@ghostbyte/agent-docs-kit 4.0.2 → 5.0.0

package/skills/manage-project-quality/references/engineering-full-reference.md

@@ -1,144 +1,24 @@
-# Engineering Reference
-
-A companion to `../security-gate/SECURITY_CHECKLIST.md`. That file is pass/fail **security
-tests**; this file is **"what should I know"** — quick-recall concept lists
-for performance, infra, and engineering practice. Nothing here has a
-severity rating or a test step; use it for onboarding, self-study, or as
-context for an agent before it reviews related code.
-
-## Table of contents
-
-- [A. Speeding Up a Slow Query](#a-speeding-up-a-slow-query)
-- [B. Networking Concepts Every Dev Should Know](#b-networking-concepts-every-dev-should-know)
-- [C. Rate Limiting Algorithms](#c-rate-limiting-algorithms)
-- [D. Debugging Production Issues](#d-debugging-production-issues)
-- [E. Code Review Practices](#e-code-review-practices)
-- [F. Data Modeling Concepts](#f-data-modeling-concepts)
-- [G. Cloud Cost-Saving Techniques](#g-cloud-cost-saving-techniques)
-- [H. Types of Testing](#h-types-of-testing)
-- [I. Message Queue Concepts](#i-message-queue-concepts)
-
-> **Note:** the original "Web security vulnerabilities" list is not
-> duplicated here — it's already covered item-for-item in
-> `../security-gate/SECURITY_CHECKLIST.md` → `02_Web_Vulnerabilities`. Rate limiting
-> algorithms (below) are a companion to, not a replacement for,
-> `01_API_Security/01_rate_limiting.md`.
-
----
-
-## A. Speeding Up a Slow Query
-
-1. Start with the explain plan
-2. Add the missing index
-3. Stop selecting *
-4. Fix N+1 queries
-5. Use a covering index
-6. Cache repeated queries
-7. Prune partitions
-8. Denormalize for reads
-9. Batch your writes
-10. Update table statistics
-
-## B. Networking Concepts Every Dev Should Know
-
-1. DNS resolution
-2. TCP handshake
-3. TLS handshake
-4. NAT
-5. Load balancer types
-6. CDN edge caching
-7. Packet loss & retransmit
-8. MTU / fragmentation
-9. Keep-alive
-10. BGP routing
-
-## C. Rate Limiting Algorithms
-
-1. Fixed window
-2. Sliding window log
-3. Sliding window counter
-4. Token bucket
-5. Leaky bucket
-6. Distributed rate limiting
-7. Client-side throttling
-8. Adaptive rate limiting
-9. Concurrency limiting
-10. Back pressure
-
-## D. Debugging Production Issues
-
-1. Correlation IDs
-2. Distributed tracing
-3. Feature flag rollback
-4. Canary analysis
-5. Replay traffic
-6. Heap dumps
-7. Chaos testing
-8. Synthetic monitoring
-9. Error budgets
-10. Postmortems
-
-## E. Code Review Practices
-
-1. Small PRs
-2. Clear description
-3. Constructive feedback
-4. Nitpick vs. blocker
-5. Fast turnaround
-6. Automated checks first
-7. Context before code
-8. Approve vs. request changes
-9. Self-review first
-10. Learning from reviews
-
-## F. Data Modeling Concepts
-
-1. Primary vs. foreign keys
-2. One-to-many
-3. Many-to-many
-4. Composite keys
-5. Soft deletes
-6. Polymorphic associations
-7. Enum vs. lookup table
-8. Audit columns
-9. Schema migrations
-10. Precision & data types
-
-## G. Cloud Cost-Saving Techniques
-
-1. Spot instances
-2. Autoscaling
-3. Reserved capacity
-4. Right-sizing
-5. Storage tiering
-6. CDN offloading
-7. Serverless for spiky loads
-8. Idle resource cleanup
-9. Compression
-10. Multi-region arbitrage
-
-## H. Types of Testing
-
-1. Unit test
-2. Integration test
-3. End-to-end test
-4. Snapshot test
-5. Contract test
-6. Load test
-7. Chaos test
-8. Mutation test
-9. Smoke test
-10. Regression test
-
-## I. Message Queue Concepts
-
-1. Producer / consumer
-2. Topic + partition
-3. Consumer group
-4. At-least-once delivery
-5. Dead letter queue
-6. Backpressure
-7. Fan-out
-8. Message ordering
-9. Idempotent consumer
-10. Offset commit
+# Engineering Quality Reference
+
+This index routes reviewers to focused, evidence-based practice reviews. Engineering findings are advisory unless they reveal a separate correctness, reliability, or security defect.
+
+Use `Applied`, `Partial`, `Recommended`, `Unverified`, or `N/A`. For each recommendation, record observable evidence, impact, an owner, and a verification step.
+
+## Topic index
+
+1. Query performance and slow-query diagnosis
+2. Networking fundamentals
+3. Rate-limiting algorithms
+4. Production debugging
+5. Code-review practices
+6. Data modeling
+7. Cloud cost saving
+8. Testing types and strategy
+9. Message queues
+10. API design and compatibility
+11. Reliability, SLOs, and error budgets
+12. Observability and telemetry
+13. Deployment and change safety
+14. Capacity, concurrency, and resource management
+
+Run `agent-docs list engineering`, then create only the needed worksheet with `agent-docs engineering worksheet <topic>`.

package/skills/manage-project-quality/references/engineering-protocol.md

@@ -18,6 +18,6 @@ If the review discovers a security vulnerability, data-loss risk, or correctness
 
 1. Identify the system constraint or decision under review.
 2. Inspect representative code, configuration, tests, telemetry, and design records.
-3. Evaluate tradeoffs in the project’s actual scale and failure model.
+3. Evaluate tradeoffs in the project's actual scale and failure model.
 4. Prefer measurable recommendations with a verification method.
 5. Avoid importing enterprise complexity into a project that does not need it.

package/skills/manage-project-quality/references/security-01-design-architecture.md

@@ -1,21 +1,14 @@
 # Design & Architecture
 
-# Phase 1: Design & Architecture (Pre-Code)
+## Phase 1: Design & Architecture (Pre-Code)
 
 **When to run this:** Before writing code — during system/feature design, RFCs, or architecture review.
 
 **Goal of this pass:** Catch design-level flaws (missing trust boundaries, over-broad data collection, no threat model) that are cheap to fix now and expensive to fix after code exists.
 
-## Files in this folder
+## How to use this reference
 
-| File | Purpose |
-|---|---|
-| `CHECKLIST.md` | What to check — the reference list of items, severity, and example test steps for this phase. Doesn't get filled in; copy it or use `RESULTS_TEMPLATE.md` to record a real pass. |
-| `RESULTS_TEMPLATE.md` | Fillable version of the same checklist, with Result/Notes columns and a sign-off block. Copy this file per test pass (e.g. `RESULTS_2026-08-29.md`) so history isn't overwritten. |
-
-Full background, "why it matters," and references for every item live in
-`../../SECURITY_CHECKLIST.md` (search for the source file path shown in the
-checklist below).
+Use each stable control ID in a generated security worksheet. Record observed evidence before assigning a status; leave a control Unverified when evidence is unavailable. Preserve each dated worksheet as audit history.
 
 ## Sign-off criteria
 
@@ -25,15 +18,14 @@ checklist below).
 
 ---
 
-# What to Check — Phase 1: Design & Architecture (Pre-Code)
+## What to Check — Phase 1: Design & Architecture (Pre-Code)
 
-Reference checklist only — no result columns. Use `RESULTS_TEMPLATE.md` in
-this same folder to actually record a test pass.
+Use the applicable controls below to populate the worksheet findings table.
 
-| # | Source file | Item | Severity | Example test |
+| Control ID | Source | Control | Severity | Evidence question |
 |---|---|---|---|---|
-| 1 | `15_Architecture_Compliance/01_privacy_by_design.md` | Privacy by Design | Medium | Review the most recent feature's design doc and confirm data collection was scoped to only what the feature actually needs. |
-| 2 | `15_Architecture_Compliance/02_threat_modeling.md` | Threat Modeling | High | Pull the data-flow diagram for the highest-risk service and confirm a STRIDE (or equivalent) pass was actually performed and mitigations tracked to closure. |
-| 3 | `15_Architecture_Compliance/04_defense_in_depth.md` | Defense in Depth | Medium | Pick one critical asset and map every independent control protecting it; confirm there isn't a single point whose failure alone exposes it. |
-| 4 | `15_Architecture_Compliance/06_zero_trust_network.md` | Zero Trust Network Architecture | High | From inside the internal network, attempt to reach a service without presenting valid per-request authentication and confirm it's still denied. |
-| 5 | `15_Architecture_Compliance/08_secure_sdlc.md` | Secure SDLC (added) | Medium | Confirm the most recent feature had security requirements defined at design time, not bolted on after code review. |
+| SEC-01-01 | `15_Architecture_Compliance/01_privacy_by_design.md` | Privacy by Design | Medium | Review the most recent feature's design doc and confirm data collection was scoped to only what the feature actually needs. |
+| SEC-01-02 | `15_Architecture_Compliance/02_threat_modeling.md` | Threat Modeling | High | Pull the data-flow diagram for the highest-risk service and confirm a STRIDE (or equivalent) pass was actually performed and mitigations tracked to closure. |
+| SEC-01-03 | `15_Architecture_Compliance/04_defense_in_depth.md` | Defense in Depth | Medium | Pick one critical asset and map every independent control protecting it; confirm there isn't a single point whose failure alone exposes it. |
+| SEC-01-04 | `15_Architecture_Compliance/06_zero_trust_network.md` | Zero Trust Network Architecture | High | From inside the internal network, attempt to reach a service without presenting valid per-request authentication and confirm it's still denied. |
+| SEC-01-05 | `15_Architecture_Compliance/08_secure_sdlc.md` | Secure SDLC (added) | Medium | Confirm the most recent feature had security requirements defined at design time, not bolted on after code review. |

package/skills/manage-project-quality/references/security-02-local-development.md

@@ -1,21 +1,14 @@
 # Local Development
 
-# Phase 2: Local Development
+## Phase 2: Local Development
 
 **When to run this:** During day-to-day coding, before opening a pull request.
 
 **Goal of this pass:** Prevent secrets, unpinned/unvetted dependencies, and known-bad coding patterns from ever reaching a shared branch.
 
-## Files in this folder
+## How to use this reference
 
-| File | Purpose |
-|---|---|
-| `CHECKLIST.md` | What to check — the reference list of items, severity, and example test steps for this phase. Doesn't get filled in; copy it or use `RESULTS_TEMPLATE.md` to record a real pass. |
-| `RESULTS_TEMPLATE.md` | Fillable version of the same checklist, with Result/Notes columns and a sign-off block. Copy this file per test pass (e.g. `RESULTS_2026-08-29.md`) so history isn't overwritten. |
-
-Full background, "why it matters," and references for every item live in
-`../../SECURITY_CHECKLIST.md` (search for the source file path shown in the
-checklist below).
+Use each stable control ID in a generated security worksheet. Record observed evidence before assigning a status; leave a control Unverified when evidence is unavailable. Preserve each dated worksheet as audit history.
 
 ## Sign-off criteria
 
@@ -25,17 +18,16 @@ checklist below).
 
 ---
 
-# What to Check — Phase 2: Local Development
+## What to Check — Phase 2: Local Development
 
-Reference checklist only — no result columns. Use `RESULTS_TEMPLATE.md` in
-this same folder to actually record a test pass.
+Use the applicable controls below to populate the worksheet findings table.
 
-| # | Source file | Item | Severity | Example test |
+| Control ID | Source | Control | Severity | Evidence question |
 |---|---|---|---|---|
-| 1 | `08_Release_Engineering_Version_Control/01_secure_coding_guidelines.md` | Secure Coding Guidelines | Low | Confirm the team's secure-coding cheat sheet is linked from the PR template/onboarding docs, not just filed away unused. |
-| 2 | `08_Release_Engineering_Version_Control/02_semantic_versioning.md` | Semantic Versioning | Low | Check the last 3 releases and confirm any breaking change actually bumped the MAJOR version. |
-| 3 | `10_Dependency_Supply_Chain/01_backend_dependency_scanning.md` | Dependency & SCA Scanning | High | Run the SCA scanner manually against the current backend dependency tree and confirm it matches what CI reports, with no critical CVEs unpatched past SLA. |
-| 4 | `10_Dependency_Supply_Chain/02_dependency_version_pinning.md` | Dependency Version Pinning | Medium | Delete the lockfile locally and reinstall; confirm CI fails the build if the regenerated lockfile differs from the committed one. |
-| 5 | `10_Dependency_Supply_Chain/03_frontend_dependency_scanning.md` | Frontend Dependency Scanning | Medium | Run npm audit / yarn audit and manually review any newly added package for typosquatting risk or suspicious post-install scripts. |
-| 6 | `06_Data_Protection_Secrets/06_secrets_management.md` | Secrets Management (added) | Critical | Run a secret-scanning tool (e.g. gitleaks/truffleHog) across the full git history, not just HEAD, and confirm zero committed credentials. |
-| 7 | `09_Release_Pipeline_Stages/01_local_dev_testing.md` | Stage 1: Local / Developer Testing | Low | Confirm a fresh local dev environment setup never requires copying real production credentials or data. |
+| SEC-02-01 | `08_Release_Engineering_Version_Control/01_secure_coding_guidelines.md` | Secure Coding Guidelines | Low | Confirm the team's secure-coding cheat sheet is linked from the PR template/onboarding docs, not just filed away unused. |
+| SEC-02-02 | `08_Release_Engineering_Version_Control/02_semantic_versioning.md` | Semantic Versioning | Low | Check the last 3 releases and confirm any breaking change actually bumped the MAJOR version. |
+| SEC-02-03 | `10_Dependency_Supply_Chain/01_backend_dependency_scanning.md` | Dependency & SCA Scanning | High | Run the SCA scanner manually against the current backend dependency tree and confirm it matches what CI reports, with no critical CVEs unpatched past SLA. |
+| SEC-02-04 | `10_Dependency_Supply_Chain/02_dependency_version_pinning.md` | Dependency Version Pinning | Medium | Delete the lockfile locally and reinstall; confirm CI fails the build if the regenerated lockfile differs from the committed one. |
+| SEC-02-05 | `10_Dependency_Supply_Chain/03_frontend_dependency_scanning.md` | Frontend Dependency Scanning | Medium | Run npm audit / yarn audit and manually review any newly added package for typosquatting risk or suspicious post-install scripts. |
+| SEC-02-06 | `06_Data_Protection_Secrets/06_secrets_management.md` | Secrets Management (added) | Critical | Run a secret-scanning tool (e.g. gitleaks/truffleHog) across the full git history, not just HEAD, and confirm zero committed credentials. |
+| SEC-02-07 | `09_Release_Pipeline_Stages/01_local_dev_testing.md` | Stage 1: Local / Developer Testing | Low | Confirm a fresh local dev environment setup never requires copying real production credentials or data. |

package/skills/manage-project-quality/references/security-03-database-backend.md

@@ -1,21 +1,14 @@
 # Database & Backend
 
-# Phase 3: Database & Backend Layer
+## Phase 3: Database & Backend Layer
 
 **When to run this:** While building/reviewing server-side business logic and the data access layer.
 
 **Goal of this pass:** Confirm the backend enforces authorization and business rules itself, and that the data layer doesn't quietly reintroduce injection or over-fetching risk.
 
-## Files in this folder
+## How to use this reference
 
-| File | Purpose |
-|---|---|
-| `CHECKLIST.md` | What to check — the reference list of items, severity, and example test steps for this phase. Doesn't get filled in; copy it or use `RESULTS_TEMPLATE.md` to record a real pass. |
-| `RESULTS_TEMPLATE.md` | Fillable version of the same checklist, with Result/Notes columns and a sign-off block. Copy this file per test pass (e.g. `RESULTS_2026-08-29.md`) so history isn't overwritten. |
-
-Full background, "why it matters," and references for every item live in
-`../../SECURITY_CHECKLIST.md` (search for the source file path shown in the
-checklist below).
+Use each stable control ID in a generated security worksheet. Record observed evidence before assigning a status; leave a control Unverified when evidence is unavailable. Preserve each dated worksheet as audit history.
 
 ## Sign-off criteria
 
@@ -25,22 +18,21 @@ checklist below).
 
 ---
 
-# What to Check — Phase 3: Database & Backend Layer
+## What to Check — Phase 3: Database & Backend Layer
 
-Reference checklist only — no result columns. Use `RESULTS_TEMPLATE.md` in
-this same folder to actually record a test pass.
+Use the applicable controls below to populate the worksheet findings table.
 
-| # | Source file | Item | Severity | Example test |
+| Control ID | Source | Control | Severity | Evidence question |
 |---|---|---|---|---|
-| 1 | `05_Backend_Handling/01_business_logic_validation.md` | Business Logic Validation | High | Attempt to call the 'ship order' step of a checkout flow while skipping the 'payment' step and confirm the server rejects the out-of-order transition. |
-| 2 | `05_Backend_Handling/02_file_upload_handling.md` | File Upload Handling | Critical | Upload a file with a .jpg extension but executable/script magic bytes inside, and confirm the server validates content type by inspecting bytes, not just the extension. |
-| 3 | `05_Backend_Handling/03_orm_database_security.md` | ORM & Database Layer Security | High | Search the codebase for any raw-query escape hatches in the ORM and confirm every one uses parameter binding, not string concatenation. |
-| 4 | `05_Backend_Handling/04_background_job_queue_security.md` | Background Job & Queue Security | Medium | Submit a queued job payload with malformed/malicious data directly (bypassing the API layer) and confirm the worker validates it the same way the API would. |
-| 5 | `05_Backend_Handling/05_error_handling_stack_traces.md` | Error Handling & Stack Trace Exposure | Medium | Send a malformed request (bad JSON, wrong content-type) to a production endpoint and confirm the response is a generic error, not a stack trace or file path. |
-| 6 | `03_Access_Control_Session_Auth/02_backend_access_control.md` | Backend Access Control | Critical | Using User A's valid session, request User B's resource ID directly and confirm a 403, not the data. |
-| 7 | `03_Access_Control_Session_Auth/05_rbac_abac.md` | RBAC / ABAC Models (added) | Medium | Pick a long-lived test account and diff its current granted permissions against what its role should have today, looking for accumulated excess access. |
-| 8 | `06_Data_Protection_Secrets/01_encryption_at_rest.md` | Encryption at Rest | High | Confirm via cloud console/CLI that the database volume, backups, and object storage all show encryption-at-rest enabled, not just the primary disk. |
-| 9 | `06_Data_Protection_Secrets/02_encryption_in_transit.md` | Encryption in Transit | High | Attempt to connect to the database and any internal service-to-service endpoint over plaintext and confirm the connection is refused, TLS-only. |
-| 10 | `06_Data_Protection_Secrets/03_pii_data_classification.md` | PII & Data Classification | Medium | Pull a sample data export/report and check whether it exposes any field classified as higher-sensitivity than the export's intended audience. |
-| 11 | `06_Data_Protection_Secrets/04_key_management.md` | Key Management (KMS) | Critical | Confirm encryption keys live in a KMS/HSM (not a config file or env var) and walk through the documented key-revocation procedure end to end. |
-| 12 | `06_Data_Protection_Secrets/05_tls_certificate_management.md` | TLS Certificate Management | High | Run an SSL/TLS scan (e.g. against the Mozilla Observatory or testssl.sh) on each public endpoint and confirm TLS 1.2+ only, no weak ciphers, valid expiry. |
+| SEC-03-01 | `05_Backend_Handling/01_business_logic_validation.md` | Business Logic Validation | High | Attempt to call the 'ship order' step of a checkout flow while skipping the 'payment' step and confirm the server rejects the out-of-order transition. |
+| SEC-03-02 | `05_Backend_Handling/02_file_upload_handling.md` | File Upload Handling | Critical | Upload a file with a .jpg extension but executable/script magic bytes inside, and confirm the server validates content type by inspecting bytes, not just the extension. |
+| SEC-03-03 | `05_Backend_Handling/03_orm_database_security.md` | ORM & Database Layer Security | High | Search the codebase for any raw-query escape hatches in the ORM and confirm every one uses parameter binding, not string concatenation. |
+| SEC-03-04 | `05_Backend_Handling/04_background_job_queue_security.md` | Background Job & Queue Security | Medium | Submit a queued job payload with malformed/malicious data directly (bypassing the API layer) and confirm the worker validates it the same way the API would. |
+| SEC-03-05 | `05_Backend_Handling/05_error_handling_stack_traces.md` | Error Handling & Stack Trace Exposure | Medium | Send a malformed request (bad JSON, wrong content-type) to a production endpoint and confirm the response is a generic error, not a stack trace or file path. |
+| SEC-03-06 | `03_Access_Control_Session_Auth/02_backend_access_control.md` | Backend Access Control | Critical | Using User A's valid session, request User B's resource ID directly and confirm a 403, not the data. |
+| SEC-03-07 | `03_Access_Control_Session_Auth/05_rbac_abac.md` | RBAC / ABAC Models (added) | Medium | Pick a long-lived test account and diff its current granted permissions against what its role should have today, looking for accumulated excess access. |
+| SEC-03-08 | `06_Data_Protection_Secrets/01_encryption_at_rest.md` | Encryption at Rest | High | Confirm via cloud console/CLI that the database volume, backups, and object storage all show encryption-at-rest enabled, not just the primary disk. |
+| SEC-03-09 | `06_Data_Protection_Secrets/02_encryption_in_transit.md` | Encryption in Transit | High | Attempt to connect to the database and any internal service-to-service endpoint over plaintext and confirm the connection is refused, TLS-only. |
+| SEC-03-10 | `06_Data_Protection_Secrets/03_pii_data_classification.md` | PII & Data Classification | Medium | Pull a sample data export/report and check whether it exposes any field classified as higher-sensitivity than the export's intended audience. |
+| SEC-03-11 | `06_Data_Protection_Secrets/04_key_management.md` | Key Management (KMS) | Critical | Confirm encryption keys live in a KMS/HSM (not a config file or env var) and walk through the documented key-revocation procedure end to end. |
+| SEC-03-12 | `06_Data_Protection_Secrets/05_tls_certificate_management.md` | TLS Certificate Management | High | Run an SSL/TLS scan (e.g. against the Mozilla Observatory or testssl.sh) on each public endpoint and confirm TLS 1.2+ only, no weak ciphers, valid expiry. |

package/skills/manage-project-quality/references/security-04-api-layer.md

@@ -1,21 +1,14 @@
 # API Layer
 
-# Phase 4: API Layer
+## Phase 4: API Layer
 
 **When to run this:** While building/reviewing any endpoint that's called over the network — internal or external.
 
 **Goal of this pass:** Confirm authentication, authorization, and abuse controls are enforced on every endpoint, not assumed from the caller.
 
-## Files in this folder
+## How to use this reference
 
-| File | Purpose |
-|---|---|
-| `CHECKLIST.md` | What to check — the reference list of items, severity, and example test steps for this phase. Doesn't get filled in; copy it or use `RESULTS_TEMPLATE.md` to record a real pass. |
-| `RESULTS_TEMPLATE.md` | Fillable version of the same checklist, with Result/Notes columns and a sign-off block. Copy this file per test pass (e.g. `RESULTS_2026-08-29.md`) so history isn't overwritten. |
-
-Full background, "why it matters," and references for every item live in
-`../../SECURITY_CHECKLIST.md` (search for the source file path shown in the
-checklist below).
+Use each stable control ID in a generated security worksheet. Record observed evidence before assigning a status; leave a control Unverified when evidence is unavailable. Preserve each dated worksheet as audit history.
 
 ## Sign-off criteria
 
@@ -25,27 +18,26 @@ checklist below).
 
 ---
 
-# What to Check — Phase 4: API Layer
+## What to Check — Phase 4: API Layer
 
-Reference checklist only — no result columns. Use `RESULTS_TEMPLATE.md` in
-this same folder to actually record a test pass.
+Use the applicable controls below to populate the worksheet findings table.
 
-| # | Source file | Item | Severity | Example test |
+| Control ID | Source | Control | Severity | Evidence question |
 |---|---|---|---|---|
-| 1 | `01_API_Security/01_rate_limiting.md` | Rate Limiting | High | Fire 200 requests/sec at a login endpoint from one IP and confirm 429s with Retry-After start well before account lockout thresholds are reachable. |
-| 2 | `01_API_Security/02_api_keys.md` | API Keys | High | Grep the built client bundle and mobile binary for hardcoded key patterns, then rotate one key and confirm the old value is rejected within minutes. |
-| 3 | `01_API_Security/03_oauth2.md` | OAuth 2.0 | Critical | Attempt the authorization flow with a modified redirect_uri (e.g. attacker.com) and confirm the server rejects it rather than redirecting. |
-| 4 | `01_API_Security/04_jwt_validation.md` | JWT Validation | Critical | Submit a token with 'alg' changed to 'none' and an empty signature; confirm the API rejects it instead of trusting the claims. |
-| 5 | `01_API_Security/05_input_sanitation.md` | Input Sanitation | High | Submit oversized, wrong-type, and boundary values (e.g. negative quantity, 10k-char string) on every field and confirm consistent server-side rejection. |
-| 6 | `01_API_Security/06_cors_policy.md` | CORS Policy | High | Send a fetch with Origin: https://evil.com and credentials:'include'; confirm the Access-Control-Allow-Origin response does not reflect evil.com. |
-| 7 | `01_API_Security/07_mtls.md` | Mutual TLS (mTLS) | Medium | Present an expired or self-signed client certificate to the mTLS endpoint and confirm the connection is rejected, not silently accepted. |
-| 8 | `01_API_Security/08_request_signing.md` | Request Signing | Medium | Replay a previously captured signed request unmodified after its timestamp window; confirm it is rejected as a replay. |
-| 9 | `01_API_Security/09_ip_allowlisting.md` | IP Allowlisting | Medium | Send a request from a disallowed IP with a spoofed X-Forwarded-For header set to an allowlisted IP and confirm it is still blocked. |
-| 10 | `01_API_Security/10_security_headers.md` | Security Headers (added) | Medium | Run curl -I against each public endpoint and confirm CSP, HSTS, X-Content-Type-Options, and frame-ancestors are all present. |
-| 11 | `03_Access_Control_Session_Auth/07_session_management.md` | Session Management (added) | High | Capture the session cookie before and after login and confirm the session ID value actually changes (regenerates) rather than persisting. |
-| 12 | `03_Access_Control_Session_Auth/08_mfa.md` | Multi-Factor Authentication (added) | Critical | Attempt the password-reset flow and confirm it cannot be used to fully log in while skipping the MFA step. |
-| 13 | `03_Access_Control_Session_Auth/09_session_store_caching.md` | Session Store Security (Redis/Memcached) | High | Attempt to connect directly to the Redis/Memcached session store from outside the app network and confirm authentication is required and it isn't publicly reachable. |
-| 14 | `03_Access_Control_Session_Auth/10_remember_me_persistent_login.md` | "Remember Me" & Persistent Login Tokens | High | Use a captured remember-me token once, then reuse the same (now-rotated-out) token value again and confirm it triggers revocation/alerting rather than silent success. |
-| 15 | `03_Access_Control_Session_Auth/06_forced_reauth_sensitive_actions.md` | Forced Re-Authentication for Sensitive Actions | High | From an already-logged-in session, attempt to change the account email/password without re-entering credentials and confirm it's blocked. |
-| 16 | `03_Access_Control_Session_Auth/03_cache_invalidation_on_auth_change.md` | Cache Invalidation on Auth/Privilege Change | High | Downgrade a test user's role, then immediately retry a privileged action with their still-active session and confirm it's now denied. |
-| 17 | `03_Access_Control_Session_Auth/04_device_trust_fingerprinting.md` | Device Trust & Fingerprinting | Medium | Replay a captured device-trust identifier from a different browser/device and confirm it does not skip MFA. |
+| SEC-04-01 | `01_API_Security/01_rate_limiting.md` | Rate Limiting | High | Fire 200 requests/sec at a login endpoint from one IP and confirm 429s with Retry-After start well before account lockout thresholds are reachable. |
+| SEC-04-02 | `01_API_Security/02_api_keys.md` | API Keys | High | Grep the built client bundle and mobile binary for hardcoded key patterns, then rotate one key and confirm the old value is rejected within minutes. |
+| SEC-04-03 | `01_API_Security/03_oauth2.md` | OAuth 2.0 | Critical | Attempt the authorization flow with a modified redirect_uri (e.g. attacker.com) and confirm the server rejects it rather than redirecting. |
+| SEC-04-04 | `01_API_Security/04_jwt_validation.md` | JWT Validation | Critical | Submit a token with 'alg' changed to 'none' and an empty signature; confirm the API rejects it instead of trusting the claims. |
+| SEC-04-05 | `01_API_Security/05_input_sanitation.md` | Input Sanitation | High | Submit oversized, wrong-type, and boundary values (e.g. negative quantity, 10k-char string) on every field and confirm consistent server-side rejection. |
+| SEC-04-06 | `01_API_Security/06_cors_policy.md` | CORS Policy | High | Send a fetch with Origin: https://evil.com and credentials:'include'; confirm the Access-Control-Allow-Origin response does not reflect evil.com. |
+| SEC-04-07 | `01_API_Security/07_mtls.md` | Mutual TLS (mTLS) | Medium | Present an expired or self-signed client certificate to the mTLS endpoint and confirm the connection is rejected, not silently accepted. |
+| SEC-04-08 | `01_API_Security/08_request_signing.md` | Request Signing | Medium | Replay a previously captured signed request unmodified after its timestamp window; confirm it is rejected as a replay. |
+| SEC-04-09 | `01_API_Security/09_ip_allowlisting.md` | IP Allowlisting | Medium | Send a request from a disallowed IP with a spoofed X-Forwarded-For header set to an allowlisted IP and confirm it is still blocked. |
+| SEC-04-10 | `01_API_Security/10_security_headers.md` | Security Headers (added) | Medium | Run curl -I against each public endpoint and confirm CSP, HSTS, X-Content-Type-Options, and frame-ancestors are all present. |
+| SEC-04-11 | `03_Access_Control_Session_Auth/07_session_management.md` | Session Management (added) | High | Capture the session cookie before and after login and confirm the session ID value actually changes (regenerates) rather than persisting. |
+| SEC-04-12 | `03_Access_Control_Session_Auth/08_mfa.md` | Multi-Factor Authentication (added) | Critical | Attempt the password-reset flow and confirm it cannot be used to fully log in while skipping the MFA step. |
+| SEC-04-13 | `03_Access_Control_Session_Auth/09_session_store_caching.md` | Session Store Security (Redis/Memcached) | High | Attempt to connect directly to the Redis/Memcached session store from outside the app network and confirm authentication is required and it isn't publicly reachable. |
+| SEC-04-14 | `03_Access_Control_Session_Auth/10_remember_me_persistent_login.md` | "Remember Me" & Persistent Login Tokens | High | Use a captured remember-me token once, then reuse the same (now-rotated-out) token value again and confirm it triggers revocation/alerting rather than silent success. |
+| SEC-04-15 | `03_Access_Control_Session_Auth/06_forced_reauth_sensitive_actions.md` | Forced Re-Authentication for Sensitive Actions | High | From an already-logged-in session, attempt to change the account email/password without re-entering credentials and confirm it's blocked. |
+| SEC-04-16 | `03_Access_Control_Session_Auth/03_cache_invalidation_on_auth_change.md` | Cache Invalidation on Auth/Privilege Change | High | Downgrade a test user's role, then immediately retry a privileged action with their still-active session and confirm it's now denied. |
+| SEC-04-17 | `03_Access_Control_Session_Auth/04_device_trust_fingerprinting.md` | Device Trust & Fingerprinting | Medium | Replay a captured device-trust identifier from a different browser/device and confirm it does not skip MFA. |

package/skills/manage-project-quality/references/security-05-frontend-ui.md

@@ -1,21 +1,14 @@
 # Frontend & UI
 
-# Phase 5: Frontend / UI Layer
+## Phase 5: Frontend / UI Layer
 
 **When to run this:** While building/reviewing client-side code — components, routing, state, build config.
 
 **Goal of this pass:** Confirm the UI never becomes the actual security boundary, and that framework-specific escape hatches don't reopen XSS.
 
-## Files in this folder
+## How to use this reference
 
-| File | Purpose |
-|---|---|
-| `CHECKLIST.md` | What to check — the reference list of items, severity, and example test steps for this phase. Doesn't get filled in; copy it or use `RESULTS_TEMPLATE.md` to record a real pass. |
-| `RESULTS_TEMPLATE.md` | Fillable version of the same checklist, with Result/Notes columns and a sign-off block. Copy this file per test pass (e.g. `RESULTS_2026-08-29.md`) so history isn't overwritten. |
-
-Full background, "why it matters," and references for every item live in
-`../../SECURITY_CHECKLIST.md` (search for the source file path shown in the
-checklist below).
+Use each stable control ID in a generated security worksheet. Record observed evidence before assigning a status; leave a control Unverified when evidence is unavailable. Preserve each dated worksheet as audit history.
 
 ## Sign-off criteria
 
@@ -25,20 +18,19 @@ checklist below).
 
 ---
 
-# What to Check — Phase 5: Frontend / UI Layer
+## What to Check — Phase 5: Frontend / UI Layer
 
-Reference checklist only — no result columns. Use `RESULTS_TEMPLATE.md` in
-this same folder to actually record a test pass.
+Use the applicable controls below to populate the worksheet findings table.
 
-| # | Source file | Item | Severity | Example test |
+| Control ID | Source | Control | Severity | Evidence question |
 |---|---|---|---|---|
-| 1 | `04_UI_Framework_Security/01_framework_xss_sinks.md` | Framework-Specific XSS Sinks | High | grep -r 'dangerouslySetInnerHTML\\|v-html\\|innerHTML' across the frontend source and confirm every hit sanitizes input (e.g. via DOMPurify) first. |
-| 2 | `04_UI_Framework_Security/02_client_side_routing_auth.md` | Client-Side Routing & Route Guards | High | Call the data-fetching API endpoint behind a guarded route directly via curl/Postman without going through the SPA route guard, and confirm it's still blocked server-side. |
-| 3 | `04_UI_Framework_Security/03_state_management_leaks.md` | State Management Data Leaks | Medium | Open Redux/Vuex devtools against the production build and search global state for tokens, secrets, or full user PII objects. |
-| 4 | `04_UI_Framework_Security/04_build_config_exposure.md` | Build Config & Source Map Exposure | Medium | Fetch every .map file path from the production bundle directly and confirm 404s; grep the deployed JS bundle for API key-shaped strings. |
-| 5 | `04_UI_Framework_Security/05_csp_framework_compatibility.md` | CSP Compatibility with UI Frameworks | Medium | Check the deployed CSP header for 'unsafe-inline'; if present, test whether nonces/hashes can replace it without breaking the framework's inline scripts. |
-| 6 | `02_Web_Vulnerabilities/02_xss.md` | Cross-Site Scripting (XSS) | Critical | Submit <script>alert(document.domain)</script> and common encoded variants into every reflected, stored, and DOM-rendered field. |
-| 7 | `02_Web_Vulnerabilities/03_csrf.md` | Cross-Site Request Forgery (CSRF) | High | Build an auto-submitting HTML form on a separate origin targeting a state-changing endpoint using the victim's real session cookie, and confirm it is rejected. |
-| 8 | `02_Web_Vulnerabilities/06_clickjacking.md` | Clickjacking | Medium | Embed the target page in an <iframe> on a test page and confirm the browser refuses to render it (frame-ancestors/X-Frame-Options enforced). |
-| 9 | `02_Web_Vulnerabilities/07_open_redirect.md` | Open Redirect | Medium | Set the redirect parameter to an external domain (and bypass tricks like //evil.com or trusted.com.evil.com) and confirm the app refuses or rewrites it. |
-| 10 | `03_Access_Control_Session_Auth/01_ui_ux_access_control.md` | UI/UX-Level Access Control | Medium | Call the underlying API directly with a lower-privilege token, bypassing the UI that hides the button, and confirm the server still denies it. |
+| SEC-05-01 | `04_UI_Framework_Security/01_framework_xss_sinks.md` | Framework-Specific XSS Sinks | High | grep -r 'dangerouslySetInnerHTML\\|v-html\\|innerHTML' across the frontend source and confirm every hit sanitizes input (e.g. via DOMPurify) first. |
+| SEC-05-02 | `04_UI_Framework_Security/02_client_side_routing_auth.md` | Client-Side Routing & Route Guards | High | Call the data-fetching API endpoint behind a guarded route directly via curl/Postman without going through the SPA route guard, and confirm it's still blocked server-side. |
+| SEC-05-03 | `04_UI_Framework_Security/03_state_management_leaks.md` | State Management Data Leaks | Medium | Open Redux/Vuex devtools against the production build and search global state for tokens, secrets, or full user PII objects. |
+| SEC-05-04 | `04_UI_Framework_Security/04_build_config_exposure.md` | Build Config & Source Map Exposure | Medium | Fetch every .map file path from the production bundle directly and confirm 404s; grep the deployed JS bundle for API key-shaped strings. |
+| SEC-05-05 | `04_UI_Framework_Security/05_csp_framework_compatibility.md` | CSP Compatibility with UI Frameworks | Medium | Check the deployed CSP header for 'unsafe-inline'; if present, test whether nonces/hashes can replace it without breaking the framework's inline scripts. |
+| SEC-05-06 | `02_Web_Vulnerabilities/02_xss.md` | Cross-Site Scripting (XSS) | Critical | Submit <script>alert(document.domain)</script> and common encoded variants into every reflected, stored, and DOM-rendered field. |
+| SEC-05-07 | `02_Web_Vulnerabilities/03_csrf.md` | Cross-Site Request Forgery (CSRF) | High | Build an auto-submitting HTML form on a separate origin targeting a state-changing endpoint using the victim's real session cookie, and confirm it is rejected. |
+| SEC-05-08 | `02_Web_Vulnerabilities/06_clickjacking.md` | Clickjacking | Medium | Embed the target page in an <iframe> on a test page and confirm the browser refuses to render it (frame-ancestors/X-Frame-Options enforced). |
+| SEC-05-09 | `02_Web_Vulnerabilities/07_open_redirect.md` | Open Redirect | Medium | Set the redirect parameter to an external domain (and bypass tricks like //evil.com or trusted.com.evil.com) and confirm the app refuses or rewrites it. |
+| SEC-05-10 | `03_Access_Control_Session_Auth/01_ui_ux_access_control.md` | UI/UX-Level Access Control | Medium | Call the underlying API directly with a lower-privilege token, bypassing the UI that hides the button, and confirm the server still denies it. |

package/skills/manage-project-quality/references/security-06-application-security-testing.md

@@ -1,21 +1,16 @@
 # Application Security Testing
 
-# Phase 6: Application Security Testing (QA / Staging)
+## Phase 6: Application Security Testing (QA / Staging)
 
 **When to run this:** A dedicated security test pass in QA/staging before release — after features are functionally complete.
 
-**Goal of this pass:** Run the deeper, often-automatable vulnerability classes end to end against a real running build, and confirm coverage against recognized baselines (OWASP Top 10 / API Top 10).
+**Goal of this pass:** Review deeper vulnerability classes in an explicitly authorized, isolated test environment with synthetic accounts and data. Confirm coverage against current OWASP baselines without placing production systems, third parties, or real credentials at risk.
 
-## Files in this folder
+> Safety boundary: begin with passive code and configuration review. Active tests require written scope, stop conditions, rate limits, synthetic data, and a non-production target. Never probe cloud metadata, external hosts, or real user accounts.
 
-| File | Purpose |
-|---|---|
-| `CHECKLIST.md` | What to check — the reference list of items, severity, and example test steps for this phase. Doesn't get filled in; copy it or use `RESULTS_TEMPLATE.md` to record a real pass. |
-| `RESULTS_TEMPLATE.md` | Fillable version of the same checklist, with Result/Notes columns and a sign-off block. Copy this file per test pass (e.g. `RESULTS_2026-08-29.md`) so history isn't overwritten. |
+## How to use this reference
 
-Full background, "why it matters," and references for every item live in
-`../../SECURITY_CHECKLIST.md` (search for the source file path shown in the
-checklist below).
+Use each stable control ID in a generated security worksheet. Record observed evidence before assigning a status; leave a control Unverified when evidence is unavailable. Preserve each dated worksheet as audit history.
 
 ## Sign-off criteria
 
@@ -25,24 +20,23 @@ checklist below).
 
 ---
 
-# What to Check — Phase 6: Application Security Testing (QA / Staging)
+## What to Check — Phase 6: Application Security Testing (QA / Staging)
 
-Reference checklist only — no result columns. Use `RESULTS_TEMPLATE.md` in
-this same folder to actually record a test pass.
+Use the applicable controls below to populate the worksheet findings table.
 
-| # | Source file | Item | Severity | Example test |
+| Control ID | Source | Control | Severity | Evidence question |
 |---|---|---|---|---|
-| 1 | `02_Web_Vulnerabilities/01_sql_injection.md` | SQL Injection | Critical | Submit a single quote and boolean/time-based payloads (e.g. ' OR '1'='1, SLEEP(5)) in every input field and inspect responses/timing for injection signals. |
-| 2 | `02_Web_Vulnerabilities/04_ssrf.md` | Server-Side Request Forgery (SSRF) | Critical | Submit a URL-fetching parameter pointing at http://169.254.169.254/latest/meta-data/ and confirm the server does not fetch it. |
-| 3 | `02_Web_Vulnerabilities/05_idor.md` | Insecure Direct Object Reference (IDOR) | Critical | Log in as User A, capture an object ID from a request, then repeat the identical request as User B and confirm access is denied. |
-| 4 | `02_Web_Vulnerabilities/08_path_traversal.md` | Path Traversal | Critical | Submit ../../../../etc/passwd and URL-encoded/unicode variants in any file-path parameter and confirm access stays within the intended directory. |
-| 5 | `02_Web_Vulnerabilities/09_insecure_deserialization.md` | Insecure Deserialization | Critical | Tamper with a serialized object/cookie (flip a field, change a type) and submit it; confirm the server rejects it rather than deserializing blindly. |
-| 6 | `02_Web_Vulnerabilities/10_broken_authentication.md` | Broken Authentication | Critical | Run a scripted credential-stuffing pass against the login endpoint using a small known-breached credential list and confirm lockout/rate-limit triggers. |
-| 7 | `02_Web_Vulnerabilities/11_ssti.md` | Server-Side Template Injection (SSTI) (added) | Critical | Submit template syntax such as {{7*7}} or ${7*7} into user-controlled text fields and check whether the output evaluates to 49. |
-| 8 | `02_Web_Vulnerabilities/12_xxe.md` | XML External Entity (XXE) Injection (added) | Critical | Submit an XML payload with a DOCTYPE defining an external entity pointing to a local file and confirm the parser refuses to resolve it. |
-| 9 | `02_Web_Vulnerabilities/13_mass_assignment.md` | Mass Assignment (added) | High | Add an unexpected field such as "isAdmin": true to a normal profile-update request body and confirm it is ignored, not applied. |
-| 10 | `02_Web_Vulnerabilities/14_race_conditions.md` | Race Conditions (added) | High | Fire 20 identical concurrent requests at a discount/redeem endpoint and confirm only one succeeds, not all twenty. |
-| 11 | `02_Web_Vulnerabilities/15_request_smuggling.md` | HTTP Request Smuggling (added) | Critical | Send a request with conflicting Content-Length and Transfer-Encoding headers through the full proxy chain and observe whether front-end/back-end parsing disagrees. |
-| 12 | `19_Security_Checklists/01_owasp_top10_checklist.md` | OWASP Top 10 Checklist | Reference | Use this as a coverage tracker after running folders 01-18 — check off each OWASP Top 10 category once its dedicated checklist items have been executed. |
-| 13 | `19_Security_Checklists/02_api_security_checklist.md` | OWASP API Security Top 10 Checklist | Reference | Use this as a coverage tracker after running folder 01 (API_Security) and relevant items from 02/03 — confirm each OWASP API Top 10 category is addressed. |
-| 14 | `19_Security_Checklists/03_pentest_checklist.md` | Penetration Test Checklist (added) | Reference | Use this as the top-level structure for any full engagement: confirm scope/RoE are signed before folder-by-folder testing begins. |
+| SEC-06-01 | `02_Web_Vulnerabilities/01_sql_injection.md` | SQL Injection | Critical | Review parameterization and run a scanner only against an authorized disposable test dataset; record the tool, scope, rate limit, and evidence. |
+| SEC-06-02 | `02_Web_Vulnerabilities/04_ssrf.md` | Server-Side Request Forgery (SSRF) | Critical | Use a controlled callback endpoint inside the test environment; never target real cloud metadata or third-party systems. |
+| SEC-06-03 | `02_Web_Vulnerabilities/05_idor.md` | Insecure Direct Object Reference (IDOR) | Critical | Log in as User A, capture an object ID from a request, then repeat the identical request as User B and confirm access is denied. |
+| SEC-06-04 | `02_Web_Vulnerabilities/08_path_traversal.md` | Path Traversal | Critical | Submit ../../../../etc/passwd and URL-encoded/unicode variants in any file-path parameter and confirm access stays within the intended directory. |
+| SEC-06-05 | `02_Web_Vulnerabilities/09_insecure_deserialization.md` | Insecure Deserialization | Critical | Tamper with a serialized object/cookie (flip a field, change a type) and submit it; confirm the server rejects it rather than deserializing blindly. |
+| SEC-06-06 | `02_Web_Vulnerabilities/10_broken_authentication.md` | Broken Authentication | Critical | Use synthetic accounts and generated passwords in an isolated environment to verify throttling and lockout without using breached credentials. |
+| SEC-06-07 | `02_Web_Vulnerabilities/11_ssti.md` | Server-Side Template Injection (SSTI) (added) | Critical | Submit template syntax such as {{7*7}} or ${7*7} into user-controlled text fields and check whether the output evaluates to 49. |
+| SEC-06-08 | `02_Web_Vulnerabilities/12_xxe.md` | XML External Entity (XXE) Injection (added) | Critical | Submit an XML payload with a DOCTYPE defining an external entity pointing to a local file and confirm the parser refuses to resolve it. |
+| SEC-06-09 | `02_Web_Vulnerabilities/13_mass_assignment.md` | Mass Assignment (added) | High | Add an unexpected field such as "isAdmin": true to a normal profile-update request body and confirm it is ignored, not applied. |
+| SEC-06-10 | `02_Web_Vulnerabilities/14_race_conditions.md` | Race Conditions (added) | High | Fire 20 identical concurrent requests at a discount/redeem endpoint and confirm only one succeeds, not all twenty. |
+| SEC-06-11 | `02_Web_Vulnerabilities/15_request_smuggling.md` | HTTP Request Smuggling (added) | Critical | Prefer configuration review and vendor-supported test tooling; active ambiguity tests require an isolated proxy chain and explicit authorization. |
+| SEC-06-12 | `19_Security_Checklists/01_owasp_top10_checklist.md` | OWASP Top 10 Checklist | Reference | Use this as a coverage tracker after running folders 01-18 — check off each OWASP Top 10 category once its dedicated checklist items have been executed. |
+| SEC-06-13 | `19_Security_Checklists/02_api_security_checklist.md` | OWASP API Security Top 10 Checklist | Reference | Use this as a coverage tracker after running folder 01 (API_Security) and relevant items from 02/03 — confirm each OWASP API Top 10 category is addressed. |
+| SEC-06-14 | `19_Security_Checklists/03_pentest_checklist.md` | Penetration Test Checklist (added) | Reference | Use this as the top-level structure for any full engagement: confirm scope/RoE are signed before folder-by-folder testing begins. |