@dzhechkov/p-replicator 1.1.0 → 1.3.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@dzhechkov/p-replicator",
-  "version": "1.1.0",
-  "description": "P-Replicator — Claude Code toolkit for AI-assisted product development (Vibe Coding). Full /replicate pipeline, 10 modular skills (165K+ chars), /harvest knowledge extraction, swarm agents, quality gates, cross-project learning.",
+  "version": "1.3.0",
+  "description": "P-Replicator — Claude Code toolkit for AI-assisted product development (Vibe Coding). Full /replicate pipeline, 10 modular skills (194K+ chars), /harvest knowledge extraction, swarm agents, quality gates, security patterns, cross-project learning.",
   "main": "src/cli.js",
   "bin": {
     "p-replicator": "bin/cli.js"
@@ -35,6 +35,8 @@
     "bdd",
     "invest",
     "smart",
+    "security",
+    "owasp",
     "documentation",
     "skill-pack",
     "modular-skills",

package/templates/.claude/rules/replicate-pipeline.md

@@ -20,7 +20,7 @@ When executing skills during the pipeline:
 3. When a skill references `/mnt/user-data/uploads/` — read from `docs/` instead
 4. When a skill outputs to `/output/` — write to `docs/` or project root instead
 5. `goap-research` skill name maps to `goap-research-ed25519` in this repo
-6. When a skill has `modules/` directory — read the module file referenced by the phase
+6. **CRITICAL:** When a skill has `modules/` directory — you MUST read the FULL module file for EVERY phase before executing it. SKILL.md is the orchestrator only — it contains summaries, NOT the actual generation logic. NEVER generate artifacts from SKILL.md summaries. In a real project, skipping `modules/04-generate-p1.md` caused 10+ artifacts to be silently omitted.
 7. See `.claude/rules/skill-interface-protocol.md` for full interface specification
 
 ## Modular Skills
@@ -28,6 +28,10 @@ When executing skills during the pipeline:
 Skills with `modules/` directories delegate phases to self-contained module files.
 Each module follows: INPUT → PROCESS → OUTPUT → QUALITY GATE interface.
 
+**MANDATORY:** Before executing any modular skill phase, read the corresponding module file in full.
+Module files contain the actual generation instructions, templates, and quality gates.
+SKILL.md contains only summaries and orchestration logic — it is NOT sufficient for generation.
+
 Currently modularized skills:
 - `cc-toolkit-generator-enhanced` — 9 modules (6 core pipeline + 3 extensions)
 - `knowledge-extractor` — 4 modules (agent review → classify → decontextualize → integrate)

package/templates/.claude/skills/brutal-honesty-review/SKILL.md

@@ -136,6 +136,49 @@ higher quality. They don't."
 
 ---
 
+## Security Review Checklist (Linus Mode — CRITICAL)
+
+When reviewing code that handles authentication, authorization, data storage,
+or external integrations, apply this checklist in addition to standard code quality:
+
+### OWASP Top 10 Quick Checks
+
+| # | Vulnerability | What to Look For | Severity |
+|---|--------------|-------------------|----------|
+| A01 | Broken Access Control | Missing auth middleware, RLS bypass (pool.query vs dbClient), cross-tenant entity access without ownership check | CRITICAL |
+| A02 | Cryptographic Failures | Weak JWT secrets with fallback defaults, hardcoded secrets, missing HMAC on webhooks | CRITICAL |
+| A03 | Injection | SQL via string interpolation (SET LOCAL), template literals in queries, unsanitized user input in commands | CRITICAL |
+| A04 | Insecure Design | Per-request stateful services (circuit breakers never trigger), missing rate limiting | HIGH |
+| A05 | Security Misconfiguration | Same CORS policy across environments, verbose errors in production, missing security headers | HIGH |
+| A07 | Auth Failures | No account lockout, weak password policy, session fixation | HIGH |
+| A08 | Data Integrity | Unsigned webhook payloads, missing CSRF tokens, unvalidated redirects | HIGH |
+| A09 | Logging Failures | No audit trail for auth events, PII in logs, missing failed-attempt logging | MEDIUM |
+
+### Multi-Tenant Security (if applicable)
+
+- [ ] All DB queries use tenant-scoped connection, NOT shared pool
+- [ ] SET LOCAL uses parameterized set_config(), NOT string interpolation
+- [ ] Cross-entity references verify tenant ownership before operation
+- [ ] Tenant isolation tested with cross-tenant attack scenarios
+
+### Secret Management
+
+- [ ] All secrets validated at startup — missing = process.exit(1)
+- [ ] No fallback defaults for security-critical secrets
+- [ ] Secrets never appear in logs, error messages, or stack traces
+- [ ] Environment-specific security posture (dev/staging/prod)
+
+### Webhook Security
+
+- [ ] Every webhook endpoint verifies request signature/HMAC
+- [ ] Unsigned payloads are rejected and logged
+- [ ] Webhook secrets stored in environment variables
+
+**Calibration:** Security violations ALWAYS trigger Level 3 (Brutal).
+Security bugs are not "style issues" — they are negligence.
+
+---
+
 ## Assessment Rubrics
 
 ### Code Quality (Linus Mode)

package/templates/.claude/skills/cc-toolkit-generator-enhanced/SKILL.md

@@ -18,6 +18,14 @@ description: >
   Three modes: AUTO, HYBRID (default), MANUAL.
 ---
 
+> **CRITICAL MODULE LOADING REQUIREMENT:**
+> This skill has 9 modules in `modules/`. SKILL.md is the orchestrator ONLY.
+> You MUST read EVERY module file referenced in the Module Execution Protocol below
+> before executing its phase. Skipping module files causes entire artifact categories
+> to be silently omitted. In one real project, skipping `modules/04-generate-p1.md`
+> caused 10+ P1 artifacts (agents, skills, commands) to be completely missing.
+> NEVER generate artifacts from SKILL.md summaries alone — always read the full module.
+
 # CC-Toolkit-Generator Enhanced
 
 Generate production-ready Claude Code instruments from **SPARC or idea2prd-manual documentation**.

package/templates/.claude/skills/cc-toolkit-generator-enhanced/modules/03-generate-p0.md

@@ -27,6 +27,12 @@ From the Instrument Map this module uses:
 
 ## Process
 
+> **ANTI-COMPRESSION DIRECTIVE:** When generating files from templates in this module,
+> COPY the FULL text of each template. Do NOT summarize, compress, or "interpret" templates.
+> Every section, every placeholder, every comment must be preserved verbatim.
+> AI systems routinely compress 211-line templates to 60 lines — this is a CRITICAL defect.
+> Validate: generated file line count must be >= 80% of template line count.
+
 ### P0 Mandatory Items (always generated)
 
 The following 16 items are generated for every project, regardless of pipeline
@@ -37,6 +43,7 @@ type or user mode.
 #### Item 1: CLAUDE.md
 
 **Template:** `view() references/claude-md-strategy.md`
+> CRITICAL: COPY the full template. Do NOT compress or summarize.
 
 The project's root context file. Generation strategy differs by pipeline:
 
@@ -154,6 +161,39 @@ Generate `.claude/rules/coding-style.md` containing:
 - Code organization patterns
 - IF idea2prd: DDD tactical patterns (aggregate rules, entity identity, VO immutability)
 
+**Known Gotchas section (always include):**
+
+Add a `## Known Gotchas` section to coding-style.md with language/framework-specific
+pitfalls extracted from harvest insights. Include at minimum:
+
+```markdown
+## Known Gotchas
+
+### TypeScript / JavaScript
+- `\w` in regex does NOT match Cyrillic or other non-Latin characters.
+  Use `\p{L}` with `/u` flag or explicit character classes for Unicode text.
+- Direct type casting `req as CustomType` fails with TS2352. Use double-cast
+  via `unknown`: `(req as unknown as CustomType)`. Better: use generic route handlers.
+- Jest `coverageThreshold` (singular) silently fails if spelled `coverageThresholds` (plural).
+  Per-directory thresholds require a `global` key. ts-jest needs `ts-node` as peer dependency.
+- `jest.fn(async () => value)` doesn't satisfy `jest.Mocked<T>` in strict mode.
+  Use `jest.fn().mockResolvedValue(value)` or `jest.fn().mockImplementation(...)`.
+- Opossum `CircuitBreaker.fire()` returns `Promise<unknown>`, requires explicit cast.
+  Both `@types/opossum` and `opossum` packages are needed.
+- Socket.io `Server` has no `.toRoom()` method. Wrap it:
+  `{ toRoom: (room) => io.to(room) }` for hexagonal architecture ports.
+
+### Infrastructure
+- Services with circuit breakers/rate limiters MUST be singletons.
+  Per-request instances bypass protection (breaker never accumulates failures).
+- `SET LOCAL` in PostgreSQL only affects the current transaction on the current connection.
+  Use parameterized `set_config()` instead of string interpolation.
+```
+
+Adapt gotchas to the specific tech stack detected in IPM. Remove irrelevant entries
+(e.g., no TypeScript gotchas for Python projects). Add stack-specific gotchas from
+`view() references/security-patterns-library.md` if applicable.
+
 **Output path:** `.claude/rules/coding-style.md`
 
 ---
@@ -161,6 +201,7 @@ Generate `.claude/rules/coding-style.md` containing:
 #### Item 4: /start command
 
 **Template:** `view() references/templates/start-command.md`
+> CRITICAL: COPY the full template. Do NOT compress or summarize.
 
 Generate `.claude/commands/start.md` -- the full project bootstrap command.
 
@@ -189,6 +230,7 @@ code from memory. Every Phase 2 Task includes explicit doc references.
 #### Item 5: /myinsights command
 
 **Template:** `view() references/templates/insights-system.md` (Section 1)
+> CRITICAL: COPY the full template. Do NOT compress or summarize.
 
 Generate `.claude/commands/myinsights.md` -- the insight capture and management
 command with:
@@ -207,6 +249,7 @@ command with:
 #### Item 6: /feature command
 
 **Template:** `view() references/templates/feature-lifecycle.md` (Section 2)
+> CRITICAL: COPY the full template. Do NOT compress or summarize.
 
 Generate `.claude/commands/feature.md` -- the 4-phase feature lifecycle command:
 
@@ -278,6 +321,7 @@ type(scope): description
 #### Item 8: insights-capture.md rule
 
 **Template:** `view() references/templates/insights-system.md` (Section 2)
+> CRITICAL: COPY the full template. Do NOT compress or summarize.
 
 Generate `.claude/rules/insights-capture.md` with:
 - Error-First Lookup protocol (grep index BEFORE debugging)
@@ -293,6 +337,7 @@ Generate `.claude/rules/insights-capture.md` with:
 #### Item 9: feature-lifecycle.md rule
 
 **Template:** `view() references/templates/feature-lifecycle.md` (Section 3)
+> CRITICAL: COPY the full template. Do NOT compress or summarize.
 
 Generate `.claude/rules/feature-lifecycle.md` with:
 - Protocol definition (4-phase lifecycle)
@@ -310,6 +355,7 @@ Generate `.claude/rules/feature-lifecycle.md` with:
 #### Item 10: settings.json hooks
 
 **Template:** `view() references/templates/insights-system.md` (Section 3 -- Stop hook)
+> CRITICAL: COPY the full template. Do NOT compress or summarize.
 
 Generate `.claude/settings.json` with hook configuration:
 

package/templates/.claude/skills/cc-toolkit-generator-enhanced/modules/04-generate-p1.md

@@ -19,6 +19,12 @@ engine and conditionally included based on project characteristics and document
 
 ## Process
 
+> **ANTI-COMPRESSION DIRECTIVE:** When generating files from templates in this module,
+> COPY the FULL text of each template. Do NOT summarize, compress, or "interpret" templates.
+> Every section, every placeholder, every comment must be preserved verbatim.
+> AI systems routinely compress 211-line templates to 60 lines — this is a CRITICAL defect.
+> Validate: generated file line count must be >= 80% of template line count.
+
 ### Step 1: Filter P1 Candidates
 
 Select all instruments assigned tier P1 from the Instrument Map (score >= 12 after tier boosts).
@@ -208,6 +214,7 @@ Generate .claude/rules/testing.md:
 **Trigger:** `IPM.has_ddd == true`
 
 Read complete template: `view("references/templates/feature-lifecycle-ent.md")`
+> CRITICAL: COPY the full template. Do NOT compress or summarize.
 
 ```
 IF has_ddd:
@@ -254,6 +261,7 @@ IF has_ddd:
 **Trigger:** Always generated for P1 (enhances developer workflow regardless of pipeline).
 
 Read complete template: `view("references/templates/feature-suggestions.md")`
+> CRITICAL: COPY the full template. Do NOT compress or summarize.
 
 ```
 7a. Generate .claude/feature-roadmap.json
@@ -305,6 +313,7 @@ Read complete template: `view("references/templates/feature-suggestions.md")`
 **Trigger:** Always generated for P1 (provides autonomous execution capabilities).
 
 Read complete template: `view("references/templates/automation-commands.md")`
+> CRITICAL: COPY the full template. Do NOT compress or summarize.
 
 ```
 8a. Generate .claude/commands/go.md

package/templates/.claude/skills/cc-toolkit-generator-enhanced/modules/05-generate-p2p3.md

@@ -22,6 +22,12 @@ when DDD documentation is detected.
 
 ## Process
 
+> **ANTI-COMPRESSION DIRECTIVE:** When generating files from templates in this module,
+> COPY the FULL text of each template. Do NOT summarize, compress, or "interpret" templates.
+> Every section, every placeholder, every comment must be preserved verbatim.
+> AI systems routinely compress 211-line templates to 60 lines — this is a CRITICAL defect.
+> Validate: generated file line count must be >= 80% of template line count.
+
 ### Tier Overview
 
 ```
@@ -41,6 +47,7 @@ P3 — External Integrations:
 Source: Pseudocode (SPARC/idea2prd) + Gherkin tests (idea2prd) + Fitness Functions (idea2prd)
 
 Read template: `view("references/templates/ddd-agents.md")` section "tdd-guide.md Agent (Enhanced)"
+> CRITICAL: COPY the full template. Do NOT compress or summarize.
 
 ```
 Generate .claude/agents/tdd-guide.md:
@@ -156,6 +163,7 @@ skip this entire step.
 Source: DDD Tactical (aggregates) + Fitness Functions
 
 Read template: `view("references/templates/ddd-agents.md")` section "ddd-validator.md Agent"
+> CRITICAL: COPY the full template. Do NOT compress or summarize.
 
 ```
 IF has_ddd:
@@ -191,6 +199,7 @@ IF has_ddd:
 Source: DDD Tactical (aggregates, entities, value-objects)
 
 Read template: `view("references/templates/ddd-skills.md")` section "aggregate-patterns/ Skill"
+> CRITICAL: COPY the full template. Do NOT compress or summarize.
 
 ```
 IF has_ddd:
@@ -213,6 +222,7 @@ IF has_ddd:
 Source: DDD Tactical (events)
 
 Read template: `view("references/templates/ddd-skills.md")` section "event-handlers/ Skill"
+> CRITICAL: COPY the full template. Do NOT compress or summarize.
 
 ```
 IF has_ddd:
@@ -284,6 +294,7 @@ IF has_ddd AND has_fitness:
 ### Step 3: Generate P3 Items — MCP Configuration
 
 Read complete template: `view("references/templates/mcp.md")`
+> CRITICAL: COPY the full template. Do NOT compress or summarize.
 
 ```
 Generate .mcp.json in project root:

package/templates/.claude/skills/cc-toolkit-generator-enhanced/modules/06-package-deliver.md

@@ -216,6 +216,52 @@ CHECK 20: P3 MCP (IF external integrations detected)
   [ ] INSTALL.md documents all required env vars from .mcp.json
 ```
 
+### Step 1.5: Automated File-Existence Validation
+
+Before proceeding to placeholder scanning, run an automated file-existence check
+against the expected output manifest. This catches the most common generation failure:
+files that should exist but were silently omitted (often due to skipping module files).
+
+```
+AUTOMATED FILE CHECK PROTOCOL:
+
+Step 1: Build expected file list from Instrument Map tiers:
+  - P0 mandatory: 16 items (always expected)
+  - P0 conditional: check IPM flags before expecting
+  - P1 core: 10 items (if P1 was executed)
+  - P1 conditional: check IPM flags
+  - P2/P3: check flags and execution status
+
+Step 2: For each expected file, run existence check:
+  for file in expected_files:
+    if not exists(file.path):
+      log CRITICAL: "Missing file: {file.path} (expected from {file.phase})"
+      missing_count++
+
+Step 3: For each expected directory, verify SKILL.md exists inside:
+  for skill_dir in expected_skill_directories:
+    if not exists(skill_dir + "/SKILL.md"):
+      log CRITICAL: "Missing SKILL.md in {skill_dir}"
+      missing_count++
+
+Step 4: Verify file sizes (anti-compression check):
+  for file in generated_files:
+    if file.size_bytes < 100:
+      log WARNING: "Suspiciously small file: {file.path} ({file.size_bytes} bytes)"
+      log WARNING: "Possible template compression — verify content completeness"
+
+Step 5: Report
+  if missing_count > 0:
+    CRITICAL FAILURE: {missing_count} expected files are missing.
+    List each missing file with its expected source phase/module.
+    Attempt auto-fix by re-reading the relevant module and regenerating.
+  else:
+    PASS: All {total_count} expected files exist.
+```
+
+This step was added based on a real-project insight where skipping `modules/04-generate-p1.md`
+caused 10+ P1 artifacts to be silently omitted without any error in the final report.
+
 ### Step 2: Verify Placeholder Substitution
 
 Scan ALL generated files for unsubstituted placeholders:

package/templates/.claude/skills/cc-toolkit-generator-enhanced/references/security-patterns-library.md

@@ -0,0 +1,196 @@
+# Security Patterns Library
+
+Reference library of security patterns extracted from real-project harvest insights.
+Used by toolkit generator modules (03, 04, 05) when generating security.md rules,
+secrets-management.md, security-patterns/ skill, and code-reviewer agent.
+
+## Critical Patterns (Must-Have for Multi-Tenant Systems)
+
+### S-01: RLS Bypass Prevention — Pool vs Client Query
+
+**Problem:** Tenant middleware sets `app.tenant_id` via `SET LOCAL` on a dedicated
+PoolClient (`req.dbClient`), but repositories use `pool.query()` (shared pool).
+The query runs on a different connection without tenant context — RLS is bypassed.
+
+**Pattern:**
+```
+RULE: NEVER use pool.query() in multi-tenant systems with RLS.
+ALWAYS pass the tenant-scoped dbClient from middleware through service layer to repository.
+Every database query MUST use the same connection where SET LOCAL was executed.
+```
+
+**Detection:** Search for `pool.query()` in repository files when RLS is enabled.
+
+**Generated Rule (security.md):**
+```markdown
+- Multi-tenant RLS: All database queries MUST use tenant-scoped connection (req.dbClient),
+  NEVER the shared pool. Verify by grepping for pool.query() — any hit is a security bug.
+```
+
+---
+
+### S-02: SQL Injection via SET LOCAL
+
+**Problem:** String interpolation in `SET LOCAL app.tenant_id = '${tenantId}'`
+is an SQL injection vector even with UUID validation.
+
+**Pattern:**
+```
+RULE: NEVER use string interpolation for SET LOCAL.
+ALWAYS use parameterized set_config():
+  SELECT set_config('app.tenant_id', $1, true)
+```
+
+**Detection:** Search for `SET LOCAL` with template literals or string concatenation.
+
+**Generated Rule (security.md):**
+```markdown
+- Parameterized config: Use `set_config('key', $1, true)` instead of
+  `SET LOCAL key = '${value}'`. Applies to all session-level config.
+```
+
+---
+
+### S-03: Fail-Fast Secret Validation at Startup
+
+**Problem:** Service A falls back to `'dev-secret-change-me'` when JWT_SECRET is
+missing, while Service B uses `process.env.JWT_SECRET!`. Creates split-brain:
+signing uses weak fallback, verification uses undefined.
+
+**Pattern:**
+```
+RULE: NEVER provide fallback values for security-critical secrets.
+ALWAYS validate at startup and exit with process.exit(1) if missing or too short.
+
+Required checks:
+- JWT_SECRET: exists AND length >= 32 characters
+- DATABASE_URL: exists AND not localhost in production
+- API keys: exist AND not placeholder values
+```
+
+**Generated Rule (security.md):**
+```markdown
+- Startup secret guard: All security secrets (JWT_SECRET, API keys, encryption keys)
+  MUST be validated at application startup. Missing or weak secrets MUST cause
+  immediate process.exit(1). NEVER use fallback defaults for secrets.
+```
+
+---
+
+### S-04: Cross-Tenant Entity Ownership
+
+**Problem:** API endpoint accepts an entity ID (e.g., operatorId) without
+verifying that the entity belongs to the requesting tenant. RLS on the target
+table may not cover this cross-reference.
+
+**Pattern:**
+```
+RULE: Before using any entity ID from request params in a cross-table operation,
+verify the entity belongs to the same tenant:
+  1. Load entity by ID
+  2. Check entity.tenantId === request.tenantId
+  3. Return 403 if mismatch
+```
+
+**Generated Rule (security.md):**
+```markdown
+- Cross-tenant ownership: When an API accepts entity IDs (operatorId, userId, etc.),
+  ALWAYS verify entity.tenantId matches the requesting tenant before any operation.
+  RLS alone may not protect cross-table references.
+```
+
+---
+
+### S-05: Webhook Signature Verification
+
+**Problem:** Webhook endpoints accept any POST without HMAC/signature verification.
+Attackers can inject fake messages if webhook URLs are discovered.
+
+**Pattern:**
+```
+RULE: Every webhook endpoint MUST verify the request signature:
+- Telegram: verify X-Telegram-Bot-Api-Secret-Token header
+- Stripe: verify Stripe-Signature header with webhook secret
+- GitHub: verify X-Hub-Signature-256 header
+- Generic: verify HMAC-SHA256 of body with shared secret
+```
+
+**Generated Rule (security.md):**
+```markdown
+- Webhook HMAC: Every webhook endpoint MUST verify request signature/HMAC.
+  NEVER accept unsigned webhook requests. Log and reject unsigned payloads.
+```
+
+---
+
+## High-Priority Patterns
+
+### S-06: Singleton Service Instances
+
+**Problem:** Creating service instances per-request (e.g., `Service.fromEnv()` in
+route handler) means stateful components like circuit breakers never accumulate
+failure state and never trigger protection.
+
+**Pattern:**
+```
+RULE: Services with stateful protection mechanisms (circuit breakers, rate limiters,
+connection pools) MUST be created as singletons at application startup.
+NEVER create per-request instances of stateful services.
+```
+
+**Impact on Generated Code:**
+- In architect.md agent: include singleton pattern for infrastructure services
+- In coding-style.md rule: "stateful services are singletons, injected at startup"
+
+---
+
+### S-07: Environment-Specific Security Posture
+
+**Pattern:**
+```
+RULE: Security posture MUST match environment:
+- Development: relaxed CORS, verbose errors, debug logging
+- Staging: production-like security, sanitized test data
+- Production: strict CORS, generic errors, structured logging only
+
+NEVER: same security config across all environments
+NEVER: expose stack traces in production error responses
+```
+
+---
+
+## Integration Patterns for Generated Toolkit
+
+### How Patterns Map to Generated Files
+
+| Pattern | security.md | secrets-management.md | code-reviewer.md | architect.md |
+|---------|------------|----------------------|-------------------|--------------|
+| S-01 RLS Bypass | Rule | — | Check | Architecture note |
+| S-02 SQL Injection | Rule | — | Check | — |
+| S-03 Secret Validation | Rule | Primary content | Check | Startup validation |
+| S-04 Cross-Tenant | Rule | — | Check | — |
+| S-05 Webhook HMAC | Rule | Secret storage | Check | — |
+| S-06 Singleton | — | — | Check | Architecture pattern |
+| S-07 Env Security | Rule | Env-specific rules | — | Environment guide |
+
+### Usage in Module 03 (Generate P0)
+
+When generating `security.md` rule (Item 2), include applicable patterns:
+- IF multi-tenant detected: S-01, S-02, S-04
+- IF has_external_apis: S-03, S-05
+- IF has_database: S-01, S-02
+- ALWAYS: S-03, S-07
+
+### Usage in Module 04 (Generate P1)
+
+When generating `code-reviewer.md` agent (Step 2b), add security review checklist
+from applicable patterns to the agent's review criteria.
+
+When generating `architect.md` agent (Step 2c), include S-06 singleton pattern
+and S-07 environment posture in architecture guidelines.
+
+### Usage in brutal-honesty-review
+
+When reviewing code in Linus Mode, check for violations of all S-01 through S-07
+patterns as CRITICAL findings. Security violations should always trigger
+Level 3 (Brutal) calibration.

package/templates/.claude/skills/cc-toolkit-generator-enhanced/references/templates/automation-commands.md

@@ -27,6 +27,13 @@ description: Intelligent feature implementation pipeline. Analyzes complexity an
 One-command feature implementation that automatically selects the right pipeline
 based on feature complexity, then executes it without manual confirmations.
 
+> **PROCESS COMPLIANCE — BLOCKING RULES:**
+> - MUST use /plan, /feature, or /feature-ent commands — NEVER launch raw Agent tools directly
+> - MUST follow the skill chain: /next -> /go -> /plan|/feature|/feature-ent
+> - FORBIDDEN: Bypassing the skill chain by spawning parallel agents without commands
+> - FORBIDDEN: Batching multiple features into a single commit wave
+> - CRITICAL: Each feature MUST get its own plan, validation, and commit sequence
+
 ## Step 1: Determine Target Feature
 
 IF $ARGUMENTS is provided:
@@ -186,6 +193,14 @@ description: Autonomous project build loop. Bootstraps project and implements fe
 End-to-end autonomous project build: bootstrap → implement features in loop → done.
 Combines `/start`, `/next`, and `/go` into a single continuous pipeline.
 
+> **AUTONOMOUS EXECUTION — BLOCKING RULES:**
+> - MUST execute features ONE AT A TIME through the full /go pipeline
+> - MUST create 1 plan per feature, 1 validation per feature, 1 commit per feature
+> - NEVER batch features into parallel waves without individual plans
+> - NEVER skip the /next -> /go pipeline by launching raw implementation agents
+> - CRITICAL: If a feature fails 3 times, skip it and log — NEVER retry indefinitely
+> - MUST push state after each feature completion (independent commits)
+
 ## Step 0: Parse Scope
 
 ```

package/templates/.claude/skills/cc-toolkit-generator-enhanced/references/templates/ddd-agents.md

@@ -194,6 +194,44 @@ Proposed
 [What was rejected and why?]
 ```
 
+## Architecture Patterns
+
+### Singleton Services (Infrastructure)
+
+Services with stateful protection mechanisms MUST be created as singletons at
+application startup. NEVER create per-request instances of stateful services.
+
+**Why:** Per-request instances of circuit breakers, rate limiters, or connection pools
+bypass protection — the breaker never accumulates failure state and never opens.
+
+**Pattern:**
+```
+CORRECT:
+  const mcpService = MCPService.fromEnv()  // at startup, once
+  app.use((req, res, next) => {
+    req.mcpService = mcpService  // inject singleton
+    next()
+  })
+
+WRONG:
+  app.get('/api', (req, res) => {
+    const mcpService = MCPService.fromEnv()  // new instance per request!
+    // circuit breaker resets every request — never trips
+  })
+```
+
+**Applies to:** circuit breakers, rate limiters, connection pools, MCP clients,
+external service adapters, cache managers.
+
+### Security-by-Environment
+
+Security posture MUST match environment:
+- **Development:** relaxed CORS, verbose errors, debug logging
+- **Staging:** production-like security, sanitized test data
+- **Production:** strict CORS, generic errors, structured logging only
+
+NEVER use the same security configuration across all environments.
+
 ## Fitness Functions
 
 {{ARCHITECTURE_FITNESS_FUNCTIONS}}
@@ -206,6 +244,7 @@ For architecture questions:
 - Explain bounded context impact
 - List trade-offs explicitly
 - Suggest ADR if recording needed
+- Check singleton pattern for infrastructure services
 ```
 
 ---

package/templates/.claude/skills/cc-toolkit-generator-enhanced/references/templates/feature-lifecycle.md

@@ -65,6 +65,14 @@ description: Full feature lifecycle — from idea to reviewed implementation.
 Four-phase feature development lifecycle with quality gates between each phase.
 All documentation goes to `docs/features/<feature-name>/sparc/`.
 
+> **SKILL CHAIN — BLOCKING RULES:**
+> - MUST execute Phase 0 (pre-flight check) before ANY generation
+> - MUST use sparc-prd-mini skill for planning — NEVER generate SPARC docs from memory
+> - MUST use requirements-validator for validation — NEVER skip validation phase
+> - MUST use brutal-honesty-review for review — NEVER self-review
+> - FORBIDDEN: Skipping any phase without explicit user permission
+> - CRITICAL: Each phase MUST complete and commit before the next phase starts
+
 ## Phase 0: PRE-FLIGHT CHECK
 
 Before starting, verify all required skills exist:

package/templates/.claude/skills/requirements-validator/SKILL.md

@@ -103,13 +103,37 @@ Always flag these terms and suggest specific replacements:
 - Add AC: "Given X, when Y, then Z within 200ms"
 ```
 
+### Security Acceptance Criteria (10% bonus weight)
+
+When requirements involve authentication, data storage, external APIs, or multi-tenancy,
+apply additional security validation:
+
+| Criterion | Check | Red Flags |
+|-----------|-------|-----------|
+| Input Validation | All user inputs sanitized? | No validation mentioned, "trust client" |
+| Authentication | Auth mechanism specified? | "users can access", no auth context |
+| Authorization | Access control defined? | No role/permission model |
+| Data Protection | Sensitive data handling specified? | PII without encryption rules |
+| Multi-Tenant Isolation | Tenant boundary enforced? | Shared queries, no tenant context |
+| Secret Management | Secrets externalized? | Hardcoded keys, fallback defaults |
+| Webhook Security | Signature verification? | "Accept POST", no HMAC |
+
+**Scoring Bonus:** +5 points if security criteria present and specific, +0 if not applicable,
+-10 if security-relevant requirement lacks any security criteria (BLOCKED if score drops below 50).
+
+**Security BDD Scenarios:** For security-relevant requirements, ALWAYS generate:
+- Auth bypass attempt scenario
+- Input injection scenario (SQL, XSS, command)
+- Cross-tenant access attempt (if multi-tenant)
+- Rate limiting / brute force scenario (if auth endpoint)
+
 ### BDD Scenario Generation
 
 For each requirement, generate scenarios covering:
 1. **Happy path** (1-2 scenarios) — Primary success flow
 2. **Error handling** (2-3 scenarios) — Validation, network, server errors
 3. **Edge cases** (1-2 scenarios) — Boundaries, concurrent access
-4. **Security** (if applicable) — Auth, injection, rate limiting
+4. **Security** (1-3 scenarios) — Auth bypass, injection, cross-tenant, rate limiting
 
 See `references/bdd-patterns.md` for Gherkin templates and examples.