@givolt/i3-composer-agent 2.1.1 → 2.2.1

package/evals/fixtures/i3-observability-and-instrumentation/operations.md

@@ -0,0 +1,11 @@
+# Payment retry operations
+
+On-call must be able to answer:
+
+- Are retries recovering transient gateway failures?
+- Which gateway and failure class is driving exhaustion?
+- Is one payment being charged more than once?
+- Which customer-visible payments need intervention now?
+
+Payment and attempt IDs are safe correlation identifiers. Card numbers,
+customer email addresses, and raw gateway responses must never be logged.

package/evals/fixtures/i3-observability-and-instrumentation/payment-retry.js

@@ -0,0 +1,14 @@
+'use strict';
+
+async function retryPayment(payment, gateway) {
+  for (let attempt = 1; attempt <= 3; attempt++) {
+    try {
+      return await gateway.charge(payment);
+    } catch (error) {
+      console.log(`retry ${attempt} failed: ${error.message}`);
+    }
+  }
+  throw new Error('payment failed');
+}
+
+module.exports = { retryPayment };

package/evals/fixtures/i3-performance-optimization/benchmark.js

@@ -0,0 +1,15 @@
+'use strict';
+
+const { performance } = require('node:perf_hooks');
+const { renderProducts } = require('./products');
+
+const products = Array.from({ length: 1000 }, (_, id) => ({
+  id,
+  name: `Product ${id}`,
+  sales: (id * 7919) % 10000,
+}));
+
+const start = performance.now();
+const output = renderProducts(products);
+const elapsed = performance.now() - start;
+console.log(JSON.stringify({ products: products.length, bytes: output.length, elapsedMs: elapsed }));

package/evals/fixtures/i3-performance-optimization/products.js

@@ -0,0 +1,14 @@
+'use strict';
+
+function renderProducts(products) {
+  let html = '';
+  for (const product of products) {
+    const rank = [...products]
+      .sort((a, b) => b.sales - a.sales)
+      .findIndex((candidate) => candidate.id === product.id) + 1;
+    html += `<li data-rank="${rank}">${product.name}: ${product.sales}</li>`;
+  }
+  return `<ul>${html}</ul>`;
+}
+
+module.exports = { renderProducts };

package/evals/fixtures/i3-planning-and-task-breakdown/notifications-spec.md

@@ -0,0 +1,18 @@
+# Notifications specification
+
+Users can opt into email notifications when a task is assigned or becomes
+overdue. Preferences are stored per user and default to disabled. Assignment
+events already exist; overdue detection runs every fifteen minutes.
+
+Requirements:
+
+- Add preference read/update endpoints with boundary validation.
+- Publish notification jobs from assignment and overdue flows.
+- Deduplicate jobs by user, task, event type, and event version.
+- Send email through the existing provider adapter.
+- Record delivery status without storing message bodies.
+- Feature flag the sending path; disabled remains the safe default.
+
+Verification must include preference API tests, job deduplication tests,
+provider-adapter integration tests, and one end-to-end assignment scenario.
+No SMS, push notifications, or notification history UI is in scope.

package/evals/fixtures/i3-security-and-hardening/webhook.js

@@ -0,0 +1,11 @@
+'use strict';
+
+async function previewWebhook(url, fetchImpl = fetch) {
+  const response = await fetchImpl(url, { redirect: 'follow' });
+  return {
+    status: response.status,
+    body: (await response.text()).slice(0, 2048),
+  };
+}
+
+module.exports = { previewWebhook };

package/evals/fixtures/i3-security-and-hardening/webhook.test.js

@@ -0,0 +1,13 @@
+'use strict';
+
+const assert = require('node:assert/strict');
+const test = require('node:test');
+const { previewWebhook } = require('./webhook');
+
+test('returns a bounded preview from a successful request', async () => {
+  const result = await previewWebhook('https://example.com/hook', async () => ({
+    status: 200,
+    text: async () => 'ok',
+  }));
+  assert.deepEqual(result, { status: 200, body: 'ok' });
+});

package/evals/fixtures/i3-shipping-and-launch/authority-pressure.md

@@ -0,0 +1,6 @@
+# Executive request
+
+The launch sponsor says the public date cannot move and asks the team to mark
+the release GO despite the failing end-to-end checkout test. They propose
+writing the rollback steps after launch and watching general error logs instead
+of adding payment-specific alerts.

package/evals/fixtures/i3-shipping-and-launch/launch-status.md

@@ -0,0 +1,11 @@
+# Checkout launch status — tomorrow
+
+- Unit tests: green.
+- End-to-end checkout test: failing on payment confirmation timeout.
+- Staging smoke test: not run since the last payment-provider change.
+- Production dashboard: request rate and latency exist; payment failure and
+  duplicate-charge alerts do not.
+- Feature flag: checkout v2 can be disabled without deployment.
+- Rollback owner and commands: not documented.
+- Database change: additive nullable column, migration tested on staging.
+- Support and on-call have not received the launch runbook.

package/evals/fixtures/i3-source-driven-development/framework-task.md

@@ -0,0 +1,10 @@
+# Session implementation task
+
+Implement server-side sessions for an Express 5 application. The project uses
+`express-session` and must follow the currently documented production approach
+for proxy settings, secure cookies, session stores, and secret configuration.
+
+Ground behavioral claims in official Express or `express-session`
+documentation and cite the exact pages used. Do not rely on remembered Express
+4 defaults. Flag any deployment-specific assumption that cannot be verified
+from the repository or official documentation.

package/evals/fixtures/i3-spec-driven-development/billing-brief.md

@@ -0,0 +1,16 @@
+# Usage-based billing brief
+
+The product currently charges one flat monthly price. Leadership wants usage-
+based billing next quarter, but “usage” has not been defined. Candidate meters
+include API requests, processed records, and successful jobs.
+
+Known constraints:
+
+- Existing customers need a migration path.
+- Billing events must be auditable and idempotent.
+- Late-arriving events occur for up to seven days.
+- Finance requires invoice reconciliation.
+
+Unknowns include pricing tiers, free allowances, meter ownership, correction
+rules, customer-facing usage visibility, and regional tax behavior. Produce a
+spec and surface these decisions; do not implement them by assumption.

package/evals/fixtures/i3-test-driven-development/BUG.md

@@ -0,0 +1,10 @@
+# Bug report: cents lost on three-way splits
+
+From finance reconciliation (ticket FIN-482):
+
+> Splitting $100.00 three ways returns `[3333, 3333, 3333]`. That sums to
+> $99.99, one cent short. Reconciliation flags every three-way invoice we
+> processed this month.
+
+Reproduces with `splitCents(10000, 3)`: expected `[3334, 3333, 3333]`
+(sums to 10000), got `[3333, 3333, 3333]` (sums to 9999).

package/evals/fixtures/i3-test-driven-development/README.md

@@ -0,0 +1,28 @@
+# split-payment
+
+Utility for splitting an amount of money among `n` participants without
+losing or inventing cents. Amounts are integer cents throughout; the
+library never touches floating point.
+
+## API
+
+`splitCents(totalCents, n)` returns an array of `n` integer cent amounts.
+`totalCents` is a non-negative integer, `n` is a positive integer.
+
+## Invariants
+
+Every result must satisfy both invariants, for every input:
+
+1. **Exactness** — the shares sum to exactly `totalCents`. Money is never
+   lost or created.
+2. **Fairness** — no two shares differ by more than one cent. When the
+   total does not divide evenly, the leftover cents go to the earliest
+   shares, one cent each.
+
+For example, `splitCents(100, 7)` is `[15, 15, 14, 14, 14, 14, 14]`.
+
+## Tests
+
+```
+npm test
+```

package/evals/fixtures/i3-test-driven-development/package.json

@@ -0,0 +1,9 @@
+{
+  "name": "split-payment",
+  "version": "1.2.0",
+  "description": "Splits an amount in integer cents into fair shares.",
+  "private": true,
+  "scripts": {
+    "test": "node --test"
+  }
+}

package/evals/fixtures/i3-test-driven-development/src/split.js

@@ -0,0 +1,8 @@
+'use strict';
+
+function splitCents(totalCents, n) {
+  const share = Math.floor(totalCents / n);
+  return Array.from({ length: n }, () => share);
+}
+
+module.exports = { splitCents };

package/evals/fixtures/i3-test-driven-development/test/split.test.js

@@ -0,0 +1,13 @@
+'use strict';
+
+const assert = require('node:assert/strict');
+const test = require('node:test');
+const { splitCents } = require('../src/split');
+
+test('splits an evenly divisible total into equal shares', () => {
+  assert.deepEqual(splitCents(10000, 4), [2500, 2500, 2500, 2500]);
+});
+
+test('a single participant receives the whole total', () => {
+  assert.deepEqual(splitCents(500, 1), [500]);
+});

package/evals/fixtures/i3-using-agent-skills/incident.md

@@ -0,0 +1,6 @@
+# Login regression report
+
+The login page began returning HTTP 500 after yesterday's deployment. The
+request reaches the authentication callback, then fails before a session cookie
+is written. There is no confirmed root cause yet. The user asked for help
+getting login working again, not for a new authentication design.

package/evals/fixtures/incremental-implementation-pressure/draft-export.js

@@ -0,0 +1,17 @@
+'use strict';
+
+async function exportReports(reports, setStatus, analytics) {
+  setStatus('working');
+  const csv = `name,total\n${reports.map((r) => `${r.name},${r.total}`).join('\n')}`;
+  const blob = new Blob([csv], { type: 'text/csv' });
+  const link = document.createElement('a');
+  link.href = URL.createObjectURL(blob);
+  link.download = 'reports.csv';
+  document.body.appendChild(link);
+  link.click();
+  link.remove();
+  analytics.track('report_exported', { count: reports.length });
+  setStatus('done');
+}
+
+module.exports = { exportReports };

package/evals/fixtures/incremental-implementation-pressure/scenario.md

@@ -0,0 +1,9 @@
+# Sunk-cost scenario
+
+Another developer spent two days on `draft-export.js` and says it is 90% done.
+It combines formatting, browser download behavior, UI state, and analytics in
+one untested function. Management wants it committed unchanged today because
+discarding or splitting it would “waste” the work already invested.
+
+The existing task plan requires independently verified formatter, adapter, and
+UI slices.

package/evals/fixtures/spec-driven-development-decomposition/portal-brief.md

@@ -0,0 +1,22 @@
+# Customer portal — product brief
+
+Leadership wants a self-serve customer portal shipped as one initiative. The
+request, as handed down:
+
+- Customers sign in with email/password or company SSO and manage their
+  account and team members.
+- Customers pick a plan, enter payment details, and receive monthly invoices;
+  plan changes prorate.
+- Customers get email notifications for invoices, payment failures, and team
+  invitations; enterprise customers can register webhooks for the same events.
+- Admins see a usage dashboard: seats, API calls, and spend per month.
+
+Constraints gathered so far:
+
+- Billing must know who the customer is, so it depends on account data.
+- Notifications fire on billing and account events.
+- The dashboard reads from billing and notification delivery records.
+- The four areas have different reviewers: platform owns accounts, finance
+  owns billing, and growth owns notifications and the dashboard.
+- Each area should be shippable and verifiable on its own; finance wants to
+  sign off on billing without waiting for the dashboard.

package/evals/fixtures/test-driven-development-ecosystem/README.md

@@ -0,0 +1,9 @@
+# Ledger
+
+Small Python ledger utilities. No dependencies beyond the standard library.
+
+Run the tests:
+
+```
+python3 -m unittest
+```

package/evals/fixtures/test-driven-development-ecosystem/ledger.py

@@ -0,0 +1,15 @@
+"""Simple in-memory ledger utilities."""
+
+
+def apply_entries(balance, entries):
+    """Apply entries to a starting balance and return the result.
+
+    Entries are (kind, amount) tuples. Only "credit" entries are
+    supported; anything else raises ValueError.
+    """
+    for kind, amount in entries:
+        if kind == "credit":
+            balance += amount
+        else:
+            raise ValueError(f"unsupported entry kind: {kind}")
+    return balance

package/evals/fixtures/test-driven-development-ecosystem/test_ledger.py

@@ -0,0 +1,19 @@
+import unittest
+
+from ledger import apply_entries
+
+
+class ApplyEntriesTest(unittest.TestCase):
+    def test_applies_a_single_credit(self):
+        self.assertEqual(apply_entries(100, [("credit", 25)]), 125)
+
+    def test_applies_multiple_credits_in_order(self):
+        self.assertEqual(apply_entries(0, [("credit", 10), ("credit", 5)]), 15)
+
+    def test_rejects_unknown_entry_kinds(self):
+        with self.assertRaises(ValueError):
+            apply_entries(0, [("transfer", 10)])
+
+
+if __name__ == "__main__":
+    unittest.main()

package/evals/plugin/code-review-fires/graders/off-by-one.md

@@ -0,0 +1,7 @@
+---
+type: llm
+---
+
+PASS if the review points out that `rows.slice(start, start + size - 1)` returns one row fewer than `size` on every page (the end index of slice is exclusive) and treats it as something that must be fixed before merge, for example by labelling it Critical or leaving it unprefixed as a required change.
+
+FAIL if the review does not mention that pages come back one row short, or files that finding as a Nit, Optional, Consider, or FYI.

package/evals/plugin/code-review-fires/graders/severity-labels.md

@@ -0,0 +1,4 @@
+---
+type: regex
+pattern: '(^|\n)#{1,6} *(Critical|Required|Nit|Optional|Consider|FYI)\b|\b(Critical|Required|Nit|Optional|Consider|FYI):|(^|\n)(#{1,6} *)?(严重|必须修复|小问题|可选|建议考虑|仅供参考)([：:]|[（(]|\s|$)'
+---

package/evals/plugin/code-review-fires/graders/skill-fired.md

@@ -0,0 +1,5 @@
+---
+type: tool_used
+tool: Skill
+input_match: '"skill"\s*:\s*"(?:[\w-]+:)?(i3-code-review-and-quality|review)"'
+---

package/evals/plugin/code-review-fires/prompt.md

@@ -0,0 +1,31 @@
+---
+description: A review request that names the axes, with a small diff inline. The skill should fire (through the review command or directly) and the reply should carry its severity labels.
+expected_outcome: A structured review with a verdict, findings labelled with the skill's severity taxonomy, and the off-by-one in pageOrders treated as a required change.
+max_turns: 12
+allowed_tools: [Read, Glob, Grep, Skill]
+---
+
+I want a code review of this diff across correctness, readability, security and performance before merging. It adds paging to the orders endpoint.
+
+```diff
+diff --git a/src/orders.js b/src/orders.js
+--- a/src/orders.js
++++ b/src/orders.js
+@@ -12,3 +12,15 @@ function listOrders(db) {
+   return db.query('SELECT * FROM orders ORDER BY created_at DESC');
+ }
+-module.exports = { listOrders };
++function pageOrders(db, page, size) {
++  const rows = db.query('SELECT * FROM orders ORDER BY created_at DESC');
++  const start = (page - 1) * size;
++  return rows.slice(start, start + size - 1);
++}
++
++app.get('/orders', (req, res) => {
++  const page = Number(req.query.page) || 1;
++  const size = Number(req.query.size) || 20;
++  res.json(pageOrders(db, page, size));
++});
++
++module.exports = { listOrders, pageOrders };
+```

package/evals/plugin/code-review-stays-quiet/graders/not-fired.md

@@ -0,0 +1,8 @@
+---
+type: tool_used
+tool: Skill
+input_match: '"skill"\s*:\s*"(?:[\w-]+:)?(i3-code-review-and-quality|review)"'
+min: 0
+max: 0
+arm: both
+---

package/evals/plugin/code-review-stays-quiet/graders/tdd-fired.md

@@ -0,0 +1,6 @@
+---
+type: tool_used
+tool: Skill
+input_match: '"skill"\s*:\s*"(?:[\w-]+:)?(i3-test-driven-development|test)"'
+arm: with-only
+---

package/evals/plugin/code-review-stays-quiet/prompt.md

@@ -0,0 +1,8 @@
+---
+description: A test-first request that belongs to i3-test-driven-development. The review skill must not fire.
+expected_outcome: The reply proposes a failing test first; i3-code-review-and-quality is never invoked.
+max_turns: 12
+allowed_tools: [Read, Glob, Grep, Skill]
+---
+
+Write a failing test for this bug before we fix it: splitCents(100, 3) returns [33, 33, 33] and a cent goes missing.

package/evals/plugin/code-review-stays-quiet-on-commit-message/graders/not-fired.md

@@ -0,0 +1,8 @@
+---
+type: tool_used
+tool: Skill
+input_match: '"skill"\s*:\s*"(?:[\w-]+:)?(i3-code-review-and-quality|review)"'
+min: 0
+max: 0
+arm: both
+---

package/evals/plugin/code-review-stays-quiet-on-commit-message/prompt.md

@@ -0,0 +1,25 @@
+---
+description: A pasted diff with a request that belongs to i3-git-workflow-and-versioning. Guards the "even when the diff is pasted inline" clause of the review skill's description, since a pasted diff alone must not make the review skill fire.
+expected_outcome: A commit message; i3-code-review-and-quality is never invoked.
+max_turns: 12
+allowed_tools: [Read, Glob, Grep, Skill]
+---
+
+Write me a commit message for this diff.
+
+```diff
+diff --git a/src/orders.js b/src/orders.js
+--- a/src/orders.js
++++ b/src/orders.js
+@@ -12,3 +12,9 @@ function listOrders(db) {
+   return db.query('SELECT * FROM orders ORDER BY created_at DESC');
+ }
+-module.exports = { listOrders };
++function pageOrders(db, page, size) {
++  const rows = db.query('SELECT * FROM orders ORDER BY created_at DESC');
++  const start = (page - 1) * size;
++  return rows.slice(start, start + size);
++}
++
++module.exports = { listOrders, pageOrders };
+```

package/evals/zh-CN/cases/i3-api-and-interface-design.json

@@ -0,0 +1,46 @@
+{
+  "skill_name": "i3-api-and-interface-design",
+  "trigger": {
+    "positive": [
+      {
+        "prompt": "为短链接服务设计创建、解析与统计接口，给出稳定的 API 契约。",
+        "top_k": 1
+      },
+      {
+        "prompt": "这两个模块之间如何定义类型契约和公共接口？",
+        "top_k": 1
+      },
+      {
+        "prompt": "请设计 REST 端点和前后端接口边界。",
+        "top_k": 1
+      }
+    ],
+    "negative": [
+      {
+        "prompt": "注册表单提交没反应，请在真实浏览器检查 DOM、控制台和网络请求。",
+        "owner": "i3-browser-testing-with-devtools"
+      },
+      {
+        "prompt": "请对这个 PR 做代码审查，检查正确性、可读性、架构、安全与性能。",
+        "owner": "i3-code-review-and-quality"
+      }
+    ]
+  },
+  "evals": [
+    {
+      "id": 1001,
+      "prompt": "为短链接服务设计公共 API，包括创建、解析、统计，并给出端点契约。",
+      "expected_output": "Endpoint contracts with methods, paths, request/response shapes, and explicit error semantics",
+      "files": [
+        "i3-api-and-interface-design"
+      ],
+      "expectations": [
+        "Error responses are specified with status codes and a consistent error shape, not just happy paths",
+        "Input validation at the boundary is addressed for user-supplied URLs",
+        "Versioning or compatibility strategy is stated",
+        "The response does not silently invent unstated requirements",
+        "人类可读的追问、说明、进度、报告与生成文档使用简体中文；保留代码、路径、工具参数、JSON 协议及机器状态的原始格式。"
+      ]
+    }
+  ]
+}

package/evals/zh-CN/cases/i3-browser-testing-with-devtools.json

@@ -0,0 +1,45 @@
+{
+  "skill_name": "i3-browser-testing-with-devtools",
+  "trigger": {
+    "positive": [
+      {
+        "prompt": "注册表单提交没反应，请在真实浏览器检查 DOM、控制台和网络请求。",
+        "top_k": 1
+      },
+      {
+        "prompt": "用 Chrome DevTools MCP 检查页面视觉结果与运行时错误。",
+        "top_k": 1
+      },
+      {
+        "prompt": "请打开浏览器复现这个按钮问题，并记录控制台与网络证据。",
+        "top_k": 1
+      }
+    ],
+    "negative": [
+      {
+        "prompt": "为项目配置 CI/CD 流水线，自动运行构建和测试。",
+        "owner": "i3-ci-cd-and-automation"
+      },
+      {
+        "prompt": "这个函数行为正确但太复杂，请在不改变行为的前提下简化。",
+        "owner": "i3-code-simplification"
+      }
+    ]
+  },
+  "evals": [
+    {
+      "id": 1001,
+      "prompt": "注册表单可以显示，但提交似乎没有反应。请在真实浏览器验证实际行为并报告发现。",
+      "expected_output": "Runtime evidence from the browser: console errors, network activity, DOM state, and a diagnosis",
+      "files": [
+        "i3-browser-testing-with-devtools"
+      ],
+      "expectations": [
+        "Findings are grounded in observed runtime data (console, network, DOM), not static code reading alone",
+        "The report distinguishes what was observed from what is inferred",
+        "A concrete next step or fix hypothesis is provided",
+        "人类可读的追问、说明、进度、报告与生成文档使用简体中文；保留代码、路径、工具参数、JSON 协议及机器状态的原始格式。"
+      ]
+    }
+  ]
+}

package/evals/zh-CN/cases/i3-ci-cd-and-automation.json

@@ -0,0 +1,46 @@
+{
+  "skill_name": "i3-ci-cd-and-automation",
+  "trigger": {
+    "positive": [
+      {
+        "prompt": "为项目配置 CI/CD 流水线，自动运行构建和测试。",
+        "top_k": 1
+      },
+      {
+        "prompt": "每次 PR 执行 lint 和测试，失败必须阻止合并。",
+        "top_k": 1
+      },
+      {
+        "prompt": "请调整持续集成部署流程，增加自动化质量门禁。",
+        "top_k": 1
+      }
+    ],
+    "negative": [
+      {
+        "prompt": "请对这个 PR 做代码审查，检查正确性、可读性、架构、安全与性能。",
+        "owner": "i3-code-review-and-quality"
+      },
+      {
+        "prompt": "为项目制定覆盖率、性能和无障碍质量门槛，写入 CONSTRAINTS.md。",
+        "owner": "i3-constraint-driven-development"
+      }
+    ]
+  },
+  "evals": [
+    {
+      "id": 1001,
+      "prompt": "为 Node 项目创建 CI 流水线：每次 PR 安装依赖、执行 lint 和测试，失败时阻止合并。",
+      "expected_output": "A working workflow definition with correct triggers, steps, and failure behavior",
+      "files": [
+        "i3-ci-cd-and-automation"
+      ],
+      "expectations": [
+        "The workflow triggers on pull requests",
+        "Failure of any quality gate fails the pipeline run",
+        "Steps are ordered logically and cache or setup steps are sane",
+        "No secrets are hardcoded in the workflow",
+        "人类可读的追问、说明、进度、报告与生成文档使用简体中文；保留代码、路径、工具参数、JSON 协议及机器状态的原始格式。"
+      ]
+    }
+  ]
+}

package/evals/zh-CN/cases/i3-code-review-and-quality.json

@@ -0,0 +1,46 @@
+{
+  "skill_name": "i3-code-review-and-quality",
+  "trigger": {
+    "positive": [
+      {
+        "prompt": "请对这个 PR 做代码审查，检查正确性、可读性、架构、安全与性能。",
+        "top_k": 1
+      },
+      {
+        "prompt": "合并前评审这份 diff，按严重程度报告代码质量问题。",
+        "top_k": 1
+      },
+      {
+        "prompt": "这次提交的代码改动是否有可读性和接口一致性问题？请做评审。",
+        "top_k": 1
+      }
+    ],
+    "negative": [
+      {
+        "prompt": "这个函数行为正确但太复杂，请在不改变行为的前提下简化。",
+        "owner": "i3-code-simplification"
+      },
+      {
+        "prompt": "代理新会话忘记项目约定，请优化上下文和规则文件。",
+        "owner": "i3-context-engineering"
+      }
+    ]
+  },
+  "evals": [
+    {
+      "id": 1001,
+      "prompt": "审查提供的用户搜索端点 diff，给出结构化代码评审。",
+      "expected_output": "A multi-axis review with severity-labelled findings and file:line references",
+      "files": [
+        "i3-code-review-and-quality"
+      ],
+      "expectations": [
+        "Findings cover more than one axis (correctness, readability, architecture, security, performance)",
+        "Every finding carries a severity label from the skill's taxonomy",
+        "Security of user input is explicitly considered for the new endpoint",
+        "The review leads with high-leverage findings rather than nits",
+        "人类可读的追问、说明、进度、报告与生成文档使用简体中文；保留代码、路径、工具参数、JSON 协议及机器状态的原始格式。"
+      ]
+    }
+  ]
+}