@curdx/flow 3.0.0 → 3.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (219) hide show
  1. package/CHANGELOG.md +21 -87
  2. package/LICENSE +1 -1
  3. package/README.md +28 -129
  4. package/dist/index.mjs +995 -0
  5. package/package.json +33 -44
  6. package/.claude-plugin/marketplace.json +0 -48
  7. package/.claude-plugin/plugin.json +0 -52
  8. package/agent-preamble/preamble.md +0 -314
  9. package/agents/flow-adversary.md +0 -203
  10. package/agents/flow-architect.md +0 -198
  11. package/agents/flow-brownfield-analyst.md +0 -143
  12. package/agents/flow-debugger.md +0 -321
  13. package/agents/flow-edge-hunter.md +0 -289
  14. package/agents/flow-executor.md +0 -269
  15. package/agents/flow-orchestrator.md +0 -145
  16. package/agents/flow-planner.md +0 -247
  17. package/agents/flow-product-designer.md +0 -159
  18. package/agents/flow-qa-engineer.md +0 -282
  19. package/agents/flow-researcher.md +0 -166
  20. package/agents/flow-reviewer.md +0 -304
  21. package/agents/flow-security-auditor.md +0 -401
  22. package/agents/flow-triage-analyst.md +0 -272
  23. package/agents/flow-ui-researcher.md +0 -230
  24. package/agents/flow-ux-designer.md +0 -221
  25. package/agents/flow-verifier.md +0 -350
  26. package/bin/curdx-flow +0 -5
  27. package/bin/curdx-flow-state +0 -104
  28. package/bin/curdx-flow.js +0 -54
  29. package/cli/README.md +0 -104
  30. package/cli/doctor-workflow.js +0 -483
  31. package/cli/doctor.js +0 -73
  32. package/cli/help.js +0 -59
  33. package/cli/install-bundled-mcps.js +0 -37
  34. package/cli/install-companions.js +0 -19
  35. package/cli/install-context7-config.js +0 -80
  36. package/cli/install-curdx-plugin.js +0 -96
  37. package/cli/install-language.js +0 -35
  38. package/cli/install-next-steps.js +0 -29
  39. package/cli/install-options.js +0 -9
  40. package/cli/install-paths.js +0 -52
  41. package/cli/install-recommended-plugins.js +0 -104
  42. package/cli/install-required-plugins.js +0 -57
  43. package/cli/install-self-update.js +0 -62
  44. package/cli/install-workflow.js +0 -209
  45. package/cli/install.js +0 -101
  46. package/cli/lib/claude-commands.js +0 -41
  47. package/cli/lib/claude-ops.js +0 -47
  48. package/cli/lib/claude.js +0 -183
  49. package/cli/lib/config.js +0 -24
  50. package/cli/lib/doctor-claude-settings.js +0 -1186
  51. package/cli/lib/doctor-report.js +0 -978
  52. package/cli/lib/doctor-runtime-environment.js +0 -196
  53. package/cli/lib/frontmatter.js +0 -44
  54. package/cli/lib/json-schema.js +0 -57
  55. package/cli/lib/logging.js +0 -25
  56. package/cli/lib/process.js +0 -60
  57. package/cli/lib/prompts.js +0 -135
  58. package/cli/lib/runtime.js +0 -107
  59. package/cli/lib/semver.js +0 -109
  60. package/cli/lib/version.js +0 -12
  61. package/cli/protocols-body.md +0 -22
  62. package/cli/protocols.js +0 -162
  63. package/cli/registry.js +0 -123
  64. package/cli/router.js +0 -49
  65. package/cli/uninstall-actions.js +0 -360
  66. package/cli/uninstall-workflow.js +0 -146
  67. package/cli/uninstall.js +0 -42
  68. package/cli/upgrade-workflow.js +0 -80
  69. package/cli/upgrade.js +0 -91
  70. package/cli/utils.js +0 -40
  71. package/gates/adversarial-review-gate.md +0 -219
  72. package/gates/coverage-audit-gate.md +0 -182
  73. package/gates/devex-gate.md +0 -254
  74. package/gates/edge-case-gate.md +0 -194
  75. package/gates/karpathy-gate.md +0 -130
  76. package/gates/security-gate.md +0 -218
  77. package/gates/tdd-gate.md +0 -182
  78. package/gates/test-quality-gate.md +0 -59
  79. package/gates/verification-gate.md +0 -179
  80. package/hooks/hooks.json +0 -130
  81. package/hooks/scripts/common.sh +0 -237
  82. package/hooks/scripts/config-change-guard.sh +0 -94
  83. package/hooks/scripts/flow-context-watch.sh +0 -94
  84. package/hooks/scripts/inject-karpathy.sh +0 -53
  85. package/hooks/scripts/quick-mode-guard.sh +0 -69
  86. package/hooks/scripts/session-start.sh +0 -94
  87. package/hooks/scripts/session-title.sh +0 -87
  88. package/hooks/scripts/stop-watcher.sh +0 -231
  89. package/hooks/scripts/subagent-artifact-guard.sh +0 -92
  90. package/hooks/scripts/subagent-statusline.sh +0 -111
  91. package/hooks/scripts/task-lifecycle-guard.sh +0 -106
  92. package/hooks/scripts/teammate-idle-guard.sh +0 -83
  93. package/knowledge/artifact-output-discipline.md +0 -24
  94. package/knowledge/artifact-summary-contracts.md +0 -50
  95. package/knowledge/atomic-commits.md +0 -262
  96. package/knowledge/claude-code-runtime-contracts.md +0 -240
  97. package/knowledge/epic-decomposition.md +0 -307
  98. package/knowledge/execution-strategies.md +0 -303
  99. package/knowledge/karpathy-guidelines.md +0 -219
  100. package/knowledge/planning-reviews.md +0 -211
  101. package/knowledge/poc-first-workflow.md +0 -223
  102. package/knowledge/review-feedback-intake.md +0 -57
  103. package/knowledge/spec-driven-development.md +0 -180
  104. package/knowledge/systematic-debugging.md +0 -378
  105. package/knowledge/two-stage-review.md +0 -249
  106. package/knowledge/wave-execution.md +0 -403
  107. package/monitors/monitors.json +0 -8
  108. package/monitors/scripts/flow-state-monitor.sh +0 -102
  109. package/output-styles/curdx-evidence-first.md +0 -34
  110. package/output-styles/curdx-fast-mode.md +0 -42
  111. package/output-styles/curdx-spec-mode.md +0 -46
  112. package/schemas/agent-frontmatter.schema.json +0 -66
  113. package/schemas/config.schema.json +0 -134
  114. package/schemas/gate-frontmatter.schema.json +0 -30
  115. package/schemas/hooks.schema.json +0 -115
  116. package/schemas/output-style-frontmatter.schema.json +0 -22
  117. package/schemas/plugin-manifest.schema.json +0 -436
  118. package/schemas/plugin-settings.schema.json +0 -29
  119. package/schemas/skill-frontmatter.schema.json +0 -177
  120. package/schemas/spec-frontmatter.schema.json +0 -42
  121. package/schemas/spec-state.schema.json +0 -165
  122. package/settings.json +0 -8
  123. package/skills/brownfield-index/SKILL.md +0 -53
  124. package/skills/brownfield-index/references/applicability.md +0 -12
  125. package/skills/brownfield-index/references/handoff.md +0 -8
  126. package/skills/brownfield-index/references/index-contract.md +0 -10
  127. package/skills/browser-qa/SKILL.md +0 -39
  128. package/skills/browser-qa/references/handoff.md +0 -6
  129. package/skills/browser-qa/references/prerequisites.md +0 -10
  130. package/skills/browser-qa/references/qa-contract.md +0 -20
  131. package/skills/cancel/SKILL.md +0 -41
  132. package/skills/cancel/references/destructive-mode.md +0 -17
  133. package/skills/cancel/references/reporting.md +0 -18
  134. package/skills/cancel/references/state-recovery.md +0 -30
  135. package/skills/cancel/references/target-resolution.md +0 -7
  136. package/skills/debug/SKILL.md +0 -45
  137. package/skills/debug/references/context-gathering.md +0 -11
  138. package/skills/debug/references/failure-guard.md +0 -25
  139. package/skills/debug/references/intake.md +0 -12
  140. package/skills/debug/references/phase-workflow.md +0 -34
  141. package/skills/debug/references/reporting.md +0 -20
  142. package/skills/epic/SKILL.md +0 -39
  143. package/skills/epic/references/epic-artifacts.md +0 -20
  144. package/skills/epic/references/epic-intake.md +0 -9
  145. package/skills/epic/references/slice-handoff.md +0 -16
  146. package/skills/fast/SKILL.md +0 -62
  147. package/skills/fast/references/applicability.md +0 -25
  148. package/skills/fast/references/clarification.md +0 -20
  149. package/skills/fast/references/execution-contract.md +0 -56
  150. package/skills/help/SKILL.md +0 -55
  151. package/skills/help/references/dispatch.md +0 -20
  152. package/skills/help/references/overview.md +0 -39
  153. package/skills/help/references/troubleshoot.md +0 -47
  154. package/skills/help/references/workflow.md +0 -37
  155. package/skills/implement/SKILL.md +0 -104
  156. package/skills/implement/references/error-recovery.md +0 -36
  157. package/skills/implement/references/linear-execution.md +0 -43
  158. package/skills/implement/references/native-task-sync.md +0 -107
  159. package/skills/implement/references/preflight.md +0 -43
  160. package/skills/implement/references/progress-contract.md +0 -36
  161. package/skills/implement/references/state-init.md +0 -36
  162. package/skills/implement/references/stop-hook-execution.md +0 -50
  163. package/skills/implement/references/strategy-router.md +0 -38
  164. package/skills/implement/references/subagent-execution.md +0 -57
  165. package/skills/implement/references/wave-execution.md +0 -180
  166. package/skills/init/SKILL.md +0 -49
  167. package/skills/init/references/gitignore-and-health.md +0 -26
  168. package/skills/init/references/next-steps.md +0 -22
  169. package/skills/init/references/preflight.md +0 -15
  170. package/skills/init/references/scaffold-contract.md +0 -27
  171. package/skills/review/SKILL.md +0 -82
  172. package/skills/review/references/optional-passes.md +0 -48
  173. package/skills/review/references/preflight.md +0 -38
  174. package/skills/review/references/report-contract.md +0 -49
  175. package/skills/review/references/reporting.md +0 -20
  176. package/skills/review/references/stage-execution.md +0 -32
  177. package/skills/security-audit/SKILL.md +0 -47
  178. package/skills/security-audit/references/audit-contract.md +0 -21
  179. package/skills/security-audit/references/gate-handoff.md +0 -8
  180. package/skills/security-audit/references/scope-and-depth.md +0 -9
  181. package/skills/spec/SKILL.md +0 -100
  182. package/skills/spec/references/artifact-landing.md +0 -31
  183. package/skills/spec/references/phase-execution.md +0 -50
  184. package/skills/spec/references/planning-review.md +0 -31
  185. package/skills/spec/references/preflight-and-routing.md +0 -46
  186. package/skills/spec/references/reporting.md +0 -21
  187. package/skills/start/SKILL.md +0 -84
  188. package/skills/start/references/branch-routing.md +0 -51
  189. package/skills/start/references/mode-semantics.md +0 -12
  190. package/skills/start/references/preflight.md +0 -13
  191. package/skills/start/references/reporting.md +0 -20
  192. package/skills/start/references/state-seeding.md +0 -44
  193. package/skills/start/references/workflow-handoff.md +0 -26
  194. package/skills/status/SKILL.md +0 -41
  195. package/skills/status/references/gather-contract.md +0 -30
  196. package/skills/status/references/health-rules.md +0 -27
  197. package/skills/status/references/output-contract.md +0 -25
  198. package/skills/status/references/preflight.md +0 -10
  199. package/skills/status/references/recovery-hints.md +0 -18
  200. package/skills/ui-sketch/SKILL.md +0 -39
  201. package/skills/ui-sketch/references/brief-intake.md +0 -10
  202. package/skills/ui-sketch/references/iteration-handoff.md +0 -5
  203. package/skills/ui-sketch/references/variant-contract.md +0 -15
  204. package/skills/verify/SKILL.md +0 -56
  205. package/skills/verify/references/evidence-workflow.md +0 -39
  206. package/skills/verify/references/output-contract.md +0 -23
  207. package/skills/verify/references/preflight.md +0 -11
  208. package/skills/verify/references/report-handoff.md +0 -35
  209. package/skills/verify/references/strict-mode.md +0 -12
  210. package/templates/CONTEXT.md.tmpl +0 -53
  211. package/templates/PROJECT.md.tmpl +0 -59
  212. package/templates/ROADMAP.md.tmpl +0 -50
  213. package/templates/STATE.md.tmpl +0 -49
  214. package/templates/config.json.tmpl +0 -51
  215. package/templates/design.md.tmpl +0 -83
  216. package/templates/progress.md.tmpl +0 -77
  217. package/templates/requirements.md.tmpl +0 -76
  218. package/templates/research.md.tmpl +0 -83
  219. package/templates/tasks.md.tmpl +0 -107
@@ -1,27 +0,0 @@
1
- # Init Scaffold Contract — What Must Be Created
2
-
3
- Create the runtime skeleton:
4
-
5
- - `.flow/specs/`
6
- - `.flow/_epics/`
7
- - `.flow/checkpoints/`
8
- - `.flow/threads/`
9
- - `.flow/seeds/`
10
-
11
- Render the canonical scaffold files from `${CLAUDE_PLUGIN_ROOT}/templates/`:
12
-
13
- - `templates/PROJECT.md.tmpl` -> `.flow/PROJECT.md`
14
- - `templates/CONTEXT.md.tmpl` -> `.flow/CONTEXT.md`
15
- - `templates/STATE.md.tmpl` -> `.flow/STATE.md`
16
- - `templates/ROADMAP.md.tmpl` -> `.flow/ROADMAP.md`
17
- - `templates/config.json.tmpl` -> `.flow/config.json`
18
-
19
- Populate placeholders with:
20
-
21
- - `{{PROJECT_NAME}}` from the current directory name unless the user gave a
22
- better project label
23
- - `{{CREATED_DATE}}` from the current date
24
- - `{{USER_NAME}}` from git config when available
25
-
26
- Create missing scaffold files. Do not overwrite user-edited canonical files
27
- unless the user explicitly asks for a reset.
@@ -1,82 +0,0 @@
1
- ---
2
- name: review
3
- description: Run two-stage review with optional adversarial, edge-case, and DevEx passes.
4
- when_to_use: Use when implementation exists and the user wants review findings, spec-compliance checks, adversarial review, edge-case hunting, or a DevEx audit.
5
- argument-hint: "[--stage=<1|2|both>] [--adversarial] [--edge-case] [--devex]"
6
- disable-model-invocation: true
7
- allowed-tools: [Read, Bash, Agent, Grep, Glob]
8
- ---
9
-
10
- # Two-Stage Code Review
11
-
12
- Distinct from `/curdx-flow:verify`:
13
-
14
- - `verify` checks whether the spec's user-visible goals work
15
- - `review` checks whether the implementation is correct, aligned, and maintainable
16
-
17
- Keep this entrypoint focused on review routing, pass selection, and final
18
- report handoff.
19
-
20
- When this skill is used for follow-up work after prior review comments, apply
21
- `@${CLAUDE_PLUGIN_ROOT}/knowledge/review-feedback-intake.md` first so accepted
22
- fixes and technical pushback are recorded in `.progress.md`.
23
-
24
- Detailed review protocols live in:
25
-
26
- - `references/preflight.md`
27
- - `references/stage-execution.md`
28
- - `references/optional-passes.md`
29
- - `references/report-contract.md`
30
- - `references/reporting.md`
31
-
32
- ## Flags
33
-
34
- | Flag | Default | Purpose |
35
- |------|---------|---------|
36
- | `--stage=<1\|2\|both>` | `both` | Stage 1 = spec compliance only. Stage 2 = code quality only. `both` = sequential. |
37
- | `--adversarial` | off (`enterprise` -> on) | Add an adversarial review pass across applicable categories. |
38
- | `--edge-case` | off (`enterprise` -> on) | Add edge-case hunting across applicable categories. Produces a test-gap checklist. |
39
- | `--devex` | off (`enterprise` -> on) | Add the DevEx audit for naming, comments, structure, error handling, setup, types, tests, and developer loop. |
40
-
41
- ## Preflight
42
-
43
- Use `references/preflight.md` for:
44
-
45
- - `.flow/` and active-spec checks
46
- - required artifact checks
47
- - mode-aware `--stage`, `--adversarial`, `--edge-case`, and `--devex`
48
- normalization
49
-
50
- ## Stage Execution
51
-
52
- Stage responsibilities, reviewer prompts, and pass/fail expectations live in
53
- `references/stage-execution.md`.
54
-
55
- - Stage 1 -> `flow-reviewer` in spec-compliance mode
56
- - Stage 2 -> `flow-reviewer` in code-quality mode
57
-
58
- Optional adversarial, edge-case, and DevEx extensions live in
59
- `references/optional-passes.md`.
60
-
61
- ## Report Contract
62
-
63
- Landing checks, report shape, and final status output live in
64
- `references/report-contract.md`.
65
-
66
- The report lands at:
67
-
68
- - `.flow/specs/$SPEC_NAME/review-report.md`
69
-
70
- ## Reporting
71
-
72
- Use `references/reporting.md` for the final summary and rerun handoff.
73
-
74
- ## References
75
-
76
- - `flow-reviewer` agent: `@${CLAUDE_PLUGIN_ROOT}/agents/flow-reviewer.md`
77
- - `flow-adversary` agent: `@${CLAUDE_PLUGIN_ROOT}/agents/flow-adversary.md`
78
- - `flow-edge-hunter` agent: `@${CLAUDE_PLUGIN_ROOT}/agents/flow-edge-hunter.md`
79
- - `adversarial-review-gate`: `@${CLAUDE_PLUGIN_ROOT}/gates/adversarial-review-gate.md`
80
- - `edge-case-gate`: `@${CLAUDE_PLUGIN_ROOT}/gates/edge-case-gate.md`
81
- - `devex-gate`: `@${CLAUDE_PLUGIN_ROOT}/gates/devex-gate.md`
82
- - Knowledge: `@${CLAUDE_PLUGIN_ROOT}/knowledge/two-stage-review.md`
@@ -1,48 +0,0 @@
1
- # Optional Passes — Adversarial, Edge Cases, DevEx
2
-
3
- ## Adversarial Review
4
-
5
- If `FLAG_ADV=1` after preflight normalization, dispatch `flow-adversary`
6
- across applicable categories:
7
-
8
- 1. What's missing?
9
- 2. What's overengineered?
10
- 3. What breaks first in production?
11
- 4. What would a new maintainer misunderstand?
12
- 5. What choice locks out a future option?
13
- 6. What would a skeptical reviewer reject?
14
-
15
- Zero findings still requires proof-of-checking.
16
-
17
- ## Edge-Case Hunting
18
-
19
- If `FLAG_EDGE=1` after preflight normalization, dispatch `flow-edge-hunter`
20
- across:
21
-
22
- 1. boundary values
23
- 2. concurrency and races
24
- 3. network or partial failure
25
- 4. malformed input
26
- 5. auth and permission failure
27
- 6. resource exhaustion
28
- 7. time, locale, and timezone
29
-
30
- Output: a test-gap checklist.
31
-
32
- ## DevEx Audit
33
-
34
- If `FLAG_DEVEX=1` after preflight normalization, inject
35
- `@${CLAUDE_PLUGIN_ROOT}/gates/devex-gate.md` into `flow-reviewer` so Stage 2
36
- also evaluates:
37
-
38
- 1. naming
39
- 2. comments
40
- 3. structure
41
- 4. error handling
42
- 5. setup
43
- 6. types
44
- 7. tests
45
- 8. developer loop
46
-
47
- Do not fork a separate custom reviewer for DevEx; keep `flow-reviewer` generic
48
- and extend it with the gate file.
@@ -1,38 +0,0 @@
1
- # Review Preflight — Resolve Scope and Flags
2
-
3
- Before dispatching any reviewer:
4
-
5
- ```bash
6
- [ ! -d ".flow" ] && { echo "✗ Not a CurdX-Flow project."; exit 1; }
7
-
8
- SPEC_NAME=$(cat .flow/.active-spec 2>/dev/null)
9
- [ -z "$SPEC_NAME" ] && { echo "✗ No active spec."; exit 1; }
10
-
11
- SPEC_STATE=".flow/specs/$SPEC_NAME/.state.json"
12
- SPEC_MODE=$(grep -oP '"mode"\\s*:\\s*"\\K[^"]+' "$SPEC_STATE" 2>/dev/null || echo "standard")
13
-
14
- for f in design.md; do
15
- [ ! -f ".flow/specs/$SPEC_NAME/$f" ] && {
16
- echo "✗ Missing $f. Run /curdx-flow:spec first.";
17
- exit 1;
18
- }
19
- done
20
-
21
- FLAG_STAGE=$(echo "$ARGUMENTS" | grep -oP -- '--stage=\K[^\s]+' || echo "both")
22
- FLAG_ADV=$(echo "$ARGUMENTS" | grep -q -- '--adversarial' && echo 1 || echo 0)
23
- FLAG_EDGE=$(echo "$ARGUMENTS" | grep -q -- '--edge-case' && echo 1 || echo 0)
24
- FLAG_DEVEX=$(echo "$ARGUMENTS" | grep -q -- '--devex' && echo 1 || echo 0)
25
-
26
- if [ "$SPEC_MODE" = "enterprise" ]; then
27
- FLAG_ADV=1
28
- FLAG_EDGE=1
29
- FLAG_DEVEX=1
30
- fi
31
- ```
32
-
33
- The entrypoint should resolve flags once, then route all review passes from
34
- that normalized configuration rather than reparsing later.
35
-
36
- `enterprise` mode auto-enables adversarial, edge-case, and DevEx review even
37
- when the user does not pass those flags explicitly. Manual flags still force
38
- the same behavior in non-enterprise modes.
@@ -1,49 +0,0 @@
1
- # Report Contract — Landing, Shape, Verdict
2
-
3
- ## Landing Check
4
-
5
- Sub-agent responses can truncate before the report is written. After dispatching
6
- review agents, verify the report actually landed:
7
-
8
- ```bash
9
- REPORT=".flow/specs/$SPEC_NAME/review-report.md"
10
- if [ ! -f "$REPORT" ] || [ "$(wc -c < "$REPORT" 2>/dev/null | tr -d ' ')" -lt 300 ]; then
11
- echo "⚠ Report missing or truncated. Re-dispatching flow-reviewer with a terse 'Write the report now, no narration' prompt."
12
- fi
13
- ```
14
-
15
- ## Report Shape
16
-
17
- ```markdown
18
- # Review Report — <spec-name>
19
-
20
- ## Stage 1 — Spec Compliance
21
- ...
22
-
23
- ## Stage 2 — Code Quality
24
- ...
25
-
26
- ## Adversarial (if run)
27
- ...
28
-
29
- ## Edge Cases (if run)
30
- ...
31
-
32
- ## DevEx (if run)
33
- ...
34
-
35
- ## Verdict
36
- - [ ] APPROVED
37
- - [X] CHANGES REQUIRED — <n> blockers
38
- - [ ] REJECTED
39
- ```
40
-
41
- ## Final Output
42
-
43
- Summarize:
44
-
45
- - Stage 1 finding count
46
- - Stage 2 finding count
47
- - optional pass finding counts
48
- - final verdict
49
- - report path
@@ -1,20 +0,0 @@
1
- # Review Reporting — Final Summary and Rerun Handoff
2
-
3
- End with a compact review summary:
4
-
5
- ```text
6
- ✓ Review complete
7
- Stage 1 findings: <n>
8
- Stage 2 findings: <n>
9
- Adversarial findings: <n> (if adversarial pass ran)
10
- Edge-case gaps: <n> (if edge-case pass ran)
11
- DevEx findings: <n> (if DevEx audit ran)
12
- Verdict: CHANGES REQUIRED
13
-
14
- Report: .flow/specs/<name>/review-report.md
15
-
16
- Next: address blockers, then re-run /curdx-flow:review.
17
- ```
18
-
19
- Keep the response outcome-focused. The report file is the artifact; the closing
20
- message only confirms counts, verdict, path, and next action.
@@ -1,32 +0,0 @@
1
- # Review Stages — Core Two-Pass Protocol
2
-
3
- ## Stage 1 — Spec Compliance
4
-
5
- Dispatch `flow-reviewer` in Stage 1 mode. It verifies:
6
-
7
- - every relevant `US`, `AC`, `FR`, and `NFR` in `requirements.md`
8
- - architecture decisions in `design.md`
9
- - `tasks.md` completion claims versus actual code
10
- - conventional commits versus declared task completion
11
-
12
- Output: the Stage 1 section of the review report with compliance gaps and
13
- evidence.
14
-
15
- ## Stage 2 — Code Quality
16
-
17
- Dispatch `flow-reviewer` in Stage 2 mode. It checks:
18
-
19
- - naming, comments, and structure
20
- - error handling completeness
21
- - test quality and coverage
22
- - performance and resource concerns
23
- - security smells
24
- - Karpathy 4 principles
25
-
26
- Output: the Stage 2 section of the review report with prioritized findings.
27
-
28
- ## Sequencing
29
-
30
- - `--stage=1` -> run only Stage 1
31
- - `--stage=2` -> run only Stage 2
32
- - `--stage=both` -> Stage 1 first, then Stage 2
@@ -1,47 +0,0 @@
1
- ---
2
- name: security-audit
3
- description: Use when the user needs security review of code, specs, credentials, sensitive data, or dependency risk.
4
- when_to_use: Triggers on "security", "auth", "authentication", "credential", "password", "secret", "API key", "token", "OWASP", "STRIDE", "CVE", "vulnerability", "injection", "XSS", "CSRF", "SSRF", "SQL injection", "hardcoded secret", "sensitive data", "leak", "will my API key leak", "is this safe".
5
- argument-hint: "[scope] [--depth=<owasp|stride|full>]"
6
- context: fork
7
- agent: flow-security-auditor
8
- paths:
9
- - "**/*.{js,jsx,ts,tsx,py,rb,go,java,kt,php,cs,rs,swift,sql,sh}"
10
- - "**/*.{json,yml,yaml,toml,tf,hcl,conf,ini}"
11
- - "**/.env*"
12
- - "**/Dockerfile*"
13
- - ".github/workflows/**"
14
- - ".gitlab-ci.yml"
15
- - "docker-compose*.yml"
16
- - "k8s/**"
17
- - "helm/**"
18
- - "infra/**"
19
- - "terraform/**"
20
- ---
21
-
22
- # Security Audit
23
-
24
- This skill orchestrates scoped security review. Keep the entrypoint focused on
25
- scope/depth selection, required audit outputs, and the blocking gate. Detailed
26
- rules live in:
27
-
28
- - `references/scope-and-depth.md`
29
- - `references/audit-contract.md`
30
- - `references/gate-handoff.md`
31
-
32
- ## Scope and Depth
33
-
34
- Use `references/scope-and-depth.md` to confirm:
35
-
36
- - scope
37
- - audit depth
38
- - risk tolerance
39
-
40
- ## Audit Contract
41
-
42
- `flow-security-auditor` should follow `references/audit-contract.md`.
43
-
44
- ## Gate and Handoff
45
-
46
- Blocking semantics and next-step routing live in
47
- `references/gate-handoff.md`.
@@ -1,21 +0,0 @@
1
- # Security Audit Contract — What the Auditor Must Produce
2
-
3
- `flow-security-auditor` should:
4
-
5
- 1. scan for secrets, weak crypto, and unsafe inputs
6
- 2. apply OWASP Top 10
7
- 3. apply STRIDE threat modeling when requested
8
- 4. run dependency CVE scanning
9
- 5. label findings by severity
10
-
11
- ## Required Artifact
12
-
13
- - `.flow/specs/<active>/security-audit.md`
14
-
15
- The report should include:
16
-
17
- - SR (blocking)
18
- - SW (warning)
19
- - SM (mandatory baseline)
20
- - CVE hits
21
- - concrete fixes
@@ -1,8 +0,0 @@
1
- # Security Gate Handoff — Blocking Rules and Next Steps
2
-
3
- Apply `@${CLAUDE_PLUGIN_ROOT}/gates/security-gate.md`.
4
-
5
- - if any SR findings exist, block completion until remediated or explicitly
6
- waived with a D-NN decision in `STATE.md`
7
- - if findings are advisory only, hand off `security-audit.md` as evidence for
8
- later implementation or review work
@@ -1,9 +0,0 @@
1
- # Security Scope and Depth — Confirm the Audit Shape
2
-
3
- Before dispatching, confirm:
4
-
5
- - scope: current spec, specific path, or whole repo
6
- - depth: `owasp`, `stride`, or `full`
7
- - risk tolerance: blocking vs advisory
8
-
9
- The positional first argument is the scope. Depth stays in `--depth=...`.
@@ -1,100 +0,0 @@
1
- ---
2
- name: spec
3
- description: Generate or refresh research, requirements, design, and tasks for the active spec.
4
- when_to_use: Use when the user wants to generate, resume, regenerate, or review a feature spec across research, requirements, design, and task planning.
5
- argument-hint: "[--phase=<X[,Y,...]>] [--until=<X>] [--review[=<dim[,dim]>]] [--regenerate] [--resume]"
6
- disable-model-invocation: true
7
- allowed-tools: [Read, Write, Bash, Agent, AskUserQuestion]
8
- ---
9
-
10
- # Generate or Refresh the Active Spec
11
-
12
- This command writes `research.md`, `requirements.md`, `design.md`, and
13
- `tasks.md` into `.flow/specs/<active-spec>/`.
14
-
15
- Keep this entrypoint focused on phase selection and orchestration. Detailed
16
- phase prompts and landing checks live in:
17
-
18
- - `references/preflight-and-routing.md`
19
- - `references/phase-execution.md`
20
- - `references/artifact-landing.md`
21
- - `references/planning-review.md`
22
- - `references/reporting.md`
23
-
24
- ## Flags
25
-
26
- | Flag | Default | Purpose |
27
- |------|---------|---------|
28
- | `--phase=<X[,Y]>` | (inferred from `.state.json`) | Run only the listed phase(s). `X ∈ {research, requirements, design, tasks}`. Accepts comma-separated list. |
29
- | `--until=<X>` | (none) | Run from the current phase forward, stopping after `X`. Mutually exclusive with `--phase`. |
30
- | `--review[=<dim[,dim]>]` | (not run) | After phases complete, run a planning review. `dim ∈ {ceo, eng, design, dx, all}`. Bare `--review` = `--review=all`. |
31
- | `--regenerate` | (resume) | Wipe existing phase output for the targeted phases and rebuild from scratch. |
32
- | `--resume` | (default) | Continue from `.state.json.phase`. This is the default when no flag is given. |
33
-
34
- ## Preflight
35
-
36
- Use `references/preflight-and-routing.md` for:
37
-
38
- - `.flow/`, active spec, and `.state.json` checks
39
- - flag parsing and invalid flag combinations
40
- - ordered phase routing and `--regenerate` scope resolution
41
-
42
- ## Phase Resolution
43
-
44
- The ordered pipeline is still `research -> requirements -> design -> tasks`.
45
- The exact routing rules and stopping points are defined in
46
- `references/preflight-and-routing.md`.
47
-
48
- ## Phase Dispatch
49
-
50
- Phase-specific prompts, mandatory output protocols, and post-phase state updates
51
- live in `references/phase-execution.md`.
52
-
53
- Use this phase-to-agent mapping:
54
-
55
- | Phase | Agent | Output |
56
- |-------|-------|--------|
57
- | `research` | `flow-researcher` | `research.md` |
58
- | `requirements` | `flow-product-designer` | `requirements.md` |
59
- | `design` | `flow-architect` | `design.md` |
60
- | `tasks` | `flow-planner` | `tasks.md` |
61
-
62
- After each dispatch, run the landing guard from
63
- `references/artifact-landing.md`. Never advance phase state based only on the
64
- agent's narrative response.
65
-
66
- ## Optional Planning Review
67
-
68
- If `--review` is present, use the dimension-expansion and aggregation protocol
69
- from `references/planning-review.md`.
70
-
71
- The review output lands at:
72
-
73
- - `.flow/specs/<active>/spec-review.md`
74
-
75
- ## Reporting
76
-
77
- Use `references/reporting.md` for the final user-visible summary and next-step
78
- handoff.
79
-
80
- ## Common Invocations
81
-
82
- ```text
83
- /curdx-flow:spec
84
- /curdx-flow:spec --phase=design
85
- /curdx-flow:spec --phase=design,tasks
86
- /curdx-flow:spec --until=design
87
- /curdx-flow:spec --review
88
- /curdx-flow:spec --review=eng,dx
89
- /curdx-flow:spec --regenerate
90
- /curdx-flow:spec --regenerate --phase=tasks
91
- ```
92
-
93
- ## References
94
-
95
- - Agents: `@${CLAUDE_PLUGIN_ROOT}/agents/flow-researcher.md`,
96
- `flow-product-designer.md`, `flow-architect.md`, `flow-planner.md`,
97
- `flow-ux-designer.md`
98
- - Knowledge: `@${CLAUDE_PLUGIN_ROOT}/knowledge/spec-driven-development.md`,
99
- `poc-first-workflow.md`
100
- - Preamble: `@${CLAUDE_PLUGIN_ROOT}/agent-preamble/preamble.md`
@@ -1,31 +0,0 @@
1
- # Artifact Landing Check — Mandatory After Every Phase
2
-
3
- Sub-agent responses can be truncated before the `Write` tool call happens. Do
4
- not trust the agent response alone.
5
-
6
- ## Landing Guard
7
-
8
- ```bash
9
- ARTIFACT=".flow/specs/$SPEC_NAME/<phase>.md"
10
- if [ ! -f "$ARTIFACT" ]; then
11
- echo "⚠ $ARTIFACT did not land. Re-dispatching <phase> agent with an explicit 'write the file' prompt."
12
- fi
13
-
14
- if [ -f "$ARTIFACT" ] && [ "$(wc -c < "$ARTIFACT" | tr -d ' ')" -lt 500 ]; then
15
- echo "⚠ $ARTIFACT looks truncated (<500 bytes). Re-dispatching to complete it."
16
- fi
17
- ```
18
-
19
- ## Re-dispatch Rule
20
-
21
- If the artifact is missing or obviously truncated, front-load the retry prompt
22
- with:
23
-
24
- ```text
25
- Your ONLY job is to call the Write tool with the full <phase>.md content now.
26
- Do not explain. Do not narrate. Write the file and stop.
27
- ```
28
-
29
- Only advance `.state.json.phase` after the file exists and passes the size
30
- sanity check. If a second dispatch still fails, stop and surface the problem to
31
- the user rather than silently continuing.
@@ -1,50 +0,0 @@
1
- # Phase Execution — Dispatch Contracts
2
-
3
- Each phase writes exactly one artifact. The file is the deliverable; agent
4
- commentary is not.
5
-
6
- Shared runtime references:
7
-
8
- - `${CLAUDE_PLUGIN_ROOT}/knowledge/artifact-output-discipline.md`
9
- - `${CLAUDE_PLUGIN_ROOT}/knowledge/artifact-summary-contracts.md`
10
-
11
- ## Phase Map
12
-
13
- | Phase | Agent | Inputs | Output |
14
- |-------|-------|--------|--------|
15
- | `research` | `flow-researcher` | spec goal + one-line description from `.state.json` | `research.md` |
16
- | `requirements` | `flow-product-designer` | `research.md` | `requirements.md` |
17
- | `design` | `flow-architect` | `research.md` + `requirements.md` | `design.md` |
18
- | `tasks` | `flow-planner` | all prior artifacts + `.flow/PROJECT.md` | `tasks.md` |
19
-
20
- ## Shared Dispatch Rule
21
-
22
- Every phase dispatch must explicitly enforce the same two rules:
23
-
24
- 1. The first substantive action is the `Write` call for the final artifact.
25
- 2. After the write lands, emit only the matching summary contract from
26
- `${CLAUDE_PLUGIN_ROOT}/knowledge/artifact-summary-contracts.md`.
27
-
28
- Do not inline previews, rationale summaries, or duplicate artifact content in
29
- the orchestration skill.
30
-
31
- ## Phase Output Contracts
32
-
33
- | Phase | Artifact | Summary contract | Next line |
34
- |-------|----------|------------------|-----------|
35
- | `research` | `research.md` | `research.md` section | `Next: /curdx-flow:spec --phase=requirements` |
36
- | `requirements` | `requirements.md` | `requirements.md` section | `Next: /curdx-flow:spec --phase=design` |
37
- | `design` | `design.md` | `design.md` section | `Next: /curdx-flow:spec --phase=tasks` |
38
- | `tasks` | `tasks.md` | `tasks.md` section | `Next: /curdx-flow:implement` |
39
-
40
- ## Post-Phase State Update
41
-
42
- After the artifact lands and passes landing checks, update `.state.json`:
43
-
44
- ```json
45
- {
46
- "phase": "<just-completed-phase>",
47
- "phase_status": { "<phase>": "completed" },
48
- "updated": "<ISO8601 timestamp>"
49
- }
50
- ```
@@ -1,31 +0,0 @@
1
- # Planning Review — Optional Multi-Dimension Pass
2
-
3
- Use this only when `--review` is present.
4
-
5
- ## Preconditions
6
-
7
- - `design.md` must exist
8
- - Bare `--review` expands to `ceo,eng,design,dx`
9
- - `all` also expands to `ceo,eng,design,dx`
10
-
11
- ## Dimension Map
12
-
13
- | Dim | Agent | Focus |
14
- |-----|-------|-------|
15
- | `ceo` | `flow-architect` (review mode) | Strategic scope fit, ROI, opportunity cost |
16
- | `eng` | `flow-architect` (review mode) | Lock-in risk, architecture debt, technical risk |
17
- | `design` | `flow-ux-designer` | UX, UI, accessibility, design system fit |
18
- | `dx` | `flow-architect` (review mode) | Naming, structure, setup, types, tests, developer loop |
19
-
20
- ## Aggregation
21
-
22
- Dispatch one review agent per dimension, aggregate findings into:
23
-
24
- ```text
25
- .flow/specs/<active>/spec-review.md
26
- ```
27
-
28
- The report must contain:
29
-
30
- - one section per requested dimension
31
- - a consolidated verdict: `GO`, `GO-WITH-CHANGES`, or `HOLD`
@@ -1,46 +0,0 @@
1
- # Spec Preflight and Routing — Resolve What Runs
2
-
3
- Before dispatching any phase:
4
-
5
- ```bash
6
- [ ! -d ".flow" ] && {
7
- echo "✗ Not a CurdX-Flow project. Run /curdx-flow:init first.";
8
- exit 1;
9
- }
10
-
11
- SPEC_NAME=$(cat .flow/.active-spec 2>/dev/null)
12
- if [ -z "$SPEC_NAME" ]; then
13
- echo "✗ No active spec. Run /curdx-flow:start <name> \"<goal>\" first.";
14
- exit 1;
15
- fi
16
- SPEC_DIR=".flow/specs/$SPEC_NAME"
17
- STATE_FILE="$SPEC_DIR/.state.json"
18
- [ ! -f "$STATE_FILE" ] && { echo "✗ Missing $STATE_FILE"; exit 1; }
19
-
20
- FLAG_PHASE=$(echo "$ARGUMENTS" | grep -oP -- '--phase=\K[^\s]+' || true)
21
- FLAG_UNTIL=$(echo "$ARGUMENTS" | grep -oP -- '--until=\K[^\s]+' || true)
22
- FLAG_REVIEW=$(echo "$ARGUMENTS" | grep -oP -- '--review(?:=[^\s]+)?' || true)
23
- FLAG_REGENERATE=$(echo "$ARGUMENTS" | grep -q -- '--regenerate' && echo "1" || echo "0")
24
-
25
- if [ -n "$FLAG_PHASE" ] && [ -n "$FLAG_UNTIL" ]; then
26
- echo "✗ --phase and --until cannot be combined. Pick one.";
27
- exit 1;
28
- fi
29
- ```
30
-
31
- The ordered pipeline is:
32
-
33
- ```text
34
- research -> requirements -> design -> tasks
35
- ```
36
-
37
- Routing rules:
38
-
39
- - no flags -> start at `.state.json.phase`, run forward to `tasks`
40
- - `--phase=design` -> run only `design`
41
- - `--phase=design,tasks` -> run `design` then `tasks`
42
- - `--until=design` -> start at `.state.json.phase`, stop after `design`
43
- - `--regenerate` -> clear targeted phase output before rerunning it
44
-
45
- Advance `.state.json.phase` only after the targeted artifact lands and passes
46
- `references/artifact-landing.md`.
@@ -1,21 +0,0 @@
1
- # Spec Reporting — Final Summary and Handoff
2
-
3
- End with a compact execution summary:
4
-
5
- ```text
6
- ✓ Spec <name> refreshed
7
- Phases run: research, requirements, design, tasks
8
- Review dims: ceo, eng, design, dx (if --review was used)
9
- Files:
10
- .flow/specs/<name>/research.md
11
- .flow/specs/<name>/requirements.md
12
- .flow/specs/<name>/design.md
13
- .flow/specs/<name>/tasks.md
14
- .flow/specs/<name>/spec-review.md (if --review was used)
15
-
16
- Next: /curdx-flow:implement
17
- ```
18
-
19
- Do not summarize the full content of the artifacts inline. The files are the
20
- deliverables; the closing message only confirms what ran and where the outputs
21
- landed.