@curdx/flow 1.1.11 → 2.0.0-beta.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.claude-plugin/marketplace.json +3 -3
- package/.claude-plugin/plugin.json +2 -2
- package/CHANGELOG.md +79 -0
- package/README.md +74 -102
- package/agents/flow-adversary.md +1 -1
- package/agents/flow-architect.md +1 -1
- package/agents/flow-product-designer.md +1 -1
- package/agents/flow-qa-engineer.md +3 -3
- package/agents/flow-researcher.md +1 -1
- package/agents/flow-security-auditor.md +1 -1
- package/agents/flow-triage-analyst.md +3 -3
- package/agents/flow-ui-researcher.md +5 -5
- package/agents/flow-ux-designer.md +2 -2
- package/cli/install.js +16 -5
- package/commands/debug.md +10 -10
- package/commands/help.md +109 -87
- package/commands/implement.md +4 -4
- package/commands/init.md +5 -5
- package/commands/review.md +114 -130
- package/commands/spec.md +131 -89
- package/commands/start.md +100 -153
- package/commands/verify.md +110 -92
- package/gates/adversarial-review-gate.md +1 -1
- package/gates/coverage-audit-gate.md +1 -1
- package/gates/devex-gate.md +1 -1
- package/gates/edge-case-gate.md +1 -1
- package/gates/security-gate.md +3 -3
- package/hooks/scripts/session-start.sh +1 -1
- package/knowledge/epic-decomposition.md +2 -2
- package/knowledge/execution-strategies.md +4 -4
- package/knowledge/planning-reviews.md +6 -6
- package/knowledge/spec-driven-development.md +3 -3
- package/knowledge/two-stage-review.md +2 -2
- package/knowledge/wave-execution.md +5 -5
- package/package.json +1 -1
- package/agents/persona-amelia.md +0 -128
- package/agents/persona-david.md +0 -141
- package/agents/persona-emma.md +0 -179
- package/agents/persona-john.md +0 -105
- package/agents/persona-mary.md +0 -95
- package/agents/persona-oliver.md +0 -136
- package/agents/persona-rachel.md +0 -126
- package/agents/persona-serena.md +0 -175
- package/agents/persona-winston.md +0 -117
- package/commands/audit.md +0 -170
- package/commands/autoplan.md +0 -184
- package/commands/design.md +0 -155
- package/commands/discuss.md +0 -162
- package/commands/doctor.md +0 -124
- package/commands/index.md +0 -261
- package/commands/install-deps.md +0 -128
- package/commands/party.md +0 -241
- package/commands/plan-ceo.md +0 -117
- package/commands/plan-design.md +0 -107
- package/commands/plan-dx.md +0 -104
- package/commands/plan-eng.md +0 -108
- package/commands/qa.md +0 -118
- package/commands/requirements.md +0 -146
- package/commands/research.md +0 -141
- package/commands/security.md +0 -109
- package/commands/sketch.md +0 -118
- package/commands/spike.md +0 -181
- package/commands/status.md +0 -139
- package/commands/switch.md +0 -95
- package/commands/tasks.md +0 -189
- package/commands/triage.md +0 -160
package/commands/help.md
CHANGED
|
@@ -1,119 +1,141 @@
|
|
|
1
1
|
---
|
|
2
2
|
name: help
|
|
3
|
-
description: CurDX-Flow
|
|
3
|
+
description: Show CurDX-Flow command list, workflow overview, or troubleshooting guide. With a command name, show that command's detail.
|
|
4
4
|
argument-hint: "[<command-name> | workflow | troubleshoot]"
|
|
5
|
-
allowed-tools: [Read]
|
|
5
|
+
allowed-tools: [Read, Bash]
|
|
6
6
|
---
|
|
7
7
|
|
|
8
8
|
# CurDX-Flow Help
|
|
9
9
|
|
|
10
|
-
## No
|
|
10
|
+
## No argument — quick overview
|
|
11
|
+
|
|
12
|
+
Show the 9 core slash commands + 5 auto-invoked skills. Keep the table compact, use tabs for alignment.
|
|
11
13
|
|
|
12
14
|
```
|
|
13
|
-
🚀 CurDX-Flow —
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
15
|
+
🚀 CurDX-Flow v2 — Claude Code Discipline Layer
|
|
16
|
+
|
|
17
|
+
9 slash commands (explicit control)
|
|
18
|
+
────────────────────────────────────
|
|
19
|
+
/curdx-flow:init Initialize .flow/ in the current project
|
|
20
|
+
/curdx-flow:start Create / resume / switch a feature spec
|
|
21
|
+
/curdx-flow:spec Write or refresh the spec (--phase, --review, --regenerate)
|
|
22
|
+
/curdx-flow:implement Execute the tasks (auto-routed strategy)
|
|
23
|
+
/curdx-flow:verify Goal-backward verification — the differentiator
|
|
24
|
+
/curdx-flow:review Two-stage code review (+ --adversarial, --edge-case)
|
|
25
|
+
/curdx-flow:fast Skip the spec — one-shot small task
|
|
26
|
+
/curdx-flow:debug Systematic 4-stage debugging
|
|
27
|
+
/curdx-flow:help This help
|
|
28
|
+
|
|
29
|
+
5 skills (auto-invoked by Claude based on context)
|
|
30
|
+
────────────────────────────────────
|
|
31
|
+
epic Decompose a large feature into vertical-slice sub-specs
|
|
32
|
+
browser-qa Real-browser test via chrome-devtools MCP
|
|
33
|
+
ui-sketch Generate UI design variants (via frontend-design skill)
|
|
34
|
+
security-audit OWASP + STRIDE + CVE scan
|
|
35
|
+
brownfield-index Map an unfamiliar / legacy codebase
|
|
36
|
+
|
|
37
|
+
3 MCP servers auto-installed
|
|
38
|
+
────────────────────────────────────
|
|
39
|
+
context7 Latest library docs
|
|
40
|
+
sequential-thinking Structured reasoning
|
|
41
|
+
chrome-devtools Browser automation
|
|
42
|
+
|
|
43
|
+
Usage:
|
|
44
|
+
/curdx-flow:help <command> Detail for one command
|
|
45
|
+
/curdx-flow:help workflow Standard workflow walkthrough
|
|
46
|
+
/curdx-flow:help troubleshoot Common problems
|
|
37
47
|
```
|
|
38
48
|
|
|
39
|
-
## `<command-name>` —
|
|
49
|
+
## `<command-name>` — command detail
|
|
40
50
|
|
|
41
|
-
|
|
51
|
+
When the argument matches one of the 9 commands, read the corresponding `commands/<name>.md` from the plugin cache and present it cleanly:
|
|
42
52
|
|
|
43
53
|
```bash
|
|
44
|
-
|
|
54
|
+
PLUGIN=$(ls -dt "$HOME/.claude/plugins/cache/curdx-flow-marketplace/curdx-flow/"*/ 2>/dev/null | head -1)
|
|
55
|
+
CMD="$1"
|
|
56
|
+
cat "$PLUGIN/commands/$CMD.md"
|
|
45
57
|
```
|
|
46
58
|
|
|
47
|
-
|
|
59
|
+
If the argument isn't a known command, list the 9 candidates and the 5 skill names.
|
|
60
|
+
|
|
61
|
+
## `workflow` — standard workflow
|
|
48
62
|
|
|
49
63
|
```
|
|
50
|
-
📐 CurDX-Flow Standard Workflow
|
|
51
|
-
|
|
52
|
-
1.
|
|
53
|
-
└─
|
|
54
|
-
|
|
55
|
-
2. Per
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
├─
|
|
60
|
-
├─
|
|
61
|
-
├─
|
|
62
|
-
├─
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
fast
|
|
77
|
-
standard —
|
|
78
|
-
enterprise
|
|
79
|
-
autonomous — Overnight automation
|
|
64
|
+
📐 CurDX-Flow v2 Standard Workflow
|
|
65
|
+
|
|
66
|
+
1. One-time setup (outside Claude Code)
|
|
67
|
+
└─ npx @curdx/flow install --all
|
|
68
|
+
|
|
69
|
+
2. Per project (in Claude Code)
|
|
70
|
+
└─ /curdx-flow:init
|
|
71
|
+
|
|
72
|
+
3. Per feature — the main loop
|
|
73
|
+
├─ /curdx-flow:start my-feature "one-line goal"
|
|
74
|
+
├─ /curdx-flow:spec ← research → requirements → design → tasks
|
|
75
|
+
├─ (optional) /curdx-flow:spec --review ← add multi-dim planning review
|
|
76
|
+
├─ /curdx-flow:implement ← execute tasks
|
|
77
|
+
├─ /curdx-flow:verify ← goal-backward check
|
|
78
|
+
└─ /curdx-flow:review ← code review
|
|
79
|
+
|
|
80
|
+
4. Big feature (breaks into multiple specs)
|
|
81
|
+
└─ Say "this feature is too big, break it down" → epic skill auto-invokes
|
|
82
|
+
|
|
83
|
+
5. One-off task (skip the spec)
|
|
84
|
+
└─ /curdx-flow:fast "rename foo to bar in src/"
|
|
85
|
+
|
|
86
|
+
6. Stuck on a bug
|
|
87
|
+
└─ /curdx-flow:debug "tests fail intermittently after 3rd run"
|
|
88
|
+
|
|
89
|
+
Modes (set via /curdx-flow:start --mode=...)
|
|
90
|
+
fast One-off task paths
|
|
91
|
+
standard Default — spec + gates + review
|
|
92
|
+
enterprise Standard + adversarial + edge-case + security-audit
|
|
80
93
|
```
|
|
81
94
|
|
|
82
|
-
## `troubleshoot` —
|
|
95
|
+
## `troubleshoot` — common issues
|
|
83
96
|
|
|
84
97
|
```
|
|
85
|
-
🛠️
|
|
98
|
+
🛠️ Common issues
|
|
99
|
+
|
|
100
|
+
Q: After install, /curdx-flow:* commands are not found.
|
|
101
|
+
A: Restart Claude Code. The plugin needs a fresh session to register.
|
|
102
|
+
|
|
103
|
+
Q: MCP servers not starting?
|
|
104
|
+
A: Check Node >= 18: node --version
|
|
105
|
+
Check MCPs: claude mcp list
|
|
106
|
+
Health overall: npx @curdx/flow doctor
|
|
107
|
+
|
|
108
|
+
Q: GitHub slow / blocked during install?
|
|
109
|
+
A: v1.1.5+ defaults to offline install (bundled plugin body).
|
|
110
|
+
Force-offline: npx @curdx/flow install --no-deps
|
|
111
|
+
Force-online: npx @curdx/flow install --online
|
|
86
112
|
|
|
87
|
-
Q:
|
|
88
|
-
A:
|
|
89
|
-
View MCP status: `claude mcp list`
|
|
90
|
-
Restart Claude Code
|
|
113
|
+
Q: claude-mem MCP keeps failing?
|
|
114
|
+
A: It needs bun. Run: npx @curdx/flow doctor — it auto-symlinks bun if installed.
|
|
91
115
|
|
|
92
|
-
Q:
|
|
93
|
-
A:
|
|
94
|
-
touch "${CLAUDE_PLUGIN_DATA}/.deps-checked"
|
|
116
|
+
Q: /curdx-flow:init says .flow/ already exists?
|
|
117
|
+
A: Use --force, or run /curdx-flow:start directly to begin a new spec in the existing .flow/.
|
|
95
118
|
|
|
96
|
-
Q:
|
|
97
|
-
A:
|
|
119
|
+
Q: Skills don't auto-invoke reliably?
|
|
120
|
+
A: Invoke explicitly — every skill also has a /skill-name slash. E.g., /curdx-flow:security-audit.
|
|
98
121
|
|
|
99
|
-
Q:
|
|
100
|
-
A:
|
|
101
|
-
|
|
122
|
+
Q: I want the old v1 commands (research, plan-ceo, party…).
|
|
123
|
+
A: They're removed in v2. See MIGRATION.md for mappings, or stay on 1.x:
|
|
124
|
+
npm i -g @curdx/flow@^1.1
|
|
102
125
|
|
|
103
|
-
Q:
|
|
104
|
-
A:
|
|
105
|
-
|
|
126
|
+
Q: Too many gates blocking progress?
|
|
127
|
+
A: Your spec mode decides gate strictness. Lower via:
|
|
128
|
+
/curdx-flow:start <name> "<goal>" --mode=fast
|
|
106
129
|
|
|
107
|
-
Q:
|
|
108
|
-
A:
|
|
109
|
-
Enabling pua does not affect curdx-flow's core features (the three red lines are built into preamble).
|
|
130
|
+
Q: Where are decisions logged?
|
|
131
|
+
A: .flow/STATE.md (D-NN entries). Edit directly — no slash command needed.
|
|
110
132
|
|
|
111
|
-
Q:
|
|
112
|
-
A: https://github.com/
|
|
133
|
+
Q: File a bug / request feature
|
|
134
|
+
A: https://github.com/curdx/curdx-flow/issues
|
|
113
135
|
```
|
|
114
136
|
|
|
115
|
-
## Output
|
|
137
|
+
## Output principles
|
|
116
138
|
|
|
117
|
-
-
|
|
118
|
-
-
|
|
119
|
-
-
|
|
139
|
+
- Keep it compact. Use tables and lists, not prose.
|
|
140
|
+
- Always point at a concrete next action, not "see the docs".
|
|
141
|
+
- Version number should come from `cli/utils.js` dynamic read, not hard-coded.
|
package/commands/implement.md
CHANGED
|
@@ -38,7 +38,7 @@ done
|
|
|
38
38
|
[ -z "$SPEC_NAME" ] && { echo "❌ No active spec. Run /curdx-flow:start first"; exit 1; }
|
|
39
39
|
|
|
40
40
|
DIR=".flow/specs/$SPEC_NAME"
|
|
41
|
-
[ ! -f "$DIR/tasks.md" ] && { echo "❌ Missing tasks.md. Run /curdx-flow:tasks
|
|
41
|
+
[ ! -f "$DIR/tasks.md" ] && { echo "❌ Missing tasks.md. Run /curdx-flow:spec first (or /curdx-flow:spec --phase=tasks to rebuild just the tasks phase)"; exit 1; }
|
|
42
42
|
```
|
|
43
43
|
|
|
44
44
|
## Step 2: Parse Task Characteristics from tasks.md
|
|
@@ -275,7 +275,7 @@ len(failed) == 1:
|
|
|
275
275
|
|
|
276
276
|
len(failed) >= 2:
|
|
277
277
|
→ likely environment issue (missing deps/tsc error/permissions)
|
|
278
|
-
→ stop immediately, suggest /
|
|
278
|
+
→ stop immediately, suggest npx @curdx/flow doctor
|
|
279
279
|
|
|
280
280
|
failed_attempts >= 3 (cumulative):
|
|
281
281
|
→ stop, user intervention required
|
|
@@ -357,10 +357,10 @@ if all tasks done:
|
|
|
357
357
|
|
|
358
358
|
## Error Recovery
|
|
359
359
|
|
|
360
|
-
- Verify field in tasks.md is "manual" → stop, suggest re-running
|
|
360
|
+
- Verify field in tasks.md is "manual" → stop, suggest re-running `/curdx-flow:spec --phase=tasks --regenerate` to fix
|
|
361
361
|
- 3 consecutive TASK_FAILED → stop, prompt for user intervention
|
|
362
362
|
- git operation failure → stop immediately, do not continue (avoid state corruption)
|
|
363
|
-
- Test framework not found (npm test not found) → stop, suggest running /
|
|
363
|
+
- Test framework not found (npm test not found) → stop, suggest running npx @curdx/flow doctor
|
|
364
364
|
|
|
365
365
|
## Output to User
|
|
366
366
|
|
package/commands/init.md
CHANGED
|
@@ -22,7 +22,7 @@ ls -la
|
|
|
22
22
|
- If the current directory is a dangerous location such as the home directory or a system directory, stop and ask the user to switch
|
|
23
23
|
- If `.flow/` already exists:
|
|
24
24
|
- With `--force` → continue but warn about overwriting
|
|
25
|
-
- Without `--force` → stop and prompt the user to run `/curdx-flow:
|
|
25
|
+
- Without `--force` → stop and prompt the user to inspect `.flow/` directly, or run `/curdx-flow:start --list` to see existing specs
|
|
26
26
|
|
|
27
27
|
### Step 2: Create Directory Skeleton
|
|
28
28
|
|
|
@@ -71,7 +71,7 @@ Append (if not already present):
|
|
|
71
71
|
|
|
72
72
|
### Step 5: Health Check
|
|
73
73
|
|
|
74
|
-
Run
|
|
74
|
+
Run `npx @curdx/flow doctor` (or inline its checks) to verify:
|
|
75
75
|
- 3 MCPs started (context7 / sequential-thinking / chrome-devtools)
|
|
76
76
|
- Recommended plugins status (pua / claude-mem / frontend-design)
|
|
77
77
|
|
|
@@ -90,9 +90,9 @@ Output:
|
|
|
90
90
|
|
|
91
91
|
Next steps (in order):
|
|
92
92
|
1. Edit .flow/PROJECT.md to add the project goal
|
|
93
|
-
2.
|
|
94
|
-
3. /
|
|
95
|
-
4. /curdx-flow:
|
|
93
|
+
2. (already handled) — recommended plugins installed via `npx @curdx/flow install --all`
|
|
94
|
+
3. npx @curdx/flow doctor — verify health
|
|
95
|
+
4. /curdx-flow:start <name> "<goal>" — begin your first feature spec
|
|
96
96
|
|
|
97
97
|
Start development (after Phase 1 ships):
|
|
98
98
|
5. /curdx-flow:start <name> "<goal>" — kick off the first spec
|
package/commands/review.md
CHANGED
|
@@ -1,168 +1,152 @@
|
|
|
1
1
|
---
|
|
2
2
|
name: review
|
|
3
|
-
description: Two-
|
|
4
|
-
argument-hint: "[
|
|
3
|
+
description: Two-stage code review — Stage 1 spec compliance, Stage 2 code quality. Optional flags add adversarial review or edge-case hunting.
|
|
4
|
+
argument-hint: "[--stage=<1|2|both>] [--adversarial] [--edge-case]"
|
|
5
5
|
allowed-tools: [Read, Bash, Task, Grep, Glob]
|
|
6
6
|
---
|
|
7
7
|
|
|
8
|
-
#
|
|
8
|
+
# Two-Stage Code Review
|
|
9
9
|
|
|
10
|
-
|
|
10
|
+
Distinct from `/curdx-flow:verify`:
|
|
11
|
+
- **verify** checks that the spec's stated goals actually work (goal-backward).
|
|
12
|
+
- **review** checks that the code is good (spec compliance + craftsmanship).
|
|
11
13
|
|
|
12
|
-
|
|
13
|
-
Optionally layer on deep reviews from `flow-adversary` and `flow-edge-hunter`.
|
|
14
|
+
## Flags
|
|
14
15
|
|
|
15
|
-
|
|
16
|
+
| Flag | Default | Purpose |
|
|
17
|
+
|------|---------|---------|
|
|
18
|
+
| `--stage=<1\|2\|both>` | `both` | Stage 1 = spec compliance only. Stage 2 = code quality only. `both` = sequential. |
|
|
19
|
+
| `--adversarial` | off | Add an adversarial review pass (6 dimensions × 2 sequential-thinking rounds). Zero-findings forbidden. |
|
|
20
|
+
| `--edge-case` | off | Add edge-case hunting across the 7 categories. Produces a test-gap checklist. |
|
|
16
21
|
|
|
17
|
-
|
|
18
|
-
- Before PR
|
|
19
|
-
- When the user explicitly requests a deep review (add --adversarial / --edge-case / --both)
|
|
20
|
-
|
|
21
|
-
## Step 1: Parse arguments
|
|
22
|
+
## Preflight
|
|
22
23
|
|
|
23
24
|
```bash
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
25
|
+
[ ! -d ".flow" ] && { echo "✗ Not a CurDX-Flow project."; exit 1; }
|
|
26
|
+
|
|
27
|
+
SPEC_NAME=$(cat .flow/.active-spec 2>/dev/null)
|
|
28
|
+
[ -z "$SPEC_NAME" ] && { echo "✗ No active spec."; exit 1; }
|
|
29
|
+
|
|
30
|
+
# Review needs a design.md + implementation to compare against
|
|
31
|
+
for f in design.md; do
|
|
32
|
+
[ ! -f ".flow/specs/$SPEC_NAME/$f" ] && {
|
|
33
|
+
echo "✗ Missing $f. Run /curdx-flow:spec first.";
|
|
34
|
+
exit 1;
|
|
35
|
+
}
|
|
36
|
+
done
|
|
37
|
+
|
|
38
|
+
FLAG_STAGE=$(echo "$ARGUMENTS" | grep -oP -- '--stage=\K[^\s]+' || echo "both")
|
|
39
|
+
FLAG_ADV=$(echo "$ARGUMENTS" | grep -q -- '--adversarial' && echo 1 || echo 0)
|
|
40
|
+
FLAG_EDGE=$(echo "$ARGUMENTS" | grep -q -- '--edge-case' && echo 1 || echo 0)
|
|
35
41
|
```
|
|
36
42
|
|
|
37
|
-
##
|
|
43
|
+
## Stage 1 — Spec compliance
|
|
38
44
|
|
|
39
|
-
|
|
40
|
-
|
|
45
|
+
Dispatch `flow-reviewer` in Stage 1 mode. It checks:
|
|
46
|
+
- Implementation actually addresses every US / AC / FR / NFR in `requirements.md`
|
|
47
|
+
- Code structure reflects AD-NN decisions from `design.md`
|
|
48
|
+
- Task checklist in `tasks.md` is genuinely complete (all tasks marked `[x]` have real code)
|
|
49
|
+
- Conventional-commit log (`git log`) matches the tasks declared completed
|
|
41
50
|
|
|
42
|
-
|
|
43
|
-
if [ ! -f "$DIR/verification-report.md" ]; then
|
|
44
|
-
echo "⚠ /curdx-flow:verify not run. Recommend running goal-reverse verification first."
|
|
45
|
-
echo "Continue? (y/N)"
|
|
46
|
-
# AskUserQuestion
|
|
47
|
-
fi
|
|
48
|
-
```
|
|
51
|
+
Output: Stage-1 section of the report with any compliance gaps.
|
|
49
52
|
|
|
50
|
-
##
|
|
53
|
+
## Stage 2 — Code quality
|
|
51
54
|
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
Spec files to read:
|
|
61
|
-
- .flow/specs/$SPEC_NAME/requirements.md
|
|
62
|
-
- .flow/specs/$SPEC_NAME/design.md
|
|
63
|
-
- .flow/specs/$SPEC_NAME/tasks.md
|
|
64
|
-
- .flow/specs/$SPEC_NAME/.state.json
|
|
65
|
-
- .flow/specs/$SPEC_NAME/verification-report.md (if exists)
|
|
66
|
-
|
|
67
|
-
Enabled Gates (from .flow/config.json):
|
|
68
|
-
- karpathy-gate (always)
|
|
69
|
-
- verification-gate (always)
|
|
70
|
-
- tdd-gate (standard+)
|
|
71
|
-
- coverage-audit-gate (standard+)
|
|
72
|
-
|
|
73
|
-
Tasks:
|
|
74
|
-
Stage 1: Spec compliance review
|
|
75
|
-
- Judge each FR / AC / AD / error path as ✓/⚠/✗
|
|
76
|
-
- Check Out of Scope adherence
|
|
77
|
-
|
|
78
|
-
Stage 2: Code quality review
|
|
79
|
-
- Apply all enabled Gates
|
|
80
|
-
- Emit per-Gate check results
|
|
81
|
-
|
|
82
|
-
Combined verdict:
|
|
83
|
-
- APPROVED / APPROVED_WITH_WARNINGS / NEEDS_FIXES / BLOCKED
|
|
84
|
-
|
|
85
|
-
Output:
|
|
86
|
-
.flow/specs/$SPEC_NAME/review-report.md
|
|
87
|
-
|
|
88
|
-
Return a brief to me: Stage 1/2 verdicts, blocking/warning counts, and the top 3 fix suggestions
|
|
89
|
-
```
|
|
55
|
+
Dispatch `flow-reviewer` in Stage 2 mode. It checks:
|
|
56
|
+
- Naming, comments, structure
|
|
57
|
+
- Error handling completeness
|
|
58
|
+
- Test coverage and test quality
|
|
59
|
+
- Performance / resource usage concerns
|
|
60
|
+
- Security smells (not a full security audit — that's `security-audit` skill)
|
|
61
|
+
- Karpathy 4 principles applied
|
|
90
62
|
|
|
91
|
-
|
|
63
|
+
Output: Stage-2 section of the report.
|
|
64
|
+
|
|
65
|
+
## Optional: adversarial review
|
|
92
66
|
|
|
93
67
|
If `--adversarial`:
|
|
68
|
+
Dispatch `flow-adversary`. It runs 6 dimensions × 2 rounds of `sequential-thinking`:
|
|
69
|
+
1. What's missing?
|
|
70
|
+
2. What's overengineered?
|
|
71
|
+
3. What would break first in production?
|
|
72
|
+
4. What's undocumented that a new maintainer would misunderstand?
|
|
73
|
+
5. What decision locks us out of a future option?
|
|
74
|
+
6. What would a skeptical reviewer reject?
|
|
94
75
|
|
|
95
|
-
|
|
96
|
-
Task:
|
|
97
|
-
subagent_type: general-purpose
|
|
98
|
-
description: "Adversarial review $SPEC_NAME"
|
|
99
|
-
prompt: |
|
|
100
|
-
You are the flow-adversary agent. Full definition:
|
|
101
|
-
${CLAUDE_PLUGIN_ROOT}/agents/flow-adversary.md
|
|
102
|
-
|
|
103
|
-
Core rule: zero findings are forbidden — must find ≥ 3 categories of issues
|
|
104
|
-
|
|
105
|
-
Scan:
|
|
106
|
-
- .flow/specs/$SPEC_NAME/*.md
|
|
107
|
-
- Related code (git diff)
|
|
108
|
-
- Recent commits
|
|
109
|
-
|
|
110
|
-
Use sequential-thinking ≥ 12 rounds (2 rounds × 6 dimensions)
|
|
111
|
-
|
|
112
|
-
Output: .flow/specs/$SPEC_NAME/adversarial-review.md
|
|
113
|
-
```
|
|
76
|
+
**Zero findings are forbidden** — if the agent reports "all good", re-dispatch with stronger skepticism. Per `@${CLAUDE_PLUGIN_ROOT}/gates/adversarial-review-gate.md`.
|
|
114
77
|
|
|
115
|
-
##
|
|
78
|
+
## Optional: edge-case hunting
|
|
116
79
|
|
|
117
80
|
If `--edge-case`:
|
|
81
|
+
Dispatch `flow-edge-hunter` across the 7 categories:
|
|
82
|
+
1. Boundary values (0, MAX, empty, one-over-limit)
|
|
83
|
+
2. Concurrency / race conditions
|
|
84
|
+
3. Network failure / partial failure
|
|
85
|
+
4. Malformed input
|
|
86
|
+
5. Permission / auth failure
|
|
87
|
+
6. Resource exhaustion
|
|
88
|
+
7. Time / locale / timezone
|
|
118
89
|
|
|
119
|
-
|
|
120
|
-
Task:
|
|
121
|
-
subagent_type: general-purpose
|
|
122
|
-
description: "Edge-case scan $SPEC_NAME"
|
|
123
|
-
prompt: |
|
|
124
|
-
You are the flow-edge-hunter agent. Full definition:
|
|
125
|
-
${CLAUDE_PLUGIN_ROOT}/agents/flow-edge-hunter.md
|
|
126
|
-
|
|
127
|
-
Scan the subject's coverage across 7 categories:
|
|
128
|
-
- Boundary values / nulls / concurrency / error recovery / security / i18n / performance
|
|
129
|
-
|
|
130
|
-
Use sequential-thinking ≥ 3 rounds per category
|
|
131
|
-
|
|
132
|
-
Output: .flow/specs/$SPEC_NAME/edge-cases.md
|
|
133
|
-
```
|
|
90
|
+
Output: test-gap checklist with suggested test cases.
|
|
134
91
|
|
|
135
|
-
##
|
|
92
|
+
## Report
|
|
136
93
|
|
|
137
|
-
|
|
138
|
-
MAIN_REPORT="$DIR/review-report.md"
|
|
139
|
-
ADV_REPORT="$DIR/adversarial-review.md"
|
|
140
|
-
EDGE_REPORT="$DIR/edge-cases.md"
|
|
94
|
+
**Landing check**: sub-agent responses can be truncated. After dispatching review agents, verify the report actually landed on disk:
|
|
141
95
|
|
|
142
|
-
|
|
143
|
-
|
|
96
|
+
```bash
|
|
97
|
+
REPORT=".flow/specs/$SPEC_NAME/review-report.md"
|
|
98
|
+
if [ ! -f "$REPORT" ] || [ "$(wc -c < "$REPORT" 2>/dev/null | tr -d ' ')" -lt 300 ]; then
|
|
99
|
+
echo "⚠ Report missing or truncated. Re-dispatching flow-reviewer with a terse 'Write the report now, no narration' prompt."
|
|
100
|
+
fi
|
|
144
101
|
```
|
|
145
102
|
|
|
146
|
-
|
|
103
|
+
Consolidated output: `.flow/specs/$SPEC_NAME/review-report.md`:
|
|
104
|
+
|
|
105
|
+
```markdown
|
|
106
|
+
# Review Report — <spec-name>
|
|
107
|
+
|
|
108
|
+
## Stage 1 — Spec Compliance
|
|
109
|
+
- ✓ FR-01: implemented in src/auth.ts
|
|
110
|
+
- ✗ FR-04: missing — add handler for token refresh
|
|
111
|
+
- ⚠ AC-2.1: no integration test asserting 403 on expired token
|
|
147
112
|
|
|
113
|
+
## Stage 2 — Code Quality
|
|
114
|
+
- Blocker: duplicated error-handling pattern in 3 files — extract helper
|
|
115
|
+
- Warning: function foo() in src/a.ts: 90 lines, split
|
|
116
|
+
- Nit: inconsistent naming (getUserId vs fetchUser)
|
|
117
|
+
|
|
118
|
+
## Adversarial (if run)
|
|
119
|
+
...
|
|
120
|
+
|
|
121
|
+
## Edge Cases (if run)
|
|
122
|
+
...
|
|
123
|
+
|
|
124
|
+
## Verdict
|
|
125
|
+
- [ ] APPROVED
|
|
126
|
+
- [X] CHANGES REQUIRED — <n> blockers
|
|
127
|
+
- [ ] REJECTED
|
|
148
128
|
```
|
|
149
|
-
✓ Review complete: $SPEC_NAME
|
|
150
129
|
|
|
151
|
-
|
|
152
|
-
|
|
130
|
+
## Reporting
|
|
131
|
+
|
|
132
|
+
```
|
|
133
|
+
✓ Review complete
|
|
134
|
+
Stage 1 findings: <n>
|
|
135
|
+
Stage 2 findings: <n>
|
|
136
|
+
Adversarial findings: <n> (if --adversarial)
|
|
137
|
+
Edge-case gaps: <n> (if --edge-case)
|
|
138
|
+
Verdict: CHANGES REQUIRED
|
|
153
139
|
|
|
154
|
-
|
|
155
|
-
$([ "$EDGE" = "1" ] && echo "Edge-case scan: $EDGE_REPORT")
|
|
140
|
+
Report: .flow/specs/<name>/review-report.md
|
|
156
141
|
|
|
157
|
-
Next
|
|
158
|
-
$([ "$VERDICT" = "APPROVED" ] && echo " ✓ Proceed to /curdx-flow:ship (Phase 6+)")
|
|
159
|
-
$([ "$VERDICT" = "APPROVED_WITH_WARNINGS" ] && echo " ⚠ Recommend fixing warnings first, then /curdx-flow:ship")
|
|
160
|
-
$([ "$VERDICT" = "NEEDS_FIXES" ] && echo " ❌ Fix blockers → /curdx-flow:implement --task=... → /curdx-flow:review re-review")
|
|
161
|
-
$([ "$VERDICT" = "BLOCKED_BY_SPEC" ] && echo " ❌ Back to /curdx-flow:implement to fill missing FR/AD")
|
|
142
|
+
Next: address blockers, then re-run /curdx-flow:review.
|
|
162
143
|
```
|
|
163
144
|
|
|
164
|
-
##
|
|
145
|
+
## References
|
|
165
146
|
|
|
166
|
-
-
|
|
167
|
-
-
|
|
168
|
-
-
|
|
147
|
+
- `flow-reviewer` agent: `@${CLAUDE_PLUGIN_ROOT}/agents/flow-reviewer.md`
|
|
148
|
+
- `flow-adversary` agent: `@${CLAUDE_PLUGIN_ROOT}/agents/flow-adversary.md`
|
|
149
|
+
- `flow-edge-hunter` agent: `@${CLAUDE_PLUGIN_ROOT}/agents/flow-edge-hunter.md`
|
|
150
|
+
- `adversarial-review-gate`: `@${CLAUDE_PLUGIN_ROOT}/gates/adversarial-review-gate.md`
|
|
151
|
+
- `edge-case-gate`: `@${CLAUDE_PLUGIN_ROOT}/gates/edge-case-gate.md`
|
|
152
|
+
- Knowledge: `@${CLAUDE_PLUGIN_ROOT}/knowledge/two-stage-review.md`
|