLUGIN_ROOT}/knowledge/two-stage-review.md
10
+ Distinct from `/curdx-flow:verify`:
11
+ - **verify** checks that the spec's stated goals actually work (goal-backward).
12
+ - **review** checks that the code is good (spec compliance + craftsmanship).
11
13
 
12
- Dispatches the `flow-reviewer` agent to perform a Two-Stage Review: Stage 1 compliance + Stage 2 quality.
13
- Optionally layer on deep reviews from `flow-adversary` and `flow-edge-hunter`.
14
+ ## Flags
14
15
 
15
- ## When to use
16
+ | Flag | Default | Purpose |
17
+ |------|---------|---------|
18
+ | `--stage=<1\|2\|both>` | `both` | Stage 1 = spec compliance only. Stage 2 = code quality only. `both` = sequential. |
19
+ | `--adversarial` | off | Add an adversarial review pass (6 dimensions × 2 sequential-thinking rounds). Zero-findings forbidden. |
20
+ | `--edge-case` | off | Add edge-case hunting across the 7 categories. Produces a test-gap checklist. |
16
21
 
17
- - After `/curdx-flow:verify` passes
18
- - Before PR
19
- - When the user explicitly requests a deep review (add --adversarial / --edge-case / --both)
20
-
21
- ## Step 1: Parse arguments
22
+ ## Preflight
22
23
 
23
24
  ```bash
24
- ARGS="$ARGUMENTS"
25
- ADV=0; EDGE=0
26
- case "$ARGS" in
27
- *--both*) ADV=1; EDGE=1 ;;
28
- *--adversarial*) ADV=1 ;;
29
- *--edge-case*) EDGE=1 ;;
30
- esac
31
-
32
- SPEC_NAME=$(echo "$ARGS" | sed 's/--[a-z-]*//g' | xargs)
33
- [ -z "$SPEC_NAME" ] && SPEC_NAME=$(cat .flow/.active-spec 2>/dev/null)
34
- [ -z "$SPEC_NAME" ] && { echo "❌ No active spec"; exit 1; }
25
+ [ ! -d ".flow" ] && { echo "✗ Not a CurDX-Flow project."; exit 1; }
26
+
27
+ SPEC_NAME=$(cat .flow/.active-spec 2>/dev/null)
28
+ [ -z "$SPEC_NAME" ] && { echo "✗ No active spec."; exit 1; }
29
+
30
+ # Review needs a design.md + implementation to compare against
31
+ for f in design.md; do
32
+ [ ! -f ".flow/specs/$SPEC_NAME/$f" ] && {
33
+ echo "✗ Missing $f. Run /curdx-flow:spec first.";
34
+ exit 1;
35
+ }
36
+ done
37
+
38
+ FLAG_STAGE=$(echo "$ARGUMENTS" | grep -oP -- '--stage=\K[^\s]+' || echo "both")
39
+ FLAG_ADV=$(echo "$ARGUMENTS" | grep -q -- '--adversarial' && echo 1 || echo 0)
40
+ FLAG_EDGE=$(echo "$ARGUMENTS" | grep -q -- '--edge-case' && echo 1 || echo 0)
35
41
  ```
36
42
 
37
- ## Step 2: Preflight checks
43
+ ## Stage 1 Spec compliance
38
44
 
39
- ```bash
40
- DIR=".flow/specs/$SPEC_NAME"
45
+ Dispatch `flow-reviewer` in Stage 1 mode. It checks:
46
+ - Implementation actually addresses every US / AC / FR / NFR in `requirements.md`
47
+ - Code structure reflects AD-NN decisions from `design.md`
48
+ - Task checklist in `tasks.md` is genuinely complete (all tasks marked `[x]` have real code)
49
+ - Conventional-commit log (`git log`) matches the tasks declared completed
41
50
 
42
- # If /curdx-flow:verify hasn't been run, prompt to run it first
43
- if [ ! -f "$DIR/verification-report.md" ]; then
44
- echo "⚠ /curdx-flow:verify not run. Recommend running goal-reverse verification first."
45
- echo "Continue? (y/N)"
46
- # AskUserQuestion
47
- fi
48
- ```
51
+ Output: Stage-1 section of the report with any compliance gaps.
49
52
 
50
- ## Step 3: Dispatch flow-reviewer (core)
53
+ ## Stage 2 Code quality
51
54
 
52
- ```
53
- Task:
54
- subagent_type: general-purpose
55
- description: "Review $SPEC_NAME"
56
- prompt: |
57
- You are the flow-reviewer agent. Full definition:
58
- ${CLAUDE_PLUGIN_ROOT}/agents/flow-reviewer.md
59
-
60
- Spec files to read:
61
- - .flow/specs/$SPEC_NAME/requirements.md
62
- - .flow/specs/$SPEC_NAME/design.md
63
- - .flow/specs/$SPEC_NAME/tasks.md
64
- - .flow/specs/$SPEC_NAME/.state.json
65
- - .flow/specs/$SPEC_NAME/verification-report.md (if exists)
66
-
67
- Enabled Gates (from .flow/config.json):
68
- - karpathy-gate (always)
69
- - verification-gate (always)
70
- - tdd-gate (standard+)
71
- - coverage-audit-gate (standard+)
72
-
73
- Tasks:
74
- Stage 1: Spec compliance review
75
- - Judge each FR / AC / AD / error path as ✓/⚠/✗
76
- - Check Out of Scope adherence
77
-
78
- Stage 2: Code quality review
79
- - Apply all enabled Gates
80
- - Emit per-Gate check results
81
-
82
- Combined verdict:
83
- - APPROVED / APPROVED_WITH_WARNINGS / NEEDS_FIXES / BLOCKED
84
-
85
- Output:
86
- .flow/specs/$SPEC_NAME/review-report.md
87
-
88
- Return a brief to me: Stage 1/2 verdicts, blocking/warning counts, and the top 3 fix suggestions
89
- ```
55
+ Dispatch `flow-reviewer` in Stage 2 mode. It checks:
56
+ - Naming, comments, structure
57
+ - Error handling completeness
58
+ - Test coverage and test quality
59
+ - Performance / resource usage concerns
60
+ - Security smells (not a full security audit — that's `security-audit` skill)
61
+ - Karpathy 4 principles applied
90
62
 
91
- ## Step 4 (optional): Dispatch flow-adversary
63
+ Output: Stage-2 section of the report.
64
+
65
+ ## Optional: adversarial review
92
66
 
93
67
  If `--adversarial`:
68
+ Dispatch `flow-adversary`. It runs 6 dimensions × 2 rounds of `sequential-thinking`:
69
+ 1. What's missing?
70
+ 2. What's overengineered?
71
+ 3. What would break first in production?
72
+ 4. What's undocumented that a new maintainer would misunderstand?
73
+ 5. What decision locks us out of a future option?
74
+ 6. What would a skeptical reviewer reject?
94
75
 
95
- ```
96
- Task:
97
- subagent_type: general-purpose
98
- description: "Adversarial review $SPEC_NAME"
99
- prompt: |
100
- You are the flow-adversary agent. Full definition:
101
- ${CLAUDE_PLUGIN_ROOT}/agents/flow-adversary.md
102
-
103
- Core rule: zero findings are forbidden — must find ≥ 3 categories of issues
104
-
105
- Scan:
106
- - .flow/specs/$SPEC_NAME/*.md
107
- - Related code (git diff)
108
- - Recent commits
109
-
110
- Use sequential-thinking ≥ 12 rounds (2 rounds × 6 dimensions)
111
-
112
- Output: .flow/specs/$SPEC_NAME/adversarial-review.md
113
- ```
76
+ **Zero findings are forbidden** — if the agent reports "all good", re-dispatch with stronger skepticism. Per `@${CLAUDE_PLUGIN_ROOT}/gates/adversarial-review-gate.md`.
114
77
 
115
- ## Step 5 (optional): Dispatch flow-edge-hunter
78
+ ## Optional: edge-case hunting
116
79
 
117
80
  If `--edge-case`:
81
+ Dispatch `flow-edge-hunter` across the 7 categories:
82
+ 1. Boundary values (0, MAX, empty, one-over-limit)
83
+ 2. Concurrency / race conditions
84
+ 3. Network failure / partial failure
85
+ 4. Malformed input
86
+ 5. Permission / auth failure
87
+ 6. Resource exhaustion
88
+ 7. Time / locale / timezone
118
89
 
119
- ```
120
- Task:
121
- subagent_type: general-purpose
122
- description: "Edge-case scan $SPEC_NAME"
123
- prompt: |
124
- You are the flow-edge-hunter agent. Full definition:
125
- ${CLAUDE_PLUGIN_ROOT}/agents/flow-edge-hunter.md
126
-
127
- Scan the subject's coverage across 7 categories:
128
- - Boundary values / nulls / concurrency / error recovery / security / i18n / performance
129
-
130
- Use sequential-thinking ≥ 3 rounds per category
131
-
132
- Output: .flow/specs/$SPEC_NAME/edge-cases.md
133
- ```
90
+ Output: test-gap checklist with suggested test cases.
134
91
 
135
- ## Step 6: Read reports + aggregate verdict
92
+ ## Report
136
93
 
137
- ```bash
138
- MAIN_REPORT="$DIR/review-report.md"
139
- ADV_REPORT="$DIR/adversarial-review.md"
140
- EDGE_REPORT="$DIR/edge-cases.md"
94
+ **Landing check**: sub-agent responses can be truncated. After dispatching review agents, verify the report actually landed on disk:
141
95
 
142
- # Parse the verdict from review-report.md
143
- VERDICT=$(grep -E "^## Verdict:" "$MAIN_REPORT" | head -1 | sed 's/## Verdict: //')
96
+ ```bash
97
+ REPORT=".flow/specs/$SPEC_NAME/review-report.md"
98
+ if [ ! -f "$REPORT" ] || [ "$(wc -c < "$REPORT" 2>/dev/null | tr -d ' ')" -lt 300 ]; then
99
+ echo "⚠ Report missing or truncated. Re-dispatching flow-reviewer with a terse 'Write the report now, no narration' prompt."
100
+ fi
144
101
  ```
145
102
 
146
- ## Step 7: Output to user
103
+ Consolidated output: `.flow/specs/$SPEC_NAME/review-report.md`:
104
+
105
+ ```markdown
106
+ # Review Report — <spec-name>
107
+
108
+ ## Stage 1 — Spec Compliance
109
+ - ✓ FR-01: implemented in src/auth.ts
110
+ - ✗ FR-04: missing — add handler for token refresh
111
+ - ⚠ AC-2.1: no integration test asserting 403 on expired token
147
112
 
113
+ ## Stage 2 — Code Quality
114
+ - Blocker: duplicated error-handling pattern in 3 files — extract helper
115
+ - Warning: function foo() in src/a.ts: 90 lines, split
116
+ - Nit: inconsistent naming (getUserId vs fetchUser)
117
+
118
+ ## Adversarial (if run)
119
+ ...
120
+
121
+ ## Edge Cases (if run)
122
+ ...
123
+
124
+ ## Verdict
125
+ - [ ] APPROVED
126
+ - [X] CHANGES REQUIRED — <n> blockers
127
+ - [ ] REJECTED
148
128
  ```
149
- ✓ Review complete: $SPEC_NAME
150
129
 
151
- Main report: .flow/specs/$SPEC_NAME/review-report.md
152
- Verdict: $VERDICT
130
+ ## Reporting
131
+
132
+ ```
133
+ ✓ Review complete
134
+ Stage 1 findings: <n>
135
+ Stage 2 findings: <n>
136
+ Adversarial findings: <n> (if --adversarial)
137
+ Edge-case gaps: <n> (if --edge-case)
138
+ Verdict: CHANGES REQUIRED
153
139
 
154
- $([ "$ADV" = "1" ] && echo "Adversarial review: $ADV_REPORT")
155
- $([ "$EDGE" = "1" ] && echo "Edge-case scan: $EDGE_REPORT")
140
+ Report: .flow/specs/<name>/review-report.md
156
141
 
157
- Next steps:
158
- $([ "$VERDICT" = "APPROVED" ] && echo " ✓ Proceed to /curdx-flow:ship (Phase 6+)")
159
- $([ "$VERDICT" = "APPROVED_WITH_WARNINGS" ] && echo " ⚠ Recommend fixing warnings first, then /curdx-flow:ship")
160
- $([ "$VERDICT" = "NEEDS_FIXES" ] && echo " ❌ Fix blockers → /curdx-flow:implement --task=... → /curdx-flow:review re-review")
161
- $([ "$VERDICT" = "BLOCKED_BY_SPEC" ] && echo " ❌ Back to /curdx-flow:implement to fill missing FR/AD")
142
+ Next: address blockers, then re-run /curdx-flow:review.
162
143
  ```
163
144
 
164
- ## Error recovery
145
+ ## References
165
146
 
166
- - review-report.md generation fails → check agent turn limit, reduce spec scope
167
- - Agent returns no findings (violates adversarial zero-tolerance) agent auto-triggers Round 2
168
- - Multiple concurrent agents produce conflicting files → run sequentially, not in parallel
147
+ - `flow-reviewer` agent: `@${CLAUDE_PLUGIN_ROOT}/agents/flow-reviewer.md`
148
+ - `flow-adversary` agent: `@${CLAUDE_PLUGIN_ROOT}/agents/flow-adversary.md`
149
+ - `flow-edge-hunter` agent: `@${CLAUDE_PLUGIN_ROOT}/agents/flow-edge-hunter.md`
150
+ - `adversarial-review-gate`: `@${CLAUDE_PLUGIN_ROOT}/gates/adversarial-review-gate.md`
151
+ - `edge-case-gate`: `@${CLAUDE_PLUGIN_ROOT}/gates/edge-case-gate.md`
152
+ - Knowledge: `@${CLAUDE_PLUGIN_ROOT}/knowledge/two-stage-review.md`