@givolt/i3-composer-agent 0.0.0-stage → 1.0.0

package/rebrand/upstream.json

@@ -0,0 +1,171 @@
+{
+  "upstreamCommit": "1401c8b8030e023baeebb31781a6653fe8e93026",
+  "upstreamVersion": "0.6.12",
+  "skills": [
+    "api-and-interface-design",
+    "browser-testing-with-devtools",
+    "ci-cd-and-automation",
+    "code-review-and-quality",
+    "code-simplification",
+    "constraint-driven-development",
+    "context-engineering",
+    "debugging-and-error-recovery",
+    "deprecation-and-migration",
+    "documentation-and-adrs",
+    "doubt-driven-development",
+    "frontend-ui-engineering",
+    "git-workflow-and-versioning",
+    "idea-refine",
+    "incremental-implementation",
+    "interview-me",
+    "observability-and-instrumentation",
+    "performance-optimization",
+    "planning-and-task-breakdown",
+    "security-and-hardening",
+    "shipping-and-launch",
+    "source-driven-development",
+    "spec-driven-development",
+    "test-driven-development",
+    "using-agent-skills"
+  ],
+  "commands": [
+    "build",
+    "code-simplify",
+    "constraints",
+    "plan",
+    "review",
+    "ship",
+    "spec",
+    "test",
+    "webperf"
+  ],
+  "personas": [
+    "code-reviewer",
+    "security-auditor",
+    "test-engineer",
+    "web-performance-auditor"
+  ],
+  "references": [
+    "references/accessibility-checklist.md",
+    "references/definition-of-done.md",
+    "references/observability-checklist.md",
+    "references/orchestration-patterns.md",
+    "references/performance-checklist.md",
+    "references/security-checklist.md",
+    "references/testing-patterns.md"
+  ],
+  "runtimeFiles": [
+    ".agents/plugins/marketplace.json",
+    ".claude-plugin/marketplace.json",
+    ".claude-plugin/plugin.json",
+    ".claude/commands/build.md",
+    ".claude/commands/code-simplify.md",
+    ".claude/commands/constraints.md",
+    ".claude/commands/plan.md",
+    ".claude/commands/review.md",
+    ".claude/commands/ship.md",
+    ".claude/commands/spec.md",
+    ".claude/commands/test.md",
+    ".claude/commands/webperf.md",
+    ".codex-plugin/plugin.json",
+    ".gemini/commands/build.toml",
+    ".gemini/commands/code-simplify.toml",
+    ".gemini/commands/constraints.toml",
+    ".gemini/commands/planning.toml",
+    ".gemini/commands/review.toml",
+    ".gemini/commands/ship.toml",
+    ".gemini/commands/spec.toml",
+    ".gemini/commands/test.toml",
+    ".gemini/commands/webperf.toml",
+    "LICENSE",
+    "agents/code-reviewer.md",
+    "agents/security-auditor.md",
+    "agents/test-engineer.md",
+    "agents/web-performance-auditor.md",
+    "commands/build.toml",
+    "commands/code-simplify.toml",
+    "commands/constraints.toml",
+    "commands/planning.toml",
+    "commands/review.toml",
+    "commands/ship.toml",
+    "commands/spec.toml",
+    "commands/test.toml",
+    "commands/webperf.toml",
+    "hooks/SDD-CACHE.md",
+    "hooks/SIMPLIFY-IGNORE.md",
+    "hooks/sdd-cache-post.sh",
+    "hooks/sdd-cache-pre.sh",
+    "hooks/sdd-cache-test.sh",
+    "hooks/session-start-test.sh",
+    "hooks/session-start.sh",
+    "hooks/simplify-ignore-test.sh",
+    "hooks/simplify-ignore.sh",
+    "plugin.json",
+    "references/accessibility-checklist.md",
+    "references/definition-of-done.md",
+    "references/observability-checklist.md",
+    "references/orchestration-patterns.md",
+    "references/performance-checklist.md",
+    "references/security-checklist.md",
+    "references/testing-patterns.md",
+    "skills/api-and-interface-design/SKILL.md",
+    "skills/browser-testing-with-devtools/SKILL.md",
+    "skills/ci-cd-and-automation/SKILL.md",
+    "skills/code-review-and-quality/SKILL.md",
+    "skills/code-simplification/SKILL.md",
+    "skills/constraint-driven-development/SKILL.md",
+    "skills/constraint-driven-development/references/floor-guard.md",
+    "skills/context-engineering/SKILL.md",
+    "skills/debugging-and-error-recovery/SKILL.md",
+    "skills/deprecation-and-migration/SKILL.md",
+    "skills/documentation-and-adrs/SKILL.md",
+    "skills/doubt-driven-development/SKILL.md",
+    "skills/frontend-ui-engineering/SKILL.md",
+    "skills/git-workflow-and-versioning/SKILL.md",
+    "skills/idea-refine/SKILL.md",
+    "skills/idea-refine/examples.md",
+    "skills/idea-refine/frameworks.md",
+    "skills/idea-refine/refinement-criteria.md",
+    "skills/idea-refine/scripts/idea-refine.sh",
+    "skills/incremental-implementation/SKILL.md",
+    "skills/interview-me/SKILL.md",
+    "skills/observability-and-instrumentation/SKILL.md",
+    "skills/performance-optimization/SKILL.md",
+    "skills/performance-optimization/references/optimization-patterns.md",
+    "skills/planning-and-task-breakdown/SKILL.md",
+    "skills/security-and-hardening/SKILL.md",
+    "skills/security-and-hardening/references/hardening-patterns.md",
+    "skills/shipping-and-launch/SKILL.md",
+    "skills/source-driven-development/SKILL.md",
+    "skills/spec-driven-development/SKILL.md",
+    "skills/test-driven-development/SKILL.md",
+    "skills/using-agent-skills/SKILL.md"
+  ],
+  "skillFrontmatter": {
+    "api-and-interface-design": "44f904d462977e9514f439ac7c057b8691613ba8160360ad9d28b830d3a24001",
+    "browser-testing-with-devtools": "e235631718d18a0527d00eb718ecece2218bbf205d742632f8197b30c052e96b",
+    "ci-cd-and-automation": "dd73253ec445a9af27ebeab74404ee7a770919e40ec9db0b34af4fa9ec36bf7c",
+    "code-review-and-quality": "bf3dda5e08190fcf00175a5053f53550bca91ca32b0a06e4b97cd33e046e8eb7",
+    "code-simplification": "cee4dc87b4bc95d77fe646d4ab9e66c9a422dd081a833d657d618aaf2967b5a2",
+    "constraint-driven-development": "0da347bd34b155ab79cad1e0ee80238f3b4b91b1a17ca0fc2f68460c02224194",
+    "context-engineering": "f4f18514e5eeb162ef9f925dea85af2c72ba79f9b157783a06c39c0bde102d3f",
+    "debugging-and-error-recovery": "658d96f63d56946214a7ec87be0347c78d6024a18f6481dc9f7310638f403629",
+    "deprecation-and-migration": "388d5e7e549f1b728213f0f50d91e9ca96210e0cb23fd9fccd30755268dd01f9",
+    "documentation-and-adrs": "6b2a9d19ebbb81570022a89f09b4810eeb0643a48c698989ee27a224f90bc026",
+    "doubt-driven-development": "df8954091f08c14b0e91bf3bf330f43d5a8408c1efe697591b7b0e8448251c71",
+    "frontend-ui-engineering": "323624fe7ec44bdb4fad3c9488e55993119912625fffa20ee5787389da2b600d",
+    "git-workflow-and-versioning": "dd28469b0f294865dbd20d622a9fee5f05ef87ab1599e973fec6d15a16f76e15",
+    "idea-refine": "07eedcfcba98c6c8f6985917830c4b3d93d4e17af05a9b2ca1b8cb54226bc1b9",
+    "incremental-implementation": "d31e04a0d7b07fc7d01e0176aafbba5607f1cfe7a29a634498305d95c2b3bd3b",
+    "interview-me": "62700902b592a4fa28f6f71f2581d4e1dee412ff288eb156ed97fac3db8b4295",
+    "observability-and-instrumentation": "652b9724e431bd7cfd4481bbab31bb079eeab2b5f70ebc04cf66743e37028721",
+    "performance-optimization": "76befb0806caad12322de8fe372d2e984f6e07c393fd8d3658537c92c7e285cf",
+    "planning-and-task-breakdown": "c3bc139dfa7af82e2d11c7cf461bbf923add7d6494d669da98925f77a7671641",
+    "security-and-hardening": "981142e38769394e6e7760250f2dd599dff21a370040f3f141c42507f04ea540",
+    "shipping-and-launch": "02cc76557e581957cb4987a53e03a8d1aa04c72dc735390d52ae4eed3ddeddf9",
+    "source-driven-development": "233bf9f16f5fe0960c988a5feb2efc475b9b24f9e145d960f8c63e44f4f34fde",
+    "spec-driven-development": "e21f25e534ffa3e2de9ac08c40f8d1d90cef17ad55702f83301cbc2a297c2dcb",
+    "test-driven-development": "38f1489687eaa60761522a8e3efaa926b52786b0e1b3c57947a6050c0da340de",
+    "using-agent-skills": "df5d4f61855ac46da3371bad8c05edb8bc9375ba191acc82b0cca257cfec946c"
+  }
+}

package/references/accessibility-checklist.md

@@ -0,0 +1,160 @@
+# Accessibility Checklist
+
+Quick reference for WCAG 2.1 AA compliance. Use alongside the `frontend-ui-engineering` skill.
+
+## Table of Contents
+
+- [Essential Checks](#essential-checks)
+- [Common HTML Patterns](#common-html-patterns)
+- [Testing Tools](#testing-tools)
+- [Quick Reference: ARIA Live Regions](#quick-reference-aria-live-regions)
+- [Common Anti-Patterns](#common-anti-patterns)
+
+## Essential Checks
+
+### Keyboard Navigation
+- [ ] All interactive elements focusable via Tab key
+- [ ] Focus order follows visual/logical order
+- [ ] Focus is visible (outline/ring on focused elements)
+- [ ] Custom widgets have keyboard support (Enter to activate, Escape to close)
+- [ ] No keyboard traps (user can always Tab away from a component)
+- [ ] Skip-to-content link at top of page - visible (at least) on keyboard focus
+- [ ] Modals trap focus while open, return focus on close
+
+### Screen Readers
+- [ ] All images have `alt` text (or `alt=""` for decorative images)
+- [ ] All form inputs have associated labels (`<label>` or `aria-label`)
+- [ ] Buttons and links have descriptive text (not "Click here")
+- [ ] Icon-only buttons have `aria-label`
+- [ ] Page has one `<h1>` and headings don't skip levels
+- [ ] Dynamic content changes announced (`aria-live` regions)
+- [ ] Tables have `<th>` headers with scope
+
+### Visual
+- [ ] Text contrast ≥ 4.5:1 (normal text) or ≥ 3:1 (large text, 18px+)
+- [ ] UI components contrast ≥ 3:1 against background
+- [ ] Color is not the only way to convey information
+- [ ] Text resizable to 200% without breaking layout
+- [ ] No content that flashes more than 3 times per second
+
+### Forms
+- [ ] Every input has a visible label
+- [ ] Required fields indicated (not by color alone)
+- [ ] Error messages specific and associated with the field
+- [ ] Error state visible by more than color (icon, text, border)
+- [ ] Form submission errors summarized and focusable
+- [ ] Known fields use autocomplete (for example `type="email" autocomplete="email"`)
+
+### Content
+- [ ] Language declared (`<html lang="en">`)
+- [ ] Page has a descriptive `<title>`
+- [ ] Links distinguish from surrounding text (not by color alone)
+- [ ] Touch targets ≥ 44x44px on mobile
+- [ ] Meaningful empty states (not blank screens)
+
+## Common HTML Patterns
+
+### Buttons vs. Links
+
+```html
+<!-- Use <button> for actions -->
+<button onClick={handleDelete}>Delete Task</button>
+
+<!-- Use <a> for navigation -->
+<a href="/tasks/123">View Task</a>
+
+<!-- NEVER use div/span as buttons -->
+<div onClick={handleDelete}>Delete</div>  <!-- BAD -->
+```
+
+### Form Labels
+
+```html
+<!-- Explicit label association -->
+<label htmlFor="email">Email address</label>
+<input id="email" type="email" required />
+
+<!-- Implicit wrapping -->
+<label>
+  Email address
+  <input type="email" required />
+</label>
+
+<!-- Hidden label (visible label preferred) -->
+<input type="search" aria-label="Search tasks" />
+```
+
+### ARIA Roles
+
+```html
+<!-- Navigation -->
+<nav aria-label="Main navigation">...</nav>
+<nav aria-label="Footer links">...</nav>
+
+<!-- Status messages -->
+<div role="status" aria-live="polite">Task saved</div>
+
+<!-- Alert messages -->
+<div role="alert">Error: Title is required</div>
+
+<!-- Modal dialogs -->
+<dialog aria-modal="true" aria-labelledby="dialog-title">
+  <h2 id="dialog-title">Confirm Delete</h2>
+  ...
+</dialog>
+
+<!-- Loading states -->
+<div aria-busy="true" aria-label="Loading tasks">
+  <Spinner />
+</div>
+```
+
+### Accessible Lists
+
+```html
+<ul role="list" aria-label="Tasks">
+  <li>
+    <input type="checkbox" id="task-1" aria-label="Complete: Buy groceries" />
+    <label htmlFor="task-1">Buy groceries</label>
+  </li>
+</ul>
+```
+
+## Testing Tools
+
+```bash
+# Automated audit
+npx axe-core          # Programmatic accessibility testing
+npx pa11y             # CLI accessibility checker
+
+# In browser
+# Chrome DevTools → Lighthouse → Accessibility
+# Chrome DevTools → Elements → Accessibility tree
+
+# Screen reader testing
+# macOS: VoiceOver (Cmd + F5)
+# Windows: NVDA (free) or JAWS
+# Linux: Orca
+```
+
+## Quick Reference: ARIA Live Regions
+
+| Value | Behavior | Use For |
+|-------|----------|---------|
+| `aria-live="polite"` | Announced at next pause | Status updates, saved confirmations |
+| `aria-live="assertive"` | Announced immediately | Errors, time-sensitive alerts |
+| `role="status"` | Same as `polite` | Status messages |
+| `role="alert"` | Same as `assertive` | Error messages |
+
+## Common Anti-Patterns
+
+| Anti-Pattern | Problem | Fix |
+|---|---|---|
+| `div` as button | Not focusable, no keyboard support | Use `<button>` |
+| Missing `alt` text | Images invisible to screen readers | Add descriptive `alt` |
+| Color-only states | Invisible to color-blind users | Add icons, text, or patterns |
+| Autoplaying media | Disorienting, can't be stopped | Add controls, don't autoplay |
+| Custom dropdown with no ARIA | Unusable by keyboard/screen reader | Use native `<select>` or proper ARIA listbox |
+| Removing focus outlines | Users can't see where they are | Style outlines, don't remove them |
+| Empty links/buttons | "Link" announced with no description | Add text or `aria-label` |
+| `tabindex > 0` | Breaks natural tab order | Use `tabindex="0"` or `-1` only |

package/references/definition-of-done.md

@@ -0,0 +1,67 @@
+# Definition of Done
+
+A standing, project-wide bar that every change must clear before it counts as done. Unlike acceptance criteria, which vary per task and answer "did we build the right thing?", the Definition of Done is the same every time and answers "is this finished to our standard?". Use it as the final gate in `planning-and-task-breakdown`, `incremental-implementation`, and `shipping-and-launch`.
+
+## Definition of Done vs. Acceptance Criteria
+
+| | Acceptance Criteria | Definition of Done |
+|---|---|---|
+| Scope | Specific to one task or spec | Applies to every increment |
+| Changes | Different for each item | Fixed and reused |
+| Answers | "Did we build *this thing*?" | "Is it *ready*?" |
+| Owner | Defined when planning the task | Defined once for the project |
+| Example | "User can reset password via email link" | "Tests pass, no regressions, docs updated" |
+
+The two are complementary. A task is done only when **its** acceptance criteria are met **and** the standing Definition of Done is satisfied. Skipping either leaves work that looks finished but is not.
+
+## The Standing Checklist
+
+Apply this to every change before declaring it done.
+
+### Correctness
+- [ ] All acceptance criteria for the task are met
+- [ ] Code runs and behaves as intended, verified at runtime, not just compiled or typechecked
+- [ ] New behavior is covered by tests that fail without the change and pass with it
+- [ ] Existing tests still pass; no regressions introduced
+- [ ] Edge cases and error paths are handled, not just the happy path
+
+### Quality
+- [ ] Code reveals intent through naming and structure; no comments needed to explain *what* it does
+- [ ] No duplicated business logic
+- [ ] No dead code, debug output, or commented-out blocks left behind
+- [ ] Changes are scoped to the task; no unrelated refactors snuck in
+- [ ] Linting and formatting pass
+
+The depth behind these items lives in `code-review-and-quality` (the five-axis review) and `code-simplification` (reducing complexity without changing behavior).
+
+### Integration
+- [ ] Change works with the rest of the system, not just in isolation
+- [ ] Database migrations, config changes, and feature flags are accounted for
+- [ ] Backward compatibility considered for any public interface or API change
+
+### Documentation
+- [ ] Public interfaces, APIs, and user-facing behavior are documented
+- [ ] Architectural decisions worth preserving are recorded (see `documentation-and-adrs`)
+- [ ] Documentation describes the current state in timeless language, not the change history
+
+### Ship-readiness
+- [ ] Security implications reviewed for any untrusted input, auth, or data handling (see `security-and-hardening`)
+- [ ] Observability in place for new critical paths (logs, metrics, traces) (see `observability-and-instrumentation`)
+- [ ] Rollback path exists for anything risky (see `shipping-and-launch`)
+- [ ] The human has reviewed and approved before merge or deploy
+
+## How to Apply
+
+- **Per task**: confirm the Correctness and Quality sections before checking the task off.
+- **Per feature**: confirm Integration and Documentation before considering the feature complete.
+- **Per release**: the full checklist is the floor; `shipping-and-launch` adds the deploy-specific gates on top.
+
+Tailor the list to the project once, then reuse it unchanged. A Definition of Done that is renegotiated every sprint is not a Definition of Done.
+
+## Red Flags
+
+- "It's done, I just haven't run it yet": unverified work is not done.
+- "Tests pass" used as a synonym for done while docs, regressions, or runtime verification are skipped.
+- A different bar applied depending on deadline pressure.
+- Acceptance criteria treated as the whole bar, with no standing quality floor.
+- "Done" declared before human review on changes that need it.

package/references/observability-checklist.md

@@ -0,0 +1,92 @@
+# Observability Checklist
+
+Quick reference for instrumenting production code. Use alongside the `observability-and-instrumentation` skill.
+
+## Table of Contents
+
+- [On-Call Questions (Start Here)](#on-call-questions-start-here)
+- [Structured Logging](#structured-logging)
+- [Metrics](#metrics)
+- [Distributed Tracing](#distributed-tracing)
+- [Alerting](#alerting)
+- [Dashboards](#dashboards)
+- [Verify the Telemetry](#verify-the-telemetry)
+- [Pre-Launch Gate](#pre-launch-gate)
+
+## On-Call Questions (Start Here)
+
+Telemetry without a question is noise. Before instrumenting anything:
+
+- [ ] 2–4 questions an on-call engineer will ask about this feature are written down
+- [ ] Every signal below maps to one of those questions
+- [ ] Each question is matched to the right signal type: metrics say **that** something is wrong, traces say **where**, logs say **why**
+
+## Structured Logging
+
+- [ ] Logs are structured (JSON) with stable event names — not free-form strings
+- [ ] Every log line carries a correlation/request ID, generated or accepted at the system boundary
+- [ ] Correlation ID is propagated on every outbound call and async boundary (HTTP headers, queue metadata)
+- [ ] Any log stream written by more than one entry point (scheduler, replay endpoint, manual run) carries an entry-point field, set where the run starts and propagated alongside the correlation ID
+- [ ] Log levels are consistent: `error` = invariant broken, someone may act; `warn` = degraded but handled; `info` = significant business event; `debug` = off in production
+- [ ] No secrets, tokens, passwords, or unredacted PII in any log line (hard rule from `security-and-hardening`)
+- [ ] Fields are allowlisted — no whole request/response bodies, no auth headers
+- [ ] External service calls logged with metadata only: endpoint, status, latency, attempt count, sanitized identifiers
+- [ ] Actual log output spot-checked: structured fields, not `[object Object]`
+
+## Metrics
+
+- [ ] **RED** instrumented for every endpoint and every external dependency: Rate, Errors, Duration
+- [ ] **USE** instrumented for every resource (queues, pools, hosts): Utilization, Saturation, Errors
+- [ ] Latency is a histogram; p50/p95/p99 queryable — never an average
+- [ ] All labels come from small, fixed sets (route template, status class, provider name)
+- [ ] No unbounded label values: no user IDs, tenant IDs, emails, raw URLs, request IDs, or error message text
+- [ ] Status codes grouped by class (`5xx`, not `503`)
+- [ ] Queue depth and processing duration tracked for every worker/queue
+
+## Distributed Tracing
+
+- [ ] OpenTelemetry (or equivalent) initialized at service startup, before other imports
+- [ ] Auto-instrumentation enabled for HTTP, gRPC, and DB clients
+- [ ] Trace context propagated on every outbound call (W3C `traceparent`/`tracestate`) and extracted from every inbound request
+- [ ] Context survives async boundaries — queue messages carry trace metadata
+- [ ] Manual spans only around meaningful internal units of work, with the attributes on-call will filter by
+- [ ] No secrets or PII as span attributes
+- [ ] Head-based sampling at a low default rate; 100% of errors kept if tail sampling is available
+
+## Alerting
+
+- [ ] Every alert is symptom-based (error rate, p99 latency, queue age) — causes (CPU, disk, restarts) go to dashboards, not pagers
+- [ ] Every alert is actionable; "ignore it, it self-heals" alerts are deleted
+- [ ] Every alert links to a runbook — minimum three lines: what it means, first query to run, escalation path
+- [ ] Thresholds and durations justified by an SLO or historical data, not guesses
+- [ ] Two severities only: **page** (user-facing, act now) and **ticket** (degradation, act this week)
+- [ ] Each new alert test-fired once: it reached the right channel and the runbook link works
+- [ ] No alerts that fire daily and get acknowledged without action
+
+## Dashboards
+
+- [ ] Service health dashboard exists: error rate, latency p99, traffic, saturation
+- [ ] Dependency health panel shows per-service error rates and latency
+- [ ] Dashboard answers the on-call questions from the top of this checklist — not "everything except the answer"
+- [ ] Default time range is sensible (1h–6h, not 30d)
+
+## Verify the Telemetry
+
+Instrumentation is code; it can be wrong:
+
+- [ ] Forced an error in staging → found it in the logs by correlation ID
+- [ ] Sent test traffic → metric series appear with expected labels and sane values
+- [ ] Followed one request end-to-end in the tracing UI → no broken spans
+- [ ] An induced failure was diagnosed from telemetry alone, without reading the source
+
+## Pre-Launch Gate
+
+Before a feature ships to production, all of the following are true:
+
+- [ ] Structured logs flowing to the log aggregator
+- [ ] RED metrics visible in dashboards for every new endpoint and dependency
+- [ ] At least one symptom-based alert configured, with runbook, test-fired
+- [ ] A request can be traced across every service it touches
+- [ ] On-call knows where the runbooks are
+
+For launch-day monitoring sequence and rollback triggers, see the `shipping-and-launch` skill.